joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69c570
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov dword [edi], 0
cmp dword [0x9a5720], 0
je 0x69c5c3
mov eax, dword [0x9b3ad8]
test eax, eax
je 0x69c598
push eax
call dword [0x9a5770]
add esp, 4
lea eax, [esp + 0xc]
push eax
push 0x14
call fcn.0065b4e0
mov eax, dword [0x9b3ad8]
add esp, 8
test eax, eax
je 0x69c5bd
push eax
call dword [0x9a5778]
mov esi, dword [esp + 0x10]
jmp 0x69c5cd
mov esi, dword [esp + 0xc]
jmp 0x69c5d0
push 0x14
call dword [0x9a5740]
mov esi, eax
add esp, 4
test esi, esi
jne 0x69c5da
pop edi
lea eax, [esi + 7]
pop esi
ret
cmp byte [0x9a5724], 0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
je 0x69c629
mov eax, dword [0x9a5820]
test eax, eax
je 0x69c604
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x69c629
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x69c6c0
push 0
push 0
mov dword [esi + 0xc], ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x69c639
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x69c651
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop ebp
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
ret
Function at 0x6a92b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
push edi
call fcn.00654370
mov ebx, dword [edi + 0x28]
xor eax, eax
movzx ecx, word [edi + 0x30]
xor ebp, ebp
mov esi, dword [edi + 0x2c]
add esp, 4
mov word [esp + 0x18], ax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0x74]
mov dword [esp + 0x28], ebp
mov eax, dword [eax + 0x3c]
sub eax, ebx
cmp ecx, eax
jle 0x6a92f9
xor ecx, ecx
test eax, eax
sets cl
dec ecx
and ecx, eax
mov dword [esp + 0x20], ebx
cmp esi, ecx
ja 0x6a9311
mov eax, 0x1010
mov dword [esp + 0x1c], esi
mov word [esp + 0x18], ax
jmp 0x6a9336
lea eax, [esp + 0x10]
push eax
push esi
push 0
push edi
call fcn.006a9f90
add esp, 0x10
test eax, eax
jne 0x6a9417
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
movzx edi, byte [ebx]
mov dword [esp + 0x68], edi
cmp edi, 0x80
jb 0x6a9357
lea eax, [esp + 0x68]
push eax
push ebx
call fcn.00689e20
mov edi, dword [esp + 0x70]
add esp, 8
cmp edi, 3
jb 0x6a93d9
cmp edi, esi
ja 0x6a93d9
lea eax, [edi - 1]
add eax, ebx
movzx ecx, byte [eax]
mov dword [esp + 0x68], ecx
cmp ecx, 0x80
jb 0x6a9386
lea ecx, [esp + 0x68]
push ecx
push eax
call fcn.00689e20
mov ecx, dword [esp + 0x70]
add esp, 8
lea eax, [ecx - 1]
cmp eax, 8
ja 0x6a93d9
cmp ecx, 7
je 0x6a93d9
movzx edx, byte [ecx + 0x6ee778]
lea eax, [edx + edi]
cmp esi, eax
jb 0x6a93d9
lea eax, [esp + 0x38]
sub esi, edx
push eax
push ecx
add esi, ebx
push esi
call fcn.006abca0
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x44]
mov dword [ecx], eax
mov eax, dword [esp + 0x48]
mov dword [ecx + 4], eax
lea eax, [esp + 0x1c]
push eax
call fcn.006aa510
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
test dword [esp + 0x18], 0x2400
jne 0x6a93e7
test ebp, ebp
je 0x6a93f4
lea eax, [esp + 0x10]
push eax
call fcn.006bb550
add esp, 4
push 0x6fa37c
push 0x14b3d
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00629b00
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x6bf960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov ecx, 0xc
push ebx
mov ebx, dword [esp + 0x68]
push ebp
push esi
push edi
cmp byte [ebx + 0x2b], 2
lea edi, [esp + 0x10]
mov eax, dword [ebx + 0x20]
mov ebp, dword [eax]
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
je 0x6bf991
mov eax, dword [ebx + 4]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c]
call eax
add esp, 4
lea esi, [ebp + 0x30]
mov ecx, 0xc
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov esi, 0x2c
lea edx, [esp + 0x40]
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x6bfa61
add ecx, 4
add edx, 4
sub esi, 4
jae 0x6bf9b0
cmp byte [esp + 0x1c], 0
je 0x6bfa61
xor edx, edx
lea ecx, [esp + 0x10]
xor esi, esi
mov eax, dword [ecx]
add eax, edx
add esi, eax
mov eax, dword [ecx + 4]
add eax, esi
add ecx, 8
add edx, eax
lea eax, [esp + 0x38]
cmp ecx, eax
jb 0x6bf9d8
cmp esi, dword [esp + 0x38]
jne 0x6bfa61
cmp edx, dword [esp + 0x3c]
jne 0x6bfa61
lea edi, [ebx + 0x34]
mov esi, 0x2c
mov ecx, edi
lea edx, [esp + 0x10]
lea ebx, [ebx]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x6bfa2b
add ecx, 4
add edx, 4
sub esi, 4
jae 0x6bfa10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0x78]
lea esi, [esp + 0x10]
mov ecx, 0xc
mov dword [eax], 1
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebx + 0x42]
mov eax, ecx
and ecx, 0xfe00
and eax, 1
pop edi
shl eax, 0x10
pop esi
add eax, ecx
mov dword [ebx + 0x24], eax
xor eax, eax
pop ebp
pop ebx
add esp, 0x60
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x60
ret
Function at 0x1001398
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.010016dd
add esi, 4
mov eax, dword [esi]
xor edi, edi
inc edi
test eax, eax
je 0x10013db
cmp byte [eax], 0x2d
jne 0x10013d6
jmp 0x10013c6
cmp cl, 0x6c
jne 0x10013db
mov dword [0x1002060], edi
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x10013bb
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x10013b4
cmp dword [esi], 0
jne 0x10013e4
call fcn.01001118
mov eax, edi
jmp 0x100143a
push 0x1002080
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x1001433
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x271a
call fcn.010016a1
jmp 0x1001433
push 0xa
call dword [sym.imp.msvcrt.dll_putchar]
pop ecx
push dword [esi]
call fcn.01001127
test eax, eax
jne 0x1001430
push dword [esi]
push 0x2710
push edi
call fcn.01001632
add esp, 0xc
add esi, 4
cmp dword [esi], 0
jne 0x100140c
xor eax, eax
pop edi
pop esi
ret

