joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b2fb
Capabilities:
Authenticate hmac

Disassembly:
mov al, 0x36
mov bl, 0xc6
mov edi, 0x712ba07a
shl dh, cl
ret 0xaa6b
mov eax, 0x7afc6ecc
cld
pop es
popal
push 0x4c
sti
js 0x48b386
push ebp
insd dword es:[edi], dx
jge 0x48b371
std
pop ecx
in eax, 0x6b
arpl sp, si
inc edx
out 0x9c, al
mov edi, ebp
in eax, dx
push es
stosb byte es:[edi], al
jns 0x48b2c9
add esi, dword [ecx + 0x6c25fbb6]
inc ebp
fild qword [edi - 0x31]
add byte es:[ebx + 0x7c], ch
mov esp, 0xacf2c5a9
adc eax, 0x5502f080
xor al, 2
push ebp
insd dword es:[edi], dx
scasb al, byte es:[edi]
test byte [esi + 0x15], ch
lcall 0xeffe, 0x9b695e84
scasb al, byte es:[edi]
sbb ecx, dword [edi]
sbb ebp, dword [ecx + 0x2d]
mov byte [eax - 0x3fedd65b], cl
outsd dx, dword [esi]
push ds
sar bh, 0xcd
cli
lodsb al, byte [esi]
mov eax, dword [0xaffbd54d]
sti
scasd eax, dword es:[edi]
sub dword [ebp + edx - 0x54], edi
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
pushal
and byte [ecx + eax*4 + 0x453e9e64], bl
jecxz 0x48b357
test al, 0x5c
test eax, 0x6da929b8
add eax, 0xf20cad27
daa
lodsd eax, dword [esi]
or al, 0xf2
dec edi
or edx, dword [esi - 0x29213678]
pop esp
push ds
ret
add dword [ebp + 0x4b], ecx
out 0xfb, eax
jno 0x48b330
and dword [edx*2 - 0x693c5bb2], ebp
in al, dx
dec ebx
salc
mov ebx, 0x708704c0
rcl byte [ebx + ebx*4 + 0x1f]
cdq
mov gs, ecx
jbe 0x48b3e8
aad 0xa6
in eax, dx
movsd dword es:[edi], dword [esi]
push esp
mov ebp, 0x97ebc931
cmpsw word [esi], word es:[edi]
push eax
mov dword [0x2ce2feb1], eax
dec esp
out 0x83, eax
cld
lodsb al, byte [esi]
clc
out dx, eax
xchg ebx, eax
insb byte es:[edi], dx
mov edx, 0xe0821847
pop ds
stosb byte es:[edi], al
pop edx
insd dword es:[edi], dx
sub eax, 0x17cc5f00
outsd dx, dword [esi]
pushfd
in eax, dx
inc edi
aas
stosb byte es:[edi], al
mov bh, 0xee
out dx, al
sub dword [edi + 0x79], 0x20
int1
jecxz 0x48b3ee
out dx, al
lahf
xor eax, 0x2cbde62a
sbb esi, eax
adc al, 0xf
mov byte [ebp + edx*4 - 0x11], bh
xchg ebp, eax
out dx, eax
adc esi, 0xdeca93ab
stc
push esi
push ebx
loop 0x48b3fe
aad 0xec
jnp 0x48b448
dec ecx
sbb eax, 0xa1d39479
add bh, cl
jg 0x48b47f
mov byte [0xed25008e], al
push esp
fld qword [esi - 0x63]
dec edx
fisub word [ecx]
cli
aad 9
cdq
mov dword [ecx], 0x13d824a6
sti
or ch, ah
dec edx
push ebp
push ds
inc edx
popal
adc eax, 0x923aabd
cwde
invalid
pop ebx
invalid
popal
ret 0x6620

Function at 0x4bd3bd
Capabilities:
Encode data using xor

Disassembly:
wait
adc eax, 0x5090b34c
add al, 0xf2
invalid
mov bh, 0x29
inc ecx
ja 0x4bd367
test dword [edi - 0x648ae39f], eax
popfd
stosb byte es:[edi], al
jg 0x4bd368
and al, 0x3d
or dword [ebx - 0x36b05a0d], 0xc2306a30
pop es
and ch, dl
and ah, dh
push ecx
ret
Function at 0x4f5257
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb2
jl 0x4f5253
push ebp
in al, dx
dec ebp
sub dl, byte [ebp + 0x13]
xor edi, dword [eax]
retf
or eax, 0xafcf1ba
mov bl, 0xb1
inc eax
dec esp
fyl2xp1
or dh, byte [ebx - 0x26b3bf4f]
stc
leave
push 0x21
sbb ch, byte [edi + 0x53]
xor dword [eax - 0x3d], esi
sub byte [esi + 0x3feb2818], ch
or byte [ebx], ch
dec esp
test edx, edx
add byte es:[0xaaffd91b], ch
outsd dx, dword [esi]
cdq
mov eax, dword [0x6f8a4a0e]
mov byte [0xa8df7d61], al
add eax, ebx
and edi, dword [0x573a2a]
nop
cld
inc dword [ebp - 0x2fb10bc6]
scasd eax, dword es:[edi]
test eax, 0xc5669553
lodsd eax, dword [esi]
jp 0x4f52f6
jno 0x4f52cc
push ds
jne 0x4f5223
add byte [edi + 0x3d], dl
lodsb al, byte [esi]
imul ebx, dword [ebx], 0x6b
invalid
invalid
outsb dx, byte [esi]
mov al, byte [0x381be87f]
jbe 0x4f52b1
iretd
loop 0x4f52cb
sub al, 0x1c
stosd dword es:[edi], eax
cmp eax, 0xbdfcee70
nop
adc eax, dword [ebx - 0x41]
xchg dword [edx - 0x4c], ebx
inc ebp
inc ebx
mov edi, 0x45b45a87
or esp, edi
fdiv dword [0x19180f5d]
test eax, 0x9b0a8c62
xlatb
xor ecx, dword [ebx]
pop ebp
rcl dword [edi - 0x2b]
jg 0x4f5302
enter 0xffffffffffff8fd7, 0xffffffffffffff87
and byte [eax - 0x75], bl
mov ah, bh
cdq
mov ebp, 0xc4a7dc65
mov bh, 0xbd
invalid

Function at 0x5192ff
Capabilities:
Encode data using xor

Disassembly:
out dx, al
loop 0x519319
imul ebx, dword [ecx], 0x91f3d39d
pop edx
das
push ds
fsub qword [esi - 0x54]
pop es
popal
mov word [esi - 0x325c76c7], fs
cmc
scasb al, byte es:[edi]
push edx
cmpsb byte [esi], byte es:[edi]
jp 0x519305
mov esi, ebp
sub ebp, edi
insb byte es:[edi], dx
xor esp, dword [edi + 0x9df5d1c]
sbb eax, 0xba1bd480
push cs
sar ecx, cl
or al, 0xc9
test byte [ebp - 0x29], bl
jmp 0x5192d1
add byte [edx - 0x70], dh
pop ebx
xor byte [ebx - 0x720a97cd], bl
enter 0xffffffffffffac3d, 0xffffffffffffffaa
stosb byte es:[edi], al
stosb byte es:[edi], al
mov eax, dword [0x371d44ed]
mov cl, 0x86
cli
ja 0x519387
in al, 3
xchg al, dh
jne 0x5192a1
xlatb
xor eax, 0xec4aa465
inc edi
push esi
test eax, 0xcad09992
xchg edx, eax
cdq
ror dl, 1
mov cl, 5
lodsd eax, dword [esi]
pop ecx
insb byte es:[edi], dx
jae 0x5192f2
aad 0xe2
cdq
mov esp, 0xbda3b31a
in eax, 0x39
or al, byte [ebx]
xor eax, 0xa8ac8932
push ebx
mov cl, 0x4d
comiss xmm1, dword [edx - 0x56600c51]
lcall 0x872, 0x8a4d48ab
jae 0x519389
pop ss
fld xword [ebx]
dec ebx
xchg esp, eax
clc
jae 0x51931b
in al, dx
arpl si, cx
invalid
shr dword [ecx + 0x3c], cl
inc ebp
cmp al, 0x45
aas
invalid

Function at 0x568f29
Capabilities:
Encode data using xor

Disassembly:
fadd st(2), st(0)
sal edx, 0xe
stc
adc dh, byte [edx]
xor bl, bh
sub byte [esi + 0xcfdf92d], 0x58
xor bl, bh
sub byte [esi + 0xcfdf92d], 0x58
call 0xfb2d0a7b
jge 0x568f22
test ah, 0x7b
pushfd
rcl byte [eax - 0x51], cl
bound edi, qword [0x12a32995]
pop ss
xor bl, byte [ebp - 0x71ed67f6]
out dx, eax
mov byte [0x936da221], al
fnsave dword [edx - 0x353eb1cf]
xchg esi, eax
or eax, 0x97b3d28c
js 0x568f3d
mov word [ebx*2 + 0xe32b7fa], gs
dec ebp
sub dl, byte [ebx]
or edx, dword [ebx]
cmp bl, ah
sub eax, 0xd5ac3e4d
dec edx
ret 0x93cb
Function at 0x5c7b03
Capabilities:
Encode data using xor

Disassembly:
fidivr word [0x5dadaf8]
mov eax, 0xbce487cc
mov esp, 0x94d81bca
cmp byte [edx + 0x120becd2], cl
add eax, 0xeb9808ff
adc al, 0xe
sbb eax, 0xad990ce2
test eax, 0xe9d3cef8
aam 0x39
invalid

Function at 0x617f32
Capabilities:
Encode data using xor

Disassembly:
mov byte [eax - 0x3e], 0xcd
jecxz 0x617e95
lcall 0xa55d, 0x162c4e98
inc esp
mov esp, 0xfb6a02e8
test ch, ch
mov ah, 0x62
invalid
cdq
pop esp
xor al, 0x4e
push esp
mov esp, 0x9cd463c4
movsb byte es:[edi], byte [esi]
fsubr qword [ebx + 0x73]
sbb ebp, dword [ecx + ecx + 0x2b]
or al, byte [ebx]
int3
fcomp qword [edx - 0x60]
cmp eax, 0xec38a394
mov ss, word fs:[ebp - 0x70f35f7e]
jne 0x617f46
mov dword [0x128bedf9], eax
sbb byte [ebx], 0x9a
push ebx
jbe 0x617e5a
jae 0x617e83
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
mul dword [esi + 0x1d]
mov ah, 0x82
and al, 0xe3
mov esp, 0x84e65d12
and al, 0x61
invalid
cmc
push eax
out 0x1b, eax
xchg edx, eax
adc al, 0x86
cmp esp, dword [esi]
jl 0x617eea
mov ebx, 0x394babbb
adc dh, byte [eax + eax*2 - 0x4a]
je 0x617eb9
sahf
test edx, ebp
lea eax, [edx + 0x2dde93d5]
lcall 0x7eeb, 0x95607428
test esp, edx
shl dword [edx + 0x60], 1
or dword [edi - 0x75b42b26], ebp
retf
fisubr word [0x6074289a]
xchg ebp, eax
jmp 0x617f92
and esi, dword [esi - 0x130407e]
xor esp, dword [eax]
js 0x617f3d
inc edi
cmpsd dword [esi], dword es:[edi]
jb 0x617eee
mov ebp, 0x8c09337a
push ebp
xor ecx, dword [ecx]
mov word [ebp + 0x72], ss
inc ebp
jb 0x617f8d
ja 0x617f75
pushfd
pushfd
scasb al, byte es:[edi]
cmp byte [ecx], bh
loope 0x617f0b
xor eax, 0xd2ca4df5
mul esi
push es
sub ebp, eax
invalid
retf 0xf7d2
jge 0x617f54
xchg esp, eax
cli
salc
ljmp 0x7797
jmp 0x617f42
mov al, 0x7d
pop es
sahf
xchg ebx, eax
xchg esp, eax
insd dword es:[edi], dx
mov esp, 0x6215c477
sti
popal
dec edx
scasb al, byte es:[edi]
clc
sahf
mov esp, 0x271a0436
daa
pop ecx
sahf
mov al, 0xf7
call 0x6d43a5c7
in al, dx
xor esi, dword [edi]
and al, 0xd2
cmp al, al
mov ah, 0x67
pop ebx
lahf
xchg esp, eax
sub byte [esi + 0x53706177], dh
test eax, esi
mov esp, dword [ebx]
lds ebp, [ebx - 0x737bfe2c]
mov dh, 0x3a
aad 0x7c
mov ah, byte [edi]
or ebx, esi
in eax, 0x98
push ebp
ror bl, 0xcb
mov edi, 0x39ed31c7
ja 0x617fa8
jmp 0x61ae28
test dword [esi - 0x5a2837fe], ebx
invalid
Function at 0x61c677
Capabilities:
Encode data using xor

Disassembly:
xchg dword [edi], edx
cmpsb byte [esi], byte es:[edi]
add ebx, edx
popal
mov ecx, 0x744431b1
push 0x9154d792
mov byte [0xec93c88e], al
cmpsd dword [esi], dword es:[edi]
jl 0x61c689
out dx, eax
inc edi
jmp 0x61c684
enter 0x7413, 0xffffffffffffff98
cmp byte [edx], 0x5c
bound esp, qword [edi - 0x4a9a7f15]
mov ah, 0x92
jecxz 0x61c699
mov al, byte [0x9ee6925d]
imul esp, ebp, 0xffffff8d
cld
leave
aad 0x7c
sub al, 0xa5
invalid
mov bh, 0x6a
aad 0xa3
inc ecx
and eax, 0xc4676fd6
jp 0x61c618
inc edx
mov ecx, 0x15d636e1
cdq
mov dh, 0x24
salc
adc eax, 0x24b6f299
sub al, 0xa6
adc eax, 0x169f0833
or ecx, dword [ebp + 0x7de7eaf9]
shr byte [eax + 1], cl
xor eax, 0x947f58fe
mov bl, 0xa4
pop edi
mov esi, 0x28c4031f
jecxz 0x61c636
ljmp 0x3501:0x68d27de7
lodsd eax, dword [esi]
adc ebp, 0x3d142293
cmp eax, 0x92b4259
rcl dl, cl
push edi
bnd jae 0x61c6fc
imul dword [0xe518886b]
or al, 0xa8
invalid
xor esi, dword [eax + 0x73]
push eax
div dword fs:[edx + 0x63]
das
pop ss
adc dword [ecx + 0x3af79449], edi
adc bh, bl
adc dword [edi + edi*8 + 0x65], eax
in al, dx
push ds
mov bh, 0x61
xchg ecx, eax
test dh, cl
out 0x3c, eax
push esp
mov edi, 0x993033d4
jns 0x61c786
hlt
fsub qword [ebp + 0x5abc156a]
xor ebp, dword [ebx + 1]
xchg edx, eax
dec esp
and byte [ebx], ah
in eax, 0x3d
into
arpl di, ax
jecxz 0x61c7a2
sub ebx, esi
test al, 0xa4
test eax, 0x7ca6b729
xor byte [eax + 0x7985674b], ch
sub eax, dword [ebp - 0x47bde456]
nop
movsb byte es:[edi], byte [esi]
adc dl, byte [eax + 0x69]
adc al, 0xf
sbb byte [ebx + 0x3c8963b], cl
adc eax, 0xba6feb6
cmpsb byte [esi], byte es:[edi]
invalid
sbb eax, 0xcc629d46
lcall 0x5242, 0x4771e698
inc edx
push edx
stosd dword es:[edi], eax
enter 0x528f, 1
int1
xor edi, dword [ebp + 0x355634e9]
outsd dx, dword [esi]
and eax, edx
jns 0x61c75c
pushfd
sbb eax, 0x3ab5b35e
push esp
jl 0x61c798
adc byte [eax + ebx*2], bl
cmp al, 0x54
enter 0xffffffffffff8361, 0xffffffffffffffa3
inc edx
inc ebx
push esp
loopne 0x61c839
xor ebp, dword [edi - 0x6b]
mov ebx, 0xe54601b3
shl byte [edx], cl
sti
mov ebx, 0x129374b8
xchg ebx, eax
mov dword [0x93c2d063], eax
mov ah, 0xe6
fsub dword [edx + 0x7e]
lds eax, [eax]
std
wait
stosd dword es:[edi], eax
in eax, 0x80
inc ebp
inc ecx
invalid
outsb dx, byte [esi]
and dword [ecx + esi*8], 0xffffffef
sub dword [edx], 0x72
rol dword [edx - 0x7d], cl
invalid
Function at 0x650c5e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x658230
cmp edx, dword [eax]
je 0x650c80
add eax, 8
inc ecx
cmp eax, 0x6582c0
jl 0x650c71
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x658230]
jne 0x650dae
mov eax, dword [0xa5b874]
cmp eax, 1
je 0x650d88
test eax, eax
jne 0x650cb1
cmp dword [0x658174], 1
je 0x650d88
cmp edx, 0xfc
je 0x650dae
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x650ce8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00651370
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006515a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x650d2b
lea eax, [ebp - 0x1a4]
push eax
call fcn.006515a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x654a48
push edi
call fcn.00652d70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00651370
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00651380
lea eax, [ebp - 0xa0]
push 0x654a28
push eax
call fcn.00651380
push dword [esi + 0x658234]
lea eax, [ebp - 0xa0]
push eax
call fcn.00651380
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00652ce4
add esp, 0x2c
pop edi
jmp 0x650dae
lea eax, [ebp + 8]
lea esi, [esi + 0x658234]
push 0
push eax
push dword [esi]
call fcn.006515a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x472e5b5b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x70cc0902
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x35a2319c
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x74a108ae
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7a5d321f
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x464c6fe2
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x40428c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406f44
test esi, esi
jne 0x4042c2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040709c
jmp 0x4042e0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004041d0
mov edi, eax
test esi, esi
je 0x4042e0
cmp dword [ebx], 0
je 0x4042e0
dec esi
jmp 0x4042c9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404314
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x435008], 0x8088405
inc edx
mov dword [ebx + 0x435008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406158
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004063f4
mov byte [esp], al
cmp byte [esp], 0
jne 0x4062e2
test edi, edi
je 0x4062e2
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406222
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4061fd
cmp edi, 0xffffffff
je 0x4061bd
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4061bd
mov byte [esp], 0
jmp 0x4062e2
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4061fd
test ebx, ebx
jne 0x4061ef
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4061ef
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4062e2
lea eax, [esp + 0xc]
call fcn.00405f08
dec ebp
test ebp, ebp
jg 0x4061a2
cmp edi, 0xffffffff
je 0x406222
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x406220
mov byte [esp], 0
jmp 0x4062e2
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406166
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406222
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00406350
mov edx, eax
mov ebx, dword [0x4378f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x406286
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x406284
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x406286
xor edi, edi
cmp byte [esp], 0
je 0x4062ac
mov ebx, dword [esi]
test bl, 1
jne 0x4062c2
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40628c
mov byte [esp + 1], 1
jmp 0x4062c2
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4062ac
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406239
cmp byte [esp], 0
je 0x4062e2
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406cc4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x437054], 0
je 0x406d2b
cmp word [0x437340], 0xd7b2
jne 0x406ced
cmp dword [0x437348], 0
jbe 0x406ced
mov eax, 0x43733c
call dword [0x437358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x406d58
call fcn.00407500
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x435026], 0
jne 0x406d47
push 0
push 0x4359b2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4089a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408b05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406f44
cmp si, word [0x4359f0]
jb 0x408a38
cmp si, word [0x435bf0]
ja 0x408a38
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x408a38
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4359f0]
jae 0x408a12
mov edi, ebx
dec edi
jmp 0x408a33
cmp si, word [ebx*8 + 0x4359f0]
jbe 0x408a22
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408a33
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4359f4]
call fcn.004088c0
jmp 0x408a38
cmp edi, dword [ebp - 8]
jae 0x4089fc
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408ae7
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408ae7
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407698
push dword [ebp - 0x160]
push 0x408b20
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00407698
push dword [ebp - 0x164]
push 0x408b30
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407698
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00407850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408b0c
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406fa4
ret
Function at 0x408cb8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408dbc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x439b84
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x439b9c]
jne 0x408d04
mov eax, esi
mov edx, 0x439b9e
mov ecx, 0x55
call fcn.00407698
push 0x439b84
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408da6
push 0x439b84
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406f44
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408d73
cmp byte [0x439b80], 0
je 0x408d38
mov edx, esi
mov eax, ebx
call fcn.00408b9c
jmp 0x408d73
mov edx, esi
mov eax, ebx
call fcn.004089a0
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408d73
cmp dword [esi], 0
je 0x408d5c
mov eax, esi
mov edx, 0x408dd4
call fcn.00407770
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004089a0
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407770
push 0x439b84
call sub.kernel32.dll_EnterCriticalSection
mov word [0x439b9c], bx
mov eax, dword [esi]
call fcn.00407604
mov ecx, eax
mov eax, 0x439b9e
mov edx, 0xaa
call fcn.00408820
push 0x439b84
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408dc3
lea eax, [ebp - 4]
call fcn.00406f44
ret