joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468ce0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push ebp
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004687e0
add esp, 0xc
test eax, eax
js 0x4687d0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x468660
lea esi, [ebp + 8]
lea esi, [esi + edi*4]
lea eax, [ebp + 8]
lea esp, [esp]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x468620
mov edi, 1
cmp dword [ebp + 0xf0], edi
jle 0x4687cb
lea esi, [ebp + 2]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x4f8c48]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x4f9848]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa048]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa448]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4f9c48]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x4f8c48]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x4f9848]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa048]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4f9c48]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa448]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x4f8c48]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x4f9848]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa048]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4f9c48]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa448]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x4f8c48]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x4f9848]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa048]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4f9c48]
movzx eax, dl
movzx eax, byte [eax*4 + 0x4f8c48]
xor ecx, dword [eax*4 + 0x4fa448]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebp + 0xf0]
jl 0x468674
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
jmp 0x4685e0

Function at 0x468d00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x468d14
mov dword [esp + 0x18], 0x468010
jmp fcn.004748b0
mov dword [esp + 0x18], 0x467a70
jmp fcn.00474600
Function at 0x469a70
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.00466690
mov eax, dword [0x54006c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x469af7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x469af7
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.004ef658
add esp, 0x10
lea ecx, [esp + 4]
test eax, eax
push 0
push ecx
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00465694
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0xff
push eax
call fcn.004ef658
add esp, 0x10
mov byte [esp + 0x107], 0
call fcn.00469930
test eax, eax
jle 0x469b7b
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x469b8f
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00465694
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.00465694
add esp, 0x108
ret
Function at 0x4e7aca
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e778a

Function at 0x4eb8b8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eb737
Function at 0x40374c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x489008], 0x8088405
inc edx
mov dword [ebx + 0x489008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x422420
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x422426
ret

Function at 0x457604
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00405024
mov esi, ebx
mov eax, dword [ebp]
call fcn.00405290
test ax, ax
jbe 0x45766f
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.004054e8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x457634
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4579b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.00405024
mov eax, dword [esi]
call fcn.00405290
test ax, ax
jbe 0x457a18
mov word [esp], ax
mov bx, 1
mov eax, esi
call fcn.004054e8
movzx ebp, bx
mov edx, dword [esi]
mov dl, byte [edx + ebp - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebp - 1], dl
mov eax, dword [esi]
movzx eax, byte [eax + ebp - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [esp]
jne 0x4579e0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403484
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40351c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034fc
xor eax, eax
push ebp
push 0x4034f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403538
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403dc8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x403e29
cmp word [0x40a218], 0xd7b2
jne 0x403df1
cmp dword [0x40a220], 0
jbe 0x403df1
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40908c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e50
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x403e45
push 0
push 0x409084
push 0x40908c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404780
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4049b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404803
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4049b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404803
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4049cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40488c
xor eax, eax
push ebp
push 0x404885
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004045c8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40486a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4049ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40486a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40488c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4049a6
cmp byte [ebp - 0xd], 0
jne 0x4048d3
cmp byte [ebp - 0x12], 0
je 0x4049a6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4048ec
dec ebx
cmp byte [ebx], 0x2e
je 0x4048fb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4048eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4049a6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404938
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049a6
cmp byte [ebp - 0xd], 0
je 0x4049a6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049a6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40488c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4049b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404803
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4049b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404803
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4049cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40488c
xor eax, eax
push ebp
push 0x404885
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004045c8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40486a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4049ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40486a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40488c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4049a6
cmp byte [ebp - 0xd], 0
jne 0x4048d3
cmp byte [ebp - 0x12], 0
je 0x4049a6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4048ec
dec ebx
cmp byte [ebx], 0x2e
je 0x4048fb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4048eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4049a6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404938
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049a6
cmp byte [ebp - 0xd], 0
je 0x4049a6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049a6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404b3c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404ba2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040418c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c08
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404b8c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ba9
lea eax, [ebp - 0x10]
call fcn.00403f44
ret

Function at 0x406940
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406979
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404034
jmp 0x406982
mov eax, ebx
mov edx, esi
call fcn.00403f98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40698c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4069ad
mov al, byte [esp]
jmp 0x4069af
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407034
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406eac
mov eax, dword [0x4093dc]
cmp byte [eax], 0
je 0x4070b0
mov eax, dword [0x409330]
call fcn.004029cc
call fcn.0040262c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405e34
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4070f8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4070e6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x409310]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40a660]
call fcn.0040458c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407aa4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407b08
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040418c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405d08
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407b0f
lea eax, [ebp - 0xc]
call fcn.00403f44
ret
Function at 0x47b358
Capabilities:
Encode data using xor

Disassembly:
fbstp tbyte [eax - 0x32c826a6]
pushfd
inc ebp
jbe 0x47b376
xlatb
adc dword [ebx + 0x49e9ed6d], ebx
aad 0xda
lds edi, [edi - 9]
invalid
sub ebp, dword [ebp - 0x4234c5bc]
pushfd
wait
mov eax, dword [0x159b7aab]
push ebp
dec ecx
xor byte [edx], dl
mov ebp, 0xb2178414
ljmp 0x347c

Function at 0x494eec
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
cdq
out 0x15, al
fisttp word [ecx]
pop esp
and dword [ebp + 0x25e69bf2], esi
mov ch, 0xf2
wait
out 0x25, al
xor al, byte [ebp + 0x2c]
stc
mov dh, 4
jb 0x494ef5
mov edi, 0x2f525db9

Function at 0x4c7ff1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d2400
cmp edx, dword [eax]
je 0x4c8013
add eax, 8
inc ecx
cmp eax, 0x4d2490
jl 0x4c8004
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d2400]
jne 0x4c8141
mov eax, dword [0x4d7e30]
cmp eax, 1
je 0x4c811b
test eax, eax
jne 0x4c8044
cmp dword [0x4d2328], 1
je 0x4c811b
cmp edx, 0xfc
je 0x4c8141
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c807b
lea eax, [ebp - 0x1a4]
push 0x4cde30
push eax
call fcn.004c89d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8e60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c80be
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8e60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cde2c
push edi
call fcn.004cad30
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cde10
push eax
call fcn.004c89d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c89e0
lea eax, [ebp - 0xa0]
push 0x4cde0c
push eax
call fcn.004c89e0
push dword [esi + 0x4d2404]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c89e0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cdde4
push eax
call fcn.004caca4
add esp, 0x2c
pop edi
jmp 0x4c8141
lea eax, [ebp + 8]
lea esi, [esi + 0x4d2404]
push 0
push eax
push dword [esi]
call fcn.004c8e60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x404684
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004077f4
test esi, esi
jne 0x4046bc
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407930
jmp 0x4046da
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404568
mov edi, eax
test esi, esi
je 0x4046da
cmp dword [ebx], 0
je 0x4046da
dec esi
jmp 0x4046c3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404710
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5b6008], 0x8088405
inc edx
mov dword [ebx + 0x5b6008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4067b8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5be054], 0
je 0x406819
cmp word [0x5be330], 0xd7b2
jne 0x4067e1
cmp dword [0x5be338], 0
jbe 0x4067e1
mov eax, 0x5be32c
call dword [0x5be348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406844
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5b6034], 0
jne 0x406835
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4069a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x5b603c], 0
je 0x4069ca
mov edx, esi
mov eax, ebx
call dword [0x5b603c]
jmp 0x4069d9
mov eax, 8
call fcn.004042b0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x5be055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40696c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x408340
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x408382
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4083a2
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004079f4
add esp, 0x41c
pop esi
pop ebx
ret