Function at 0x10016e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0xa
pop esi
jmp 0x100170a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2747
jne 0x100171f
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esi + esi*4]
shl esi, 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10016f1
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10

Function at 0xc4a268
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c4a3b8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x45a738bf
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x70c303a4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x41b64b
Capabilities:
Write file on windows

Disassembly:
adc eax, 0x4e36ac
cmp eax, 0x217
dec esi
add byte [0x217], bh
je 0x41b65e
cmp eax, 0x3e5
jne 0x41b66f
mov edx, 0x76ff0deb
adc bh, bh
and al, 0xb4
invalid
push dword [esi + 0x10]
jmp dword [esp + esi*4]
xor eax, eax
pop edi
pop esi
sar dl, 1
add byte [ebx + ecx*4 + 0x10ec83ec], bh
mov esp, 0xec83ec8b
adc byte [edi - 0x75], dl
jge fcn.0041b688
pop ebp
jg 0x41b69f
sbb ah, dl
lodsb al, byte [esi]
loope 0x41b648
add byte [ebx + 0x76811877], cl
add al, 0xff
adc eax, 0x4e674d
mov ebx, 0xbd5800
mov byte [0x9d85e2c3], al
add byte [eax], al
invalid
lea ecx, [esi + 8]
invalid

Function at 0x41b72c
Capabilities:
Write file on windows

Disassembly:
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
cmp esi, ebx
je 0x41b741
cmp dword [ebp - 4], 0xc
je 0x41b752
dec dword [ebx]
in al, dx
invalid
jge 0x41b755
into
add dh, byte [edx]
sbb byte [esi + 0x5b], bl
pop edi
leave
ret 4

Function at 0x42732c
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x8b
inc ebp
clc
pop ecx
pop ecx
inc edi
jne 0x4272de
mov dword [edi + 0x30], edi
jne 0x427321
js 0x4272df
mov byte [ebp + 0x41], 1
mov byte [ebp + 0x42], bl
mov byte [ebp + 0x43], bl
pop ebp
inc ebx
inc ebp
inc ecx
add dword [eax + 0x5d88425d], ecx
pop ebp
inc ebx
call fcn.00426ed8
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x48]
je fcn.00427347
adc byte [eax - 1], al
pop ecx
or byte [ebx - 0x3ceb8d], al
invalid
je 0x427353
ror dword [ebx + 0x2474ffb6], 0x10
je 0x427359
adc bh, bh
je 0x4272ce
out dx, al
pop edi
and al, 0x92

Function at 0x4282c7
Capabilities:
Encode data using xor

Disassembly:
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x4f0de5]
add byte [ebx - 0x63193e10], cl
xor edx, esi
rol dl, 1
inc ecx

Function at 0x42f99c
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x5277ff07]
mov ecx, dword [edi + 0x23]
mov dword [ebp - 8], eax
call fcn.004282be
xor edx, edx
psllq mm1, qword [ebx - 0x72a6034c]
adc al, 0xd0
add edx, dword [ebx]
call 0xff5f82e8
xor byte [edi], dl
clc
test ebx, edi
jne 0x42f983
int1
rol byte [eax + 0x1b], 0x5f
pop esi
leave
ret

Function at 0x434d6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [esi + 0x30]
mov ecx, dword [esi + 0x28]
push ebx
mov ecx, dword [ecx + 0x5d89c0bc]
cld
call fcn.00428532
push esp
bound ebp, qword [eax]
push ebx
call 0x9ae277c2
lea ebx, [edi + edi]
sub bl, byte [edi + 0x3f1c8d9a]
inc bl
imul eax, eax, 0x28
push eax
mov esp, dword [eax + 0x7e8966fc]
xor al, ch
sbb eax, 0x83ffffdf
pop es
or al, 0x85
ror byte [ecx + 0x3d742846], 0x85
jle 0x434d8a
mov eax, eax
adc byte [esi - 0x39], ah
inc eax
or al, 1
add byte [ebx + 0x8894b0e], cl
add eax, 0x28
hlt
Function at 0x44fe81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor eax, 0xd5851470
je 0x44fe7e
mov eax, dword [ebx + 0x7d8b570c]
or byte [edi - 0x77], al
inc ebp
imul eax, dword [ebx + 0x74000cd5], 0xa3458b08
cmp dword [eax], 0
je 0x44fe71
push 0x2f
push 0xffffffffffffffef
push dword [ebp + 0x7a]
push esi
push ebx
add byte [ebx], ah
adc al, 6
dec dword [ebx + 0x5141c24e]
inc ecx
push ecx
push eax
mov eax, dword [ebx + 0xc]
push edi
push 0x46
lea ecx, [edx + 0xe]
invalid
add dword [ebp - 4], 4
mov esi, dword [esi + 0x47]
in eax, dx
test esi, esi
call 0xc9525e44
ret
or eax, 0x8b55c3c9
in al, dx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [esi]
call fcn.00439658
mov ebx, dword [ebp - 0x4a]
mov edi, dword [ebx + 0x18]
mov dword [ebp - 4], eax
mov bl, 0xc0
cmp dword [ebp + 0xc], 2
pop ecx
jo 0x44fee9
or byte [edx + 0x476ff09], cl
call fcn.00439658
pop ecx
cmp dword [ebp - 4], 0
je 0x44fee1
lea ecx, [ebp + 8]
push ecx
push eax
push dword [ebp - 0x70]
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
je 0x44fe60
invalid
pop edi
pop esi
sbb al, 0xc9
je 0x44ff3a
mov al, 0xdb
mov ebp, 0x57926853
sub al, 0
push ebx
push 0xffffffffffffffa0
xchg dword [edx], eax
push str.sqlite_rename_table
push esi
pop esp
push esp
cmp edi, 0x68535366
push ecx
pop ecx
inc esp
lahf
push ebx
push 0xffffffffffffffec
mov dl, 0x30
push 0x4f5789
push esi
call fcn.0044809e
add esp, 0x31
push ebx
push ebx
push 0xa4445892
push ebx
push 1
push 3
push str.sqlite_rename_parent
push esi
call 0xe2448054
loope 0x44feb5
les esp, [eax]
cmp byte [esi + 0x1e], bl
lcall 0x880, 0x26a1975
pushal
push 2
or byte [eax], 0x60
dec edi
add byte [esi - 0x18], dl
mov ebp, 0x83ffffb0
jge 0x44ff56
cmp eax, 7
jne 0x44ff53
ret 0x1e79
ret
mov esi, 0x50f520
mov edi, 0x614910
push edi
imul esp, dword [esp + ecx*8 - 0x397c0003], 0x74fe8120
sti
push eax
pop ecx
jl 0x44ff60
mov esi, 0x50f2b8
push edi
call 0xe642cc0a
add esi, 0xffffffc2
xor esi, 0xe2f34b
jl 0x44ff77
imul ebx, dword [esi - 0x3d], 0x83ec8b55
arpl word [esi + ecx*4 + 0x4d], ax
ret

Function at 0x4551f1
Capabilities:
Encode data using xor

Disassembly:
sub al, ch
aas
mov ebx, 0xc48308fd
or al, 0x8b
inc ebp
xor eax, 0xfdbb4be8
push dword [esi]
mov dword [ebp - 0x2c], eax
push esi
mov eax, edi
call fcn.00436ff6
xor ebx, ebx
sbb byte [ebp + 0x64], bl
pop ecx
pop ecx
movsb byte es:[edi], byte [esi]
sub eax, 0x8df75f8b
inc ebx
add dword [ecx + 0x36ff4347], ecx
mov dword [ebp - 0x24], ebx
push edi
wait
xor eax, 0x967dff18
invalid

Function at 0x464d71
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push eax
mov esi, 0x55e8645d
or byte [esi], al
out dx, eax
mov edi, dword [0x4ef337]
test eax, 0x89530cc4
pop ebp
invalid
Function at 0x478b7a
Capabilities:
Encode data using xor

Disassembly:
push edx
add al, 0
mov eax, 0x714fddc0
add dword [0xe850500c], 0xffffff8f
jle 0x478b64
add bh, dh
push eax
lea eax, [ebp - 0x804]
push 0x4f7e20
push eax
dec edx
cdq
leave
inc ecx
add byte [ebp + 0x6a10c4], ah
push eax
test esp, edi
idiv edi
jmp [eax + 0x20]
lea eax, [ebp - 0x1b000885]
push eax
add byte [ebp + 8], 0xff
mov ah, 0x86
stc
add al, byte [eax]
add bh, bh
adc eax, 0x224ef380
mov ecx, dword [ebp - 4]
xor edi, dword [ebx]
call fcn.004c74f3
and eax, 0x550004c2
jo 0x478b4f
and al, 0x74
cld
invalid

Function at 0x4c3a02
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dh, 0x59
inc edx
sub esi, ebx
je 0x4c3a1e
xor ebx, dword [0x9f68f685]
ret
movzx esi, byte [eax + 0x15]
movzx ebx, byte [ecx + 0x49]
sub esi, ebx
je 0x4c3a35
lodsb al, byte [esi]
fild dword [ebp - 0x3c60f00a]
lea ebx, [esp + ecx*2 - 0x2c]
invalid

Function at 0x4d2230
Capabilities:
Encode data using xor

Disassembly:
invalid
add dword [eax], eax
add byte [ebp + 0x5e50e8b3], cl
dec edi
sub dl, dh
dec esi
add byte [ebp + 0x294f0fc0], al
add dword [eax], eax
add byte [edx + 1], bh
add dword [eax], eax
add bl, ch
inc ebx
sbb al, 0x56
push eax
call fcn.004c55d0
xor edx, edx
inc edx
add esp, 0x6d
cmp dword [ebx], ecx
call 0x89519deb
jae 0x4d2223
arpl word [esi + 0x51f8], ax
clc
push ecx
add byte [eax], al
xor byte [eax], 0x90
dec esi
je 0x4e1843
cdq
jne 0x4d2266
inc edx
push cs
test cl, cl
rdpmc
std
add byte [eax], al
add byte [edi], cl
lea eax, [esi - 1]
mov ecx, dr1
jmp 0x4d2333
add byte [edx], 3
sbb eax, 0xc13b4004
cmp eax, ecx
jbe 0x4d232d
add eax, 0xff7e5c82
add byte [edi], cl
test dword [edi + edi*8], esi
jmp dword [0xb91e438d]
pushfd
call [ecx + 0x6a]
add byte [edx], ch
call fcn.004c6b1f
int3
Function at 0x402dfc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402e55
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402c98
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402c98
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402e3f
inc ebx
jmp 0x402e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e5c
lea eax, [ebp - 8]
call fcn.00404428
ret

Function at 0x4030b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45c008], 0x8088405
inc edx
mov dword [ebx + 0x45c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403508
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45c024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403580
xor eax, eax
push ebp
push 0x403579
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403580
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45c024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45c024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4042a4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x55a04c], 0
je 0x404305
cmp word [0x55a220], 0xd7b2
jne 0x4042cd
cmp dword [0x55a228], 0
jbe 0x4042cd
mov eax, 0x55a21c
call dword [0x55a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45c070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40432c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45c034], 0
jne 0x404321
push 0
push 0x45c068
push 0x45c070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4062f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40635a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404698
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030cc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406344
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406361
lea eax, [ebp - 0x10]
call fcn.00404428
ret

Function at 0x40b498
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4d1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404518
jmp 0x40b4da
mov eax, ebx
mov edx, esi
call fcn.0040447c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b4e4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b505
mov al, byte [esp]
jmp 0x40b507
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bb9c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ba04
mov eax, dword [0x55940c]
cmp byte [eax], 0
je 0x40bc18
mov eax, dword [0x55920c]
call fcn.00402f1c
call fcn.00402bc4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408c54
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bc60
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bc4e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x5591b8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x55a668]
call fcn.00405760
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c504
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c5da
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004044c0
lea eax, [ebp - 8]
call fcn.00404938
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048e8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c5c4
mov eax, ebx
call fcn.00402a38
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c5bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048e8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c5a7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c5ec
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c5a7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c5c4
mov eax, dword [ebp - 0x10]
call fcn.00402a68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c5e1
lea eax, [ebp - 8]
call fcn.00404428
ret

Function at 0x40cb40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cba4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404698
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408768
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cbab
lea eax, [ebp - 0xc]
call fcn.00404428
ret