joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ee5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
cmp dword [ebp + 0x18], 0
jle 0x48eebb
xor esi, esi
mov eax, dword [ebp + 0x14]
mov ecx, eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov bl, byte [eax]
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
inc esi
cmp esi, 8
jl 0x48ee74
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048e3f8
add esp, 0xc
push 8
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048db84
add esp, 0xc
add dword [ebp + 0x10], 8
add dword [ebp + 0x14], 8
sub dword [ebp + 0x18], 8
cmp dword [ebp + 0x18], 0
jg 0x48ee67
pop esi
pop ebx
pop ebp
ret

Function at 0x48eec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0x18], 0
jle 0x48ef2d
push 8
push esi
lea eax, [ebp - 8]
push eax
call fcn.0048db84
add esp, 0xc
push edi
push esi
mov edx, dword [ebp + 8]
add edx, 0x80
push edx
call fcn.0048e3f8
add esp, 0xc
xor ecx, ecx
mov edx, edi
mov eax, dword [ebp + 0xc]
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 8
jl 0x48eeff
push 8
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048db84
add esp, 0xc
add esi, 8
add edi, 8
sub dword [ebp + 0x18], 8
cmp dword [ebp + 0x18], 0
jg 0x48eed5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x490c34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
cmp dword [ebp + 0x18], 0
jle 0x490c93
xor esi, esi
mov eax, dword [ebp + 0x14]
mov ecx, eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov bl, byte [eax]
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
inc esi
cmp esi, 8
jl 0x490c4c
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048f08c
add esp, 0xc
push 8
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048db84
add esp, 0xc
add dword [ebp + 0x10], 8
add dword [ebp + 0x14], 8
sub dword [ebp + 0x18], 8
cmp dword [ebp + 0x18], 0
jg 0x490c3f
pop esi
pop ebx
pop ebp
ret

Function at 0x490c98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0x18], 0
jle 0x490d05
push 8
push esi
lea eax, [ebp - 8]
push eax
call fcn.0048db84
add esp, 0xc
push edi
push esi
mov edx, dword [ebp + 8]
add edx, 0x180
push edx
call fcn.0048f08c
add esp, 0xc
xor ecx, ecx
mov edx, edi
mov eax, dword [ebp + 0xc]
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 8
jl 0x490cd7
push 8
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048db84
add esp, 0xc
add esi, 8
add edi, 8
sub dword [ebp + 0x18], 8
cmp dword [ebp + 0x18], 0
jg 0x490cad
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x492c1c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp esi, 0x40
jle 0x492c49
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
call fcn.00492bc0
add esp, 0xc
mov esi, 0x14
lea ebx, [ebp - 0x14]
push 0x40
push 0x36
lea eax, [edi + 0x5c]
push eax
call fcn.0048db64
add esp, 0xc
lea edx, [edi + 0x9c]
push 0x40
push 0x5c
push edx
call fcn.0048db64
add esp, 0xc
xor ecx, ecx
lea edx, [edi + 0x5c]
mov eax, ebx
cmp esi, ecx
jle 0x492c87
mov bl, byte [eax]
inc ecx
xor byte [edx], bl
mov bl, byte [eax]
inc eax
xor byte [edx + 0x40], bl
inc edx
cmp esi, ecx
jg 0x492c77
push edi
call fcn.00490d8c
pop ecx
lea eax, [edi + 0x5c]
push 0x40
push eax
push edi
call fcn.004929d4
add esp, 0xc
lea edx, [ebp - 0x14]
push 0x14
push 0
push edx
call fcn.0048db64
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49bd78
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x49bd90
mov ebx, 0x7d0
push esi
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call sub.kernel32.dll_ReadFile
push ebx
mov eax, dword [esi + 0x10]
push eax
call sub.kernel32.dll_WaitForSingleObject
sub eax, 1
jb 0x49bdbb
sub eax, 0x101
je 0x49bdc7
jmp 0x49bddc
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edx
xor ebx, ebx
jmp 0x49bdef
push edi
call sub.kernel32.dll_CancelIo
mov ebx, 1
push 0x18
call fcn.0049aafc
pop ecx
jmp 0x49bdef
push edi
call sub.kernel32.dll_CancelIo
mov ebx, 2
push 0x19
call fcn.0049aafc
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x49bdf8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
test edi, edi
jne 0x49be10
mov edi, 0x7d0
push ebx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x49be2c
call sub.kernel32.dll_GetLastError
push edi
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_WaitForSingleObject
sub eax, 1
jb 0x49be44
sub eax, 0x101
je 0x49be50
jmp 0x49be65
mov edx, dword [ebx + 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edx
xor ebx, ebx
jmp 0x49be78
push esi
call sub.kernel32.dll_CancelIo
mov ebx, 1
push 0x1a
call fcn.0049aafc
pop ecx
jmp 0x49be78
push esi
call sub.kernel32.dll_CancelIo
mov ebx, 2
push 0x1b
call fcn.0049aafc
pop ecx
push 0
call fcn.0049aafc
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x49c14c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x49c180
push 0x36
call fcn.0049aafc
pop ecx
mov eax, 2
pop ecx
pop ebp
ret
push 0
call fcn.0049aafc
pop ecx
xor eax, eax
pop ecx
pop ebp
ret

Function at 0x49c190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x49c1c4
push 0x37
call fcn.0049aafc
pop ecx
mov eax, 2
pop ecx
pop ebp
ret
push 0
call fcn.0049aafc
pop ecx
xor eax, eax
pop ecx
pop ebp
ret
Function at 0x4a9ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x5dfd80
call fcn.0057c5c8
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call sub.CC3260MT.DLL__malloc
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4a9b45
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.kernel32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x4a9b45
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call sub.CC3260MT.DLL__realloc
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4a9b45
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.kernel32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x4a9b62
cmp dword [ebp - 0x34], 0
je 0x4a9b62
mov edx, dword [ebp - 0x34]
jmp 0x4a9b67
mov edx, 0x5df9f4
lea eax, [ebp - 4]
call fcn.0058f82c
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call sub.CC3260MT.DLL__free
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0058fb34
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0058fb04
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x4a9be5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b0a20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
call fcn.004b0a74
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b0a42
lea eax, [ebp - 1]
xor edx, edx
call fcn.004b0aa8
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b0a58
lea eax, [ebp - 1]
mov dl, 2
call fcn.004b0aa8
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b0a6e
lea eax, [ebp - 1]
mov dl, 1
call fcn.004b0aa8
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x4b10a4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl60.bpl__Forms_TApplication_Minimize_qqrv
push 0
mov edx, dword [sym.imp.vcl60.bpl__Forms_Application]
mov ecx, dword [edx]
push dword [ecx + 0x30]
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp word [eax + 0x24a], 0
je 0x4b10ec
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call dword [ebx + 0x248]
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b10f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl60.bpl__Forms_TApplication_Restore_qqrv
push 9
mov edx, dword [sym.imp.vcl60.bpl__Forms_Application]
mov ecx, dword [edx]
push dword [ecx + 0x30]
call sub.user32.dll_ShowWindow
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov edx, dword [eax]
push dword [edx + 0x30]
call sub.user32.dll_SetForegroundWindow
mov ecx, dword [ebp - 4]
cmp word [ecx + 0x252], 0
je 0x4b1147
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call dword [ebx + 0x250]
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b2c34
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [0x5eff80], 0
jne 0x4b2c6b
mov eax, dword [ebp - 4]
mov dword [sym.SDERPServer.exe__Csinpedt_frmCalculator], eax
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x4b2bf8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5eff80], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b3bbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.vcl60.bpl__Controls_TWinControl_HandleAllocated_qqrv
test al, al
je 0x4b3c26
cmp byte [ebp - 5], 7
jne 0x4b3bfc
push 2
lea eax, [ebp - 0xe]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA
xor eax, eax
mov al, byte [ebp - 0xe]
sub eax, 0x30
mov dword [ebp - 0xc], eax
jmp 0x4b3c04
xor eax, eax
mov al, byte [ebp - 5]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
je 0x4b3c26
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, dword [ebp - 0xc]
call fcn.00401fc8
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov byte [edx + 0x220], al
mov esp, ebp
pop ebp
ret
Function at 0x4e2ec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4e3121
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 8]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x4e2fb7
cmp eax, 0xb7a2
jge 0x4e2f5a
cmp eax, 0xb2c1
jge 0x4e2f2f
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x4e3077
sub eax, 0x1fc
jb 0x4e3080
jmp 0x4e3107
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x4e3089
sub eax, 0x1fc
jb 0x4e308f
sub eax, 0xb8
jb 0x4e3095
jmp 0x4e3107
cmp eax, 0xbbf7
jge 0x4e2f8c
add eax, 0xffff485e
sub eax, 0x11f
jb 0x4e309b
sub eax, 0x13d
jb 0x4e30a1
sub eax, 0x1f9
jb 0x4e30a7
jmp 0x4e3107
add eax, 0xffff4409
sub eax, 0x3af
jb 0x4e30ad
sub eax, 0x106
jb 0x4e30b3
sub eax, 0x23c
jb 0x4e30b9
jmp 0x4e3107
cmp eax, 0xc8f6
jge 0x4e3017
cmp eax, 0xc5be
jge 0x4e2fee
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x4e30bf
sub eax, 0xf3
jb 0x4e30c5
sub eax, 8
jb 0x4e30cb
jmp 0x4e3107
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x4e30d1
sub eax, 0x1e1
jb 0x4e30d7
sub eax, 0x3b
jb 0x4e30dd
jmp 0x4e3107
cmp eax, 0xcef4
jge 0x4e3049
add eax, 0xffff370a
sub eax, 0x304
jb 0x4e30e3
sub eax, 0x1e0
jb 0x4e30e9
sub eax, 0x11a
jb 0x4e30ef
jmp 0x4e3107
add eax, 0xffff310c
sub eax, 0x295
jb 0x4e30f5
add eax, 0xffffffd0
sub eax, 0x318
jb 0x4e30fb
sub eax, 0x329
jb 0x4e3101
jmp 0x4e3107
mov byte [ebp - 9], 0x41
jmp 0x4e310b
mov byte [ebp - 9], 0x42
jmp 0x4e310b
mov byte [ebp - 9], 0x43
jmp 0x4e310b
mov byte [ebp - 9], 0x44
jmp 0x4e310b
mov byte [ebp - 9], 0x45
jmp 0x4e310b
mov byte [ebp - 9], 0x46
jmp 0x4e310b
mov byte [ebp - 9], 0x47
jmp 0x4e310b
mov byte [ebp - 9], 0x48
jmp 0x4e310b
mov byte [ebp - 9], 0x4a
jmp 0x4e310b
mov byte [ebp - 9], 0x4b
jmp 0x4e310b
mov byte [ebp - 9], 0x4c
jmp 0x4e310b
mov byte [ebp - 9], 0x4d
jmp 0x4e310b
mov byte [ebp - 9], 0x4e
jmp 0x4e310b
mov byte [ebp - 9], 0x4f
jmp 0x4e310b
mov byte [ebp - 9], 0x50
jmp 0x4e310b
mov byte [ebp - 9], 0x51
jmp 0x4e310b
mov byte [ebp - 9], 0x52
jmp 0x4e310b
mov byte [ebp - 9], 0x53
jmp 0x4e310b
mov byte [ebp - 9], 0x54
jmp 0x4e310b
mov byte [ebp - 9], 0x57
jmp 0x4e310b
mov byte [ebp - 9], 0x58
jmp 0x4e310b
mov byte [ebp - 9], 0x59
jmp 0x4e310b
mov byte [ebp - 9], 0x5a
jmp 0x4e310b
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3128
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x4f4d50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4f4fad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 8]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x4f4e43
cmp eax, 0xb7a2
jge 0x4f4de6
cmp eax, 0xb2c1
jge 0x4f4dbb
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x4f4f03
sub eax, 0x1fc
jb 0x4f4f0c
jmp 0x4f4f93
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x4f4f15
sub eax, 0x1fc
jb 0x4f4f1b
sub eax, 0xb8
jb 0x4f4f21
jmp 0x4f4f93
cmp eax, 0xbbf7
jge 0x4f4e18
add eax, 0xffff485e
sub eax, 0x11f
jb 0x4f4f27
sub eax, 0x13d
jb 0x4f4f2d
sub eax, 0x1f9
jb 0x4f4f33
jmp 0x4f4f93
add eax, 0xffff4409
sub eax, 0x3af
jb 0x4f4f39
sub eax, 0x106
jb 0x4f4f3f
sub eax, 0x23c
jb 0x4f4f45
jmp 0x4f4f93
cmp eax, 0xc8f6
jge 0x4f4ea3
cmp eax, 0xc5be
jge 0x4f4e7a
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x4f4f4b
sub eax, 0xf3
jb 0x4f4f51
sub eax, 8
jb 0x4f4f57
jmp 0x4f4f93
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x4f4f5d
sub eax, 0x1e1
jb 0x4f4f63
sub eax, 0x3b
jb 0x4f4f69
jmp 0x4f4f93
cmp eax, 0xcef4
jge 0x4f4ed5
add eax, 0xffff370a
sub eax, 0x304
jb 0x4f4f6f
sub eax, 0x1e0
jb 0x4f4f75
sub eax, 0x11a
jb 0x4f4f7b
jmp 0x4f4f93
add eax, 0xffff310c
sub eax, 0x295
jb 0x4f4f81
add eax, 0xffffffd0
sub eax, 0x318
jb 0x4f4f87
sub eax, 0x329
jb 0x4f4f8d
jmp 0x4f4f93
mov byte [ebp - 9], 0x41
jmp 0x4f4f97
mov byte [ebp - 9], 0x42
jmp 0x4f4f97
mov byte [ebp - 9], 0x43
jmp 0x4f4f97
mov byte [ebp - 9], 0x44
jmp 0x4f4f97
mov byte [ebp - 9], 0x45
jmp 0x4f4f97
mov byte [ebp - 9], 0x46
jmp 0x4f4f97
mov byte [ebp - 9], 0x47
jmp 0x4f4f97
mov byte [ebp - 9], 0x48
jmp 0x4f4f97
mov byte [ebp - 9], 0x4a
jmp 0x4f4f97
mov byte [ebp - 9], 0x4b
jmp 0x4f4f97
mov byte [ebp - 9], 0x4c
jmp 0x4f4f97
mov byte [ebp - 9], 0x4d
jmp 0x4f4f97
mov byte [ebp - 9], 0x4e
jmp 0x4f4f97
mov byte [ebp - 9], 0x4f
jmp 0x4f4f97
mov byte [ebp - 9], 0x50
jmp 0x4f4f97
mov byte [ebp - 9], 0x51
jmp 0x4f4f97
mov byte [ebp - 9], 0x52
jmp 0x4f4f97
mov byte [ebp - 9], 0x53
jmp 0x4f4f97
mov byte [ebp - 9], 0x54
jmp 0x4f4f97
mov byte [ebp - 9], 0x57
jmp 0x4f4f97
mov byte [ebp - 9], 0x58
jmp 0x4f4f97
mov byte [ebp - 9], 0x59
jmp 0x4f4f97
mov byte [ebp - 9], 0x5a
jmp 0x4f4f97
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4fb4
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x55781c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.vcl60.bpl__Controls_TWinControl_HandleAllocated_qqrv
test al, al
je 0x557886
cmp byte [ebp - 5], 7
jne 0x55785c
push 2
lea eax, [ebp - 0xe]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA
xor eax, eax
mov al, byte [ebp - 0xe]
sub eax, 0x30
mov dword [ebp - 0xc], eax
jmp 0x557864
xor eax, eax
mov al, byte [ebp - 5]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
je 0x557886
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, dword [ebp - 0xc]
call fcn.00401fc8
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov byte [edx + 0x220], al
mov esp, ebp
pop ebp
ret

Function at 0x55a03c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 6]
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call sub.vcl60.bpl__Controls_TControl_MouseDown_qqr21Controls_TMouseButton46System__Set_t18Classes_Classes__1_iuc_0_iuc_6_ii
push 0xa
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x188]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x55a088
push 0
call sub.SHELL32.dll_ShellExecuteA
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x55c9f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl60.bpl__Forms_TApplication_Minimize_qqrv
mov edx, dword [ebp - 4]
cmp byte [edx + 0x269], 0
je 0x55ca31
mov ecx, dword [ebp - 4]
cmp byte [ecx + 0x268], 0
je 0x55ca31
push 0
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov edx, dword [eax]
push dword [edx + 0x30]
call sub.user32.dll_ShowWindow
mov ecx, dword [ebp - 4]
cmp word [ecx + 0x22a], 0
je 0x55ca53
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
call dword [ebx + 0x228]
pop ebx
pop ecx
pop ebp
ret
Function at 0x577304
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
lea edx, [ebp - 0x210]
push edx
call sub.user32.dll_wvsprintfA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x208
jl 0x577352
push 0x10e
push 0x5e1b39
push 0x5e1b1e
call fcn.0055d6c4
add esp, 0xc
cmp eax, 2
jne 0x577352
call sub.kernel32.dll_DebugBreak
lea ecx, [ebp - 0x210]
push ecx
call sub.kernel32.dll_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x57e0f4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x57e122
mov eax, ebx
call fcn.0057ebac
cmp dword [ebx + 0x3c], 0
je 0x57e11b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x57e193
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x57e185
cmp dword [ebx + 8], 0
je 0x57e144
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x57e156
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x57e185
cmp dword [ebx + 8], 0
je 0x57e137
cmp eax, 3
je 0x57e169
dec eax
jne 0x57e137
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x57e137
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x57e137
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x57e1b1
cmp dword [ebx + 0x10], 0xcc
je 0x57e1b1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0057e1bc
pop ebx
ret
Function at 0x78e6dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x78e6f5
mov esi, edi
mov edi, eax
jmp 0x78e6f7
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x78e707
mov eax, ebx
jmp 0x78e711
push eax
push ebx
call fcn.007754ac
add esp, 8
test eax, eax
jne 0x78e719
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x78e737
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x78e720
cmp eax, dword [esi + 4]
jge 0x78e74e
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x78e73c
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x78e771
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x78e76e
sub eax, 1
test eax, eax
jg 0x78e75e
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x7f27fc
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], ecx
mov edx, esi
dec ebx
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp - 8]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 0xc]
sub esi, edx
test ebx, ebx
jg 0x7f2831
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x7f2c6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 0xc]
dec ebx
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
test ebx, ebx
jg 0x7f2c9e
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret