joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403abd
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
add esi, eax
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esi*4 + 4]
push eax
mov ecx, dword [edi]
mov dword [esp + 0x24], ecx
call fcn.00401127
mov ebp, eax
mov dword [ebx], esi
mov dword [edi], ebp
xor esi, esi
mov edi, dword [esp + 0x1c]
pop ecx
test edi, edi
jle 0x403b23
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x403b1e
cmp byte [eax + 1], 0x4a
jne 0x403b1e
add eax, 2
je 0x403b18
push eax
call fcn.004011b7
pop ecx
mov dword [ebp], eax
add ebp, 4
inc esi
cmp esi, edi
jl 0x403afe
mov ebx, dword [esp + 0x10]
xor eax, eax
test ebx, ebx
jle 0x403b56
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + eax*4]
cmp byte [ecx], 0x2d
jne 0x403b51
cmp byte [ecx + 1], 0x4a
jne 0x403b51
add ecx, 2
cmp byte [ecx], 0
je 0x403c02
mov dword [ebp], ecx
add ebp, 4
inc eax
cmp eax, ebx
jl 0x403b31
xor esi, esi
test edi, edi
jle 0x403b84
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x403b6e
cmp byte [eax + 1], 0x4a
je 0x403b7b
push eax
call fcn.004011b7
mov dword [ebp], eax
add ebp, 4
pop ecx
inc esi
cmp esi, edi
jl 0x403b60
mov ebx, dword [esp + 0x10]
xor esi, esi
test ebx, ebx
jle 0x403bf8
mov eax, dword [esp + 0x20]
mov edi, dword [eax + esi*4]
cmp byte [edi], 0x2d
jne 0x403bed
mov al, byte [edi + 1]
cmp al, 0x4a
je 0x403bf3
cmp byte [0x4319b9], 0
je 0x403bed
cmp al, 0x63
jne 0x403bed
push 0x425518
push edi
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x403bcc
push str._classpath
push edi
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
jne 0x403bed
lea eax, [ebx - 1]
cmp esi, eax
jge 0x403bed
mov eax, dword [esp + 0x20]
mov dword [ebp], edi
push dword [eax + esi*4 + 4]
call fcn.00406a8f
mov dword [ebp + 4], eax
add ebp, 8
pop ecx
inc esi
jmp 0x403bf3
mov dword [ebp], edi
add ebp, 4
inc esi
cmp esi, ebx
jl 0x403b8a
and dword [ebp], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Error:_The__J_option_should_not_be_followed_by_a_space.
call fcn.00405aa8
pop ecx
push 1
call fcn.0040ed64
int3
Function at 0x4042f7
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.00414038
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x40446a
jg 0x404326
test esi, esi
jb 0x40446a
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40446a
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404388
push edi
call fcn.00404879
pop ecx
test eax, eax
je 0x40437f
push ebx
push esi
push edi
push ebp
call fcn.004044bc
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40446f
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.00414038
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x40446a
jg 0x4043b1
cmp ebp, ebx
jb 0x40446a
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043c6
jl 0x4043c0
cmp ebp, ecx
jae 0x4043c6
mov esi, ebp
mov ecx, eax
jmp 0x4043ca
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.00414038
add esp, 0x10
cmp edx, ebx
jl 0x40446a
jg 0x4043f0
cmp eax, ebx
jb 0x40446a
push 0x10015
call fcn.0040ea93
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40446a
push esi
push ebx
push dword [esp + 0x24]
call fcn.00417558
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404463
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40445f
cmp byte [esi], 0x50
jne 0x40445e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40445e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404476
dec esi
cmp esi, ebx
jae 0x40441f
push ebx
call fcn.0040ea78
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a130
push ebx
call fcn.0040ea78
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404879
add esp, 0x14
test eax, eax
je 0x4044b6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.004044bc
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40446f
Function at 0x4044bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, 0x14
push ebx
push esi
push edi
push 0
sbb eax, 0
push eax
push ecx
push dword [ebp + 8]
call fcn.00414038
mov ebx, edx
add esp, 0x10
mov edi, eax
test ebx, ebx
jl 0x40452c
jg 0x4044eb
test edi, edi
jb 0x40452c
mov esi, dword [ebp + 0xc]
push 0x14
push esi
push dword [ebp + 8]
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40452c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x7064b50
jne 0x40452c
mov eax, edi
mov edx, ebx
jmp 0x404531
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4048e9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 4], 0xffffffff
je 0x404a16
cmp dword [esi], 0xffffffff
je 0x404a16
push 0
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp + 8]
call fcn.00414038
add esp, 0x10
test edx, edx
jl 0x404a16
jg 0x40492d
test eax, eax
jb 0x404a16
mov eax, dword [esi + 4]
inc eax
push eax
call fcn.0040ea93
mov edi, eax
pop ecx
test edi, edi
je 0x404a16
mov ebx, dword [esi + 4]
push ebx
push edi
push dword [ebp + 8]
call fcn.00417558
add esp, 0xc
cmp eax, ebx
jne 0x404a0f
cmp dword [esi + 0x10], 0
jne 0x404977
mov ecx, dword [ebp + 0x10]
mov byte [ebx + edi], 0
test ecx, ecx
je 0x404970
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov eax, edi
jmp 0x404a18
cmp dword [esi + 0x10], 8
jne 0x404a0f
xor eax, eax
mov dword [ebp - 0x38], edi
push 0x38
push str.1.2.11
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x34], ebx
call fcn.00408364
add esp, 0x10
test eax, eax
js 0x404a0f
mov eax, dword [esi]
inc eax
push eax
call fcn.0040ea93
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404a0f
mov ecx, dword [esi]
lea eax, [ebp - 0x38]
push 1
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ecx
call fcn.00406d0c
pop ecx
pop ecx
push edi
test eax, eax
jns 0x4049e3
call fcn.0040ea78
push ebx
call fcn.0040ea78
pop ecx
jmp 0x404a15
mov eax, dword [esi]
mov byte [ebx + eax], 0
call fcn.0040ea78
lea eax, [ebp - 0x38]
push eax
call fcn.00408328
pop ecx
pop ecx
test eax, eax
jns 0x404a00
push ebx
jmp 0x404a10
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x404a0b
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, ebx
jmp 0x404a18
push edi
call fcn.0040ea78
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c34
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
push ebx
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 0x10000
push dword [esp + 0x28]
mov dword [esp + 0x14], ebx
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.004144e6
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x404c80
lea eax, [esp + 0xc]
push eax
push ebx
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.004144e6
add esp, 0x18
mov esi, eax
cmp dword [0x431020], ebx
je 0x404d29
push ebp
push edi
push str.J2D_D3D
call fcn.0040e884
mov ebp, str.false
pop ecx
test eax, eax
je 0x404cb5
push ebp
push eax
call fcn.00416377
neg eax
pop ecx
sbb eax, eax
and dword [0x431020], eax
pop ecx
push str.J2D_D3D_PRELOAD
call fcn.0040e884
mov edi, eax
pop ecx
test edi, edi
je 0x404ce3
push ebp
push edi
call fcn.00416377
pop ecx
pop ecx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [0x431020]
mov dword [0x431020], ecx
jmp 0x404ce9
mov ecx, dword [0x431020]
test ecx, ecx
jns 0x404d1a
mov dword [0x431020], ebx
test edi, edi
je 0x404d27
push str.true
push edi
call fcn.00416377
xor edx, edx
pop ecx
inc edx
test eax, eax
pop ecx
mov ecx, dword [0x431020]
cmove ecx, edx
mov dword [0x431020], ecx
test ecx, ecx
je 0x404d27
push str.preloadD3D
call fcn.00404ae5
pop ecx
pop edi
pop ebp
test esi, esi
je 0x404d4b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404d57
push dword [esp + 0x20]
call dword [esp + 0x18]
mov dword [esp + 8], eax
cmp dword [0x431a10], 0
pop esi
pop ebx
je 0x404d6d
mov eax, dword [0x431a2c]
test eax, eax
je 0x404d6d
call eax
mov eax, dword [esp]
pop ecx
pop ecx
ret
Function at 0x40505d
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
mov ebp, dword [esp + 0xc]
inc eax
push esi
mov ebx, dword [ebx]
mov esi, eax
push edi
push 0x20
pop edi
cmp dword [ebp], eax
jle 0x4050f5
push str._J_d64
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050e3
push str._d64
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050e3
push str._J_d32
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050df
push str._d32
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050df
call fcn.00401d51
test al, al
je 0x4050d5
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x4050e6
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x4050ec
jmp 0x4050e6
push 0x20
jmp 0x4050e5
push 0x40
pop edi
inc esi
cmp esi, dword [ebp]
jl 0x405078
cmp edi, 0x20
jne 0x405256
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004056c3
pop ecx
pop ecx
test al, al
jne 0x40511a
push str.Error:_Could_not_find_Java_SE_Runtime_Environment.
call fcn.00405aa8
pop ecx
push 2
jmp 0x405265
mov eax, 0x426344
push eax
push str.i386
push eax
push eax
push dword [esp + 0x2c]
push str._s_slib_s_s_sjvm.cfg
push dword [esp + 0x48]
push dword [esp + 0x48]
call fcn.00405c8b
push 0
push dword [esp + 0x50]
call fcn.00402e39
add esp, 0x28
cmp eax, 1
jge 0x40515f
push str.Error:_no_known_VMs.__check_for_corrupt_jvm.cfg_file_
call fcn.00405aa8
jmp 0x405262
mov ebx, dword [esp + 0x18]
push 0
push ebx
push ebp
call fcn.004017b8
mov esi, eax
push str.ERROR
push esi
call fcn.00413d40
add esp, 0x14
test eax, eax
jne 0x405192
push str.Error:_could_not_determine_JVM_type.
call fcn.00405aa8
pop ecx
push 4
jmp 0x405265
push dword [esp + 0x28]
mov edi, dword [esp + 0x28]
push edi
push esi
push dword [esp + 0x28]
mov byte [edi], 0
call fcn.004057bf
add esp, 0x10
test al, al
jne 0x4051c0
push edi
push esi
push str.Error:_missing___s_JVM_at___s._nPlease_install_or_use_the_JRE_or_JDK_that_contains_these_missing_components.
call fcn.00405aa8
add esp, 0xc
jmp 0x40518b
mov edi, dword [ebx]
xor esi, esi
cmp dword [ebp], esi
jle 0x405251
mov ecx, dword [0x431020]
test ecx, ecx
jns 0x4051fc
push dword [edi + esi*4]
push str._Dsun.awt.warmup
call fcn.00405681
xor ebx, ebx
pop ecx
inc ebx
pop ecx
mov ecx, dword [0x431020]
cmp eax, ebx
cmove ecx, ebx
mov dword [0x431020], ecx
jmp 0x4051ff
xor ebx, ebx
inc ebx
test ecx, ecx
je 0x405242
push dword [edi + esi*4]
push str._Dsun.java2d.noddraw
call fcn.00405681
pop ecx
pop ecx
cmp eax, ebx
je 0x40524a
push dword [edi + esi*4]
push str._Dsun.java2d.d3d
call fcn.00405681
pop ecx
pop ecx
test eax, eax
je 0x40524a
push dword [edi + esi*4]
push str._Dsun.java2d.opengl
call fcn.00405681
pop ecx
pop ecx
cmp eax, ebx
je 0x40524a
mov ecx, dword [0x431020]
inc esi
cmp esi, dword [ebp]
jl 0x4051d3
jmp 0x405251
and dword [0x431020], 0
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push str.Error:_This_Java_instance_does_not_support_a__d_bit_JVM._nPlease_install_the_desired_version.
call fcn.00405aa8
pop ecx
pop ecx
push 1
call fcn.0040ed64
int3
Function at 0x405f5b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x120]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
push edi
push 0x104
mov dword [esp + 0x18], eax
xor edi, edi
lea eax, [esp + 0x20]
xor esi, esi
push eax
push edi
push ebx
call ebp
test eax, eax
jne 0x40602e
mov eax, dword [esp + 0x14]
inc esi
push dword [eax + 8]
lea eax, [esp + 0x20]
push eax
call fcn.00406371
pop ecx
pop ecx
test eax, eax
je 0x405fe6
test edi, edi
je 0x405fd9
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.004063e4
pop ecx
pop ecx
test eax, eax
jle 0x405fe6
push edi
call fcn.00401149
pop ecx
lea eax, [esp + 0x1c]
push eax
call fcn.004011b7
pop ecx
mov edi, eax
push 0x104
lea eax, [esp + 0x20]
push eax
push esi
push ebx
call ebp
test eax, eax
je 0x405fa5
test edi, edi
je 0x40602e
lea eax, [esp + 0x10]
xor ebp, ebp
push eax
push 0x20019
push ebp
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov esi, eax
call fcn.00401149
pop ecx
test esi, esi
je 0x406049
cmp dword [esp + 0x10], ebp
je 0x40602e
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004097a8
add esp, 0x114
ret
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x104
push eax
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push str.JavaHome
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40601e
cmp dword [esp + 0x10], ebp
je 0x406080
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x1c]
push eax
call fcn.004011b7
pop ecx
jmp 0x406030
Function at 0x406af2
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push ecx
push ebx
push esi
push 0x10
call fcn.004069ad
mov esi, eax
push 8
mov dword [esp + 0x10], esi
call fcn.00401127
pop ecx
pop ecx
push 0x431a38
push dword [esp + 0x18]
mov ebx, eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x406b3b
push ebx
call fcn.00401149
push esi
call fcn.004068fd
pop ecx
pop ecx
xor eax, eax
jmp 0x406c3a
push ebp
mov dword [ebx], eax
mov dword [ebx + 4], 0x431a64
push edi
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x406b53
and dword [ebx + 4], 0
jmp 0x406b6c
push 0x431a38
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebp, eax
neg ebp
sbb ebp, ebp
and ebp, 0x431a64
test ebp, ebp
je 0x406c1e
push ebp
call fcn.0040e970
pop ecx
cmp eax, 4
jl 0x406b46
cmp byte [eax + ebp - 4], 0x2e
jne 0x406b46
lea edi, [eax - 3]
add edi, ebp
push 0x426a78
push edi
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x406bae
push 0x426a7c
push edi
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
jne 0x406b46
push 0x3b
push ebp
call fcn.0040bd30
pop ecx
pop ecx
test eax, eax
jne 0x406b46
push dword [esp + 0x1c]
call fcn.0040e970
push ebp
mov edi, eax
call fcn.0040e970
mov esi, eax
lea ecx, [esi + edi]
push ecx
call fcn.00401127
lea ecx, [edi - 1]
mov ebx, eax
push ecx
push dword [esp + 0x2c]
push ebx
call fcn.0040a130
lea ecx, [esi + 1]
push ecx
lea eax, [edi - 1]
add eax, ebx
push ebp
push eax
call fcn.0040a130
mov esi, dword [esp + 0x34]
mov eax, dword [esi + 4]
inc eax
push eax
push esi
call fcn.004067c9
mov ecx, dword [esi + 4]
add esp, 0x2c
mov eax, dword [esi]
mov dword [eax + ecx*4], ebx
inc dword [esi + 4]
mov ebx, dword [esp + 0x14]
jmp 0x406b46
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebx + 4]
call fcn.00401149
push ebx
call fcn.00401149
pop ecx
pop ecx
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
pop ecx
pop ecx
ret
Function at 0x41c465
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041bfb8

Function at 0x421244
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004210ba
Function at 0x4011e0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, edx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40123c
push str.____Error_while_opening_inputFile_n
call fcn.00401040
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00401c4a
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0x2000000
push 2
push 0
push 2
push 0x40000000
push ebx
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x40128c
push str.____Error_while_opening_outputFile_n
call fcn.00401040
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00401c4a
mov esp, ebp
pop ebp
ret
push dword [esp + 0x10]
call fcn.00401c9e
add esp, 4
mov ebx, eax
lea eax, [esp + 0x1c]
push 0
push eax
push dword [esp + 0x18]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4012e7
push str.____Error_while_reading_inputFile_n
call fcn.00401040
add esp, 4
push ebx
call fcn.00401c5b
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00401c4a
mov esp, ebp
pop ebp
ret
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401305
push str.____Error_while_writing_into_outputFile_n
jmp 0x4012b6
push ebx
call fcn.00401c5b
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401c4a
mov esp, ebp
pop ebp
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x404c40
Capabilities:
Get geographical location

Disassembly:
out dx, eax
sbb eax, 0x315f06e0
sti
mov edx, 0x58a21f76
xor ebx, edx
pop esi
xor ebx, esi
xor ebx, ecx
call dword [ebx]
mov edx, 0x20756722
xor edx, 0x217e7722
push 0x79381ca3
mov ebx, 0x33285fe7
pop ecx
xor ebx, ecx
xor edx, ebx
add esp, 0xfffffffc
mov ecx, esp
mov dword [ecx], edx
mov ecx, 0x78a4c033
xor ecx, 0x4560bfaf
push ecx
push 0x305d979
mov edi, 0x75daf5b1
pop ecx
xor edi, ecx
pop ebx
xor edi, ebx
pop esi
xor edi, esi
test dword [ecx], 0xfcc483fc

Function at 0x404c94
Capabilities:
Get geographical location

Disassembly:
test dword [ecx], 0xfcc483fc
mov ecx, esp
mov dword [ecx], eax
pop ebx
mov esi, ebx
add esp, 0xfffffffc
mov dword [esp], esi
pop edi
test edi, edi
je 0x40523c
push 0x1ffca72d
mov ecx, 0x1ffca729
pop edx
xor ecx, edx
sub esp, ecx
mov ebx, 0

Function at 0x404cc4
Capabilities:
Get geographical location

Disassembly:
mov esi, 0
xor ebx, esi
xor ebx, esp
mov dword [ebx], eax
mov ebx, 0x100eaf53
mov edi, 0x1edddac0
xor edi, ebx
mov ecx, edi
stc

Function at 0x404d14
Capabilities:
Get geographical location

Disassembly:
stc
xor ecx, 0xffffffff
and ecx, 0x5c0b89d
and edi, 0xfa3f4762
or edi, ecx
add esp, 0xfffffffc
mov edx, esp
mov dword [edx], edi
push 0x2acf00d
mov esi, 0x116bc91d
pop edx
xor esi, edx
mov ecx, 0x52d4c62d
xor esi, ecx
pop eax
xor esi, eax
mov ebx, esi
mov ecx, 4
add byte [eax], al
sub esp, ecx
mov dword [esp], ebx
mov ebx, 0x9230464
mov ecx, 0x44d44a00
xor ebx, ecx
push ebx
mov edi, 0x7606ca4c
xor edi, 0x696b40a4
pop eax
xor edi, eax
push 0x299097a0
mov esi, 0x96f2059
pop eax
xor esi, eax
xor edi, esi
mov edx, 0xfffffffc
add esp, edx
mov eax, esp
mov ecx, eax
mov dword [ecx], edi
mov edi, esp
mov esi, 0x3202cff1
mov edx, 0xcdfd300d
xor edx, esi
add esp, edx
mov dword [esp], edi
mov edi, 0x4f14897c
adc al, 0x4f
xor edi, 0x44419de2
mov ecx, 0x195ece4c
xor edi, ecx
xor edi, 0x120b4a56
mov ebx, 0x490b1880
mov ecx, 0x22040401
xor ebx, ecx
mov edx, ebx
xor edx, 0xffffffff
and edx, 0x6b4f5d99
and ebx, 0x94b0a266
or ebx, edx
xor edi, ebx
call dword [edi]
push 0x7c018ea0
mov edx, 0x64d08cb
pop esi
xor edx, esi
push 0x49e15d0f
mov ebx, 0x33addb6c
pop ecx
invalid
Function at 0x405194
Capabilities:
Get geographical location

Disassembly:
mov ebx, eax
push ebx
call edi
pop edx
pop ecx
mov esi, ecx
mov edi, esi
add esp, 0xfffffffc
mov dword [esp], edi
mov edi, 0x6c1eacf0
mov ebx, 0x6c1eacf0
xor ebx, edi
xor ebx, ecx
add ebx, 0
je 0x40522f
pop esi
pop ecx
mov edx, esi
mov edi, edx
add esp, 0xfffffffc
mov ebx, esp
mov dword [ebx], edi
call ecx
pop ebx
xor ecx, ecx
add ecx, eax
sub ecx, ebx
and ecx, 0xffff8000
push 0x4e6b1a93
mov esi, 0x4e6b1a93
pop edx
xor esi, edx
xor esi, ecx
or esi, esi
je 0x405236
mov edx, 0x3d2c01c0
xor edx, 0xd0cccf0
push edx
push 0x2700c149
mov eax, 0xa18070d
pop edi
xor eax, edi
pop ebx
xor eax, ebx
add esp, 0xfffffffc
invalid
cld
mov edx, esp
mov dword [edx], eax
mov edx, 0x4206800
mov edi, 0x3104020a
xor edx, edi
mov esi, 0x2801420
mov eax, 0x80410040
xor esi, eax
xor edx, esi
mov edi, edx
push edi
pop esi
pop esi
jmp 0x40523c
nop
jmp 0x40523d
ret
mov ebx, 0x6d0b6473
xor ebx, 0x1d759c6b
mov ecx, 0x1a224b64
xor ebx, ecx
xor ebx, 0x6a1cd2b2
call ebx
rcl byte [ebx + 0x56], 0x57
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret