joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016977
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x268]
push 0x208
push ebx
push eax
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x54]
mov ecx, 0x100033a0
call fcn.10024941
test eax, eax
je 0x10016b04
push esi
push edi
lea eax, [ebp - 0x274]
mov esi, 0x100085e4
push eax
lea eax, [ebp - 0x270]
push eax
push ebx
push 0x20006
push ebx
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x60]
push ebx
push ebx
push eax
movsd dword es:[edi], dword [esi]
push SysReAllocString
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10016ad6
mov esi, 0x10008560
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
inc edi
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push ebx
push ebx
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10016ad6
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x100085c4
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10016ad6
push 0x104
lea eax, [ebp - 0x268]
push eax
push dword [0x10028408]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x268]
push eax
push edi
push ebx
push ebx
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10016ad6
mov esi, 0x1000854c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push edi
push ebx
push 0x100085a4
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10016ad6
mov ebx, edi
cmp dword [ebp - 0x26c], 0
pop edi
pop esi
je 0x10016aed
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x270], 0
je 0x10016b02
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10026d70
mov esp, ebp
pop ebp
ret
Function at 0x10018099
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0xa4]
xor esi, esi
mov ecx, 0x100033a0
mov dword [ebp - 0x2a8], esi
call fcn.10024941
lea edx, [ebp - 0x54]
mov ecx, edi
call fcn.10024941
mov eax, edx
push eax
movzx eax, word [ebp + 8]
push eax
push 0x100086a4
lea eax, [ebp - 0xa4]
push eax
push 0x100086c8
push 0x10008620
lea eax, [ebp - 0x2a4]
push 0x100
push eax
call fcn.1001048c
add esp, 0x20
test eax, eax
js 0x10018155
sub esp, 0x14
lea eax, [ebp - 0x2a4]
lea ecx, [ebp - 0x2a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10025120
mov esi, dword [ebp - 0x2a8]
test eax, eax
jne 0x10018155
push 4
lea eax, [ebp - 0x2ac]
xor edi, edi
push eax
push 4
push 0
push 0x10008644
inc edi
push esi
mov dword [ebp - 0x2ac], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10018157
xor edi, edi
test esi, esi
je 0x10018162
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10026d70
mov esp, ebp
pop ebp
ret 8

Function at 0x1001833a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
xor edi, edi
push ecx
push eax
mov dword [ebp - 0x20c], edi
call fcn.10018176
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], edi
push eax
push 0x2001f
push edi
lea eax, [ebp - 0x204]
mov esi, SysReAllocString
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001839f
mov esi, dword [ebp - 0x208]
jmp 0x100183bf
sub esp, 0x14
lea eax, [ebp - 0x204]
lea ecx, [ebp - 0x20c]
push eax
push esi
call fcn.10025120
mov esi, dword [ebp - 0x20c]
test eax, eax
jne 0x100183e7
mov eax, dword [ebp + 0x14]
push 4
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push 4
push edi
push 0x10009710
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100183e7
xor edi, edi
inc edi
test esi, esi
je 0x100183f2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10026d70
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100186f0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
xor edi, edi
push ecx
push eax
mov esi, edi
call fcn.10009f1f
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], edi
push eax
push 0x2001f
push edi
lea eax, [ebp - 0x204]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001875f
mov esi, dword [ebp - 0x208]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1001875f
inc edi
test esi, esi
je 0x1001876a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026d70
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001feac
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
mov dword [ebp - 0x41c], eax
neg edi
mov dword [ebp - 0x420], ecx
mov esi, 0x80004005
sbb edi, edi
and edi, 0x7fffbffb
add edi, esi
test ebx, ebx
je 0x1001ffdf
and dword [ebx], 0
lea edx, [ebp - 0x20c]
push ecx
mov ecx, eax
call fcn.10020008
mov edi, eax
test edi, edi
js 0x1001ffe3
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
jbe 0x1001ff36
mov edi, esi
jmp 0x1001ffe3
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x7fffbffb
add edi, esi
test eax, eax
je 0x1001ffdf
push 0x10008828
push eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov edi, esi
neg edi
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
test esi, esi
je 0x1001ffdf
lea eax, [ebp - 0x418]
mov ecx, esi
push eax
push 0x10002fb0
push dword [ebp - 0x41c]
call dword [0x10029340]
call esi
mov edi, eax
test edi, edi
js 0x1001ffe3
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x1001ffdf
push dword [ebp - 0x420]
mov esi, dword [eax]
push 0x1000990c
push 0
push eax
mov ecx, dword [esi + 0xc]
call dword [0x10029340]
call dword [esi + 0xc]
mov edi, eax
mov eax, dword [ebp - 0x418]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x10029340]
call esi
test edi, edi
jns 0x1001fff3
cmp dword [ebx], 0
je 0x1001fff3
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebx], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026d70
mov esp, ebp
pop ebp
ret 8
Function at 0x10021efb
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor eax, eax
lea ebx, [esi + 8]
cmp word [edi], ax
jne 0x10021f17
mov dword [ebx], eax
jmp 0x10021f3e
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi + 4]
mov edx, edi
push eax
call fcn.10024de2
mov eax, dword [ebp - 4]
push ebx
lea eax, [edi + eax*2]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esi + 0xc], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100244e3
Capabilities:
Get file size
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
mov ebx, ecx
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100245b0
push edi
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 4], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100267f0
mov edi, eax
pop ecx
test edi, edi
je 0x100245af
push dword [ebp - 4]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x1002454c
push edi
call fcn.100267eb
xor eax, eax
jmp 0x100245ae
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 4], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100267f0
mov dword [ebx + 0x18], eax
pop ecx
test eax, eax
je 0x10024542
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push esi
push esi
push dword [ebp + 0x10]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0xc], eax
cmp eax, 0xffffffff
je 0x100245a6
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
mov dword [ebx + 8], eax
inc esi
push edi
call fcn.100267eb
mov eax, esi
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10025184
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push esi
push edi
push eax
mov edi, ecx
xor ecx, ecx
push 0x2001f
push ecx
push ebx
push dword [edi]
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x218], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10025284
cmp dword [ebp - 0x210], eax
je 0x100251e3
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x220]
push ecx
xor esi, esi
mov dword [ebp - 0x210], eax
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push esi
push eax
jmp 0x1002524a
xor eax, eax
lea ecx, [ebp - 0x210]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.10025184
mov esi, eax
test esi, esi
jne 0x10025284
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1002520d
cmp dword [ebp - 0x210], 0
je 0x10025279
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x210], esi
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp dword [ebp - 0x210], 0
je 0x10025299
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026d70
mov esp, ebp
pop ebp
ret 4

Function at 0x100252ae
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100252f9
cmp dword [ebp - 4], 1
je 0x100252f0
cmp dword [ebp - 4], 2
je 0x100252f0
push 0xd
pop eax
jmp 0x100252f9
mov eax, dword [ebp - 8]
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10026f90
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10026fce
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10026fc6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10026fd0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10026fb6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100270c0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100270d6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x100270f1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x4014a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4014f8
cmp byte [esi + ebx - 1], 0xa
je 0x4014cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x406084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x406094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401c60
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x406094]
movzx eax, al
bt eax, esi
jae 0x401cc0
mov ecx, dword [0x406084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401b65
test byte [0x402018], 8
jne 0x401c00
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x402028], 8
jne 0x401bb0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b34
cmp esi, 3
jbe 0x401b70
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4040e8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401b34
mov ecx, dword [0x406094]
test ecx, ecx
je 0x401ca0
mov dword [esp], 0x402028
call dword [0x406094]
test al, 8
je 0x401b0b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401b0b
mov ebx, dword [0x406094]
test ebx, ebx
je 0x401c80
mov dword [esp], 0x402018
call dword [0x406094]
test al, 8
je 0x401af6
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401afe
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x406094
call sym._load_func.part.0
jmp 0x401abd
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x406094
call sym._load_func.part.0
jmp 0x401c0a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x406094
call sym._load_func.part.0
jmp 0x401bbe
mov eax, 0xffffffff
jmp 0x401b65
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x416213
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00416292
jae 0x41621f
xor ecx, ecx
call fcn.00416292
jae 0x416249
xor eax, eax
call fcn.00416292
jae 0x41625a
mov al, 0x10
call fcn.00416292
adc al, al
jae 0x41623b
jne 0x416287
stosb byte es:[edi], al
jmp 0x416220
call fcn.0041629e
dec ecx
loop 0x416266
mov eax, ebp
call fcn.0041629c
jmp 0x416288
lodsb al, byte [esi]
shr eax, 1
je 0x4162ae
adc ecx, 2
mov ebp, eax
jmp 0x416288
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0041629c
cmp eax, 0x7d00
jae 0x416286
cmp eax, 0x500
jae 0x416287
cmp eax, 0x7f
ja 0x416288
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416220
pop ebp
ret 8
Function at 0x4027a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x403cf8
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403d54
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x403d46
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403d3b
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403d36
mov eax, 0x64
jmp 0x403d4b
call sub.kernel32.dll_GetLastError
call fcn.00402674
xor eax, eax
jmp 0x403d36
mov eax, 0x67
jmp 0x403d4b

Function at 0x403d5c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403db7
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x403da9
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403d9e
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403d99
mov eax, 0x65
jmp 0x403dae
call sub.kernel32.dll_GetLastError
call fcn.00402674
xor eax, eax
jmp 0x403d99
mov eax, 0x67
jmp 0x403dae

Function at 0x403e40
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403e70
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x403e66
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.00402684
or eax, 0xffffffff
jmp 0x403e64
mov eax, 0x67
call fcn.00402674
or eax, 0xffffffff
jmp 0x403e64

Function at 0x4054b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4054ed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403284
jmp 0x4054f6
mov eax, ebx
mov edx, esi
call fcn.00403238
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405500
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405521
mov al, byte [esp]
jmp 0x405523
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406a2c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x406a48
shr eax, 1
xor eax, 0xedb88320
jmp 0x406a4a
shr eax, 1
dec edx
jne 0x406a3b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x406a34
pop esi
ret
Function at 0x406a60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [0x40b558], 0
jne 0x406a7e
call fcn.00406a2c
mov byte [0x40b558], 1
mov eax, edi
test esi, esi
je 0x406aa9
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x406a84
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x407d90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407e15
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x407df8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00407d44
mov eax, dword [ebp - 0xc]
call fcn.00403444
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407dff
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x407e9c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
xor eax, eax
mov dl, byte [ebx]
sub dl, 1
jb 0x407ec8
sub dl, 0x1f
je 0x407ec0
sub dl, 2
je 0x407ebc
jmp 0x407ec4
xor al, 1
jmp 0x407ec4
test al, al
je 0x407ec8
inc ebx
jmp 0x407ea9
inc ebx
cmp byte [ebx], 0x20
je 0x407ec7
mov eax, esi
mov edx, ebx
call fcn.004032c4
pop esi
pop ebx
ret

Function at 0x4080b4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040503c
add esp, 0x104
pop ebx
ret

Function at 0x4081fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4082a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x40828f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x408248
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x40828f
cmp dword [ebp - 0xc], 2
jge 0x40825a
mov eax, dword [ebp - 4]
call fcn.004031a4
mov bl, 1
jmp 0x40828f
mov edx, dword [ebp - 0xc]
dec edx
lea eax, [ebp - 0x10]
call fcn.00403520
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403450
push eax
push 0
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x40828f
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031f4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4082ac
lea eax, [ebp - 0x10]
call fcn.004031a4
ret