joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100395c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 0x1c]
mov cx, word [esi + 0x1c]
mov edx, eax
or edx, ecx
test dl, 1
je 0x100395ec
and eax, 1
and ecx, 1
pop edi
pop esi
sub eax, ecx
pop ebx
ret
test dl, 0xc
je 0x1003968e
test cl, 0xc
jne 0x10039603
pop edi
pop esi
mov eax, 1
pop ebx
ret
test al, 0xc
jne 0x1003960e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov edx, eax
and edx, ecx
test dl, 4
jne 0x1003965a
test cl, 8
jne 0x10039620
fild qword [esi]
jmp 0x10039623
fld qword [esi + 8]
test al, 8
jne 0x1003962b
fild qword [edi]
jmp 0x1003962e
fld qword [edi + 8]
fld st(1)
fcomp st(1)
fnstsw ax
test ah, 1
je 0x10039644
fstp st(0)
pop edi
pop esi
fstp st(0)
or eax, 0xffffffff
pop ebx
ret
fxch st(1)
fcomp st(1)
fnstsw ax
test ah, 0x41
fstp st(0)
jne 0x10039688
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov eax, dword [esi]
mov ecx, dword [edi]
mov esi, dword [esi + 4]
mov edi, dword [edi + 4]
cmp esi, edi
jg 0x1003967f
jl 0x1003966e
cmp eax, ecx
jae 0x10039675
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
cmp esi, edi
jl 0x10039688
jg 0x1003967f
cmp eax, ecx
jbe 0x10039688
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
test dl, 2
je 0x1003974b
test cl, 2
jne 0x100396a5
pop edi
pop esi
mov eax, 1
pop ebx
ret
test al, 2
jne 0x100396b0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x1003974b
mov al, byte [esi + 0x1f]
mov cl, byte [ebx + 4]
cmp al, cl
jne 0x100396e4
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x18]
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [esi + 0x18]
push ecx
mov ecx, dword [ebx + 6]
push edx
push eax
push ecx
call dword [ebx + 0xa]
add esp, 0x14
pop edi
pop esi
pop ebx
ret
push ebp
push ecx
push esi
mov byte [esp + 0x20], al
call fcn.10039890
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x100396ff
mov dword [esp + 0x14], eax
jmp 0x10039706
mov edx, dword [esi + 0x18]
mov dword [esp + 0x14], edx
mov al, byte [ebx + 4]
push eax
push edi
call fcn.10039890
add esp, 8
test eax, eax
jne 0x1003971b
xor ecx, ecx
jmp 0x1003971e
mov ecx, dword [edi + 0x18]
mov edx, dword [ebx + 6]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
push edx
call dword [ebx + 0xa]
mov ebp, dword [esp + 0x2c]
mov ebx, eax
push ebp
push esi
call fcn.10039890
push ebp
push edi
call fcn.10039890
add esp, 0x24
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
mov edx, dword [esi + 0x18]
mov ebx, dword [edi + 0x18]
cmp edx, ebx
mov ecx, ebx
jg 0x10039759
mov ecx, edx
mov edi, dword [edi + 0x14]
mov esi, dword [esi + 0x14]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1003976a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10039772
sub edx, ebx
mov eax, edx
pop edi
pop esi
pop ebx
ret
Function at 0x10042798
Capabilities:
Encode data using xor

Disassembly:
xor ebp, dword [esi]
xor eax, 0x322e
add byte [ecx], al
add al, byte [0x19140f0a]
sbb dword [ecx], ebx
xor dh, byte [edx]
add byte fs:[ecx], al
add ecx, dword [eax]
adc ah, byte [ecx]
xor eax, 0xb280674e
in al, 0
outsd dx, dword [esi]
add byte [ebp], dh
je 0x100427bf
and byte [eax], al
outsd dx, dword [esi]
add byte [esi], ah
and byte [eax], al
insd dword es:[edi], dx
add byte [ebp], ah
insd dword es:[edi], dx
add byte [edi], ch
jb 0x100427d1
jns 0x100427d3
add byte [eax], al
add byte [eax], al
add byte [eax], al
insb byte es:[edi], dx
add byte [ecx], ch
bound eax, qword [eax]
jb 0x100427e1
popal
add byte [edx], dh
jns 0x100427e7
and byte [eax], al
jb 0x100427eb
outsd dx, dword [esi]
add byte [ebp], dh
je 0x100427f1
imul eax, dword [eax], 0x65006e
and byte [eax], al
arpl word [eax], ax
popal
add byte [eax + eax + 0x6c], ch
add byte [ebp], ah
add byte fs:[eax], ah
add byte [edi], ch
jne 0x1004280b
je 0x1004280d
and byte [eax], al
outsd dx, dword [esi]
add byte [esi], ah
and byte [eax], al
jae 0x10042817
add byte gs:[ecx], dh
jne 0x1004281d
add byte gs:[esi], ch
arpl word [eax], ax
add byte gs:[eax], al
add byte [eax], al
mov al, 0xa3
add al, 0x10
test al, 0xa3
add al, 0x10
mov al, byte [0x981004a3]
mov dword [0xa38c1004], eax
add al, 0x10
and byte [ebx - 0x5c8beffc], 4
adc byte [ebx + 4], ch
adc byte [ebx + 4], ah
adc byte [eax - 0x5d], bl
add al, 0x10
push esp
mov dword [0xa3501004], eax
add al, 0x10
dec eax
mov dword [0xa3401004], eax
add al, 0x10
xor al, 0xa3
add al, 0x10
sub al, 0xa3
add al, 0x10
sub byte [ebx - 0x5ce3effc], ah
add al, 0x10
adc byte [ebx - 0x5cf7effc], ah
add al, 0x10
cld
mov byte [0xa2f41004], al
add al, 0x10
in al, dx
mov byte [0xa2e01004], al
add al, 0x10
aam 0xa2
add al, 0x10
enter 0x4a2, 0x10
shl byte [edx - 0x5d4feffc], 4
adc byte [eax - 0x63effb5e], ch
mov byte [0xa2941004], al
add al, 0x10
mov word [edx - 0x5d7feffc], fs
add al, 0x10
je 0x10042850
add al, 0x10
push 0x601004a2
mov byte [0xa2541004], al
add al, 0x10
dec esp
mov byte [0xa2441004], al
add al, 0x10
cmp al, 0xa2
adc byte [edx + 4], cl
adc byte [edx + 4], al
adc byte [edx], bh
add al, 0x10
xor al, 0xa2
add al, 0x10
sub byte [edx - 0x5ddfeffc], ah
add al, 0x10
sbb byte [edx - 0x5defeffc], ah
add al, 0x10
add al, 0xa2
add al, 0x10
cld
mov eax, dword [0xa1f41004]
add al, 0x10
in al, dx
mov eax, dword [0xa1e41004]
add al, 0x10
fsub qword [ecx - 0x5e2beffc]
add al, 0x10
enter 0x4a1, 0x10
shl byte [ecx - 0x5e4beffc], 4
adc byte [eax - 0x63effb5f], ch
mov eax, dword [0xa1901004]
add al, 0x10
test byte [ecx - 0x5e87effc], ah
add al, 0x10
je 0x100428bb
add al, 0x10
jo 0x100428bf
add al, 0x10
mov eax, dword fs:[0xa1581004]
add al, 0x10
dec esp
mov eax, dword [0xa1441004]
add al, 0x10
cmp al, 0xa1
add al, 0x10
cmp byte [ecx - 0x5ecbeffc], ah
add al, 0x10
xor byte [ecx - 0x5ed3effc], ah
add al, 0x10
sub byte [ecx - 0x5edbeffc], ah
add al, 0x10
sbb al, 0xa1
add al, 0x10
adc al, 0xa1
add al, 0x10
or al, 0xa1
add al, 0x10
add byte [ecx - 0x5f0beffc], ah
add al, 0x10
invalid
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret

Function at 0x40df2c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x40df78
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.0040ef4c
test al, al
jne 0x40df6e
cmp word [edi], 0x5a4d
jne 0x40df6e
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x40df6e
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40df84
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x416640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 0x24]
sub esi, dword [ebx + 0x5c]
sub esi, dword [ebx + 0x54]
test esi, esi
jne 0x416671
cmp dword [ebx + 0x54], 0
jne 0x416671
cmp dword [ebx + 0x5c], 0
jne 0x416671
mov esi, dword [ebp - 8]
jmp 0x41671c
cmp esi, 0xffffffff
jne 0x41667c
dec esi
jmp 0x41671c
mov eax, dword [ebx + 0x54]
mov edx, dword [ebp - 8]
sub edx, 0x106
add edx, dword [ebp - 8]
cmp eax, edx
jb 0x41671c
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 8]
lea edx, [eax + edx]
mov ecx, dword [ebp - 8]
xchg edx, eax
call sub.rtl250.bpl__System_Move_qqrpxvpvi
mov eax, dword [ebp - 8]
sub dword [ebx + 0x58], eax
mov eax, dword [ebp - 8]
sub dword [ebx + 0x54], eax
mov eax, dword [ebp - 8]
sub dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x2c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x4166de
movzx ecx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x4166e3
mov word [edx], 0
dec eax
test eax, eax
jne 0x4166c0
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x28]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x41670f
movzx ecx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x416714
mov word [edx], 0
dec eax
test eax, eax
jne 0x4166f1
add esi, dword [ebp - 8]
mov ecx, dword [ebx]
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
push edx
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
cmp edx, dword [esp + 4]
jne 0x416738
cmp eax, dword [esp]
pop edx
pop eax
je 0x4167a6
push ebp
mov eax, dword [ebx + 0x54]
add eax, dword [ebx + 0x5c]
mov edx, dword [ebx + 0x20]
add edx, eax
mov eax, ecx
mov ecx, esi
call fcn.004165cc
pop ecx
add dword [ebx + 0x5c], eax
cmp dword [ebx + 0x5c], 3
jb 0x416780
mov eax, dword [ebx + 0x54]
mov edx, dword [ebx + 0x20]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x30], eax
mov ecx, dword [ebx + 0x40]
shl eax, cl
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x20]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x3c]
mov dword [ebx + 0x30], eax
cmp dword [ebx + 0x5c], 0x106
jae 0x4167a6
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx + 0x18]
jne 0x416650
cmp eax, dword [ecx + 0x14]
jne 0x416650
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x41a304
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x41a328
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
movzx edx, dl
mov edx, dword [edx*4 + 0x4cb038]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x41a30f
mov eax, esi
pop esi
ret

Function at 0x41af28
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ebx, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x41af44
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0041ab68
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x48], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x44], ecx
inc edi
cmp edi, 9
jne 0x41afa5
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1048]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0041ab68
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x41afeb
add ebx, 0x400
dec edi
jne 0x41afe9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b030
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x104d], cl
mov dword [ebp - 0x104c], edx
mov edi, eax
mov ebx, dword [ebp + 0x14]
lea esi, [ebp - 0x105c]
push esi
push edi
mov esi, 0x4cb43c
lea edi, [ebp - 0x48]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x4cb484
lea edi, [ebp - 0x1048]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, ebx
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
push eax
mov eax, ebx
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
pop edx
call fcn.0041af28
pop ecx
mov ebx, edi
cmp byte [ebp - 0x104d], 0
je 0x41b0b7
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x1058], 1
jmp 0x41b0ca
lea eax, [ebp - 4]
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x1058], 0xffffffff
mov edi, dword [ebp - 0x104c]
shr edi, 3
dec edi
test edi, edi
jl 0x41b1e1
inc edi
cmp dword [ebp + 0x10], 0
jne 0x41b0e7
cmp dword [ebp + 0xc], 0
je 0x41b168
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
movzx eax, byte [eax]
inc eax
and al, 0xff
lea edx, [ebp + 0xc]
add edx, dword [esi]
mov byte [edx], al
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x41b112
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x41b0ef
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.0041ab3c
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.0041ab3c
mov dword [ebp - 0x1060], eax
push ebp
mov eax, dword [ebp - 0x1058]
push eax
lea edx, [ebp - 0x1060]
mov eax, esi
mov ecx, dword [ebp - 0x1054]
call fcn.0041ab68
pop ecx
mov eax, dword [esi]
call fcn.0041ab3c
xor dword [ebx], eax
mov eax, dword [ebp - 0x1060]
call fcn.0041ab3c
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x41b1d7
cmp byte [ebp + 8], 0
jne 0x41b1be
mov eax, dword [ebx]
call fcn.0041ab3c
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.0041ab3c
mov dword [ebp - 0x1060], eax
push ebp
mov eax, dword [ebp - 0x1058]
push eax
lea edx, [ebp - 0x1060]
mov eax, esi
mov ecx, dword [ebp - 0x1054]
call fcn.0041ab68
pop ecx
mov eax, dword [esi]
call fcn.0041ab3c
mov dword [ebx], eax
mov eax, dword [ebp - 0x1060]
call fcn.0041ab3c
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x41b1d7
push ebp
mov eax, dword [ebp - 0x1058]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1054]
call fcn.0041ab68
pop ecx
add ebx, 8
dec edi
jne 0x41b0dd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41b2f0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jle 0x41b41b
lea eax, [esi + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, edx
add edx, edx
mov eax, edi
xor ecx, ecx
call sub.rtl250.bpl__System__LStrSetLength_qqrr27System__AnsiStringT_us_i0__ius
mov ecx, dword [edi]
mov eax, esi
mov edi, 3
cdq
idiv edi
mov edi, eax
test edi, edi
jle 0x41b38d
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x4cc484]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x4cc484]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x4cc484]
mov byte [ecx + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x4cc484]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec edi
jne 0x41b32d
mov eax, esi
mov esi, 3
cdq
idiv esi
dec edx
je 0x41b3a2
dec edx
je 0x41b3d3
jmp 0x41b422
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x4cc484]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x4cc484]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x41b422
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x4cc484]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x4cc484]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x4cc484]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x41b422
mov eax, edi
call sub.rtl250.bpl__System__LStrClr_qqrpv
pop edi
pop esi
pop ebx
ret
Function at 0x429078
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
movzx eax, cl
mov edx, dword [ebp - 4]
cmp word [edx + eax*2], 0xffff
jne 0x4290ca
mov dword [ebp - 0xc], 0x7fffffff
xor esi, esi
mov ebx, dword [ebp - 8]
movzx eax, cl
movzx edx, byte [ebx]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [ebp - 0xc]
jge 0x4290c1
movzx edx, cl
mov edi, dword [ebp - 4]
lea edi, [edi + edx*2]
mov word [edi], si
mov dword [ebp - 0xc], eax
inc esi
add ebx, 3
cmp esi, 0x10
jne 0x4290a0
movzx eax, cl
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bc18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp + 4], cl
mov dword [esp], edx
mov edi, eax
mov ecx, edi
movzx eax, byte [esp]
mov byte [esp + 5], al
mov edx, edi
shr edx, 8
mov eax, dword [esp]
shr eax, 8
mov byte [esp + 6], al
mov eax, edi
shr eax, 0x10
mov ebx, dword [esp]
shr ebx, 0x10
mov byte [esp + 7], bl
xor esi, esi
cmp byte [esp + 4], 0
je 0x42bcac
movzx ebx, cl
movzx ebp, byte [esp + 5]
add ebx, ebp
cmp ebx, 0xff
jbe 0x42bc70
inc esi
mov cl, 0xff
jmp 0x42bc74
add cl, byte [esp + 5]
movzx ebx, dl
movzx ebp, byte [esp + 6]
add ebx, ebp
cmp ebx, 0xff
jbe 0x42bc8b
inc esi
mov dl, 0xff
jmp 0x42bc8f
add dl, byte [esp + 6]
movzx ebx, al
movzx ebp, byte [esp + 7]
add ebx, ebp
cmp ebx, 0xff
jbe 0x42bca6
inc esi
mov al, 0xff
jmp 0x42bcd9
add al, byte [esp + 7]
jmp 0x42bcd9
cmp cl, byte [esp + 5]
jae 0x42bcb7
inc esi
xor ecx, ecx
jmp 0x42bcbb
sub cl, byte [esp + 5]
cmp dl, byte [esp + 6]
jae 0x42bcc6
inc esi
xor edx, edx
jmp 0x42bcca
sub dl, byte [esp + 6]
cmp al, byte [esp + 7]
jae 0x42bcd5
inc esi
xor eax, eax
jmp 0x42bcd9
sub al, byte [esp + 7]
dec esi
jle 0x42bcf0
movzx ecx, byte [esp + 4]
xor cl, 1
mov edx, dword [esp]
mov eax, edi
call fcn.0042bc18
jmp 0x42bd03
movzx eax, al
shl eax, 0x10
movzx edx, dl
shl edx, 8
add eax, edx
movzx edx, cl
add eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42cee8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cff3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x10
call fcn.00403818
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
sub eax, 0x2e
mov dword [esi + 8], eax
call fcn.00403100
test eax, 0x80000000
jne 0x42cf66
push 0x410
push esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042d110
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
push eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042d110
mov eax, dword [ebp - 8]
call sub.rtl250.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push edi
call fcn.004034e8
jmp 0x42cfb8
push 0x410
push esi
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0042d110
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0xc]
call sub.rtl250.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0042d110
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromUStr_qqrr27System__AnsiStringT_us_i0__x20System_UnicodeStringus
mov eax, dword [ebp - 0x14]
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
push eax
push edi
call fcn.004034e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cffa
lea eax, [ebp - 0x18]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x14]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x10]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0xc]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x4359d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x435b57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x435b2b
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x435b2b
cmp dword [0x4d1470], 0
jne 0x435a54
push 0x435b68
push 0x435b94
call fcn.00402ff0
push eax
call fcn.00403018
mov dword [0x4d1470], eax
cmp dword [0x4d1470], 0
je 0x435a86
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x4d1470]
test eax, eax
je 0x435a86
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call sub.rtl250.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
jmp 0x435abd
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x435abd
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call sub.rtl250.bpl__System__LStrFromPChar_qqrr27System__AnsiStringT_us_i0__pcus
mov edx, dword [ebp - 0x218]
mov eax, edi
call sub.rtl250.bpl__System__UStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x435ae9
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.004333b8
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.00409b20
cmp dword [edi], 0
je 0x435b2b
mov eax, dword [edi]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x435b2b
test bl, bl
je 0x435b16
mov eax, edi
mov edx, 0x435bb8
call sub.rtl250.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x435b2b
mov eax, dword [edi]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
mov eax, edi
mov ecx, 1
call sub.rtl250.bpl__System__UStrDelete_qqrr20System_UnicodeStringii
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435b5e
lea eax, [ebp - 0x21c]
call sub.rtl250.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0x218]
call sub.rtl250.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__IntfClear_qqrr44System__DelphiInterface_17System_IInterface_
ret

Function at 0x44b9e4
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call sub.rtl250.bpl__System__LStrToPChar_qqrx27System__AnsiStringT_us_i0__
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44ba10
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x44ba10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret