joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443bf0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x443c0c
cmp dword [esi + 4], 0
je 0x443c39
test byte [ebx + 0x55], 1
jne 0x443c2b
mov eax, ebx
call fcn.00442044
test eax, eax
jne 0x443c2b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x443d49
mov edx, esi
mov eax, ebx
call fcn.004435f8
jmp 0x443d49
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x443d42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00445c48
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043f4ec
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00443bf0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00445c48
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443d49
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ad2c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x526530]
cmp byte [eax + 0xc], 0
je 0x44ae99
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44ae92
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52a548], 0
jne 0x44ad80
push 0x44aea0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44aea8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a548], eax
cmp dword [0x48275c], 0
jne 0x44ae7b
push 0x44aeb8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x48275c], eax
cmp dword [0x48275c], 0
je 0x44ae7b
push 0x44aec4
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a54c], eax
push 0x44aed4
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a550], eax
push 0x44aee8
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a554], eax
push 0x44af00
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a558], eax
push 0x44af18
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a55c], eax
push 0x44af2c
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a560], eax
push 0x44af44
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a564], eax
push 0x44af5c
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a568], eax
push 0x44af78
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a56c], eax
push 0x44af84
mov eax, dword [0x48275c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x52a570], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ae99
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4504e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x450534]
test si, 4
je 0x4504f5
or bl, 1
test si, 8
je 0x4504ff
or bl, 4
test si, 1
je 0x450509
or bl, 8
test si, 2
je 0x450513
or bl, 0x10
test si, 0x10
je 0x45051d
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45052c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x450538
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x450574]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450552
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450561
or bl, 4
test esi, 0x20000000
je 0x45056c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x457c28
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x457c3a
add esp, 0xfffffff0
call fcn.00403d34
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042378c
mov eax, dword [0x5260bc]
mov dword [eax + 4], ebx
mov dword [eax], 0x457fcc
mov eax, dword [0x5260cc]
mov dword [eax + 4], ebx
mov dword [eax], 0x457fd8
mov eax, ebx
call fcn.00457fe4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x453a7c
push eax
push 0
push 0
mov eax, dword [0x526294]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x427928]
call fcn.00428e48
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x427928]
call fcn.00428e48
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x427928]
call fcn.00428e48
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00458414
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4582e4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4582e4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4582e4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457d77
call fcn.00403d8c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4580c8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458273
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x458254
mov dl, 1
mov eax, dword [0x41ad64]
call fcn.004039f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040483c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x458243
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044b088
test al, al
je 0x458236
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458284
lea eax, [ebp - 0x254]
call fcn.00409f08
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x458236
xor eax, eax
push ebp
push 0x45822f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4582bc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x458218
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404aac
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x458218
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458236
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x458139
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041f49c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45827a
lea eax, [ebp - 0x260]
call fcn.0040483c
ret

Function at 0x458bec
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x52a580]
cmp byte [eax + 0xad], 0
jne 0x458c5d
cmp dword [0x52a598], 0
jne 0x458c1e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x458ba8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x52a598], eax
cmp dword [0x52a594], 0
jne 0x458c39
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x52a594], eax
cmp dword [0x52a59c], 0
jne 0x458c5d
push esp
push 0
push 0
push 0x458b4c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x52a59c], eax
pop edx
ret
Function at 0x458e30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x458e47
add esp, 0xfffffff0
call fcn.00403d34
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042378c
mov eax, dword [0x526278]
cmp word [eax + 2], 0
jne 0x458e6f
mov eax, dword [0x526278]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a8e0
mov eax, dword [0x52636c]
cmp word [eax + 2], 0
jne 0x458e89
mov eax, dword [0x52636c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045aaec
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41a6f8]
call fcn.004039f8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x428104]
call fcn.0042dfb4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x459040
mov eax, dword [0x52613c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e388
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45b1ac
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x52613c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e220
test eax, eax
je 0x458f90
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004098c0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e254
test eax, eax
je 0x458fa4
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404aac
mov byte [ebx + 0xd4], 0
push ebx
push 0x45a440
call fcn.00424f28
mov dword [ebx + 0xc8], eax
mov eax, dword [0x525fe0]
cmp byte [eax], 0
jne 0x458ff5
mov eax, ebx
call fcn.00459184
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045b388
mov eax, ebx
call fcn.0045bee8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459035
call fcn.00403d8c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459404
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x52a580]
cmp dword [eax + 0x30], 0
je 0x4594ae
cmp dword [ebx + 0x94], 0
jne 0x4594a8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x459394
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4594a8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45946e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4594a8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041ceb0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45947d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45a1c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45a1fd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040492c
jmp 0x45a20a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404890
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45b56c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45b5da
mov eax, esi
call fcn.00445f44
test al, al
je 0x45b5da
mov eax, dword [ebx + 0x84]
call fcn.00445c48
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b5da
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45b5ce
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445c48
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043e18c
jmp 0x45b5da
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045b3a8
pop esi
pop ebx
ret
Function at 0x4654e4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4079d4]
call fcn.004054d0
xor eax, eax
push ebp
push 0x465685
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x482a1c], 0
jne 0x46553f
mov ecx, dword [0x525ff0]
mov dl, 1
mov eax, dword [0x407dcc]
call fcn.0040d530
call fcn.00404284
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004032f8
mov eax, ebx
call fcn.00405218
mov dword [ebp - 0x24], eax
mov esi, 0x465694
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406714
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405228
test eax, eax
jle 0x465628
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x465614
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404aac
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4655ba
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404ac4
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4655d0
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404ac4
mov eax, dword [ebp - 0x54]
call fcn.00404d00
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404aac
mov eax, dword [ebp - 0x58]
call fcn.00404d00
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x465616
xor eax, eax
test al, al
je 0x465621
mov ebx, 0x15
jmp 0x46562d
mov ebx, 0x10
jmp 0x46562d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x482a1c]
call fcn.00465368
mov eax, dword [ebp - 4]
call fcn.00465368
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040672c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46568c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404860
lea eax, [ebp - 0xc]
mov edx, dword [0x4079d4]
call fcn.004055a0
ret
Function at 0x402d24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040460c
test esi, esi
jne 0x402d5b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004046fc
jmp 0x402d7c
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402bc0
mov dword [esp], eax
test esi, esi
je 0x402d7c
cmp dword [ebx], 0
je 0x402d7c
dec esi
jmp 0x402d63
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403280
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41a008], 0x8088405
inc edx
mov dword [ebx + 0x41a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4039c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a58
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a38
xor eax, eax
push ebp
push 0x403a31
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a74
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a38
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41a024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404488
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41b044], 0
je 0x4044e9
cmp word [0x41b218], 0xd7b2
jne 0x4044b1
cmp dword [0x41b220], 0
jbe 0x4044b1
mov eax, 0x41b214
call dword [fcn.0041b230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41a090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404510
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41a030], 0
jne 0x404505
push 0
push 0x41a088
push 0x41a090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4061cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406232
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040487c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004034a0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40621c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406239
lea eax, [ebp - 0x10]
call fcn.0040460c
ret

Function at 0x407094
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x407127
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040460c
xor eax, eax
mov dword [0x41c030], eax
push 0
push 0x407034
call sub.user32.dll_EnumWindows
mov esi, dword [0x41c030]
dec esi
test esi, esi
jl 0x407111
inc esi
mov ebx, 0x41b6cc
push dword [edi]
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.004076d0
push dword [ebp - 4]
push 0x40713c
push dword [ebx - 4]
push 0x407148
mov eax, edi
mov edx, 5
call fcn.0040498c
lea eax, [ebx - 4]
call fcn.0040460c
xor eax, eax
mov dword [ebx], eax
add ebx, 8
dec esi
jne 0x4070d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40712e
lea eax, [ebp - 4]
call fcn.0040460c
ret

Function at 0x407258
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404abc
xor eax, eax
push ebp
push 0x407301
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4072e6
xor edx, edx
push ebp
push 0x4072d5
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x407318
call fcn.00404918
mov eax, dword [ebp - 8]
call fcn.0040773c
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x4072cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4072e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4072e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407308
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404630
ret