joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001d30
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x10005638]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x10001e21
mov eax, dword [0x10005630]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10001d75
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10001d58
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x10001e21
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10001a90
mov ecx, dword [0x10005638]
add esp, 4
cmp esi, ecx
jae 0x10001dd5
imul edi, esi, 0x2c
mov eax, dword [0x10005630]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10001dca
mov edx, ebx
mov ecx, esi
call fcn.10001c30
mov dword [ebp - 4], eax
test eax, eax
jne 0x10001dd2
mov ecx, dword [0x10005638]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10001da1
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10001e21
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10001e12
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10001e06
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10001de5
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10005614]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002120
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10005040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.10001e30
cmp dword [0x10005614], edi
je 0x100022bb
mov edx, dword [0x10005638]
xor esi, esi
test edx, edx
je 0x1000216c
mov ecx, dword [0x10005630]
mov eax, ecx
nop dword [eax]
cmp ebx, dword [eax]
je 0x10002176
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10002160
mov edi, 4
jmp 0x100022c0
cmp esi, 0xffffffff
je 0x1000216c
imul ebx, esi, 0x2c
mov dword [ebp - 0x10], ebx
test byte [ebx + ecx + 0x14], 2
je 0x10002237
push 0
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.10001a90
mov edi, dword [0x10005630]
add esp, 4
add edi, ebx
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100021d5
lea edi, [eax + 0xa]
jmp 0x1000221e
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x100021f0
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x100021f6
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
xor edi, edi
lea ecx, [ebp - 0x1c]
call fcn.10001be0
test edi, edi
jne 0x100022c0
mov ecx, dword [0x10005630]
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebx + ecx + 8]
call fcn.10001150
mov eax, dword [0x10005638]
lea edx, [eax - 1]
cmp esi, edx
jae 0x1000227c
mov ecx, dword [0x10005630]
imul eax, eax, 0x2c
movups xmm0, xmmword [eax + ecx - 0x2c]
movups xmmword [ebx + ecx], xmm0
movups xmm0, xmmword [eax + ecx - 0x1c]
movups xmmword [ebx + ecx + 0x10], xmm0
movq xmm0, qword [eax + ecx - 0xc]
movq qword [ebx + ecx + 0x20], xmm0
mov eax, dword [eax + ecx - 4]
mov dword [ebx + ecx + 0x28], eax
mov eax, dword [0x10005634]
shr eax, 1
mov dword [0x10005638], edx
cmp eax, 0x20
jb 0x100022c0
cmp eax, edx
jb 0x100022c0
imul eax, eax, 0x2c
push eax
push dword [0x10005630]
push 0
push dword [0x10005614]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x100022c0
shr dword [0x10005634], 1
mov dword [0x10005630], eax
jmp 0x100022c0
mov edi, 2
xor ecx, ecx
mov eax, 0x10005610
xchg dword [eax], ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002622
mov esp, ebp
pop ebp
ret
Function at 0x4020d4
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x4020ec
push dword [esp + 4]
push 0x40206d
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x402129
push esi
mov esi, dword [0x404490]
test esi, esi
je 0x402128
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x402120
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
push edi
push 0x404490
call fcn.00402716
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x4020f9
pop edi
pop ebx
pop esi
ret 4
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0xbb8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xbb81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbb807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbb806a
add dl, dl
jne 0xbb8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbb80dc
xor eax, eax
add dl, dl
jne 0xbb8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbb817d
add dl, dl
jne 0xbb80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbb80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbb8075
mov eax, 1
add dl, dl
jne 0xbb80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbb80e1
sub eax, ebx
mov ebx, 1
jne 0xbb8128
mov ecx, 1
add dl, dl
jne 0xbb810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbb8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbb8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbb8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbb813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbb814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbb8136
cmp eax, 0x7d00
jae 0xbb816d
cmp eax, 0x500
jb 0xbb8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbb8075
cmp eax, 0x7f
ja 0xbb8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbb8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbb819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbb8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404880
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3e0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push 0x53a1dc
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x40493a
lea eax, [ebp - 0xc10]
push eax
push 0
push 0
push 0x8005
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x40493a
lea eax, [ebp - 0xc10]
call fcn.00403ab8
mov ebx, eax
test ebx, ebx
je 0x4048ee
cmp byte [ebp + ebx - 0xc11], 0x5c
je 0x4048f7
mov byte [ebp + ebx - 0xc10], 0x5c
inc ebx
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, 0x53a1dc
call fcn.00404860
mov ecx, dword [ebp - 0xc]
inc ecx
lea edx, [ebp + ebx - 0xc10]
mov eax, dword [ebp - 0x10]
call sub.rtl160.bpl__System_Move_qqrpxvpvi
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0xc10]
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x404a6e
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
lea edx, [ebp - 0x410]
mov eax, 0x404a78
mov ecx, 2
call fcn.00403da0
mov ebx, eax
mov eax, 0x404a7c
mov ecx, 0x20
mov edx, ebx
call fcn.00403da0
mov ebx, eax
lea eax, [ebp - 0xc20]
push eax
call sub.kernel32.dll_GetLocalTime
movzx eax, word [ebp - 0xc20]
mov edx, ebx
call fcn.00403cf0
mov ebx, eax
mov byte [ebx], 0x2f
inc ebx
movzx eax, word [ebp - 0xc1e]
mov edx, ebx
call fcn.00403cf0
mov ebx, eax
mov byte [ebx], 0x2f
inc ebx
movzx eax, word [ebp - 0xc1a]
mov edx, ebx
call fcn.00403cf0
mov ebx, eax
mov byte [ebx], 0x20
inc ebx
movzx eax, word [ebp - 0xc18]
mov edx, ebx
call fcn.00403cf0
mov ebx, eax
mov byte [ebx], 0x3a
inc ebx
cmp word [ebp - 0xc16], 0xa
jae 0x4049e3
mov byte [ebx], 0x30
inc ebx
movzx eax, word [ebp - 0xc16]
mov edx, ebx
call fcn.00403cf0
mov ebx, eax
mov byte [ebx], 0x3a
inc ebx
cmp word [ebp - 0xc14], 0xa
jae 0x404a05
mov byte [ebx], 0x30
inc ebx
movzx eax, word [ebp - 0xc14]
mov edx, ebx
call fcn.00403cf0
mov ebx, eax
mov eax, 0x404a7c
mov ecx, 0x20
mov edx, ebx
call fcn.00403da0
mov ebx, eax
mov eax, 0x404a78
mov ecx, 2
mov edx, ebx
call fcn.00403da0
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
sub ebx, eax
push ebx
lea eax, [ebp - 0x410]
push eax
push esi
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_WriteFile
push esi
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404ac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
mov eax, 0x53a1dc
call fcn.00403ad4
mov ebx, eax
test ebx, ebx
jbe 0x404b62
mov eax, dword [0x532818]
call fcn.00403ab8
mov ecx, eax
inc ecx
lea edx, [ebx + 0x53a1d8]
mov eax, dword [0x532818]
call sub.rtl160.bpl__System_Move_qqrpxvpvi
push 0x3ff
lea eax, [ebp - 0x808]
push eax
push 0x404b68
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
test ebx, ebx
jbe 0x404b62
cmp byte [ebp + ebx - 0x809], 0x5c
je 0x404b2a
mov byte [ebp + ebx - 0x808], 0x5c
inc ebx
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, 0x53a1dc
call fcn.00404860
mov ecx, dword [ebp - 8]
inc ecx
lea edx, [ebp + ebx - 0x808]
mov eax, dword [ebp - 4]
call sub.rtl160.bpl__System_Move_qqrpxvpvi
mov edx, 0x53a1dc
lea eax, [ebp - 0x808]
mov ecx, 0x3ff
call sub.rtl160.bpl__System_Move_qqrpxvpvi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4076c4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
xor ebx, ebx
cmp dword [0x53ac90], 0
je 0x40775d
cmp byte [0x53ac8c], 0
je 0x407712
push 0x407764
call sub.kernel32.dll_OutputDebugStringA
lea edx, [ebp - 0x400]
mov eax, 0x407784
call fcn.00403afc
lea edx, [ebp - 0x400]
mov eax, 0x407764
call fcn.00403dec
jmp 0x40775d
call sub.rtl160.bpl__System_IsMemoryManagerSet_qqrv
test al, al
jne 0x40775d
lea eax, [ebp - 0x428]
call sub.rtl160.bpl__System_GetHeapStatus_qqrv
cmp dword [ebp - 0x41c], 0
je 0x40775b
push 0x407798
call sub.kernel32.dll_OutputDebugStringA
lea edx, [ebp - 0x400]
mov eax, 0x407980
call fcn.00403afc
lea edx, [ebp - 0x400]
mov eax, 0x407798
call fcn.00403dec
jmp 0x40775d
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c24
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl160.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x408cdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30]
call sub.rtl160.bpl__System__DynArrayLength_qqrpxv
mov esi, eax
cmp dword [ebp - 4], 0
jne 0x408c6c
test esi, esi
jle 0x408c6c
lea eax, [ebp - 4]
lea edx, [esi + esi*2]
mov ecx, dword [ebx + 0x30]
mov edx, dword [ecx + edx*8 - 8]
call sub.rtl160.bpl__System__LStrLAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
lea eax, [esi + 1]
push eax
lea eax, [ebx + 0x30]
mov ecx, 1
mov edx, dword [0x408434]
call sub.rtl160.bpl__System__DynArraySetLength_qqrv
add esp, 4
lea edi, [esi + esi*2]
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x38]
mov dword [eax + edi*8], edx
mov edx, dword [ebx + 0x3c]
mov dword [eax + edi*8 + 4], edx
mov eax, dword [ebx + 0x30]
mov edx, dword [ebp + 8]
mov dword [eax + edi*8 + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + edi*8 + 0xc], edx
mov eax, dword [ebx + 0x30]
lea eax, [eax + edi*8 + 0x10]
mov edx, dword [ebp - 4]
call sub.rtl160.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add dword [ebx + 0x38], eax
adc dword [ebx + 0x3c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ce2
lea eax, [ebp - 4]
call sub.rtl160.bpl__System__LStrClr_qqrpv
ret
Function at 0x40b2b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x40b354
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call sub.rtl160.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x40b2de
cmp byte [esp], 0
je 0x40b323
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x40b360
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
push eax
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call sub.rtl160.bpl__System_Move_qqrpxvpvi
mov edx, ebx
mov eax, edi
xor ecx, ecx
call sub.rtl160.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
jmp 0x40b360
mov eax, edi
mov edx, 0x40b374
call sub.rtl160.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b378
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x40b41b
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call sub.rtl160.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringU_qqrr20System_UnicodeString
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x40b3a0
cmp byte [esp], 0
je 0x40b3e9
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringU_qqrr20System_UnicodeString
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x40b427
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringU_qqrr20System_UnicodeString
push eax
mov eax, edi
call sub.rtl160.bpl__System__UniqueStringU_qqrr20System_UnicodeString
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call sub.rtl160.bpl__System_Move_qqrpxvpvi
mov edx, ebx
mov eax, edi
call sub.rtl160.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
jmp 0x40b427
mov eax, edi
mov edx, 0x40b43c
call sub.rtl160.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40c2ec
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp byte [0x532a88], 0
jne 0x40c320
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x40c319
movzx eax, byte [esp]
mov byte [0x532a88], al
jmp 0x40c320
mov byte [0x532a88], 0x2c
movzx eax, byte [0x532a88]
pop edx
ret

Function at 0x40c930
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call sub.rtl160.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov eax, ebx
call sub.rtl160.bpl__System_UniqueString_qqrr27System__AnsiStringT_us_i0__
mov eax, dword [ebx]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x40c958
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x40c96c
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x40c961
pop edx
pop esi
pop ebx
ret
Function at 0x40dcec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40de9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call sub.rtl160.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call sub.rtl160.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40de7c
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 8]
call sub.rtl160.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40de7c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x40deb0
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40ddc1
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x40dd92
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x40ddc1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, esi
call dword [0x532af8]
jmp 0x40de7c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40deb4
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40de7c
cmp dword [ebp - 0x14], 0
je 0x40de7c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x40dedc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp - 0x14]
movzx edx, word [edx]
shl edx, 0x10
or eax, edx
mov cl, 0x30
mov edx, 8
call fcn.0040bbdc
mov eax, dword [ebp - 0x24]
mov ecx, 0x7fffffff
mov edx, 2
call sub.rtl160.bpl__System__LStrCopy_qqrx27System__AnsiStringT_us_i0__ii
push dword [ebp - 0x20]
push 0x40defc
lea eax, [ebp - 0x1c]
mov edx, 3
call sub.rtl160.bpl__System__LStrCatN_qqrv
mov eax, dword [ebp - 0x1c]
call sub.rtl160.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40de7c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov ecx, 0
call sub.rtl160.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
mov eax, dword [ebp - 0x28]
mov ebx, dword [0x536a00]
mov ebx, dword [ebx]
mov edx, esi
call ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dea6
lea eax, [ebp - 0x28]
mov edx, 4
call sub.rtl160.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl160.bpl__System__LStrClr_qqrpv
ret
Function at 0x40e1a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0x40
push 0x1000
push 0x11
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov dword [ebp - 4], ebx
mov eax, ebx
mov byte [eax], 0x58
mov byte [eax + 1], 0x68
mov dword [eax + 2], esi
mov byte [eax + 6], 0x50
mov byte [eax + 7], 0xff
mov byte [eax + 8], 0x25
lea edx, [eax + 0xd]
mov dword [eax + 9], edx
mov dword [eax + 0xd], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40ec18
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x40ec60
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x40ec56
cmp word [edi], 0x5a4d
jne 0x40ec56
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x40ec56
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40ec6c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40ee04
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x532b0c], 0
jne 0x40eee5
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x40ee57
push 0x10000
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov esi, eax
jmp 0x40ee88
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x40eee5
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x40eeb3
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x40eec5
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x40eedf
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
ret