joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48095c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x480962
ret

Function at 0x49a0e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49a2ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405a90
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, 0x49a2c4
call fcn.00405624
mov eax, dword [ebp - 4]
call fcn.004216ac
dec eax
test eax, eax
jl 0x49a1a9
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00421680
mov edx, dword [0x48d708]
call fcn.00404478
test al, al
je 0x49a1a1
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00421680
lea edx, [ebp - 0x20]
call fcn.004abc88
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov edx, 3
mov al, 0x20
call fcn.00405a90
push dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004056a0
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x49a14f
mov al, byte [0x49a2c8]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x49a2d4
mov eax, dword [ebp - 0x10]
call fcn.0040fc98
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00405388
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
call fcn.004abc88
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, 0x49a2c4
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
call fcn.004abc88
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xb
mov eax, 0x49a2c4
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
mov eax, 0x49a2c4
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x78]
mov ecx, 9
mov eax, 0x49a2e0
call fcn.0040b830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a2b5
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.00405314
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405314
lea eax, [ebp - 0x20]
call fcn.004052f0
lea eax, [ebp - 0x1c]
call fcn.004052f0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405314
ret
Function at 0x4ea1d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x537840
test esi, esi
jne 0x4ea1ee
xor eax, eax
jmp 0x4ea2df
cmp dword [ebp], 0
jne 0x4ea1f9
call fcn.004ea164
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4ea2b9
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4ea205
test edi, edi
jbe 0x4ea2da
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4ea2bd
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ee538
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4ee566
mov eax, ebx
call fcn.004eefdc
cmp dword [ebx + 0x3c], 0
je 0x4ee55f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4ee5d7
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4ee5c9
cmp dword [ebx + 8], 0
je 0x4ee588
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4ee59a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4ee5c9
cmp dword [ebx + 8], 0
je 0x4ee57b
cmp eax, 3
je 0x4ee5ad
dec eax
jne 0x4ee57b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4ee57b
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4ee57b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4ee5f5
cmp dword [ebx + 0x10], 0xcc
je 0x4ee5f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004ee600
pop ebx
ret
Function at 0x4fb624
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4fb652
mov eax, ebx
call fcn.004fc0d8
cmp dword [ebx + 0x40], 0
je 0x4fb64b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4fb6c3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4fb6b5
cmp dword [ebx + 8], 0
je 0x4fb674
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4fb686
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4fb6b5
cmp dword [ebx + 8], 0
je 0x4fb667
cmp eax, 3
je 0x4fb699
dec eax
jne 0x4fb667
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4fb667
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4fb667
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4fb6e1
cmp dword [ebx + 0x14], 0xcc
je 0x4fb6e1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004fb6ec
pop ebx
ret
Function at 0x436de6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
xor ebx, ebx
mov esi, 0x421720
rep stosd dword es:[edi], eax
or dword [ebp - 0xc], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [0x421720], eax
je 0x436e51
mov edi, dword [ebp + 8]
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push ebx
push 0x10
push ebx
push dword [esi]
push edi
call dword [eax + 0x10]
test eax, eax
jne 0x436e4a
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 4]
call fcn.004376e8
test eax, eax
jne 0x436eab
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 4], ebx
add esi, 0x10
cmp dword [esi], ebx
jne 0x436e19
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 8]
mov edi, dword [ebp - 0x2c]
push ecx
push 2
push dword [ebp - 0x20]
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x34]
test eax, eax
jne 0x436eab
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
add edx, 4
test edi, edi
je 0x436e91
mov eax, dword [edx]
xor eax, dword [ecx]
movzx eax, ax
xor eax, dword [edx]
lea edx, [edx + 4]
mov dword [ecx], eax
lea ecx, [ecx + 0x10]
sub edi, 1
jne 0x436e78
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], ebx
je 0x436ea1
mov eax, dword [esi]
push ebx
push ecx
push dword [ebp - 0x2c]
push esi
call dword [eax + 0x20]
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.00436c81
push dword [ebp - 8]
call 0x442f94
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x436ec3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.00436b6c
mov esp, ebp
pop ebp
ret 8
Function at 0x10050569
Capabilities:
Encode data using xor

Disassembly:
sbb byte [ebx], ah
xor esi, eax
xchg ecx, eax
fistp dword [edx + 0x5cf730d7]
jb 0x1005055c
retf 0x3daf
adc dl, byte [ebx - 0x30]
invalid
jno 0x10050506
inc ecx
jl 0x1005058c
cmp eax, 0x16d22fa
invalid
push cs
pop edi
inc ecx
or byte [eax + 0x14fa8bdc], cl
movsd dword es:[edi], dword [esi]
mov al, byte [0xe452413]
inc ebp
push cs
inc ebp
push cs
movsb byte es:[edi], byte [esi]
psubsb mm3, qword [edi]
xor al, 0x47
jle 0x1005053e
jno 0x10050536
or al, 0x2c
jae 0x100505ec
invalid
mov edx, gs
cdq
dec esi
and eax, 0x5d70c246
test edx, 0xc7b244f3
sar bh, 1
pop esp
sti
xor esp, dword [edx + 0x4fc62de2]
test dword [ebp + esi - 0x4092ba73], edi
add dh, byte [eax + 0x3fdbe589]
into
lahf
iretd
scasd eax, dword es:[edi]
and bl, byte [edx + 0x212caf28]
and al, 0xbd
inc ebp
xor al, 0x90
shr ebp, cl
out dx, eax
pop ecx
inc ecx
salc
add dword [edx], esi
sbb dword [eax], ecx
jge 0x100505df
in al, dx
xor al, 0x89
xor ecx, 0xcdc8cd94
lahf
mov bl, 0xb3
pop esi
dec edx
inc ecx
mov esi, 0xe7232276
and ah, byte [ebx + 0x22]
lodsb al, byte [esi]
inc eax
xor byte [ecx], dh
pop ebp
and al, 0xe
xor dword [ebp + 0x24], ebx
push cs
popal
push ebp
mov ebp, edx
or eax, dword [eax]
xor dh, byte [edx]
xor esi, edi
adc dword [esp + esi + 0xb], ecx
jecxz 0x100505fd
or esp, ebx
std
js 0x100505c8
sub al, 0x8b
push ebx
cmp edi, 0xec5fc5f9
stc
lds ebx, [edi - 0x14]
jb 0x10050665
movsd dword es:[edi], dword [esi]
push eax
js 0x1005063a
call 0x13dfbaef
lea ebx, [edi - 0x27e241c1]
jns 0x100505ba
dec ebx
out 0xea, al
inc eax
xor bl, cl
push edi
xchg esp, eax
stc
inc edi
mov dword [eax + 0x1f90417c], edi
push edx
xchg ecx, eax
stc
cmpsd dword [esi], dword es:[edi]
add al, 0x24
outsd dx, dword [esi]
cmp ebx, esi
push 0x42
loop 0x10050630
enter 0xffffffffffff8097, 0xffffffffffffffd9
pop eax
xor ebp, edi
jmp 0x37662737
jnp 0x100506b6
pop esp
out dx, al
mov al, 0x40
jns 0x10050607
sbb eax, 0x232a5b45
jb 0x1005068b
getsec
wait
inc esi
inc edi
adc ah, ah
aaa
push ss
add byte [edi + 0x322f9677], bl
inc esp
and dword [eax + edi], ecx
xor al, 0x9f
cmp dword [eax + 0x208e9649], ebx
dec ecx
xchg esi, eax
mov fs, word [eax]
shr ah, 1
mov ecx, 0x886c9d18
test eax, 0xf1408521
sti
mov cl, 0x4b
cmp ah, byte [ebp + 0x17]
push esi
push esi
dec edx
wait
jp 0x10050700
into
stosb byte es:[edi], al
mov dl, 0xf8
cmc
mov eax, dword [0x2a85bc]
sbb edx, ecx
cmp byte [edi - 0x1a], al
or bl, 3
dec esi
stosd dword es:[edi], eax
ror dword [ebx + 0x53], cl
sbb ebp, ebp
in al, dx
mov cl, 0x94
cdq
invalid
inc esp
out 0x80, al
retf
push ebx
or dl, byte [eax + 0x3b252164]
jle 0x10050733
in eax, dx
dec ebp
push edx
sbb dword [ebp - 0x4d], 0x9f205d09
pop esi
xchg ebx, eax
jge 0x10050739
into
pop eax
imul ecx, dword [edi], 0xffffffef
pop ebp
and dl, byte [edx - 0x61]
fistp dword [ebp + 0x682e49f2]
jbe 0x10050774
cdq
cmpsd dword [esi], dword es:[edi]
sbb byte [ecx - 0x63c54200], ah
daa
inc esp
sbb al, 0xd3
add cl, byte [ebp - 0x5b]
rol dword [edx], cl
dec ebp
movsd dword es:[edi], dword [esi]
inc ebx
dec edx
imul esi, edi, 0x4b
xchg edi, eax
adc bl, ah
push cs
add dh, al
int3
aaa
jno 0x10050717
mov bl, 0x30
xor al, byte [eax]
retf
Function at 0x4055d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x61f008], 0x8088405
inc edx
mov dword [ebx + 0x61f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4201cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x420225
test eax, edx
je 0x420228
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4201e3
movzx eax, word [eax]
sub eax, ecx
jmp 0x42020a
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42020b
add ecx, 4
js 0x4201fb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x420208
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42020a
xor eax, eax
ret
test eax, eax
je 0x420234
test edx, edx
jne 0x4201d4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4287b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004081d4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040bc7c
mov edi, eax
cmp edi, 0x104
jbe 0x42875f
mov eax, edi
add eax, eax
call fcn.0040505c
mov esi, eax
jmp 0x428761
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040bc7c
push esi
call fcn.0040df08
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42879a
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x428784
mov eax, esp
cmp esi, eax
je 0x4287a7
mov eax, esi
call fcn.00405078
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4287e0
cmp bl, 0
je 0x4287dc
cmp bl, 0x41
jl 0x4287d7
cmp bl, 0x5a
jg 0x4287d7
or bl, 0x20
xor al, bl
inc esi
jmp 0x4287bb
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x428720
Function at 0x45aa90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00407dc0
xor eax, eax
push ebp
push 0x459faa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x45aac5
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x45ab16
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00408ca4
mov edx, dword [ebp - 0x10]
mov eax, 0x459fc4
call fcn.00409114
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, ecx
test eax, eax
je 0x45aaf0
sub eax, 4
mov eax, dword [eax]
dec eax
cmp edx, eax
jne 0x45ab16
mov ebx, ecx
test ebx, ebx
je 0x45ab00
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004087e8
mov eax, dword [ebp - 4]
test eax, eax
je 0x45ab22
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x45ab52
mov dword [ebp - 0xc], 1
lea eax, [ebp - 4]
call fcn.0040828c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx ecx, byte [ecx + esi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 0xc]
dec ebx
jne 0x45ab2f
mov eax, dword [ebp - 4]
test eax, eax
je 0x45ab5e
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 0xc], 0
jle 0x45ab8c
lea eax, [ebp - 4]
call fcn.0040828c
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459fb1
lea eax, [ebp - 0x10]
call fcn.00407ccc
lea eax, [ebp - 4]
call fcn.00407cf0
ret

Function at 0x45c210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004088ec
cmp dword [ebp - 4], 0
jle 0x45c251
mov eax, ebx
call fcn.0040828c
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x45c262
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x45c290
mov dword [ebp - 4], 1
mov eax, ebx
call fcn.0040828c
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov edi, dword [ebp - 4]
movzx ecx, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 4]
dec esi
jne 0x45c26f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x463078
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call fcn.0040d9a0
test eax, eax
jne 0x4630b7
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4630b7
cmp dword [eax + 0x3c], 0
je 0x4630b7
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0xf8
push esi
call fcn.0040d9a0
test eax, eax
jne 0x4630b5
cmp dword [esi], 0x4550
je 0x4630b7
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x467108
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.004592e4
test al, al
je 0x46714c
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x46714c
cmp dword [eax + 0x3c], 0
je 0x46714c
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.004592e4
test al, al
je 0x46714a
cmp dword [esi], 0x4550
je 0x46714c
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x46a194
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov ebx, dword [eax]
mov esi, ebx
xor esi, ecx
and esi, 0xff
shr ebx, 8
mov esi, dword [edx + esi*4]
xor esi, ebx
mov dword [eax], esi
and esi, 0xff
add dword [eax + 4], esi
imul ebx, dword [eax + 4], 0x8088405
inc ebx
mov dword [eax + 4], ebx
shr ebx, 0x18
mov esi, dword [eax + 8]
xor ebx, esi
and ebx, 0xff
shr esi, 8
mov edx, dword [edx + ebx*4]
xor edx, esi
mov dword [eax + 8], edx
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x46a218
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
cmp dword [ebp - 0xc], 0xc
jge 0x46a23d
xor eax, eax
jmp 0x46a36e
inc dword [0x620c78]
mov edx, dword [0x620c78]
cmp edx, 1
jne 0x46a262
push 0
call fcn.00469b04
pop ecx
xor eax, 0xbb40e64e
push eax
call fcn.00469b1c
pop ecx
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0046a1e0
xor ebx, ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], eax
call fcn.00469b10
sar eax, 7
and eax, 0xff
mov dword [ebp - 0x14], eax
mov edx, edi
mov eax, esi
call fcn.0046a174
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov edx, edi
mov eax, esi
call fcn.0046a194
mov dl, byte [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor dl, byte [ebp - 0x14]
mov byte [ecx], dl
inc ebx
inc dword [ebp - 0x24]
cmp ebx, 0xa
jl 0x46a276
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0046a1e0
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x20]
mov edx, eax
xor ebx, ebx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
mov edx, edi
mov eax, esi
call fcn.0046a174
mov dword [ebp - 0x10], eax
mov eax, esi
mov ecx, dword [ebp - 0x28]
mov edx, edi
movzx ecx, byte [ecx]
call fcn.0046a194
mov al, byte [ebp - 0x10]
mov edx, dword [ebp - 0x28]
xor al, byte [edx]
mov ecx, dword [ebp - 0x2c]
mov byte [ecx], al
inc ebx
inc dword [ebp - 0x2c]
inc dword [ebp - 0x28]
cmp ebx, 0xa
jl 0x46a2ce
mov edx, edi
mov eax, esi
call fcn.0046a174
mov dword [ebp - 0x10], eax
mov eax, esi
mov ecx, dword [ebp + 8]
mov edx, edi
shr ecx, 0x10
and ecx, 0xff
call fcn.0046a194
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
shr eax, 0x10
mov cl, byte [ebp - 0x10]
and al, 0xff
xor cl, al
mov eax, esi
mov byte [edx + ebx], cl
mov edx, edi
inc ebx
call fcn.0046a174
mov dword [ebp - 0x10], eax
mov eax, esi
mov ecx, dword [ebp + 8]
mov edx, edi
shr ecx, 0x18
and ecx, 0xff
call fcn.0046a194
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
shr eax, 0x18
mov cl, byte [ebp - 0x10]
and al, 0xff
xor cl, al
mov byte [edx + ebx], cl
inc ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46b2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
xor esi, esi
test eax, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
jne 0x46b2ed
mov eax, 0xffffff9a
jmp 0x46b4b5
mov ebx, eax
cmp dword [ebx + 0x2c], 0
jne 0x46b2ff
mov eax, 0xffffff9a
jmp 0x46b4b5
xor edx, edx
mov dword [ebx + 0x34], edx
cmp dword [ebx + 0x80], 8
jne 0x46b356
cmp dword [ebx + 0x84], 0
jne 0x46b356
test esi, esi
jne 0x46b356
cmp dword [ebx + 0x40], 0
jne 0x46b338
mov eax, ebx
call fcn.0046b15c
mov dword [ebx + 0x40], 0x10000
lea edx, [ebx + 0x88]
inc eax
mov dword [ebx + 0x3c], edx
mov edi, dword [ebx + 0x44]
lea eax, [ebx + 0x30]
mov edx, 4
call fcn.0046cad8
mov esi, eax
mov eax, dword [ebx + 0x44]
sub eax, edi
add dword [ebx + 0x6c], eax
test esi, esi
je 0x46b31a
cmp esi, 1
jne 0x46b35d
xor esi, esi
cmp dword [ebx + 0x6c], 0
jbe 0x46b374
test esi, esi
jne 0x46b374
mov eax, ebx
call fcn.0046b15c
inc eax
jne 0x46b374
or esi, 0xffffffff
cmp dword [ebx + 0x80], 8
jne 0x46b395
cmp dword [ebx + 0x84], 0
jne 0x46b395
lea eax, [ebx + 0x30]
call fcn.0046cd9c
mov esi, eax
xor eax, eax
mov dword [ebx + 0x68], eax
cmp dword [ebx + 0x84], 0
jne 0x46b3ae
mov edx, dword [ebx + 0x1008c]
mov dword [esp + 4], edx
mov ecx, dword [ebx + 0x38]
mov dword [esp], ecx
mov edi, dword [ebx + 0x44]
add edi, dword [ebx + 0x100a4]
mov eax, dword [ebx + 0x74]
add eax, 0x10
mov ecx, 4
mov edx, dword [esp + 4]
call fcn.0046a4f8
mov eax, dword [ebx + 0x74]
add eax, 0x14
mov ecx, 4
mov edx, edi
call fcn.0046a4f8
cmp dword [ebx + 0x5c], 1
jne 0x46b3f8
mov eax, dword [ebx + 0x74]
add eax, 0x24
mov ecx, 2
mov edx, 1
call fcn.0046a4f8
mov eax, dword [ebx + 0x74]
add eax, 0x18
mov ecx, 4
mov edx, dword [esp]
call fcn.0046a4f8
test esi, esi
jne 0x46b41f
lea eax, [ebx + 0x24]
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x74]
call fcn.0046a3d0
mov esi, eax
mov eax, dword [ebx + 0x74]
push eax
call fcn.00469af4
pop ecx
test esi, esi
jne 0x46b4a8
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
push 0
mov ecx, dword [ebx + 0x70]
mov edx, dword [ebx + 0x20]
add ecx, 0xe
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x10]
test eax, eax
je 0x46b452
or esi, 0xffffffff
test esi, esi
jne 0x46b468
push 4
mov ecx, dword [esp + 8]
mov edx, dword [ebx + 0x20]
mov eax, ebx
call fcn.0046a48c
mov esi, eax
test esi, esi
jne 0x46b47c
push 4
mov ecx, edi
mov edx, dword [ebx + 0x20]
mov eax, ebx
call fcn.0046a48c
mov esi, eax
test esi, esi
jne 0x46b492
push 4
mov ecx, dword [esp + 4]
mov edx, dword [ebx + 0x20]
mov eax, ebx
call fcn.0046a48c
mov esi, eax
push 0
mov ecx, dword [esp + 0xc]
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x10]
test eax, eax
je 0x46b4a8
or esi, 0xffffffff
inc dword [ebx + 0x100b0]
xor eax, eax
mov dword [ebx + 0x2c], eax
mov eax, esi
add esp, 0xc
pop edi
pop esi
pop ebx
ret