joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b00
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esi], ebx
push edi
jne 0x407b87
cmp dword [esi + 4], 0xffffffff
jne 0x407b87
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00409cbb
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
pop ecx
je 0x407b49
cmp ax, 0x2f
je 0x407b49
push 0x41dc40
push edi
call fcn.00408d0a
pop ecx
pop ecx
push 0x20
call fcn.0040b67f
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
push eax
mov byte [eax], bl
mov byte [eax + 1], 1
mov byte [eax + 0x10], bl
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0xc], ebx
call fcn.004070e6
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x407b8c
mov eax, 0x1000000
pop edi
pop ebx
pop ecx
ret 8

Function at 0x408816
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
xor esi, esi
and word [ebp - 0x7c], si
push 0x206
lea eax, [ebp - 0x7a]
push esi
push eax
call fcn.00408c60
add esp, 0xc
test ebx, ebx
je 0x4088cc
and dword [ebp - 0x80], esi
mov esi, 0x41ddcc
push esi
call fcn.00409cbb
test eax, eax
pop ecx
jbe 0x408875
push 0x41dcc4
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00409339
add esp, 0xc
jmp 0x4088a9
lea eax, [ebp - 0x7c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41ff94
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00408d82
push 0x41dcc4
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00409339
add esp, 0x18
xor esi, esi
inc esi
cmp dword [ebp - 0x80], 0
je 0x4088cc
push dword [ebp - 0x80]
push esi
push 0x200
push ebx
call fcn.00409c2e
push dword [ebp - 0x80]
call fcn.00409a98
add esp, 0x14
mov ecx, dword [ebp + 0x18c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408c4c
add ebp, 0x190
leave
ret
Function at 0x4088e4
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x72]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], ebx
mov word [ebp - 0x74], bx
call fcn.00408c60
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 0x78], ebx
je 0x4089ba
push edi
mov edi, str.golfset.ini
push edi
call fcn.00409cbb
test eax, eax
pop ecx
je 0x4089b9
cmp dword [0x4230a0], 3
mov esi, 0x104
lea eax, [ebp - 0x74]
jne 0x40896a
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc40
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00408d82
add esp, 0xc
jmp 0x408972
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00408d82
push 0x41dcbc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00409339
add esp, 0x18
cmp dword [ebp - 0x78], ebx
je 0x4089b9
push dword [ebp - 0x78]
xor esi, esi
inc esi
push esi
push 0x200
push dword [ebp - 0x80]
call fcn.00409a0a
push dword [ebp - 0x78]
call fcn.00409a98
add esp, 0x14
mov dword [ebp - 0x7c], esi
pop edi
mov ecx, dword [ebp + 0x194]
mov eax, dword [ebp - 0x7c]
pop esi
xor ecx, ebp
pop ebx
call fcn.00408c4c
add ebp, 0x198
leave
ret

Function at 0x4089d4
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x72]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], ebx
mov word [ebp - 0x74], bx
call fcn.00408c60
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 0x78], ebx
je 0x408a81
push edi
mov edi, 0x41ff94
push edi
call fcn.00409cbb
test eax, eax
pop ecx
je 0x408a80
lea eax, [ebp - 0x74]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00408d82
push 0x41dcbc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00409339
add esp, 0x18
cmp dword [ebp - 0x78], ebx
je 0x408a80
push dword [ebp - 0x78]
xor esi, esi
inc esi
push esi
push 0x200
push dword [ebp - 0x80]
call fcn.00409a0a
push dword [ebp - 0x78]
call fcn.00409a98
add esp, 0x14
mov dword [ebp - 0x7c], esi
pop edi
mov ecx, dword [ebp + 0x194]
mov eax, dword [ebp - 0x7c]
pop esi
xor ecx, ebp
pop ebx
call fcn.00408c4c
add ebp, 0x198
leave
ret
Function at 0x408b90
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408bb0
mov eax, dword [ebp + 8]
call fcn.00408bfb
test eax, eax
je 0x408bf6
push edi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x408bf5
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x408bee
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x408bfb
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408c0e
xor eax, eax
pop esi
ret
test al, 1
je 0x408c15
xor eax, 1
test al, 4
je 0x408c1c
xor eax, 4
test al, 2
je 0x408c23
xor eax, 2
test al, 0x20
je 0x408c2a
xor eax, 0x20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
pop esi
ret

Function at 0x408c4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422044]
jne 0x408c56
repz ret
jmp fcn.0040ca63
Function at 0x4147e9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040ce6d
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4148be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414829
xor eax, eax
jmp 0x414982
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x414822
push eax
call fcn.0040ce0a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040ce0a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040ce0a
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f061
test eax, eax
pop ecx
pop ecx
je 0x41488c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cc6b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4148be
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040ce0a
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x4148be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ce0a
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414937
cmp dword [0x4244b8], esi
je 0x414937
push eax
call fcn.0040ce76
pop ecx
call eax
cmp eax, ebx
je 0x414904
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040ce76
pop ecx
call eax
test eax, eax
je 0x414904
test byte [ebp - 0x18], 1
jne 0x414937
lea eax, [ebp - 0xc]
push eax
call fcn.0040f098
test eax, eax
pop ecx
je 0x41491f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cc6b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x41492e
or dword [ebp + 0x10], 0x200000
jmp 0x414968
or dword [ebp + 0x10], 0x40000
jmp 0x414968
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x414968
push eax
call fcn.0040ce76
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x414968
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x414968
push dword [ebp - 4]
push eax
call fcn.0040ce76
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040ce76
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
nop
mov ecx, 0x6cc87b8d
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7e620456
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x421aeb
Capabilities:
Encode data using xor

Disassembly:
pushfd
pop ds
mov gs, word [ebp + 0x54886e19]
adc al, 0x2c
or dword [esi], 0xfffffff1
nop
sbb ebx, dword [edi + edx - 0x3846ab75]
test eax, 0x235075
mov bl, 0xa
sbb byte [eax], ah
mov dh, 0
test byte [edi], ah
jmp 0x421b05
cmp al, 0xd6
rcl dword [edx], 0xcf
nop
ja 0x421b36
wait
hlt
jae 0x421a71
or ecx, dword [ebx + esi*2 + 0x49]
dec ecx
dec ecx
mov edx, 0x23b6bf03
pop es
sub al, 0x54
and esp, ecx
aas
mov bl, byte [edx]
mov bh, 0xc7
xor ebx, dword fs:[eax + 0x2a346d51]
insd dword es:[edi], dx
xor al, 0x2a
ja 0x421af0
push cs
aad 0xcb
imul edi, dword [ebp + 0xe39fa61], 0xfd253194
inc eax
imul dword [edx]
ja 0x421ac5
stosb byte es:[edi], al
fistp dword [eax + 0x1e5b62bf]
pop edi
insd dword es:[edi], dx
ljmp 0xf0d1
jb 0x421b8a
nop
and edi, dword [ebx - 0x57ea3aa2]
jb 0x421b7d
mov al, byte cs:[0x95eb41b]
sbb edi, dword [esi]
xchg edi, eax
retf
sub dword [esi + 0x71], edx
loop 0x421b97
test dword [edi + ebx*4 + 0x64], ebx
cmpsd dword [esi], dword es:[edi]
pop ds
cmp al, 0x6a
xchg ebp, eax
sub dword [esi + 0x61], eax
pop ebp
and eax, 0x1f7e2a30
lodsd eax, dword [esi]
out 0x5b, eax
sbb eax, 0x56abe0f6
stosd dword es:[edi], eax
jp 0x421be0
add ch, ah
hlt
cli
dec ebp
imul dword [esi + 0x74]
inc esp
in eax, 0x7d
fdivr dword [eax + 0x7b919c3e]
xchg ecx, eax
invalid

Function at 0x42a915
Capabilities:
Encode data using xor

Disassembly:
retf 0xd7e4
xor al, 0xc5
inc ebx
jns 0x42a973
pop esp
pushal
push esp
pop ecx
jno 0x42a8ff
cdq
pop esi
cmp byte [esi], bh
ret
mov ss, word [esi + 0x7106a032]
imul dword [edi - 0x57]
salc
cmp dl, ch
aas
and cl, 0x9a
scasb al, byte es:[edi]
and al, 0xf3
les edi, [eax]
or eax, 0xe612f89
adc cl, byte ds:[esi]
adc ax, word [edi + 0x6b556bbc]
sar byte [ecx + 0x3004450e], cl
pop ecx
pop edi
mov dh, 0x8d
invalid
Function at 0x407297
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7df95c], 0
jne 0x4072d5
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072ab
mov dword [ecx*4 + 0x7df958], eax
inc ecx
cmp ecx, 0x100
jl 0x4072a6
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407302
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7df958]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072e3
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x710c79
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7109ec
dec ebx
call fcn.00710ca6
sub ebx, 0x3fde7483
dec ebx
xor dword [esi], eax
sub ebx, ecx
and ebx, ecx
inc esi
inc ebx
or ebx, ecx
and ecx, ecx
cmp esi, edi
jne fcn.00710c79
add ecx, ecx
sub ecx, ecx
sub ebx, ecx
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x40515c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405195
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40519e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4051a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4051c9
mov al, byte [esp]
jmp 0x4051cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4067c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406808
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040675c
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40680f
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406a10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406a9e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406a5b
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406a88
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406a6f
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406a7e
lea edx, [ebp - 4]
call fcn.004068d4
test ebx, ebx
je 0x406a7e
dec ebx
jmp 0x406a60
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406aa5
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406aac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404d30
add esp, 0x104
pop ebx
ret
Function at 0x406bf4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406d15
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406cff
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406c4d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406cff
cmp dword [ebp - 0xc], 0
jne 0x406c62
mov eax, dword [ebp - 4]
call fcn.00403198
mov bl, 1
jmp 0x406cff
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403420
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406c19
test eax, eax
jne 0x406cff
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406ca9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406cff
jmp 0x406ca9
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x406cbc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x406ca6
cmp dword [ebp - 8], 7
jne 0x406ccb
cmp dword [ebp - 0xc], 0
je 0x406ccb
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004034f0
cmp dword [ebp - 8], 7
jne 0x406cf2
cmp dword [ebp - 0xc], 0
je 0x406cf2
lea eax, [ebp - 0x10]
call fcn.00403420
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d1c
lea eax, [ebp - 0x10]
call fcn.00403198
ret

Function at 0x407650
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x40766c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40766e
shr eax, 1
dec edx
jne 0x40765f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407658
pop esi
ret

Function at 0x407684
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x4076a7
call fcn.00407650
push 1
push 0x40b558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4076d2
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4076ad
mov eax, ebx
pop edi
pop esi
pop ebx
ret