joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41064c
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x563310
call fcn.00543196
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x410672
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4106cc
lea ecx, [ebp - 0x10]
call fcn.00402b10
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x572984]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0054abeb
push eax
call fcn.00407878
add esp, 0x14
test esi, esi
je 0x4106bf
push esi
call fcn.0054ab60
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402ee0
mov eax, ebx
call fcn.00543164
ret 8

Function at 0x41d962
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41d9b5
push esi
push dword [ebp + 8]
call fcn.0041db48
mov edi, eax
test edi, edi
je 0x41d9b0
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41d9b0
mov eax, dword [ebp - 8]
jmp 0x41d9c7
mov eax, dword [ebp + 0x10]
jmp 0x41d9c7
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x41e173
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00424f45
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41e1a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.0041e1b9
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42bed2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x42bf28
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42bf01
call fcn.00421710
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x42bf16
call fcn.00421710
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x42bf28
call fcn.00421710
call fcn.00424f45
cmp dword [eax + 0x3c], 0
je 0x42bf3d
push edi
mov ecx, ebx
call fcn.0042b5f5
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0042c123
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x42bf66
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x42bf72
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x433fbc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x433fd5
call fcn.00424f45
mov esi, dword [eax + 0xc]
push 0x578c10
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x434017
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x434017
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x434017
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00434020
jmp 0x434019
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4b9635
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00410592
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4b9671
call fcn.004b9852
mov dword [esi + 0xc], 1
jmp 0x4b9676
call fcn.004b9852
cmp dword [esi], 0
je 0x4b96c1
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x4b969c
push edi
call fcn.00408959
lea ecx, [edi + 1]
push ecx
jmp 0x4b96ab
push 0xff
call fcn.00403040
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040897c
pop edi
jmp 0x4b96e5
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4b96e5
push dword [esi]
push dword [ebp - 4]
call fcn.0042a039
pop esi
leave
ret 0xc
Function at 0x4b97a9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004b9852
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4b97f1
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00408959
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040897c
jmp 0x4b97fc
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042a039
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x509b0e
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0053e47d
call fcn.00424f99
cmp dword [eax + 0x14], 0
jne 0x509b29
mov ecx, esi
pop esi
jmp fcn.00508e32
pop esi
ret

Function at 0x509bfe
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005525b7
pop ecx
test eax, eax
jne 0x509c40
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0041debc
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x509c06
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x525458
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004024e0
call fcn.00424f99
cmp dword [eax + 0x14], 0
jne 0x525473
mov ecx, esi
pop esi
jmp fcn.00524cc9
pop esi
ret

Function at 0x55c4c9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055c01c
Function at 0x58ff86
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bed70]
jne 0x58ff90
repz ret
jmp fcn.00594b0f

Function at 0x592ea0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bed70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0058d3f2
and dword [ebp - 0x14], 0
cmp dword [0x4c165c], 0
mov dword [ebp - 0x18], eax
jne 0x592f53
push 0x49cfbc
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x592ffb
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x49cfb0
push ebx
call edi
test eax, eax
je 0x592ffb
mov esi, dword [fcn.00489c60]
push eax
call esi
push 0x49cfa0
push ebx
mov dword [0x4c165c], eax
call edi
push eax
call esi
push 0x49cf8c
push ebx
mov dword [0x4c1660], eax
call edi
push eax
call esi
push 0x49cf70
push ebx
mov dword [0x4c1664], eax
call edi
push eax
call esi
mov dword [0x4c166c], eax
test eax, eax
je 0x592f53
push 0x49cf58
push ebx
call edi
push eax
call esi
mov dword [0x4c1668], eax
mov eax, dword [0x4c1668]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00489c64]
cmp eax, ecx
je 0x592fac
cmp dword [0x4c166c], ecx
je 0x592fac
push eax
call esi
push dword [0x4c166c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x592fac
test ebx, ebx
je 0x592fac
call edi
test eax, eax
je 0x592fa3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x592fa3
test byte [ebp - 8], 1
jne 0x592fac
or dword [ebp + 0x10], 0x200000
jmp 0x592fdf
mov eax, dword [0x4c1660]
cmp eax, dword [ebp - 0x18]
je 0x592fdf
push eax
call esi
test eax, eax
je 0x592fdf
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x592fdf
mov eax, dword [0x4c1664]
cmp eax, dword [ebp - 0x18]
je 0x592fdf
push eax
call esi
test eax, eax
je 0x592fdf
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c165c]
call esi
test eax, eax
je 0x592ffb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x592ffd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058ff86
leave
ret
Function at 0x40e690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x40e0b0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0041b3d3
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xa4c9504e
jmp 0x40e6f0
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
cmp eax, 0xec002f32
jg 0x40e720
cmp eax, 0xa4c9504e
jne 0x40e6f0
mov eax, 0xec002f33
cmp dword [ebp - 8], 0
je 0x40e6e4
mov eax, 0xc728512
jmp 0x40e6e4
cmp eax, 0x7bad12aa
jg 0x40e750
cmp eax, 0x5a442cf2
jg 0x40e76d
cmp eax, 0x94742db
jg 0x40e78c
cmp eax, 0xec002f33
jne 0x40e6f0
mov dword [ebp - 0x14], 0xb2841a1
jmp 0x40e6f0
cmp eax, 0x7bad12ab
jne 0x40e6f0
mov al, byte [ebp - 1]
test al, al
mov eax, 0x29879a74
jne 0x40e768
mov eax, 0x31aaf636
mov dword [ebp - 0x14], eax
jmp 0x40e6f0
cmp eax, 0x5a442cf3
jne 0x40e6f0
cmp dword [ebp - 0x10], 0
setne byte [ebp - 1]
mov dword [ebp - 0x14], 0x7bad12ab
jmp 0x40e6f0
cmp eax, 0x31aaf635
jg 0x40e7b4
cmp eax, 0x29879a73
jg 0x40e7c1
cmp eax, 0x94742dc
je 0x40e7e7
cmp eax, 0xb2841a1
jne 0x40e7f3
mov dword [ebp - 0x14], 0x5a442cf3
jmp 0x40e6f0
cmp eax, 0x31aaf636
jne 0x40e6f0
jmp 0x40e821
cmp eax, 0x29879a74
jne 0x40e6f0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x14], 0x31aaf636
jmp 0x40e6f0
mov dword [ebp - 0x14], 0x5a442cf3
jmp 0x40e6f0
cmp eax, 0xc728512
jne 0x40e6f0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x14], 0xb2841a1
jmp 0x40e6f0
add esp, 0x2c
pop ebp
ret
Function at 0x410260
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov eax, dword [0x411540]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 0x6efc3812
jmp 0x4102b0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0x60e4da5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
cmp eax, 0x6efc3811
jg 0x4102f0
cmp eax, 0x1a0a65db
jg 0x410310
cmp eax, 0xaaa5d50d
jg 0x41031c
cmp eax, 0x9867b9f2
jne 0x4102b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ba108], eax
call fcn.0041ae3f
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x60e4da5
jmp 0x4102b0
cmp eax, 0x6efc3812
jne 0x4102b0
mov eax, 0xfead6726
cmp dword [ebp - 0xc], 0
je 0x410307
mov eax, 0xaaa5d50e
mov dword [ebp - 0x20], eax
jmp 0x4102b0
cmp eax, 0x1a0a65dc
jne 0x4102b0
jmp 0x410293
cmp eax, 0xaaa5d50e
je 0x41033b
cmp eax, 0xfead6726
je 0x410293
cmp eax, 0x60e4da5
jne 0x4102b0
jmp 0x410395
mov dword [esp], 0
call fcn.004103a0
mov esi, eax
call fcn.00402da0
imul eax, esi
mov dword [esp], eax
call fcn.0041ae62
mov eax, dword [ebp - 0x14]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.00405bd0
mov ecx, dword [ebp - 0x14]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
neg eax
sub edi, eax
mov dword [ebp - 0x18], edi
mov eax, 0x9867b9f2
cmp edi, dword [ebp - 0x1c]
je 0x41038d
mov eax, 0x1a0a65dc
mov dword [ebp - 0x20], eax
jmp 0x4102b0
mov eax, dword [ebp - 0x10]
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
Function at 0x422e8a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cd3f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041fce3
mov dword [ebp - 0x14], eax
cmp dword [0x4cec84], edi
jne 0x422f7b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x422f08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42305b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42305b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42305b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4cec84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4cec88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4cec8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cec94], eax
test eax, eax
je 0x422f78
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cec90], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x422fa0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x422f93
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x422fb5
push 4
pop eax
jmp 0x42305d
cmp dword [ebp - 0x14], edi
je 0x422fb5
push dword [0x4cec84]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x422f9a
mov eax, dword [0x4cec90]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x423013
cmp dword [0x4cec94], esi
je 0x423013
push eax
call ebx
push dword [0x4cec94]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x423013
test eax, eax
je 0x423013
call ecx
test eax, eax
je 0x423008
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x423008
test byte [ebp - 8], 1
jne 0x423013
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x423043
mov eax, dword [0x4cec88]
cmp eax, esi
je 0x423040
push eax
call ebx
test eax, eax
je 0x423040
call eax
mov edi, eax
test edi, edi
je 0x423040
mov eax, dword [0x4cec8c]
cmp eax, esi
je 0x423040
push eax
call ebx
test eax, eax
je 0x423040
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4cec84]
call ebx
test eax, eax
je 0x42305b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42305d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cde9
leave
ret
Function at 0x402dfc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402e55
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402c98
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402c98
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402e3f
inc ebx
jmp 0x402e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e5c
lea eax, [ebp - 8]
call fcn.00404464
ret

Function at 0x402e64
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404464
test esi, esi
jne 0x402e9b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404554
jmp 0x402ebc
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c98
mov dword [esp], eax
test esi, esi
je 0x402ebc
cmp dword [ebx], 0
je 0x402ebc
dec esi
jmp 0x402ea3
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x40310c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x456008], 0x8088405
inc edx
mov dword [ebx + 0x456008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403564
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x456024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035dc
xor eax, eax
push ebp
push 0x4035d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403618
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x456024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x456024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4042e0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x458044], 0
je 0x404341
cmp word [0x458218], 0xd7b2
jne 0x404309
cmp dword [0x458220], 0
jbe 0x404309
mov eax, 0x458214
call dword [0x458230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x456070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404368
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x456034], 0
jne 0x40435d
push 0
push 0x456068
push 0x456070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406124
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40618a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004046d4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403128
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406174
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406191
lea eax, [ebp - 0x10]
call fcn.00404464
ret

Function at 0x40b0d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b10d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404554
jmp 0x40b116
mov eax, ebx
mov edx, esi
call fcn.004044b8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b120
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b141
mov al, byte [esp]
jmp 0x40b143
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b7d8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b640
mov eax, dword [0x456f90]
cmp byte [eax], 0
je 0x40b854
mov eax, dword [0x456dcc]
call fcn.00402f78
call fcn.00402bc4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004088c4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b89c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b88a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x456d80]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x458660]
call fcn.00405590
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c0f8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c1ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004044fc
lea eax, [ebp - 8]
call fcn.00404974
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404924
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c1b8
mov eax, ebx
call fcn.00402a38
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c1b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404924
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c19b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c1e0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c19b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c1b8
mov eax, dword [ebp - 0x10]
call fcn.00402a68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c1d5
lea eax, [ebp - 8]
call fcn.00404464
ret

Function at 0x40c6a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c70c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004046d4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408440
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c713
lea eax, [ebp - 0xc]
call fcn.00404464
ret