joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426448
Capabilities:
Get http content length

Disassembly:
push 0x14
mov eax, 0x508ea2
call fcn.004e2589
push 0
lea eax, [ebp - 0x10]
push eax
lea edi, [esi + 0x70]
push edi
push 0x20000005
push dword [esi + 0x2c]
mov dword [esi + 0x6c], 0
mov dword [edi], 0
mov dword [ebp - 0x10], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x4264d5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.CCoreWininet::InitFileSize
call fcn.00401769
and dword [ebp - 4], 0
push 0x3a0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str..CoreWininet.cpp
call fcn.00401769
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.wininet:_HttpQueryInfo_for_file_size_failed_
call fcn.00401769
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041129b
mov eax, dword [edi]
mov ecx, dword [esi + 0x68]
cmp ecx, eax
jae 0x4264e3
mov eax, dword [edi]
mov dword [esi + 0x68], eax
call fcn.004e2661
ret
Function at 0x4269dd
Capabilities:
Write file on windows

Disassembly:
push 8
mov eax, 0x507801
call fcn.004e2589
mov eax, dword [esi + 0x44]
cmp eax, 0xffffffff
jne 0x426a45
push 1
push 0x448
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.CCoreWininet::WriteOutput
call fcn.00401769
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.wininet:_WriteOutput_failed_because_output_file_is_not_open_
call fcn.00401769
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.inetwriteout
call fcn.00401769
mov byte [ebp - 4], 2
mov eax, dword [esi]
push 6
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [eax + 0x14]
xor eax, eax
jmp 0x426ab2
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x426aaf
push 1
push 0x44d
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.CCoreWininet::WriteOutput
call fcn.00401769
mov dword [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.wininet:_WriteFile_failed_
call fcn.00401769
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.inetwritefile
call fcn.00401769
mov byte [ebp - 4], 5
mov eax, dword [esi]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [eax + 0x1c]
jmp 0x426a41
xor eax, eax
inc eax
call fcn.004e2661
ret 8

Function at 0x426bdd
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004de430
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
add esp, 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
neg eax
sbb eax, eax
neg eax
leave
ret
Function at 0x42761a
Capabilities:
Resume thread

Disassembly:
push 0xc
mov eax, 0x5134fa
call fcn.004e2589
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x2b
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov edi, str.CPing::Start
push edi
call fcn.00401769
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
call fcn.00412190
cmp dword [esi + 0x94], ebx
jne 0x4276b6
push 1
push 0x2f
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Called_with_NULL_WrapperConfig_
call fcn.00401769
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.pingnoconfig
call fcn.00401769
mov byte [ebp - 4], 4
lea ecx, [esi + 0x9c]
mov eax, dword [ecx]
push 1
mov byte [ebp - 4], bl
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
xor eax, eax
call fcn.004e2661
ret 4
cmp dword [esi + 0x98], ebx
jne 0x4276fc
push 1
push 0x35
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Called_with_NULL_DetectionManager_
call fcn.00401769
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.pingnodetection
call fcn.00401769
mov byte [ebp - 4], 7
jmp 0x427690
lea eax, [ebp + 8]
lea ecx, [esi + 0x1a0]
push eax
call fcn.004043ce
mov dword [esi + 0x1a8], ebx
cmp dword [esi + 0x198], ebx
je 0x42775a
push 1
push 0x40
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Ping_download_thread_is_not_NULL_in_StartDownload_
call fcn.00401769
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.threadnotnull
call fcn.00401769
mov byte [ebp - 4], 0xa
jmp 0x427690
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Starting_ping_download...
call fcn.00401769
mov byte [ebp - 4], 0xb
push 4
mov byte [ebp - 4], bl
call fcn.00412200
push ebx
push 4
push ebx
push ebx
push esi
push 0x42782d
call fcn.004c5d94
mov dword [esi + 0x198], eax
cmp eax, ebx
jne 0x4277f8
push 1
push 0x4c
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.AfxBeginThread_failed_
call fcn.00401769
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.beginthread
call fcn.00401769
mov byte [ebp - 4], 0xe
add esi, 0x9c
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov byte [ebp - 4], bl
mov ecx, esi
call dword [edi + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
mov eax, ebx
jmp 0x4276ae
mov dword [eax + 0x28], ebx
mov esi, dword [esi + 0x198]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.__ping_download_thread_started.
call fcn.00401769
mov byte [ebp - 4], 0xf
push 4
mov byte [ebp - 4], bl
call fcn.00412200
xor ebx, ebx
inc ebx
jmp 0x4277e5
Function at 0x429300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503eb3
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x56d790]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push 0x52602c
push eax
call fcn.004127b9
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esi]
add eax, 0x4c
push ebx
or dword [esp + 0x34], 0xffffffff
mov ecx, esi
call dword [eax]
push ecx
push ecx
mov edi, eax
mov eax, esp
mov dword [esp + 0x1c], esp
push str.items
push eax
mov dword [esp + 0x20], ebx
call fcn.004127b9
inc ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esi]
add eax, 0x4c
push edi
or dword [esp + 0x34], 0xffffffff
mov ecx, esi
call dword [eax]
and dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [eax + 0x1c], 0
jle 0x429425
lea ecx, [eax + 0x14]
mov eax, dword [esp + 0xc]
call fcn.004080c5
mov edi, dword [eax]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x194]
test eax, eax
je 0x42940e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x19c]
test eax, eax
je 0x42940e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1d4]
test eax, eax
je 0x42940e
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push str.item
push eax
mov dword [esp + 0x20], ebx
call fcn.004127b9
mov dword [esp + 0x30], 2
mov eax, dword [esi]
push dword [esp + 0x1c]
add eax, 0x4c
or dword [esp + 0x34], 0xffffffff
mov ecx, esi
call dword [eax]
mov edx, dword [edi]
push eax
push esi
mov ecx, edi
call dword [edx + 0x1dc]
inc dword [esp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xc]
cmp ecx, dword [eax + 0x1c]
jl 0x429399
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x437a99
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x5083e8
call fcn.004e2589
xor ebx, ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.__Postback_using_Shell...
call fcn.00401769
mov byte [ebp - 4], 1
push 2
mov byte [ebp - 4], bl
call fcn.00412200
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], vtable.CFlags_enum_WebArgFlag_.0
mov dword [eax + 4], 1
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.0040184e
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0xc]
call fcn.00429936
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 8]
call fcn.004043ce
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401898
push str.ShellExecuteEx:
lea ecx, [ebp + 0xc]
call fcn.00401769
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp + 8]
push edx
push eax
push ecx
call fcn.0040403d
add esp, 0xc
mov byte [ebp - 4], 6
push 4
mov byte [ebp - 4], 5
call fcn.00412200
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401898
push 0x3c
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.004de430
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x440
mov dword [ebp - 0x48], 0x5279c0
mov dword [ebp - 0x38], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x437bfc
push 1
push 0x18f
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.CWebManager::PostbackShell
call fcn.00401769
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.ShellExecuteEx_failed_
call fcn.00401769
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.postshell
call fcn.00401769
mov byte [ebp - 4], 9
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov byte [ebp - 4], bl
call dword [eax + 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
mov eax, ebx
call fcn.004e2661
ret 0xc
cmp dword [ebp - 0x1c], ebx
je 0x437c18
push 0xbb8
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x437be6
Function at 0x440668
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x4f9091
call fcn.004e2589
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x440691
push ebx
push ebx
push 2
xor ecx, ecx
pop eax
call fcn.004417f1
xor al, al
jmp 0x4407fb
call fcn.0044003d
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push dword [ebp + 0xc]
call fcn.004e0213
push dword [ebp + 0xc]
call fcn.004e123d
push ebx
push ebx
push dword [ebp + 0xc]
mov esi, eax
call fcn.004e0213
add esp, 0x1c
cmp esi, ebx
jg 0x4406ca
push ebx
push ebx
push 0xd
jmp 0x440682
mov ebx, 0x574b24
mov dword [ebp - 0x10], ebx
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0043f90b
lea eax, [esi + 1]
push eax
call fcn.004bb66c
push dword [ebp + 0xc]
mov edi, eax
push 1
push esi
push edi
mov dword [ebp - 0x14], edi
mov byte [edi], 0
call fcn.004e0f91
add esp, 0x14
cmp eax, 1
je 0x440739
push edi
call fcn.004bb6a6
mov edi, dword [ebp + 8]
pop ecx
push 0
push 0
push 2
xor ecx, ecx
pop eax
call fcn.004417f1
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], ebx
je 0x44068a
push dword [ebp - 0x10]
call fcn.004bb6a6
pop ecx
jmp 0x44068a
mov ebx, edi
mov eax, ebx
mov byte [eax + esi], 0
cmp byte [eax], 0
je 0x44079e
mov al, byte [ebx]
cmp al, 0xa
jne 0x44075e
mov eax, ebx
sub eax, edi
inc eax
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.0043fa0b
inc ebx
jmp 0x440794
cmp al, 0xd
jne 0x440798
mov eax, ebx
sub eax, edi
test eax, eax
jle 0x440774
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.0043fa0b
push 1
lea eax, [ebp + 0xc]
push eax
lea edi, [ebp - 0x10]
mov byte [ebp + 0xc], 0xa
call fcn.0043fa0b
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x440792
inc ebx
inc ebx
jmp 0x440794
mov ebx, eax
mov edi, ebx
jmp 0x440799
inc ebx
cmp byte [ebx], 0
jne 0x440746
sub ebx, edi
je 0x4407ac
push ebx
push edi
lea edi, [ebp - 0x10]
call fcn.0043fa0b
push dword [ebp - 0x14]
call fcn.004bb6a6
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
pop ecx
push 0
push 0
lea ecx, [edi + 8]
push ecx
mov ecx, esi
call dword [eax + 8]
cmp byte [esi + 0x2c], 0
je 0x4407e6
or dword [ebp - 4], 0xffffffff
cmp edi, 0x574b24
je 0x44068a
push edi
jmp 0x44072e
or dword [ebp - 4], 0xffffffff
cmp edi, 0x574b24
je 0x4407f9
push edi
call fcn.004bb6a6
pop ecx
mov al, 1
call fcn.004e2661
ret 8
Function at 0x4431bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xa4
mov eax, 0x4fcf67
call fcn.004e25bc
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x78], eax
cmp eax, ebx
jne 0x4431f6
mov dword [ebp - 0x1c], edi
push 0x5486a4
lea eax, [ebp - 0x1c]
push eax
call fcn.004e2693
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
je 0x44320a
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov dword [esi + 0x3c], eax
call fcn.00442d3c
mov eax, dword [esi + 0x18]
call fcn.00446cad
mov eax, dword [esi + 0x2c]
dec eax
mov dword [esi + 0x30], eax
push ebx
push 0xe
mov ecx, esi
call fcn.004434ff
cmp dword [esi + 0x24], edi
jne 0x44325f
lea edi, [esi + 0x20]
cmp dword [edi], ebx
jne 0x44323b
call fcn.0044297d
jmp 0x44323d
mov eax, dword [edi]
lea ebx, [esi + 0x40]
call fcn.00442578
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 1
jae 0x443259
call fcn.00442997
inc dword [ebp - 0x14]
jmp 0x443249
and dword [esi + 0x1c], 0
jmp 0x44328d
lea eax, [ebp - 0x50]
push eax
xor edx, edx
call fcn.004424f3
mov byte [ebp - 4], 2
lea ebx, [esi + 0x40]
lea eax, [ebp - 0x50]
call fcn.00442578
mov dword [esi + 0x1c], 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x50]
push eax
call fcn.00418d78
and dword [ebp - 4], 0
jmp 0x443353
add esi, 0x40
push esi
push dword [ebp + 0xc]
call fcn.0044253b
and dword [ebp - 4], 0
or dword [ebp - 0x18], 1
mov eax, dword [ebp + 0xc]
call fcn.004e2661
ret 8
Function at 0x456cfe
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x56d790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x138], 0
jne 0x456daa
mov eax, dword [esi + 4]
cmp eax, 0x100
jb 0x456daa
xor ebx, ebx
inc ebx
cmp eax, 0x101
jbe 0x456d43
add eax, 0xfffffefc
cmp eax, ebx
ja 0x456daa
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x456daa
mov ecx, dword [esi + 8]
lea eax, [ecx - 0x70]
cmp eax, 0xb
jbe 0x456da6
cmp ecx, 0x2f
je 0x456da6
mov al, byte [ebp - 0xf3]
and al, 0x80
je 0x456d73
cmp ecx, 0x4e
je 0x456da6
test al, al
je 0x456d8e
cmp ecx, 0x50
je 0x456da6
test al, al
je 0x456d8e
cmp ecx, 0x44
je 0x456da6
test al, al
je 0x456d8e
cmp ecx, 0x46
je 0x456da6
mov al, byte [ebp - 0xf2]
and al, 0x80
je 0x456d9d
cmp ecx, 0x25
je 0x456da6
test al, al
je 0x456daa
cmp ecx, 0x27
jne 0x456daa
mov eax, ebx
jmp 0x456db2
push esi
mov ecx, edi
call fcn.004bc165
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dd215
leave
ret 4
Function at 0x464831
Capabilities:
Persist via run registry key

Disassembly:
push 0x10
mov eax, 0x50f0e3
call fcn.004e2589
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov ecx, edi
call fcn.00404312
and dword [ebp - 4], 0
xor esi, esi
inc esi
push esi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x522f14
mov dword [ebp - 0x10], esi
call fcn.00401769
mov dword [ebp - 4], esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401769
mov byte [ebp - 4], 2
push SysReAllocString
mov byte [ebp - 4], 0
call fcn.0041e90f
add esp, 0x14
test eax, eax
jne 0x4648aa
push str._windows_Desktop
mov ecx, edi
call fcn.00401732
push esi
call fcn.0041b3bb
pop ecx
mov eax, edi
call fcn.004e2661
ret 4
Function at 0x46702e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x56d790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
inc dword [0x574bd0]
cmp dword [0x574bd0], 1
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
jne 0x467077
push 0
call fcn.004e1f51
xor eax, 0xbb40e64e
push eax
call fcn.004e1e39
pop ecx
pop ecx
push edi
mov ecx, ebx
mov eax, esi
call fcn.00466ff6
add esp, 4
xor esi, esi
call fcn.004e1e4b
mov ebx, eax
mov eax, dword [ebp - 0x14]
sar ebx, 7
and ebx, 0xff
call fcn.00466fd9
mov ecx, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x18], eax
call fcn.00467c78
xor bl, byte [ebp - 0x18]
add esp, 4
mov byte [ebp + esi - 0x10], bl
inc esi
cmp esi, 0xa
jl 0x467086
mov eax, dword [ebp - 0x20]
push edi
call fcn.00466ff6
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
add esp, 4
xor esi, esi
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
call fcn.00466fd9
mov bl, byte [ebp + esi - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
movzx eax, bl
push eax
call fcn.00467c78
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add eax, esi
add esp, 4
inc esi
cmp esi, 0xa
mov byte [ebp + eax - 0x10], bl
jl 0x4670d3
mov eax, ecx
call fcn.00466fd9
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
shr ebx, 0x10
mov eax, ebx
and eax, 0xff
push eax
call fcn.00467c78
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov byte [eax + esi], bl
mov eax, ecx
inc esi
call fcn.00466fd9
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
shr ebx, 0x18
push ebx
mov dword [ebp - 0x18], eax
call fcn.00467c78
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
add esp, 8
mov byte [eax + esi], bl
pop edi
lea eax, [esi + 1]
pop esi
xor ecx, ebp
pop ebx
call fcn.004dd215
leave
ret
Function at 0x467787
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [esi + 0x4090], eax
je 0x4677e7
cmp dword [esi + 0x6c], eax
jbe 0x4677e7
push ebx
mov dword [ebp - 4], 0xffffff78
sub dword [ebp - 4], esi
push edi
lea ebx, [esi + 0x88]
lea edx, [esi + 0x4094]
mov eax, edx
call fcn.00466fd9
mov edi, dword [esi + 0x40a0]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
push eax
mov ecx, edx
call fcn.00467c78
mov al, byte [ebp - 0xc]
xor byte [ebx], al
mov eax, dword [ebp - 4]
add esp, 4
inc ebx
add eax, ebx
cmp eax, dword [esi + 0x6c]
jb 0x4677b1
pop edi
pop ebx
push dword [esi + 0x6c]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 8]
add esp, 0x10
cmp eax, dword [esi + 0x6c]
je 0x467806
or dword [ebp - 8], 0xffffffff
and dword [esi + 0x6c], 0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4678e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
cmp ebx, edi
jne 0x467903
push 0xffffffffffffff9a
pop eax
jmp 0x467ab4
cmp dword [ebx + 0x2c], edi
je 0x4678fb
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x46795f
cmp dword [ebx + 0x84], edi
jne 0x46795f
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x46793e
mov esi, ebx
call fcn.00467787
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
mov edi, ebp
call fcn.00469216
mov edi, eax
mov eax, dword [ebx + 0x44]
sub eax, esi
add dword [ebx + 0x6c], eax
test edi, edi
je 0x467921
cmp edi, 1
jne 0x46795f
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x467977
test edi, edi
jne 0x467977
mov esi, ebx
call fcn.00467787
cmp eax, 0xffffffff
jne 0x467977
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x467997
cmp dword [ebx + 0x84], 0
jne 0x4679b1
lea esi, [ebx + 0x30]
call fcn.0046990a
and dword [ebx + 0x68], 0
mov edi, eax
cmp dword [ebx + 0x84], 0
jne 0x4679b1
mov eax, dword [ebx + 0x408c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x10], eax
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0xc]
add ebp, dword [ebx + 0x44]
push 4
add esi, 0x10
pop edx
call fcn.00467259
mov esi, dword [ebx + 0x74]
push 4
add esi, 0x14
pop edx
mov ecx, ebp
call fcn.00467259
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x5c], ecx
jne 0x4679f2
mov esi, dword [ebx + 0x74]
push 2
add esi, 0x24
pop edx
call fcn.00467259
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x10]
push 4
add esi, 0x18
pop edx
call fcn.00467259
test edi, edi
jne 0x467a1a
push dword [ebx + 0x78]
lea edi, [ebx + 0x24]
push dword [ebx + 0x74]
call fcn.00467182
pop ecx
pop ecx
mov edi, eax
push dword [ebx + 0x74]
call fcn.004e04ec
pop ecx
test edi, edi
jne 0x467aa6
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x18
test eax, eax
je 0x467a51
or edi, 0xffffffff
jmp 0x467a8d
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x10]
push 4
pop esi
mov edi, ebx
call fcn.00467210
mov edi, eax
pop ecx
test edi, edi
jne 0x467a8d
push dword [ebx + 0x20]
mov ecx, ebp
mov edi, ebx
call fcn.00467210
mov edi, eax
pop ecx
test edi, edi
jne 0x467a8d
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.00467210
pop ecx
mov edi, eax
push 0
push dword [esp + 0x18]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x10
test eax, eax
je 0x467aa6
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
and dword [ebx + 0x2c], 0
pop esi
mov eax, edi
pop ebp
pop edi
add esp, 0xc
ret
Function at 0x467c78
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret