joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412938
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4129dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov dword [ebp - 0xc], eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 0x10]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4129f4
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xc]
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4129e3
lea eax, [ebp - 0x10]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41f594
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41f5f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41f5de
push 3
push 0x41f600
push 0x41f600
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41f604
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f5fb
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x424e94
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x424eb2
and ecx, ecx
jle 0x424eb2
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x424e9d
pop ebx
ret

Function at 0x425120
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x425143
and ecx, ecx
jle 0x425143
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x425149]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x425133
pop edi
pop ebx
ret
Function at 0x42796c
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call sub.rtl60.bpl__System__FillChar_qqrpvic
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0x60], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x64], 0x10325476
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], 0xc3d2e1f0
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], 0x76543210
mov eax, dword [ebp - 4]
mov dword [eax + 0x70], 0xfedcba98
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], 0x89abcdef
mov eax, dword [ebp - 4]
mov dword [eax + 0x78], 0x1234567
mov eax, dword [ebp - 4]
mov dword [eax + 0x7c], 0x3c2d1e0f
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00426ad8
pop ecx
pop ebp
ret
Function at 0x4330fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x20]
mov eax, dword [ebp - 8]
mov ecx, 0x20
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
dec eax
test eax, eax
jb 0x43326f
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x10
jae 0x433209
mov eax, dword [ebp - 0x10]
add eax, eax
mov edx, dword [ebp - 0xc]
shr edx, 1
and edx, 1
add eax, edx
shl eax, 7
lea eax, [eax*8 + 0x4401a0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
and eax, 0xff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
inc eax
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
mov eax, dword [ebp - 0xc]
add eax, 0xf
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
and eax, 0xff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
inc eax
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
mov eax, dword [ebp - 0xc]
add eax, 0xf
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jb 0x433153
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x4476a8]
mov dword [ebp - 0x18], eax
mov eax, 0x20
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
shr eax, cl
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov edx, dword [edx + ebx*4]
shl edx, cl
or eax, edx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jne 0x433226
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jne 0x433144
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x43313f
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0xf
sub eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
xor dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x433274
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ebx, dword [0x45620c]
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call ebx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x20], eax
mov ebx, dword [0x45620c]
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
call ebx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax]
mov eax, dword [ebp - 0x1c]
call fcn.00438240
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 2]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 4]
add dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 6]
mov eax, dword [ebp - 0x28]
call fcn.00438240
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 8]
mov eax, dword [ebp - 0x18]
call fcn.00438240
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 0xa]
mov eax, dword [ebp - 0x14]
call fcn.00438240
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
add dword [ebp - 0x10], 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x4382c6
mov eax, dword [ebp - 0x10]
movzx edx, word [eax]
mov eax, dword [ebp - 0x1c]
call fcn.00438240
mov word [ebp - 2], ax
mov ax, word [ebp - 0x24]
mov edx, dword [ebp - 0x10]
add ax, word [edx + 2]
mov word [ebp - 4], ax
mov ebx, dword [0x45620c]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov ax, word [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add ax, word [edx + 4]
mov word [ebp - 2], ax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 6]
mov eax, dword [ebp - 0x28]
call fcn.00438240
mov word [ebp - 4], ax
mov ebx, dword [0x45620c]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438ee8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
add eax, 0x100
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
xor eax, eax
mov dword [ebp - 4], eax
mov al, byte [ebp - 8]
and al, 0xff
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov eax, dword [ebp - 8]
and eax, 0xff
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 4]
mov byte [edx + eax], cl
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov dword [ebp - 8], edx
inc dword [ebp - 0xc]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jne 0x438f17
mov esp, ebp
pop ebp
ret
Function at 0x43b2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
and eax, 0xff
imul eax, eax, 0x1010101
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
xor eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x43b305
mov esp, ebp
pop ebp
ret

Function at 0x43b328
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x44a704
lea eax, [ebp - 0x108]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x18]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x44a704]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44a904]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x43b35b
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x44a804
lea eax, [ebp - 0x108]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x17]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x44a704]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44ad04]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x400], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x43b3bc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x44a704
lea eax, [ebp - 0x108]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x16]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x44a804]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44b104]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x800], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x43b421
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x44a804
lea eax, [ebp - 0x108]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x15]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x44a804]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44b504]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0xc00], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x43b486
mov esp, ebp
pop ebp
ret
Function at 0x43b4c4
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x44a804
lea eax, [ebp - 0x10c]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x14]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x44a704]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x44a704]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44a904]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x43b501
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x44a804
lea eax, [ebp - 0x10c]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x17]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x13]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x44a804]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x44a704]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44ad04]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x400], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x43b576
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x44a704
lea eax, [ebp - 0x10c]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x16]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x12]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x44a704]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x44a804]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44b104]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x800], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x43b5ef
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x44a704
lea eax, [ebp - 0x10c]
call fcn.0043b2e0
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x15]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x11]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x44a804]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x44a804]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x44b504]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0xc00], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x43b668
mov esp, ebp
pop ebp
ret
Function at 0x43bf84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov byte [eax - 0x100], 1
mov word [ebp - 2], 1
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax - 0x101]
add eax, eax
mov word [ebp - 4], ax
test byte [ebp - 3], 1
je 0x43bfb9
xor word [ebp - 4], 0x1f5
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 4]
mov byte [edx + eax - 0x100], cl
inc word [ebp - 2]
cmp word [ebp - 2], 0x100
jne 0x43bf98
mov word [ebp - 2], 1
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax - 0x100]
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 2]
mov byte [edx + eax - 0x200], cl
inc word [ebp - 2]
cmp word [ebp - 2], 0xff
jne 0x43bfdc
pop ecx
pop ebp
ret

Function at 0x43c058
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov ebx, dword [0x4561a0]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 0
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
xor eax, eax
mov al, byte [ebp - 0xd]
movzx eax, byte [eax*8 + 0x44bb04]
call fcn.0043c008
pop ecx
xor edx, edx
mov dl, byte [ebp - 0xd]
mov byte [ebp + edx - 0x1e], al
mov byte [ebp - 0xe], 1
push ebp
xor eax, eax
mov al, byte [ebp - 0xe]
xor edx, edx
mov dl, byte [ebp - 0xd]
lea edx, [edx*8 + 0x44bb04]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xe]
movzx edx, byte [ebp + edx - 0x16]
call fcn.0043c008
pop ecx
xor edx, edx
mov dl, byte [ebp - 0xd]
xor byte [ebp + edx - 0x1e], al
inc byte [ebp - 0xe]
cmp byte [ebp - 0xe], 8
jne 0x43c0ca
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 8
jne 0x43c0a4
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
shl eax, 8
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shr edx, 0x18
or eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0xd]
movzx edx, byte [ebp + edx - 0x1e]
xor eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 8
jne 0x43c121
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d0ac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
jmp 0x43d0c7
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jne 0x43d0c3
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x43d124
xor eax, eax
push ebp
push 0x43d11d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d124
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret
Function at 0x43ee7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x43ee8b
pop dword [ebp - 0x40]
mov eax, 0x1087c69e
add eax, 0xefbc27ed
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x546c4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x59d2
mov edi, eax
mov edx, 0x60c6c777
sub edx, 0x607e4977
add edx, dword [ebp - 0x40]
mov esi, 0xacf1385b
sub esi, 0xee19ae3
sub dword [ebp - 0x2c], 0x3311e7fa
mov ebx, dword [edx]
add dword [ebp - 0x24], esi
add ebx, esi
mov dword [ebp - 0x30], 0x552af61f
mov dword [edi], ebx
xor dword [ebp - 0x24], edi
add edi, 0x1456f6f0
add edi, 0xeba90914
add edx, 4
loop 0x43eedf
add eax, 0xc8096b9d
add eax, 0x37f7ee7e
mov ebx, eax
add eax, 0x9d6af738
add eax, 0x629508cd
mov ecx, 0xe1cc962
add ecx, 0xf223369e
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret