joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445300
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x2c
call fcn.0045be30
mov eax, dword [0x8c8664]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0x18]
mov edx, dword [esp]
mov dword [esp + 0x14], edx
mov ebx, dword [esp + 4]
mov dword [esp + 0xc], ebx
inc dword [ecx + 0x7c]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
mov ebp, dword [esp + 0x34]
mov dword [esp + 4], ebp
call fcn.004452a0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x30]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0043ed40
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x445385
cmp dword [eax + 4], ecx
jae 0x4453b3
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [0x445560]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x24]
mov dword [esp], ecx
call fcn.0046b110
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x445409
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
lea eax, [0x445510]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.0046b110
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.004452a0
lea eax, [0x88aae0]
mov dword [esp], eax
call fcn.00402c30
movzx eax, byte [esp + 4]
test al, al
je 0x445442
lea eax, [0x6c70f8]
mov dword [esp], eax
call fcn.0046b110
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.004452a0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
test byte [ecx], al
mov ecx, dword [ecx + 0x11a0]
test ecx, ecx
je 0x44547e
lea eax, [0x6c72ac]
mov dword [esp], eax
call fcn.0046b110
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.004452a0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x58]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x1f8], edx
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
lea edx, [ecx + 4]
mov dword [ecx + 0x2c], 0
mov ebx, dword [eax + 0x18]
mov dword [ebx + 0x60], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x58], 0
mov dword [esp], edx
mov dword [esp + 4], 2
call fcn.00402f00
lea eax, [0x88aad4]
mov dword [esp], eax
call fcn.00402c30
movzx eax, byte [esp + 4]
test al, al
je 0x4454f6
lea eax, [0x6c70f4]
mov dword [esp], eax
call fcn.0046b110
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.004452a0
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x7c]
add esp, 0x2c
ret
Function at 0x457aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8664]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x457c1a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x457c10
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x457afa
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x457afa
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x457b0d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x457be7
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x457bdb
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x457bd2
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x457b60
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x457ba3
mov eax, 1
cmp eax, ecx
ja 0x457b97
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0046c6f0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x457bcd
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x457b9c
mov ecx, dword [esp + 0xc]
jmp 0x457b65
call fcn.0046c690
xor eax, eax
mov ecx, eax
call fcn.0046c680
call fcn.0046c6f0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x457c0b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x457be0
mov ecx, dword [esp + 0x18]
jmp 0x457b12
call fcn.0046c690
xor eax, eax
mov ecx, eax
call fcn.0046c680
nop
call fcn.0046b200
jmp fcn.00457aa0
Function at 0x45cf60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8664]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45d14d
sub esp, 0x68
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x102
call fcn.0045b350
mov eax, dword [esp + 0x74]
test byte [eax], al
mov ecx, eax
mov eax, 0xaaaaaaab
mov edx, dword [esp + 0x70]
mov ebx, edx
mul edx
shr edx, 1
lea eax, [edx + edx*2]
sub ebx, eax
lea eax, [ecx + ebx*4 + 0xe0]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x64], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x44], ebp
mov esi, dword [esp + 0x14]
mov dword [esp + 0x40], esi
mov dword [esp], eax
call fcn.00402cc0
mov eax, dword [esp + 4]
test eax, eax
je 0x45cfee
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x45d076
mov eax, dword [esp + 0x74]
lea ecx, [eax + 0xe0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
call fcn.0045df00
movzx eax, byte [esp + 8]
test al, al
jne 0x45d01f
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x45d076
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
movzx ebx, byte [eax + 0x6e]
mov ebp, dword [esp + 0x64]
mov dword [esp], ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x1c], 4
mov byte [esp + 0x1d], bl
call fcn.0045dc10
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x60], ebx
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x70]
mov ecx, eax
and eax, 1
mov edx, dword [esp + 0x74]
lea eax, [edx + eax*8 + 0xec]
mov edi, dword [eax]
mov esi, dword [eax + 4]
add edi, 1
mov dword [esp + 0x3c], edi
mov dword [eax], edi
adc esi, 0
mov dword [eax + 4], esi
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x78]
mov dword [esp], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call fcn.0045d9a0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
lea edi, [esp + 0x48]
mov edx, eax
xor eax, eax
call fcn.0046c89a
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov eax, dword [eax + 0x54]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x15
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.0045b570
add esp, 0x68
ret
call fcn.0046b200
jmp fcn.0045cf60
Function at 0x460e80
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x8c8664]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x460f1b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x8c8664]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0046c897
lea ecx, [0x460f30]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0046b110
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0046b200
jmp fcn.00460e80
Function at 0x46c4b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x8c8b00]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46ac3b
je 0x46ac8e
cmp ebx, 0x20
jbe 0x46ac94
cmp ebx, 0x40
jbe 0x46acda
jmp 0x46ad7b
test ebx, ebx
je 0x46ac84
add eax, 0x10
test ax, 0xff0
je 0x46ac70
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x7158c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x7159c0]
jmp 0x46ac58
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46ac58
pxor xmm1, xmmword [0x8c8b10]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8c8b10]
pxor xmm2, xmmword [0x8c8b20]
pxor xmm3, xmmword [0x8c8b30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8c8b10]
pxor xmm2, xmmword [0x8c8b20]
pxor xmm3, xmmword [0x8c8b30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46adda
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x8c8532], 0
je 0x46c4ca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46ac00
jmp fcn.00409750
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x6aad20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x65c015
lea edi, [esi - 0x25b015]
push edi
or ebp, 0xffffffff
jmp 0x6aad42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6aad49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aad38
mov eax, 1
add ebx, ebx
jne 0x6aad5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6aad6c
jne 0x6aad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aad8b
dec eax
add ebx, ebx
jne 0x6aad78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6aad50
add ebx, ebx
jne 0x6aad87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6aaddd
xor ecx, ecx
sub eax, 3
jb 0x6aada3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6aae12
sar eax, 1
mov ebp, eax
jmp 0x6aadae
add ebx, ebx
jne 0x6aadae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aad7c
inc ecx
add ebx, ebx
jne 0x6aadbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aad7c
add ebx, ebx
jne 0x6aadc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6aadbe
jne 0x6aadda
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6aadbe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6aadfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6aadee
jmp 0x6aad3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6aadfc
add edi, ecx
jmp 0x6aad3e
pop esi
mov edi, esi
mov ecx, 0xae7f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6aae1a
cmp byte [edi], 0xe
jne 0x6aae1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6aae1f
lea edi, [esi + 0x2a8000]
mov eax, dword [edi]
or eax, eax
je 0x6aae97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2aa534]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2aa570]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6aae4c
mov ecx, edi
jns 0x6aae7b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2aa578]
or eax, eax
je 0x6aae91
mov dword [ebx], eax
add ebx, 4
jmp 0x6aae69
call dword [esi + 0x2aa574]
mov ebp, dword [esi + 0x2aa57c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6aaecb
sub esp, 0xffffff80
jmp 0x402ba0
Function at 0x404784
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406280
test esi, esi
jne 0x4047ba
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004063bc
jmp 0x4047d8
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404668
mov edi, eax
test esi, esi
je 0x4047d8
cmp dword [ebx], 0
je 0x4047d8
dec esi
jmp 0x4047c1
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40480c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x438008], 0x8088405
inc edx
mov dword [ebx + 0x438008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x405214
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004054b0
mov byte [esp], al
cmp byte [esp], 0
jne 0x40539e
test edi, edi
je 0x40539e
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4052de
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4052b9
cmp edi, 0xffffffff
je 0x405279
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405279
mov byte [esp], 0
jmp 0x40539e
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4052b9
test ebx, ebx
jne 0x4052ab
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4052ab
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x40539e
lea eax, [esp + 0xc]
call fcn.00404fa8
dec ebp
test ebp, ebp
jg 0x40525e
cmp edi, 0xffffffff
je 0x4052de
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4052dc
mov byte [esp], 0
jmp 0x40539e
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x405222
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4052de
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040540c
mov edx, eax
mov ebx, dword [0x43a8f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405342
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405340
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405342
xor edi, edi
cmp byte [esp], 0
je 0x405368
mov ebx, dword [esi]
test bl, 1
jne 0x40537e
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405348
mov byte [esp + 1], 1
jmp 0x40537e
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405368
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4052f5
cmp byte [esp], 0
je 0x40539e
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x405f1c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x43a054], 0
je 0x405f83
cmp word [0x43a340], 0xd7b2
jne 0x405f45
cmp dword [0x43a348], 0
jbe 0x405f45
mov eax, 0x43a33c
call dword [0x43a358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x405fb0
call fcn.00406924
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x438032], 0
jne 0x405f9f
push 0
push 0x4389c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x438034], 0
je 0x40616b
mov edx, edi
mov eax, esi
call dword [0x438034]
mov ebx, eax
jmp 0x40617c
mov eax, 8
call fcn.004043c4
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x43a055], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406108
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x4061ac
mov eax, ebx
call fcn.004043e0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x407e2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x407f91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406280
cmp si, word [0x438a00]
jb 0x407ec4
cmp si, word [0x438c00]
ja 0x407ec4
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x407ec4
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x438a00]
jae 0x407e9e
mov edi, ebx
dec edi
jmp 0x407ebf
cmp si, word [ebx*8 + 0x438a00]
jbe 0x407eae
inc ebx
mov dword [ebp - 8], ebx
jmp 0x407ebf
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x438a04]
call fcn.00407d4c
jmp 0x407ec4
cmp edi, dword [ebp - 8]
jae 0x407e88
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x407f73
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x407f73
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406b94
push dword [ebp - 0x160]
push 0x407fac
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00406b94
push dword [ebp - 0x164]
push 0x407fbc
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406b94
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00406d60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f98
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004062e0
ret