joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfa98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cfb7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4b0a54]
call fcn.004dfd08
mov ebx, eax
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.004066ac
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4cfb98
call fcn.0040eff0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [esi + 0xc], 0
je 0x4cfb0a
mov edx, dword [esi + 0xc]
mov eax, ebx
call fcn.004b0e74
jmp 0x4cfb39
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc]
test eax, eax
je 0x4cfb2f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, eax
movzx ecx, byte [esi + 0x2c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
mov byte [esi + 0x2c], 0
jmp 0x4cfb39
mov edx, dword [esi + 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor edx, edx
mov eax, ebx
call fcn.004dfa04
lea eax, [ebx + 0x14]
mov edx, dword [esi + 0x14]
call fcn.004066ac
lea eax, [ebx + 0x18]
mov edx, dword [esi + 0x18]
call fcn.004066ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov edx, ebx
call fcn.004b381c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfb82
lea eax, [ebp - 8]
call fcn.0040669c
ret
Function at 0x4db250
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4db37a
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4db33c
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403968
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xc], 1
mov eax, esi
call fcn.00406738
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffd
sub eax, 2
jb 0x4db2f7
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], 0x11
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x48]
mov eax, dword [0x577cdc]
call fcn.0040918c
mov ecx, dword [ebp - 0x48]
mov dl, 1
mov eax, dword [0x4da69c]
call fcn.004dae0c
call fcn.00404bfc
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x64], eax
movzx eax, word [ebp - 0x24]
mov dword [ebx + 0x60], eax
lea eax, [ebx + 0x58]
push eax
mov edx, dword [ebp - 0x2c]
sub edx, edi
sar edx, 1
jns 0x4db314
adc edx, 0
inc edx
mov ecx, dword [ebp - 0x28]
mov eax, esi
call fcn.00406e58
lea eax, [ebx + 0x5c]
push eax
mov edx, dword [ebp - 0x10]
sub edx, edi
sar edx, 1
jns 0x4db32f
adc edx, 0
inc edx
mov ecx, dword [ebp - 0xc]
mov eax, esi
call fcn.00406e58
jmp 0x4db35a
xor eax, eax
mov dword [ebx + 0x60], eax
lea eax, [ebx + 0x58]
xor edx, edx
call fcn.004066ac
lea eax, [ebx + 0x5c]
xor edx, edx
call fcn.004066ac
xor eax, eax
mov dword [ebx + 0x64], eax
lea eax, [ebx + 0x3c]
mov edx, esi
call fcn.004066ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db381
lea eax, [ebp - 0x48]
call fcn.0040669c
ret
Function at 0x4db5b8
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
test dl, dl
je 0x4db6e7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39], 0
jne 0x4db71e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4db5e6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4db5f1
mov ebx, 3
jmp 0x4db5f3
xor ebx, ebx
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x4db603
call fcn.0041344c
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00406738
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00406738
push eax
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00406738
push eax
call sub.wininet.dll_InternetOpenW
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x70], esi
test esi, esi
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004dafcc
xor eax, eax
push ebp
push 0x4db6c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
call fcn.00406738
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.00406738
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x60]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.00406738
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
push eax
call sub.wininet.dll_InternetConnectW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], ebx
test ebx, ebx
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004dafcc
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4db71e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
test eax, eax
je 0x4db6f7
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x74], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
test eax, eax
je 0x4db70f
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x70], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e9b78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e9c05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004ea0dc
test al, al
je 0x4e9bb4
lea eax, [ebp - 4]
mov edx, esi
call fcn.00406700
jmp 0x4e9bbc
lea eax, [ebp - 4]
call fcn.004e9b34
lea eax, [ebp - 0x20c]
push eax
xor bl, 1
movzx eax, bl
push eax
push 0x4e9c14
mov eax, dword [ebp - 4]
call fcn.00406738
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, edi
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004068ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9c0c
lea eax, [ebp - 4]
call fcn.0040669c
ret
Function at 0x4e9ca8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e9d72
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040e7dc
xor ebx, ebx
mov edx, dword [ebp - 4]
mov eax, 0x4e9d90
call fcn.00407170
mov esi, eax
test esi, esi
jle 0x4e9d5c
mov eax, dword [ebp - 4]
test eax, eax
je 0x4e9d01
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4e9d01
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004056ec
test eax, eax
je 0x4e9d0a
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
lea eax, [ebp - 4]
call fcn.00406f28
mov eax, dword [ebp - 4]
test eax, eax
je 0x4e9d36
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4e9d36
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004056ec
test eax, eax
je 0x4e9d3f
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0xe]
mov ecx, eax
mov eax, dword [ebp - 4]
xchg edx, eax
call fcn.0040ebe8
lea eax, [ebp - 0xe]
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9d79
lea eax, [ebp - 4]
call fcn.0040669c
ret
Function at 0x4e9ee0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ea0a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040e510
cmp dword [ebp - 4], 0
jne 0x4e9f30
lea eax, [ebp - 0x1c]
call fcn.0040e98c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.0040e510
lea eax, [ebp - 4]
mov edx, 0x4ea0c4
call fcn.00406ac0
mov eax, ebx
call fcn.004ea8c4
sub al, 2
jb 0x4e9f4f
je 0x4e9f62
jmp case.default.0x4e9fb7
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
jmp case.default.0x4e9fb7
mov edx, ebx
mov eax, 0x4ea0d4
call fcn.00407170
dec eax
jne 0x4e9fa0
call fcn.004e9e84
test al, al
je 0x4e9f8d
mov eax, dword [ebp - 4]
call fcn.004e9d94
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp case.default.0x4e9fb7
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0x7fffffff
jmp case.default.0x4e9fb7
mov eax, dword [ebp - 4]
call fcn.00406738
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 6
ja case.default.0x4e9fb7
jmp dword [eax*4 + 0x4e9fbe]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
jmp case.default.0x4e9fb7
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
jmp case.default.0x4e9fb7
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
jmp case.default.0x4e9fb7
mov eax, dword [ebp - 4]
call fcn.004e9d94
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp case.default.0x4e9fb7
mov eax, dword [ebp - 4]
call fcn.004e9e58
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp case.default.0x4e9fb7
mov eax, dword [ebp - 4]
call fcn.004e9d94
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp case.default.0x4e9fb7
mov eax, dword [ebp - 4]
call fcn.004e9d94
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4ea056
cmp dword [ebp - 0x18], 0xffffffff
jb 0x4ea06b
jmp 0x4ea058
jl 0x4ea06b
cmp dword [ebp - 0x14], 0
jne 0x4ea069
cmp dword [ebp - 0x18], 0x7fffffff
jbe 0x4ea07b
jmp 0x4ea06b
jle 0x4ea07b
mov dword [ebp - 0x10], 0x7fffffff
mov dword [ebp - 0xc], 0
jmp 0x4ea087
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea0ac
lea eax, [ebp - 0x1c]
call fcn.0040669c
lea eax, [ebp - 4]
call fcn.0040669c
ret

Function at 0x4ea0dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov edx, esi
mov eax, 0x4ea140
call fcn.00407170
test eax, eax
jne 0x4ea129
mov edx, esi
mov eax, 0x4ea150
call fcn.00407170
test eax, eax
jne 0x4ea129
lea eax, [ebp - 0x200]
mov edx, esi
call fcn.0040eb44
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4ea129
test al, 0x10
je 0x4ea129
mov bl, 1
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eb61c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [eax]
movzx ecx, cx
dec ecx
test ecx, ecx
jl 0x4eb648
inc ecx
mov ebx, esi
xor bl, byte [edx]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x575bf0]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov esi, ebx
inc edx
dec ecx
jne 0x4eb629
mov dword [eax], esi
pop esi
pop ebx
ret

Function at 0x4ed5f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x4ed618
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov edi, dword [0x577b10]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x4ed5fd
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ef7bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ef802
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.004ee7cc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef809
lea eax, [ebp - 4]
call fcn.0040669c
ret

Function at 0x4f259c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4f2630
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x38], 0
jne 0x4f261a
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x28]
call fcn.004e9b1c
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x2c]
call fcn.004066ac
mov edx, 2
mov eax, dword [ebx + 0x2c]
call fcn.0040dcb8
mov esi, eax
mov dword [ebx + 0x38], esi
test esi, esi
jg 0x4f260c
xor eax, eax
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x2c]
call fcn.00406738
push eax
call sub.kernel32.dll_DeleteFileW
mov ecx, dword [ebx + 0x2c]
mov dl, 1
mov eax, dword [0x4e7468]
call fcn.004e8b30
call fcn.00404bfc
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2637
lea eax, [ebp - 4]
call fcn.0040669c
ret

Function at 0x4f76a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.004ee948
mov dword [ebp - 0x10], eax
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4265e4]
call fcn.0042ce20
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4f776c
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x4f771f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7726
mov eax, dword [ebp - 0xc]
call fcn.004040a8
ret
Function at 0x4f8250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
cmp eax, dword [ebp - 4]
jge 0x4f8280
mov ecx, 0xeb
mov edx, 0x4f839c
mov eax, 0x4f842c
call fcn.0040542c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x4f82a5
mov eax, dword [ebp - 4]
dec eax
cmp eax, dword [ebp - 8]
je 0x4f82a5
mov ecx, 0xed
mov edx, 0x4f839c
mov eax, 0x4f84b8
call fcn.0040542c
mov eax, dword [ebx + 0x28]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jle 0x4f82b1
inc eax
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jl 0x4f82f1
inc esi
mov dword [ebp - 0x10], esi
shl edx, 5
movzx esi, byte [eax + 2]
xor edx, esi
and edx, 0x3fff
mov esi, eax
and esi, dword [ebx + 0x58]
mov edi, dword [ebp - 0xc]
lea edi, [edi + esi*4]
mov esi, dword [ecx + edx*4]
mov dword [edi], esi
mov dword [ecx + edx*4], eax
inc eax
dec dword [ebp - 0x10]
jne 0x4f82c9
mov esi, dword [ebp - 0xc]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x4f8329
mov eax, dword [ebp - 4]
add dword [ebx + 0x44], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x4f8343
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x4f8343
mov eax, ebx
call fcn.004f8888
jmp 0x4f8343
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x5c]
jl 0x4f8343
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x5c]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x4f8379
mov eax, dword [ebp - 4]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x4f8379
mov dword [ebp - 0x14], esi
fild dword [ebp - 0x14]
fmul dword [0x4f852c]
fild dword [ebx + 0x50]
fdivp st(1)
call fcn.004037e4
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x4f8388
mov eax, ebx
call fcn.004f8888
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fc0f4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
jne 0x4fc121
mov ecx, 0xc4
mov edx, 0x4fc1c8
mov eax, 0x4fc258
call fcn.0040542c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
dec esi
test esi, esi
jl 0x4fc197
inc esi
mov eax, dword [ebp - 8]
and eax, 0xffff
or eax, 2
movzx edx, byte [ebx]
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
mov edx, dword [ebp - 0x10]
movzx eax, byte [ebx]
call fcn.004eb650
mov edi, eax
mov dword [ebp - 0x10], edi
and edi, 0xff
add dword [ebp - 0xc], edi
imul edi, dword [ebp - 0xc], 0x8088405
inc edi
mov dword [ebp - 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebp - 8]
call fcn.004eb650
mov dword [ebp - 8], eax
inc ebx
dec esi
jne 0x4fc142
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x10], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fc2e4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x4fc30c
mov ecx, 0xf4
mov edx, 0x4fc39c
mov eax, 0x4fc42c
call fcn.0040542c
mov edx, esi
mov eax, ebx
call fcn.004fc494
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
movzx eax, byte [esi]
call fcn.004eb650
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004eb650
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x4fc322
movzx eax, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fc494
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405c90
xor eax, eax
push ebp
push 0x4fc552
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [ebp - 4]
test eax, eax
je 0x4fc4ea
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4fc4ea
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0040571c
test eax, eax
je 0x4fc4f3
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x4fc53c
mov edi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.004eb650
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004eb650
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x4fc4fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc559
lea eax, [ebp - 4]
call fcn.00405500
ret
Function at 0x4fc924
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
cmp dword [ebp - 8], 0
jne 0x4fc94f
mov ecx, 0x188
mov edx, 0x4fcb1c
mov eax, 0x4fcbac
call fcn.0040542c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004fcdf8
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.004037b0
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.004eb650
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004eb650
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4fc963
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004fcdf8
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
movzx eax, byte [edi]
mov edx, dword [ebx + 8]
call fcn.004eb650
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004eb650
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4fc9df
movzx eax, byte [ebp + 0xa]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.004eb650
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004eb650
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
movzx eax, byte [ebp + 0xb]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.004eb650
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004eb650
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4