joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493550
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x71000]
push edi
or ebp, 0xffffffff
jmp 0x493572
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x493579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x493568
mov eax, 1
add ebx, ebx
jne 0x49358b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49359c
jne 0x4935ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4935ac
dec eax
add ebx, ebx
jne 0x4935a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x493580
xor ecx, ecx
sub eax, 3
jb 0x4935c4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x493636
sar eax, 1
mov ebp, eax
jmp 0x4935cf
add ebx, ebx
jne 0x4935cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4935dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x493600
inc ecx
add ebx, ebx
jne 0x4935ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4935e1
jne 0x4935fd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4935e1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x493620
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x493611
jmp 0x49356e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x493620
add edi, ecx
jmp 0x49356e
pop esi
mov edi, esi
mov ecx, 0x13d2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49363e
cmp byte [edi], 0x30
jne 0x49363e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x493643
lea edi, [esi + 0x91000]
mov eax, dword [edi]
or eax, eax
je 0x4936bb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x940dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x94140]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x493670
mov ecx, edi
jns 0x49369f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x94144]
or eax, eax
je 0x4936b5
mov dword [ebx], eax
add ebx, 4
jmp 0x49368d
call dword [esi + 0x94148]
popal
jmp 0x41a225
Function at 0x42f830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x42f890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x42f887
mov edx, dword [0x496918]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42f87b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42f860
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x42f889
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x433910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x43397c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x4339c3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004583cf
add esp, 8
test eax, eax
jne 0x4339c1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4339c5
jmp 0x433973
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43b570
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x4882f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00436a80
add esp, 4
movzx edx, al
test edx, edx
je 0x43b601
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.0044d140
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x43b5ff
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x43b5ff
jmp 0x43b601
jmp 0x43b583
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d895
mov esp, ebp
pop ebp
ret
Function at 0x43e480
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462417
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4882f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0043cbd0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0043cbd0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0043cbd0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0043de80
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0043de80
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0043de80
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43e6c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4624c7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4882f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0043ca90
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0043ca90
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0043ca90
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0043dea0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0043dea0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0043dea0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4486de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x448763
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0044d1c0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x448726
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x448748
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4487be
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.004484ac
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x4487aa
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x4487be
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4486e7
pop esi
pop ebx
leave
ret
Function at 0x44d895
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4882f0]
jne 0x44d89f
repz ret
jmp fcn.00453f47

Function at 0x455cbd
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x488e90]
je 0x455cd8
inc edi
cmp edi, 0x17
jb 0x455cc9
cmp edi, 0x17
jae 0x455e58
push ebp
push 3
call fcn.0045b18f
cmp eax, 1
pop ecx
je 0x455e24
push 3
call fcn.0045b18f
test eax, eax
pop ecx
jne 0x455d0c
cmp dword [0x488430], 1
je 0x455e24
cmp ebx, 0xfc
je 0x455e57
push 0x48f26c
mov ebx, 0x314
push ebx
mov ebp, 0x497f90
push ebp
call fcn.00455c58
add esp, 0xc
test eax, eax
je 0x455d42
push esi
push esi
push esi
push esi
push esi
call fcn.0044fb03
add esp, 0x14
push 0x104
mov esi, 0x497fa9
push esi
push 0
mov byte [0x4980ad], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x455d86
push 0x48f254
push 0x2fb
push esi
call fcn.00455c58
add esp, 0xc
test eax, eax
je 0x455d86
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0044fb03
add esp, 0x14
push esi
call fcn.0044f740
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x455dcb
push esi
call fcn.0044f740
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4982a4
push 0x48f250
sub ecx, eax
push ecx
push eax
call fcn.004598b7
add esp, 0x14
test eax, eax
je 0x455dcb
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0044fb03
add esp, 0x14
jmp 0x455dcd
xor esi, esi
push 0x489db4
push ebx
push ebp
call fcn.00459846
add esp, 0xc
test eax, eax
je 0x455ded
push esi
push esi
push esi
push esi
push esi
call fcn.0044fb03
add esp, 0x14
push dword [edi*8 + 0x488e94]
push ebx
push ebp
call fcn.00459846
add esp, 0xc
test eax, eax
je 0x455e0f
push esi
push esi
push esi
push esi
push esi
call fcn.0044fb03
add esp, 0x14
push 0x12010
push 0x48f228
push ebp
call fcn.0045afd2
add esp, 0xc
jmp 0x455e57
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x455e57
cmp ebp, 0xffffffff
je 0x455e57
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x488e94]
push dword [esi]
call fcn.0044f740
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x45afd2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00454125
xor ebx, ebx
cmp dword [0x498630], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x45b0a8
push 0x49035c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x45b188
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x490350
push edi
call esi
cmp eax, ebx
je 0x45b188
push eax
call fcn.004540b7
mov dword [esp], 0x490340
push edi
mov dword [0x498630], eax
call esi
push eax
call fcn.004540b7
mov dword [esp], 0x49032c
push edi
mov dword [0x498634], eax
call esi
push eax
call fcn.004540b7
mov dword [0x498638], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004505b5
test eax, eax
pop ecx
pop ecx
je 0x45b076
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044fb03
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x45b0a8
push 0x490310
push edi
call esi
push eax
call fcn.004540b7
cmp eax, ebx
pop ecx
mov dword [0x498640], eax
je 0x45b0a8
push 0x4902f8
push edi
call esi
push eax
call fcn.004540b7
pop ecx
mov dword [0x49863c], eax
mov eax, dword [0x49863c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x45b12d
cmp dword [0x498640], ecx
je 0x45b12d
push eax
call fcn.0045412e
push dword [0x498640]
mov esi, eax
call fcn.0045412e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x45b12d
cmp edi, ebx
je 0x45b12d
call esi
cmp eax, ebx
je 0x45b0fa
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45b0fa
test byte [ebp - 0x18], 1
jne 0x45b12d
lea eax, [ebp - 0x10]
push eax
call fcn.004505ec
test eax, eax
pop ecx
je 0x45b115
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044fb03
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x45b124
or dword [ebp + 0x10], 0x200000
jmp 0x45b168
or dword [ebp + 0x10], 0x40000
jmp 0x45b168
mov eax, dword [0x498634]
cmp eax, dword [ebp - 8]
je 0x45b168
push eax
call fcn.0045412e
cmp eax, ebx
pop ecx
je 0x45b168
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x45b168
mov eax, dword [0x498638]
cmp eax, dword [ebp - 8]
je 0x45b168
push eax
call fcn.0045412e
cmp eax, ebx
pop ecx
je 0x45b168
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x498630]
call fcn.0045412e
cmp eax, ebx
pop ecx
je 0x45b188
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45b18a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403594
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4ca008], 0x8088405
inc edx
mov dword [ebx + 0x4ca008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41c358
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41c389
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c371
add dl, dl
jne 0x41c394
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c3e5
xor eax, eax
add dl, dl
jne 0x41c3a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c482
add dl, dl
jne 0x41c3b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c3bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c3c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c3d1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41c3db
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41c380
mov eax, 1
add dl, dl
jne 0x41c3f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c3fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c3ea
sub eax, ebx
mov ebx, 1
jne 0x41c431
mov ecx, 1
add dl, dl
jne 0x41c417
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c422
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c40e
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c380
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41c448
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c453
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c43f
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c380
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41c4a3
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41c380
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov eax, dword [eax + 0x78]
add eax, ebx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0x41d3fc
test esi, esi
jbe 0x41d413
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.004087a0
test eax, eax
jne 0x41d3ee
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x41d413
add dword [ebp - 8], 2
add edi, 4
dec esi
test esi, esi
ja 0x41d3cb
jmp 0x41d413
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41d413
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41dbcc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4ba1dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404ca4
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41dc07
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41dc20
lea eax, [ebp - 0xc]
mov edx, dword [0x4cbd78]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d04
jmp 0x41dc33
lea eax, [ebp - 0xc]
mov edx, dword [0x4cbd78]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d04
lea eax, [ebp - 0xc]
mov edx, ebx
sar edx, 1
jns 0x41dc3f
adc edx, 0
mov edx, dword [edx*4 + 0x4ca8d8]
call fcn.00404ef4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.00404ed8
push eax
call fcn.00406a4c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ddaf
mov eax, 0x40
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406c4c
test eax, eax
je 0x41dda2
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41dda2
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406c84
mov eax, edi
call fcn.00403270
mov eax, 0x18
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406c4c
test eax, eax
je 0x41dda2
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41dda2
add eax, 4
cmp byte [ebp - 1], 0
je 0x41dd46
cmp word [eax], 0x8664
jne 0x41dd46
mov eax, edi
call fcn.00403270
mov eax, 0xf0
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406c4c
test eax, eax
je 0x41dda2
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x41dda2
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404ce0
jmp 0x41dda2
cmp byte [ebp - 1], 0
jne 0x41dda2
cmp word [eax], 0x14c
jb 0x41dda2
cmp word [eax], 0x150
ja 0x41dda2
mov eax, edi
call fcn.00403270
mov eax, 0xe0
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406c4c
test eax, eax
je 0x41dda2
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x41dda2
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404ce0
mov eax, edi
call fcn.00403270
push esi
call fcn.00406a04
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00405000
jne 0x41ddc7
inc ebx
cmp ebx, 0x19
jne 0x41dbf9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba1e4
lea eax, [ebp - 0xc]
call fcn.00404ca4
ret