joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444302
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
sete al
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4443d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x444348
cmp eax, 0x50
je 0x444340
cmp eax, 0xb7
jne 0x444348
xor esi, esi
inc esi
jmp 0x4443d9
cmp eax, 3
jne 0x4443cb
movzx eax, word [ebx]
mov edi, esi
mov ecx, ebx
test ax, ax
je 0x4443c4
push 0x5c
pop edx
cmp ax, dx
cmove edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x44435c
test edi, edi
je 0x4443c4
push esi
xor eax, eax
push ebx
mov word [edi], ax
call fcn.0040436e
mov esi, eax
push 0x5c
pop eax
mov word [edi], ax
test esi, esi
js 0x4443d9
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4443d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x4443d9
push esi
push 0x44c
push str.fileutil.cpp
call fcn.00403b3b
jmp 0x4443d9
mov esi, 0x80070003
jmp 0x4443d9
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x444433
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
xor esi, esi
call fcn.00444718
test eax, eax
je 0x4444ba
test byte [ebp - 4], 7
push ebx
mov ebx, 0x80070000
je 0x444488
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x444488
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x444488
push esi
push 0x5bc
jmp 0x4444af
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4444b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x4444b9
push esi
push 0x5c2
push str.fileutil.cpp
call fcn.00403b3b
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4444c3
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
xor eax, eax
mov ebx, esi
inc eax
cmp dword [ebp + 0x10], ebx
cmovne ebx, eax
cmp dword [ebp + 0x14], esi
je 0x4444dd
or ebx, 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4445cc
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [ebp + 0x10], esi
jne 0x444515
cmp edi, 0x50
je 0x44450d
cmp edi, 0xb7
jne 0x444515
xor esi, esi
inc esi
jmp 0x4445cb
cmp edi, 2
jne 0x44452e
push esi
push dword [ebp + 8]
call fcn.00444718
test eax, eax
je 0x4445bd
push 3
pop edi
cmp edi, 3
jne 0x4445bd
mov eax, dword [ebp + 0xc]
mov edi, esi
mov edx, eax
movzx ecx, word [eax]
test cx, cx
je 0x4445b6
mov dword [ebp + 0x10], 0x5c
cmp cx, word [ebp + 0x10]
cmove edi, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x44454d
test edi, edi
je 0x4445b6
push esi
xor ecx, ecx
push eax
mov word [edi], cx
call fcn.0040436e
mov esi, eax
mov eax, dword [ebp + 0x10]
mov word [edi], ax
test esi, esi
js 0x4445cb
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4445cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x4445cb
push esi
push 0x4cc
push str.fileutil.cpp
call fcn.00403b3b
jmp 0x4445cb
mov esi, 0x80070003
jmp 0x4445cb
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x444d35
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x444d8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x444d8a
push esi
push 0x115
push str.fileutil.cpp
call fcn.00403b3b
jmp 0x444e31
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x444da5
mov esi, 0x8007000e
push esi
push 0x119
jmp 0x444d7b
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x444de0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x444de0
push esi
push 0x11d
push str.fileutil.cpp
call fcn.00403b3b
jmp 0x444e2a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x44b790
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x444e17
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x444e17
push esi
push 0x122
jmp 0x444dd4
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [ecx], edx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4450f3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x445139
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x445143
add edi, dword [ebp - 4]
cmp edi, dword [ebp + 0x10]
jb 0x445104
jmp 0x445153
push esi
push 0x3e7
push str.fileutil.cpp
call fcn.00403b3b
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x446042
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push str._ls.R
push edi
call fcn.00402232
mov esi, eax
add esp, 0xc
test esi, esi
js 0x44614e
push 0
push 0x80
push 4
push 0
push 4
push 0xc0000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4460cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0xc1
push str.dlutil.cpp
call fcn.00403b3b
jmp 0x44614e
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x446114
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
je 0x4460fe
cmp ecx, 8
jb 0x4460cf
cmp ecx, 8
je 0x44610a
and dword [ebx], 0
and dword [ebx + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
or edi, 0xffffffff
jmp 0x446142
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0xc8
push str.dlutil.cpp
call fcn.00403b3b
cmp edi, 0xffffffff
je 0x44614e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4465d4
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0
push dword [edi + 4]
push dword [edi]
push dword [ebp + 0xc]
call fcn.00444bd6
mov esi, eax
test esi, esi
js 0x44672a
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4466fb
cmp dword [ebp - 4], 0
je 0x446729
xor ebx, ebx
and dword [ebp + 0x10], ebx
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
sub eax, ebx
push eax
mov eax, dword [ebp + 0x20]
add eax, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4466d5
add ebx, dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
je 0x446659
cmp ebx, dword [ebp - 4]
jb 0x446628
add dword [edi], ebx
push 0
pop eax
adc dword [edi + 4], eax
cmp dword [ebp + 0x14], 0xffffffff
je 0x4466a3
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
mov ebx, eax
mov dword [ebp - 8], eax
call fcn.00444bd6
test eax, eax
js 0x4466a3
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*8]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, dword [ebp - 8]
cmp dword [ebp - 8], 0
je 0x4466a3
cmp ebx, 8
jb 0x44667c
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x4466c9
cmp dword [eax], 0
je 0x4466c9
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.00445f20
mov esi, eax
test esi, esi
js 0x446729
cmp dword [ebp - 4], 0
jne 0x4465fe
jmp 0x446729
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1a6
jmp 0x44671f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x19a
push str.dlutil.cpp
call fcn.00403b3b
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x24
Function at 0x446734
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.004024b5
mov esi, eax
test esi, esi
js 0x44689d
xor eax, eax
push eax
push eax
push eax
push eax
push str.Burn
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x4467c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x84
push str.dlutil.cpp
call fcn.00403b3b
jmp 0x44689d
lea eax, [ebp - 4]
push eax
push 0x78
push str.DownloadTimeout
push str.WiXBurn
call fcn.00445ab8
mov eax, dword [ebp - 4]
test eax, eax
je 0x446810
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445f99
mov esi, eax
test esi, esi
js 0x44689d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call fcn.00446042
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445c96
mov esi, eax
test esi, esi
js 0x44688e
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44688e
xor ecx, ecx
cmp word [eax], cx
je 0x44688e
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x44689d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4468aa
push eax
call fcn.0040296f
test edi, edi
je 0x4468b5
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x4468c3
push dword [ebp - 8]
call fcn.0040296f
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x448c9a
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], 4
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000005
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x448ceb
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x448ceb
push esi
push 0x18
push str.inetutil.cpp
call fcn.00403b3b
jmp 0x448cf7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
and dword [edx + 4], 0
mov dword [edx], ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x448e31
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x246c
call fcn.0044a2e0
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2428], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x241c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2430], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x2420], eax
mov eax, dword [ebp + 0x1c]
push 0x3c
mov dword [ebp - 0x2424], eax
lea eax, [ebp - 0x246c]
push esi
push eax
call fcn.0042f820
add esp, 0xc
mov dword [ebp - 0x246c], 0x3c
cmp dword [ebp - 0x241c], esi
je 0x448ec3
lea eax, [ebp - 0x410]
mov dword [ebp - 0x2458], 0x101
mov dword [ebp - 0x245c], eax
mov ecx, 0x81
cmp dword [ebp - 0x2420], esi
je 0x448ee2
lea eax, [ebp - 0x108]
mov dword [ebp - 0x244c], ecx
mov dword [ebp - 0x2450], eax
cmp dword [ebp - 0x2424], esi
je 0x448efc
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2444], ecx
mov dword [ebp - 0x2448], eax
mov ecx, 0x801
test ebx, ebx
je 0x448f17
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x243c], ecx
mov dword [ebp - 0x2440], eax
test edi, edi
je 0x448f2d
lea eax, [ebp - 0x2418]
mov dword [ebp - 0x2434], ecx
mov dword [ebp - 0x2438], eax
lea eax, [ebp - 0x246c]
push eax
push 0x90000000
push esi
push dword [ebp - 0x2428]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x448f7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x56
push str.uriutil.cpp
call fcn.00403b3b
jmp 0x44903e
mov ecx, dword [ebp - 0x242c]
test ecx, ecx
je 0x448f8c
mov eax, dword [ebp - 0x2460]
mov dword [ecx], eax
mov eax, dword [ebp - 0x241c]
test eax, eax
je 0x448fb2
push dword [ebp - 0x2458]
push dword [ebp - 0x245c]
push eax
call fcn.004024b5
mov esi, eax
test esi, esi
js 0x44903e
mov eax, dword [ebp - 0x2430]
test eax, eax
je 0x448fc6
mov cx, word [ebp - 0x2454]
mov word [eax], cx
mov eax, dword [ebp - 0x2420]
test eax, eax
je 0x448fe8
push dword [ebp - 0x244c]
push dword [ebp - 0x2450]
push eax
call fcn.004024b5
mov esi, eax
test esi, esi
js 0x44903e
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x44900a
push dword [ebp - 0x2444]
push dword [ebp - 0x2448]
push eax
call fcn.004024b5
mov esi, eax
test esi, esi
js 0x44903e
test ebx, ebx
je 0x449026
push dword [ebp - 0x243c]
push dword [ebp - 0x2440]
push ebx
call fcn.004024b5
mov esi, eax
test esi, esi
js 0x44903e
test edi, edi
je 0x44903e
push dword [ebp - 0x2434]
push dword [ebp - 0x2438]
push edi
call fcn.004024b5
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042df6e
mov esp, ebp
pop ebp
ret 0x20
Function at 0x402a3c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402a79
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA_1
push esp
call sub.kernel32.dll_SetCurrentDirectoryA_1
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA_1
test bl, bl
je 0x402a99
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404c80
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402c00
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a10
test esi, esi
jne 0x402c36
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b00
jmp 0x402c54
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402b14
mov edi, eax
test esi, esi
je 0x402c54
cmp dword [ebx], 0
je 0x402c54
dec esi
jmp 0x402c3d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x63e008], 0x8088405
inc edx
mov dword [ebx + 0x63e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40396c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x63e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a04
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4039e4
xor eax, eax
push ebp
push 0x4039dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a20
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4039e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x63e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x63e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4047f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x65004c], 0
je 0x404851
cmp word [0x650220], 0xd7b2
jne 0x404819
cmp dword [0x650228], 0
jbe 0x404819
mov eax, 0x65021c
call dword [0x650238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x63e074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404878
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
pop edx
ret
cmp byte [0x63e034], 0
jne 0x40486d
push 0
push 0x63e06c
push 0x63e074
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x4049c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402860
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x65004d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40498c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread_1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406524
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406754
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x4065a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406754
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x4065a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406770
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x406630
xor eax, eax
push ebp
push 0x406629
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040636c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x40660e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406790
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x40660e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406630
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40674a
cmp byte [ebp - 0xd], 0
jne 0x406677
cmp byte [ebp - 0x12], 0
je 0x40674a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406690
dec ebx
cmp byte [ebx], 0x2e
je 0x40669f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40668f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40674a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4066dc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40674a
cmp byte [ebp - 0xd], 0
je 0x40674a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40674a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret