joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6df5f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74f4a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x834
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
lea edi, [ebx + 8]
mov ecx, 0x1b
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
call fcn.0070273d
mov dword [ebx + 8], eax
mov al, byte [ebx + 0x5a]
add esp, 4
test al, al
je 0x6df65d
mov dword [ebx + 0x98], 0xa
call fcn.007028fe
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [ebx + 0x9c], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x54]
cmp eax, esi
je 0x6df791
mov dl, byte [ecx + 0x64]
test dl, dl
ja 0x6df791
push eax
lea ecx, [ebp - 0x840]
push str.SELECT__FROM_cq_password_WHERE_id_u_LIMIT_1
push ecx
call fcn.0070258b
mov eax, dword [0x7ff318]
add esp, 0xc
cmp eax, esi
jne 0x6df6b5
push 0xc2
push 0x7db568
push str.CWorldKernel::m_pWorld
push str.ASSERT
push 0x793720
call fcn.00401080
add esp, 0x14
mov edx, dword [0x7ff318]
mov ecx, dword [edx + 0x30]
mov eax, dword [ecx]
push 1
lea edx, [ebp - 0x840]
push edx
call dword [eax]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, esi
mov dword [ebp - 4], esi
jne 0x6df6f7
push 0x50
push 0x7dd478
push str.pRes
push str.IF_OK
push 0x793720
call fcn.00401080
add esp, 0x14
jmp 0x6df744
mov edx, dword [edi]
lea eax, [esi + 1]
push eax
mov ecx, edi
mov dword [ebp + 8], eax
call dword [edx + 0x44]
test esi, esi
jl 0x6df714
cmp esi, 0x1a
jge 0x6df714
mov byte [esi + ebx + 0x77], al
jmp 0x6df732
push 0x56
push 0x7dd438
push str.index_0__index_26
push str.CHECK
push 0x793720
call fcn.00401080
add esp, 0x14
mov esi, dword [ebp + 8]
lea eax, [esi + 1]
cmp eax, 0x1b
jl 0x6df6f7
mov ecx, ebx
call fcn.006df830
mov dword [ebx + 0xa0], 0x12c
call fcn.007028fe
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
test edi, edi
mov dword [ebx + 0xa4], edx
mov dword [ebp - 4], 0xffffffff
je 0x6df7d7
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x440]
call fcn.006dfcf0
push 1
push esi
push 0x34
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 1
call fcn.006dfe40
test eax, eax
je 0x6df7c5
lea eax, [ebp - 0x440]
push eax
mov ecx, ebx
call fcn.006df550
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0xffffffff
call fcn.006dfda0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x6dfbb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74f50b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44c
push esi
mov esi, ecx
mov ax, word [esi + 0x58]
mov word [ebp - 0x28], ax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x7ff318]
test eax, eax
jne 0x6dfc27
push 0xc2
push 0x7db568
push str.CWorldKernel::m_pWorld
push str.ASSERT
push 0x793720
call fcn.00401080
add esp, 0x14
mov eax, dword [0x7ff318]
mov ecx, dword [eax + 0x34]
mov edx, dword [ecx]
lea eax, [ebp - 0x28]
push eax
push 0x1c
push 0xc41b
push 1
call dword [edx + 0x1c]
cmp word [esi + 0x58], 0xffff
je 0x6dfca6
lea ecx, [ebp - 0x458]
call fcn.006e1940
push 0
push 0x835
push 0xffffff
push 0
push str.ANSWER_OK
push str.ALLUSERS
push str.SYSTEM
lea ecx, [ebp - 0x458]
mov dword [ebp - 4], 0
call fcn.006e1a50
test eax, eax
je 0x6dfc94
lea ecx, [ebp - 0x458]
push ecx
mov ecx, esi
call fcn.006df550
lea ecx, [ebp - 0x458]
mov dword [ebp - 4], 0xffffffff
call fcn.006e19f0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x6ee010
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x6ee031
mov ecx, dword [esp + 0xc]
mov dword [eax + 0x44], ecx
mov edx, dword [esi + 0x70]
add edx, 4
push 1
push edx
call fcn.007059d8
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10]
mov byte [esi + 6], al
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x6ee053
push eax
push esi
call 0x6ee060
mov edx, dword [esi + 0x10]
push esi
call dword [edx + 0x58]
add esp, 0xc
push 1
call fcn.007058c4
nop
nop
nop
nop
nop
nop
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x28]
mov dword [esi + 0x14], eax
mov eax, dword [eax]
push eax
push esi
mov dword [esi + 0xc], eax
call fcn.006f4410
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push esi
call fcn.006edf90
push esi
mov word [esi + 0x34], 0
mov byte [esi + 0x37], 1
call fcn.006ee0b0
add esp, 0x18
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
pop esi
ret
Function at 0x6eef00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0x10]
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov bl, byte [ebp + 0x14]
mov esi, dword [edi]
xor ebx, 3
test esi, esi
je 0x6eef8c
mov eax, dword [esp + 0x1c]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x1c], eax
jbe 0x6eef8c
cmp byte [esi + 4], 8
jne 0x6eef45
mov eax, dword [esp + 0x14]
lea edx, [esi + 0x68]
push 0xfffffffffffffffd
push edx
push eax
call fcn.006eef00
add esp, 0xc
mov al, byte [esi + 5]
mov ecx, eax
and ecx, 0xff
xor ecx, 3
test ebx, ecx
je 0x6eef68
mov dl, byte [ebp + 0x14]
and al, 0xf8
and dl, 3
mov edi, esi
or dl, al
mov byte [esi + 5], dl
jmp 0x6eef86
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
cmp esi, eax
jne 0x6eef78
mov ecx, dword [esi]
mov dword [ebp + 0x1c], ecx
mov edx, dword [esp + 0x14]
push esi
push edx
call fcn.006eefa0
add esp, 8
mov esi, dword [edi]
test esi, esi
jne 0x6eef1d
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x6f4090
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov eax, ebp
push esi
shr eax, 5
inc eax
push edi
cmp ebp, eax
mov edx, ebp
mov esi, ebp
jb 0x6f40c6
xor ecx, ecx
mov edi, edx
mov cl, byte [ebx + esi - 1]
sub esi, eax
shl edi, 5
add ecx, edi
mov edi, edx
shr edi, 2
add ecx, edi
xor edx, ecx
cmp esi, eax
jae 0x6f40aa
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, edx
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x6f40fc
cmp dword [eax + 0xc], ebp
jne 0x6f40f6
mov esi, ebx
mov ecx, ebp
lea edi, [eax + 0x10]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x6f4111
mov ebx, dword [esp + 0x18]
mov eax, dword [eax]
test eax, eax
jne 0x6f40e0
mov eax, dword [esp + 0x14]
push edx
push ebp
push ebx
push eax
call fcn.006f4140
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x1c]
mov cl, byte [eax + 5]
mov dl, cl
mov bl, byte [esi + 0x14]
and edx, 3
not ebx
test bl, dl
je 0x6f410c
pop edi
xor cl, 3
pop esi
pop ebp
mov byte [eax + 5], cl
pop ebx
ret

Function at 0x702c76
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x702c96
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.007054e3
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x702cb9
test byte [esp + 8], 2
je 0x702cb9
call fcn.00705556
mov dword [eax], 0xd
call fcn.0070555f
mov dword [eax], 5
jmp 0x702c92
xor eax, eax
ret
Function at 0x71b1e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00702820
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x71b2ab
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x71b2ab
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x71b25e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x71b269
or bh, 8
and edi, 0x8000000
je 0x71b284
mov eax, dword [0x802ebc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x71b2ab
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x71b680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x71b6ab
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x71b6cf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x71b6ea
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x71b900
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
push 0x41c
call fcn.00728cf3
mov esi, eax
add esp, 4
test esi, esi
je 0x71ba60
mov al, byte [esp + 8]
mov cl, byte [esp + 0xc]
lea edx, [esi + 0x408]
mov byte [esi + 0x40a], cl
mov cl, byte [esp + 0x14]
push ebx
mov byte [edx], al
mov al, byte [esp + 0x14]
mov byte [esi + 0x40b], al
mov al, byte [esp + 0x1c]
mov byte [esi + 0x409], cl
mov cl, byte [esp + 0x20]
mov byte [esi + 0x40c], al
mov al, byte [esp + 0x24]
mov byte [esi + 0x40e], cl
mov cl, byte [esp + 0x28]
mov byte [esi + 0x40f], al
mov eax, dword [edx]
push ebp
lea ebp, [esi + 4]
push edi
mov byte [esi + 0x40d], cl
mov dword [esi + 0x410], eax
mov dword [esi + 0x414], eax
mov ecx, 0x80
xor eax, eax
mov edi, ebp
mov dword [esi + 0x418], 1
mov dword [esi], 0x763c80
mov dword [esp + 0x18], 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov al, byte [ecx + 1]
xor edi, edi
mov byte [esp + 0x14], al
mov byte [edi + ebp], al
mov eax, dword [esp + 0x14]
xor edx, edx
and eax, 0xff
mov dl, byte [ecx]
xor ebx, ebx
imul edx, eax
mov bl, byte [ecx + 2]
add edx, ebx
imul edx, eax
xor eax, eax
mov al, byte [ecx + 3]
add eax, edx
and eax, 0x800000ff
jns 0x71b9de
dec eax
or eax, 0xffffff00
inc eax
inc edi
mov byte [esp + 0x14], al
cmp edi, 0x100
jl 0x71b9ac
mov eax, dword [esp + 0x18]
add ecx, 4
add ebp, 0x100
dec eax
mov dword [esp + 0x18], eax
jne 0x71b9a3
mov ecx, 0x80
xor eax, eax
lea edi, [esi + 0x204]
rep stosd dword es:[edi], eax
mov ecx, 0xfffffefc
lea eax, [esi + 0x104]
sub ecx, esi
mov edx, dword [eax - 0x100]
mov edi, dword [eax]
xor edx, edi
mov dword [eax + 0x100], edx
mov edx, dword [eax - 0x100]
mov ebp, dword [eax]
add eax, 4
and edx, ebp
mov dword [eax + 0x1fc], edx
lea edx, [ecx + eax]
cmp edx, 0x100
jl 0x71ba1b
xor eax, eax
pop edi
mov word [esi + 0x406], ax
mov word [esi + 0x404], ax
pop ebp
mov eax, esi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x71be30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push 0x41c
call fcn.00728cf3
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x71bf77
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push esi
lea esi, [ebp + 0x408]
mov dword [ebp + 0x40c], ecx
mov dword [ebp + 0x410], eax
mov dword [ebp + 0x414], ecx
mov dword [esi], eax
mov dword [ebp + 0x418], 1
mov dword [ebp], 0x763ca0
lea eax, [ebp + 0x409]
mov ecx, 2
mov bl, 0xad
mov dl, 0xbe
xor byte [eax - 1], 0xde
xor byte [eax], 0xaf
xor byte [eax + 1], bl
xor byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x71be8c
lea edx, [ebp + 4]
push edi
mov ecx, 0x80
xor eax, eax
mov edi, edx
mov dword [esp + 0x18], 2
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, esi
mov al, byte [ecx + 1]
xor esi, esi
mov byte [esp + 0x14], al
mov byte [edi + esi], al
mov eax, dword [esp + 0x14]
xor edx, edx
and eax, 0xff
mov dl, byte [ecx]
xor ebx, ebx
imul edx, eax
mov bl, byte [ecx + 2]
add edx, ebx
imul edx, eax
xor eax, eax
mov al, byte [ecx + 3]
add eax, edx
and eax, 0x800000ff
jns 0x71bef5
dec eax
or eax, 0xffffff00
inc eax
inc esi
mov byte [esp + 0x14], al
cmp esi, 0x100
jl 0x71bec3
mov eax, dword [esp + 0x18]
add ecx, 4
add edi, 0x100
dec eax
mov dword [esp + 0x18], eax
jne 0x71beba
mov ecx, 0x80
xor eax, eax
lea edi, [ebp + 0x204]
rep stosd dword es:[edi], eax
mov ecx, 0xfffffefc
lea eax, [ebp + 0x104]
sub ecx, ebp
pop edi
mov edx, dword [eax]
mov esi, dword [eax - 0x100]
xor edx, esi
mov dword [eax + 0x100], edx
mov edx, dword [eax]
mov ebx, dword [eax - 0x100]
add eax, 4
and edx, ebx
mov dword [eax + 0x1fc], edx
lea edx, [ecx + eax]
cmp edx, 0x100
jl 0x71bf33
xor eax, eax
pop esi
mov word [ebp + 0x406], ax
mov word [ebp + 0x404], ax
mov eax, ebp
pop ebx
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x72c0e5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x72c11d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0072af8f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0072af67
jmp 0x72c129
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x72dee7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x72df29
call fcn.007384d8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, edi
je 0x72df29
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, edi
jne 0x72df20
xor eax, eax
jmp 0x72df31
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0072df37
pop edi
pop esi
pop ebx
ret 4
Function at 0x40293c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402979
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402999
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.00404118
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x402b58
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402b87
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fd0
jmp 0x402ba5
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402a80
mov edi, eax
test ebx, ebx
je 0x402ba5
cmp dword [esi], 0
je 0x402ba5
dec ebx
jmp 0x402b8e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e00
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x513044], 0x8088405
inc edx
mov dword [0x513044], edx
mul edx
mov eax, edx
ret

Function at 0x402ff8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403090
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403070
xor eax, eax
push ebp
push 0x403069
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403070
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e9c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027d0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x513049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403e64
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4061dc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406398
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40623d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4063b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4062af
xor eax, eax
push ebp
push 0x4062a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00406034
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406291
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4063d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062af
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406390
cmp byte [ebp - 0xd], 0
jne 0x4062f1
cmp byte [ebp - 0x12], 0
je 0x406390
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40630a
dec ebx
cmp byte [ebx], 0x2e
je 0x406319
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406309
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406390
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406346
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406390
cmp byte [ebp - 0xd], 0
je 0x406390
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406390
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret