joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e750
Capabilities:
Get process image filename

Disassembly:
sub esp, 0x32c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x328], eax
push esi
push edi
push 0x220
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.0042e2e0
push 0x103
lea ecx, [esp + 0x23d]
push 0
push ecx
mov byte [esp + 0x244], 0
call fcn.0042e2e0
add esp, 0x18
call fcn.004077c0
mov edi, dword [esp + 0x338]
push edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x40e856
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e83a
push 0x104
lea edx, [esp + 0x230]
push edx
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameA
push str.Path_Process
call fcn.004073f0
lea eax, [esp + 0x230]
push eax
call fcn.004073f0
lea ecx, [esp + 0x234]
push 0x470190
push ecx
call fcn.0040a580
push 0x470190
call fcn.004073f0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.End_Process
call fcn.004073f0
add esp, 4
jmp 0x40e8bc
pop edi
mov eax, 0x45b5a5
pop esi
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.0042e2c5
add esp, 0x32c
ret
lea edx, [esp + 8]
push edx
push esi
mov dword [esp + 0x10], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x40e88d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.0042e2c5
add esp, 0x32c
ret
lea eax, [esp + 0x128]
push eax
push 0x104
push 0x470190
call fcn.00430055
push 0x470190
call fcn.004073f0
add esp, 0x10
test esi, esi
je 0x40e8bc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x330]
pop edi
pop esi
xor ecx, esp
mov eax, 0x470190
call fcn.0042e2c5
add esp, 0x32c
ret
Function at 0x40e8e0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 0xf003f
push 0
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x40ea3b
mov eax, dword [esp + 0x3c]
push esi
push 0x2c
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40e931
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea ecx, [esp + 0x10]
push ecx
push 0x24
lea edx, [esp + 0x24]
push edx
push 0
push esi
call edi
test eax, eax
je 0x40ea2d
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x40ea2d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 3
jne 0x40e9cb
lea esp, [esp]
mov eax, 0xcccccccd
mul dword [esp + 0x34]
shr edx, 3
cmp edx, 0x3e8
jae 0x40e98b
mov edx, 0x3e8
jmp 0x40e998
cmp edx, 0x2710
jbe 0x40e998
mov edx, 0x2710
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
call edi
test eax, eax
je 0x40ea29
cmp dword [esp + 0x20], 1
je 0x40ea29
call ebp
sub eax, dword [esp + 0x14]
cmp eax, 0x7530
ja 0x40ea29
cmp dword [esp + 0x20], 3
je 0x40e970
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.0040a9a0
add esp, 8
lea eax, [esp + 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40ea29
cmp dword [esp + 0x20], 1
je 0x40ea29
mov ecx, dword [esp + 0x34]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push 0x24
lea eax, [esp + 0x24]
push eax
push 0
push esi
call edi
test eax, eax
je 0x40ea29
cmp dword [esp + 0x20], 1
je 0x40ea29
call ebp
sub eax, dword [esp + 0x14]
cmp eax, 0x7530
ja 0x40ea29
cmp dword [esp + 0x20], 1
jne 0x40e9f2
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x40eb30
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Persist via run registry key

Disassembly:
sub esp, 0x508
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x504], eax
mov eax, dword [esp + 0x50c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [esp + 0x10], eax
xor esi, esi
jmp 0x40eb70
push 0x400
lea ecx, [esp + 0x118]
push 0
push ecx
call fcn.0042e2e0
add esp, 0xc
cmp esi, 4
ja case.default.0x40eb90
jmp dword [esi*4 + 0x40ed24]
lea edx, [esp + 0x114]
push edx
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call fcn.0040b6d0
add esp, 0x10
jmp case.default.0x40eb90
lea eax, [esp + 0x114]
push eax
push str.Common_Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040b6d0
add esp, 0x10
jmp case.default.0x40eb90
lea ecx, [esp + 0x114]
push ecx
push str.AppData
jmp 0x40eba4
push 0x104
lea edx, [esp + 0x118]
push edx
call ebx
jmp case.default.0x40eb90
mov eax, dword [str.C:WindowsSysnative]
mov ecx, dword [0x45c91c]
mov edx, dword [0x45c920]
mov dword [esp + 0x114], eax
mov eax, dword [0x45c924]
mov dword [esp + 0x118], ecx
mov ecx, dword [0x45c928]
mov dword [esp + 0x11c], edx
mov dl, byte [0x45c92c]
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
mov byte [esp + 0x128], dl
lea eax, [esp + 0x114]
push eax
call ebp
test eax, eax
je 0x40ed00
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov eax, edx
push str._s_s
push eax
call fcn.0042e476
add esp, 0x10
lea ecx, [esp + 0x114]
push ecx
call ebp
test eax, eax
je 0x40ed00
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40ed00
push 0xff
push eax
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1d]
push eax
call fcn.0042e2e0
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x24]
push str._s.np4
push edx
call fcn.0042e476
add esp, 0x18
push 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x11c]
push ecx
call edi
test eax, eax
jne 0x40ed00
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x118]
push eax
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x40ed00
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
inc esi
cmp esi, 5
jl 0x40eb70
mov ecx, dword [esp + 0x514]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e2c5
add esp, 0x508
ret
Function at 0x40f0fb
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4MYSQLD.NPAV4.26042018
push str.NPAV4MYSQLD.NPAV4.26042018
push 0x45ca48
push str.MYSQLD.EXE
call fcn.00407310
push 0x103
lea eax, [esp + 0x35]
push 0
push eax
mov byte [esp + 0x3c], 0
call fcn.0042e2e0
push str.WORM.MYSQLD.NPAV4.26042018
push str.MYSQLD.EXE
call fcn.0040a000
mov ebx, dword [0x46f734]
add esp, 0x34
test ebx, ebx
je 0x40f16e
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x10]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x40f110
mov dl, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.MYSQLD.NPAV4.26042018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebx
add esp, 0x1e0
cmp dword [0x470160], 0
jne 0x40f20d
push 0x104
push 0
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.MYSQLD.NPAV4.26042018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
mov eax, dword [str.MYSQLD.EXE]
mov ecx, dword [0x45ca40]
mov dx, word [0x45ca44]
mov dword [0x46f978], eax
mov al, byte [0x45ca46]
add esp, 0x18
cmp dword [0x470144], 0
mov dword [0x46f97c], ecx
mov word [0x46f980], dx
mov byte [0x46f982], al
je 0x40f20d
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x40e710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042e2c5
add esp, 0x10c
ret
Function at 0x40f230
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
call ebx
push 0xf003f
push 0
push 0
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x46f5d0], eax
test eax, eax
je 0x40f371
push 0x2c
push 0x467270
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x469cc0], eax
test eax, eax
jne 0x40f284
mov eax, dword [0x46f5d0]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
pop ebx
add esp, 0x28
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea ecx, [esp + 0xc]
push ecx
push 0x24
lea edx, [esp + 0x18]
push edx
push 0
push eax
call esi
test eax, eax
je 0x40f359
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x40f370
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 3
jne 0x40f2fa
lea ecx, [ecx]
mov eax, dword [esp + 0x2c]
push eax
call edi
mov eax, dword [0x469cc0]
lea ecx, [esp + 0x10]
push ecx
push 0x24
lea edx, [esp + 0x1c]
push edx
push 0
push eax
call esi
test eax, eax
je 0x40f358
cmp dword [esp + 0x18], 1
je 0x40f358
call ebx
sub eax, ebp
cmp eax, 0x3e8
ja 0x40f358
cmp dword [esp + 0x18], 3
je 0x40f2c0
call fcn.0040cb20
mov edx, dword [0x469cc0]
lea ecx, [esp + 0x14]
push ecx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40f358
cmp dword [esp + 0x18], 1
je 0x40f358
mov edi, edi
push 0x64
call edi
mov edx, dword [0x469cc0]
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x1c]
push ecx
push 0
push edx
call esi
test eax, eax
je 0x40f358
cmp dword [esp + 0x18], 1
je 0x40f358
call ebx
sub eax, ebp
cmp eax, 0x3e8
ja 0x40f358
cmp dword [esp + 0x18], 1
jne 0x40f320
pop edi
mov eax, dword [0x469cc0]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
mov ecx, dword [0x46f5d0]
push ecx
call esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x41e3c0
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x28
xor eax, eax
push esi
push eax
push 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41e457
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x41e44c
push edi
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
call fcn.00410800
add esp, 4
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x41e411
pop edi
test esi, esi
je 0x41e457
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x41f290
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x459848
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x468004]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], eax
call fcn.00404080
lea eax, [esp + 0x38]
push eax
mov ecx, 0x470380
mov dword [esp + 0x60], ebp
call fcn.00406370
test eax, eax
je 0x41f461
mov ecx, dword [esp + 0x4c]
mov esi, dword [ecx]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x4c]
cmp edi, ebp
je 0x41f303
cmp edi, dword [esp + 0x38]
je 0x41f308
call fcn.0042dddf
cmp esi, ebx
je 0x41f452
xor eax, eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
cmp edi, ebp
jne 0x41f3fc
call fcn.0042dddf
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f337
call fcn.0042dddf
mov edx, dword [esi + 8]
mov dword [esp + 0x2c], edx
cmp edi, ebp
jne 0x41f403
call fcn.0042dddf
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f357
call fcn.0042dddf
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
push 0x41e460
push ebp
push ebp
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x32
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, ebp
je 0x41f397
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebp
jne 0x41f40a
call fcn.0042dddf
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f3ac
call fcn.0042dddf
inc dword [esi + 0x14]
cmp edi, ebp
jne 0x41f40e
call fcn.0042dddf
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f3c4
call fcn.0042dddf
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esi + 0x10]
cmp ecx, 0xea60
jbe 0x41f3db
mov dword [esp + 0x14], 1
cmp ebx, ebp
je 0x41f412
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 0x103
je 0x41f412
mov dword [esp + 0x14], 1
jmp 0x41f418
mov eax, dword [edi]
jmp 0x41f32d
mov eax, dword [edi]
jmp 0x41f34d
mov eax, dword [edi]
jmp 0x41f3a2
mov eax, dword [edi]
jmp 0x41f3ba
cmp dword [esp + 0x14], ebp
je 0x41f432
push esi
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
call fcn.004033a0
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x41f2f5
cmp edi, ebp
jne 0x41f44e
call fcn.0042dddf
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x41f447
call fcn.0042dddf
mov esi, dword [esi]
jmp 0x41f2f5
mov eax, dword [edi]
jmp 0x41f43d
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0x470380
call fcn.004063e0
lea ecx, [esp + 0x38]
call fcn.004029d0
mov edx, dword [esp + 0x38]
push edx
call fcn.0042d969
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x428710
Capabilities:
Delete file

Disassembly:
sub esp, 0x2c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push str.c:zvinfo_v.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 8]
push 0x45c434
push ecx
call fcn.0042e476
mov edx, dword [esp + 0x44]
xor eax, eax
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
push 0x45c434
push eax
call fcn.0042e476
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0x18
push str.c:zvinfo_v.ini
lea ecx, [esp + 8]
push ecx
push 0x45eb10
push str.info
call esi
push str.c:zvinfo_v.ini
lea edx, [esp + 0x1c]
push edx
push 0x45eb04
push str.info
call esi
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
call fcn.0042e2c5
add esp, 0x2c
ret

Function at 0x42e2c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x468004]
jne 0x42e2cf
repz ret
jmp fcn.00437a8c

Function at 0x442276
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4422a7
call fcn.00430cb6
mov dword [eax], esi
call fcn.00430ca3
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0042ddb9
add esp, 0x14
push 0x16
pop eax
jmp 0x4422fc
test dword [ebp + 0xc], 0xfffffff9
jne 0x442283
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4422d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00430cc9
pop ecx
call fcn.00430ca3
mov eax, dword [eax]
jmp 0x4422fc
test al, 0x10
jne 0x4422fa
test al, 1
je 0x4422fa
test byte [ebp + 0xc], 2
je 0x4422fa
call fcn.00430cb6
mov dword [eax], 5
call fcn.00430ca3
mov dword [eax], 0xd
jmp 0x4422cb
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4517ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004373c8
and dword [ebp - 4], 0
cmp dword [0x4711a0], 0
mov ebx, eax
jne 0x45185d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45190e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45190e
push eax
call fcn.00437356
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4711a0], eax
call esi
push eax
call fcn.00437356
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4711a4], eax
call esi
push eax
call fcn.00437356
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4711a8], eax
call esi
push eax
call fcn.00437356
pop ecx
mov dword [0x4711b0], eax
test eax, eax
je 0x45185d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00437356
pop ecx
mov dword [0x4711ac], eax
mov eax, dword [0x4711ac]
cmp eax, ebx
je 0x4518b5
cmp dword [0x4711b0], ebx
je 0x4518b5
push eax
call fcn.004373d1
push dword [0x4711b0]
mov esi, eax
call fcn.004373d1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4518b5
test edi, edi
je 0x4518b5
call esi
test eax, eax
je 0x4518ac
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4518ac
test byte [ebp - 0xc], 1
jne 0x4518b5
or dword [ebp + 0x10], 0x200000
jmp 0x4518ee
mov eax, dword [0x4711a4]
cmp eax, ebx
je 0x4518ee
push eax
call fcn.004373d1
pop ecx
test eax, eax
je 0x4518ee
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4518ee
mov eax, dword [0x4711a8]
cmp eax, ebx
je 0x4518ee
push eax
call fcn.004373d1
pop ecx
test eax, eax
je 0x4518ee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4711a0]
call fcn.004373d1
pop ecx
test eax, eax
je 0x45190e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x451910
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402df4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4f0008], 0x8088405
inc edx
mov dword [ebx + 0x4f0008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40327c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4f0024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403314
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032f4
xor eax, eax
push ebp
push 0x4032ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403330
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4f0024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4f0024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f304c], 0
je 0x404151
cmp word [0x4f3220], 0xd7b2
jne 0x404119
cmp dword [0x4f3228], 0
jbe 0x404119
mov eax, 0x4f321c
call dword [0x4f3238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4f0070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404178
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4f0034], 0
jne 0x40416d
push 0
push 0x4f0068
push 0x4f0070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406554
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4065ba
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044dc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e10
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4065a4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065c1
lea eax, [ebp - 0x10]
call fcn.0040426c
ret

Function at 0x40bdf8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40be31
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040435c
jmp 0x40be3a
mov eax, ebx
mov edx, esi
call fcn.004042c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40be44
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40be65
mov al, byte [esp]
jmp 0x40be67
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c4ec
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c364
mov eax, dword [0x4f2afc]
cmp byte [eax], 0
je 0x40c568
mov eax, dword [0x4f283c]
call fcn.00402c24
call fcn.00402a70
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409528
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c5b0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c59e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4f27c0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4f3668]
call fcn.00405a4c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret