joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015e65
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x452e18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [esp + 0x20]
mov ebx, dword [edi + 8]
sub esp, 0x44
mov dword [esp + 0x5c], 0
mov esi, esp
mov dword [esp + 0x50], esp
mov dword [esi], eax
mov ecx, dword [esp + 0x68]
mov dword [esi + 4], ecx
mov eax, dword [esp + 0x6c]
lea edx, [esi + 8]
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x70]
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x74]
mov dword [edx + 8], eax
mov ecx, dword [esp + 0x78]
lea eax, [esp + 0x80]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x7c]
push eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], edx
call fcn.100507ef
mov ecx, dword [esp + 0x84]
push ebx
mov dword [esi + 0x20], ecx
mov edx, dword [esp + 0x8c]
mov dword [esi + 0x24], edx
mov eax, dword [esp + 0x90]
mov dword [esi + 0x28], eax
mov ecx, dword [esp + 0x94]
mov dword [esi + 0x2c], ecx
mov edx, dword [esp + 0x98]
mov dword [esi + 0x30], edx
mov al, byte [esp + 0x9c]
mov byte [esi + 0x34], al
mov ecx, dword [esp + 0xa0]
mov dword [esi + 0x38], ecx
mov edx, dword [esp + 0xa4]
mov dword [esi + 0x3c], edx
mov eax, dword [esp + 0xa8]
mov ecx, edi
mov dword [esi + 0x40], eax
call fcn.10016495
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], 0xffffffff
call fcn.10050a7a
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x44
Function at 0x10033228
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
je 0x1003325c
cmp dword [esi + 4], 0
je 0x1003325c
push 8
pop ebx
cmp word [esi + 0x16], bx
jae 0x10033265
add esi, 0x40
push 0x47a06c
push esi
call fcn.1003d505
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
and byte [ebp - 0x1c], 0
mov ecx, esi
call fcn.10030b95
test eax, eax
setne al
mov byte [ebp - 0x1b], al
mov ax, word [esi + 0x16]
cmp ax, bx
setne cl
inc ecx
mov byte [ebp - 0x1a], cl
xor ecx, ecx
cmp ax, bx
mov word [ebp - 0x19], cx
setne dl
dec edx
mov word [ebp - 0x14], cx
and edx, 0xff
cmp ax, bx
movzx dx, dl
mov word [ebp - 0x17], dx
mov word [ebp - 0x12], cx
setne dl
dec edx
and byte [ebp - 0xb], cl
and edx, 0x18
cmp dword [esi + 0x188], ecx
mov byte [ebp - 0x15], dl
mov dx, word [esi + 0xc]
mov word [ebp - 0x10], dx
mov dx, word [esi + 0x10]
mov word [ebp - 0xe], dx
mov dl, al
mov byte [ebp - 0xc], dl
je 0x100332e0
cmp ax, 0x18
jne 0x100332e0
mov byte [ebp - 0xc], 0x20
mov eax, dword [edi]
push 1
lea ecx, [ebp - 0x1c]
push 0x12
push ecx
mov ecx, edi
call dword [eax + 0xc]
cmp word [esi + 0x16], bx
jne 0x1003333c
mov ecx, esi
call fcn.10030b95
lea ecx, [ebp - 0x33b]
add eax, 2
mov dword [ebp - 4], 0x100
mov dl, byte [eax - 2]
mov byte [ecx - 1], dl
mov dl, byte [eax - 1]
mov byte [ecx], dl
mov dl, byte [eax]
mov byte [ecx + 1], dl
add eax, 4
add ecx, 3
dec dword [ebp - 4]
jne 0x1003330c
mov eax, dword [edi]
push 1
lea ecx, [ebp - 0x33c]
push 0x300
push ecx
mov ecx, edi
call dword [eax + 0xc]
push esi
lea ecx, [ebp - 0x3c]
call fcn.10033713
cmp dword [esi + 0x188], 0
je 0x10033404
cmp word [esi + 0x16], bx
je 0x10033404
movzx eax, word [ebp - 0x10]
shl eax, 2
push eax
call dword [0x4553a0]
and dword [ebp - 8], 0
cmp word [ebp - 0xe], 0
pop ecx
mov dword [ebp - 4], eax
jbe 0x100333f8
xor ebx, ebx
cmp word [ebp - 0x10], bx
jbe 0x100333d8
mov eax, dword [ebp - 4]
lea edi, [eax + 1]
push dword [ebp - 8]
lea eax, [ebp - 0x24]
mov ecx, esi
push ebx
push eax
call fcn.10030cba
mov eax, dword [eax]
push dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov byte [edi - 1], al
mov al, byte [ebp - 0x1e]
mov byte [edi], ah
push ebx
mov ecx, esi
mov byte [edi + 1], al
call fcn.1003107b
movzx ecx, byte [esi + 0x178]
movzx eax, al
imul eax, ecx
cdq
mov ecx, 0xff
add edi, 4
idiv ecx
inc ebx
mov byte [edi - 2], al
movzx eax, word [ebp - 0x10]
cmp ebx, eax
jl 0x10033387
mov edi, dword [ebp + 8]
movzx ecx, word [ebp - 0x10]
mov eax, dword [edi]
push 1
shl ecx, 2
push ecx
mov ecx, edi
push dword [ebp - 4]
call dword [eax + 0xc]
movzx eax, word [ebp - 0xe]
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x10033379
push dword [ebp - 4]
call dword [0x4553a4]
pop ecx
jmp 0x10033439
xor ebx, ebx
cmp word [ebp - 0xe], bx
jbe 0x10033439
push ebx
lea ecx, [ebp - 0x3c]
call fcn.1003373e
movzx ecx, word [esi + 0x16]
movzx edx, word [ebp - 0x10]
shr ecx, 3
imul ecx, edx
mov eax, dword [edi]
push 1
push ecx
mov ecx, edi
push dword [ebp - 0x2c]
call dword [eax + 0xc]
movzx eax, word [ebp - 0xe]
inc ebx
cmp ebx, eax
jl 0x1003340c
mov al, 1
jmp 0x1003325e
Function at 0x10097e16
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100275ac], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x10097ed0
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x100275a8], eax
inc ebx
cmp ebx, 0x100
jb 0x10097e36
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x10097efc
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100275a8]
sub edi, 1
jne 0x10097edb
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10097f2e
nop dword [eax]
cmp cl, 0x23
jne 0x10097f15
cmp byte [esi], cl
jne 0x10097f15
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100275a8]
test cl, cl
jne 0x10097f06
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x100d2309
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.100d24b9
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x100d2407
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x100d23aa
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x100d23ed
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x100d23c1
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x100d23dc
test al, 0x40
je 0x100d23d3
mov ecx, dword [edi + 0x20]
jmp 0x100d23da
test al, 0x80
je 0x100d23ed
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x100d23ed
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x100d2379
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x100d5340
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0xcd199
jmp fcn.10001058
Function at 0x402b1c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045d4
test esi, esi
jne 0x402b52
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004046c4
jmp 0x402b70
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029d0
mov edi, eax
test esi, esi
je 0x402b70
cmp dword [ebx], 0
je 0x402b70
dec esi
jmp 0x402b59
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403120
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x46e008], 0x8088405
inc edx
mov dword [ebx + 0x46e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4036d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40376c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40374c
xor eax, eax
push ebp
push 0x403745
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403788
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40374c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x46e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404438
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47004c], 0
je 0x404499
cmp word [0x470220], 0xd7b2
jne 0x404461
cmp dword [0x470228], 0
jbe 0x404461
mov eax, 0x47021c
call dword [0x470238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46e074
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4044c0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x46e034], 0
jne 0x4044b5
push 0
push 0x46e06c
push 0x46e074
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x405b3c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d6c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405bbf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d6c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405bbf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d88
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x405c48
xor eax, eax
push ebp
push 0x405c41
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405984
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405c26
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405da8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405c26
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c48
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405d62
cmp byte [ebp - 0xd], 0
jne 0x405c8f
cmp byte [ebp - 0x12], 0
je 0x405d62
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ca8
dec ebx
cmp byte [ebx], 0x2e
je 0x405cb7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405ca7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405d62
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405cf4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d62
cmp byte [ebp - 0xd], 0
je 0x405d62
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d62
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406450
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4064b6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404844
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040313c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4064a0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064bd
lea eax, [ebp - 0x10]
call fcn.004045d4
ret

Function at 0x40b7a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40b7dd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004046c4
jmp 0x40b7e6
mov eax, ebx
mov edx, esi
call fcn.00404628
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b7f0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40b811
mov al, byte [esp]
jmp 0x40b813
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c804
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c8da
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040466c
lea eax, [ebp - 8]
call fcn.00404ae4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a94
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c8c4
mov eax, ebx
call fcn.00402794
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c8bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a94
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c8a7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c8ec
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c8a7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8c4
mov eax, dword [ebp - 0x10]
call fcn.004027b4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8e1
lea eax, [ebp - 8]
call fcn.004045d4
ret
Function at 0x40cea4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cf08
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404844
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004089f8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf0f
lea eax, [ebp - 0xc]
call fcn.004045d4
ret

Function at 0x41ea7c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x470888
cmp dword [edi], 0
jne 0x41eaf8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x470884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46e404
mov ecx, 2
call fcn.00402990
mov edx, 0x41ea54
lea eax, [esi + 5]
call fcn.0041ea74
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041ea74
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41eacd
mov dword [0x470884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x420114
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42011a
ret

Function at 0x422624
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x422675
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42265c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42264c
jmp 0x422675
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42265d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b718
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a84
xor eax, eax
push ebp
push 0x42b846
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42b819
xor eax, eax
push ebp
push 0x42b812
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404894
inc eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42b7e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x42b7d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404894
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404a94
mov edx, ebx
pop ecx
call fcn.00402990
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b7dd
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x46f5d8]
mov dl, 1
mov eax, dword [0x4078d0]
call fcn.0040c028
call fcn.00403ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b84d
lea eax, [ebp - 4]
call fcn.004045d4
ret
Function at 0x42b854
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42ba05
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404c84
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42ba1c
call fcn.004048e0
mov eax, ebx
call fcn.0041e010
mov edi, eax
dec edi
test edi, edi
jl 0x42b90c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041dfe4
mov edx, dword [0x431ec4]
call fcn.004039f0
test al, al
je 0x42b908
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041dfe4
lea edx, [ebp - 0x14]
call fcn.004467f8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404c84
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404954
inc esi
dec edi
jne 0x42b8ba
mov al, byte [0x42ba20]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42ba2c
mov eax, dword [ebp - 0xc]
call fcn.0040d47c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0040466c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004467f8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42ba1c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004467f8
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42ba1c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42ba1c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42ba38
call fcn.004096ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ba0c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004045f8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004045f8
lea eax, [ebp - 0x14]
call fcn.004045d4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004045f8
ret