joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410576
Capabilities:
Clear file content
Create directory
Set registry value

Disassembly:
sub esp, 0x419db4
mov eax, dword [0x4193e9]
mov dword [esp + 0x800], eax
mov al, byte [0x1000d59c]
test al, al
je 0x4105f0
mov ecx, dword [esp + 0x808]
push edx
push dword [esp - 0xed]
push dword [esp - 0x8c]
push dword [esp - 0x45]
push dword [esp - 0x31]
call 0x4105c8
push eax
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea esp, [esp + 0x14]
mov edx, dword [esp + 8]
push dword [esp - 0x96]
push 0xffffffffffffffc3
push ebp
push esp
call 0x4105f8
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea esp, [esp + 0x14]
add dword [esp + 4], edx
push edx
push dword [esp - 3]
push dword [esp - 0x6f]
push 0x4037d8
push 0x40
call fcn.00410632
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x410650
mov eax, dword [edi + 0x10]
test eax, eax
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
test eax, eax
push dword fs:[eax]
push 0x400d1f
push ebp
push 0x40086c
push 0x3f7dfe
call fcn.00403ef1
push 0x419613
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]

Function at 0x4105c8
Capabilities:
Clear file content
Create directory
Set registry value

Disassembly:
sub esp, 0x419db4
mov eax, dword [0x4193e9]
mov dword [esp + 0x800], eax
mov al, byte [0x1000d59c]
test al, al
je 0x4105f0
mov ecx, dword [esp + 0x808]
push edx
push dword [esp - 0xed]
push dword [esp - 0x8c]
push dword [esp - 0x45]
push dword [esp - 0x31]
call 0x4105c8
push eax
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea esp, [esp + 0x14]
mov edx, dword [esp + 8]
push dword [esp - 0x96]
push 0xffffffffffffffc3
push ebp
push esp
call 0x4105f8
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea esp, [esp + 0x14]
add dword [esp + 4], edx
push edx
push dword [esp - 3]
push dword [esp - 0x6f]
push 0x4037d8
push 0x40
call fcn.00410632
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x410650
mov eax, dword [edi + 0x10]
test eax, eax
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
test eax, eax
push dword fs:[eax]
push 0x400d1f
push ebp
push 0x40086c
push 0x3f7dfe
call fcn.00403ef1
push 0x419613
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
Function at 0x4105f8
Capabilities:
Create directory
Set registry value

Disassembly:
sub esp, 0x419db4
mov eax, dword [0x4193e9]
mov dword [esp + 0x800], eax
mov al, byte [0x1000d59c]
test al, al
je 0x4105f0
mov ecx, dword [esp + 0x808]
push edx
push dword [esp - 0xed]
push dword [esp - 0x8c]
push dword [esp - 0x45]
push dword [esp - 0x31]
call 0x4105c8
push eax
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea esp, [esp + 0x14]
mov edx, dword [esp + 8]
push dword [esp - 0x96]
push 0xffffffffffffffc3
push ebp
push esp
call 0x4105f8
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea esp, [esp + 0x14]
add dword [esp + 4], edx
push edx
push dword [esp - 3]
push dword [esp - 0x6f]
push 0x4037d8
push 0x40
call fcn.00410632
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x410650
mov eax, dword [edi + 0x10]
test eax, eax
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
test eax, eax
push dword fs:[eax]
push 0x400d1f
push ebp
push 0x40086c
push 0x3f7dfe
call fcn.00403ef1
push 0x419613
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]

Function at 0x410675
Capabilities:
Set registry value

Disassembly:
cmp dword [edx], 0
je 0x41138a
push ebx
push esp
push 5
push 0x40320b
call fcn.00404199
lea esp, [esp]
mov bl, byte [eax]
and al, 0x10
loopne fcn.004106e0
add byte [eax], dl
test ah, 5
jp 0x4106e9
and al, 0x10
loopne 0x4106eb
add byte [eax], dl
and al, 0x24
ret
lea eax, [esp]
dec ecx
and al, 0x49
jne 0x40e14e
push 0x400122
push 0xffffffffffffffb3
push dword [esp + 0xc]
push 0x3fadf8
call fcn.00403db1
jmp dword [sym.imp.USER32.dll_PostQuitMessage]
push edx
push 0xffffffffffffffee
push 0xa49
push 0x419b41
call fcn.0040ce83
push dword [esp + 0xc]
push 0x400ffa
push 0xffffffffffffffab
push 0x3ff33b
call fcn.00403db1
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004046a0
push 0x166c
push 0x1f4a
call fcn.0040a652
push 8
push 7
call fcn.00404dba
int3
Function at 0x410974
Capabilities:
Get graphical window text

Disassembly:
call fcn.0040858d
push 0
push 0
call fcn.00406fa2
mov ecx, dword [esi + 8]
mov ebx, dword [ebp + 8]
mov edx, ecx
sub edx, ebx
mov eax, 0x41a10c
add esp, 4
push dword [esp + 4]
push 0x15
push 0x2a
push 0x3fcfb8
call fcn.00404062
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x410a24
mov eax, dword [0x419f4f]
xor eax, eax
test esi, esi
setge al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
push esi
push dword [esp + 0xb]
push 0xffffffffffffff91
call 0x4109e6
mov eax, 0x4197ae
pop esi
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 0
push 0xa
push eax
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp + 0x7b]
push 0xfffffffffffffff6
call 0x410a07
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
push 0
push 5
push edx
push eax
call dword [ecx + 0x30]
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push dword [esp - 0x100]
push dword [esp - 0x12]
call 0x410a3d
mov eax, dword [0x419a90]
test eax, eax
jne 0x4109c0
push 0x419859
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
mov dword [0x4194e1], eax
je 0x4109d6
push esi
lea esp, [esp + 0xc]
pop esi
ret 8

Function at 0x4109e6
Capabilities:
Get graphical window text

Disassembly:
call fcn.0040858d
push 0
push 0
call fcn.00406fa2
mov ecx, dword [esi + 8]
mov ebx, dword [ebp + 8]
mov edx, ecx
sub edx, ebx
mov eax, 0x41a10c
add esp, 4
push dword [esp + 4]
push 0x15
push 0x2a
push 0x3fcfb8
call fcn.00404062
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x410a24
mov eax, dword [0x419f4f]
xor eax, eax
test esi, esi
setge al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
push esi
push dword [esp + 0xb]
push 0xffffffffffffff91
call 0x4109e6
mov eax, 0x4197ae
pop esi
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 0
push 0xa
push eax
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp + 0x7b]
push 0xfffffffffffffff6
call 0x410a07
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
push 0
push 5
push edx
push eax
call dword [ecx + 0x30]
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push dword [esp - 0x100]
push dword [esp - 0x12]
call 0x410a3d
mov eax, dword [0x419a90]
test eax, eax
jne 0x4109c0
push 0x419859
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
mov dword [0x4194e1], eax
je 0x4109d6
push esi
lea esp, [esp + 0xc]
pop esi
ret 8
Function at 0x410a07
Capabilities:
Get graphical window text

Disassembly:
call fcn.0040858d
push 0
push 0
call fcn.00406fa2
mov ecx, dword [esi + 8]
mov ebx, dword [ebp + 8]
mov edx, ecx
sub edx, ebx
mov eax, 0x41a10c
add esp, 4
push dword [esp + 4]
push 0x15
push 0x2a
push 0x3fcfb8
call fcn.00404062
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x410a24
mov eax, dword [0x419f4f]
xor eax, eax
test esi, esi
setge al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
push esi
push dword [esp + 0xb]
push 0xffffffffffffff91
call 0x4109e6
mov eax, 0x4197ae
pop esi
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 0
push 0xa
push eax
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp + 0x7b]
push 0xfffffffffffffff6
call 0x410a07
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
push 0
push 5
push edx
push eax
call dword [ecx + 0x30]
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push dword [esp - 0x100]
push dword [esp - 0x12]
call 0x410a3d
mov eax, dword [0x419a90]
test eax, eax
jne 0x4109c0
push 0x419859
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
mov dword [0x4194e1], eax
je 0x4109d6
push esi
lea esp, [esp + 0xc]
pop esi
ret 8

Function at 0x4130ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x1872
push 0x3a
call fcn.00410f11
push 0x1026
push 0x419c54
push 0xffffffffffffffeb
call fcn.004055c4
push esi
push 0x400506
push 0xffffffffffffffc7
push 0x3fce70
call fcn.0040432b
lea eax, [esp + 4]
push 1
push eax
mov eax, dword [0x41a0fb]
call fcn.0040a3ac
cmp eax, 0xffffffff
push esp
push 0x927
push 9
call fcn.0040a43a
push 3
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
int3
Function at 0x405b4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405b85
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040331c
jmp 0x405b8e
mov eax, ebx
mov edx, esi
call fcn.004032d0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405b98
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405bb9
mov al, byte [esp]
jmp 0x405bbb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40debc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040323c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x40df1d
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x40df1d
cmp byte [ebp - 0x102], 0
je 0x40df1d
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403398
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f150
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x40f1d1
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40f182
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x40f194
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x40f1a0
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.0040f028
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40f1c5
push ebp
mov eax, dword [ebp - 4]
call fcn.0040f0c4
pop ecx
mov ebx, eax
cmp bl, 2
je 0x40f1a0
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416414
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41641a
ret
Function at 0x41b408
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x42264c
cmp dword [edi], 0
jne 0x41b484
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x422648]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4214ec
mov ecx, 2
call fcn.004026e0
mov edx, 0x41b3e0
lea eax, [esi + 5]
call fcn.0041b400
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b400
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b459
mov dword [0x422648], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b588
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41b5d8]
test si, 4
je 0x41b59c
or bl, 1
test si, 8
je 0x41b5a6
or bl, 4
test si, 1
je 0x41b5b0
or bl, 8
test si, 2
je 0x41b5ba
or bl, 0x10
test si, 0x10
je 0x41b5c4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41b5d3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41b5dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41b614]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41b5f5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41b604
or bl, 4
test esi, 0x20000000
je 0x41b60f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41f0bc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x422624]
cmp byte [eax + 0x7f], 0
jne 0x41f10f
cmp dword [0x422650], 0
jne 0x41f0eb
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x41f078
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x422650], eax
cmp dword [0x422654], 0
jne 0x41f10f
push esp
push 0
push 0
push 0x41f028
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x422654], eax
pop edx
ret

Function at 0x41f114
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x422650], 0
je 0x41f128
mov eax, dword [0x422650]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x422650], eax
cmp dword [0x422654], 0
je 0x41f145
push 0
mov eax, dword [0x422654]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x422654], eax
ret
Function at 0x41f1e4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x41f1fb
add esp, 0xfffffff0
call fcn.00402b88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040d01c
mov dl, 1
mov eax, 0x40775c
call fcn.00402988
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, 0x40775c
call fcn.00402988
mov dword [ebx + 0x80], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x3c], 0x80000018
mov dword [ebx + 0x54], 0x1f4
mov dword [ebx + 0x58], 0x32
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, 0x41630c
call fcn.00419ac0
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x41f33c
mov eax, dword [0x422014]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00419e4c
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x4205ec
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x422014]
push eax
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004056b4
test eax, eax
je 0x41f2d8
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004055c8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00405694
test eax, eax
je 0x41f2ec
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403398
cmp byte [0x422034], 0
jne 0x41f31c
mov eax, ebx
call fcn.0041f3cc
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x3a], 1
cmp byte [ebp - 1], 0
je 0x41f334
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41fdd4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x7e], 0
je 0x41fe06
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040331c
jmp 0x41fe10
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.004032d0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4207c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x4207fc
mov eax, esi
call fcn.00414da8
test al, al
je 0x4207fc
mov eax, dword [ebx + 0x60]
call fcn.00414cac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4207fc
push 0
mov eax, dword [ebx + 0x60]
call fcn.00414cac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x402e18
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402e71
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402cb4
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402cb4
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402e5b
inc ebx
jmp 0x402e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e78
lea eax, [ebp - 8]
call fcn.00404518
ret

Function at 0x402e80
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404518
test esi, esi
jne 0x402eb7
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404608
jmp 0x402ed8
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402cb4
mov dword [esp], eax
test esi, esi
je 0x402ed8
cmp dword [ebx], 0
je 0x402ed8
dec esi
jmp 0x402ebf
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403188
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45c008], 0x8088405
inc edx
mov dword [ebx + 0x45c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4035e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45c024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403678
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403658
xor eax, eax
push ebp
push 0x403651
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403694
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403658
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45c024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45c024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404374
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45e044], 0
je 0x4043d5
cmp word [0x45e218], 0xd7b2
jne 0x40439d
cmp dword [0x45e220], 0
jbe 0x40439d
mov eax, 0x45e214
call dword [0x45e230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45c070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043fc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45c034], 0
jne 0x4043f1
push 0
push 0x45c068
push 0x45c070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4062b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406316
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404788
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004031a4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406300
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40631d
lea eax, [ebp - 0x10]
call fcn.00404518
ret

Function at 0x40b398
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3d1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404608
jmp 0x40b3da
mov eax, ebx
mov edx, esi
call fcn.0040456c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b3e4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b405
mov al, byte [esp]
jmp 0x40b407
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ba9c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b904
mov eax, dword [0x45d008]
cmp byte [eax], 0
je 0x40bb18
mov eax, dword [0x45ce40]
call fcn.00402fb8
call fcn.00402be0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408b88
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bb60
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bb4e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x45cdf0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45e660]
call fcn.0040571c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x41ae98
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
lea ebx, [ebp - 0xc]
mov esi, 0x45e880
cmp dword [esi], 0
jne 0x41af3e
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [0x45e87c]
mov dword [eax], edx
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x45c3ec
mov ecx, 2
call fcn.00402c74
mov edx, 0x41ae70
mov eax, dword [ebp - 8]
add eax, 5
call fcn.0041ae90
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebx], eax
mov eax, dword [ebx]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebx]
call fcn.0041ae90
mov edx, dword [ebx]
mov dword [edx + 1], eax
mov eax, dword [ebx]
mov edx, dword [esi]
mov dword [eax + 5], edx
mov eax, dword [ebx]
mov dword [esi], eax
add dword [ebx], 0xd
mov eax, dword [ebx]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x41af05
mov eax, dword [ebp - 8]
mov dword [0x45e87c], eax
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 5]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41c474
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c47a
ret

Function at 0x41e940
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e991
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e978
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e968
jmp 0x41e991
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e979
pop ebx
mov esp, ebp
pop ebp
ret