joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46aa10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push esi
push edi
push str.SYSTEMCurrentControlSetControlSession_Manager
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call fcn.0046a6f0
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x46ab78
push ebx
push 0x9000
push esi
mov dword [esp + 0x14], 0x8000
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x46ab70
mov eax, dword [esp + 0xc]
push eax
push 0xff
push ebx
call fcn.0046e3e0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
add esp, 0xc
lea esi, [ecx + ebx]
push edx
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.00472799
add esp, 4
lea eax, [esp + 0xc]
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0
push str.PendingFileRenameOperations
push edi
mov byte [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46ab58
mov edx, dword [esp + 0xc]
lea eax, [edx + ebx]
mov esi, ebx
mov dword [esp + 0x18], eax
cmp ebx, eax
jae 0x46ab58
push ebp
jmp 0x46aad0
push esi
call fcn.00472681
lea edi, [eax + esi + 1]
push edi
call fcn.00472681
add esp, 8
cmp dword [esi], 0x5c3f3f5c
lea ebp, [eax + edi + 1]
jne 0x46aaf2
add esi, 4
cmp dword [edi], 0x5c3f3f5c
jne 0x46aafd
add edi, 4
push esi
call fcn.00472799
push edi
call fcn.00472799
add esp, 8
cmp byte [edi], 0
jne 0x46ab2d
mov eax, dword [esp + 0x18]
push eax
push esi
call fcn.00472613
add esp, 8
test eax, eax
jne 0x46ab3f
mov dword [esp + 0x14], 1
jmp 0x46ab57
mov ecx, dword [esp + 0x18]
push ecx
push edi
call fcn.00472613
add esp, 8
test eax, eax
je 0x46ab4f
cmp byte [ebp], 0
je 0x46ab57
mov esi, ebp
cmp ebp, dword [esp + 0x1c]
jb 0x46aad0
jmp 0x46ab57
mov dword [esp + 0x14], 2
pop ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret
Function at 0x46ab80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push esi
push edi
push str.SYSTEMCurrentControlSetControlSession_Manager
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call fcn.0046a6f0
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x46ad6c
push ebp
push 0xa000
push esi
mov dword [esp + 0x14], 0x8000
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x46ad64
mov eax, dword [esp + 0xc]
push eax
push 0xff
push ebp
call fcn.0046e3e0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
add esp, 0xc
lea esi, [ecx + ebp]
push edx
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call fcn.00472983
add esp, 4
lea eax, [esp + 0xc]
push eax
push ebp
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x48554c
push edi
mov byte [ebp], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46ad4c
mov edx, dword [esp + 0xc]
lea eax, [edx + ebp]
mov edi, ebp
mov dword [esp + 0x18], eax
cmp ebp, eax
jae 0x46ad4c
push ebx
lea esp, [esp]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46ac45
sub eax, edx
sar eax, 1
lea esi, [edi + eax*2 + 2]
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46ac60
sub eax, edx
sar eax, 1
push edi
lea ebx, [esi + eax*2 + 2]
call fcn.00472983
push esi
call fcn.00472983
push 4
push str.___
push edi
call fcn.00471f1e
add esp, 0x14
test eax, eax
jne 0x46ac96
add edi, 8
push 4
push str.___
push esi
call fcn.00471f1e
add esp, 0xc
test eax, eax
jne 0x46acad
add edi, 8
cmp word [esi], 0
jne 0x46acf9
mov ecx, dword [esp + 0x18]
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46ace6
test dx, dx
je 0x46ace2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46ace6
add eax, 4
add ecx, 4
test dx, dx
jne 0x46acc0
xor eax, eax
jmp 0x46aceb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x46ad2f
mov dword [esp + 0x14], 1
jmp 0x46ad4b
mov eax, dword [esp + 0x18]
lea ecx, [ecx]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x46ad26
test cx, cx
je 0x46ad22
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x46ad26
add esi, 4
add eax, 4
test cx, cx
jne 0x46ad00
xor eax, eax
jmp 0x46ad2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46ad43
cmp word [ebx], 0
je 0x46ad4b
mov edi, ebx
cmp ebx, dword [esp + 0x1c]
jb 0x46ac40
jmp 0x46ad4b
mov dword [esp + 0x14], 2
pop ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret
Function at 0x46af70
Capabilities:
Start service

Disassembly:
push ebx
push SysReAllocString
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x46af98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
xor eax, eax
pop ebx
ret 8
mov edx, dword [esp + 8]
push edi
push 0x10
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x46afc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push ebx
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop ebx
ret 8
push esi
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov esi, eax
test esi, esi
jne 0x46afec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
mov dword [edx], eax
cmp eax, 0x420
jne 0x46aff1
mov esi, 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
mov eax, esi
pop esi
pop edi
pop ebx
ret 8

Function at 0x46b010
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
mov eax, 0xf003f
call fcn.0046add0
mov ebx, eax
test ebx, ebx
jne 0x46b02b
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x24]
push edi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x46b054
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
push esi
lea ecx, [esp + 0xc]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, eax
test esi, esi
jne 0x46b071
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46b076
mov esi, 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
mov eax, esi
pop esi
pop edi
pop ebx
add esp, 0x1c
ret 4
Function at 0x46b090
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x424
mov eax, dword [0x49ab28]
xor eax, esp
mov dword [esp + 0x420], eax
mov eax, dword [esp + 0x428]
mov dword [esp + 0xc], eax
mov byte [eax], 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x46b0d6
mov eax, 1
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0046c1d2
add esp, 0x424
ret
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push 0x20008
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x46b123
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0046c1d2
add esp, 0x424
ret
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
lea ecx, [esp + 0x24]
push ecx
push 0x400
lea edx, [esp + 0x38]
push edx
mov ebp, 2
push ebp
push eax
call esi
lea ecx, [esp + 0x20]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
mov edi, eax
mov eax, dword [esp + 0x20]
push 0x12
push eax
mov dword [esp + 0x24], ebp
call esi
test eax, eax
jne 0x46b16b
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x46b19c
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push ebp
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x46b1a0
xor eax, eax
jmp 0x46b1ea
xor ebp, ebp
xor esi, esi
cmp dword [esp + 0x30], ebx
jbe 0x46b1d3
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esp + 0x34]
mov ecx, dword [edi]
mov edx, dword [esp + 0x18]
push ecx
push edx
call ebx
test eax, eax
jne 0x46b1ce
inc esi
add edi, 8
cmp esi, dword [esp + 0x30]
jb 0x46b1b4
jmp 0x46b1d3
mov ebp, 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov byte [edx], cl
mov eax, ebp
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046c1d2
add esp, 0x424
ret

Function at 0x46b280
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x46bb10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x64
mov eax, dword [0x49ab28]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, dword [esp + 0x6c]
push edi
push 0x410
mov dword [esp + 0x10], eax
call fcn.0046e4c4
mov edi, eax
add esp, 4
test edi, edi
jne 0x46bb52
pop edi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0046c1d2
add esp, 0x64
ret 8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push ebx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x46bbac
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push ebx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x46bbac
push edi
call fcn.0046c1c7
add esp, 4
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0046c1d2
add esp, 0x64
ret 8
lea ecx, [esp + 0x18]
push ecx
call fcn.0046b280
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
push 0
lea edx, [esp + 0x14]
push edx
push 0x400
push edi
push esi
mov dword [esp + 0x24], 0
call ebp
test eax, eax
je 0x46bc1b
jmp 0x46bbe0
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x46bc1b
push ebx
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.0046b9e0
add esp, 0xc
cmp ebx, 0x400
jb 0x46bc1b
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x400
push edi
push esi
mov dword [esp + 0x24], 0
call ebp
test eax, eax
jne 0x46bbe0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.0046ba80
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0046c1c7
mov ecx, dword [esp + 0x74]
add esp, 4
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0046c1d2
add esp, 0x64
ret 8

Function at 0x46bc60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push ebx
mov bl, byte [esp + 0x60]
push esi
mov esi, 0x20
test bl, 4
je 0x46bc78
mov esi, 0x1000020
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0046e3e0
mov eax, dword [esp + 0x6c]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push esi
push 0
push 0
push 0
push eax
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
je 0x46bd0a
test bl, 1
je 0x46bcd5
mov ecx, dword [esp + 8]
push 0x1d4c0
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov esi, eax
neg esi
sbb esi, esi
inc esi
test bl, 2
je 0x46bce7
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x68]
test eax, eax
je 0x46bcff
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov eax, esi
pop esi
pop ebx
add esp, 0x54
ret 0xc
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
add esp, 0x54
ret 0xc
Function at 0x46bd20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x46bd4c
movzx ecx, byte [edx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x49a728]
inc edx
sub esi, 1
jne 0x46bd31
pop esi
ret 0xc

Function at 0x46bd50
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
push edi
mov dword [esp + 0xc], ebp
test esi, esi
je 0x46bd6a
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x46bd92
mov esi, 0x10000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x46bd8e
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
mov edi, eax
mov ebp, eax
mov eax, dword [esp + 0x14]
push ebx
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46bdd2
test ebp, ebp
je 0x46bdc8
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0x20]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x46be25
nop
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x46be21
mov edx, dword [esp + 0x20]
push edx
push ebp
push edi
call fcn.0046bd20
mov dword [esp + 0x20], eax
cmp ebp, esi
jb 0x46be21
push 0
lea eax, [esp + 0x20]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x46bdf0
mov ebp, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x46be40
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x20]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
Function at 0x46be50
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
test eax, eax
je 0x46be61
mov dword [eax], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46be6f
mov dword [eax], 0
push ebx
mov ebx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x14]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x46be8c
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esi + 0x800]
push edi
push ecx
call fcn.0046e4c4
mov edi, eax
add esp, 4
test edi, edi
jne 0x46bea9
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push ebp
push edi
push esi
lea ebp, [edi + esi]
xor esi, esi
push esi
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, 1
je 0x46bed0
push edi
call fcn.0046c1c7
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push str.VarFileInfoTranslation
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], esi
call sub.VERSION.dll_VerQueryValueA
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x494bb0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x46bf24
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
cmp eax, esi
je 0x46bf17
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x46bf24
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x46bf37
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
jmp 0x46bf41
push 0x4e4
push 0x409
push str.StringFileInfo_04x_04x_
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
xor esi, esi
add ebx, ebp
cmp dword [esp + 0x30], esi
jle 0x46bfad
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + esi*8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebp
push edi
mov dword [esp + 0x20], 0
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0x10], 0
je 0x46bfa6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + esi*8 + 4]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
cmp esi, dword [esp + 0x30]
jl 0x46bf63
push edi
call fcn.0046c1c7
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x46c1d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49ab28]
jne 0x46c1dc
repz ret
jmp fcn.004729f3
Function at 0x47e766
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00473573
and dword [ebp - 4], 0
cmp dword [0x4a1dc8], 0
mov ebx, eax
jne 0x47e817
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47e8c8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49245c
push edi
call esi
test eax, eax
je 0x47e8c8
push eax
call fcn.00473501
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a1dc8], eax
call esi
push eax
call fcn.00473501
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a1dcc], eax
call esi
push eax
call fcn.00473501
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a1dd0], eax
call esi
push eax
call fcn.00473501
pop ecx
mov dword [0x4a1dd8], eax
test eax, eax
je 0x47e817
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00473501
pop ecx
mov dword [0x4a1dd4], eax
mov eax, dword [0x4a1dd4]
cmp eax, ebx
je 0x47e86f
cmp dword [0x4a1dd8], ebx
je 0x47e86f
push eax
call fcn.0047357c
push dword [0x4a1dd8]
mov esi, eax
call fcn.0047357c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x47e86f
test edi, edi
je 0x47e86f
call esi
test eax, eax
je 0x47e866
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47e866
test byte [ebp - 0xc], 1
jne 0x47e86f
or dword [ebp + 0x10], 0x200000
jmp 0x47e8a8
mov eax, dword [0x4a1dcc]
cmp eax, ebx
je 0x47e8a8
push eax
call fcn.0047357c
pop ecx
test eax, eax
je 0x47e8a8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x47e8a8
mov eax, dword [0x4a1dd0]
cmp eax, ebx
je 0x47e8a8
push eax
call fcn.0047357c
pop ecx
test eax, eax
je 0x47e8a8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a1dc8]
call fcn.0047357c
pop ecx
test eax, eax
je 0x47e8c8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47e8ca
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402ad0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402aff
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403e14
jmp 0x402b1d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004029f8
mov edi, eax
test ebx, ebx
je 0x402b1d
cmp dword [esi], 0
je 0x402b1d
dec ebx
jmp 0x402b06
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402db4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x4e9040], 0x8088405
inc edx
mov dword [0x4e9040], edx
mul edx
mov eax, edx
ret

Function at 0x402fac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403044
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403024
xor eax, eax
push ebp
push 0x40301d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403060
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403024
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x405cc0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405e78
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405d21
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405e94
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405d8e
xor eax, eax
push ebp
push 0x405d87
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405d70
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405eb4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d8e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405e6f
cmp byte [ebp - 0xd], 0
jne 0x405dd0
cmp byte [ebp - 0x12], 0
je 0x405e6f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405de9
dec ebx
cmp byte [ebx], 0x2e
je 0x405df8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405de8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405e6f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405e25
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405e6f
cmp byte [ebp - 0xd], 0
je 0x405e6f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405e6f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406430
Capabilities:
Delete file

Disassembly:
mov edx, dword [eax + 4]
sub edx, 0xd7b0
cmp edx, 3
ja 0x406457
lea eax, [eax + 0x48]
push eax
call sub.kernel32.dll_DeleteFileA
dec eax
jne 0x40644b
ret
call sub.kernel32.dll_GetLastError
call fcn.004028b4
jmp 0x40644a
mov eax, 0x66
jmp 0x406450