joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b7a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001b7b8
pop dword [ebp - 0xc]
mov eax, 0xb5918466
add eax, 0x5a703352
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x7db4853b
sub dword [ebp - 0x1c], 0x2f623ff0
mov dword [ebp - 0x18], 0x848fce0f
add dword [ebp - 0x18], 0xada37e36
mov dword [ebp - 0x14], 0x5f1ba32a
sub dword [ebp - 0x14], 0x12cf5efc
mov dword [ebp - 0x10], 0xbb7c11c6
add dword [ebp - 0x10], 0x4483ee3a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x15cdb70c
sub eax, 0x5cbc6c4
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x759e3e1e
add dword [ebp - 0x1c], 0xfed42b38
mov dword [ebp - 0x18], 0xefe831a8
add dword [ebp - 0x18], 0x51842fcd
mov dword [ebp - 0x14], 0xd7dcfc30
add dword [ebp - 0x14], 0x8b92703c
mov dword [ebp - 0x10], 0xa8cccc58
sub dword [ebp - 0x10], 0xa8cccc58
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xfa3b76c8
sub eax, 0xea39867c
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3e341
push 0
call eax
mov ecx, 0xa6dd20b6
add ecx, 0x59232937
mov edi, eax
mov ebx, 0xb8c3673b
add ebx, 0x573f44c5
add ebx, dword [ebp - 0xc]
mov edx, 0x6823bc2b
sub dword [ebp - 8], 0x660f6185
mov esi, dword [ebx]
xor dword [ebp - 4], 0x1a0f362c
add esi, edx
xor dword [ebp - 8], 0x6e8c993a
mov dword [edi], esi
xor dword [ebp - 8], 0xeac972b9
add edi, 0x84b3c440
add edi, 0x7b4c3bc4
add ebx, 0x977791ab
add ebx, 0x68886e59
loop 0x1001b8d4
add eax, 0xfd012137
sub eax, 0xfd0006b0
xor ebx, ebx
add ebx, eax
add eax, 0x6a35cd88
add eax, 0x95ca327d
mov ecx, 0xd9b7e596
add ecx, 0x36481a6a
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x1001d7ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026200]
jne 0x1001d7b6
repz ret
jmp fcn.1001dc29
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403203
pop dword [ebp - 0x48]
mov eax, 0xfbbdd5dd
sub eax, 0xfb7da3da
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x8f08f488
add dword [ebp - 0x58], 0xbf4950c3
mov dword [ebp - 0x54], 0xfcfbe865
sub dword [ebp - 0x54], 0xcac89c20
mov dword [ebp - 0x50], 0x7744d2cc
sub dword [ebp - 0x50], 0x2af88e9e
mov dword [ebp - 0x4c], 0x7e7bedda
add dword [ebp - 0x4c], 0x81841226
lea eax, [ebp - 0x58]
push eax
mov eax, 0x71d2327a
sub eax, 0x7191c216
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1424ea66
sub dword [ebp - 0x58], 0x9fb28110
mov dword [ebp - 0x54], 0x9efc0a60
sub dword [ebp - 0x54], 0x5d8fa8eb
mov dword [ebp - 0x50], 0x6b490bce
sub dword [ebp - 0x50], 0x7d99f62
mov dword [ebp - 0x4c], 0x958c55d7
sub dword [ebp - 0x4c], 0x958c55d7
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xe629ed8f
add eax, 0x1a168319
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3c375
push 0
call eax
mov ecx, 0x624637d1
sub ecx, 0x6245d954
xor edi, edi
add edi, eax
mov esi, 0xb643aeae
sub esi, 0xb602aeae
add esi, dword [ebp - 0x48]
mov ebx, 0xf7d86fd0
sub ebx, 0x34099d7c
sub dword [ebp - 0x44], 0x25e5a7cf
mov edx, dword [esi]
xor dword [ebp - 0x10], 0xab0f8173
xor edx, ebx
add dword [ebp - 0x30], edi
mov dword [edi], edx
sub dword [ebp - 4], ebx
add edi, 0x2f2be258
sub edi, 0x2f2be254
add esi, 0xf580ef48
sub esi, 0xf580ef44
loop 0x403327
add eax, 0xb7d2015a
add eax, 0x482f6b6d
mov ebx, eax
add eax, 0x18f63535
sub eax, 0x18f63530
mov ecx, 0xe2f2fd82
sub ecx, 0xe2b2fd82
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4010f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b1004]
jne 0x4010fe
repz ret
jmp fcn.004014d0

Function at 0x408cfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b1004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404ac6
and dword [ebp - 0x14], 0
cmp dword [0x4b3c74], 0
mov dword [ebp - 0x18], eax
jne 0x408daf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4b3c74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4b3c78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4b3c7c], eax
call edi
push eax
call esi
mov dword [0x4b3c84], eax
test eax, eax
je 0x408daf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4b3c80], eax
mov eax, dword [0x4b3c80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408e08
cmp dword [0x4b3c84], ecx
je 0x408e08
push eax
call esi
push dword [0x4b3c84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408e08
test ebx, ebx
je 0x408e08
call edi
test eax, eax
je 0x408dff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408dff
test byte [ebp - 8], 1
jne 0x408e08
or dword [ebp + 0x10], 0x200000
jmp 0x408e3b
mov eax, dword [0x4b3c78]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e3b
mov eax, dword [0x4b3c7c]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b3c74]
call esi
test eax, eax
je 0x408e57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010f4
leave
ret
Function at 0x4a5770
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x4b1004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4b1db0]
push ebx
mov ebx, dword [0x2c57234]
push edi
mov edi, dword [0x2c596b4]
call fcn.004a56e0
cmp dword [0x2c596b4], 0x2f
jne 0x4a57dd
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004a5710
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010f4
add esp, 0x24
ret
Function at 0x4a5a70
Capabilities:
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x4a5a88
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x4a5ad1
mov dword [0x2c5931c], 0x8e46a6f0
cmp dword [0x2c596b4], 0x3dc
jne 0x4a5acf
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x4a5a7f
mov dword [ebp - 0x10], 0
jmp 0x4a5ae3
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x4a5b86
cmp dword [0x2c596b4], 0xa5f
jne 0x4a5b0c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x10], 0x84620b
jne 0x4a5b31
mov eax, dword [0x4b2bd0]
mov dword [0x2c596b4], eax
mov ecx, dword [0x2c596b4]
add ecx, 0xa231
mov dword [0x2c596b4], ecx
cmp dword [0x2c596b4], 0x141
jne 0x4a5b81
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x4b41a0], 0xec58acac
mov dword [0x4b41a4], 0xffffffff
jmp 0x4a5ada
call fcn.004a5800
jmp dword [0x2c57234]
Function at 0x401210
Capabilities:
Parse pe header

Disassembly:
test ecx, ecx
jne 0x401217
xor al, al
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x401214
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401214
mov eax, dword [eax + 0x98]
test eax, eax
je 0x401214
add ecx, eax
je 0x401214
lea edx, [ecx + 8]
test edx, edx
je 0x401214
cmp byte [edx], 0x30
lea eax, [edx + 1]
jne 0x401214
mov dl, byte [eax]
inc eax
cmp dl, 0x82
jne 0x401214
movzx edx, byte [eax]
movzx eax, byte [eax + 1]
shl edx, 8
lea eax, [edx + eax + 0x13]
and eax, 0xffffff8
je 0x401214
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov al, 1
ret
Function at 0x401920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x424688
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4372c0]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4372c0]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov ecx, 7
xor edi, edi
xor eax, eax
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xa4], edi
mov word [esp + 0x94], ax
mov dword [esp + 0xb8], edi
cmp dword [0x4390f0], 0xa
mov dword [esp + 0x14], edi
jb 0x401b3b
mov eax, dword [0x438098]
mov ebp, 8
cmp dword [0x4380ac], ebp
jae 0x4019a9
mov eax, 0x438098
mov dword [esp + 0x8c], ecx
xor ecx, ecx
mov word [esp + 0x78], cx
mov ecx, eax
mov dword [esp + 0x88], edi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x4019c3
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x78]
call fcn.00409980
lea edx, [esp + 0x90]
push edx
mov ecx, esi
mov byte [esp + 0xbc], 1
call fcn.004016d0
add esp, 4
test eax, eax
sete bl
mov byte [esp + 0xb8], 0
cmp dword [esp + 0x8c], ebp
jb 0x401a19
mov eax, dword [esp + 0x78]
push eax
call fcn.00412b13
add esp, 4
test bl, bl
je 0x401b1e
lea ecx, [esp + 0x90]
push ecx
lea edi, [esp + 0x5c]
call fcn.004122c0
push eax
mov ebx, str.TUInstallHelper.exe
lea esi, [esp + 0x7c]
mov byte [esp + 0xc0], 2
call fcn.0040a7a0
add esp, 8
cmp dword [esp + 0x70], ebp
jb 0x401a5f
mov edx, dword [esp + 0x5c]
push edx
call fcn.00412b13
add esp, 4
xor esi, esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x140
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], str.open
cmp dword [esp + 0x8c], ebp
jb 0x401a90
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], eax
jmp 0x401a98
lea ecx, [esp + 0x78]
mov dword [esp + 0x2c], ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x34], str.__uninstall_sandman
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 1
call dword [0x427258]
test eax, eax
je 0x401b08
mov ebx, dword [0x427078]
mov dword [esp + 0x18], esi
mov esi, dword [0x427194]
mov edi, 0x103
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x18]
push eax
push ecx
call ebx
test eax, eax
je 0x401ae8
mov eax, dword [esp + 0x18]
cmp eax, edi
jne 0x401af4
push 0xa
call esi
cmp dword [esp + 0x18], edi
je 0x401ad0
jmp 0x401b08
cmp eax, 1
jne 0x401aff
mov dword [esp + 0x14], eax
jmp 0x401b08
cmp eax, 2
jne 0x401b08
mov dword [esp + 0x14], eax
cmp dword [esp + 0x8c], ebp
jb 0x401b1e
mov edx, dword [esp + 0x78]
push edx
call fcn.00412b13
add esp, 4
cmp dword [esp + 0xa8], ebp
jb 0x401b37
mov eax, dword [esp + 0x94]
push eax
call fcn.00412b13
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00412b1e
add esp, 0xa8
ret
Function at 0x401b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x424688
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4372c0]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4372c0]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov ecx, 7
xor edi, edi
xor eax, eax
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xa4], edi
mov word [esp + 0x94], ax
mov dword [esp + 0xb8], edi
mov eax, dword [0x438098]
mov ebp, 8
mov ebx, 1
mov dword [esp + 0x14], ebx
cmp dword [0x4380ac], ebp
jae 0x401bf1
mov eax, 0x438098
mov dword [esp + 0x8c], ecx
xor ecx, ecx
mov word [esp + 0x78], cx
mov ecx, eax
mov dword [esp + 0x88], edi
lea esi, [ecx + 2]
jmp 0x401c10
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x401c10
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x78]
call fcn.00409980
lea edx, [esp + 0x90]
push edx
mov ecx, esi
mov byte [esp + 0xbc], bl
call fcn.004016d0
add esp, 4
test eax, eax
sete bl
mov byte [esp + 0xb8], 0
cmp dword [esp + 0x8c], ebp
jb 0x401c65
mov eax, dword [esp + 0x78]
push eax
call fcn.00412b13
add esp, 4
test bl, bl
je 0x401d5c
lea ecx, [esp + 0x90]
push ecx
lea edi, [esp + 0x5c]
call fcn.004122c0
push eax
mov ebx, str.TUInstallHelper.exe
lea esi, [esp + 0x7c]
mov byte [esp + 0xc0], 2
call fcn.0040a7a0
add esp, 8
cmp dword [esp + 0x70], ebp
jb 0x401cab
mov edx, dword [esp + 0x5c]
push edx
call fcn.00412b13
add esp, 4
xor esi, esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x20], 0x140
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], str.open
cmp dword [esp + 0x8c], ebp
jb 0x401cdc
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], eax
jmp 0x401ce4
lea ecx, [esp + 0x78]
mov dword [esp + 0x2c], ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x34], str.__close_tuuapps
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 1
call dword [0x427258]
test eax, eax
je 0x401d42
mov ebx, dword [0x427078]
mov dword [esp + 0x18], esi
mov esi, dword [0x427194]
mov edi, 0x103
lea esp, [esp]
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x18]
push eax
push ecx
call ebx
test eax, eax
je 0x401d36
cmp dword [esp + 0x18], edi
jne 0x401d46
push 0xa
call esi
cmp dword [esp + 0x18], edi
je 0x401d20
jmp 0x401d46
mov dword [esp + 0x14], esi
cmp dword [esp + 0x8c], ebp
jb 0x401d5c
mov edx, dword [esp + 0x78]
push edx
call fcn.00412b13
add esp, 4
cmp dword [esp + 0xa8], ebp
jb 0x401d75
mov eax, dword [esp + 0x94]
push eax
call fcn.00412b13
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00412b1e
add esp, 0xa8
ret
Function at 0x40a7a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x423c88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4372c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.004098d0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a7f6
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00409790
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.004098d0
cmp dword [esp + 0x24], 8
jb 0x40a83f
mov edx, dword [esp + 0x10]
push edx
call fcn.00412b13
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4122c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x423e18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4372c0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x4372c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0xc], ebx
cmp dword [eax + 0x14], ebx
jne 0x412322
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
push 1
mov eax, 0x42a2ac
mov esi, edi
call fcn.00409980
jmp 0x4123a8
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x18], cx
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
call fcn.004098d0
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x24]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x412355
call fcn.00413e53
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x412364
lea eax, [esp + 0x14]
cmp word [eax + esi*2], 0x5c
je 0x412376
push 0x5c
lea esi, [esp + 0x14]
call fcn.004090a0
push 0xffffffffffffffff
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push ebx
lea eax, [esp + 0x18]
mov ecx, edi
mov word [edi + 4], dx
call fcn.004098d0
cmp dword [esp + 0x28], 8
jb 0x4123a8
mov eax, dword [esp + 0x14]
push eax
call fcn.00412b13
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00412b1e
add esp, 0x30
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x10a99008], 0x8088405
inc edx
mov dword [ebx + 0x10a99008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x10a7d58e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10a7d595
ret