joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c4b0
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x454688
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4738c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [0x476ec0]
mov ecx, dword [eax + 4]
push ecx
call fcn.0043ccf8
add esp, 4
test eax, eax
je 0x40c50b
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40c50b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x210]
sub eax, 0x10
push eax
call fcn.00401bb0
add eax, 0x10
add esp, 4
mov dword [esp + 8], eax
push str.New.exe
push str..exe
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20], 0
call fcn.0040c940
test eax, eax
jne 0x40c558
push str.NEW.EXE
push str..EXE
lea eax, [esp + 0x10]
push eax
call fcn.0040c940
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x478018]
push ecx
push 0x4636c0
push str.ExecuteType
push str.SystemState
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [0x478020]
mov ecx, dword [0x477c30]
push 0x40
push edx
push 0x4657ac
call fcn.0040f593
mov eax, dword [edi + 0x210]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esi - 0x10]
mov byte [0x477cec], 1
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c5da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x40d628
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041c25a
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40d65f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040d24a
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x411e45
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x411e7e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0040cc11
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00402550
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x413bee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x413c31
call fcn.0041c25a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x413c31
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x413c4c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004137a5
test ebx, ebx
mov esi, eax
je 0x413c4a
test edi, edi
je 0x413c4a
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x417fcf
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x452753
call fcn.0043e751
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x417ff4
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x418040
call fcn.00418a14
push eax
lea ecx, [ebp - 0x10]
call fcn.00401860
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417896
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401840
mov eax, esi
call fcn.0043e829
ret 8

Function at 0x41938d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x4193b6
call fcn.0041c25a
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4193d9
push eax
push dword [esi + 4]
call fcn.00419318
push esi
push eax
mov ecx, 0x4769e0
call fcn.00418ff2
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x425f66
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0041c25a
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x425f91
xor eax, eax
jmp 0x426035
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x425f8a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x425f8a
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040cb7a
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x425fe6
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x425fd5
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00424d25
push edi
mov ebx, eax
call fcn.0040cbaa
test ebx, ebx
pop ecx
je 0x426028
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.004253c4
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00425476
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x428206
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x428234
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x428252
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00428170
jmp 0x428252
mov eax, dword [esi + 0x14]
test eax, eax
je 0x428252
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00428170
test edi, edi
mov eax, edi
jne 0x42823c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x476bf8]
test ecx, ecx
je 0x428315
jmp 0x428205
ret 8

Function at 0x429f08
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x429f11
xor eax, eax
jmp 0x429f7a
cmp dword [esp + 8], 0
jne 0x429f1d
call fcn.0041893b
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.00441c18
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x429f58
push dword [esi + 0x10]
call fcn.0044195d
test eax, eax
pop ecx
jne 0x429f58
mov esi, dword [esi + 0xc]
call fcn.0043eb53
push esi
push dword [eax]
push 1
call fcn.0042d2dc
push dword [esi + 0x10]
call fcn.0044198c
test eax, eax
pop ecx
je 0x429f77
push dword [esi + 0x10]
call fcn.004418b1
push eax
call fcn.004019d0
pop ecx
pop ecx
jmp 0x429f46
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x429f83
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x429f8d
call fcn.0041893b
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.00441d4d
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x429fba
mov esi, dword [esi + 0xc]
call fcn.0043eb53
push esi
push dword [eax]
push 1
call fcn.0042d2dc
pop esi
ret 8

Function at 0x434e08
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x434e4e
call fcn.0041c25a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x434e4e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x434e91
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x434e7a
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x434e7a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x434e8e
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43c7fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4738c0]
jne 0x43c808
repz ret
jmp fcn.00442eaa
Function at 0x44e260
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00443011
xor ebx, ebx
cmp dword [0x47795c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x44e335
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x44e2a0
xor eax, eax
jmp 0x44e3f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x462768
push edi
call esi
cmp eax, ebx
je 0x44e299
push eax
call fcn.00442fae
mov dword [esp], 0x462758
push edi
mov dword [0x47795c], eax
call esi
push eax
call fcn.00442fae
mov dword [esp], 0x462744
push edi
mov dword [0x477960], eax
call esi
push eax
call fcn.00442fae
mov dword [0x477964], eax
lea eax, [ebp - 8]
push eax
call fcn.0043ddcb
test eax, eax
pop ecx
pop ecx
je 0x44e303
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00443a0f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x44e335
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00442fae
cmp eax, ebx
pop ecx
mov dword [0x47796c], eax
je 0x44e335
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00442fae
pop ecx
mov dword [0x477968], eax
mov eax, dword [0x477968]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x44e3ae
cmp dword [0x47796c], esi
je 0x44e3ae
push eax
call fcn.0044301a
pop ecx
call eax
cmp eax, ebx
je 0x44e37b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x47796c]
call fcn.0044301a
pop ecx
call eax
test eax, eax
je 0x44e37b
test byte [ebp - 0x18], 1
jne 0x44e3ae
lea eax, [ebp - 0xc]
push eax
call fcn.0043de02
test eax, eax
pop ecx
je 0x44e396
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00443a0f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x44e3a5
or dword [ebp + 0x10], 0x200000
jmp 0x44e3df
or dword [ebp + 0x10], 0x40000
jmp 0x44e3df
mov eax, dword [0x477960]
cmp eax, esi
je 0x44e3df
push eax
call fcn.0044301a
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44e3df
mov eax, dword [0x477964]
cmp eax, esi
je 0x44e3df
push dword [ebp - 4]
push eax
call fcn.0044301a
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x47795c]
call fcn.0044301a
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x451e2a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4738c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00451dbf
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043e310
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x451e79
cmp dword [ebp - 0x1c], 5
jb 0x451e91
jmp 0x451e8d
cmp dword [ebp - 0x10], 1
jne 0x451e91
cmp dword [ebp - 0x1c], 4
ja 0x451e8d
jne 0x451e91
cmp dword [ebp - 0x18], 0
jbe 0x451e91
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x46306c
call fcn.00451cb0
test eax, eax
jge 0x451eb2
mov byte [0x47808c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043c7fe
add ebp, 0x78
leave
ret
Function at 0x40134c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor ecx, ecx
push esi
cmp dword [ebp + 0xc], ecx
jle 0x401383
mov eax, dword [ebp + 8]
lea esi, [ecx + eax]
movzx eax, byte [ecx + eax]
mov edx, eax
and edx, 0xf
shr eax, 4
mov dl, byte [edx + 0x403044]
shl dl, 4
or dl, byte [eax + 0x403044]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov byte [esi], dl
jl 0x40135a
mov eax, dword [str.H_e]
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x10], eax
jle 0x4013f6
push ebx
push edi
and byte [ebp - 1], 0
xor edi, edi
mov ebx, edi
lea edx, [edi + edi]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 2
shl ebx, 2
mov eax, dword [ebp - 0x10]
mov ecx, ebx
sar eax, cl
mov ecx, edx
add ebx, 0x10
and al, 1
shl al, cl
mov ecx, eax
mov eax, dword [ebp + 8]
xor byte [esi + eax], cl
mov al, byte [esi + eax]
mov cl, dl
shr al, cl
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
and al, 1
shl al, cl
or byte [ebp - 1], al
inc edx
dec dword [ebp - 0xc]
jne 0x4013ac
inc edi
cmp edi, 4
jl 0x40139a
mov ecx, dword [ebp + 8]
mov al, byte [ebp - 1]
mov byte [esi + ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x401394
pop edi
pop ebx
mov eax, esi
dec esi
test eax, eax
je 0x40140e
mov eax, dword [ebp + 8]
add eax, esi
mov cl, byte [eax]
xor cl, 0x5d
add cl, 0x2d
mov byte [eax], cl
jmp 0x4013f6
xor eax, eax
test esi, esi
setne al
dec eax
pop esi
leave
ret 8
Function at 0x401720
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x401740
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x40172c
add dl, dl
jne 0x40174b
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x40179c
xor eax, eax
add dl, dl
jne 0x401758
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x401839
add dl, dl
jne 0x401767
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x401772
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40177d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x401788
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x401792
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x401737
mov eax, 1
add dl, dl
jne 0x4017aa
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4017b5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4017a1
sub eax, ebx
mov ebx, 1
jne 0x4017e8
mov ecx, 1
add dl, dl
jne 0x4017ce
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4017d9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4017c5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x401737
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4017ff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x40180a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4017f6
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x401737
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x40185a
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x401737
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x402d14
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402d51
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402d71
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405300
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402fb8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x403011
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402e54
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402e54
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402ffb
inc ebx
jmp 0x402fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403018
lea eax, [ebp - 8]
call fcn.00405090
ret

Function at 0x403020
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405090
test esi, esi
jne 0x403057
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00405180
jmp 0x403078
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402e54
mov dword [esp], eax
test esi, esi
je 0x403078
cmp dword [ebx], 0
je 0x403078
dec esi
jmp 0x40305f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403778
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x551008], 0x8088405
inc edx
mov dword [ebx + 0x551008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403fc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x551024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404060
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404040
xor eax, eax
push ebp
push 0x404039
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40407c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404040
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x551024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x551024], ax
mov esp, ebp
pop ebp
ret
Function at 0x4075dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x407642
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00405300
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403914
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40762c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407649
lea eax, [ebp - 0x10]
call fcn.00405090
ret

Function at 0x40e384
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e3bd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00405180
jmp 0x40e3c6
mov eax, ebx
mov edx, esi
call fcn.004050e4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e3d0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e3f1
mov al, byte [esp]
jmp 0x40e3f3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40f420
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f4f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405128
lea eax, [ebp - 8]
call fcn.004055bc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040556c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40f4e0
mov eax, ebx
call fcn.00402b08
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40f4d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040556c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40f4c3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40f508
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40f4c3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f4e0
mov eax, dword [ebp - 0x10]
call fcn.00402b38
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f4fd
lea eax, [ebp - 8]
call fcn.00405090
ret