joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426e6e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b0e48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00420016
and dword [ebp - 0x14], 0
cmp dword [0x6bcb80], 0
mov dword [ebp - 0x18], eax
jne 0x426f21
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x426fc9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x426fc9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x6bcb80], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6bcb84], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6bcb88], eax
call edi
push eax
call esi
mov dword [0x6bcb90], eax
test eax, eax
je 0x426f21
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6bcb8c], eax
mov eax, dword [0x6bcb8c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x426f7a
cmp dword [0x6bcb90], ecx
je 0x426f7a
push eax
call esi
push dword [0x6bcb90]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x426f7a
test ebx, ebx
je 0x426f7a
call edi
test eax, eax
je 0x426f71
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x426f71
test byte [ebp - 8], 1
jne 0x426f7a
or dword [ebp + 0x10], 0x200000
jmp 0x426fad
mov eax, dword [0x6bcb84]
cmp eax, dword [ebp - 0x18]
je 0x426fad
push eax
call esi
test eax, eax
je 0x426fad
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x426fad
mov eax, dword [0x6bcb88]
cmp eax, dword [ebp - 0x18]
je 0x426fad
push eax
call esi
test eax, eax
je 0x426fad
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6bcb80]
call esi
test eax, eax
je 0x426fc9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x426fcb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c16c
leave
ret
Function at 0x40b920
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x40b933
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b92f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x40b960
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40b99f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40b995
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40b9a1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40b985
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x413220
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
adc byte [edx - 0x55], ah
mov es, word [eax]
nop
add byte [eax], al
sub dword [edx + 0x3b], edx
dec esi
test eax, 0x5700007f
adc byte gs:[edi + 0x10], 0x62
add byte [eax], al
or eax, 0x10000054
bound ecx, qword [0x5c3154]
add ch, bh
xor byte [ebp - 0x6d], 0
add bl, dh
push edx
add byte [eax], al
insd dword es:[edi], dx
imul eax, dword [eax], 0x215fb700
jno 0x413228
xchg ecx, eax
add byte [eax], al
fist dword [edx]
add byte [edi], dh
pop edi
add byte [eax], al
or cl, byte [esi]
add ch, ah
dec esi
add byte [eax], al
push ecx
add byte [eax], al
in eax, 0x5d
add byte [eax], al
pop ds
nop
add byte [eax], al
jmp dword [edx + 0x27]
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0040eb78
push str._JAVA_LAUNCHER_DEBUG
mov eax, dword [eax]
mov dword [0x433680], eax
call fcn.004242af
xor ebp, ebp
pop ecx
test eax, eax
je 0x401059
push str.Windows_original_main_args:_n
call fcn.00401112
pop ecx
mov esi, ebp
call fcn.0040e6c7
cmp dword [eax], ebp
jle 0x401059
call fcn.0040e6cd
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401112
add esp, 0xc
inc esi
call fcn.0040e6c7
cmp esi, dword [eax]
jl 0x401037
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040121d
call fcn.00401285
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401135
pop ecx
pop ecx
mov esi, eax
call fcn.0040128b
mov edx, ebp
test ebx, ebx
jle 0x401093
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x401088
mov edi, dword [str.java]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010a2
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010ae
mov edx, dword [esi]
mov ecx, dword [0x432990]
push ebp
xor ebp, ebp
inc ebp
test ecx, ecx
push ebp
push ebp
setne al
movzx eax, al
push eax
push edi
push edx
push 0x426274
push 0x426278
push dword [0x432994]
push ebp
push ecx
push ebp
push esi
push ebx
call fcn.00401d65
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x404305
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.004242af
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x404478
jg 0x404334
test esi, esi
jb 0x404478
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175dd
add esp, 0xc
test eax, eax
js 0x404478
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404396
push edi
call fcn.00404887
pop ecx
test eax, eax
je 0x40438d
push ebx
push esi
push edi
push ebp
call fcn.004242af
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40447d
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.004242af
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x404478
jg 0x4043bf
cmp ebp, ebx
jb 0x404478
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043d4
jl 0x4043ce
cmp ebp, ecx
jae 0x4043d4
mov esi, ebp
mov ecx, eax
jmp 0x4043d8
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.004242af
add esp, 0x10
cmp edx, ebx
jl 0x404478
jg 0x4043fe
cmp eax, ebx
jb 0x404478
push 0x10015
call fcn.004242af
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404478
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175dd
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404471
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40446d
cmp byte [esi], 0x50
jne 0x40446c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40446c
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404484
dec esi
cmp esi, ebx
jae 0x40442d
push ebx
call fcn.004242af
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a170
push ebx
call fcn.004242af
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404887
add esp, 0x14
test eax, eax
je 0x4044c4
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.004242af
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40447d
Function at 0x4242af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x4242be
pop dword [ebp - 0x34]
mov eax, 0x4242be
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xd43b847b
sub dword [ebp - 0x44], 0x85e93f30
mov dword [ebp - 0x40], 0x557485d8
add dword [ebp - 0x40], 0xdcbec66d
mov dword [ebp - 0x3c], 0x86833922
add dword [ebp - 0x3c], 0xc5c90b0c
mov dword [ebp - 0x38], 0xd1a3eae9
add dword [ebp - 0x38], 0x2e5c1517
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xfcd7da56
sub dword [ebp - 0x44], 0x88657100
mov dword [ebp - 0x40], 0x22b3659e
sub dword [ebp - 0x40], 0xe1470429
mov dword [ebp - 0x3c], 0x62cd37a1
sub dword [ebp - 0x3c], 0xff5dcb35
mov dword [ebp - 0x38], 0x9e11fa97
sub dword [ebp - 0x38], 0x9e11fa97
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3cf3e
push 0
call eax
mov ecx, 0x44db
mov edx, eax
mov ebx, 0x9856513f
sub ebx, 0x9812673f
add ebx, dword [ebp - 0x34]
mov edi, 0x59fbddfc
mov dword [ebp - 8], 0xa3e16453
mov esi, dword [ebx]
sub dword [ebp - 0x2c], edi
xor esi, edi
sub dword [ebp - 0x30], 0x2204fcd8
mov dword [edx], esi
add dword [ebp - 0x18], ebx
add edx, 4
add ebx, 4
loop 0x4243c5
add eax, 0xd1051bcf
sub eax, 0xd1041590
mov ebx, eax
add eax, 5
mov ecx, 0x455bd27a
add ecx, 0xbae42d86
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40645d
pop dword [ebp - 0x18]
mov eax, 0x75b79d91
sub eax, 0x75773934
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xc4e2375
add dword [ebp - 0x28], 0x420421d6
mov dword [ebp - 0x24], 0x6c739501
sub dword [ebp - 0x24], 0x3a4048bc
mov dword [ebp - 0x20], 0xef32798b
add dword [ebp - 0x20], 0x5d19caa3
mov dword [ebp - 0x1c], 0x10c3e117
add dword [ebp - 0x1c], 0xef3c1ee9
lea eax, [ebp - 0x28]
push eax
mov eax, 0xb600a551
add eax, 0x4a3fdb27
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2ae9a72b
add dword [ebp - 0x28], 0x4988c22b
mov dword [ebp - 0x24], 0xee77e62b
sub dword [ebp - 0x24], 0xad0b84b6
mov dword [ebp - 0x20], 0x7e72c68d
add dword [ebp - 0x20], 0xe4fca5df
mov dword [ebp - 0x1c], 0x7cf5921b
sub dword [ebp - 0x1c], 0x7cf5921b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3a117
push 0
call eax
mov ecx, 0xe0fbc44f
add ecx, 0x1f048fc1
xor esi, esi
add esi, eax
mov edi, 0x731fda65
sub edi, 0x72dac665
add edi, dword [ebp - 0x18]
mov edx, 0x40086a8
sub dword [ebp - 0xc], edx
mov ebx, dword [edi]
sub dword [ebp - 4], esi
sub ebx, edx
add dword [ebp - 8], edx
mov dword [esi], ebx
xor dword [ebp - 0x10], 0xace56e9
add esi, 0x281d935e
add esi, 0xd7e26ca6
add edi, 4
loop 0x406576
add eax, 0x14313
xor ebx, ebx
add ebx, eax
add eax, 0x4ee19afd
sub eax, 0x4ee19af8
mov ecx, 0x43e215ae
sub ecx, 0x43a215ae
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40ef4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40ef5d
pop dword [ebp - 0x34]
mov eax, 0x8e9bc2e4
add eax, 0x71a52c79
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x4cdcb6c0
add dword [ebp - 0x44], 0x1758e8b
mov dword [ebp - 0x40], 0x34d85988
sub dword [ebp - 0x40], 0x2a50d43
mov dword [ebp - 0x3c], 0xc3f8f579
add dword [ebp - 0x3c], 0x88534eb5
mov dword [ebp - 0x38], 0xa433923
add dword [ebp - 0x38], 0xf5bcc6dd
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe3c7459c
sub dword [ebp - 0x44], 0x6f54dc46
mov dword [ebp - 0x40], 0xfe7d73e8
sub dword [ebp - 0x40], 0xbd111273
mov dword [ebp - 0x3c], 0xdbc087c1
add dword [ebp - 0x3c], 0x87aee4ab
mov dword [ebp - 0x38], 0x1e14822b
add dword [ebp - 0x38], 0xe1eb7dd5
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x33fd914f
sub eax, 0x33bb602b
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3e882
push 0
call eax
mov ecx, 0x6d02d85f
add ecx, 0x92fd72fa
xor ebx, ebx
add ebx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x34]
mov edx, 0xb4e39064
sub edx, 0x19790ff4
add dword [ebp - 0x20], 0x4ae969f6
mov edi, dword [esi]
mov dword [ebp - 0x2c], 0x38501912
xor edi, edx
mov dword [ebx], edi
mov dword [ebp - 4], 0xc5b2bcfb
add ebx, 0x8833fca7
add ebx, 0x77cc035d
add esi, 0x9aaa185a
add esi, 0x6555e7aa
loop 0x40f076
add eax, 0xaea515c2
add eax, 0x515c0a75
mov ebx, eax
add eax, 0x296df633
add eax, 0xd69209d2
mov ecx, 0x59351819
add ecx, 0xa70ae7e7
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x402ea4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045a4
test esi, esi
jne 0x402edb
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404694
jmp 0x402efc
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d40
mov dword [esp], eax
test esi, esi
je 0x402efc
cmp dword [ebx], 0
je 0x402efc
dec esi
jmp 0x402ee3
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x40317c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4c0008], 0x8088405
inc edx
mov dword [ebx + 0x4c0008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4035e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4c0024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403678
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403658
xor eax, eax
push ebp
push 0x403651
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403694
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403658
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4c0024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4c0024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40437c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c404c], 0
je 0x4043dd
cmp word [0x4c4220], 0xd7b2
jne 0x4043a5
cmp dword [0x4c4228], 0
jbe 0x4043a5
mov eax, 0x4c421c
call dword [0x4c4238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4c0070
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404404
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4c0034], 0
jne 0x4043f9
push 0
push 0x4c0068
push 0x4c0070
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret

Function at 0x404558
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402ae0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4c404d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404520
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40664c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4066b2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404814
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403198
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40669c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066b9
lea eax, [ebp - 0x10]
call fcn.004045a4
ret

Function at 0x409480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404a64
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409499
test al, 0x10
jne 0x40949d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40958c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404a64
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
pop ebx
ret

Function at 0x4095a0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404a64
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x4095c2
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c52c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40c565
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404694
jmp 0x40c56e
mov eax, ebx
mov edx, esi
call fcn.004045f8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c578
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40c599
mov al, byte [esp]
jmp 0x40c59b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40d5a4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d67a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040463c
lea eax, [ebp - 8]
call fcn.00404ab4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a64
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d664
mov eax, ebx
call fcn.00402ae0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d65d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a64
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d647
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d68c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d647
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d664
mov eax, dword [ebp - 0x10]
call fcn.00402b10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d681
lea eax, [ebp - 8]
call fcn.004045a4
ret

Function at 0x40dc94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40dcf8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404814
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004090ac
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dcff
lea eax, [ebp - 0xc]
call fcn.004045a4
ret

Function at 0x41fc88
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041fab4
dec esi
jne 0x41fcaa
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x420dec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4c488c
cmp dword [edi], 0
jne 0x420e68
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4c4888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4c041c
mov ecx, 2
call fcn.00402d00
mov edx, 0x420dc4
lea eax, [esi + 5]
call fcn.00420de4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00420de4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x420e3d
mov dword [0x4c4888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4224c4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4224ca
ret

Function at 0x424b08
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x424b59
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x424b40
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x424b30
jmp 0x424b59
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x424b41
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e1c4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a54
xor eax, eax
push ebp
push 0x42e2f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42e2c7
xor eax, eax
push ebp
push 0x42e2c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404864
inc eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42e295
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42e284
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404864
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404a64
mov edx, dword [ebp - 0xc]
pop ecx
call fcn.00402d00
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e28b
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x4c28e0]
mov dl, 1
mov eax, dword [0x407bbc]
call fcn.0040cdc0
call fcn.00403f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e2fb
lea eax, [ebp - 4]
call fcn.004045a4
ret