joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019ff
push esp
mov dword [ebp - 0x24], 0x40171b
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a9e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a7f
pop ebp
ret 0x10
Function at 0x44ba10
Capabilities:
Accept command line arguments
Check os version

Disassembly:
sub esp, 8
mov al, byte [0x662041]
mov cl, byte [0x66204b]
xor cl, al
push ebx
mov byte [0x66204b], cl
mov cl, byte [0x662042]
or cl, 0x10
shr cl, 3
and ecx, 0xff
mov dword [esp + 4], ecx
fild dword [esp + 4]
fdivr qword [0x665958]
fadd qword [0x662058]
fstp qword [0x6659c8]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dl, byte [0x66204d]
mov ebx, eax
mov al, byte [0x662041]
or al, dl
mov byte [0x662041], al
mov al, byte [0x662045]
or al, 2
shr al, 1
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x662058]
fadd qword [0x65e718]
fstp qword [0x665968]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44bac9
mov edx, dword [0x665ab4]
push 0x6657cc
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x665ab4]
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov ecx, ebx
xor eax, eax
and ecx, 0xff
mov al, bh
cmp ecx, 5
pop ebx
jne 0x44baee
cmp eax, 1
jae 0x44bafe
mov dword [0x664fb8], 0x409
add esp, 8
ret
ja 0x44bafe
mov dword [0x664fb8], 0x409
add esp, 8
ret
mov dword [0x664fb8], 0x7f
add esp, 8
ret

Function at 0x5b58dc
Capabilities:
Encode data using xor

Disassembly:
nop
mov dword [eax - 0x58], ecx
call [edi - 0x75]
mov bh, 0x73
pop esp
lodsb al, byte [esi]
and edi, edi
and esp, dword [ebx - 0x27e242b7]
rcl dword gs:[esi + ebx*2], 0x1c
popfd
aam 0x31
dec ebp
pop edx
fnstenv [esi - 0x5a]
xor ch, byte [eax]
mov ebp, 0x494545cb
invalid
mov esi, dword [edi + 0x21ac5c73]
jmp dword [ebx]
rcl byte [ebx + 0x2e763279], 0x89
sub bl, byte [ebp - 0x2c]
mov edx, 0xfff48ec2
retf
mov edi, dword [ebp - 0x14]
xor eax, 0xb1510d21
shr dword [esp + esi - 0x39], cl
jl 0x5b5840
add esi, esp
jl 0x5b583a
sbb al, 0x7d
shl ebp, cl
ror dword fs:[ebp - 0x2e], 0xbb
jge 0x5b5875
in eax, 0x64
ror dword [ebp - 0x2e], 0xbb
mov dh, 0xcc
mov ebp, 0xf7c9820d
cmp al, 0x31
enter 0xffffffffffffdb07, 0x50
or eax, 0x8dcf88d7
test dword [edx - 0x426dd0bc], ebp
sbb edi, dword [esi + esi*8 - 0x7c837170]
sbb byte [edi + ecx + 0xe920cbc], 0x20
xor al, 0xad
xchg esp, eax
cdq
inc ebp
ja 0x5b588d
sub dword [edi - 0x7a], eax
mov esp, 0x68476e64
push eax
sub al, 0x60
inc eax
out 0x54, eax
imul ecx, ebx, 0x33
adc byte [edx + 0x71], bl
push cs
adc al, 0xe8
jne 0x5b5955
in al, dx
mov ecx, 0xf88cb39b
xor byte [edi - 0x38], dl
jb 0x5b58a0
invalid
mov ebp, 0x859e248f
mov dl, 0xa2
xor al, 0xe6
push edx
out 0x7c, al
mov bh, 0xc
outsb dx, byte [esi]
pushfd
iretd
and dh, dl
popfd
push ebx
xchg ecx, eax
jg 0x5b5918
cli
jmp 0x5b59d4
mov dword [ebp - 0x4f328624], ecx
mov al, 0x62
dec ecx
add eax, 0xf2a1bbb3
xchg esp, eax
int3
Function at 0x603c59
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xe7d300ce
add byte [eax], ah
adc ebx, esi
push ss
dec edx
add dword [edx + 0x58], esi
call 0xead4acdf
dec ecx
in al, 0x6f
xor eax, 0x37b10d70
cdq
popfd
invalid
mov bh, 0x96
ja 0x603c70
sub esi, dword [esi - 0x30]
jp 0x603b8b
push 0xffffffffffffffb0
sub bl, byte [edx + edi*8 - 0x69ee7c50]
or al, 0x26
out 0xf6, eax
pushfd
cli
mov al, 0x83
adc dword [esi - 0x918d9f4], edx
adc dword [esi - 0x550f0d5d], esi
jg 0x603c9b
enter 0xffffffffffff9830, 0
pop es
cwde
add byte [edi], al
aam 0x36
nop
insb byte es:[edi], dx
loopne 0x603c02
mov al, 0x38
lodsb al, byte [esi]
call dword [edx + eax - 0x3e]
ret 0xe630
mov al, 0xca
mov ebp, 0x312fb072
mov eax, dword [0x58a60e99]
jb 0x603c0e
das
xor dword [ecx + 0x58a60e99], esp
adc eax, 0x200a2793
xchg esi, eax
xlatb
xchg ebp, eax
cdq
xor cl, byte [ebx - 0x71]
push esp
xlatb
adc byte [edx + 0x64], dh
cmc
inc esp
cmpsb byte [esi], byte es:[edi]
loop 0x603c5c
dec ebx
invalid
adc byte [ebx + 0x22b812c5], al
scasd eax, dword es:[edi]
jnp 0x603c94
mov eax, 0xf7baf22
dec eax
invalid
jo 0x603c80
pushal
cmp eax, 0x98006136
cwde
loopne 0x603c23
and byte [ebp - 0x78], cl
scasd eax, dword es:[edi]
ret

Function at 0x659a0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662398
cmp edx, dword [eax]
je 0x659a2f
add eax, 8
inc ecx
cmp eax, 0x662428
jl 0x659a20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662398]
jne 0x659b5d
mov eax, dword [0xa5ccfc]
cmp eax, 1
je 0x659b37
test eax, eax
jne 0x659a60
cmp dword [0x6622c4], 1
je 0x659b37
cmp edx, 0xfc
je 0x659b5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659a97
lea eax, [ebp - 0x1a4]
push 0x65eab0
push eax
call fcn.0065a3f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a880
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659ada
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a880
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eaac
push edi
call fcn.0065c750
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ea90
push eax
call fcn.0065a3f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a400
lea eax, [ebp - 0xa0]
push 0x65ea8c
push eax
call fcn.0065a400
push dword [esi + 0x66239c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a400
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ea64
push eax
call fcn.0065c6c4
add esp, 0x2c
pop edi
jmp 0x659b5d
lea eax, [ebp + 8]
lea esi, [esi + 0x66239c]
push 0
push eax
push dword [esi]
call fcn.0065a880
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4030d0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404ee4
test esi, esi
jne 0x403106
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404fd4
jmp 0x403124
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402fd4
mov edi, eax
test esi, esi
je 0x403124
cmp dword [ebx], 0
je 0x403124
dec esi
jmp 0x40310d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x488020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403f58
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f38
xor eax, eax
push ebp
push 0x403f31
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403f74
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f38
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x488020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x488020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404d64
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x51c048], 0
je 0x404dc5
cmp word [0x51c21c], 0xd7b2
jne 0x404d8d
cmp dword [0x51c224], 0
jbe 0x404d8d
mov eax, 0x51c218
call dword [0x51c234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404dec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48802c], 0
jne 0x404de1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4063e0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406610
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406463
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406610
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406463
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40662c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4064ec
xor eax, eax
push ebp
push 0x4064e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040621c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4064ca
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40664c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4064ca
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406606
cmp byte [ebp - 0xd], 0
jne 0x406533
cmp byte [ebp - 0x12], 0
je 0x406606
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40654c
dec ebx
cmp byte [ebx], 0x2e
je 0x40655b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40654b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406606
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406598
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406606
cmp byte [ebp - 0xd], 0
je 0x406606
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406606
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408b64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408bf4
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408bf4
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408ba7
test edx, 3
jne 0x408b96
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408ba1
jmp 0x408ba7
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408ba7
cmp dword [ecx - 8], 1
je 0x408bb1
mov edx, ebx
or edx, 3
call fcn.00405630
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408bc3
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404ee4

Function at 0x408c00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408c90
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408c90
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408c43
test edx, 3
jne 0x408c32
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408c3d
jmp 0x408c43
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408c43
cmp dword [ecx - 8], 1
je 0x408c4d
mov edx, ebx
or edx, 3
call fcn.00405630
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408c5f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404ee4

Function at 0x409684
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004053a8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40969d
test al, 0x10
je 0x4096a1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c318
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c351
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404fd4
jmp 0x40c35a
mov eax, ebx
mov edx, esi
call fcn.00404f38
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c364
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c386
movzx eax, byte [esp]
jmp 0x40c388
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40ca18
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c890
mov eax, dword [0x51b35c]
cmp byte [eax], 0
je 0x40ca94
mov eax, dword [0x51b130]
call fcn.0040350c
call fcn.00402e40
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004099a8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cadc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40caca
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x51b0d0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x51e7f4]
call fcn.004061c4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d328
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d3fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404f7c
lea eax, [ebp - 4]
call fcn.004053f8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004053a8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d3e8
mov eax, ebx
call fcn.00402ce4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d3e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004053a8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d3cb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d410
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d3cb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3e8
mov eax, dword [ebp - 0x10]
call fcn.00402d00
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d405
lea eax, [ebp - 4]
call fcn.00404ee4
ret
Function at 0x41c48c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x51f300
cmp dword [edi], 0
jne 0x41c508
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x51f2fc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x488ad8
mov ecx, 2
call fcn.00402ed4
mov edx, 0x41c464
lea eax, [esi + 5]
call fcn.0041c484
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041c484
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41c4dd
mov dword [0x51f2fc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41eb50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004053a8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41eba8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x51b494]
mov dl, 1
mov eax, dword [0x41e674]
call fcn.0040cbd8
call fcn.0040492c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041e77c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41fd38
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41fd3e
ret
Function at 0x4367bc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405398
xor eax, eax
push ebp
push 0x4368f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4368c4
xor edx, edx
push ebp
push 0x4368bd
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x436809
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x436892
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x436881
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x436848
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.004053a8
lea ecx, [ebx + 1]
mov edx, esi
call fcn.00402ed4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436888
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x51b06c]
mov dl, 1
mov eax, dword [0x407eb8]
call fcn.0040cb9c
call fcn.0040492c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4368f8
lea eax, [ebp - 4]
call fcn.00404ee4
ret
Function at 0x436900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x436abb
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405694
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x436ad4
call fcn.004051f4
mov eax, ebx
call fcn.0041ba0c
mov edi, eax
dec edi
test edi, edi
jl 0x4369b8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041b9e0
mov edx, dword [0x42c958]
call fcn.00404244
test al, al
je 0x4369b4
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0041b9e0
lea edx, [ebp - 0x14]
call fcn.004454b4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405694
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405268
inc esi
dec edi
jne 0x436966
movzx eax, byte [0x436ad8]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x436ae4
mov eax, dword [ebp - 8]
call fcn.0040de90
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404f7c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004454b4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x436ad4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.004454b4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x436ad4
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x436ad4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x436af0
call fcn.0040a0c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436ac2
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404f08
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404f08
lea eax, [ebp - 0x14]
call fcn.00404ee4
lea eax, [ebp - 0x10]
call fcn.00404ee4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f08
ret