joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4078cf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4307cb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x44335c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
cmp dword [ecx + 8], 0xffffffff
mov dword [esp + 0x14], edi
je 0x4079fb
cmp dword [ecx + 8], edi
je 0x4079fb
mov esi, dword [ebp + 0x18]
lea eax, [esp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
mov dword [esp + 0x20], edi
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
jne 0x407998
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x111
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412bcd
push eax
mov ecx, esi
call fcn.0040f03e
lea ecx, [esp + 0x28]
call fcn.00412d2a
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x44], edi
call fcn.00402671
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00412d0e
mov eax, dword [ebp + 8]
jmp 0x407a22
cmp dword [esp + 0x10], esi
sete al
test al, al
jne 0x407a0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x112
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412bcd
push eax
mov ecx, esi
call fcn.0040f03e
lea ecx, [esp + 0x34]
call fcn.00412d2a
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x44], 1
call fcn.00402671
mov ecx, dword [esp + 0x30]
jmp 0x407988
push edi
push dword [ebp + 0x18]
add ecx, 0x10
push dword [ebp + 0x14]
call fcn.0040e3c7
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.00412bcd
push eax
lea ecx, [esi + 8]
call fcn.0040f03e
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40ba7b
Capabilities:
Access the windows event log

Disassembly:
push 0x18
mov eax, 0x4311d9
call fcn.0041bab3
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00412bcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f03e
mov byte [ebp - 4], 1
mov eax, dword [0x446018]
cmp dword [eax - 0xc], ebx
je 0x40baf4
push 0x446018
mov edx, str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x14]
call fcn.0040e2da
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
push ecx
push str.DisplayName
push dword [eax]
mov edx, 0x80000002
lea ecx, [ebp - 0x24]
call fcn.004036da
mov ecx, dword [ebp - 0x1c]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.00412d0e
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], ebx
jne 0x40bb0c
push str.Ninite_Service
lea ecx, [ebp - 0x10]
call fcn.00412822
mov esi, dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
test edi, edi
je 0x40bb3b
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea ecx, [esi - 0x10]
call fcn.00412d0e
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
call fcn.0041ba81
ret

Function at 0x40c540
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea ebx, [ecx + 0x25]
mov dword [ebp - 4], ecx
push 0
mov dword [ebx], 0x3a8
mov dword [ecx + 0x2d], 1
mov dword [ecx + 0x31], 7
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
push 0
push 0x32
call esi
push eax
push 0x31
call esi
push eax
push 1
push 1
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, dword [ebp - 4]
mov dword [esi + 0x39], eax
lea ecx, [esi + 0x3d]
mov eax, dword [esi + 4]
mov dword [esi + 0x29], eax
push dword [0x446010]
call fcn.00411be2
push ebx
xor ebx, ebx
mov dword [esi + 0x35], 0x401
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push ebx
push ebx
push dword [esi + 4]
push 0x40c25b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x446004], eax
test eax, eax
jne 0x40c60a
call fcn.00412501
push ebx
push ebx
mov edx, eax
lea ecx, [ebp - 4]
call fcn.00412019
pop ecx
pop ecx
push ebx
push str.Error
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c6c5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp edi, 1
jne 0x40c703
push ecx
mov ecx, esi
mov dword [esi + 0x3e4], 1
call fcn.0040c540
mov dword [ebx], eax
cmp dword [esi + 0x3e4], 0
je 0x40c75a
xor eax, eax
inc eax
jmp 0x40c7cd
cmp edi, 0x111
jne 0x40c75a
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esi + 0x3e4], 1
cmp eax, 6
je 0x40c749
cmp eax, 0x8004
jne 0x40c755
cmp byte [0x445fc4], 0
jne 0x40c755
lea eax, [esi + 0x25]
push eax
push 2
call ecx
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40c755
lea eax, [esi + 0x25]
push eax
push 2
call ecx
mov byte [esi + 0x24], 1
and dword [ebx], 0
jmp 0x40c6f2
cmp edi, dword [esi + 0x3e0]
jne 0x40c78e
cmp byte [esi + 0x24], 0
mov dword [esi + 0x3e4], 1
jne 0x40c77e
lea eax, [esi + 0x25]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
and dword [ebx], 0
cmp dword [esi + 0x3e4], 0
jne 0x40c6fb
cmp edi, 0x401
jne 0x40c7d4
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x3e4], 1
sub eax, 0x7b
je 0x40c7b4
sub eax, 0x186
je 0x40c7b4
sub eax, 3
jne 0x40c7bb
mov ecx, esi
call fcn.0040c615
and dword [ebx], 0
cmp dword [esi + 0x3e4], 0
jne 0x40c6fb
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
cmp edi, 0x400
jne 0x40c802
mov dword [esi + 0x3e4], 1
lea ecx, [esi + 0x3d]
push dword [0x446010]
call fcn.00411be2
lea eax, [esi + 0x25]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x40c7bb
cmp edi, 2
jne 0x40c7cb
lea eax, [esi + 0x25]
mov dword [esi + 0x3e4], 1
push eax
push edi
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40c7bb
Function at 0x4125fb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x412654
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x412645
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x412641
cmp esi, ecx
jae 0x412645
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x412631
cmp esi, ecx
jb 0x412649
xor eax, eax
jmp 0x412653
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x412d5e
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], vtable.SHA1.0
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x60], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov word [ecx + 0x64], ax
mov eax, ecx
ret
Function at 0x412e1b
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x44335c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x154], esi
xor edi, edi
lea edx, [esi + 0x21]
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
lea edx, [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + edi*4 - 0x144], ecx
inc edi
cmp edi, 0x10
jl 0x412e3e
push 0x40
lea ecx, [ebp - 0x13c]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
dec edx
jne 0x412e75
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
and dword [ebp - 0x158], edx
mov dword [ebp - 0x150], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x148], eax
mov eax, dword [esi + 0x14]
mov esi, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x150]
mov ecx, ebx
not ecx
rol edx, 5
and ecx, esi
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x158]
add edx, ecx
mov ecx, dword [ebp - 0x14c]
add ecx, 0x5a827999
mov dword [ebp - 0x14c], esi
mov esi, edi
mov edi, ebx
add edx, dword [ebp + eax*4 - 0x144]
mov ebx, dword [ebp - 0x150]
add edx, ecx
ror edi, 2
inc eax
push 0x14
pop ecx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x158], eax
cmp eax, ecx
jl 0x412eb8
mov dword [ebp - 0x148], esi
mov eax, esi
xor eax, edi
rol edx, 5
xor eax, ebx
add edx, eax
mov eax, dword [ebp - 0x14c]
add edx, dword [ebp + ecx*4 - 0x144]
add eax, 0x6ed9eba1
add edx, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc ecx
mov dword [ebp - 0x150], edx
cmp ecx, 0x28
jl 0x412f19
push 0x28
pop esi
mov ecx, edi
rol edx, 5
or ecx, ebx
add edx, 0x8f1bbcdc
add edx, dword [ebp - 0x14c]
and ecx, eax
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x148]
add ecx, dword [ebp + esi*4 - 0x144]
mov dword [ebp - 0x14c], eax
add edx, ecx
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc esi
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x150], edx
cmp esi, 0x3c
jl 0x412f64
mov esi, dword [ebp - 0x154]
push 0x3c
pop ecx
xor eax, edi
rol edx, 5
add edx, dword [ebp - 0x14c]
xor eax, ebx
add eax, 0xca62c1d6
add eax, dword [ebp + ecx*4 - 0x144]
add edx, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc ecx
mov dword [ebp - 0x150], edx
cmp ecx, 0x50
jl 0x412fbc
add dword [esi + 0xc], edi
add dword [esi + 0x10], eax
add dword [esi + 8], ebx
add dword [esi + 4], edx
mov eax, dword [ebp - 0x14c]
add dword [esi + 0x14], eax
and dword [esi + 0x60], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418039
mov esp, ebp
pop ebp
ret
Function at 0x41302c
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov byte [eax + esi + 0x20], 0x80
inc dword [esi + 0x60]
cmp eax, 0x37
mov eax, dword [esi + 0x60]
jle 0x413079
jmp 0x41304f
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x40
jl 0x413044
call fcn.00412e1b
jmp 0x413066
mov eax, dword [esi + 0x60]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
cmp dword [esi + 0x60], 0x38
jl 0x41305b
jmp 0x41307e
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x38
jl 0x41306e
mov al, byte [esi + 0x1f]
mov ecx, esi
mov byte [esi + 0x58], al
mov al, byte [esi + 0x1e]
mov byte [esi + 0x59], al
mov al, byte [esi + 0x1d]
mov byte [esi + 0x5a], al
mov al, byte [esi + 0x1c]
mov byte [esi + 0x5b], al
mov al, byte [esi + 0x1b]
mov byte [esi + 0x5c], al
mov al, byte [esi + 0x1a]
mov byte [esi + 0x5d], al
mov al, byte [esi + 0x19]
mov byte [esi + 0x5e], al
mov al, byte [esi + 0x18]
mov byte [esi + 0x5f], al
pop esi
jmp fcn.00412e1b
Function at 0x41560c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x4156a7
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004187d0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
dec edi
jne 0x415660
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
dec edi
jne 0x415685
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x415762
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x4156d4
xor eax, eax
jmp 0x415725
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4156f1
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.004146c6
jmp 0x415709
cmp eax, 2
jne 0x41570d
mov edx, dword [esi]
test edx, edx
jne 0x415700
xor eax, eax
jmp 0x41570a
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00414cce
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.004187d0
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x41574d
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x415762
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x41561d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b27d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44335c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041dd95
mov dword [ebp - 0x14], eax
cmp dword [0x445fa4], esi
jne 0x42b370
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x42b2fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42b450
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x42b450
push 0x4387d8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42b450
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x445fa4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x445fa8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x445fac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x445fb4], eax
test eax, eax
je 0x42b36d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x445fb0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42b395
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42b388
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42b3aa
push 4
pop eax
jmp 0x42b452
cmp dword [ebp - 0x14], esi
je 0x42b3aa
push dword [0x445fa4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42b38f
mov eax, dword [0x445fb0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42b408
cmp dword [0x445fb4], edi
je 0x42b408
push eax
call ebx
push dword [0x445fb4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42b408
test eax, eax
je 0x42b408
call ecx
test eax, eax
je 0x42b3fd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42b3fd
test byte [ebp - 8], 1
jne 0x42b408
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42b438
mov eax, dword [0x445fa8]
cmp eax, edi
je 0x42b435
push eax
call ebx
test eax, eax
je 0x42b435
call eax
mov esi, eax
test esi, esi
je 0x42b435
mov eax, dword [0x445fac]
cmp eax, edi
je 0x42b435
push eax
call ebx
test eax, eax
je 0x42b435
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x445fa4]
call ebx
test eax, eax
je 0x42b450
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x42b452
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418039
mov esp, ebp
pop ebp
ret
Function at 0x40317c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404aac
test esi, esi
jne 0x4031b2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b9c
jmp 0x4031d0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403080
mov edi, eax
test esi, esi
je 0x4031d0
cmp dword [ebx], 0
je 0x4031d0
dec esi
jmp 0x4031b9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403204
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4cf008], 0x8088405
inc edx
mov dword [ebx + 0x4cf008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4039c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4cf024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a5c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a3c
xor eax, eax
push ebp
push 0x403a35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a78
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a3c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4cf024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4cf024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404878
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4df04c], 0
je 0x4048d9
cmp word [0x4df220], 0xd7b2
jne 0x4048a1
cmp dword [0x4df228], 0
jbe 0x4048a1
mov eax, 0x4df21c
call dword [0x4df238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404900
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4cf030], 0
jne 0x4048f5
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4cf034], 0
je 0x404a56
mov edx, esi
mov eax, ebx
call dword [0x4cf034]
jmp 0x404a65
mov eax, 8
call fcn.00402d90
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4df04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4049f8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4063b0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065e0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406433
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065e0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406433
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065fc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4064bc
xor eax, eax
push ebp
push 0x4064b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004061ec
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40649a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40661c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40649a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064bc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4065d6
cmp byte [ebp - 0xd], 0
jne 0x406503
cmp byte [ebp - 0x12], 0
je 0x4065d6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40651c
dec ebx
cmp byte [ebx], 0x2e
je 0x40652b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40651b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4065d6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406568
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4065d6
cmp byte [ebp - 0xd], 0
je 0x4065d6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4065d6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret