joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a8234
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe18
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e4], ecx
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040568c
lea esi, [ebp - 0x1d8]
xor eax, eax
push ebp
push 0x5a842d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a83ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c1278]
push dword [eax]
push 0x5a8440
lea eax, [ebp - 0x1e0]
mov edx, dword [ebp - 4]
call fcn.00405b50
push dword [ebp - 0x1e0]
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.00405cac
mov eax, dword [ebp - 0x1dc]
call fcn.005790a0
test al, al
jne 0x5a82db
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a83f7
mov edx, dword [0x5c1278]
mov edx, dword [edx]
lea eax, [ebp - 0x1e4]
mov ecx, 0x5a8458
call fcn.00405c48
mov eax, dword [ebp - 0x1e4]
call fcn.00405bcc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00403348
mov eax, esi
call fcn.004030cc
call fcn.00402ca4
mov eax, ebx
call fcn.004051cc
jmp 0x5a839f
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040397c
mov eax, esi
call fcn.004039e8
call fcn.00402ca4
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00405264
mov edx, dword [ebp - 8]
mov eax, 0x5a8470
call fcn.004057e0
dec eax
jne 0x5a8366
lea eax, [ebp - 8]
mov ecx, 3
mov edx, 1
call fcn.0040573c
lea edx, [ebp - 0x1e8]
mov eax, dword [ebp - 8]
call fcn.005ae9e0
mov edx, dword [ebp - 0x1e8]
lea eax, [ebp - 8]
call fcn.00405264
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0x5a847c
push 0x5a8488
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040555c
mov eax, esi
call fcn.00403668
call fcn.00402ca4
test al, al
je 0x5a8323
push ebx
mov eax, dword [ebp - 0xc]
call fcn.0040549c
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004056fc
mov eax, ebx
mov edx, dword [ebx]
call fcn.00405220
mov eax, esi
call fcn.004034c4
call fcn.00402ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a83f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8434
lea eax, [ebp - 0x1e8]
call fcn.004051cc
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.0040599c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051f0
ret
Function at 0x5a848c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa1c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x5e0], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040568c
mov eax, dword [ebp - 8]
call fcn.0040568c
xor eax, eax
push ebp
push 0x5a8619
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a853c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5c1278]
mov edx, dword [edx]
lea eax, [ebp - 0x5e0]
mov ecx, 0x5a862c
call fcn.00405c48
mov eax, dword [ebp - 0x5e0]
call fcn.00405bcc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1dc]
call fcn.00403348
lea eax, [ebp - 0x1dc]
call fcn.004030d8
call fcn.00402ca4
lea eax, [ebp - 0x1dc]
call fcn.004034c4
call fcn.00402ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a8546
xor eax, eax
push ebp
push 0x5a85e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5e4]
mov edx, dword [ebp - 4]
call fcn.00405b50
mov eax, dword [ebp - 0x5e4]
mov edx, 0xa
call fcn.00578e30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5a8585
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a85ee
lea eax, [ebp - 0xc]
mov edx, 0x5a8644
call fcn.00405264
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004054a4
mov eax, dword [ebp - 0xc]
call fcn.0040549c
push eax
lea eax, [ebp - 0xc]
call fcn.004056f4
lea edx, [ebp - 0x5dc]
pop ecx
call fcn.00402dbc
mov eax, dword [ebp - 0xc]
call fcn.0040549c
mov ecx, eax
lea edx, [ebp - 0x5dc]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea eax, [ebp - 0x10]
call fcn.0057903c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a85ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8620
lea eax, [ebp - 0x5e4]
mov edx, 2
call fcn.0040599c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051f0
ret
Function at 0x5a8648
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa20
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x5e0], edx
mov dword [ebp - 0x5dc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040568c
xor eax, eax
push ebp
push 0x5a87d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a8707
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5c1278]
mov edx, dword [edx]
lea eax, [ebp - 0x5dc]
mov ecx, 0x5a87ec
call fcn.00405c48
mov eax, dword [ebp - 0x5dc]
call fcn.00405bcc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d8]
call fcn.00403348
lea eax, [ebp - 0x1d8]
call fcn.004030d8
call fcn.00402ca4
mov edx, 0x5a8804
lea eax, [ebp - 0x1d8]
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
lea eax, [ebp - 0x1d8]
call fcn.004034c4
call fcn.00402ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a8711
xor eax, eax
push ebp
push 0x5a87a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5e0]
mov edx, dword [ebp - 4]
call fcn.00405b50
mov eax, dword [ebp - 0x5e0]
mov edx, 0xa
call fcn.00578e30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5a8750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a87ae
lea eax, [ebp - 8]
mov edx, 0x5a8804
call fcn.00405264
mov eax, dword [ebp - 8]
call fcn.0040549c
push eax
lea eax, [ebp - 8]
call fcn.004056f4
lea edx, [ebp - 0x5d8]
pop ecx
call fcn.00402dbc
mov eax, dword [ebp - 8]
call fcn.0040549c
mov ecx, eax
lea edx, [ebp - 0x5d8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea eax, [ebp - 0xc]
call fcn.0057903c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a87ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a87e0
lea eax, [ebp - 0x5e0]
mov edx, 2
call fcn.0040599c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f0
ret
Function at 0x5a8808
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1d8], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040568c
mov eax, dword [ebp - 8]
call fcn.0040568c
xor eax, eax
push ebp
push 0x5a88f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a88c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5c1278]
mov edx, dword [edx]
lea eax, [ebp - 0x1d8]
mov ecx, 0x5a890c
call fcn.00405c48
mov eax, dword [ebp - 0x1d8]
call fcn.00405bcc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d4]
call fcn.00403348
lea eax, [ebp - 0x1d4]
call fcn.004030e4
call fcn.00402ca4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1d4]
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
lea eax, [ebp - 0x1d4]
call fcn.004034c4
call fcn.00402ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a88d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a88fe
lea eax, [ebp - 0x1d8]
call fcn.00405984
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f0
ret

Function at 0x5a8e48
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040568c
xor eax, eax
push ebp
push 0x5a8ed6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c1278]
push dword [eax]
push 0x5a8ee8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00405b50
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405cac
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00405464
push 0
mov eax, dword [ebp - 8]
call fcn.0040569c
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8edd
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040599c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f0
ret
Function at 0x5a9da8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d0], eax
xor eax, eax
push ebp
push 0x5a9ee2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a9eaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5c1278]
mov edx, dword [edx]
lea eax, [ebp - 0x1d0]
mov ecx, 0x5a9ef4
call fcn.00405c48
mov eax, dword [ebp - 0x1d0]
call fcn.00405bcc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov edx, 0x5a9f08
lea eax, [ebp - 0x1cc]
call fcn.00403348
lea eax, [ebp - 0x1cc]
call fcn.004030d8
call fcn.00402ca4
mov eax, dword [0x5c8ec0]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x5a9e95
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x5c8ec0]
call fcn.004c02f0
mov ebx, eax
push dword [ebx]
push 0x5a9f1c
lea edx, [ebp - 0x1d8]
mov eax, dword [ebx + 4]
call fcn.0040c92c
push dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d4]
mov edx, 3
call fcn.0040555c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
inc edi
dec esi
jne 0x5a9e3d
lea eax, [ebp - 0x1cc]
call fcn.004034c4
call fcn.00402ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a9eb9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9ee9
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.004051f0
lea eax, [ebp - 0x1d0]
call fcn.00405984
ret
Function at 0x5a9f20
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe30
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d0], eax
lea ebx, [ebp - 0x1cc]
xor eax, eax
push ebp
push 0x5aa130
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5aa10d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5c1278]
mov edx, dword [edx]
lea eax, [ebp - 0x1d0]
mov ecx, 0x5aa144
call fcn.00405c48
mov eax, dword [ebp - 0x1d0]
call fcn.00405bcc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov edx, 0x5aa158
mov eax, ebx
call fcn.00403348
mov eax, ebx
call fcn.004030d8
call fcn.00402ca4
mov edx, 0x5aa16c
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa17c
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa190
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa1a4
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa1b8
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa1cc
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa1dc
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa1f0
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa204
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa214
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa224
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa234
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa248
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa260
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa270
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov edx, 0x5aa284
mov eax, ebx
call fcn.004058b8
call fcn.00403d14
call fcn.00402ca4
mov eax, ebx
call fcn.004034c4
call fcn.00402ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5aa117
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa137
lea eax, [ebp - 0x1d0]
call fcn.00405984
ret

Function at 0x5ab26c
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040568c
mov eax, dword [ebp - 8]
call fcn.0040568c
xor eax, eax
push ebp
push 0x5ab2fa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5ab2d3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040569c
push eax
mov eax, dword [ebp - 4]
call fcn.0040569c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ab2df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab301
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f0
ret
Function at 0x5abf28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5ac07d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c19ac]
call fcn.004051cc
mov eax, dword [0x5c1758]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5ac062
inc ebx
xor esi, esi
lea ecx, [ebp - 4]
mov eax, dword [0x5c1758]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 4]
mov eax, 0x5ac094
call fcn.004057e0
test eax, eax
jle 0x5abfb0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005b1634
mov eax, dword [0x5c19ac]
push eax
mov eax, dword [ebp - 8]
call fcn.0040549c
mov ecx, eax
mov edx, 0xa
mov eax, dword [ebp - 8]
call fcn.004056fc
mov edx, dword [ebp - 4]
mov eax, 0x5ac0a4
call fcn.004057e0
test eax, eax
jle 0x5ac005
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005b1634
mov eax, dword [0x5c19ac]
push dword [eax]
push 0x5ac0b4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040549c
mov ecx, eax
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.004056fc
push dword [ebp - 0xc]
mov eax, dword [0x5c19ac]
mov edx, 3
call fcn.0040555c
mov edx, dword [ebp - 4]
mov eax, 0x5ac0c0
call fcn.004057e0
test eax, eax
jle 0x5ac05a
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005b1634
mov eax, dword [0x5c19ac]
push dword [eax]
push 0x5ac0b4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040549c
mov ecx, eax
mov edx, 7
mov eax, dword [ebp - 8]
call fcn.004056fc
push dword [ebp - 0x10]
mov eax, dword [0x5c19ac]
mov edx, 3
call fcn.0040555c
inc esi
dec ebx
jne 0x5abf66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac084
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004051f0
ret
Function at 0x403100
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40313c
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x40315c
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040594c
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403464
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004056dc
test esi, esi
jne 0x40349a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004057cc
jmp 0x4034b8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403308
mov edi, eax
test esi, esi
je 0x4034b8
cmp dword [ebx], 0
je 0x4034b8
dec esi
jmp 0x4034a1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4034ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4f3008], 0x8088405
inc edx
mov dword [ebx + 0x4f3008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403bd8
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x403bee
sub ecx, 2
jne 0x403c10
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x403c17
cmp edx, dword [ebx + 8]
je 0x403c21
mov eax, 0x64
jmp 0x403c1c
mov eax, 0x67
jmp 0x403c1c
call sub.kernel32.dll_GetLastError
call fcn.00403074
pop ebx
ret

Function at 0x403ff8
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x40402b
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x404032
cmp edx, dword [ebx + 8]
je 0x40403c
mov eax, 0x65
jmp 0x404037
mov eax, 5
jmp 0x404037
call sub.kernel32.dll_GetLastError
call fcn.00403074
mov eax, ebx
pop ebx
ret
Function at 0x404598
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4f3024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404630
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404610
xor eax, eax
push ebp
push 0x404609
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40464c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404610
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4f3024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4f3024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4054a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f604c], 0
je 0x405509
cmp word [0x4f6220], 0xd7b2
jne 0x4054d1
cmp dword [0x4f6228], 0
jbe 0x4054d1
mov eax, 0x4f621c
call dword [0x4f6238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405530
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4f3030], 0
jne 0x405525
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4f3038], 0
je 0x405686
mov edx, esi
mov eax, ebx
call dword [0x4f3038]
jmp 0x405695
mov eax, 8
call fcn.00402ef8
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4f604d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405628
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x40713c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40736c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4071bf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40736c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4071bf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x407388
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x407248
xor eax, eax
push ebp
push 0x407241
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406f78
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x407226
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4073a8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x407226
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407248
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x407362
cmp byte [ebp - 0xd], 0
jne 0x40728f
cmp byte [ebp - 0x12], 0
je 0x407362
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4072a8
dec ebx
cmp byte [ebx], 0x2e
je 0x4072b7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4072a7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x407362
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4072f4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x407362
cmp byte [ebp - 0xd], 0
je 0x407362
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x407362
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret