joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410d30
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4554b8]
test esi, esi
jle 0x410e50
mov eax, dword [0x4554bc]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x410d64
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x410de7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x410d50
mov dword [esp], ebx
call fcn.004116c0
mov edi, eax
test eax, eax
je 0x410e77
mov eax, dword [0x4554bc]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004117d0
mov edx, dword [0x4554bc]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x410e57
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x410de0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x410df0
add dword [0x4554b8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4554bc]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x410de0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00410cd0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x410d6e
mov eax, dword [0x4554bc]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00410cd0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00410cd0
lea esi, [esi]
nop

Function at 0x411330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4554d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4554cc]
sub esp, 4
test ebx, ebx
je 0x411385
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41137e
test esi, esi
je 0x41137e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x411360
mov dword [esp], 0x4554d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4119f0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x4554d0]
test eax, eax
jne 0x4113b0
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x411410
mov eax, dword [esp + 0x20]
mov dword [esp], 0x4554d4
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4554cc]
mov dword [0x4554cc], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x4554d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x41140b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x411a20
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x424ce0
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x424cf0
xor eax, eax
ret
jmp 0x4113a0

Function at 0x411a60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x411aa0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x411ac8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x426db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x43bef9
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x43bf5d]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.00411940
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.00438ab8
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x43a1c4], 0
jne 0x426ed6
mov byte [0x43a1c4], 1
call fcn.00437db0
test eax, eax
je 0x426ea4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.004108d0
mov dword [esp], 2
mov esi, dword [fcn.004249e0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x426e94
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x43beb9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4389d8
jmp 0x4389d0
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x426e5a
mov dword [esp], 2
call dword [0x43a12c]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4389cb
mov dword [esp], 2
call dword [0x43a12c]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
call fcn.00408a13
call fcn.004083c0
call fcn.00408049
call fcn.00407e90
call fcn.00407e72
call fcn.00407de9
call fcn.00407551
call fcn.00406580
call fcn.00405791
call fcn.00405529
call fcn.00404bf5
call fcn.0040486d
push dword [0x40e4d0]
call fcn.00405548
push 7
push 0x40d278
lea eax, [0x40e4d0]
push eax
push 8
call fcn.00405497
push 0x40e4c8
push 0x40d280
push 7
push 0x401
push 8
call fcn.0040a8bd
mov edx, 0x40d095
lea ecx, [0x40e3f0]
call fcn.00404068
mov edx, 0x40d12b
lea ecx, [0x40e4b4]
call fcn.00404068
mov edx, 0x40d19a
lea ecx, [0x40e41c]
call fcn.00404068
mov edx, 0x40d1df
lea ecx, [0x40e460]
call fcn.00404068
mov edx, 0x40d21a
lea ecx, [0x40e488]
call fcn.00404068
mov edx, 0x40d025
lea ecx, [0x40e464]
call fcn.00404068
mov edx, 0x40d142
lea ecx, [0x40e3f4]
jmp loc.0041158e

Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.00408055
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
push dword [esp + 0x14]
pop eax
call fcn.00407ff0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403370
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
call fcn.0040ac40
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
mov dword [esp + 0xc], 2
jmp 0x403382
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403382
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e47c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e3e0], eax
mov eax, 1
jmp 0x4033b5
push dword [esp + 4]
call fcn.0040aca0
add esp, 0xc
pop ebx
ret 4
Function at 0x2983293b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x2983294a
pop dword [ebp - 0x4c]
mov eax, 0x2983294a
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x47ddaf9b
add dword [ebp - 0x5c], 0x67495b0
mov dword [ebp - 0x58], 0xc553ed9d
sub dword [ebp - 0x58], 0x9320a158
mov dword [ebp - 0x54], 0xa4d1b0a
add dword [ebp - 0x54], 0x41ff2924
mov dword [ebp - 0x50], 0xb3ec13a9
sub dword [ebp - 0x50], 0xb3ec13a9
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x11df08a3
sub eax, 0xe85ac7ab
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xf1f0e03
add dword [ebp - 0x5c], 0x65535b53
mov dword [ebp - 0x58], 0xe1b6fce1
sub dword [ebp - 0x58], 0xa04a9b6c
mov dword [ebp - 0x54], 0x8d11e054
sub dword [ebp - 0x54], 0x29a273e8
mov dword [ebp - 0x50], 0xfacbed4e
add dword [ebp - 0x50], 0x53412b2
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x5519ce7e
sub eax, 0x2b958d8e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x42ebf
push 0
call eax
mov ecx, 0xdfc10f3c
sub ecx, 0xdfc0cd3d
xor edi, edi
add edi, eax
mov edx, 0x684594d8
sub edx, 0x3ebdd4d8
add edx, dword [ebp - 0x4c]
mov esi, 0xa2869de5
add esi, 0xc6724e02
sub dword [ebp - 0x34], 0xecc7161b
mov ebx, dword [edx]
xor dword [ebp - 0x10], edx
add ebx, esi
xor dword [ebp - 0xc], 0xa7a5e960
mov dword [edi], ebx
mov dword [ebp - 0x14], 0xf86d8570
add edi, 0xa8a7464e
sub edi, 0xa8a7464a
add edx, 0x39259116
sub edx, 0x39259112
loop 0x29832a69
add eax, 0xb6c85632
sub eax, 0xb6c75b63
mov ebx, eax
add eax, 0x617f4cc3
add eax, 0x9e80b342
mov ecx, 0xaa51c1fe
add ecx, 0x7f2e3e02
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40302c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402ecc
mov esi, eax
cmp dword [0x407ee8], 0xffffffff
je 0x40308d
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407ee4]
jne 0x40308d
lea eax, [ebp - 0x1c]
push eax
push dword [0x407ee4]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407ef0], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407ef4], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4031a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x408a48
call fcn.00406638
mov esi, dword [eax]
push 0x408a48
call fcn.00406638
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405ea0
call fcn.00405d1c
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00405da8
call fcn.00404630
test eax, eax
jne 0x4032e5
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405e80
call fcn.00404630
test eax, eax
jne 0x40325b
cmp word [ebp - 0x190], 0x5a4d
jne 0x40325b
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405dc4
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405e80
jmp 0x403265
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405dc4
call fcn.00404630
test eax, eax
jne 0x4032c9
cmp word [ebp - 0x190], 0x4550
jne 0x4032c9
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405e80
call fcn.00404630
test eax, eax
jne 0x4032c9
cmp dword [ebp - 0x288], 0x4550
jne 0x4032c9
cmp word [ebp - 0x22c], 3
jne 0x4032c9
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.00405df4
push 0x408a40
call fcn.00406638
mov dword [eax], 0
push 0x408a48
call fcn.00406638
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40333c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402ecc
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x4033e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407f88], 0
je 0x403402
mov eax, dword [0x407f88]
mov dword [ebp - 4], eax
jmp 0x403497
push 0x104
call fcn.00404704
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.004041cc
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x403447
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.00403378
mov esi, eax
inc esi
push esi
call fcn.004041cc
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.00404764
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x403478
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x403485
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00405224
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407f88], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403574
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00405198
xor eax, eax
mov bl, 0
cmp dword [0x407f2c], 0
jne 0x4035c2
push 0x407c7c
push 1
call fcn.00402dd8
mov dword [0x407f2c], eax
cmp dword [0x407f2c], 0
jne 0x4035db
push 0x8000
call fcn.00404704
mov esi, eax
mov bl, 1
jmp 0x403615
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407f2c]
test eax, eax
jne 0x403605
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x40363e
push esi
push 0x8000
push 0xff
call fcn.00405280
push esi
push 0x24
push 0
call fcn.00405280
mov eax, esi
add eax, 0xc
push eax
call fcn.004047ec
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4039ec
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
call fcn.00403978
lea edx, [ebp - 0x400]
movzx ecx, word [ebp + 0x14]
dec ecx
xor esi, esi
jmp 0x403a24
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov word [edx + 2], ax
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov word [edx], ax
inc dword [ebp + 0x18]
add edx, 4
inc esi
cmp ecx, esi
jge 0x403a0a
mov ax, word [ebp + 0x14]
mov word [ebp - 0x404], ax
mov word [ebp - 0x402], 1
mov word [ebp - 0x408], 0
mov word [ebp - 0x406], 0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x410], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40e], ax
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0x14]
add ecx, eax
dec ecx
mov word [ebp - 0x40c], cx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40a], ax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push eax
push dword [0x407ee4]
call sub.kernel32.dll_WriteConsoleOutputA
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403dcc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x403dec
mov al, byte [ebp - 4]
jmp 0x403def
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406158
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
or edi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
xor esi, esi
mov edx, dword [0x4082dc]
add edx, 0x24
mov esi, edx
cmp dword [edx], 0xffffffff
je 0x406196
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x406191
mov ecx, dword [edx + 8]
cmp ecx, dword [esi + 8]
jbe 0x406191
mov esi, edx
add edx, 0x10
jmp 0x40617a
mov edx, esi
cmp dword [edx], 0xffffffff
je 0x4062aa
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x4062aa
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x4062a8
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
je 0x4062a8
mov cl, byte [edx]
sub cl, 0x3c
jne 0x4061de
jmp 0x4062a8
sub cl, 3
jne 0x4061f8
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x4062a3
inc cl
jne 0x40620c
movzx ecx, word [edx + 1]
add edi, ecx
add edx, 3
jmp 0x4062a3
inc cl
jne 0x406220
movzx ecx, word [edx + 1]
add edi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x406233
movzx ecx, byte [edx]
shr ecx, 6
add edi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x40623d
mov esi, eax
mov dword [ebp - 0x24], edi
cmp eax, dword [ebp + 0x10]
jl 0x40629a
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x406250
cmp byte [ebp - 0x25], 0
jne 0x406298
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x14]
jle 0x406286
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + ecx]
xor dl, 0xaa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [eax + ecx], dl
jmp 0x406261
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add esi, dword [ebp - 0x18]
mov eax, esi
jmp 0x4062aa
jmp 0x4062a8
mov esi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x25], 0
jmp 0x4061d0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406780
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.0040675c
call fcn.00403574
mov dword [0x4082dc], eax
lea edx, [eax + 0x18]
mov dword [0x40833c], edx
pop edx
call fcn.004065dc
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x408308], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40831c], eax
mov dword [0x408344], eax
call fcn.004031a4
cmp eax, 3
setb byte [0x4082e5]
call fcn.004041c4
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x406a0c
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x402b38
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x468008], 0x8088405
inc edx
mov dword [ebx + 0x468008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x468024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403028
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403008
xor eax, eax
push ebp
push 0x403001
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403044
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403008
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x468024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x468024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46a048], 0
je 0x403d4d
cmp word [0x46a21c], 0xd7b2
jne 0x403d15
cmp dword [0x46a224], 0
jbe 0x403d15
mov eax, 0x46a218
call dword [0x46a234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x468070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d74
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x468034], 0
jne 0x403d69
push 0
push 0x468068
push 0x468070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret