joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489eac
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x489fef
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x489f03
push 0x20a
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [0x4ecc50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20e]
mov eax, dword [ebp - 4]
call fcn.00407be8
jmp 0x489fd6
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
mov eax, ebx
call fcn.00489e48
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00489e70
mov ebx, eax
test esi, esi
je 0x489f2b
dec esi
test esi, esi
jl 0x489f2b
cmp edi, ebx
jne 0x489f0a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x214]
mov edx, edi
call fcn.0040894c
mov eax, dword [ebp - 0x214]
mov ecx, ebx
sub ecx, edi
sar ecx, 1
jns 0x489f4d
adc ecx, 0
mov edx, 1
call fcn.00408cc0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x489f73
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x489fd6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp word [eax], 0x22
jne 0x489fd6
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x489f9a
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x489fd6
mov eax, edx
mov dword [ebp - 0x218], eax
mov ebx, dword [ebp - 0x218]
test ebx, ebx
je 0x489fbe
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00408cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489ff6
lea eax, [ebp - 0x214]
call fcn.00407a60
ret

Function at 0x490fd0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x49100d
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x490ffb
mov al, 7
jmp 0x491046
cmp edx, 5
jb 0x491046
mov al, 5
cmp dword [esp + 8], 1
jb 0x491046
mov al, 6
jmp 0x491046
cmp eax, 1
jne 0x491044
mov al, 1
cmp dword [esp + 4], 4
ja 0x491029
cmp dword [esp + 4], 4
jne 0x49102b
cmp dword [esp + 8], 0xa
jb 0x49102b
mov al, 2
cmp dword [esp + 4], 4
ja 0x491040
cmp dword [esp + 4], 4
jne 0x491046
cmp dword [esp + 8], 0x5a
jb 0x491046
mov al, 3
jmp 0x491046
xor eax, eax
add esp, 0x11c
ret
Function at 0x499f64
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x499ffc
call sub.user32.dll_RegisterWindowMessageW
mov edi, eax
mov dl, 1
mov eax, dword [0x436450]
call fcn.00405e44
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x499feb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x499e00
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x499fd5
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004414e0
mov edx, dword [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push edx
push edi
push eax
call sub.user32.dll_PostMessageW
inc esi
dec ebx
jne 0x499fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499ff2
mov eax, dword [ebp - 0xc]
call fcn.00405e74
ret
Function at 0x4b3884
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b3a7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
jne 0x4b38be
mov eax, dword [ebx + 0xc]
mov dword [eax + 0x5db], 7
jmp 0x4b3a61
mov eax, dword [ebx + 0x4c]
call fcn.004b5410
mov esi, eax
mov dword [ebx + 0x50], esi
mov edx, esi
mov eax, dword [ebx + 0x4c]
call fcn.004b53e4
xor edx, edx
push ebp
push 0x4b3a5a
push dword fs:[edx]
mov dword fs:[edx], esp
movzx eax, byte [0x4b3a8c]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, 0x4b3a9c
mov eax, 0x4b3ae4
call fcn.0047d00c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x50]
mov ecx, dword [edx + 8]
mov edx, 0x4b3b08
call fcn.00424ccc
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.0048d708
lea ecx, [ebp - 0x10]
mov edx, 0x4b3b28
mov eax, 0x4b3b44
call fcn.0047d00c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x14]
call fcn.0048d708
mov eax, dword [ebx + 0x14]
call fcn.0048df3c
lea ecx, [ebp - 0x14]
mov edx, 0x4b3b70
mov eax, 0x4b3b8c
call fcn.0047d00c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x18]
call fcn.0048d708
mov eax, dword [ebx + 0x18]
mov dl, 1
call fcn.0048c814
mov eax, dword [ebx + 0x18]
call fcn.0048df3c
mov eax, dword [ebx + 0x1c]
call fcn.0048df84
mov eax, dword [ebx + 0x20]
call fcn.0048df84
mov eax, dword [ebx + 0x14]
call fcn.0048df3c
lea ecx, [ebp - 0x18]
mov edx, 0x4b3bb8
mov eax, 0x4b3bf8
call fcn.0047d00c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
call fcn.0048d708
mov eax, dword [ebx + 0x24]
call fcn.0048df3c
mov eax, dword [ebx + 0x50]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x28]
call fcn.0048d708
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x2e]
call fcn.0048e3c8
mov eax, dword [ebx + 0x28]
call fcn.0048df3c
lea ecx, [ebp - 4]
mov edx, 0x4b3c28
mov eax, 0x4b3cb8
call fcn.0047d00c
movzx eax, byte [0x4b3cd4]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax + 8]
mov edx, 0x4b3b08
mov eax, dword [ebp - 4]
call fcn.00424ccc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00407e88
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebp - 4]
call fcn.0048d708
mov eax, dword [ebx + 0x2c]
call fcn.0048df3c
lea ecx, [ebp - 0x20]
mov edx, 0x4b3ce4
mov eax, 0x4b3e0c
call fcn.0047d00c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebx + 0x30]
call fcn.0048df3c
mov eax, dword [ebx + 0xc]
call fcn.0048df68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3a61
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3a83
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00407ac0
ret
Function at 0x4cf8f4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebx], 0
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4cf91e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4cf9dc
call fcn.004c5f90
mov dword [ebp - 8], eax
jmp 0x4cf931
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4cfa4c
call fcn.004c5f90
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cf9be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004c6ea8
test al, al
je 0x4cf971
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x4cf971
mov eax, dword [ebp - 8]
call fcn.00405e74
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4cfabc
call fcn.004c5f90
mov dword [ebp - 8], eax
jmp 0x4cf974
mov byte [ebx], 1
mov eax, dword [ebp - 8]
call fcn.004c6ea8
test al, al
je 0x4cf99b
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4cf992
mov dword [ebp - 4], 0xffffffff
jmp 0x4cf9a8
mov dword [ebp - 4], 1
jmp 0x4cf9a8
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004c7358
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf9c5
mov eax, dword [ebp - 8]
call fcn.00405e74
ret

Function at 0x4cfafc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cfbb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0x4cfbd0
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0041d914
push dword [ebp - 0x10]
push 0x4cfc20
push 0x4cfc50
push 0x4cfc68
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00408bd8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004c5f90
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cfb93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004c6ea8
test al, al
jne 0x4cfb7d
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfb9a
mov eax, dword [ebp - 8]
call fcn.00405e74
ret
Function at 0x4d16e4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d18b0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d1883
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x4d18cc
mov edx, 0x4d18e4
mov eax, 0x80000001
call fcn.00462994
mov eax, dword [ebp - 4]
mov edx, 0x4d1920
call fcn.00408c88
sete bl
lea eax, [ebp - 4]
push eax
mov ecx, 0x4d1930
mov edx, 0x4d18e4
mov eax, 0x80000001
call fcn.00462994
mov eax, dword [ebp - 4]
mov edx, 0x4d1920
call fcn.00408c88
sete byte [ebp - 9]
lea eax, [ebp - 8]
mov edx, 0x4d1948
call fcn.00407e88
mov eax, ebx
or al, byte [ebp - 9]
je 0x4d183f
xor eax, eax
call fcn.0047b8e8
push 0x4d1980
mov eax, dword [0x4e9b04]
push dword [eax]
push 0x4d1990
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00408bd8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x4d19b0
mov eax, 0x80000001
call fcn.004628c8
xor eax, eax
push ebp
push 0x4d1838
push dword fs:[eax]
mov dword fs:[eax], esp
or edx, 0xffffffff
mov eax, 0x4d1a1c
call fcn.0045fb9c
mov esi, eax
test esi, esi
jle 0x4d17e1
mov eax, 0x4d1a1c
call fcn.004a2dc4
test al, al
je 0x4d17e1
xor esi, esi
test esi, esi
jg 0x4d182a
movzx edx, byte [ebp - 9]
mov eax, ebx
call fcn.004d1c28
mov ecx, dword [ebp - 8]
mov edx, 0x4d19b0
mov eax, 0x80000001
call fcn.00462d74
mov ecx, 0x4d18cc
mov edx, 0x4d18e4
mov eax, 0x80000001
call fcn.00462d74
mov ecx, 0x4d1930
mov edx, 0x4d18e4
mov eax, 0x80000001
call fcn.00462d74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1879
ret
mov ecx, dword [ebp - 8]
mov edx, 0x4d19b0
mov eax, 0x80000001
call fcn.00462d74
mov ecx, 0x4d18cc
mov edx, 0x4d18e4
mov eax, 0x80000001
call fcn.00462d74
mov ecx, 0x4d1930
mov edx, 0x4d18e4
mov eax, 0x80000001
call fcn.00462d74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d188d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d18b7
lea eax, [ebp - 0x10]
call fcn.00407a60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x4d4bd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4d4bed
add esp, 0xfffffff0
call fcn.004063e4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d4de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], cl
mov dl, 1
mov eax, dword [0x49b428]
call fcn.0049b944
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x4d4298]
call fcn.004d44b8
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
mov eax, ebx
call fcn.004d45a4
mov eax, dword [ebp - 4]
fstp qword [eax + 0x40]
wait
push 0
mov ecx, 0x4d4e18
mov dl, 1
mov eax, dword [0x4a412c]
call fcn.004a43d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x4d4e34
call sub.user32.dll_RegisterWindowMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], ebx
mov eax, ebx
call fcn.0046026c
push 0x4d4e54
call sub.user32.dll_RegisterWindowMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
mov eax, ebx
call fcn.0046026c
mov eax, 0x4d4e88
call fcn.0048b2ac
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
mov eax, ebx
xor edx, edx
call fcn.0048d5b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, 0x4d4eb0
call fcn.0048e1d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0048c860
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [ebx + 0x46c], eax
mov dword [ebx + 0x468], 0x4d5de8
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
push 0x4d5bd0
push 0
push 1
push 0
lea ecx, [ebp - 8]
mov eax, ebx
mov edx, 1
call fcn.0048a35c
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push 0
push 0
push 0
push 0
mov edx, 0x4d4ee0
mov eax, esi
movzx ecx, word [0x4d4ee0]
call fcn.0048aa98
push 0
push 0
push 0
push 0
mov edx, 0x4d4ee0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4d4ee0]
call fcn.0048aa98
push 0
push 0
push 0
push 0
mov edx, 0x4d4ee0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4d4ee4]
call fcn.0048aa98
push 0
push 0
push 0
push 0
mov edx, 0x4d4ee0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4d4ee0]
call fcn.0048aa98
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 0
push 0x4d4ee8
mov eax, dword [0x4ecc50]
push eax
call sub.user32.dll_LoadIconW
push eax
push 0x414
push 0x4d4e88
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2d]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0048c860
mov ecx, eax
mov dl, 1
mov eax, dword [0x49a6c8]
call fcn.0049a770
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4dea
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4d4e02
call fcn.0040643c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x405a73
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [ebx]
sub ebx, dword [ebx]
adc dword [edx], ecx
adc dword [ebx], ecx
lcall 8, 0x7b020513
add byte [ecx + edx], al
add al, 0x11
add eax, 0x306f
or ah, byte [esi]
adc dword [ebx], ecx
pop ss
pop eax
adc ecx, dword [ebx]
adc dword [ebx], ecx
adc dword [edx], ecx
mov gs, word [ecx + 0x32]
fnstsw word [eax]
mov eax, dword [0x8000000]
jb 0x405a83
push es
add byte [eax + 0x17], dh
outsd dx, dword [esi]
and eax, 0x390a0000
nop
add byte [eax], al
add byte [eax], cl
or byte [edi], bl
cmp ch, byte [edi + 0x26]
add byte [eax], al
or dl, byte [edi]
pop eax
outsd dx, dword [esi]
and al, 0
add byte [edx], cl
adc eax, dword [esi]
adc dword [esi], eax
jb 0x405aa3
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or dl, byte [edi]
outsd dx, dword [esi]
das
add byte [eax], al
or dl, byte [ebx]
pop es
adc dword [edi], eax
adc ecx, dword [esi + edx]
adc ecx, dword [0xc11202b]
adc dword [0x208139a], ecx
jnp 0x405af2
add byte [eax], al
add al, 0x11
or byte [edi + 0x31], ch
add byte [eax], al
or ch, byte [edi + 0x30]
add byte [eax], al
or ah, byte [esi]
adc dword [0xd135817], ecx
adc dword [0x698e0c11], ecx
xor bl, al
sub esi, dword [edi]
pop es
adc dword [esi + ecx*4], ecx
imul esi, dword [edx], 0x7372bd8
jb 0x405b01
push es
add byte [eax + 0x6f], dh
jo 0x405b7f
xor al, byte [eax]
add byte [edx], cl
sub al, 0x28
pop es
jb 0x405b0e
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or bl, byte [eax]
outsd dx, dword [esi]
xor eax, dword [eax]
add byte [edx], cl
adc ecx, dword [ecx]
add bh, byte [ebx + 0xa]
add byte [eax], al
add al, 0x11
or dword [esi], edx
lcall 0x346f, 0x9a170911
add byte [eax], al
or ch, byte [ebx]
add dl, byte [esi]
sub al, byte [esi]
pop ss
pop eax
or al, byte [esi]
add ecx, dword [esi - 0x29ac097]
invalid
add byte [eax + 0x28], dh
sbb byte [eax], al
add byte [edx], cl
jge 0x405b95
or ch, byte [0xd7b020c]
Function at 0x402a60
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045b8
test esi, esi
jne 0x402a96
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004046a8
jmp 0x402ab4
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402974
mov edi, eax
test esi, esi
je 0x402ab4
cmp dword [ebx], 0
je 0x402ab4
dec esi
jmp 0x402a9d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40311c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x470008], 0x8088405
inc edx
mov dword [ebx + 0x470008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4036d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x470024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403770
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x403750
xor eax, eax
push ebp
push 0x403749
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40378c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403750
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x470024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x470024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40443c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47204c], 0
je 0x40449d
cmp word [0x472220], 0xd7b2
jne 0x404465
cmp dword [0x472228], 0
jbe 0x404465
mov eax, 0x47221c
call dword [fcn.00472238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x470094
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4044c4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x470034], 0
jne 0x4044b9
push 0
push 0x47008c
push 0x470094
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x405acc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cfc
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x405b4f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cfc
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x405b4f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d18
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x405bd8
xor eax, eax
push ebp
push 0x405bd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405914
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x405bb6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405d38
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x405bb6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bd8
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405cf2
cmp byte [ebp - 0xd], 0
jne 0x405c1f
cmp byte [ebp - 0x12], 0
je 0x405cf2
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405c38
dec ebx
cmp byte [ebx], 0x2e
je 0x405c47
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c37
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405cf2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c84
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cf2
cmp byte [ebp - 0xd], 0
je 0x405cf2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cf2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret