joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c2afc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [0x41e11a0]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [0x41e11a0]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.041c2acc
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.041c2acc
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.041c2acc
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.041c2acc
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x41c2b4a
movzx edx, word [ebx]
mov eax, edi
call fcn.041c2acc
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [0x41e11a0]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.041c2acc
mov word [ebp - 4], ax
mov ebx, dword [0x41e11a0]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c3270
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x41c3293
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41c4c28
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x41c4c3e
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x41c4c37
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x41c4cc9
movzx ecx, byte [ecx + 0x41d57d4]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d56d4]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d56d4]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d57d4]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x41c4d26
movzx ecx, byte [ecx + 0x41d57d4]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d57d4]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d56d4]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d56d4]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x41d56d4]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d57d4]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d56d4]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d57d4]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x41d56d4]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d56d4]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d57d4]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d57d4]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x41d58d4]
xor edx, dword [ebx*4 + 0x41d5cd4]
xor edx, dword [eax*4 + 0x41d60d4]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x41d64d4]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x41c4f28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x41c4f38
pop esi
pop ebx
ret
Function at 0x41c4f4c
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x41d56d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41d56d4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41d58d4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41c4f7d
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x41d57d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41d56d4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41d5cd4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x400], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41c4fcc
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x41d56d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41d57d4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41d60d4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x800], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41c501f
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x41d57d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41d57d4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41d64d4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0xc00], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41c5072
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c50a4
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x41d57d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x14]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41d56d4]
xor esi, ecx
movzx esi, byte [esi + 0x41d56d4]
xor esi, edx
mov esi, dword [esi*4 + 0x41d58d4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41c50de
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x41d57d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x13]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41d57d4]
xor esi, ecx
movzx esi, byte [esi + 0x41d56d4]
xor esi, edx
mov esi, dword [esi*4 + 0x41d5cd4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x400], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41c513d
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x41d56d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x12]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41d56d4]
xor esi, ecx
movzx esi, byte [esi + 0x41d57d4]
xor esi, edx
mov esi, dword [esi*4 + 0x41d60d4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x800], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41c51a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x41d56d4
lea eax, [ebp - 0x100]
call fcn.041c4f28
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x11]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x41d57d4]
xor esi, ecx
movzx esi, byte [esi + 0x41d57d4]
xor esi, edx
mov esi, dword [esi*4 + 0x41d64d4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0xc00], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x41c5203
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c5a54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov ebx, dword [0x41e1154]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 8
mov dword [ebp - 0x24], 0x41d6ad4
lea ebx, [ebp - 0x1e]
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
call fcn.041c5a14
pop ecx
mov byte [ebx], al
mov byte [ebp - 0xe], 7
mov eax, dword [ebp - 0x24]
lea esi, [eax + 1]
lea edi, [ebp - 0x15]
push ebp
xor edx, edx
mov dl, byte [edi]
xor eax, eax
mov al, byte [esi]
call fcn.041c5a14
pop ecx
xor byte [ebx], al
inc edi
inc esi
dec byte [ebp - 0xe]
jne 0x41c5acb
inc ebx
add dword [ebp - 0x24], 8
dec byte [ebp - 0xd]
jne 0x41c5aaa
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 7
lea eax, [ebp - 0x1d]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
shl edx, 8
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
shr ecx, 0x18
or edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shl edx, 8
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], edx
inc eax
dec byte [ebp - 0xd]
jne 0x41c5b06
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c5b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov eax, 0x41d6b14
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], 5
mov ebx, dword [edx]
xor dword [ecx], ebx
mov ebx, dword [edx + 4]
xor dword [ecx + 4], ebx
add edx, 8
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1800]
mov ebx, dword [ecx]
mov edi, ebx
shr edi, 0x17
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, ebx
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3000]
mov edi, ebx
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3800]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
or esi, 1
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1800]
mov edi, dword [ecx]
shr edi, 0x17
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, dword [ecx]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x3000]
add ebx, ebx
and ebx, 0x1fe
or ebx, 1
xor esi, dword [eax + ebx*4 + 0x3800]
mov dword [ecx + 4], esi
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
dec dword [ebp - 0x10]
jne 0x41c5b62
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
xor dword [ecx + 4], eax
add edx, 8
mov eax, dword [ecx]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x41d68d4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x41d68d4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x41d68d4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x41d68d4]
xor ebx, eax
mov dword [ecx], ebx
mov eax, dword [ecx + 4]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x41d68d4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x41d68d4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x41d68d4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x41d68d4]
xor ebx, eax
mov dword [ecx + 4], ebx
mov eax, dword [edx]
xor eax, dword [ecx]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c67c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x41c67d2
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
cmp edx, dword [eax]
jne 0x41c67ce
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41c6829
xor eax, eax
push ebp
push 0x41c6822
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c6829
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x41c74fc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x41c7504
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41c765b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x358]
call sub.dbrtl60.bpl__Db_TDataSet_GetActive_qqrv
test al, al
jne 0x41c7537
mov eax, dword [ebx + 0x358]
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x390]
call sub.vcl60.bpl__Controls_TControl_GetText_qqrv
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call sub.rtl60.bpl__Sysutils_Trim_qqrx17System_AnsiString
cmp dword [ebp - 4], 0
jne 0x41c757e
push 0x80000001
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x41c7670
xor edx, edx
mov eax, 0x41c7684
call sub.vegalib60.bpl__Strtools_ReadStringFromReg_qqr17System_AnsiStringt1t1ui
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x390]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
mov eax, dword [sym.imp.VEDatasets.bpl__Vedataset_defFirmaNo]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x41c76b0
mov edx, dword [ebx + 0x3ac]
mov eax, dword [0x4198d5c]
call fcn.04199030
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x10]
call sub.rtl60.bpl__System__VarToLStr_qqrr17System_AnsiStringrx14System_Variant
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x324]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
mov eax, dword [sym.imp.VEDatasets.bpl__Vedataset_defFirmaNo]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0
mov eax, dword [sym.imp.VEDatasets.bpl__Vedataset_defDonemNo]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x4c]
push eax
push 1
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x41c76e0
mov edx, dword [ebx + 0x3ac]
mov eax, dword [0x4198d5c]
call fcn.04199030
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x2c]
call sub.rtl60.bpl__System__VarToLStr_qqrr17System_AnsiStringrx14System_Variant
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x32c]
call sub.vcl60.bpl__Controls_TControl_SetText_qqrx17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c7662
lea eax, [ebp - 0x3c]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 0x2c]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 0x20]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 0x10]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x414def
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], eax
add ebx, 4
cmp ebx, esi
jne fcn.00414def
mov edx, edi
ret
Function at 0x405062
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x405083
jl 0x40507a
test edi, edi
jne 0x405083
xor eax, eax
xor edx, edx
jmp 0x405144
cmp dword [ebx + 0x38], 0
je 0x405098
push eax
push edi
push dword [ebp + 8]
call fcn.0040514a
jmp 0x405144
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4050df
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4050df
cmp eax, edi
jb 0x4050b9
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00407430
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4050e5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x405139
mov ecx, ebx
call fcn.004048f9
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x405124
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040d556
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x405139
jmp 0x4050f7
test edx, edx
je 0x405139
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040d556
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x406b1d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406b5c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406b5c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406b5c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406b5c
cmp dword [ecx + 0x74], 0xe
jbe 0x406b5c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x412cac
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427950
push 0x427948
push str.FlsAlloc
push 0x1f
call fcn.00412b17
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412ce0
push dword [ebp + 8]
mov ecx, esi
call dword [0x424140]
call esi
jmp 0x412ce6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x412d2a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427960
push 0x427958
push str.FlsGetValue
push 0x21
call fcn.00412b17
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412d61
push dword [ebp + 8]
mov ecx, esi
call dword [0x424140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x412d69
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427968
push 0x427960
push str.FlsSetValue
push 0x22
call fcn.00412b17
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412da3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x424140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]