joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419427
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor edx, eax
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
shr ecx, 8
mov edx, dword [edx*4 + 0x420600]
xor edx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
add ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shr ecx, 0x18
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
shr edx, 8
mov eax, dword [eax*4 + 0x420600]
xor eax, edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x419bd3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dl, byte [ecx + 0x2d]
test edx, edx
je 0x419cb5
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x3c], 0
je 0x419c25
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x40]
cmp edx, dword [ebp + 0xc]
jae 0x419c25
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x3c], 0
jne 0x419c51
mov edx, dword [ebp + 0xc]
shl edx, 1
push edx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x3c], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x419c7a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x419cac
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
mov cl, byte [edx + eax]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x30
push edx
call fcn.004194dd
add esp, 8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
jmp 0x419c71
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x20], 0
je 0x419d0e
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x28]
jb 0x419cdd
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x30000
xor eax, eax
jmp 0x419d43
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx + 0x24]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 0xc]
jmp 0x419d43
mov edx, dword [ebp - 0x18]
cmp dword [edx + 4], 0
je 0x419d37
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
jmp 0x419d43
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41a39e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x84], 0
je 0x41a45e
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x8c]
cmp eax, dword [edx + 0x88]
jb 0x41a3d2
xor eax, eax
jmp 0x41a4cc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x88]
sub eax, dword [edx + 0x8c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jbe 0x41a3f5
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp - 0x10]
add edx, dword [eax + 0x8c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x8c]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0041924c
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 4]
jmp 0x41a4cc
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x7c], 0
je 0x41a4c0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41a48f
xor eax, eax
jmp 0x41a4cc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0041924c
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 8]
jmp 0x41a4cc
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x705b7fc7
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6bca7d38
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1004dcd
Capabilities:
Packed with generic packer

Disassembly:
inc eax
or byte [eax], al
add byte [eax], dh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
xor al, 0x14
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax + 8], dl
add byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [edx], al
add byte [eax], al
add al, 0
add byte [eax], al
push eax
or byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax + eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0
add byte [eax], al
add byte [eax], al
rcl byte [ecx], 0
add byte [esi], al
add byte [eax], al
jl 0x1004de2
adc dword [eax], eax
add al, byte [eax]
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add al, dl
or dword [eax], eax
xchg esp, eax
add al, byte [eax]
add byte [eax], al
mov al, byte [0x27230009]
add byte [eax], al
add al, ah
or dword [eax], eax
add byte [edx + 7], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
ficom word [eax]
add byte [eax], dh
inc ebp
add byte [eax], al
add byte [eax], dh
adc dword [eax], eax
js 0x1004ddf
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x180009], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
je 0x1004f10
js 0x1004f21
add byte [eax], al
add byte [eax], al
inc eax
or byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [esi], bh
or byte [eax], al
jb 0x1004f87
popal
Function at 0x1004e20
Capabilities:
Packed with generic packer

Disassembly:
inc eax
or byte [eax], al
add byte [eax], dh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
xor al, 0x14
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax + 8], dl
add byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [edx], al
add byte [eax], al
add al, 0
add byte [eax], al
push eax
or byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax + eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0
add byte [eax], al
add byte [eax], al
rcl byte [ecx], 0
add byte [esi], al
add byte [eax], al
jl 0x1004de2
adc dword [eax], eax
add al, byte [eax]
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add al, dl
or dword [eax], eax
xchg esp, eax
add al, byte [eax]
add byte [eax], al
mov al, byte [0x27230009]
add byte [eax], al
add al, ah
or dword [eax], eax
add byte [edx + 7], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
ficom word [eax]
add byte [eax], dh
inc ebp
add byte [eax], al
add byte [eax], dh
adc dword [eax], eax
js 0x1004ddf
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x180009], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
je 0x1004f10
js 0x1004f21
add byte [eax], al
add byte [eax], al
inc eax
or byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [esi], bh
or byte [eax], al
jb 0x1004f87
popal
Function at 0x406116
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], eax
push esi
lea ecx, [ebp - 2]
push edi
push eax
lea eax, [ebp - 8]
push eax
push 2
push ecx
push dword [ebp + 8]
call dword [0x43249c]
test eax, eax
je 0x406141
cmp dword [ebp - 8], 2
jne 0x406141
mov ax, word [ebp - 2]
mov esi, dword [ebp + 0x14]
shr ax, 5
mov cx, word [ebp - 2]
shl cx, 0xb
or ax, cx
mov cx, word [ebp + 0x10]
mov word [ebp - 2], ax
mov ax, word [esi]
xor word [ebp - 2], ax
cmp word [ebp - 2], cx
ja 0x406141
mov cx, ax
xor ebx, ebx
shr cx, 0xf
push ebx
add ax, ax
mov dword [ebp - 8], ebx
or cx, ax
lea eax, [ebp - 8]
mov word [esi], cx
push eax
movzx eax, word [ebp - 2]
inc eax
mov edi, dword [ebp + 0xc]
cdq
sub eax, edx
sar eax, 1
add eax, eax
push eax
push edi
push dword [ebp + 8]
call dword [0x43249c]
test eax, eax
je 0x406141
movzx eax, word [ebp - 2]
inc eax
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax*2]
cmp ecx, dword [ebp - 8]
jne 0x406141
mov ecx, edi
test eax, eax
jle 0x406132
mov ax, word [ecx]
mov dx, ax
shr dx, 7
shl ax, 9
or dx, ax
mov word [ecx], dx
mov ax, word [esi]
xor ax, dx
mov word [ecx], ax
add ecx, 2
mov ax, word [esi]
inc bx
lea edx, [eax*4]
add byte [esi - 0x3f], ah
call 0xd04bc72c
movzx eax, word [ebp - 2]
mov word [esi], dx
inc eax
cdq
sub eax, edx
movzx edx, bx
sar eax, 1
cmp eax, edx
jg 0x4060eb
invalid
movzx eax, word [ebp - 2]
mov byte [eax + edi], 0
mov eax, 1
jmp 0x406143
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40847a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, dword [0x41583c]
mov ebp, esp
sub esp, 0xc
push esi
push edi
push eax
call fcn.004085c1
add esp, 4
lea ecx, [ebp - 0xc]
xor edi, edi
push 0xc
push dword [ebp + 8]
push ecx
call fcn.00411048
add esp, 0xc
lea esi, [ebp + edi - 0xc]
call fcn.004085a8
inc edi
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00408540
add esp, 4
cmp edi, 0xc
jl 0x4084a3
mov eax, dword [0x4159c8]
movzx cx, byte [ebp - 1]
test byte [eax + 0x28], 2
je 0x4084dc
mov ax, word [0x417ad6]
shr ax, 8
jmp 0x4084e4
mov eax, dword [0x417adc]
shr eax, 0x18
movzx eax, ax
movzx ecx, cx
cmp ecx, eax
je 0x4084f5
mov eax, 0xffffffff
jmp 0x40853a
mov eax, dword [0x41fcb4]
cmp dword [0x417b84], eax
jge 0x40850a
mov esi, dword [0x417b84]
jmp 0x408510
mov esi, dword [0x41fcb4]
mov edi, dword [0x41fd24]
mov eax, esi
dec esi
test eax, eax
je 0x408538
call fcn.004085a8
xor byte [edi], al
movzx eax, byte [edi]
push eax
inc edi
call fcn.00408540
add esp, 4
mov eax, esi
dec esi
test eax, eax
jne 0x40851d
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408540
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov edx, 0xff
xor eax, dword [0x417978]
mov ecx, dword [0x417978]
shr ecx, 8
and eax, edx
mov eax, dword [eax*4 + 0x415090]
xor eax, ecx
mov dword [0x417978], eax
and eax, edx
add dword [0x41797c], eax
mov eax, dword [0x41797c]
imul eax, eax, 0x8088405
inc eax
mov ecx, dword [0x417980]
shr ecx, 8
mov dword [0x41797c], eax
shr eax, 0x18
xor eax, dword [0x417980]
and eax, edx
mov eax, dword [eax*4 + 0x415090]
xor eax, ecx
mov dword [0x417980], eax
mov eax, dword [esp + 4]
ret

Function at 0x40c5b9
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4159fc], 0
push esi
push edi
jne 0x40c651
push 1
mov eax, dword [0x41fcb0]
push 0x2000
push eax
call fcn.0040d4e1
add esp, 0xc
mov dword [0x41fcb4], eax
cmp eax, 0xffffffff
je 0x40c651
mov eax, dword [0x41fcb0]
mov ecx, dword [0x4159c8]
mov dword [0x41fd24], eax
test byte [ecx + 0x28], 1
je 0x40c63a
mov edi, dword [0x417b84]
inc edi
cmp edi, dword [0x41fcb4]
jl 0x40c612
mov edi, dword [0x41fcb4]
mov esi, dword [0x41fcb0]
mov eax, edi
dec edi
test eax, eax
je 0x40c63a
call fcn.004085a8
xor byte [esi], al
movzx eax, byte [esi]
push eax
inc esi
call fcn.00408540
add esp, 4
mov eax, edi
dec edi
test eax, eax
jne 0x40c61f
mov ecx, dword [0x41fd24]
dec dword [0x41fcb4]
inc dword [0x41fd24]
movzx eax, byte [ecx]
jmp 0x40c656
mov eax, 0xffffffff
pop edi
pop esi
ret

Function at 0x2068871
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x2067554
movsx di, cl
lea edi, [edi*4 + 0x2053895f]
mov esp, eax
mov di, 0xad7
not edi
bswap di
not di
pushfd
pushfd
movsx di, cl
movzx di, bl
movsx di, al
mov dword [esp], esi
bswap di
pushal
mov esi, edx
pushfd
cld
lea edi, [ecx + eax - 0x40]
mov byte [esp], ch
xchg dword [esp + 0x20], edi
jmp 0x2066c5e
cmp ebp, eax
pushal
mov byte [esp + 0x20], 0x86
push 0x7c115205
lea esp, [esp + 0x28]
jno 0x2066e70
ja 0x2067fe2
shrd cx, sp, 1
bsr dx, bp
mov edx, esp
and cx, bp
lea ecx, [edi + 0x40]
lea eax, [esp - 0x558976a7]
bts di, 9
shl al, 3
shld di, bp, 0xc
sub ecx, edx
pushfd
clc
clc
pop edi
lea eax, [ebp - 0x80]
test cl, 0x17
xor di, di
and al, 0xfc
btr di, di
movzx di, bl
or di, di
sub eax, ecx
jmp 0x20680e2
Function at 0x402a7c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004040a8
test esi, esi
jne 0x402ab2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404198
jmp 0x402ad0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402990
mov edi, eax
test esi, esi
je 0x402ad0
cmp dword [ebx], 0
je 0x402ad0
dec esi
jmp 0x402ab9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d70
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49a008], 0x8088405
inc edx
mov dword [ebx + 0x49a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4031c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x49a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403260
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403240
xor eax, eax
push ebp
push 0x403239
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40327c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403240
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x49a024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x49a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f2c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49d04c], 0
je 0x403f8d
cmp word [0x49d220], 0xd7b2
jne 0x403f55
cmp dword [0x49d228], 0
jbe 0x403f55
mov eax, 0x49d21c
call dword [0x49d238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49a070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403fb4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49a034], 0
jne 0x403fa9
push 0
push 0x49a068
push 0x49a070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4055bc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4057ec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40563f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4057ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40563f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405808
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4056c8
xor eax, eax
push ebp
push 0x4056c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405404
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4056a6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405828
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4056a6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4056c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4057e2
cmp byte [ebp - 0xd], 0
jne 0x40570f
cmp byte [ebp - 0x12], 0
je 0x4057e2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405728
dec ebx
cmp byte [ebx], 0x2e
je 0x405737
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405727
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4057e2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405774
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4057e2
cmp byte [ebp - 0xd], 0
je 0x4057e2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4057e2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret