joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491ea8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.00491e64
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x491f1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x4ae1e4], eax
mov ebx, 0x491df0
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x491f1c
xor eax, eax
push ebp
push 0x491f15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491f1c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x491f24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.00491e64
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x491f8f
mov ebx, dword [0x4ae1e4]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x491f8f
xor eax, eax
push ebp
push 0x491f88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491f8f
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x497cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00407800
cmp ax, 0xffff
jne 0x497cd1
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
je 0x497d52
push eax
push edi
call sub.KERNEL32.DLL_LoadResource
test eax, eax
je 0x497d52
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x497d18
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x497d0b
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x497d52
cmp dword [ebp + 8], 0
jle 0x497d52
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042f740
mov esi, eax
test esi, esi
jle 0x497d49
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407814
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4989a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x498a08
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404700
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00409634
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498a0f
lea eax, [ebp - 0xc]
call fcn.00404490
ret

Function at 0x498a64
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x498ac0
push esp
push 0x40
push 6
push ebx
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x498a8f
call fcn.0040e824
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402d90
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x498ac0
call fcn.0040e824
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4a0f8c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x4aba88]
cmp byte [eax], 0
jne 0x4a0fba
mov ecx, 0xaf
mov edx, 0x4a1008
mov eax, 0x4a104c
call fcn.00404468
mov eax, ebx
call fcn.00404b9c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4a0ff9
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404d30
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1060
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x4aba88]
cmp byte [eax], 0
jne 0x4a1083
mov ecx, 0xbd
mov edx, 0x4a10c4
mov eax, 0x4a1108
call fcn.00404468
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4a10b6
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4a10b6
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4a10b6
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x401400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov ebx, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov esi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004012f0
mov dword [esp], eax
call 0x401470
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll_exit]
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4060c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov esp, dword [edi + 0x57565308]
mov ecx, dword [eax + 4]
mov edx, dword [eax + ecx + 0x3b]
rcl byte [edi]
or al, 0x5f
pop esi
jp 0x4060e3
add byte [ebx - 0x3da2a40d], ch
or byte [ebx + ecx*4 + 0x301c90], al
mov ah, 0x8b
pop ebp
or al, 0x8d
mov ebx, 0x8df38b89
cmp al, 0x8a
add byte [ebx + ecx*4 - 0x4472f3a3], dh
mov dword [ebx - 0x75c3720d], ecx
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 4]
mov ecx, 0x83e5
cmp edx, ecx
jne 0x10918fe
add byte [ebx], bh
ror dword [edi], 1
test edi, esi
mov bh, 0xc8
add byte [eax + 0x53], al
inc eax
push ebx
pushfd
mov edi, dword [edx + 0x78]
mov dl, byte [ebx + 8]
test cl, dl
je 0x406143
inc ebp
push eax
lodsd eax, dword [esi]
xor ecx, ecx
cmpsb byte [esi], byte es:[edi]
rcl cl, cl
movzx esi, word [eax + 0x10]
cmp dword [esi], edi
sub eax, 0xc6832908
add al, 0x3b
retf 0xf472
add byte [ebx - 0x1e], dh
mov dword [eax + ecx*4 + 0x75], edi
mov ecx, dword [eax + 0xc]
inc ecx
mov dword [eax + 0xc], ecx
test byte [ebx + 8], 4
je 0x40616d
mov edx, dword [eax + 0xd06fdf]
xor ebp, dword [esi]
test edx, edx
jbe 0x4060fe
lea esi, [eax + 0x12001014]
cmp dword [esi], edi
je 0x406180
inc ecx
add esi, 0x1b
cmp ecx, edx
jb 0x40615b
cmp ecx, edx
jne 0x406187
cmp edx, 0x400
jae 0x406187
add byte [eax + eax], al
add byte [ebx + 0x14], dh
mov dword [eax + ecx*4 + 0x49001014], edi
mov esi, dword [ebx + 0x10]
mov byte [eax + edx], dl
add byte [ecx - 0x75], cl
jae 0x40618d
aad 0
add byte [ebp - 0xd], dh
jne 0x406175
mov byte [eax], dl
adc byte [edi], bl
not byte [edx + 8]
jb 0x406135
xchg esp, eax
xchg esp, eax
nop
adc al, 0x20
add byte [eax], al
xor ecx, ecx
leave
test dword [edx + 0x76], ecx
adc cl, byte [ebp + 0x1f2018b0]
add byte [ecx], bh
je 0x4061ab
inc ecx
add esi, 0x6e
xor ecx, edx
jb 0x406194
and cl, dl
jne 0x4061cb
cmp edx, 0xda000400
jae 0x4061cb
mov esi, eax
mov byte [eax], bl
and byte [eax], al
add byte [ebx + 0x2928149d], cl
add byte [ecx + 0x4a], al
mov byte [eax], dl
add byte [eax], al
cmp edi, dword [eax + 0x302d]
jle 0x4061d9
xor dword [eax + 0xcf3018], edi
mov edi, dword [0x5ea05f81]
mov dword [eax + 4], ecx
xor eax, eax
pop ebx
adc al, 0x62
or cl, bl
sbb dword [esi - 0x48], 9
add byte [eax], al
add byte [ebx + 0x5d], bl
ret 8
Function at 0x4080f0
Capabilities:
Packed with generic packer

Disassembly:
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
jbe 0x408151
push edi
mov eax, dword [esp + ecx*2 - 0x726a3f7b]
je 0x408110
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x5900
jmp 0x408122
add bl, ch
adc cl, byte [ebx - 0x3fcc8cab]
mov edx, dword [ebp + 0x73]
xor eax, eax
test ecx, ecx
setl byte [edi + 0x28ac085]
je 0x408167
neg ecx
mov eax, 0xcc51ccf1
mov bl, 0xa
mul ecx
shr edx, 3
add dl, 0x4e
mul byte [ecx + 0x2a]
std
add cl, 0x30
mov byte [esi], cl
mov esp, dword [eax]
test edx, edx
jne 0x408122
or dh, bh
loope 0x4080ed
ljmp 0x61f6:0x4ec28003
adc byte [ebp + 0x18], al
sub edx, dword [ecx + 0x39573889]
fstp xword [ebx + ebx*2 - 0x6f823c65]
push ebp
and al, 0xec
mov eax, dword [ebp + 0xc]
mov ecx, 0x8b2c10dd
push esp
or byte [edi - 0x75], dl
jge 0x408128
test eax, eax
ja 0x408172
jb 0x40816c
cmp ebx, 0xffffffe1
ret 0x8504
test ecx, ecx
jne 0x40810d
test eax, eax
jg 0x4081a8
jl 0x40817e
cmp ebx, 0x7fffffff
dec ecx
sub al, byte [ebx + 0x257cffd2]
invalid
adc edx, 0xffffffff
jl 0x4081a8
add dword [edi], ebx
cmp ebx, 0x80000000
jb 0x4081a8
test ecx, ecx
jne 0x4081ac
mov eax, dword [ebp - 0x44]
adc dword [ebp + 0x14], edx
push eax
push edi
push edx
push ecx
sbb ch, al
dec edi
invalid
test ecx, ecx
and byte [ebx], cl
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 9
aaa
popal
test eax, eax
jg 0x40822c
jl 0x4081c1
test ebx, ebx
stosb byte es:[edi], al
pop es
mov ecx, 0x9b
jmp 0x4081ca
mov edx, dword [ebp + 0x14]
test ecx, ecx
mov dword [edx], ecx
jl 0x408178
neg ebx
or dword [ecx], 0
mul dword [esi + edx*2 + 0x6a]
jecxz 0x408248
push 0xffffffffffffffe3
push 0xa
scasd eax, dword es:[edi]
push ebx
call 0xa12e90
mov edi, dword [ecx - 0x3e756c75]
mov dl, 0xa
imul dl
sub bl, al
or ch, byte [edi - 0x535517ad]
pushal
add byte [ebx - 0x756c7447], cl
sal dword [edx + 0x2aeaf60a], 0xd8
dec edi
add bl, 0x30
mov eax, esi
jo 0x408219
mov ebx, ecx
add esi, ecx
jne 0x4081db
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x6b]
sub eax, edi
pop esi
or al, byte [ecx]
mov eax, edi
pop edi
pop ebx
pop ebp
ret
outsb dx, byte [esi]
nop
nop
ret
call dword [0x47bec1b0]
mov edx, dword [eax - 0x722774f4]
push ebp
sti
lea eax, [ebp + 0xc]
push edx
mov edx, dword [edi]
push esi
push eax
and ecx, 0xff
push 1
push ecx
mov dword [ebp - 4], ebx
call 0x1a80f0
dec eax
lea edx, [ebp + 8]
stc
push eax
pop edi
add byte [esi], ch
lea eax, [ebp + 0xc]
xor ecx, ecx
push eax
mov cl, bh
push 1
push ecx
call 0x400ef0
int1
xor ebp, dword [edx]
or byte [edx + 0x50], dl
mov byte [eax], 0xa0
lea eax, [ebp + 0xc]
xor ecx, ecx
push eax
mov cl, byte [ebp - 2]
push 5
push ecx
call 0xa80f0
xchg edi, eax
cmp dl, byte [ebp + 8]
push edx
push eax
mov byte [eax], 0x2e
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffd5
shr ebx, 0x7e
push ebx
call 0x183253c9
arpl word [ebp + 0x10], cx
sub ecx, 0x50
sub eax, dword [ebp + edx*4 - 0x74a4a1fd]
push edi
pop ebp
ret
Function at 0x9b7510
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x66400d
lea edi, [esi - 0x26300d]
push edi
or ebp, 0xffffffff
jmp 0x9b7532
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b7539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b7528
mov eax, 1
add ebx, ebx
jne 0x9b754b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b7540
jne 0x9b755c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b7540
xor ecx, ecx
sub eax, 3
jb 0x9b7570
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b75e2
mov ebp, eax
add ebx, ebx
jne 0x9b757b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9b7588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9b75ac
inc ecx
add ebx, ebx
jne 0x9b7598
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b758d
jne 0x9b75a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b758d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b75cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b75bd
jmp 0x9b752e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b75cc
add edi, ecx
jmp 0x9b752e
pop esi
mov edi, esi
mov ecx, 0x18a9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b75ea
cmp byte [edi], 0x11
jne 0x9b75ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b75ef
lea edi, [esi + 0x5b3000]
mov eax, dword [edi]
or eax, eax
je 0x9b765e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ba02c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ba084]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b761c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ba08c]
or eax, eax
je 0x9b7658
mov dword [ebx], eax
add ebx, 4
jmp 0x9b7639
call dword [esi + 0x5ba088]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9b768f
cmp al, 0xef
ja 0x9b7682
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9b7664
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9b7671
mov ebp, dword [esi + 0x5ba090]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b76c3
sub esp, 0xffffff80
jmp 0x40efbc
Function at 0x416213
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00416292
jae 0x41621f
xor ecx, ecx
call fcn.00416292
jae 0x416249
xor eax, eax
call fcn.00416292
jae 0x41625a
mov al, 0x10
call fcn.00416292
adc al, al
jae 0x41623b
jne 0x416287
stosb byte es:[edi], al
jmp 0x416220
call fcn.0041629e
dec ecx
loop 0x416266
mov eax, ebp
call fcn.0041629c
jmp 0x416288
lodsb al, byte [esi]
shr eax, 1
je 0x4162ae
adc ecx, 2
mov ebp, eax
jmp 0x416288
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0041629c
cmp eax, 0x7d00
jae 0x416286
cmp eax, 0x500
jae 0x416287
cmp eax, 0x7f
ja 0x416288
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416220
pop ebp
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x5c7d431d
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x48492ba5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403098
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040492c
test esi, esi
jne 0x4030ce
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a1c
jmp 0x4030ec
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402f9c
mov edi, eax
test esi, esi
je 0x4030ec
cmp dword [ebx], 0
je 0x4030ec
dec esi
jmp 0x4030d5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403120
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x483008], 0x8088405
inc edx
mov dword [ebx + 0x483008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403854
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x483024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038cc
xor eax, eax
push ebp
push 0x4038c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403908
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x483024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x483024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4046f8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x492048], 0
je 0x404759
cmp word [0x49221c], 0xd7b2
jne 0x404721
cmp dword [0x492224], 0
jbe 0x404721
mov eax, 0x492218
call dword [0x492234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404780
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x483030], 0
jne 0x404775
push 0
push 0x48375c
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4048b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x483034], 0
je 0x4048d6
mov edx, esi
mov eax, ebx
call dword [0x483034]
jmp 0x4048e5
mov eax, 8
call fcn.00402cac
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x492049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404878
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x405d58
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f88
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ddb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f88
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ddb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fa4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405e64
xor eax, eax
push ebp
push 0x405e5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405b94
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e42
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405fc4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e42
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e64
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405f7e
cmp byte [ebp - 0xd], 0
jne 0x405eab
cmp byte [ebp - 0x12], 0
je 0x405f7e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ec4
dec ebx
cmp byte [ebx], 0x2e
je 0x405ed3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405ec3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405f7e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405f10
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f7e
cmp byte [ebp - 0xd], 0
je 0x405f7e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f7e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret