joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074dc
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10036b0
call fcn.010076c4
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1007519
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1007519
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1007531
cmp eax, 0x20b
je 0x100751e
mov dword [ebp - 0x1c], ebx
jmp 0x1007545
cmp dword [ecx + 0x84], 0xe
jbe 0x1007519
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x100753f
cmp dword [ecx + 0x74], 0xe
jbe 0x1007519
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100aed4], 0xffffffff
or dword [0x100aed8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100aed0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100aecc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100aedc], eax
call fcn.010076c0
cmp dword [0x100808c], ebx
jne 0x10075a0
push fcn.010076c0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010076ae
push 0x100119c
push 0x1001198
call sub.msvcrt.dll__initterm
mov eax, dword [0x100aec8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x100aec4]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001194
push 0x1001190
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x1007636
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100760a
cmp al, 0x22
jne 0x10075fc
cmp byte [esi], 0x22
jne 0x1007613
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100761d
cmp al, 0x20
jbe 0x100760f
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x1007641
movzx eax, word [ebp - 0x48]
jmp 0x1007644
cmp byte [esi], 0x20
jbe 0x1007613
inc esi
mov dword [ebp - 0x34], esi
jmp 0x1007636
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1007661
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1007696
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010076fd
ret
Function at 0x1005960
Capabilities:
Initialize winsock library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x198
cmp dword [0x1009f00], 0
mov eax, dword [0x100913c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], 0x64
jne 0x10059a7
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x1009f00], 1
lea eax, [ebp - 0x198]
push eax
push esi
push 0
push 0x1c
push edi
call dword [sym.imp.WS2_32.dll_WSAAddressToStringW]
test eax, eax
je 0x10059d2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x10015c0
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.0100646d
leave
ret 8

Function at 0x1006c7d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x1006c93
or dword [ebp + 0x18], 0xffffffff
push ebx
mov ebx, dword [sym.imp.ntdll.dll_sprintf]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x13e]
cmp edi, eax
mov dword [ebp - 0x10], eax
jae 0x1006d57
mov cl, byte [esi]
mov al, cl
inc esi
and al, 0xc0
mov byte [ebp + 0xb], cl
jne 0x1006d03
movzx eax, cl
push eax
push 0x1001f10
push edi
mov dword [ebp - 0xc], eax
call ebx
add edi, eax
add esp, 0xc
cmp byte [ebp + 0xb], 0
mov dword [ebp - 8], edi
je 0x1006daa
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + esi]
cmp eax, dword [ebp + 0x18]
jae 0x1006d63
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
add dword [ebp - 8], ecx
mov edi, dword [ebp - 8]
jmp 0x1006d4c
cmp al, 0xc0
jne 0x1006d96
cmp esi, dword [ebp + 0x18]
jae 0x1006d76
xor eax, eax
mov ah, cl
mov al, byte [esi]
inc esi
movzx eax, ax
push eax
push 0x1001f08
push edi
mov dword [ebp + 8], eax
call ebx
add esp, 0xc
add edi, eax
cmp dword [ebp + 0x14], 0
je 0x1006d90
cmp dword [ebp - 4], 0
jne 0x1006d3a
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
xor eax, 0xc000
add eax, dword [ebp + 0x14]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x1006d7e
cmp edi, dword [ebp - 0x10]
mov esi, eax
jb 0x1006cb3
push 0x1001ed8
push edi
call ebx
pop ecx
pop ecx
jmp 0x1006da5
movzx eax, byte [ebp + 0xb]
push esi
push eax
push 0x1001e9c
push edi
call ebx
add esp, 0x10
jmp 0x1006da5
push esi
push 0x1001e68
jmp 0x1006d9f
push eax
lea eax, [esi - 2]
push eax
push 0x1001e34
push edi
call ebx
add esp, 0x10
jmp 0x1006da8
mov byte [edi], 0
inc edi
jmp 0x1006daa
movzx eax, cl
push eax
push 0x1001e18
push edi
call ebx
add esp, 0xc
mov esi, dword [ebp + 0x10]
add edi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1006db3
mov dword [eax], edi
cmp dword [ebp - 4], 0
je 0x1006dbc
mov esi, dword [ebp - 4]
pop edi
mov eax, esi
sub eax, dword [ebp + 0x10]
pop esi
pop ebx
leave
ret 0x14

Function at 0x414de7
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], ebx
add eax, eax
add ecx, 4
and edi, eax
or eax, edi
cmp ecx, esi
jne fcn.00414de7
add edx, edi
dec edx
sub edi, edi
ret
Function at 0x401378
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionStructuredQuery
mov ebp, esp
push ebx
xor ebx, ebx
sub esp, 0x34
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov al, byte [edx]
test al, al
je 0x4013a8
sub eax, 0x30
cmp al, 9
jbe 0x4013a5
or dword [0x41201c], 0x367febb2
jmp 0x4013a8
inc edx
jmp 0x40138c
mov eax, dword [0x411d84]
xor ecx, ecx
add eax, 0x1de2091d
mov dword [0x41216c], eax
mov eax, dword [0x411df4]
mov ebx, dword fs:[0x30]
xor eax, 0x9537d9e5
mov dword [ebp - 0xc], ecx
mov dword [0x411d84], eax
call fcn.0040be94
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1e
mov dword [esp], 0xffffffff
call fcn.00401083
test eax, eax
js 0x40140f
cmp dword [ebp - 0x14], 0
jne 0x4014af
mov eax, dword [0x411df4]
xor edx, edx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], edx
add eax, 0x4bcc7a9
mov dword [esp + 4], 0x1f
mov dword [0x41201c], eax
lea eax, [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp], 0xffffffff
call fcn.00401083
or eax, dword [ebp - 0x10]
je 0x4014af
mov eax, dword [0x41216c]
mov dword [esp], 0xffffffff
and eax, 0xfb1e4f60
mov dword [0x411d84], eax
imul eax, dword [0x411df4], 0xb902d247
mov dword [0x41201c], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [0x410be8]
call dword [eax + 0x3c]
push eax
push eax
cmp byte [ebx + 2], 1
je 0x4014af
cmp dword [ebp - 0xc], 0
mov ebx, dword [0x412198]
je 0x4014b6
imul ebx, ebx, 0x4fbf1f7
mov eax, dword [0x41216c]
and eax, 0x654963cf
mov dword [0x41201c], ebx
mov dword [0x411df4], eax
mov eax, 0x2500
jmp 0x40151c
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionStructuredQuery
mov ecx, 0xbe6
movzx eax, byte [edx]
inc edx
test al, al
je 0x4014ff
add ecx, eax
cmp ecx, 0x1b6f
jbe 0x4014c0
imul eax, ebx, 0x6584044c
mov dword [esp + 4], 0x4138f4
add ebx, 0x81d5596
mov dword [esp], str.filename_too_long
mov dword [0x41216c], eax
call fcn.0040da9c
mov dword [0x411df4], ebx
jmp 0x40150b
or ebx, 0x269e644f
mov dword [0x412198], ebx
mov eax, dword [0x41216c]
or eax, 0x9e7b297e
mov dword [0x41201c], eax
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x409f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [0x411d9c]
lea esi, [ebx - 0xca9f043]
mov dword [0x4120cc], esi
cmp byte [eax + str.sd_Deva_IN], 0
je 0x409fa4
inc eax
cmp eax, 0x1bc3
jne 0x409f80
call fcn.0040e67c
mov eax, ebx
and eax, 0x9475d892
mov dword [0x412078], eax
jmp 0x409fab
cmp eax, 0x1712
jle 0x409fbb
mov dword [esp + 4], esi
mov dword [esp], 0x413a80
call fcn.0040d828
call fcn.0040e44c
mov eax, dword [0x412078]
sub ebx, 0x372e25ed
xor eax, 0xe8d2d959
mov dword [str.pD], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x409fd7
or ebx, 0xc9e2dc38
xor edi, edi
mov dword [0x411d9c], ebx
xor ebx, ebx
mov esi, dword [0x411d9c]
call fcn.0040e44c
mov edx, dword [str.pD]
xor edx, 0x5aad5606
mov dword [str.pD], edx
mov dword [ebp - 0x11c], edx
call fcn.0040e44c
mov edx, dword [ebp - 0x11c]
mov dword [esp], 0x413714
mov eax, esi
or eax, 0x7b357ec9
or esi, 0x33353c88
imul edx, edx, 0x1f691b5b
mov dword [0x4120cc], eax
imul esi, esi, 0xb1f471ab
mov dword [esp + 4], edx
mov dword [0x411d9c], edx
call fcn.0040d828
mov eax, ebx
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [0x412078], esi
movzx eax, byte [eax + edx]
movzx edx, cl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov byte [ebp + edi - 0x118], cl
cmp ebx, 0x100
jne 0x409ff6
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
xor ecx, ecx
xor ebx, ebx
add eax, edi
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], edi
je 0x40a152
mov esi, dword [str.pD]
mov dword [esp + 8], 0x413a80
inc ebx
mov dword [esp + 4], 0x412b98
movzx ebx, bl
mov eax, esi
mov dword [esp], str.hresult
imul esi, esi, 0xf214bd95
xor eax, 0x6dbfebc8
mov dword [ebp - 0x120], ecx
sub eax, 0x632d6b10
mov dword [0x411d9c], eax
call fcn.0040d258
mov al, byte [ebp + ebx - 0x118]
mov ecx, dword [ebp - 0x120]
mov dword [0x412078], esi
or esi, 0x1d5bf9c8
add ecx, eax
mov dword [str.pD], esi
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x118]
mov byte [ebp + ebx - 0x118], dl
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor byte [edi], al
inc edi
jmp 0x40a0b1
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a63c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d71e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [0x4a9338]
push edi
push 0x4c2030
push 0x6a
push 0
mov dword [ebp - 0x28], ecx
call esi
push eax
call dword [0x4a933c]
mov edi, eax
test edi, edi
je 0x40a700
push edi
push 0
call esi
push eax
call dword [0x4a9334]
test eax, eax
je 0x40a700
push eax
call dword [0x4a9330]
push edi
push 0
mov ebx, eax
call esi
push eax
call dword [0x4a932c]
mov ecx, dword [ebp - 0x28]
mov edi, eax
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x20]
push 0x4c2040
add ecx, 8
push ecx
push eax
call fcn.0040f194
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40a6bf
mov eax, dword [eax]
push 0x4c2038
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00483d26
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.00402806
cmp dword [ebp - 0x24], 0
je 0x40a700
push dword [ebp - 0x24]
push edi
push 1
push ebx
call fcn.00484d4a
push dword [ebp - 0x24]
mov esi, eax
call fcn.00484786
add esp, 0x14
cmp esi, edi
jne 0x40a700
mov al, 1
jmp 0x40a702
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047b6e2
leave
ret 4

Function at 0x40b44d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x4d71e4]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0x4c2374
mov dword [esp + 0xc], ebx
lea eax, [esi + 8]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0040f194
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40b489
mov eax, dword [eax]
push 0x4c236c
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00483d26
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.00402806
cmp dword [esp + 8], ebx
jne 0x40b4af
xor al, al
jmp 0x40b501
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x58]
call fcn.004160d2
push dword [esp + 8]
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
push dword [esp + 0x20]
cmovae eax, dword [esp + 0x14]
push 1
push eax
call fcn.00484d4a
add esp, 0x10
push dword [esp + 8]
cmp eax, dword [esp + 0x20]
je 0x40b4ee
call fcn.00484786
jmp 0x40b4f5
call fcn.00484786
mov bl, 1
pop ecx
lea ecx, [esp + 0xc]
call fcn.00402889
mov al, bl
mov ecx, dword [esp + 0x3c]
pop esi
pop ebx
xor ecx, esp
call fcn.0047b6e2
mov esp, ebp
pop ebp
ret 4
Function at 0x43d361
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x43d38f
cmp eax, edi
jge 0x43d383
push esi
call fcn.004389ae
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x43d3b2
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x43d398
mov dword [esi + 8], edx
jmp 0x43d3c7
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x43d3bd
xor dl, dl
jmp 0x43d3c2
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x43d3b2
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x43d400
mov dword [0x4db770], str.zlib_corrupt
xor eax, eax
jmp 0x43d445
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x43d415
mov dword [0x4db770], str.read_past_buffer
jmp 0x43d3fc
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x43d42f
push edi
push ecx
push esi
call fcn.00440672
add esp, 0xc
test eax, eax
je 0x43d3fc
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0047d8b0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x44498d
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, cl
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
mov dword [edx], ecx
mov ecx, dword [edx + 8]
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x446dfc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x446e0a
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x446ec9
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
sub edi, 1
jne 0x446e22
pop edi
test esi, esi
je 0x446ee5
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4ad360]
inc edx
sub esi, 1
jne 0x446ecd
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x46ef9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d71e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x46eff3
cmp byte [esi + 0x3d], bl
je 0x46eff3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x46f02c
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x46f004
sub eax, 1
je 0x46f007
dec eax
sub eax, 1
jne 0x46f02c
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047b6e2
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x46f024
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00484d4a
add esp, 0x10
cmp edi, eax
jne 0x46f02c
cmp byte [esi + 0x3d], bl
sete al
jmp 0x46eff5
xor al, al
jmp 0x46eff5
Function at 0x474d8d
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebp + 0x10]
mov edx, dword [edi + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [esi + eax*4]
movzx eax, cl
add eax, dword [edi + 4]
mov dword [edi], ecx
imul ecx, eax, 0x8088405
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [esi + ecx*4]
mov dword [edi + 8], edx
pop edi
pop esi
pop ebp
ret

Function at 0x492e2b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492ca1
Function at 0x4028dc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403a68
test esi, esi
jne 0x402912
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403b58
jmp 0x402930
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004027f0
mov edi, eax
test esi, esi
je 0x402930
cmp dword [ebx], 0
je 0x402930
dec esi
jmp 0x402919
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x415020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ec8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ea8
xor eax, eax
push ebp
push 0x402ea1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ee4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ea8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x415020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x415020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4038ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x416044], 0
je 0x40394d
cmp word [0x416218], 0xd7b2
jne 0x403915
cmp dword [0x416220], 0
jbe 0x403915
mov eax, 0x416214
call dword [0x416230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41506c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403974
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x415030], 0
jne 0x403969
push 0
push 0x415064
push 0x41506c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404b7c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404dac
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404bff
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404dac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404bff
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404dc8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404c88
xor eax, eax
push ebp
push 0x404c81
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004049c4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404c66
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404de8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404c66
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c88
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404da2
cmp byte [ebp - 0xd], 0
jne 0x404ccf
cmp byte [ebp - 0x12], 0
je 0x404da2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404ce8
dec ebx
cmp byte [ebx], 0x2e
je 0x404cf7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404ce7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404da2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404d34
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404da2
cmp byte [ebp - 0xd], 0
je 0x404da2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404da2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret