joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018b5b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [ebp + 0x18], 0
push ebx
push esi
mov esi, ecx
mov byte [ebp - 8], dl
push edi
mov dword [ebp - 0x10], esi
je 0x10018bb1
test dl, dl
je 0x10018ba2
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10018c6a
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xf3f6
inc dword [edx]
cmp dword [edx], 1
jl 0x10018b8b
jmp 0x10018c6a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10018c6a
mov dword [ebp - 0xc], 0x6d93
cmp dword [ebp - 0xc], 0x709f
jle 0x10018c26
xor edi, edi
xor ebx, ebx
xor esi, esi
xor eax, eax
mov dword [ebp + 0x18], eax
add eax, esi
lea ecx, [ebp - 0x28]
and eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018be7
mov eax, dword [eax]
push eax
call fcn.10048785
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10003cd4
mov eax, dword [ebp + 0x18]
inc eax
mov dword [ebp + 0x18], eax
cmp eax, 0x749c
jl 0x10018bcc
inc esi
cmp esi, 0x2b6f
jl 0x10018bc7
inc ebx
cmp ebx, 0x5422
jl 0x10018bc5
inc edi
cmp edi, 0x6287
jl 0x10018bc3
mov esi, dword [ebp - 0x10]
cmp dword [ebp - 0xc], 0x6be2
jge 0x10018c3a
push str.krydarqrj_dkggrp_swti
call fcn.10048785
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10018c4a
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x10018c6a
mov dword [esi], 0
cmp dword [esi], 3
jge 0x10018c6a
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x540d7f82
inc dword [esi]
cmp dword [esi], 3
jl 0x10018c58
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100196b9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100616d6
call fcn.10060a78
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0xc61
cmp dword [ebp - 0x20], 0xf4f
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
jle 0x10019740
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x24], 0
mov dword [ebp - 0x14], ebx
xor ebx, esi
mov esi, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, esi
mov ecx, 0x1007bad8
or eax, ebx
cdq
push edx
push eax
call fcn.1000380d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x29b8
jl 0x100196fa
inc esi
cmp esi, 0x452b
jl 0x100196f5
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x3980
jl 0x100196e9
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x588a
jl 0x100196e4
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xbf8
jge 0x1001975c
mov edx, str.vqhan_iukdmedzh_vvctvaz_onu_tazhyehj_ygisvbc_kiqryhgr_adnnarw_aal_awd_xsm
mov ecx, 0x1007bad8
call fcn.10005a21
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10019831
mov dword [ebp - 0x1c], 0x92f
cmp dword [ebp - 0x1c], 0xaa4
jle 0x100197cb
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ebp - 0x20], eax
and eax, ecx
lea ecx, [ebx + esi]
or eax, ecx
mov ecx, 0x1007bad8
cdq
push edx
push eax
call fcn.1000380d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x7cd9
jl 0x10019788
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x2d02
jl 0x10019783
inc ebx
cmp ebx, 0x52ed
jl 0x1001977e
inc esi
cmp esi, 0x6546
jl 0x1001977c
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x5f1
jge 0x100197ea
mov edx, str.yueabv_zmdb_mhdpe_fuvzyd_srdhfkdo
mov ecx, 0x1007bad8
call fcn.10005a21
mov eax, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x10019851
call fcn.1001adf5
jmp 0x10019851
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10019851
mov esi, dword [ebp - 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 1
jl 0x10019842
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019904
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0x375a
cmp dword [ebp - 0xc], 0x3ae2
push 1
pop ebx
jle 0x10019985
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], eax
add eax, ebx
lea ecx, [ebp - 0x24]
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10019946
mov eax, dword [eax]
push eax
call fcn.10048785
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.10003cd4
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x583e
jl 0x1001992b
inc ebx
cmp ebx, 0x994
jl 0x10019926
inc edi
cmp edi, 0x2532
jl 0x10019924
inc esi
cmp esi, 0x3c9d
jl 0x10019922
xor ebx, ebx
inc ebx
cmp dword [ebp - 0xc], 0x3470
jge 0x10019999
push str.lwaan_zsipfrlg_zmwedxkdq_uxkhwvjx_jzccl_rdcpzffd
call fcn.10048785
pop ecx
cmp byte [ebp + 0x1c], 0
je 0x10019a25
mov dword [ebp - 0xc], 0x6f34
cmp dword [ebp - 0xc], 0x7150
jle 0x10019a07
push 0x2407
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x3c]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100199db
mov eax, dword [eax]
push eax
call fcn.10048785
pop ecx
push 0
push ebx
lea ecx, [ebp - 0x3c]
call fcn.10003cd4
inc edi
cmp edi, 0x4051
jl 0x100199c2
inc esi
cmp esi, 0x384b
jl 0x100199c0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [ebp - 0xc], 0x6e8f
jge 0x10019a8a
push str.afx_qdxz_uey
call fcn.10048785
pop ecx
jmp 0x10019a8a
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [esi]
cmp dword [eax], ecx
mov eax, dword [ebp + 8]
setne cl
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [esi]
mov edx, dword [eax]
xor eax, eax
test edx, edx
setne al
xor ecx, ecx
neg eax
cmp edx, eax
sete cl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setne al
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
sub edx, eax
mov eax, dword [esi]
mov esi, dword [eax]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
cmp edx, eax
setge cl
add ecx, 0x4a9f6a25
cmp ecx, esi
jle 0x10019a81
test esi, esi
jne 0x10019a83
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [eax], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a3b7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, ecx
cmp byte [ebp + 8], 0
push esi
push edi
je 0x1001a3ed
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001a466
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xad59e57a
inc dword [edx]
cmp dword [edx], 2
jl 0x1001a3d9
jmp 0x1001a466
mov dword [ebp - 8], 0x3a8f
cmp dword [ebp - 8], 0x3bd3
jle 0x1001a43f
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a41a
mov eax, dword [eax]
push eax
call fcn.10048785
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.10003cd4
inc edi
cmp edi, 0x6912
jl 0x1001a401
inc esi
cmp esi, 0x7329
jl 0x1001a3ff
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1001a452
push 0x2407
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [ebp - 8], 0x38c3
jge 0x1001a466
push str.iyvxub_dlofzfscj_etuxzozwf_jtp_unfzif_jxey_zag_zuh_oiewcf_rfob_kdeoprje
call fcn.10048785
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10023095
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061b1e
call fcn.10060a78
sub esp, 0x38
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10023185
mov dword [ebp - 0x28], 0x4fbc
cmp dword [ebp - 0x28], 0x5330
jle 0x1002311e
xor esi, esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x20], edi
mov ecx, edi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
mov dword [ebp - 0x1c], 0x153a
mov eax, edi
mov ecx, 0x1007bad8
xor eax, esi
cdq
push edx
push eax
call fcn.1000380d
add edi, ebx
dec dword [ebp - 0x1c]
jne 0x100230df
inc ebx
cmp ebx, 0x546e
jl 0x100230d6
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x305c
jl 0x100230cd
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x4347
jl 0x100230c8
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4e47
jge 0x1002313a
mov edx, str.impkrz_tkfgt_rdrhg_jgaxm_srtuywp_toaxoyjy_iof_nqyyd_umlpls_xwvzb
mov ecx, 0x1007bad8
call fcn.10005a21
or dword [ebp - 4], 0xffffffff
mov edx, 0x231b
push ecx
lea ecx, [ebp - 0x40]
call fcn.1002c206
push ecx
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], 2
call fcn.1000600c
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100041df
jmp 0x10023196
push 0
push 0
push 0x1634
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100231a7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov dword [esp + 8], 0x4687
cmp dword [esp + 8], 0x482f
push esi
push edi
jle 0x1002324d
xor esi, esi
mov dword [esp + 0xc], esi
xor edi, edi
mov ecx, edi
mov dword [esp + 0x14], esi
xor ebx, ebx
shl esi, cl
mov ecx, ebx
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100231f7
mov eax, dword [eax]
push eax
call fcn.10048785
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10003cd4
inc ebx
cmp ebx, 0x62b
jl 0x100231db
mov esi, dword [esp + 0xc]
inc edi
cmp edi, 0x6e58
jl 0x100231d1
inc esi
mov dword [esp + 0xc], esi
cmp esi, 0x4217
jl 0x100231cf
push 0x1737
push 0xecf
push 0x12e9
push 0x258c
push 0x177
call dword [sym.imp.GDI32.dll_IntersectClipRect]
cmp dword [esp + 0x10], 0x44dd
jge 0x10023262
push str.ktwrqncp_ateub_jzth_oczrxdiy_sxofs_jwvque_ikvavma_yninbfm_mdlano_rwhhqgny
call fcn.10048785
pop ecx
cmp byte [ebp + 0x14], 0
je 0x10023282
push 0x1506
push 0
push 0
push 0
push 0
push 0xeb7
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100232a5
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100232a5
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc0272a72
inc dword [edx]
cmp dword [edx], 2
jl 0x10023293
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025c83
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061c8e
call fcn.10060a78
sub esp, 0xc
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], edx
je 0x10025d81
cmp byte [ebp + 0x40], 0
je 0x10025d51
mov ebx, dword [ebp + 0x34]
xor edi, edi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx]
sub eax, dword [ebx]
je 0x10025cc8
cmp dword [edx], edi
je 0x10025cc8
xor eax, eax
inc eax
mov ecx, eax
jmp 0x10025ccd
xor eax, eax
mov ecx, edi
inc eax
cmp eax, ecx
mov esi, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x10]
sbb eax, eax
inc eax
imul eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [ecx]
mov eax, dword [esi]
mov eax, dword [edx]
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, dword [edx]
xor edx, edx
mov eax, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x3c]
add eax, 6
mov dword [ecx], eax
mov eax, dword [esi]
mov eax, dword [ebx]
mov eax, dword [ecx]
mov eax, dword [ebx]
test eax, eax
mov eax, dword [ebp + 0x20]
setne dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [esi]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 0x20]
sete dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [esi]
setne cl
sub eax, ecx
mov ecx, dword [ebp + 0x24]
mov dword [ecx], eax
mov eax, dword [ebx]
cmp dword [ecx], eax
jle 0x10025d3d
cmp dword [ebx], edi
je 0x10025d40
xor edi, edi
inc edi
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
sub edi, eax
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
jmp 0x10025e3a
mov eax, dword [ebp + 0x28]
push 0x1a
pop edi
mov ecx, dword [eax]
cmp ecx, edi
jge 0x10025d67
mov eax, dword [ebp + 0x44]
movzx edx, word [eax]
add edx, ecx
jmp 0x10025d74
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 0x1c]
movzx eax, word [eax]
add edx, eax
push edx
mov ecx, esi
call fcn.10014663
jmp 0x10025e3a
cmp byte [ebp + 0x38], 0
je 0x10025e20
mov dword [ebp + 0x14], 0x332a
cmp dword [ebp + 0x14], 0x3420
jle 0x10025dd6
push 0x469
push 0x15fb
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor edi, edi
mov esi, edi
mov ebx, edi
mov eax, ebx
mov ecx, 0x1007bad8
xor eax, esi
cdq
push edx
push eax
call fcn.1000380d
inc ebx
cmp ebx, 0x2afc
jl 0x10025db1
inc esi
cmp esi, 0x1214
jl 0x10025daf
jmp 0x10025dd8
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], 0x3026
jge 0x10025df3
mov edx, str.mly_wkat_jfrx_nkhm_larlmpxa_aearj_bqvltjp_ygpihrsku_dzi_qzbtsmfg_vyw_fjcnwh_hmjsx_psxb
mov ecx, 0x1007bad8
call fcn.10005a21
mov eax, dword [ebp + 0x30]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x2c]
push dword [eax]
call fcn.10005e84
jmp 0x10025e3a
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10025e3a
push 0xdb
push 0x32b
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100272a8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100272bf
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100272e1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007d194
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007d520
jl 0x100272ef
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007d7c4
jl 0x1002732f
mov ecx, dword [0x1007e510]
xor ecx, dword [0x1007d194]
and ecx, edi
xor ecx, dword [0x1007e510]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007d190], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007d7c4]
mov dword [0x1007db50], eax
pop esi
ret

Function at 0x100273a1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
mov byte [esp + 4], cl
push esi
push edi
mov edi, edx
test cl, cl
je 0x100273cd
push 0x1506
xor edx, edx
push edx
push edx
push edx
push edx
push 0xeb7
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10027414
mov edx, dword [ebp + 0x10]
mov eax, dword [edi]
mov esi, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [edx]
mov ecx, dword [edi]
sub ecx, eax
je 0x100273e3
mov eax, dword [edx]
mov eax, dword [esi]
mov eax, dword [esi]
xor edx, edx
mov eax, dword [esi]
mov eax, dword [ebp + 0x14]
push 0
mov eax, dword [eax]
mov ecx, dword [esi]
mov eax, dword [edi]
cmp ecx, eax
sete dl
cmp edx, dword [edi]
pop edx
je 0x10027403
cmp dword [esi], edx
je 0x10027403
inc edx
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp + 8]
setl cl
mov dword [eax], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0xdb430c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb4316
pushal
call 0xdb431c
pop ebp
sub ebp, 0x10
sub ebp, 0x9b430c
jmp 0xdb4332
mov eax, 0x9b430c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0xe3db8640
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb4349
jmp 0xdb435c
retf
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x6db008], 0x8088405
inc edx
mov dword [ebx + 0x6db008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x6bf58e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bf595
ret