joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536b8c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406730
xor eax, eax
push ebp
push 0x536cda
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.00536a54
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004067d4
push eax
call fcn.004094ac
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x536cb9
xor eax, eax
push ebp
push 0x536cb2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.004094c4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x536c9b
xor eax, eax
push ebp
push 0x536c94
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call fcn.00409948
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x536c7d
xor eax, eax
push ebp
push 0x536c76
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.004096e4
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.00536a8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536c7d
mov eax, dword [ebp - 0x14]
push eax
call fcn.00409a60
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536c9b
mov eax, dword [ebp - 0x10]
push eax
call fcn.00409474
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536cb9
mov eax, dword [ebp - 0xc]
push eax
call fcn.00409474
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.00536b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536ce1
lea eax, [ebp - 4]
call fcn.00406738
ret

Function at 0x536e74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.00406748
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call fcn.0042fa28
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406948
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x536ebc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call fcn.004097f0
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406948
add esp, 0x200
pop ebx
ret

Function at 0x536eec
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call fcn.00409810
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406948
add esp, 0x200
pop ebx
ret

Function at 0x536f18
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call fcn.00409878
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406948
add esp, 0x200
pop ebx
ret
Function at 0x5372b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53736f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x20a]
push eax
push esi
call fcn.0042fa28
lea eax, [ebx + 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406948
push 0
push 0x1a
lea eax, [ebp - 0x20a]
push eax
push esi
call fcn.0042fa28
lea eax, [ebx + 4]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406948
lea edx, [ebp - 0x214]
xor eax, eax
call fcn.004034e8
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.0045dd70
mov edx, dword [ebp - 0x210]
lea eax, [ebx + 0xc]
call fcn.00406748
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537376
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00406740
ret
Function at 0x539474
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x42f548]
call fcn.00407100
xor eax, eax
push ebp
push 0x539635
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5871d8], 0
jne 0x5394c8
mov ecx, dword [0x588110]
mov dl, 1
mov eax, dword [0x45ae34]
call fcn.00463f34
call fcn.004050b0
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403ba0
mov eax, ebx
call fcn.00406578
mov dword [ebp - 0x28], eax
push esi
mov esi, 0x539644
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.004087cc
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
test eax, eax
je 0x53950f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x5395db
mov dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00409674
test eax, eax
je 0x5395c7
lea eax, [ebp - 4]
lea edx, [ebp - 0x5c]
mov ecx, 0x10
call fcn.00406948
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004069b0
mov eax, dword [ebp - 4]
test eax, eax
je 0x53956a
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x53956a
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405a78
mov ebx, eax
test ebx, ebx
je 0x539575
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x539592
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x539592
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov edi, eax
test edi, edi
je 0x53959d
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.004067d4
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.004067d4
push eax
push 1
push 0x400
call fcn.0040947c
sub eax, 2
test eax, eax
sete al
jmp 0x5395c9
xor eax, eax
test al, al
je 0x5395d4
mov ebx, 0x15
jmp 0x5395e0
mov ebx, 0x10
jmp 0x5395e0
mov ebx, 0x15
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push esi
call dword [0x5871d8]
call fcn.005392e0
mov eax, dword [ebp - 0xc]
call fcn.005392e0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.004087e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53963c
lea eax, [ebp - 0x14]
mov edx, dword [0x42f548]
call fcn.004071d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406740
ret
Function at 0x557a6c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x557a9a
mov eax, ebx
call fcn.00558520
cmp dword [ebx + 0x40], 0
je 0x557a93
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x557b0b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x557afd
cmp dword [ebx + 8], 0
je 0x557abc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x557ace
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x557afd
cmp dword [ebx + 8], 0
je 0x557aaf
cmp eax, 3
je 0x557ae1
dec eax
jne 0x557aaf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x557aaf
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x557aaf
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x557b29
cmp dword [ebx + 0x14], 0xcc
je 0x557b29
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00557b34
pop ebx
ret

Function at 0x56a51c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5904c8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x56a53e
shr eax, 1
xor eax, 0xedb88320
jmp 0x56a540
shr eax, 1
dec edx
jne 0x56a52c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x56a525
mov byte [0x5908c8], 1
pop esi
pop ebx
ret

Function at 0x56a55c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5908c8], 0
jne 0x56a573
call fcn.0056a51c
mov eax, edi
dec eax
test eax, eax
jl 0x56a59b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5904c8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x56a57d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x56d350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x56d3ea.0
jmp dword [ecx*4 + 0x56d383]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x56d3b5
sub dl, 8
je 0x56d3c4
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d01c
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d070
jmp case.0x56d3ea.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x56d3ea.0
movzx ecx, byte [ecx + 0x56d3f1]
jmp dword [ecx*4 + 0x56d402]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d110
jmp case.0x56d3ea.0
cmp dl, 3
jne 0x56d42f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d168
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d124
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d1ac
jmp case.0x56d3ea.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x56d45a
sub dl, 8
je 0x56d466
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d1d8
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d23c
jmp case.0x56d3ea.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x56d485
sub dl, 8
je 0x56d491
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d2ec
jmp case.0x56d3ea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x56d314
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x56d533
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0056c558
test eax, eax
je 0x56d533
mov eax, ebx
call fcn.0056d53c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x56d4cc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x56d53c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x56d56d
dec al
je 0x56d5a8
dec al
je 0x56d5ed
dec al
je 0x56d656
jmp 0x56d6e0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x56d6e0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x56d57d
jmp 0x56d6e0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x56d6e0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x56d5b8
jmp 0x56d6e0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x56d6e0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x56d61c
xor ebp, ebp
jmp 0x56d62c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x56d635
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x56d5fd
jmp 0x56d6e0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x56d6e0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x56d6af
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0056a5a4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x56d66a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x573b2c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406730
xor eax, eax
push ebp
push 0x573ca4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045d964
test al, al
jne 0x573b68
mov word [ebp - 6], 0
jmp 0x573c8e
xor eax, eax
push ebp
push 0x573c87
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x573c61
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x471d30]
call fcn.00477dd0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x573bad
cmp eax, 0x1000
jae 0x573bc7
jmp 0x573baf
jge 0x573bc7
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004051a4
jmp 0x573c8e
lea edx, [ebp - 0x4c]
mov ecx, 0x40
mov eax, dword [ebp - 0xc]
call fcn.00477b48
cmp word [ebp - 0x4c], 0x5a4d
je 0x573bf7
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004051a4
jmp 0x573c8e
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x144]
mov ecx, 0xf8
mov eax, dword [ebp - 0xc]
call fcn.00477b48
cmp dword [ebp - 0x144], 0x4550
je 0x573c38
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004051a4
jmp 0x573c8e
movzx eax, word [ebp - 0x12e]
and ax, 0x2000
cmp ax, 0x2000
jne 0x573c51
mov word [ebp - 6], 2
jmp 0x573c57
mov word [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x573c71
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x573c8e
mov eax, dword [ebp - 0xc]
call fcn.004045f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x573cab
lea eax, [ebp - 4]
call fcn.00406738
ret
Function at 0x574bd4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1424], ecx
mov dword [ebp - 0x1428], ecx
mov dword [ebp - 0x1420], ecx
mov dword [ebp - 0x141c], ecx
mov dword [ebp - 0x1418], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x574e6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1418]
mov ecx, ebx
mov edx, 0x574e8c
call fcn.00406b1c
mov eax, dword [ebp - 0x1418]
call fcn.004067d4
push eax
call fcn.00409980
mov eax, ebx
call fcn.0045d964
test al, al
je 0x574e3c
xor eax, eax
push ebp
push 0x574cac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov ecx, ebx
mov dl, 1
mov eax, dword [0x471d30]
call fcn.00477dd0
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 0x1400
sbb edx, 0
push edx
push eax
mov eax, ebx
call fcn.00477914
lea edx, [ebp - 0x1411]
mov ecx, 0x1400
mov eax, ebx
call fcn.00477b48
mov eax, ebx
call fcn.004045f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x574ce8
lea eax, [ebp - 4]
lea edx, [ebp - 0x1411]
mov ecx, 0x1401
push 0
call fcn.00405be0
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406964
push 0x574ed0
call fcn.00409980
mov edx, dword [ebp - 8]
mov eax, 0x574ee8
call fcn.004070b4
mov ebx, eax
cmp ebx, 1
jl 0x574e3c
push 0x574ef0
call fcn.00409980
mov edx, dword [ebp - 8]
mov eax, 0x574f08
call fcn.004070b4
mov esi, eax
cmp esi, 1
jl 0x574e3c
add ebx, 3
push 0x574f10
call fcn.00409980
cmp esi, ebx
jl 0x574e3c
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
sub ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00406d9c
lea eax, [ebp - 0x1420]
mov ecx, dword [ebp - 0xc]
mov edx, 0x574f28
call fcn.00406b1c
mov eax, dword [ebp - 0x1420]
call fcn.004067d4
push eax
call fcn.00409980
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x574da3
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x574e3c
mov dl, 1
mov eax, dword [0x471ad8]
call fcn.004778bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x574e35
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0x1428]
mov eax, dword [0x58872c]
mov eax, dword [eax]
call fcn.004d04d4
mov eax, dword [ebp - 0x1428]
lea edx, [ebp - 0x1424]
call fcn.0045dd70
lea eax, [ebp - 0x1424]
mov edx, 0x574f44
call fcn.00406a9c
mov eax, dword [ebp - 0x1424]
push eax
call fcn.00467084
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
mov ebx, dword [eax]
call dword [ebx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574e3c
mov eax, dword [ebp - 0x10]
call fcn.004045f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574e76
lea eax, [ebp - 0x1428]
mov edx, 5
call fcn.00406740
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406740
lea eax, [ebp - 4]
call fcn.004058a8
ret
Function at 0x57593c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call fcn.00409830
sub eax, dword [esi]
cmp eax, 0x7530
jb 0x575959
mov bl, 1
call fcn.00409830
mov dword [esi], eax
jmp 0x57595b
xor ebx, ebx
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x576588
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov eax, edi
call fcn.004067d4
mov esi, eax
push esi
call fcn.004096bc
cmp eax, 3
jne 0x5765e0
push esi
call fcn.004096cc
cmp eax, 1
je 0x5765e0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [0x58849c]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jne 0x5765dc
cmp eax, dword [ebp + 8]
jae 0x5765e0
jmp 0x5765de
jge 0x5765e0
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404578
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406d60
test esi, esi
jne 0x4045b0
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406e9c
jmp 0x4045ce
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044bc
mov edi, eax
test esi, esi
je 0x4045ce
cmp dword [ebx], 0
je 0x4045ce
dec esi
jmp 0x4045b7
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404600
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4ac008], 0x8088405
inc edx
mov dword [ebx + 0x4ac008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40628c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4af050], 0
je 0x4062ed
cmp word [0x4af32c], 0xd7b2
jne 0x4062b5
cmp dword [0x4af334], 0
jbe 0x4062b5
mov eax, 0x4af328
call dword [0x4af344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406318
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ac030], 0
jne 0x406309
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406478
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4ac038], 0
je 0x40649e
mov edx, esi
mov eax, ebx
call dword [0x4ac038]
jmp 0x4064ad
mov eax, 8
call fcn.00404204
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4af051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406440
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408b28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408c8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406d60
cmp si, word [0x4ac7e0]
jb 0x408bc2
cmp si, word [0x4ac9e0]
ja 0x408bc2
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408bc2
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4ac7e0]
jae 0x408b9c
mov edi, ebx
dec edi
jmp 0x408bbd
cmp si, word [ebx*8 + 0x4ac7e0]
jbe 0x408bac
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408bbd
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4ac7e4]
call fcn.00408a38
jmp 0x408bc2
cmp edi, dword [ebp - 0xc]
jae 0x408b86
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408c71
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408c71
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406f48
push dword [ebp - 0x164]
push 0x408cac
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406f48
push dword [ebp - 0x168]
push 0x408cbc
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406f48
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00407300
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c96
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406d58
ret