joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411b04
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x2c
mov dword [esp], edx
call sub.msvcrt.dll__fileno
mov dword [esp + 4], 0x8000
mov edi, dword [sym.imp.msvcrt.dll__setmode]
mov dword [esp], eax
call edi
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.004219b0
inc edx
jne 0x411b57
inc eax
jne 0x411b57
mov dword [esp], str.lseek__
call sub.msvcrt.dll_perror
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0x4319c0
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
jne 0x411b88
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x411b57
mov dword [esp], str.read__
jmp 0x411bb5
test eax, eax
js 0x411b7f
je 0x411bc6
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 0x4319c0
call sub.msvcrt.dll_fwrite
test eax, eax
jne 0x411bbc
mov dword [esp], str.fwrite__
call sub.msvcrt.dll_perror
jmp 0x411bc6
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
jmp 0x411b57
mov dword [esp], ebx
call sub.msvcrt.dll__fileno
mov ecx, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x412667
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
movzx edx, byte [ebx]
mov edi, ebx
inc ebx
mov eax, edx
test byte [edx + edx + 0x4312c0], 6
jne 0x412678
cmp dl, 0x3a
je 0x4126d8
jg 0x4126b5
cmp dl, 0x26
je 0x41270c
jg 0x4126aa
mov esi, 1
test dl, dl
je 0x412848
cmp dl, 0x21
jmp 0x4126ad
cmp dl, 0x2b
je 0x412739
jmp 0x412712
mov esi, 7
cmp dl, 0x3d
je 0x412848
cmp dl, 0x3f
je 0x412739
mov esi, 6
cmp dl, 0x3b
je 0x412848
jmp 0x412712
mov al, byte [edi + 1]
cmp al, 0x3d
je 0x41273f
mov esi, 4
cmp al, 0x3a
jne 0x412848
cmp byte [edi + 3], 0x3d
je 0x4126ff
lea ebx, [edi + 2]
mov esi, 5
jmp 0x412848
lea ebx, [edi + 3]
mov esi, 7
jmp 0x412848
cmp byte [edi + 1], 0x3a
je 0x412719
mov esi, 2
jmp 0x412761
cmp byte [edi + 2], 0x3a
je 0x41272c
lea ebx, [edi + 2]
mov esi, 8
jmp 0x412848
lea ebx, [edi + 3]
mov esi, 9
jmp 0x412848
cmp byte [edi + 1], 0x3d
jne 0x412712
lea ebx, [edi + 2]
jmp 0x412702
cmp al, 0x3a
je 0x41278a
jg 0x412773
cmp al, 0x26
je 0x412827
cmp al, 0x2b
je 0x4127ff
cmp al, 0x24
je 0x4127b4
mov al, byte [ebx]
inc ebx
movzx edx, al
test byte [edx + edx + 0x4312c0], 7
je 0x412744
jmp 0x412847
cmp al, 0x3f
je 0x4127ff
cmp al, 0x5c
je 0x412804
cmp al, 0x3d
jmp 0x41282a
mov eax, ebx
sub eax, edi
cmp eax, 2
je 0x4127a3
jle 0x412847
cmp byte [ebx - 3], 0x28
jne 0x412847
movzx eax, byte [ebx - 2]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
jmp 0x41282a
mov al, byte [ebx]
lea edx, [ebx + 1]
cmp al, 0x24
je 0x412832
test al, al
je 0x412845
cmp al, 0x28
je 0x4127d4
mov esi, 0x7d
cmp al, 0x7b
jne 0x412839
jmp 0x4127d9
mov esi, 0x29
mov ebx, edx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dl, byte [ebx]
test dl, dl
je 0x41283b
cmp dl, al
lea ebx, [ebx + 1]
jne 0x4127f2
inc dword [ebp - 0x1c]
jmp 0x4127e0
mov ecx, esi
cmp dl, cl
jne 0x4127e0
dec dword [ebp - 0x1c]
jns 0x4127e0
jmp 0x41283b
cmp byte [ebx], 0x3d
jmp 0x41282a
mov al, byte [ebx]
cmp al, 0x3d
je 0x412821
jg 0x412819
sub eax, 0x3a
cmp al, 1
ja 0x41275e
jmp 0x412821
cmp al, 0x5c
jne 0x41275e
inc ebx
jmp 0x41275e
cmp byte [ebx], 0x3a
jne 0x41275e
jmp 0x412847
mov ebx, edx
jmp 0x41275e
mov ebx, edx
mov esi, 3
jmp 0x41275e
mov ebx, edx
dec ebx
mov eax, dword [ebp - 0x20]
sub ebx, edi
mov dword [eax], edi
mov eax, dword [ebp - 0x24]
mov dword [eax], ebx
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413b47
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov al, byte [esi + 1]
cmp al, 0x2f
je 0x413b62
test al, al
je 0x413b62
xor eax, eax
jmp 0x413bda
xor eax, eax
mov dword [esp], str.__HOME_
mov edi, dword [0x431518]
mov dword [esp + 4], eax
mov dword [0x431518], eax
call fcn.004040d1
mov dword [0x431518], edi
mov ebx, eax
mov al, byte [eax]
mov edi, eax
test al, al
jne 0x413ba9
mov dword [esp], ebx
call fcn.004254f4
mov dword [esp], 0x42e0f9
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x413b5e
inc esi
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], 2
call fcn.004113e0
mov dword [esp], eax
call fcn.004114a4
mov edx, edi
test dl, dl
je 0x413bda
mov dword [esp], ebx
mov dword [ebp - 0x1c], eax
call fcn.004254f4
mov eax, dword [ebp - 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41d128
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
lea esi, [ebp - 0x11d]
push ebx
sub esp, 0x14c
mov dword [esp + 4], esi
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, eax
push ecx
push ecx
mov dword [ebp - 0x124], 0x6d745f65
mov dword [ebp - 0x128], 0x6b616d67
mov dword [ebp - 0x121], 0x66706d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x12c], eax
test ebx, ebx
jne 0x41d199
mov dword [esp + 4], esi
mov edi, 1
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edx
mov ebx, eax
push edx
mov eax, dword [0x434164]
inc eax
mov dword [0x434164], eax
cmp eax, 0xffff
jbe 0x41d1eb
cmp dword [0x434160], 0
jne 0x41d1eb
mov dword [0x434160], 1
mov dword [0x434164], 1
jmp 0x41d1eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x41d2a8
mov eax, dword [0x434164]
inc eax
mov dword [0x434164], eax
cmp eax, 0x10000
je 0x41d1ab
lea ecx, [ebx + 0x22]
mov eax, dword [0x434164]
cmp ecx, 0x104
ja 0x41d2f3
test ebx, ebx
je 0x41d2f3
cmp eax, 0xffff
ja 0x41d2e4
cmp byte [ebp + ebx - 0x11e], 0x5c
mov dword [esp + 0x14], eax
mov edx, 0x42f514
mov ecx, 0x42f515
mov eax, dword [ebp - 0x12c]
cmove ecx, edx
mov dword [esp + 4], str._s_s_u__x.tmp
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0xc], eax
lea eax, [esi + ebx]
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.0041cf44
xor eax, eax
mov dword [esp], esi
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], 0x4000180
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0010000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x41d1ca
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.msvcrt.dll__open_osfhandle]
jmp 0x41d309
cmp eax, 0xb7
je 0x41d1d9
test edi, edi
jne 0x41d2d6
mov dword [esp + 4], esi
mov edi, 1
mov dword [esp], 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebx, eax
push edx
push edx
jmp 0x41d1eb
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xd
jmp 0x41d306
cmp dword [0x434160], 0
je 0x41d212
jmp 0x41d2fa
cmp eax, 0xffff
jbe 0x41d306
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x11
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41d68f
Capabilities:
Check mutex on windows

Disassembly:
push ebp
xor eax, eax
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 1
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x434168], eax
sub esp, 0xc
test eax, eax
jne 0x41d700
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 2
mov ebx, eax
call dword [0x428f14]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.CreateMutex:_error__lu_n
mov dword [esp], eax
call fcn.0041cf95
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x27
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x41f860
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, edx
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
and ecx, 4
pop ebp
jmp fcn.0041eff0
Function at 0x420976
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
xor ebx, ebx
sub esp, 0x3c
mov eax, dword [0x43837c]
mov ecx, dword [0x438378]
add eax, 0xc
cmp ecx, ebx
jle 0x4209af
mov edx, dword [eax]
cmp edi, edx
jb 0x4209a9
mov esi, dword [eax + 4]
add edx, dword [esi + 8]
cmp edi, edx
jb 0x420a9c
inc ebx
add eax, 0x14
jmp 0x420991
mov dword [esp], edi
call fcn.0042114f
mov esi, eax
test eax, eax
jne 0x4209cd
mov dword [esp + 4], edi
mov dword [esp], str.Address__p_has_no_image_section
jmp 0x420a91
imul ebx, ebx, 0x14
mov eax, dword [0x43837c]
xor edx, edx
add eax, ebx
mov dword [eax], edx
mov dword [eax + 0x10], esi
call fcn.004211ff
mov edx, dword [0x43837c]
add eax, dword [esi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
jne 0x420a2f
mov eax, dword [0x43837c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [esi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0042092c
mov eax, dword [ebp - 0x20]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x420a96
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x420a96
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [ebp - 0x28]
cmove eax, edx
mov edx, dword [ebp - 0x34]
add ebx, dword [0x43837c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x420a96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0042092c
inc dword [0x438378]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x421074
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x421099
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x421099
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
pop ebp
ret

Function at 0x42109d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
cmp ebx, esi
jae 0x4210d1
mov edx, dword [eax + 0xc]
cmp ecx, edx
jb 0x4210cb
add edx, dword [eax + 8]
cmp ecx, edx
jb 0x4210d3
inc ebx
add eax, 0x28
jmp 0x4210b9
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x421304
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
xor ecx, ecx
mov dword [eax], ecx
test ebx, ebx
jne 0x42132d
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x42133d
cmp byte [ebx], 0
jne 0x421344
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
xor ebx, ebx
jmp 0x421427
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edx
cmp eax, 0xffffffff
jne 0x421360
call sub.msvcrt.dll__errno
mov dword [eax], 2
jmp 0x42133d
test al, 0x10
je 0x421332
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__fullpath
mov dword [esp], edi
call sub.msvcrt.dll_strlen
add eax, 0x233
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
jne 0x4213a6
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x42133d
lea esi, [eax + 0x22c]
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
cmp byte [ebx + 0x22c], 0
je 0x4213e8
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov al, byte [ebx + eax + 0x22b]
cmp al, 0x5c
je 0x4213e8
cmp al, 0x2f
je 0x4213e8
mov dword [esp + 4], 0x42fbf0
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x42fbf2
mov dword [esp], esi
call sub.msvcrt.dll_strcat
xor eax, eax
lea edx, [ebx + 0x120]
mov ecx, 0x41
mov dword [ebx + 0x228], eax
mov edi, edx
mov dword [ebx + 0x118], eax
mov dword [ebx + 0x11c], eax
xor eax, eax
mov dword [ebx + 0x224], 0xffffffff
rep stosd dword es:[edi], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x2e00202e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x2e00203d
pop dword [ebp - 0x40]
mov eax, 0x72393afb
sub eax, 0x44391abe
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x831376b7
add dword [ebp - 0x50], 0xcb3ece94
mov dword [ebp - 0x4c], 0xc9596d91
sub dword [ebp - 0x4c], 0x9726214c
mov dword [ebp - 0x48], 0xebc29184
sub dword [ebp - 0x48], 0x9f764d56
mov dword [ebp - 0x44], 0x860fe358
add dword [ebp - 0x44], 0x79f01ca8
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x4704af2
add dword [ebp - 0x50], 0x70021e64
mov dword [ebp - 0x4c], 0x2a0dc0ca
sub dword [ebp - 0x4c], 0xe8a15f55
mov dword [ebp - 0x48], 0xaf34385a
add dword [ebp - 0x48], 0xb43b3412
mov dword [ebp - 0x44], 0x3d1fa237
add dword [ebp - 0x44], 0xc2e05dc9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x4aab0721
sub eax, 0x1ca7d665
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x40f19
push 0
call eax
mov ecx, 0x6f3c4640
sub ecx, 0x6f3bffba
mov edx, eax
mov ebx, 0x76db95fd
sub ebx, 0x48d617fd
add ebx, dword [ebp - 0x40]
mov esi, 0x7c33b29d
sub esi, 0x80c1e983
xor dword [ebp - 0xc], ebx
mov edi, dword [ebx]
xor dword [ebp - 0x34], 0x7646490d
xor edi, esi
mov dword [edx], edi
mov dword [ebp - 8], 0x3f9cdd92
add edx, 0xebb3f80c
sub edx, 0xebb3f808
add ebx, 0x90d33367
add ebx, 0x6f2ccc9d
loop 0x2e00215a
add eax, 0x7af8282
add eax, 0xf8518a69
xor ebx, ebx
add ebx, eax
add eax, 0xae558b5
add eax, 0xf51aa750
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e00202e
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e00202e
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403e59
pop dword [ebp - 0x2c]
mov eax, 0x4b413c6
sub eax, 0x473d56d
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1ad012ed
sub dword [ebp - 0x3c], 0xcc7dcda2
mov dword [ebp - 0x38], 0x509abd13
add dword [ebp - 0x38], 0xe1988f32
mov dword [ebp - 0x34], 0xef0ad4e1
add dword [ebp - 0x34], 0x5d416f4d
mov dword [ebp - 0x30], 0x838371f9
add dword [ebp - 0x30], 0x7c7c8e07
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xe061d1dc
add eax, 0x1fdeaeb0
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4fa7b44
add dword [ebp - 0x3c], 0x6f77ee12
mov dword [ebp - 0x38], 0x1644a9cb
add dword [ebp - 0x38], 0x2b27b7aa
mov dword [ebp - 0x34], 0x39c59358
sub dword [ebp - 0x34], 0xd65626ec
mov dword [ebp - 0x30], 0x7f76a995
add dword [ebp - 0x30], 0x8089566b
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xfe6e311b
add eax, 0x1d24fb9
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37955
push 0
call eax
mov ecx, 0xd6d9fec6
sub ecx, 0xd6d9b36e
xor edi, edi
add edi, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x2c]
mov esi, 0xeda4010d
add esi, 0xf41cee32
xor dword [ebp - 0x20], 0x4e2c451a
mov edx, dword [ebx]
add edx, esi
sub dword [ebp - 0x24], ecx
mov dword [edi], edx
add edi, 0x1fd04280
sub edi, 0x1fd0427c
add ebx, 0xd448fa6a
sub ebx, 0xd448fa66
loop 0x403f77
add eax, 0x52d1edc5
sub eax, 0x52d0cd92
xor ebx, ebx
add ebx, eax
add eax, 0x61baf7ab
sub eax, 0x61baf7a6
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x8fb008], 0x8088405
inc edx
mov dword [ebx + 0x8fb008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x8df58e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8df595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x8e08f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x8fd54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x8fd54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x8fc378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8e08fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret