joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004057f0
mov byte [esp], al
cmp byte [esp], 0
jne 0x4054c9
test edi, edi
je 0x4054c9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405409
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4053e4
cmp edi, 0xffffffff
je 0x4053a5
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4053a5
cmp dword [esi], 1
jg 0x4053e4
cmp dword [esi], 0
jne 0x4053d6
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4053d6
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4054c9
lea eax, [esp + 0xc]
call fcn.00404ff4
dec ebp
test ebp, ebp
jg 0x40538a
cmp edi, 0xffffffff
je 0x405409
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405407
mov byte [esp], 0
jmp 0x4054c9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40534e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405409
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405544
mov edx, eax
mov ebx, dword [0x4d58e0]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40546d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40546b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40546d
xor edi, edi
cmp byte [esp], 0
je 0x405493
mov ebx, dword [esi]
test bl, 1
jne 0x4054a9
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405473
mov byte [esp + 1], 1
jmp 0x4054a9
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405493
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405420
cmp byte [esp], 0
je 0x4054c9
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1

Function at 0x406030
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d5040], 0
je 0x406097
cmp word [0x4d532c], 0xd7b2
jne 0x406059
cmp dword [0x4d5334], 0
jbe 0x406059
mov eax, 0x4d5328
call dword [0x4d5344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4060c4
call fcn.00406484
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45e01e], 0
jne 0x4060b3
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40879c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40de88
Capabilities:
Write file on windows

Disassembly:
mov ecx, 0x4dc524
mov dh, byte [ecx]
cmp dh, 0x40
jne 0x40df11
pushal
pushal
push esp
call sub.kernel32.dll_GetLocalTime
movzx eax, word [esp]
sub eax, 0x7d0
shl eax, 0x1a
mov edx, dword [esp + 2]
and edx, 0xf
shl edx, 0x16
add eax, edx
mov edx, dword [esp + 6]
and edx, 0x1f
shl edx, 0x11
add eax, edx
mov edx, dword [esp + 8]
and edx, 0x1f
shl edx, 0xc
add eax, edx
mov edx, dword [esp + 0xa]
and edx, 0x3f
shl edx, 6
add eax, edx
mov edx, dword [esp + 0xc]
and edx, 0x3f
cmp edx, 0x3b
je 0x40deec
cmp byte [esp + 0xf], 3
jb 0x40deec
inc edx
add eax, edx
bswap eax
mov ecx, dword [0x4d85e4]
xchg ch, cl
bsf edx, ecx
mov edi, 0x4dc522
mov byte [edi], dl
mov dword [edi + 6], eax
add esp, 0x20
lea ebx, [eax + 0xb]
or ax, ax
je 0x40df7a
popal
or ax, ax
jne 0x40df2f
cmp byte [0x4dc521], 0x2a
jne 0x40df27
xor eax, eax
call fcn.0040dfc4
ret
mov dl, byte [0x4dc520]
mov byte [ecx], dl
mov dl, byte [ecx]
mov byte [0x4dc520], dl
mov byte [0x4dc521], dl
pushal
movzx ebx, ax
mov ebp, sub.kernel32.dll_GetTickCount
call ebp
mov edi, eax
call ebp
sub eax, edi
movzx edx, byte [0x4cac90]
lea edx, [edx + edx*4]
add dl, byte [0x4dcfe8]
cmp eax, edx
jb 0x40df4a
and byte [0x4cac90], 0
mov edi, 0x4dc522
or ebx, ebx
jne 0x40df7a
mov bx, word [edi + 3]
xchg bh, bl
jmp 0x40df98
mov byte [edi + 3], bh
mov byte [edi + 4], bl
mov byte [0x4dcfe9], 0
mov al, 0xff
mov edx, edi
lea ecx, [edx + ebx - 1]
sub al, byte [edx]
inc edx
cmp edx, ecx
jb 0x40df8f
mov byte [edx], al
and dword [0x4dcfdc], 0
push eax
mov eax, esp
push 0
push eax
push ebx
push edi
push dword [0x4d85d4]
call sub.kernel32.dll_WriteFile
pop eax
inc byte [0x4dcfe9]
call ebp
mov dword [0x4dcfe0], eax
popal
mov byte [ecx], dh
ret

Function at 0x40ed90
Capabilities:
Encode data using xor

Disassembly:
pushal
pushal
pushal
call fcn.0040ed5c
mov esi, eax
xor ebx, ebx
mov edi, 0x672507
mov eax, esp
mov dx, 0x804d
call fcn.00430db8
mov edx, esi
call fcn.00430c44
push eax
push dword [edi]
call sub.user32.dll_SetWindowTextW
dec esi
add edi, 0xffffffce
xor ebx, 1
jne 0x40eda1
add esp, 0x40
popal
ret
Function at 0x41a250
Capabilities:
Get common file path
Get disk information

Disassembly:
pushal
sub esp, 0x230
lea esi, [esp + 0x30]
mov byte [esi - 0x23], 0
mov ax, 0x37
call fcn.0045a044
mov eax, 0x4d4a38
call fcn.00430784
or dword [esi - 0x28], 0xffffffff
mov byte [esi - 0x24], 0
pop eax
push 0
mov edi, 0x2e8fb44
call sub.kernel32.dll_GetLogicalDrives
pop edx
push edx
bt eax, edx
jae 0x41a36b
add edx, 0x3a0061
mov dword [esi], edx
push 0x5c
pop dword [esi + 4]
push esi
call sub.kernel32.dll_GetDriveTypeW
lea ebx, [eax + 0x30]
cmp eax, 2
jne 0x41a2b4
cmp dword [esp], eax
jae 0x41a2b4
mov bl, 0x37
xor eax, eax
push eax
push eax
lea edx, [esi - 0x2c]
push edx
lea edx, [esi + 0x28]
push edx
push eax
push 0x7f
lea edx, [esi + 0x2c]
push edx
push esi
call sub.kernel32.dll_GetVolumeInformationW
or eax, eax
je 0x41a2f3
cmp word [esi + 0x2c], 0
je 0x41a2f3
mov edx, 0x5b0020
mov eax, esi
call fcn.00430e14
lea edx, [esi + 0x2c]
call fcn.00430da0
mov dl, 0x5d
call fcn.00430e24
call fcn.0041a392
cmp byte [edi], 0x61
jae 0x41a300
add byte [edi], 0x20
mov eax, dword [edi]
cmp al, byte [esi]
jne 0x41a36b
mov bx, 0x8078
xor ebp, ebp
mov dword [esi], ebp
inc ebp
mov ecx, dword [edi + ebp*2]
jcxz 0x41a31b
cmp cx, 0x5c
jne 0x41a33f
cmp bh, 0x80
jbe 0x41a32f
cmp word [esi], 0
je 0x41a32f
call fcn.0041a392
mov byte [esi - 0x24], 1
cmp word [edi + ebp*2], 0x5c
jne 0x41a349
mov bl, bh
inc bh
and dword [esi], 0
jmp 0x41a349
mov eax, esi
movzx edx, cx
call fcn.00430e14
cmp word [edi + ebp*2], 0
jne 0x41a30e
mov edx, dword [esi - 0x28]
mov ax, 0x37
call fcn.00430ccc
mov dl, byte [esi - 0x24]
mov ax, 0x39
call fcn.004309cc
inc byte [esi - 0x23]
inc dword [esp]
cmp dword [esp], 0x1f
jbe 0x41a282
cmp byte [esi - 0x23], 0
jne 0x41a3bd
push edi
push 0x3ff
call sub.kernel32.dll_GetCurrentDirectoryW
mov byte [esi - 0x23], 0x80
jmp 0x41a25f
add esp, 0x230
popal
ret
Function at 0x41a3ec
Capabilities:
Enumerate files on windows

Disassembly:
xor eax, eax
pushal
sub esp, 0x280
lea ebp, [esp + 0x30]
mov ax, 0x3c
mov edx, 0x184
xor ecx, ecx
and dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
call fcn.00430e30
mov ax, 0x19a
mov edx, 0x184
xor ecx, ecx
call fcn.00430e30
mov eax, 0x4d4a3c
call fcn.00430784
mov esi, 0x2e8fb44
mov eax, esi
call fcn.00430a24
push eax
or eax, eax
je 0x41a44b
push 0x5c
pop edx
cmp word [esi + eax*2 - 2], dx
je 0x41a44b
mov eax, esi
call fcn.00430e24
mov eax, esi
mov edx, 0x2e002a
call fcn.00430e14
mov dl, 0x2a
call fcn.00430e24
push ebp
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x41a484
call sub.kernel32.dll_GetLastError
cmp eax, 0x15
jne 0x41a47e
mov byte [ebp + 0x26c], 1
nop
jmp 0x41a5c8
xor edi, edi
inc edi
test byte [ebp], 0x10
je 0x41a4a7
lea ecx, [edi + 0x2d]
cmp dword [ebp - 0x10], edi
je 0x41a4d0
cmp word [ebp + 0x2c], cx
jne 0x41a4d6
cmp dword [ebp + 0x2c], ecx
je 0x41a4d0
cmp dword [ebp + 0x2e], ecx
je 0x41a4d0
jmp 0x41a4d6
cmp dword [ebp - 0x10], edi
jne 0x41a4d0
inc edi
cmp byte [0x667e9c], 5
je 0x41a4d6
lea eax, [ebp + 0x2c]
call fcn.00430a24
sub eax, 4
js 0x41a4d0
lea eax, [ebp + eax*2 + 0x2c]
call fcn.0041a3c8
dec al
jns 0x41a4d6
nop
jmp 0x41a5af
mov ebx, 0x4e93a8
lea eax, [ebp - 0x30]
xor edx, edx
mov ecx, 0x180
mov dword [eax], edx
mov dword [ebx], edx
push eax
push edx
push ecx
push dword [0x668ea3]
push eax
push edx
push ecx
push dword [0x66d2ff]
mov edx, dword [ebp - 0xc]
call fcn.00430c44
inc dword [ebp - 0xc]
call sub.user32.dll_SendMessageW
call sub.user32.dll_SendMessageW
cmp edi, 1
jne 0x41a518
mov byte [ebx], 0x5b
mov eax, ebx
lea edx, [ebp + 0x2c]
call fcn.00430da0
cmp edi, 1
jne 0x41a530
mov dl, 0x5d
call fcn.00430e24
jmp 0x41a5a1
cmp byte [0x667e9c], 5
je 0x41a545
call fcn.00430a24
and dword [ebx + eax*2 - 8], 0
jmp 0x41a5a1
xor eax, eax
pushal
xor ebp, ebp
movzx eax, word [ebp*2 + 0x4caeb0]
mov eax, dword [eax*4 + 0x4f01d0]
mov esi, eax
call fcn.00430a24
push eax
mov eax, ebx
mov edi, eax
call fcn.00430a24
pop edx
sub eax, edx
js 0x41a59a
lea edi, [edi + eax*2]
lodsw ax, word [esi]
cmp ax, word [edi]
jne 0x41a59a
je 0x41a586
cmp al, 0x61
jb 0x41a586
cmp al, 0x7a
ja 0x41a586
sub eax, 0x20
scasw ax, word es:[edi]
jne 0x41a59a
dec ax
jns 0x41a572
mov eax, dword [ebp + 0x4caf0a]
mov byte [esp + 1], al
jmp 0x41a5a0
inc ebp
cmp ebp, 0x2c
jbe 0x41a54a
popal
mov eax, edi
mov edx, ebx
mov ecx, 0x4d4a3c
call fcn.00430738
push ebp
push dword [ebp - 8]
call sub.kernel32.dll_FindNextFileW
or eax, eax
jne 0x41a484
push dword [ebp - 8]
call sub.kernel32.dll_FindClose
pop eax
and dword [esi + eax*2], 0
xor dword [ebp - 0x10], 1
jne 0x41a42e
add esp, 0x280
popal
ret
Function at 0x41a7ac
Capabilities:
Copy file

Disassembly:
mov edx, 0x2e8db40
cmp word [edx], 0
jne 0x41a7b8
ret
pushal
mov ebx, 0x4e93a8
and dword [ebx], 0
mov ebp, fcn.00430da0
mov eax, ebx
call ebp
call fcn.00430a24
push 0x5c
pop edx
cmp word [ebx + eax*2 - 2], dx
je 0x41a7dc
mov dword [ebx + eax*2], edx
mov eax, ebx
mov edx, 0x2e8e340
call ebp
mov edx, dword [0x4f218c]
call ebp
push eax
mov eax, esp
call fcn.00430838
pop edx
push edx
push edx
dec eax
push eax
push edx
call sub.kernel32.dll_GlobalLock
mov edi, eax
mov al, 3
call fcn.0041a084
cmp eax, 0xffffffff
je 0x41a841
push eax
call sub.kernel32.dll_CloseHandle
mov ebp, 0x800
push ebp
push 0
call sub.kernel32.dll_GlobalAlloc
push eax
push eax
push ebp
push ebx
push eax
call sub.kernel32.dll_RtlMoveMemory
pop eax
mov dl, 0x5f
call fcn.00430e24
push 0
push eax
push ebx
call sub.kernel32.dll_CopyFileW
call sub.kernel32.dll_GlobalFree
mov al, 2
call fcn.0041a084
cmp eax, 0xffffffff
je 0x41a8a2
mov esi, eax
mov ebp, sub.kernel32.dll_WriteFile
push eax
mov eax, esp
push 0
push eax
push 0xb
push 0x4caea4
push esi
call ebp
mov eax, esp
cmp dword [eax], 0xb
jne 0x41a89b
push 0
push eax
push dword [eax + 4]
push edi
push esi
call ebp
pop eax
mov ecx, dword [esp]
cmp eax, ecx
push eax
jne 0x41a89b
xor edx, edx
add dl, byte [edi + ecx - 1]
loop 0x41a880
mov dh, dl
not dh
mov eax, esp
mov dword [eax + 4], edx
push 0
push eax
push 2
add eax, 4
push eax
push esi
call ebp
pop eax
push esi
call sub.kernel32.dll_CloseHandle
pop eax
call sub.kernel32.dll_GlobalUnlock
call sub.kernel32.dll_GlobalFree
popal
ret

Function at 0x41aae4
Capabilities:
Read file on windows

Disassembly:
cmp byte [ebp - 4], 0
jne 0x41ab0e
pushal
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push dword [ebp - 0x10]
call sub.kernel32.dll_ReadFile
popal
cmp dword [ebp - 4], edx
setne byte [ebp - 4]
mov ecx, edx
mov dl, byte [eax + ecx - 1]
add byte [ebp - 0x11], dl
loop 0x41ab05
ret
Function at 0x42ac2c
Capabilities:
Encode data using xor

Disassembly:
pushal
mov ax, 0x3d8
call fcn.0045a044
sub esp, 0x190
call fcn.0042ac97
mov cl, byte [ecx]
mov eax, esp
mov esi, 0x42ac87
mov edi, fcn.00430db8
mov ebp, fcn.00430c44
xor ebx, ebx
cmp cl, 1
jne 0x42acb6
lea edx, [bx - 0x7fa4]
call edi
movzx edx, byte [0x2e8daec]
sub edx, 2
call ebp
call esi
xor ebx, 1
jne 0x42ac5b
jmp 0x42acf1
cmp cl, 3
jb 0x42acf1
ja 0x42acf7
lea edx, [bx - 0x7d89]
or ebx, ebx
je 0x42acc9
add edx, 3
call edi
mov dx, 0x26e
call edi
movzx edx, word [0x2e8daec]
and dh, 1
inc edx
call ebp
call esi
or ebx, ebx
jne 0x42aceb
mov eax, dword [0x4f0a88]
call esi
inc ebx
cmp ebx, 2
jbe 0x42acbd
nop
jmp 0x42ae33
cmp cl, 5
ja 0x42ad67
je 0x42ad0e
mov bp, 0x27e
call fcn.0042ae69
mov eax, dword [0x4f0bc4]
jmp 0x42ad64
mov ebx, dword [0x2e8daec]
mov edx, ebx
shr ebx, 3
and ebx, 0x1e
and edx, 1
lea ebx, [ebx + edx - 5]
call fcn.0042ac97
cmp byte [ecx + 5], dh
jne 0x42ad45
mov dx, 0x80ad
call edi
mov edx, ebx
call ebp
call esi
mov dx, 0x80ae
call edi
mov edx, ebx
call ebp
jmp 0x42ad64
mov esi, 0x42ac77
mov edx, 0x6180ad
call esi
mov edx, 0x6180ae
call esi
mov edx, 0x6280ad
call esi
mov edx, 0x6280ae
nop
jmp 0x42adcf
cmp cl, 6
jne 0x42ad83
lea edx, [bx - 0x7d87]
call edi
mov dx, 0x273
call edi
call esi
inc ebx
cmp ebx, 3
jbe 0x42ad6c
jmp 0x42ada1
cmp cl, 0x15
je 0x42ad8d
cmp cl, 0x16
jne 0x42ada4
lea edx, [bx - 0x7d87]
call edi
mov dx, 0x27f
call edi
call esi
xor ebx, 1
jne 0x42ad8d
nop
jmp 0x42adee
cmp cl, 0xc
jne 0x42adc4
lea edx, [bx - 0x7d91]
call edi
call fcn.0042ac97
movzx edx, byte [ecx + 2]
call ebp
mov dl, 0x5d
call fcn.00430e24
jmp 0x42adcf
cmp cl, 0xd
jne 0x42add2
mov dx, 0x80ac
call edi
nop
jmp 0x42ae31
mov bp, 0x332
cmp cl, 0x12
je 0x42ade9
cmp cl, 0x13
je 0x42ade5
cmp cl, 0x10
jne 0x42adf1
mov bp, 0x26d
call fcn.0042ae69
nop
jmp 0x42ae33
cmp cl, 0xf
jne 0x42ae33
call fcn.0042ac97
mov bl, byte [ecx + 2]
mov eax, dword [ebx*4 + 0x4f0a84]
call esi
mov eax, dword [ebx*4 + 0x4f0aa4]
cmp ebx, 4
jb 0x42ae33
cmp ebx, 6
jbe 0x42ae31
mov eax, dword [0x4f0f34]
cmp ebx, 8
jb 0x42ae33
je 0x42ae31
mov eax, dword [ebx*4 + 0x4f0a9c]
cmp ebx, 0xb
ja 0x42ae33
call esi
add esp, 0x190
push 0
push 0
push 0x146
push dword [0x67431b]
call sub.user32.dll_SendMessageW
cmp al, byte [0x2e8daf1]
ja 0x42ae5c
xor eax, eax
mov byte [0x2e8daf1], al
mov edx, eax
mov ax, 0x3d8
call fcn.00430ccc
popal
ret
Function at 0x430928
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov edi, 0x2e8db00
push esp
call sub.kernel32.dll_GlobalMemoryStatus
cmp dword [esp + 0xc], 0x5000000
jae 0x430973
mov esi, 0xf
lea ebx, [edi + 0x3c]
mov eax, dword [ebx]
test eax, eax
je 0x43095d
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
mov dword [ebx], eax
jmp 0x430933
dec esi
sub ebx, 4
cmp esi, 0xffffffff
jne 0x43094b
xor edx, edx
mov ax, 0x15
call fcn.004309cc
jmp 0x4309ad
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x430980
push eax
call sub.kernel32.dll_GlobalFree
push 0x3c
push edi
lea eax, [edi + 4]
push eax
call sub.kernel32.dll_RtlMoveMemory
mov eax, edi
call fcn.00430838
mov esi, eax
push 2
push esi
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GlobalReAlloc
mov dword [edi], eax
mov dl, 1
mov ax, 0x15
call fcn.004309cc
add esp, 0x20
pop edi
pop esi
pop ebx
ret
Function at 0x45d463
Capabilities:
Delete registry key
Get disk information

Disassembly:
movzx ecx, word [ebp]
add ebp, 2
jecxz 0x45d47b
lea eax, [ebp + ecx*2]
cmp eax, dword [0x2ea0a00]
ja 0x45d47c
rep movsw word es:[edi], word [esi]
ret
pop eax
pop eax
push 0x40
push 0x2e96b44
call sub.kernel32.dll_RtlZeroMemory
push 0x5000
push 0x2e91b44
call sub.kernel32.dll_RtlZeroMemory
jmp fcn.0045d4a7
Function at 0x404a7c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406610
test esi, esi
jne 0x404ab2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040677c
jmp 0x404ad0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404960
mov edi, eax
test esi, esi
je 0x404ad0
cmp dword [ebx], 0
je 0x404ad0
dec esi
jmp 0x404ab9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404b04
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5d9008], 0x8088405
inc edx
mov dword [ebx + 0x5d9008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x405578
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405828
mov byte [esp], al
cmp byte [esp], 0
jne 0x405704
test edi, edi
je 0x405704
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40563b
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x405616
cmp edi, 0xffffffff
je 0x4055d7
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4055d7
mov byte [esp], 0
jmp 0x405704
mov ebx, dword [esi]
cmp ebx, 1
jg 0x405616
test ebx, ebx
jne 0x40560c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.004026dc
test eax, eax
jne 0x40560c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405704
call 0x40586c
dec ebp
test ebp, ebp
jg 0x4055bc
cmp edi, 0xffffffff
je 0x40563b
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405639
mov byte [esp], 0
jmp 0x405704
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x405586
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.004026dc
cmp ebx, eax
jne 0x40563b
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405774
mov edx, eax
mov ebx, dword [0x5df8f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4056a2
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4056a0
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4056a2
xor edi, edi
cmp byte [esp], 0
je 0x4056cb
mov ebx, dword [esi]
test bl, 1
jne 0x4056e4
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.004026dc
cmp ebx, eax
jne 0x4056a8
mov byte [esp + 1], 1
jmp 0x4056e4
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.004026dc
cmp ebx, eax
jne 0x4056cb
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405655
cmp byte [esp], 0
je 0x405704
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40626c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5df054], 0
je 0x4062d3
cmp word [0x5df340], 0xd7b2
jne 0x406295
cmp dword [0x5df348], 0
jbe 0x406295
mov eax, 0x5df33c
call dword [0x5df358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x406300
call fcn.00406f64
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5d9032], 0
jne 0x4062ef
push 0
push 0x5d99c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4064cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x5d9034], 0
je 0x4064f7
mov edx, edi
mov eax, esi
call dword [0x5d9034]
mov ebx, eax
jmp 0x406508
mov eax, 8
call fcn.0040464c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x5df055], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406494
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40653d
mov edx, 8
mov eax, ebx
call fcn.00404668
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x408a90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408bf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406610
cmp si, word [0x5d9a00]
jb 0x408b28
cmp si, word [0x5d9c00]
ja 0x408b28
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x408b28
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x5d9a00]
jae 0x408b02
mov edi, ebx
dec edi
jmp 0x408b23
cmp si, word [ebx*8 + 0x5d9a00]
jbe 0x408b12
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408b23
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x5d9a04]
call fcn.004089a0
jmp 0x408b28
cmp edi, dword [ebp - 8]
jae 0x408aec
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408bd7
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408bd7
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004072c0
push dword [ebp - 0x160]
push 0x408c10
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004072c0
push dword [ebp - 0x164]
push 0x408c20
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004072c0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040748c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408bfc
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406670
ret
Function at 0x408da8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408eab
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5e1b84
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x5e1b9c]
jne 0x408df4
mov eax, esi
mov edx, 0x5e1b9e
mov ecx, 0x55
call fcn.004072c0
push 0x5e1b84
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408e95
push 0x5e1b84
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406610
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408e63
cmp byte [0x5e1b80], 0
je 0x408e28
mov edx, esi
mov eax, ebx
call fcn.00408c8c
jmp 0x408e63
mov edx, esi
mov eax, ebx
call fcn.00408a90
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408e63
cmp dword [esi], 0
je 0x408e4c
mov eax, esi
mov edx, 0x408ec4
call fcn.004073ac
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408a90
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004073ac
push 0x5e1b84
call sub.kernel32.dll_EnterCriticalSection
mov word [0x5e1b9c], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407214
push eax
push 0x5e1b9e
call sub.kernel32.dll_lstrcpynW
push 0x5e1b84
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408eb2
lea eax, [ebp - 4]
call fcn.00406610
ret