joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403257
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
sub ebx, dword [0x41d870]
mov edi, eax
add ebx, dword [0x41d880]
call sub.KERNEL32.dll_GetTickCount
add eax, 0x1f4
test ebx, ebx
mov dword [0x440cf8], eax
jle 0x4033e4
sub esp, 0xc
push dword [0x41d890]
call fcn.00403124
add esp, 0xc
push 0
push 0
push dword [0x41d870]
push dword [0x409014]
call sub.KERNEL32.dll_SetFilePointer
mov dword [0x41d8b0], ebx
mov dword [0x41d8c0], 0
mov esi, dword [0x41d8a0]
sub esi, dword [0x41d890]
cmp esi, 0x4000
jle 0x4032d6
mov esi, 0x4000
push eax
push eax
push esi
push 0x41d960
call fcn.00403140
pop ecx
test eax, eax
pop ebx
jne 0x4032f1
or eax, 0xffffffff
jmp 0x403401
add dword [0x41d890], esi
mov dword [0x41d8e8], 0x41d960
mov dword [0x41d8ec], esi
cmp dword [0x440ca8], 0
je 0x403340
cmp dword [0x440c68], 0
jne 0x403340
mov edx, edi
sub esp, 0xc
sub edx, dword [0x41d870]
mov eax, dword [0x41d8b0]
add edx, dword [0x41d880]
push 0
sub eax, edx
mov dword [0x41d8c0], eax
call fcn.0040319b
add esp, 0x10
mov ecx, 0x41d8d0
mov dword [0x41d8f0], 0x421960
mov dword [0x41d8f4], 0x8000
call fcn.00406ff1
test eax, eax
js 0x4033f5
mov eax, dword [0x41d8f0]
mov ebx, eax
sub ebx, 0x421960
je 0x4033af
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push ebx
push 0x421960
push dword [0x409014]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x4033fc
cmp ebx, dword [ebp - 0x10]
jne 0x4033fc
add dword [0x41d870], ebx
cmp dword [0x41d8ec], 0
je 0x4033bc
jmp 0x403307
cmp dword [0x41d8ec], 0
jne 0x4033f5
test esi, esi
je 0x4033f5
mov edx, dword [0x41d880]
mov eax, edx
sub eax, dword [0x41d870]
add eax, edi
test eax, eax
jg 0x4032bd
push 0
push 0
push edx
push dword [0x409014]
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0xc
push 1
call fcn.0040319b
xor eax, eax
add esp, 0x10
jmp 0x403401
mov eax, 0xfffffffd
jmp 0x403401
mov eax, 0xfffffffe
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403409
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test eax, eax
js 0x403437
add eax, dword [0x440cf0]
push 0
push 0
push eax
push dword [0x409014]
mov dword [0x41d880], eax
call sub.KERNEL32.dll_SetFilePointer
mov eax, 4
call fcn.00403257
mov ebx, eax
test eax, eax
js 0x403549
sub esp, 0xc
lea eax, [ebp - 0x14]
lea esi, [ebp - 0x10]
push 0
push esi
push 4
push eax
push dword [0x409014]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40353d
cmp dword [ebp - 0x10], 4
jne 0x40353d
mov eax, dword [ebp - 0x14]
add dword [0x41d880], 4
call fcn.00403257
mov ebx, eax
test eax, eax
js 0x403549
test edi, edi
je 0x4034fd
jmp 0x403509
mov esi, eax
cmp eax, 0x4000
jle 0x4034a7
mov esi, 0x4000
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push esi
push 0x41d960
push dword [0x409014]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40353d
cmp esi, dword [ebp - 0x10]
jne 0x40353d
sub esp, 0xc
push 0
push edi
push esi
push 0x41d960
push dword [ebp + 0xc]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x403544
cmp dword [ebp - 0x18], esi
jne 0x403544
mov eax, dword [ebp - 0x10]
sub dword [ebp - 0x14], eax
add ebx, eax
add dword [0x41d880], eax
jmp 0x403500
lea edi, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test eax, eax
jg 0x403499
jmp 0x403549
sub esp, 0xc
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push 0
push eax
mov eax, dword [ebp + 0x14]
cmp eax, edx
jle 0x40351e
mov eax, edx
push eax
push edi
push dword [0x409014]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40353d
mov ebx, dword [ebp - 0x10]
add dword [0x41d880], ebx
jmp 0x403549
mov ebx, 0xfffffffd
jmp 0x403549
mov ebx, 0xfffffffe
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x403959
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x47d000
call fcn.0040636a
push 0x47d000
call fcn.00406120
xor edx, edx
add esp, 0xc
test eax, eax
je 0x4039ac
sub esp, 0xc
push 0x47d000
call fcn.00406467
sub esp, 0xc
push 0
push 0x47d000
call sub.KERNEL32.dll_CreateDirectoryA
push 0x47d000
push 0x47b000
call fcn.00406816
mov edx, eax
add esp, 0x18
mov eax, edx
leave
ret
Function at 0x4064db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 8]
mov byte [ebx], 0
push edx
cmp dword [ebp + 0x18], 1
sbb eax, eax
xor al, al
add eax, 0x20119
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x406554
push eax
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x2000
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
test eax, eax
pop ecx
jne 0x40653c
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
jbe 0x40653f
mov byte [ebx], 0
mov byte [ebx + 0x1fff], 0
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x406816
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, 0x64
mov esi, dword [ebp + 8]
jmp 0x40685b
mov dword [ebp - 0x10], 0x61736e
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov edx, 0x1a
push esi
mov ecx, edx
xor edx, edx
div ecx
lea eax, [ebp - 0x10]
push 0
push eax
add ebx, edx
push dword [ebp + 0xc]
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x406866
dec edi
cmp edi, 0xffffffff
jne 0x406829
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x406872
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
push dword [ebp + 8]
push 0x43c7b8
call fcn.004064a4
push ecx
push 0x43c7b8
call fcn.00406301
add esp, 0xc
mov ebx, eax
test eax, eax
je 0x406927
sub esp, 0xc
push eax
call fcn.0040636a
add esp, 0xc
cmp byte [0x440d08], 0
jns 0x4068ea
mov al, byte [ebx]
test al, al
je 0x406927
cmp al, 0x5c
jne 0x4068ea
jmp 0x406927
sub esp, 0xc
push 0x43c7b8
call fcn.004062a2
add esp, 0xc
test eax, eax
je 0x4068d8
test byte [eax], 0x10
je 0x406927
sub esp, 0xc
push 0x43c7b8
call fcn.00406432
add esp, 0xc
jmp 0x4068f0
sub ebx, 0x43c7b8
sub esp, 0xc
push 0x43c7b8
call fcn.00406429
add esp, 0xc
cmp eax, ebx
jg 0x4068bf
sub esp, 0xc
push 0x43c7b8
call fcn.00406467
push 0x43c7b8
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x406929
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x406930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
cmp eax, 0xffffffff
pop ecx
setne dl
neg edx
and edx, eax
push 0
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x406968
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x40698e
and eax, 0xfffffffe
push edx
push edx
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop eax
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4069fb
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 1
call fcn.00406253
add esp, 0xc
test eax, eax
je 0x406a28
push edx
push 5
push ebx
push esi
call eax
pop edi
test eax, eax
jne 0x406bee
mov dword [0x43bbb8], 0x4c554e
test ebx, ebx
je 0x406a71
push ecx
push 1
push 0
push ebx
call fcn.00406930
push edx
push edx
push eax
call sub.KERNEL32.dll_CloseHandle
push eax
push eax
push 0x400
push 0x43bbb8
push ebx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0x14
test eax, eax
je 0x406bf4
cmp eax, 0x400
jg 0x406bf4
push eax
push 0x400
push 0x43bfb8
push esi
call sub.KERNEL32.dll_GetShortPathNameA
pop edi
test eax, eax
je 0x406bf4
cmp eax, 0x400
jg 0x406bf4
push 0x43bfb8
push 0x43bbb8
push str._s_s_r_n
push 0x43c3b8
call sub.USER32.dll_wsprintfA
pop ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x440ca8]
pop esi
push dword [eax + 0x128]
push 0x43bfb8
call fcn.0040655b
sub esp, 0xc
push 4
push 0xc0000000
push 0x43bfb8
call fcn.00406930
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x406bee
push ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, dword [ebp - 0x24]
mov ebx, eax
lea eax, [eax + edx + 0xa]
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
pop eax
test esi, esi
pop edx
je 0x406be0
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push ebx
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x406be0
cmp ebx, dword [ebp - 0x10]
jne 0x406be0
push edi
push edi
push str._Rename__r_n
push esi
call fcn.00406995
pop edx
test eax, eax
pop ecx
jne 0x406b66
push eax
push eax
lea eax, [esi + ebx]
push str._Rename__r_n
push eax
call fcn.004064a4
add ebx, 0xa
pop ecx
mov eax, ebx
pop edi
jmp 0x406b9f
add eax, 0xa
push edx
push edx
push 0x40a3ef
push eax
call fcn.00406995
mov edx, eax
pop edi
test edx, edx
pop eax
mov eax, ebx
je 0x406b9f
lea ecx, [edx + 1]
lea edi, [esi + ebx]
mov edx, ecx
mov dword [ebp - 0x28], edi
jmp 0x406b96
mov edi, dword [ebp - 0x24]
mov al, byte [edx]
mov byte [edi + edx], al
inc edx
cmp edx, dword [ebp - 0x28]
jb 0x406b8d
mov eax, ecx
sub eax, esi
push dword [ebp - 0x24]
lea eax, [esi + eax]
push 0x43c3b8
push eax
call fcn.0040614f
push 0
push 0
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x24]
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebx + edx]
push eax
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc dword [0x440c58]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x406efe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x4407b8], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x4407b8
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.dll_CreateProcessA
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x406f46
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x406f4c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x44080c], 0
push ebx
mov esi, dword [ebp + 0x10]
jne 0x406f89
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
cmp ecx, 8
jne 0x406f63
mov dword [ebx*4 + 0x440808], edx
inc ebx
cmp ebx, 0x100
jne 0x406f5f
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
not edx
jmp 0x406fa5
mov al, byte [ecx - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x440808]
dec esi
inc ecx
cmp esi, 0xffffffff
jne 0x406f93
not edx
mov eax, edx
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc

Function at 0x7b9df0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3b4000]
push edi
or ebp, 0xffffffff
jmp 0x7b9e12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7b9e19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7b9e08
mov eax, 1
add ebx, ebx
jne 0x7b9e2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7b9e3c
jne 0x7b9e4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7b9e4c
dec eax
add ebx, ebx
jne 0x7b9e48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7b9e20
xor ecx, ecx
sub eax, 3
jb 0x7b9e64
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7b9ed6
sar eax, 1
mov ebp, eax
jmp 0x7b9e6f
add ebx, ebx
jne 0x7b9e6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x7b9e7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x7b9ea0
inc ecx
add ebx, ebx
jne 0x7b9e8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7b9e81
jne 0x7b9e9d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7b9e81
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7b9ec0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7b9eb1
jmp 0x7b9e0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7b9ec0
add edi, ecx
jmp 0x7b9e0e
pop esi
mov edi, esi
mov ecx, 0x23b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7b9ede
cmp byte [edi], 1
jne 0x7b9ede
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x7b9ee3
lea edi, [esi + 0x3b7000]
mov eax, dword [edi]
or eax, eax
je 0x7b9f5b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3bf6bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3bf770]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7b9f10
mov ecx, edi
jns 0x7b9f3f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3bf774]
or eax, eax
je 0x7b9f55
mov dword [ebx], eax
add ebx, 4
jmp 0x7b9f2d
call dword [esi + 0x3bf778]
popal
jmp 0x403187
Function at 0x4278f4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x427931
cmp dword [ebp + 0x14], edi
je 0x427931
cmp ecx, edi
jne 0x427938
call fcn.0042652b
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0042970b
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x42794c
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x42796d
cmp ebx, 0xffffffff
je 0x42795c
push ebx
push edi
push ecx
call fcn.00424580
add esp, 0xc
cmp esi, edi
je 0x427919
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x427919
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x427989
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x427990
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x427a81
test word [esi + 0xc], 0x10c
je 0x4279e4
mov eax, dword [esi + 4]
test eax, eax
je 0x4279e4
jl 0x427ae2
cmp ebx, eax
mov edi, ebx
jb 0x4279b5
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x427a89
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004231dc
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x427a79
cmp ebx, dword [ebp - 0xc]
jb 0x427a51
cmp dword [ebp - 0xc], 0
je 0x427a0e
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x427a03
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x427a0a
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x427a19
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x427a19
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x427ab5
push eax
push dword [ebp - 8]
push esi
call fcn.00427549
pop ecx
push eax
call fcn.00430f8d
add esp, 0xc
test eax, eax
je 0x427af4
cmp eax, 0xffffffff
je 0x427ae2
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x427a79
push esi
call fcn.004308ac
cmp eax, 0xffffffff
pop ecx
je 0x427ae6
cmp dword [ebp - 4], 0
je 0x427ab5
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x427998
mov eax, dword [ebp + 0x14]
jmp 0x427933
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x427aa0
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00424580
add esp, 0xc
call fcn.0042652b
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x427929
cmp dword [ebp + 0xc], 0xffffffff
je 0x427acb
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00424580
add esp, 0xc
call fcn.0042652b
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x427929
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x427933
or dword [esi + 0xc], 0x10
jmp 0x427ae6
Function at 0x4029a0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029dd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029fd
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004046d0
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402bd4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404460
test esi, esi
jne 0x402c0a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404550
jmp 0x402c28
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402ae8
mov edi, eax
test esi, esi
je 0x402c28
cmp dword [ebx], 0
je 0x402c28
dec esi
jmp 0x402c11
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f10
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x507008], 0x8088405
inc edx
mov dword [ebx + 0x507008], edx
fld qword [ebx + 0x507068]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x4033fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x507024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403494
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403474
xor eax, eax
push ebp
push 0x40346d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4034b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403474
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x507024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x507024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404240
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50e04c], 0
je 0x4042a1
cmp word [0x50e220], 0xd7b2
jne 0x404269
cmp dword [0x50e228], 0
jbe 0x404269
mov eax, 0x50e21c
call dword [0x50e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x507078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042c8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x507034], 0
jne 0x4042bd
push 0
push 0x507070
push 0x507078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404414
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040278c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x50e04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4043dc
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40669c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406702
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004046d0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402f38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4066ec
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406709
lea eax, [ebp - 0x10]
call fcn.00404460
ret

Function at 0x4094dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404920
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4094f5
test al, 0x10
jne 0x4094f9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4096a4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404920
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x4096c6
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c594
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c5cd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404550
jmp 0x40c5d6
mov eax, ebx
mov edx, esi
call fcn.004044b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c5e0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c601
mov al, byte [esp]
jmp 0x40c603
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret