joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
jne 0x548e0f
mov eax, dword [esi + 0x1c]
push dword [eax]
push 0x1000
jmp 0x548e28
test eax, eax
je 0x548e3b
mov ecx, 0x1000
cmp eax, ecx
cmovl ecx, eax
sub eax, ecx
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x1c]
push dword [eax]
push ecx
push 1
push dword [esi + 0x24]
call fcn.00595b79
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x548e7c
cmp byte [esi + 0x28], 0
je 0x548e54
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x2a
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [edi]
push 0xffffffffffffffff
push edi
mov dword [eax + 0x14], 0x78
mov eax, dword [edi]
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x24]
add esp, 8
mov ecx, 2
mov byte [eax], 0xff
mov eax, dword [esi + 0x24]
mov byte [eax + 1], 0xd9
mov eax, dword [esi + 0x24]
mov dword [esi], eax
mov al, 1
pop edi
mov dword [esi + 4], ecx
mov byte [esi + 0x28], 0
pop esi
pop ebp
ret

Function at 0x548f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x18]
push edi
add esi, 0x800
push esi
call fcn.00593e38
mov edi, eax
add esp, 4
test edi, edi
jne 0x548fa4
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [eax]
push esi
push 1
push edi
call fcn.00595b79
mov esi, dword [ebp + 0xc]
push 0x38
push 0x5d7d18
push esi
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 0x20], 0x4c82e0
mov dword [esi + 0x24], fcn.004f3030
mov dword [esi + 0x28], 0
call fcn.00535880
add esp, 0x1c
test eax, eax
jne 0x549036
mov eax, dword [ebp + 0x20]
test eax, eax
mov ecx, dword [ebp + 0x1c]
cmovne ecx, eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 0x54]
imul ecx, dword [eax + 0x14]
mov dword [esi + 0x10], ecx
mov edi, edi
push 1
push esi
call fcn.00534050
add esp, 8
cmp eax, 1
je 0x549027
cmp eax, 0xfffffffd
jne 0x54901e
push esi
call fcn.00535a10
add esp, 4
test eax, eax
jne 0x54903c
cmp dword [esi + 0x10], eax
ja 0x549000
push edi
call fcn.00592c4b
push esi
call fcn.00535770
add esp, 8
pop edi
xor eax, eax
pop esi
pop ebp
ret
push edi
call fcn.00592c4b
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
ret
Function at 0x549220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], eax
jle 0x5492d6
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
lea ebx, [ebx]
mov edi, dword [ebp + 0x14]
xor esi, esi
cmp dword [ebx], esi
jle 0x54929e
lea esp, [esp]
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 4]
push 1
push 3
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x5492ce
movzx ecx, byte [ebp - 4]
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
push ecx
call fcn.00549620
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00549460
inc esi
add esp, 0x10
add edi, 3
cmp esi, dword [ebx]
jl 0x549250
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x1c]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x5492d3
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp + 0x10]
jl 0x549240
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x575a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x48], 0
jne 0x575a95
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [edi + 0x58]
test esi, esi
je 0x575afa
cmp dword [edi + 0x5c], 0x49492a00
mov edx, 0x575e60
mov ecx, fcn.00575e90
mov ebx, 0x5766b0
cmove ecx, edx
mov edx, fcn.005766e0
cmove edx, ebx
mov dword [ebp - 4], ecx
xor ebx, ebx
mov dword [ebp + 8], edx
cmp dword [edi + 0x60], ebx
jle 0x575afa
lea esp, [esp]
add esi, 8
push esi
call ecx
add esp, 4
test ebx, ebx
je 0x575aee
test eax, eax
je 0x575aee
mov ecx, dword [edi + 0x54]
add ecx, eax
push ecx
push esi
call dword [ebp + 8]
add esp, 8
mov ecx, dword [ebp - 4]
inc ebx
add esi, 8
cmp ebx, dword [edi + 0x60]
jl 0x575ad0
push 0x5c3924
push dword [ebp + 0xc]
call fcn.005931b4
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x575be6
push ebx
push 0xff
mov dword [ebp + 8], 1
call fcn.005958b3
push ebx
push 0xd8
call fcn.005958b3
mov eax, dword [edi + 0x4c]
add esp, 0x10
mov eax, dword [eax + 4]
cmp eax, 0xe1
je 0x575b5a
cmp eax, 0xe0
je 0x575b5a
push ebx
push 1
push 0x12
push 0x6052d0
call fcn.0059628c
add esp, 0x10
mov eax, dword [edi + 0x50]
xor ecx, ecx
dec eax
mov dword [ebp - 4], ecx
test eax, eax
jle 0x575bb8
xor esi, esi
lea esp, [esp]
push ebx
push 0xff
call fcn.005958b3
mov eax, dword [edi + 0x4c]
push ebx
movzx eax, byte [eax + esi + 4]
push eax
call fcn.005958b3
mov eax, dword [edi + 0x4c]
push ebx
push 1
push dword [eax + esi + 8]
push dword [eax + esi]
call fcn.0059628c
mov ecx, dword [ebp - 4]
lea esi, [esi + 0xc]
add esp, 0x20
neg eax
sbb eax, eax
inc ecx
and dword [ebp + 8], eax
mov eax, dword [edi + 0x50]
dec eax
mov dword [ebp - 4], ecx
cmp ecx, eax
jl 0x575b70
mov eax, dword [edi + 0x4c]
lea ecx, [ecx + ecx*2]
push ebx
push 1
push dword [eax + ecx*4 + 8]
push dword [eax + ecx*4]
call fcn.0059628c
neg eax
push ebx
sbb esi, esi
and esi, dword [ebp + 8]
call fcn.00593079
add esp, 0x14
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x575bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00575e00
add esp, 4
cmp eax, 0xd8
je 0x575c30
push str.Expected_SOI_marker_first
push 0x5c3544
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
mov eax, dword [esi + 0x44]
push esi
call eax
add esp, 0x10
lea ebx, [ebx]
push esi
call fcn.00576580
push esi
mov edi, eax
call fcn.00576630
mov ebx, eax
add esp, 8
cmp ebx, 2
jae 0x575c69
push str.Erroneous_JPEG_marker_length
push 0x5c3544
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
mov eax, dword [esi + 0x44]
push esi
call eax
add esp, 0x10
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x575c86
mov eax, dword [esi + 0x50]
inc eax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push ecx
call fcn.00593eca
add esp, 8
jmp 0x575c90
push 0xc
call fcn.00593e38
add esp, 4
mov edx, dword [esi + 0x50]
mov dword [esi + 0x4c], eax
push ebx
lea ecx, [edx + edx*2]
lea eax, [eax + ecx*4]
mov dword [ebp + 8], eax
lea eax, [edx + 1]
mov dword [esi + 0x50], eax
call fcn.00593e38
mov edx, dword [ebp + 8]
add esp, 4
mov dword [edx], eax
test eax, eax
jne 0x575cdb
push str.No_more_memory
push 0x5c3544
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
mov eax, dword [esi + 0x44]
push esi
call eax
mov edx, dword [ebp + 8]
add esp, 0x10
mov eax, dword [edx]
mov ecx, ebx
mov dword [edx + 8], ebx
mov dword [edx + 4], edi
shr ecx, 8
mov byte [eax], cl
mov eax, dword [edx]
mov byte [eax + 1], bl
lea eax, [ebx - 2]
push dword [esi]
push 1
push eax
mov eax, dword [edx]
add eax, 2
push eax
call fcn.00595b79
add esp, 0x10
sub edi, 0xd9
je 0x575df5
dec edi
jne 0x575c30
push dword [esi]
call fcn.005960c7
push 2
push edi
push dword [esi]
mov ebx, eax
mov dword [ebp + 8], ebx
call fcn.00595cb4
push dword [esi]
call fcn.005960c7
push 0
push ebx
push dword [esi]
mov edi, eax
call fcn.00595cb4
mov ecx, dword [esi + 0x4c]
add esp, 0x20
test ecx, ecx
je 0x575d61
mov eax, dword [esi + 0x50]
inc eax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push ecx
call fcn.00593eca
add esp, 8
jmp 0x575d6b
push 0xc
call fcn.00593e38
add esp, 4
mov edx, dword [esi + 0x50]
sub edi, dword [ebp + 8]
mov dword [esi + 0x4c], eax
push edi
lea ecx, [edx + edx*2]
lea ebx, [eax + ecx*4]
lea eax, [edx + 1]
mov dword [esi + 0x50], eax
call fcn.00593e38
add esp, 4
mov dword [ebx], eax
mov dword [ebx + 8], edi
test eax, eax
jne 0x575db3
push str.could_not_allocate_data_for_entire_image
push 0x5c3544
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
mov eax, dword [esi + 0x44]
push esi
call eax
add esp, 0x10
push dword [esi]
push edi
push 1
push dword [ebx]
call fcn.00595b79
add esp, 0x10
cmp eax, edi
je 0x575de7
push str.could_not_read_the_rest_of_the_image
push 0x5c3544
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
mov eax, dword [esi + 0x44]
push esi
call eax
add esp, 0x10
mov dword [ebx + 4], 0x123
mov dword [esi + 0x48], 1
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x58b760
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x204]
push edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x58b782
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x58b798
xor eax, eax
sub ecx, edx
cmp word [ebp + 0x1c], ax
setne al
push eax
push 0
push dword [ebp + 0x18]
lea eax, [ebp - 0x204]
mov byte [ebp + ecx - 0x205], 0x5f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push esi
call fcn.0058b8f0
movzx edi, ax
add esp, 0x20
test di, di
je 0x58b80c
push esi
call fcn.0059630e
add esp, 4
test eax, eax
jne 0x58b7fa
lea eax, [ebp - 0x204]
push esi
push eax
call fcn.00598271
add esp, 8
test eax, eax
je 0x58b81b
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
push eax
call fcn.0059630e
add esp, 4
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
xor ecx, ebp
pop esi
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x59faad
Capabilities:
Encode data using xor

Disassembly:
push 0xb
call fcn.0059e2ae
pop ecx
cmp dword [0x6396f6], ebx
jle 0x59fac3
or edx, dword [0x63d88b]
Function at 0x5adf54
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0059e36f
mov dword [ebp - 0x14], eax
cmp dword [0x686868], esi
jne 0x5ae047
push 0x800
push esi
push 0x61b544
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5adfd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5ae127
push esi
push esi
push 0x61b544
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5ae127
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5ae127
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x686868], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x68686c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x686870], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x686878], eax
test eax, eax
je 0x5ae044
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x686874], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5ae06c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5ae05f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5ae081
push 4
pop eax
jmp 0x5ae129
cmp dword [ebp - 0x14], esi
je 0x5ae081
push dword [0x686868]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5ae066
mov eax, dword [0x686874]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x5ae0df
cmp dword [0x686878], edi
je 0x5ae0df
push eax
call ebx
push dword [0x686878]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5ae0df
test eax, eax
je 0x5ae0df
call ecx
test eax, eax
je 0x5ae0d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5ae0d4
test byte [ebp - 8], 1
jne 0x5ae0df
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5ae10f
mov eax, dword [0x68686c]
cmp eax, edi
je 0x5ae10c
push eax
call ebx
test eax, eax
je 0x5ae10c
call eax
mov esi, eax
test esi, esi
je 0x5ae10c
mov eax, dword [0x686870]
cmp eax, edi
je 0x5ae10c
push eax
call ebx
test eax, eax
je 0x5ae10c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x686868]
call ebx
test eax, eax
je 0x5ae127
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5ae129
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x5ba310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
push dword [esi + 0x1c]
push 0x1000
push 1
push dword [esi + 0x20]
call fcn.00595b79
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x5ba376
cmp byte [esi + 0x24], al
je 0x5ba34e
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x2a
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [edi]
push 0xffffffffffffffff
push edi
mov dword [eax + 0x14], 0x78
mov eax, dword [edi]
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x20]
add esp, 8
mov ecx, 2
mov byte [eax], 0xff
mov eax, dword [esi + 0x20]
mov byte [eax + 1], 0xd9
mov eax, dword [esi + 0x20]
mov dword [esi], eax
mov al, 1
pop edi
mov dword [esi + 4], ecx
mov byte [esi + 0x24], 0
pop esi
pop ebp
ret
Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068c6
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40691d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068ff
pop edi
not eax
pop esi
ret 0xc

Function at 0x40104f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x10], 1
pushal
lea esi, [ebp - 0x54]
lea edi, [ebp - 0x10]
push 0
push 0x44
push esi
call fcn.0040103a
push 0
push 0x10
push edi
call fcn.0040103a
mov dword [ebp - 0x54], 0x44
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x4010d1
push dword [ebp + 8]
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.kernel32.dll_lstrlenA]
lea ecx, [ebp - 0x25c]
mov dword [eax + ecx], 0x20
push dword [ebp + 0xc]
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.kernel32.dll_lstrcatA]
lea eax, [ebp - 0x25c]
push edi
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
popal
leave
ret 8
Function at 0x40e2cb
Capabilities:
Encode data using xor

Disassembly:
sbb ecx, dword [0x2c2930ca]
sbb edi, 0xfe5dff1a
cmp byte [esi + eax + 0x31], ch
sub ch, bh
xor dword [eax], ebp
std
jae 0x40e33c
inc esi
jae 0x40e2da
stc
cli
dec ebx
push 0xffffffffffffffdc
xchg ebx, eax
add dword [ebp - 0xa037d6b], 0xbcca52c
int3
mov eax, 0x58c3a1f6
aam 0x4f
sbb al, 0x50
lahf
jmp 0x5a310f30

Function at 0x419deb
Capabilities:
Encode data using xor

Disassembly:
dec ebx
cld
pop edx
mov edx, 0x6ef1b733
push esi
rcr edi, cl
dec ecx
imul esp, dword [ecx - 0x44c10075], 0x5bdbddca
or ebx, ebx
mov dl, 0x81
sbb bl, dh
dec eax
xchg esp, eax
push ebp
aas
lcall 0x60f2, 0x7aac552f
sahf
aad 0x43
dec edx
pop edx
and dl, byte [bp + di]
sub eax, 0x5c331f38
xchg edi, eax
push esi
stosb byte es:[edi], al
dec ebp
out dx, eax
test dword [ebx], edi
xchg ebx, eax
push ss
popfd
xor bl, dl
sbb al, 0x4a
dec ecx
loop 0x419e15
dec ecx
sbb al, 0x34
leave
sbb byte [edi + 0x7cf35f36], ch
in eax, dx
push eax
sub cl, byte [edi + edx*2 + 0x68]
stosb byte es:[edi], al
dec eax
cmp dword [edi + 0x6edeac96], edi
adc eax, dword [edi + ebp*2]
push ds
sbb al, 0
inc ebx
in eax, 0xad
mov dword [ecx + 0x7566decd], edx
mov edx, dword [0x161cb81b]
aam 0xa4
ret

Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call esi
cmp eax, 7
jne 0x44b624
push 1
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x661210], al
mov byte [0xa636f4], al
mov eax, 0xd7b0
mov dword [0x661228], ecx
mov word [0xa6374c], ax
mov word [0xa6374e], ax
mov word [0x661624], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x661258], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b678
call esi
cmp al, 4
ja 0x44b67e
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x661254], eax
pop esi
ret
Function at 0x501d6b
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx + 0x2da52bd2], bh
or byte [esi - 0x3a1bd5f5], bh
movsd dword es:[edi], dword [esi]
sub eax, 0x2a0bbe08
in al, 0xc5
in eax, dx
scasd eax, dword es:[edi]
mov dh, dh
pop ds
stc
pop esi
sub bl, 0x9d
test eax, 0x59f149b6
xor dword [0xc915e545], ebx
jp 0x501d67
mov al, byte [0x386a5049]
ficomp word [eax]
insb byte es:[edi], dx
int3
Function at 0x5973eb
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x11865139], eax
xor al, 0x3b
loope 0x59743e
insb byte es:[edi], dx
and byte [ebp - 0x6f2c58a0], al
and ch, dh
pop ebp
test byte [eax], dl
xchg ecx, eax
inc esi
aaa
adc dword [eax + eax*2 - 0x3a422cfb], esp
je 0x5973dd
cmp al, 0x9e
invalid
rcl byte [eax - 0x59], 0x24
cli
cmpsd dword [esi], dword es:[edi]
and al, 0xfa
rol dword [ecx - 0x2c], 0x90
jo 0x5973d6
popfd
or eax, 0x1ff71191
cdq
movsb byte es:[edi], byte [esi]
xor al, 0xf8
rol dword [edx], cl
or ch, bl
lodsb al, byte [esi]
shr al, cl
loope 0x59743c
mov ah, 0x24
sbb dh, byte [ecx]
retf
Function at 0x65c2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x65c2a6
pop ebp
sub ebp, 0x45854c
lea edi, [ebp + 0x45a155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x65c2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x65c2d9
mov dword [ebp + 0x45a159], 1
cmp dword [ebp + 0x45a159], 0
jne 0x65c2e4
jmp 0x65c2fa
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c389
pop ebp
jmp 0x65c30e
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c616
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x4589ae]
mov esi, edi
lodsb al, byte [esi]
add eax, dword [ecx - 8]
dec edx
rcl esi, 0xc8
loopne 0x65c36d
enter 0xffffffffffffdfa0, 0x68
retf 0x4138
pop ebp
jmp 0x65c384
jmp 0x65c708
pop esp
jne 0x65c73c
jo 0x65c741
clc
ljmp 0x2ad2
inc eax
movsx ebx, byte [edi - 0x39eef872]
pop es
adc esi, eax
push cs
xchg ebp, eax
jg 0x65c795
invalid
mov ebx, 0xe6586912
sbb al, bl
sahf
cdq
adc byte [edi + 0x22], ah
jp 0x65c7ca
aam 0x16
salc
dec ebp
movsb byte es:[edi], byte [esi]
rcl dword [ebx + edi - 0x2dc34ab], cl
shl edx, cl
and al, byte [ecx]
nop
sar dword [edx], 1
xchg edx, eax
or dword [eax + 0x1139508f], eax
xchg esi, edi
mov ecx, 0xbdfdbead
dec esp
lea edi, [eax + 0x4e]
dec esi
les edi, [ebx + ecx*2]
or al, 0xfd
int3
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xbf6008], 0x8088405
inc edx
mov dword [ebx + 0xbf6008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret