joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a890
Capabilities:
Access peb ldr_data
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43168d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x439004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.hgeGUIObject.0
mov dword [edi + 4], 0
mov word [edi + 8], 0
mov byte [edi + 0xa], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x1c], 1
push 0x180
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call sub.hge.dll_hgeCreate
mov dword [0x439b9c], eax
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov word [edi + 0x40], 0
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x34], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0x3f800000
mov dword [edi + 0x64], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x30], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
movss xmm1, dword [ebp + 0xc]
movss xmm0, dword [ebp + 0x10]
mov dword [edi], vtable.Label.0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 4], eax
mov dword [edi + 0x34], 5
mov word [edi + 8], 0x101
mov byte [edi + 0xa], 1
mov eax, dword [ecx + 0xc0c]
mov dword [edi + 0x74], eax
cvttss2si eax, xmm1
mov dword [edi + 0x70], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
mov dword [edi + 0x64], 0x3f800000
movss dword [edi + 0x7c], xmm0
mov dword [edi + 0x44], eax
cvttss2si eax, xmm0
movss xmm3, dword [0x4346bc]
mov dword [edi + 0x48], eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
movss dword [edi + 0x78], xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4346c0]
mov eax, ecx
shr eax, 8
movzx eax, al
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x4346c0]
movzx eax, cl
cvtpd2ps xmm0, xmm0
movd xmm1, eax
divss xmm0, xmm3
cvtdq2pd xmm1, xmm1
movss dword [ebp + 8], xmm0
shr eax, 0x1f
mulss xmm2, xmm3
addsd xmm1, qword [eax*8 + 0x4346c0]
cvtpd2ps xmm0, xmm1
divss xmm0, xmm3
movss dword [ebp + 0x14], xmm0
movaps xmm0, xmm2
call fcn.0042f860
movss xmm0, dword [ebp + 8]
mulss xmm0, dword [0x4346bc]
lea esi, [eax + 0xff00]
shl esi, 8
call fcn.0042f860
movss xmm0, dword [ebp + 0x14]
add esi, eax
mulss xmm0, dword [0x4346bc]
shl esi, 8
call fcn.0042f860
push dword [ebp + 0x18]
add esi, eax
mov ecx, edi
mov dword [edi + 0x68], esi
call fcn.0041af00
mov byte [edi + 0x6c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x41d600
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431887
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x439004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov ecx, dword [0x439730]
push str.Images_Fake.png
call fcn.00428de0
mov dword [esi + 0x24], eax
mov eax, dword [0x439734]
push 1
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x180]
mov dword [esi + 0x28], eax
mov ecx, dword [0x439730]
push 0x434de4
call fcn.00428de0
mov dword [esi + 4], eax
mov ecx, dword [0x439730]
push 0x434de4
call fcn.00428de0
mov dword [esi + 0x20], eax
mov ecx, dword [0x439730]
push str.Images_MiniMapCoveredPixel.png
call fcn.00428de0
mov dword [esi + 0xc], eax
movss xmm3, dword [0x4346bc]
mov ecx, dword [eax + 0xc]
mov eax, ecx
shr eax, 0x18
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4346c0]
mov eax, ecx
shr eax, 8
movzx eax, al
cvtpd2ps xmm4, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm4, xmm3
addsd xmm0, qword [eax*8 + 0x4346c0]
movzx eax, cl
shr ecx, 0x10
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x4346c0]
movzx eax, cl
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm1, xmm3
addsd xmm0, qword [eax*8 + 0x4346c0]
cvtpd2ps xmm0, xmm0
divss xmm0, xmm3
push 0x8c
movss dword [esi + 0x10], xmm0
movss dword [esi + 0x14], xmm2
movss dword [esi + 0x18], xmm1
movss dword [esi + 0x1c], xmm4
call fcn.0042f719
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41d822
sub esp, 0x10
mov ecx, eax
mov dword [esp + 0xc], 0x43c80000
mov dword [esp + 8], 0x44160000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
call fcn.00401410
jmp 0x41d824
xor eax, eax
push 0xffffffffffffffff
push 0xff042139
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
call fcn.004019a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ff90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x439004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.00417a60
lea edx, [ebp - 0x16c]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x41ffb4
push dword [esi]
lea eax, [ebp - 0x68]
push 0x434650
push eax
call fcn.004174e0
lea edx, [ebp - 0x68]
add esp, 0xc
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x41ffe0
lea edi, [ebp - 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41fff0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x16c]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x420010
mov ax, word [0x434654]
mov word [edi], ax
lea eax, [ebp - 0x68]
push 0xa
push eax
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
lea edx, [ebp - 0x68]
add esp, 0xc
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x420040
lea edi, [ebp - 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x420050
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x16c]
pop edi
dec ecx
pop esi
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x420070
mov eax, dword [str..sav]
mov dword [ecx], eax
mov al, byte [0x43465c]
mov byte [ecx + 4], al
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.0042f757
mov esp, ebp
pop ebp
ret 4
Function at 0x4241d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431bc9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x439004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
push 0x8c
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi], eax
call fcn.0042f719
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x4242ad
mov eax, dword [0x439734]
sub esp, 0x10
mov ecx, dword [eax]
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0
push str.Images_Fake.png
push eax
call dword [ecx + 0x184]
push eax
mov ecx, edi
call fcn.00401410
jmp 0x4242af
xor eax, eax
push 0x8c
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x24], eax
call fcn.0042f719
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 1
test edi, edi
je 0x42431c
mov eax, dword [0x439734]
sub esp, 0x10
mov ecx, dword [eax]
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0
push str.Images_Fake.png
push eax
call dword [ecx + 0x184]
push eax
mov ecx, edi
call fcn.00401410
mov dword [esi + 0x28], eax
jmp 0x424323
mov dword [esi + 0x28], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43051f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43055e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43055e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43055e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43055e
cmp dword [ecx + 0x74], 0xe
jbe 0x43055e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x3001086e
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x30010f28
call fcn.30010966
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300128ec
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x3001060d
cmp eax, esi
jne 0x30010600
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30010610
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x300105e7
xor esi, esi
inc esi
mov eax, dword [0x300128e8]
cmp eax, esi
jne 0x30010623
push 0x1f
call fcn.300a2000
pop ecx
jmp 0x30010652
mov eax, dword [0x300128e8]
test eax, eax
jne 0x3001064c
mov dword [0x300128e8], esi
push 0x300012b0
push 0x300012a8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30010652
jmp 0x3001077a
mov dword [0x300125ac], esi
mov eax, dword [0x300128e8]
cmp eax, esi
jne 0x30010676
push 0x300012a4
push 0x30001284
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300128e8], 2
test ebx, ebx
jne 0x30010682
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300128f8], 0
je 0x300106a6
push 0x300128f8
call fcn.30010c6a
pop ecx
test eax, eax
je 0x300106a6
push 0
push 2
push 0
call dword [0x300128f8]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30010702
test al, al
je 0x300106c0
cmp dword [ebp - 0x1c], 0
jne 0x30010702
mov al, byte [esi]
test al, al
je 0x300106d0
cmp al, 0x20
ja 0x300106d0
inc esi
mov dword [ebp - 0x20], esi
jmp 0x300106c0
test byte [ebp - 0x3c], 1
je 0x300106dc
movzx eax, word [ebp - 0x38]
jmp 0x300106df
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x300125a8], eax
cmp dword [0x3001259c], 0
jne 0x30010756
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30010711
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30010724
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x300106ad
cmp dword [0x300125ac], 0
jne 0x30010765
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x300125a8]
jmp 0x30010786
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.300109ab
ret
call fcn.3000ff10
jmp 0x300105ad
Function at 0x411270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov ecx, 0
lea edx, [0x410f50]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
add eax, 0x2c
mov esi, dword [ebp - 0xc]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [ebp - 0x18], ecx
call fcn.0042a607
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x8e5b78e5
mov eax, dword [ebp - 0x14]
mov ecx, eax
sub ecx, 0xb06bde1b
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jg 0x411307
jmp 0x4112f1
mov eax, dword [ebp - 0x1c]
sub eax, 0x8e5b78e5
mov dword [ebp - 0x24], eax
je 0x4113a6
jmp 0x4113a1
mov eax, dword [ebp - 0x1c]
sub eax, 0x5cf19aef
mov dword [ebp - 0x28], eax
jg 0x41138b
jmp 0x41131d
mov eax, dword [ebp - 0x1c]
sub eax, 0x467b6284
mov dword [ebp - 0x2c], eax
jg 0x411375
jmp 0x411333
mov eax, dword [ebp - 0x1c]
sub eax, 0xb06bde1c
mov dword [ebp - 0x30], eax
je 0x411413
jmp 0x411349
mov eax, dword [ebp - 0x1c]
sub eax, 0xb34003dd
mov dword [ebp - 0x34], eax
je 0x4113d0
jmp 0x41135f
mov eax, dword [ebp - 0x1c]
sub eax, 0x20358c70
mov dword [ebp - 0x38], eax
je 0x411433
jmp 0x4113a1
mov eax, dword [ebp - 0x1c]
sub eax, 0x467b6285
mov dword [ebp - 0x3c], eax
je 0x4113f7
jmp 0x4113a1
mov eax, dword [ebp - 0x1c]
sub eax, 0x5cf19af0
mov dword [ebp - 0x40], eax
je 0x4113c4
jmp 0x4113a1
jmp 0x411439
mov eax, 0xb34003dd
mov ecx, 0x5cf19af0
mov edx, dword [ebp - 8]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x411439
mov dword [ebp - 0x14], 0x467b6285
jmp 0x411439
mov eax, dword [ebp - 0x10]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [ebp - 0x14], 0x467b6285
mov dword [ebp - 0x44], eax
jmp 0x411439
mov eax, 0x20358c70
mov ecx, 0xb06bde1c
cmp dword [ebp - 0x10], 0
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x411439
mov eax, dword [ebp - 0x10]
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [ebp - 0x14], 0x20358c70
mov dword [ebp - 0x48], eax
jmp 0x411439
add esp, 0x5c
pop esi
pop ebp
ret
jmp 0x4112d5
Function at 0x43207a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4346c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0042ef07
mov dword [ebp - 0x14], eax
cmp dword [0x47fb90], edi
jne 0x43216b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4320f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43224b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x43224b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43224b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x47fb90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x47fb94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x47fb98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47fba0], eax
test eax, eax
je 0x432168
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47fb9c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x432190
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x432183
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4321a5
push 4
pop eax
jmp 0x43224d
cmp dword [ebp - 0x14], edi
je 0x4321a5
push dword [0x47fb90]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43218a
mov eax, dword [0x47fb9c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x432203
cmp dword [0x47fba0], esi
je 0x432203
push eax
call ebx
push dword [0x47fba0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x432203
test eax, eax
je 0x432203
call ecx
test eax, eax
je 0x4321f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4321f8
test byte [ebp - 8], 1
jne 0x432203
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x432233
mov eax, dword [0x47fb94]
cmp eax, esi
je 0x432230
push eax
call ebx
test eax, eax
je 0x432230
call eax
mov edi, eax
test edi, edi
je 0x432230
mov eax, dword [0x47fb98]
cmp eax, esi
je 0x432230
push eax
call ebx
test eax, eax
je 0x432230
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x47fb90]
call ebx
test eax, eax
je 0x43224b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x43224d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c219
leave
ret
Function at 0x402d40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402d99
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402bdc
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402bdc
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402d83
inc ebx
jmp 0x402d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402da0
lea eax, [ebp - 8]
call fcn.00404274
ret

Function at 0x402da8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404274
test esi, esi
jne 0x402ddf
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404364
jmp 0x402e00
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402bdc
mov dword [esp], eax
test esi, esi
je 0x402e00
cmp dword [ebx], 0
je 0x402e00
dec esi
jmp 0x402de7
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x402f8c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41a008], 0x8088405
inc edx
mov dword [ebx + 0x41a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4033b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41a024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40344c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40342c
xor eax, eax
push ebp
push 0x403425
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403468
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40342c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41a024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41a024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41c044], 0
je 0x404151
cmp word [0x41c218], 0xd7b2
jne 0x404119
cmp dword [0x41c220], 0
jbe 0x404119
mov eax, 0x41c214
call dword [0x41c230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41a070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404178
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41a034], 0
jne 0x40416d
push 0
push 0x41a068
push 0x41a070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405d34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405d9a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044e4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402fa8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405d84
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405da1
lea eax, [ebp - 0x10]
call fcn.00404274
ret

Function at 0x4078d4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404734
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x4078f6
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40a118
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a151
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404364
jmp 0x40a15a
mov eax, ebx
mov edx, esi
call fcn.004042c8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a164
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a185
mov al, byte [esp]
jmp 0x40a187
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b5e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b644
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044e4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004075cc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b64b
lea eax, [ebp - 0xc]
call fcn.00404274
ret
Function at 0x417890
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
push edi
mov dword [0x41d908], 0x10
mov esi, 0x41a3cc
mov edi, 0x41c880
mov ecx, 0x422
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x418a38
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x418a7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0041899c
mov eax, dword [ebp - 4]
call fcn.00404734
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418a85
lea eax, [ebp - 4]
call fcn.00404274
ret

Function at 0x418af0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00407b6c
add esp, 0x104
pop ebx
ret