joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416294
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x424]
sub esp, 0x4a4
mov eax, dword [0x42fd70]
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0x42c]
xor eax, ebp
test esi, esi
mov dword [ebp + 0x420], eax
mov dword [ebp + 4], esi
je 0x4163dd
cmp dword [ebp + 0x434], 0
je 0x4162dd
push esi
call fcn.00416072
pop ecx
mov dword [ebp + 8], eax
jmp 0x4163dd
push ebx
push edi
xor eax, eax
mov byte [ebp + 0xc], 0
mov ecx, 0x104
lea edi, [ebp + 0xd]
rep stosd dword es:[edi], eax
mov ebx, 0x410
push ebx
lea eax, [ebp + 0xc]
push eax
push str..htm
mov edi, SysReAllocStringLen
push edi
call fcn.00416216
add esp, 0x10
test eax, eax
jne 0x4163c1
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._shellopencommand
lea eax, [ebp + 0xc]
push eax
call esi
push ebx
lea eax, [ebp + 0xc]
push eax
push eax
push edi
call fcn.00416216
add esp, 0x10
test eax, eax
jne 0x4163db
mov ebx, dword [sym.imp.MSVCR71.dll__mbsstr]
lea eax, [ebp + 0xc]
push str.__1_
push eax
call ebx
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x416378
lea eax, [ebp + 0xc]
push 0x4263b4
push eax
call ebx
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x416378
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax + 0xb]
jmp 0x41637b
mov byte [edi], 0
push 0x4263b0
push edi
call esi
push dword [ebp + 4]
push edi
call esi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x80]
call fcn.00415fcb
push dword [ebp + 0x430]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x7c]
cmp dword [ebp - 0x80], eax
je 0x4163db
push dword [ebp - 0x80]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
jmp 0x4163db
push dword [ebp + 0x430]
xor eax, eax
push eax
push eax
push esi
push str.explore
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp + 8], eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x420]
mov eax, dword [ebp + 8]
xor ecx, ebp
pop esi
call fcn.0041ee69
add ebp, 0x424
leave
ret
Function at 0x4172d2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x420e1d
call fcn.0041ee80
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
and dword [ebp - 4], 0
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
add edi, 0x4c
push edi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x419d73
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42106e
call fcn.0041ee80
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41a08c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42fd70]
xor eax, ebp
cmp dword [ecx], 0xffffffff
mov dword [ebp - 4], eax
je 0x41a0cc
call fcn.00419f2d
push 7
lea ecx, [ebp - 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x41a0cc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR71.dll_atoi]
pop ecx
jmp 0x41a0ce
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ee69
leave
ret

Function at 0x41ab80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x42fd70]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
xor eax, ebp
push edi
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x41abb2
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x41ac32
push esi
push eax
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x41abc9
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x41ac31
push esi
push dword [ebp - 0x18]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41abf0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x424c6c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41ac01
push esi
call dword [sym.imp.MSVCR71.dll_free]
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jmp 0x41ac30
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0041a14c
push esi
call dword [sym.imp.MSVCR71.dll_free]
lea esi, [ebp - 0x10]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0041ee69
leave
ret
Function at 0x41ebed
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x428430
call fcn.0041edec
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x41ec2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ec2d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41ec45
cmp eax, 0x20b
je 0x41ec32
mov dword [ebp - 0x1c], ebx
jmp 0x41ec59
cmp dword [ecx + 0x84], 0xe
jbe 0x41ec2d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x41ec53
cmp dword [ecx + 0x74], 0xe
jbe 0x41ec2d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x43021c], 0xffffffff
or dword [0x430220], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4301d4]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x4301d0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x430218], eax
call fcn.0041ef4e
call fcn.0041efee
cmp dword [0x42fd74], ebx
jne 0x41ecb9
push fcn.0041efee
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0041efdc
push 0x42f038
push 0x42f034
call sub.MSVCR71.dll__initterm
push 0x41ef92
call fcn.0041ea7c
mov eax, dword [0x4301cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4301c8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x41ed0d
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x42f030
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x41ed8b
cmp al, bl
je 0x41ed37
cmp dword [ebp - 0x20], ebx
jne 0x41ed8b
mov al, byte [esi]
cmp al, bl
je 0x41ed47
cmp al, 0x20
ja 0x41ed47
inc esi
mov dword [ebp - 0x24], esi
jmp 0x41ed37
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x41ed63
movzx eax, word [ebp - 0x54]
jmp 0x41ed66
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.0041f172
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x41ed83
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x41ede0
cmp al, 0x22
jne 0x41ed9a
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x41edad
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x41ed25
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0041ee27
ret
Function at 0x10001270
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x10011020]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 1
push 0x1c
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x100012cc
push str.C:Program_Files
lea eax, [esp + 0xc]
push 0x104
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
mov esi, dword [sym.imp.MSVCR90.dll_wcscat_s]
push str.9eMobileLogs
lea ecx, [esp + 0xc]
push 0x104
push ecx
call esi
add esp, 8
mov edx, esp
mov dword [esp + 8], esp
push edx
lea ecx, [esp + 0x10]
call fcn.100067c0
call sub.OSUtil.dll_Ordinal_16
push str.AndroidServer.log
lea eax, [esp + 0x10]
push 0x104
push eax
call esi
add esp, 0x10
push str.AndroidServer
push str.append_for_AndroidServer
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x100114e4
call dword [sym.imp.Log.dll_public:_bool___thiscall_CLog::open_log_wchar_t_const___wchar_t_const___wchar_t_const__]
mov ecx, dword [esp + 0x210]
test al, al
setne al
pop esi
xor ecx, esp
call fcn.10009c3c
add esp, 0x210
ret

Function at 0x10001410
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push ebp
push str.readx_my:_sock_d_wanted_d_n
mov dword [esp + 0x1c], eax
call fcn.100013b0
mov ebx, dword [sym.imp.MSVCR90.dll__errno]
add esp, 0xc
jmp 0x10001444
mov esi, dword [esp + 0x1c]
test esi, esi
jbe 0x100014d5
mov ecx, dword [esp + 0x10]
push 0
push esi
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10001476
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x1000c544
call fcn.100013b0
add esp, 8
jmp 0x10001488
test eax, eax
jle 0x10001486
sub esi, eax
add dword [esp + 0x10], eax
mov dword [esp + 0x1c], esi
jmp 0x10001444
jge 0x100014be
call ebx
mov esi, eax
call ebx
mov edx, dword [esi]
push edx
mov edi, eax
call dword [sym.imp.MSVCR90.dll_strerror]
push eax
mov eax, dword [edi]
push eax
push ebp
push str.readx_my:_sock_d_error__d:__s_n
call fcn.10001350
add esp, 0x14
call ebx
cmp dword [eax], 0x2714
je 0x10001440
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
push ebp
push str.readx_my:_sock_d_disconnected_n
call fcn.100013b0
add esp, 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x100014e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
test edi, edi
jbe 0x10001587
mov esi, dword [sym.imp.MSVCR90.dll__errno]
nop
mov ecx, dword [esp + 0x10]
push 0
push edi
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1000152a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.send_error:__d_n
call fcn.100013b0
add esp, 8
jmp 0x1000153c
test eax, eax
jle 0x1000153a
sub edi, eax
add dword [esp + 0x10], eax
mov dword [esp + 0x1c], edi
jmp 0x1000157b
jge 0x1000158f
call esi
mov edi, eax
call esi
mov edx, dword [edi]
push edx
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_strerror]
push eax
mov eax, dword [ebx]
push eax
push ebp
push str.writex_my:_sock_d_error__d:__s_n
call fcn.100013b0
add esp, 0x14
call esi
cmp dword [eax], 0x2714
je 0x1000157b
call esi
cmp dword [eax], 0x2733
jne 0x1000159d
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [esp + 0x1c]
test edi, edi
ja 0x10001500
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push ebp
push str.writex_my:_sock_d_disconnected_n
call fcn.100013b0
add esp, 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret

Function at 0x100015b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x1008
call fcn.1000a650
mov eax, dword [0x10011020]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x1010]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recv]
push esi
push edi
mov edi, dword [esp + 0x1018]
mov dword [esp + 0xc], eax
push edi
push str.read_and_dump__:_pre_adb_read_fd_d__n
call fcn.100013b0
push 0xfff
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call sub.MSVCR90.dll_memset
add esp, 0x14
push 0
push 0x1000
lea edx, [esp + 0x18]
push edx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001633
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x1000c544
call fcn.100013b0
add esp, 8
or esi, esi
push esi
push edi
push str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
call fcn.100013b0
add esp, 0xc
test esi, esi
je 0x10001656
jge 0x1000166e
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0x2714
je 0x100015e3
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10009c3c
add esp, 0x1008
ret
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
call dword [0x1000c118]
jmp 0x100015e3
Function at 0x10001690
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x10011020]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100016d8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_function_failed_with_error:__ld_n
call fcn.100013b0
add esp, 8
or eax, esi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10009c3c
add esp, 0x18
ret
mov eax, 2
push str.127.0.0.1
mov word [esp + 8], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x13ad
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea ecx, [esp + 8]
push ecx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10001742
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.connect_function_failed_with_error:__ld_n
call fcn.100013b0
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10009c3c
add esp, 0x18
ret
push str.Connected_to_server._n
call fcn.100013b0
mov ecx, dword [esp + 0x18]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.10009c3c
add esp, 0x18
ret
Function at 0x100093e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100093f7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10009428
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10009424
cmp esi, eax
jae 0x10009428
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10009414
cmp esi, eax
jb 0x1000942e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x10009c3c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011020]
jne 0x10009c46
repz ret
jmp fcn.1000a1b2
Function at 0x402dc8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402e05
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402e25
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404f0c
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403030
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x403089
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402ecc
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402ecc
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x403073
inc ebx
jmp 0x40305c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403090
lea eax, [ebp - 8]
call fcn.00404c9c
ret

Function at 0x403098
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404c9c
test esi, esi
jne 0x4030cf
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404d8c
jmp 0x4030f0
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402ecc
mov dword [esp], eax
test esi, esi
je 0x4030f0
cmp dword [ebx], 0
je 0x4030f0
dec esi
jmp 0x4030d7
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4036ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4ed008], 0x8088405
inc edx
mov dword [ebx + 0x4ed008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403cb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4ed024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403d50
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403d30
xor eax, eax
push ebp
push 0x403d29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403d6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4ed024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4ed024], ax
mov esp, ebp
pop ebp
ret
Function at 0x404a94
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f404c], 0
je 0x404af5
cmp word [0x4f4220], 0xd7b2
jne 0x404abd
cmp dword [0x4f4228], 0
jbe 0x404abd
mov eax, 0x4f421c
call dword [0x4f4238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4ed074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404b1c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ed034], 0
jne 0x404b11
push 0
push 0x4ed06c
push 0x4ed074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402b90
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4f404d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404c18
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406d60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406dc6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404f0c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403708
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406db0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406dcd
lea eax, [ebp - 0x10]
call fcn.00404c9c
ret

Function at 0x409cb8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040515c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409cd1
test al, 0x10
jne 0x409cd5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409e6c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040515c
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x409e80
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0040515c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409ea2
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40d150
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d189
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404d8c
jmp 0x40d192
mov eax, ebx
mov edx, esi
call fcn.00404cf0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d19c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d1bd
mov al, byte [esp]
jmp 0x40d1bf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret