joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4866db
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ebx
push edi
mov dword [ebp - 8], esi
cmp dword [ebp + 8], ebx
jne 0x486704
mov eax, 0x80070057
push eax
mov dword [ebp - 4], eax
call fcn.004321e3
jmp 0x48683b
cmp dword [ebp + 0xc], ebx
je 0x4866f1
lea eax, [ebp - 8]
push eax
push ebx
push 0x405ce4
push dword [ebp + 8]
call fcn.004314b7
mov dword [ebp - 4], eax
test eax, eax
jns 0x486730
push eax
call fcn.004321e3
mov esi, dword [ebp - 8]
jmp 0x48683b
mov esi, dword [ebp - 8]
push esi
call fcn.00438e87
test eax, eax
jne 0x4867b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test eax, eax
jle 0x486755
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WDSCORE.dll_CurrentIP
push dword [ebp - 4]
mov edi, eax
push esi
push 0x405d80
push 0x2000000
call fcn.0045ab3f
add esp, 0x10
xor ecx, ecx
push ecx
push ecx
push ebx
push edi
push 0x405cf8
push 0x405778
push 0x198
push ecx
push 0x41216c
push ecx
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
mov edi, dword [ebp - 4]
test edi, edi
jns 0x48683e
push edi
call fcn.004321e3
jmp 0x48683e
push ebx
push ebx
mov edi, 0x405dc8
push edi
push esi
call fcn.0043ae7d
test eax, eax
je 0x486836
push esi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x48682f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WDSCORE.dll_CurrentIP
push 0x405df8
push 0x2000000
mov edi, eax
call fcn.0045ab3f
pop ecx
pop ecx
xor ecx, ecx
push ecx
push ecx
push ebx
push edi
push 0x405cf8
push 0x405778
push 0x1a2
push ecx
push 0x41216c
push ecx
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
mov eax, 0x80070490
push eax
mov dword [ebp - 4], eax
call fcn.004321e3
mov edi, 0x80070490
jmp 0x48683e
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
jmp 0x48683b
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov edi, dword [ebp - 4]
push edi
call fcn.00432150
test esi, esi
je 0x48684e
push esi
call fcn.0043220c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x487398
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0x11c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
js 0x4873fa
cmp dword [ebp - 0x11c], 0xa
jne 0x4873f6
cmp dword [ebp - 0x114], 0x3839
jb 0x4873f6
inc esi
mov eax, esi
jmp 0x4873fc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047d650
leave
ret

Function at 0x48740f
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
js 0x487461
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
jmp 0x487463
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d650
leave
ret

Function at 0x487475
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0x11c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
js 0x4874d8
cmp dword [ebp - 0x11c], 6
ja 0x4874d1
jne 0x4874d4
cmp dword [ebp - 0x118], 1
jb 0x4874d4
xor esi, esi
inc esi
mov eax, esi
jmp 0x4874da
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047d650
leave
ret
Function at 0x48857b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x32c], ebx
push edi
push 4
pop edi
mov dword [ebp - 0x334], edi
test esi, esi
je 0x4886d4
lea eax, [ebp - 0x324]
push eax
push 0x20019
push ebx
push 0x405f38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4886d4
push 0x114
lea eax, [ebp - 0x318]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x320], 0x11c
mov dword [ebp - 0x31c], 6
push 2
push 2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x48868e
push 0x200
lea eax, [ebp - 0x204]
mov dword [ebp - 0x328], ebx
push ebx
push eax
mov esi, ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x330], 0x100
push ecx
push ebx
lea ecx, [ebp - 0x330]
mov eax, esi
push ecx
lea ecx, [ebp - 0x204]
inc esi
push ecx
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x488685
cmp dword [ebp - 0x328], edi
je 0x4886bd
cmp eax, 0x103
jne 0x488647
jmp 0x4886bf
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x32c]
push eax
push ebx
push esi
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4886bf
cmp dword [ebp - 0x32c], edi
jne 0x4886bf
mov bl, 1
cmp dword [ebp - 0x324], 0
je 0x4886d4
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret 4
Function at 0x48880a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x48882f
xor eax, eax
jmp 0x4888dd
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
mov edi, eax
test edi, edi
je 0x4888da
cmp edi, 0x7f
je 0x4888da
push 2
push edi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
jne 0x488880
cmp edi, 4
jne 0x488867
push 1
push 0x804
jmp 0x488876
cmp edi, 0x7c04
jne 0x4888da
push 1
push 0x404
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4888da
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x1004
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4888da
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
push 2
push esi
push 0x405eac
mov edi, eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x4888ed
mov esi, 0x405eb4
test ebx, ebx
je 0x48895b
push 0x405ec4
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x48895b
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret 8
push 2
push esi
push 0x405ed4
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x488909
mov esi, 0x405edc
jmp 0x48895b
push 2
push esi
push 0x405eec
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x488925
mov esi, 0x405ef4
jmp 0x48895b
push 2
push esi
push 0x405f00
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x488941
mov esi, 0x405f08
jmp 0x48895b
push 2
push esi
push 0x405f18
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x488969
mov esi, 0x405f20
push esi
call fcn.0048857b
test al, al
je 0x4888da
test edi, edi
je 0x48899e
cmp edi, 0xfde9
je 0x48899e
push 2
lea eax, [ebp - 0x64]
push eax
push edi
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x4888da
push edi
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4888da
push dword [ebp - 0x64]
jmp 0x4889a4
test ebx, ebx
je 0x4889b2
push 1
push ebx
call fcn.0048872f
test eax, eax
je 0x4888da
xor eax, eax
inc eax
jmp 0x4888dc
Function at 0x4889e2
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.00488320
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2008], ebx
push edi
mov edi, eax
test esi, esi
jne 0x488a1f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x488b4f
push 0x1000
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2004]
push esi
push 0x1000
push eax
push 0x405fac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp eax, 0xffe
jne 0x488a59
xor edx, edx
push 0x6f
jmp 0x488a14
xor eax, eax
lea esi, [ebp - 0x2004]
mov ecx, eax
cmp word [ebp + ecx*2 - 0x2004], ax
jne 0x488a7b
cmp word [ebp + ecx*2 - 0x2002], ax
je 0x488b4f
cmp ecx, 0xfff
jae 0x488b4f
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x488a98
add esi, 2
inc ecx
movzx edx, word [esi]
mov eax, esi
mov dword [ebp - 0x200c], eax
test dx, dx
je 0x488ab0
xor edx, edx
add esi, 2
inc ecx
cmp word [esi], dx
jne 0x488aa7
test ebx, ebx
je 0x488ab9
cmp edi, dword [ebp + 8]
je 0x488ac3
push 0
cmp eax, esi
pop eax
je 0x488a63
inc edi
jmp 0x488a63
push 0x3d
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
mov eax, dword [ebp - 0x200c]
pop ecx
pop ecx
test ebx, ebx
je 0x488adc
mov esi, ebx
sub esi, eax
sar esi, 1
cmp esi, dword [ebp + 0x10]
jb 0x488ae9
push 0x7a
jmp 0x488b45
push esi
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 0x2008]
push eax
call fcn.0041a2c8
mov eax, dword [ebp - 0x2008]
xor ecx, ecx
push 0x8000000
push eax
mov word [eax + esi*2], cx
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
and eax, 0x3ff
je 0x488b38
cmp ax, 0x7f
je 0x488b38
test ebx, ebx
je 0x488b4f
lea eax, [ebx + 2]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
mov edi, eax
pop ecx
or edi, 0x10000000
jmp 0x488b4f
mov eax, dword [ebp - 0x2008]
xor ecx, ecx
push 0x57
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret 0x10
Function at 0x401af0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi]
push 0
add eax, 0xffffffe8
push eax
push ecx
call fcn.0040801b
add esp, 0xc
test eax, eax
je 0x401b13
or eax, 0xffffffff
pop esi
ret
mov edx, dword [esi]
push edi
push edx
push 1
lea edi, [esi + 0x10]
push 0x18
push edi
call fcn.00407f74
add esp, 0x10
cmp eax, 1
jae 0x401b32
pop edi
or eax, 0xffffffff
pop esi
ret
push 8
push str.MEI_f_v_n_v
push edi
call fcn.00407c6a
add esp, 0xc
neg eax
pop edi
sbb eax, eax
pop esi
ret

Function at 0x401b50
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push 0
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.0040801b
mov ecx, dword [esi]
push ecx
push 2
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00407f74
mov ax, word [esp + 0x20]
add esp, 0x1c
cmp al, 0x4d
jne 0x401c23
cmp ah, 0x5a
jne 0x401c23
mov eax, dword [esi]
push 0
push 0x3c
push eax
call fcn.0040801b
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x1c]
push 4
push edx
call fcn.00407f74
mov eax, dword [esp + 0x24]
mov ecx, dword [esi]
push 0
add eax, 0x18
push eax
push ecx
call fcn.0040801b
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x34]
push 2
push eax
call fcn.00407f74
mov ax, word [esp + 0x3c]
add esp, 0x38
cmp al, 0xb
jne 0x401c23
cmp ah, 1
jne 0x401bee
mov eax, 0x98
jmp 0x401bf8
cmp ah, 2
jne 0x401c23
mov eax, 0xa8
add eax, dword [esp + 8]
mov edx, dword [esi]
push 0
push eax
push edx
call fcn.0040801b
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x1c]
push 4
push ecx
call fcn.00407f74
mov eax, dword [esp + 0x24]
add esp, 0x1c
test eax, eax
jne 0x401c26
or eax, 0xffffffff
pop esi
add esp, 8
ret
Function at 0x401c30
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
lea eax, [esi + 0x28]
push 0x414354
push eax
call fcn.00408430
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x401c51
or eax, 0xffffffff
pop esi
ret
push edi
push 2
push 0
push eax
call fcn.0040801b
mov ecx, dword [esi]
push ecx
call fcn.0040830f
mov edi, eax
push edi
push esi
call fcn.00401af0
add esp, 0x18
test eax, eax
jns 0x401caf
push esi
call fcn.00401b50
mov edi, eax
add esp, 4
cmp edi, 1
jl 0x401d61
push ebx
xor ebx, ebx
jmp 0x401c90
push edi
push esi
call fcn.00401af0
add esp, 8
test eax, eax
jns 0x401ca5
inc ebx
dec edi
cmp ebx, 8
jl 0x401c90
cmp ebx, 8
pop ebx
je 0x401d61
mov edx, dword [esi + 0x18]
push edx
call fcn.00406188
sub edi, eax
mov eax, dword [esi + 0x1c]
push 0
push eax
mov dword [esi + 4], edi
call fcn.00406188
add eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.0040801b
mov edx, dword [esi + 0x20]
add esp, 0xc
push edx
call fcn.00406188
push eax
call fcn.004080e7
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x401d03
push str.Could_not_allocate_buffer_for_TOC.
call fcn.00401860
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [esi + 0x20]
push eax
push 1
push ecx
call fcn.00406188
mov edx, dword [esi + 8]
push eax
push edx
call fcn.00407f74
add esp, 0x10
cmp eax, 1
jae 0x401d36
push str.Could_not_read_from_file.
call fcn.00401860
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x20]
push eax
call fcn.00406188
add eax, dword [esi + 8]
mov ecx, dword [esi]
push ecx
mov dword [esi + 0xc], eax
call fcn.004080bf
add esp, 4
test eax, eax
je 0x401d67
push str.Error_on_file
call fcn.00401860
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x402a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 4]
push esi
push edi
push 0
push eax
call fcn.00406188
mov edi, dword [esp + 0x14]
add eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
call fcn.0040801b
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call fcn.00406188
push eax
call fcn.004080e7
mov esi, eax
add esp, 4
test esi, esi
jne 0x402a50
push str.Could_not_allocate_read_buffer_n
call fcn.004018d0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
push eax
push 1
push ecx
call fcn.00406188
push eax
push esi
call fcn.00407f74
add esp, 0x10
cmp eax, 1
jae 0x402a80
push str.Could_not_read_from_file_n
call fcn.004018d0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
cmp byte [ebp + 0x10], 2
jne 0x402b70
mov eax, dword [0x41c2d8]
test eax, eax
jne 0x402aa6
push 0x414e3c
call dword [0x41c270]
add esp, 4
mov dword [0x41c2d8], eax
push ebx
push eax
call dword [0x41c298]
mov edi, eax
push 0x414e38
push edi
call dword [0x41c29c]
push str.block_size
push edi
mov dword [esp + 0x28], eax
call dword [0x41c29c]
push eax
call dword [0x41c2d0]
mov ebx, eax
push ebx
call fcn.004080e7
push ebx
push 0
push eax
mov dword [esp + 0x40], eax
call fcn.004061d0
mov edx, dword [esp + 0x40]
add esp, 0x28
push ebx
push edx
push str.MODE_CFB
push edi
call dword [0x41c29c]
add esp, 8
push eax
mov eax, dword [esp + 0x20]
push 0x20
push esi
push str.sOs
push eax
call dword [0x41c294]
mov ecx, dword [ebp + 8]
add esp, 0x1c
push ecx
mov edi, eax
call fcn.00406188
sub eax, 0x20
push eax
lea edx, [esi + 0x20]
push edx
push 0x414e14
push str.decrypt
push edi
call dword [0x41c2b0]
mov ebx, eax
mov eax, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.00406188
sub eax, 0x20
push eax
push ebx
call dword [0x41c290]
add esp, 4
push eax
push esi
call fcn.00408620
push edi
call dword [0x41c25c]
push ebx
call dword [0x41c25c]
add esp, 0x14
pop ebx
mov al, byte [ebp + 0x10]
cmp al, 1
je 0x402b7b
cmp al, 2
jne 0x402baa
push ebp
push esi
call fcn.00402910
push esi
mov edi, eax
call fcn.00406e44
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x402baa
add ebp, 0x12
push ebp
push str.Error_decompressing__s_n
call fcn.004018d0
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x402d80
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push ebx
push edi
call fcn.00402a00
add esp, 8
mov dword [esp + 8], eax
call fcn.00402d10
cmp eax, 0xffffffff
jne 0x402da9
pop edi
or eax, eax
pop ebx
pop ecx
ret
push ebp
push esi
lea ebp, [ebx + 0x12]
push ebp
add edi, 0x232
push edi
call fcn.00402bb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x402ddb
push ebp
push str._s_could_not_be_extracted__n
call fcn.00401860
add esp, 8
pop esi
pop ebp
pop edi
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [ebx + 0xc]
push esi
push 1
push eax
call fcn.00406188
mov edi, dword [esp + 0x18]
push eax
push edi
call fcn.00408c76
push esi
call fcn.00408aab
push edi
call fcn.00406e44
add esp, 0x18
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x402ec0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.00408da0
mov eax, dword [0x41b010]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
push edi
push 0x414354
push eax
mov edi, ecx
mov ebx, edx
call fcn.00408430
push ebx
push edi
mov esi, eax
call fcn.00402bb0
add esp, 0x10
xor ebx, ebx
mov edi, eax
test esi, esi
je 0x402fad
test edi, edi
je 0x402fad
push esi
call fcn.00408097
add esp, 4
test eax, eax
jne 0x402f84
mov edi, edi
push esi
push 1
lea eax, [esp + 0x14]
push 0x1000
push eax
call fcn.00407f74
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402f4a
push esi
call fcn.004080bf
add esp, 4
test eax, eax
je 0x402f69
push esi
jmp 0x402f79
push edi
push 1
lea ecx, [esp + 0x14]
push 0x1000
push ecx
call fcn.00408c76
push edi
call fcn.004080bf
add esp, 0x14
test eax, eax
jne 0x402f78
push esi
call fcn.00408097
add esp, 4
test eax, eax
je 0x402f20
jmp 0x402f84
push edi
call fcn.00408d94
add esp, 4
or ebx, 0xffffffff
push esi
call fcn.00408aab
push edi
call fcn.00408aab
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004061bd
add esp, 0x1004
ret
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.004061bd
add esp, 0x1004
ret
Function at 0x4029f4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004040b4
test esi, esi
jne 0x402a2a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004041a4
jmp 0x402a48
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402908
mov edi, eax
test esi, esi
je 0x402a48
cmp dword [ebx], 0
je 0x402a48
dec esi
jmp 0x402a31
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d38
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x51c008], 0x8088405
inc edx
mov dword [ebx + 0x51c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4031b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x51c024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40324c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40322c
xor eax, eax
push ebp
push 0x403225
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403268
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40322c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x51c024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x51c024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x51f04c], 0
je 0x403f79
cmp word [0x51f220], 0xd7b2
jne 0x403f41
cmp dword [0x51f228], 0
jbe 0x403f41
mov eax, 0x51f21c
call dword [0x51f238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x51c070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x51c034], 0
jne 0x403f95
push 0
push 0x51c068
push 0x51c070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40579c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40581f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40581f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059e8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4058a8
xor eax, eax
push ebp
push 0x4058a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004055e4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405886
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405a08
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405886
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058a8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4059c2
cmp byte [ebp - 0xd], 0
jne 0x4058ef
cmp byte [ebp - 0x12], 0
je 0x4059c2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405908
dec ebx
cmp byte [ebx], 0x2e
je 0x405917
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405907
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4059c2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405954
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4059c2
cmp byte [ebp - 0xd], 0
je 0x4059c2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4059c2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret