joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e9513a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPDestroyKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPDestroyKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951400
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPEncrypt___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPEncrypt
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951460
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPExportKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPExportKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e9514c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPGenKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPGenKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951520
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPGenRandom___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPGenRandom
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951580
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPGetHashParam___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPGetHashParam
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6e9515e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPGetKeyParam___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPGetKeyParam
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951640
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPGetProvParam___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPGetProvParam
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e9516a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPGetUserKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPGetUserKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPHashData___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPHashData
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951760
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPHashSessionKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPHashSessionKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e9517c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPImportKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPImportKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6e951820
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPReleaseContext___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPReleaseContext
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPSetHashParam___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPSetHashParam
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e9518e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPSetKeyParam___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPSetKeyParam
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951940
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPSetProvParam___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPSetProvParam
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e9519a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPSignHash___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPSignHash
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6e951a00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_CPVerifySignature___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.sccbase.dll
mov dword [ebp - 0x40], str.CPVerifySignature
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6e9536f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x6e9566c4
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x4119f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
and dword [ebp - 4], 0
cld
add bl, ch
pop es
Function at 0x42468c
Capabilities:
Enumerate pe sections

Disassembly:
inc ebp
or byte [ebx - 0x37fcc3b8], cl
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
je 0x4246c3
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4246bb
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4246c5
inc edx
add eax, 0x28
cmp edx, esi
jb 0x4246ab
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, eax
cmp word [edx], 0x5a4d
je 0x401025
or eax, 0xffffffff
jmp 0x4010d2
mov eax, dword [edx + 0x3c]
mov ecx, edx
add eax, ecx
mov ecx, eax
cmp dword [ecx], 0x4550
je 0x40103e
or eax, 0xffffffff
jmp 0x4010d2
mov eax, dword [ecx + 0x78]
mov edx, dword [ebp - 0x10]
lea ecx, [edx + eax]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ebx, eax
test ebx, ebx
jne 0x401066
or eax, 0xffffffff
jmp 0x4010d2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0xc], eax
xor esi, esi
or edi, 0xffffffff
test ebx, ebx
jle 0x4010b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ah, byte [ecx]
sub ah, al
jne 0x4010a3
test al, al
je 0x4010a8
inc edx
inc ecx
jmp 0x401093
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4010b0
mov edi, esi
jmp 0x4010b8
inc esi
or edi, 0xffffffff
cmp esi, ebx
jl 0x40107d
cmp edi, 0xffff
jne 0x4010c5
or eax, 0xffffffff
jmp 0x4010d2
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
mov edx, dword [ebp - 8]
add eax, dword [edx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4010e0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, eax
mov ebx, ecx
cmp word [ebx], 0x5a4d
je 0x4010fa
xor eax, eax
jmp 0x40113e
mov eax, dword [ebx + 0x3c]
mov esi, ebx
add eax, esi
mov esi, eax
cmp dword [esi], 0x4550
je 0x40110f
xor eax, eax
jmp 0x40113e
mov eax, dword [esi + 0x78]
mov ebx, ecx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x1c]
add eax, ebx
mov ebx, eax
mov eax, dword [esi + 0x10]
cmp edx, eax
jb 0x40112e
neg eax
add eax, edx
cmp eax, dword [esi + 0x14]
jbe 0x401132
xor eax, eax
jmp 0x40113e
mov eax, edx
sub eax, dword [esi + 0x10]
mov eax, dword [ebx + eax*4]
mov edi, ecx
add eax, edi
pop edi
pop esi
pop ebx
ret 8
Function at 0x402880
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0
push ebx
push eax
call dword [0x40d044]
test eax, eax
je 0x4028da
push 0x40b111
push ebx
call fcn.004040f0
add esp, 8
mov esi, eax
test eax, eax
je 0x4028da
push esi
mov edx, 0x40e2c8
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4028bc
push eax
push 1
push 0x40e2c8
call fcn.00404500
add esp, 0x10
push esi
call fcn.004042c0
pop ecx
lea ecx, [ebp - 0x800]
mov edx, ebx
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4028e5
pop eax
lea edx, [ebp - 0x800]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4028f9
jmp 0x402903
dec eax
cmp byte [ebp + eax - 0x801], 0x5c
jne 0x402902
lea ecx, [ebp + eax - 0x800]
mov edx, 0x40b10e
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x40291c
pop eax
push 0x32
lea eax, [ebp - 0x400]
push eax
push 0x1002
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x40b10c
lea eax, [ebp - 0x800]
push eax
call fcn.004040f0
add esp, 8
mov esi, eax
test eax, eax
je 0x402976
lea eax, [ebp - 0x400]
push eax
push 0x40b109
push esi
call fcn.00404660
add esp, 0xc
push esi
call fcn.004042c0
pop ecx
push str.aavd9apeJUt
push ebx
call fcn.00401d60
test eax, eax
je 0x402999
push str.JUthnaac9uvdSdSapee
push ebx
call fcn.00401740
test eax, eax
je 0x402999
call fcn.004020b0
cmp byte [0x40d0be], 0
jne 0x4029a8
push ebx
call fcn.00401cc0
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404780
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b5e4
push 0x405948
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x2000000
call fcn.00407c70
pop ecx
mov dword [0x40d27c], eax
call fcn.00404940
test eax, eax
jne 0x4047c7
push 1
call fcn.00405930
pop ecx
mov dword [ebp - 4], 0
call fcn.00405be0
call fcn.00405c50
call fcn.00405ca0
call fcn.00406080
call fcn.00406120
mov ebx, 0x40c4f8
jmp 0x4047f3
call dword [ebx]
add ebx, 4
cmp ebx, 0x40c4f8
jb 0x4047ee
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
call fcn.004061e0
test byte [ebp - 0x34], 1
je 0x404827
movzx edx, word [ebp - 0x30]
jmp 0x40482c
mov edx, 0xa
push edx
push eax
push 0
push ebx
call fcn.00402aa0
mov ebx, eax
mov esi, 0x40c4f8
jmp 0x404844
call dword [esi]
add esi, 4
cmp esi, 0x40c4f8
jb 0x40483f
push ebx
call fcn.00404720
pop ecx
jmp 0x40487d
or dword [ebp - 4], 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x406080
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x4060b2
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00405ef0
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.00403d00
pop ecx
mov esi, eax
test esi, esi
jne 0x4060e5
push 1
call fcn.00405930
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00405ef0
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x40d264], eax
mov dword [0x40d268], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406120
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x40613b
mov ebx, dword [0x40d890]
mov esi, ebx
xor ecx, ecx
jmp 0x40615e
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x406146
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x406159
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x406141
lea eax, [ecx + 1]
push eax
call fcn.00403d00
pop ecx
mov edi, eax
mov dword [0x40d270], eax
cmp dword [0x40d270], 0
jne 0x406185
push 1
call fcn.00405930
pop ecx
mov esi, ebx
jmp 0x4061ba
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x40618e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x4061b5
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4061a5
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x406189
mov byte [edi], 0
cmp ebx, dword [0x40d890]
je 0x4061d1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409840
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x40e300]
cmp ebx, eax
jae 0x40986d
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x40e304]
test byte [edx + eax*8 + 4], 1
jne 0x40987f
mov dword [0x40d334], 9
or eax, 0xffffffff
jmp 0x40999c
push 1
push 0
push ebx
call fcn.00408af0
add esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x4098a7
push 2
push 0
push ebx
call fcn.00408af0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x4098af
or eax, 0xffffffff
jmp 0x40999c
mov eax, dword [ebp + 0xc]
neg edi
add edi, eax
jle 0x409941
push 0x1000
push 1
call fcn.00409e10
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x40993b
push 0x8000
push ebx
call fcn.00409e70
add esp, 8
mov dword [ebp - 8], eax
mov eax, 0x1000
cmp edi, 0x1000
jge 0x4098f2
mov eax, edi
mov edx, eax
push edx
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004074e0
add esp, 0xc
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x409910
or dword [ebp - 0xc], 0xffffffff
jmp 0x409922
mov eax, edi
sub eax, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0xc], 0
test eax, eax
jg 0x4098e3
mov eax, dword [ebp - 8]
push eax
push ebx
call fcn.00409e70
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.004040b0
pop ecx
jmp 0x40998d
or dword [ebp - 0xc], 0xffffffff
jmp 0x40998d
mov dword [ebp - 0xc], 0
test edi, edi
jge 0x40998d
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00408af0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x409966
or dword [ebp - 0xc], 0xffffffff
jmp 0x40998d
push ebx
call fcn.00407980
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0xc], 0
test eax, eax
jne 0x40998d
mov dword [0x40d334], 0xd
or dword [ebp - 0xc], 0xffffffff
push 0
push esi
push ebx
call fcn.00408af0
add esp, 0xc
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40d02c], 0x8088405
inc edx
mov dword [0x40d02c], edx
mul edx
mov eax, edx
ret

Function at 0x4045a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, reloc.kernel32.dll_E
mov ebx, eax
push reloc.kernel32.dll_E
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040458c
add esp, reloc.kernel32.dll_E
pop ebx
ret

Function at 0x40565c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.kernel32.dll_E
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle reloc.kernel32.dll_E
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp reloc.kernel32.dll_E
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4056a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle reloc.kernel32.dll_E
mov al, byte [esp]
jmp reloc.kernel32.dll_E
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406e2c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406e74
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406dc8
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e7b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x40707c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.kernel32.dll_E
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40710a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne reloc.kernel32.dll_E
push reloc.kernel32.dll_E
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp reloc.kernel32.dll_E
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne reloc.kernel32.dll_E
lea eax, [ebp - 4]
call fcn.00403198
jmp reloc.kernel32.dll_E
lea edx, [ebp - 4]
call fcn.00406f40
test ebx, ebx
je reloc.kernel32.dll_E
dec ebx
jmp reloc.kernel32.dll_E
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407111
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x407118
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, reloc.kernel32.dll_E
mov ebx, eax
push reloc.kernel32.dll_E
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405230
add esp, reloc.kernel32.dll_E
pop ebx
ret