joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491450
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x59df44]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49163a
sub esp, 0x48
mov eax, dword [0x575334]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 0xa]
movzx ebx, word [ecx + 0xc]
movzx ebp, word [ecx + 2]
movzx esi, word [ecx + 8]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.0048e140
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.004660ce
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.004660ce
call fcn.0048ced0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call fcn.0045e5e0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x491527
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x491541
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x4915b8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x49158e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x49158a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x491583
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x491590
mov ebx, 0x1d
jmp 0x4915ae
mov ebp, eax
jmp 0x491590
mov ebp, eax
cmp ebp, 0xd
jae 0x49162d
lea eax, [ebp - 1]
lea edx, [0x56e6a0]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x491623
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x4915b8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x4915ea
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x4915f2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call fcn.00465a90
mov eax, ebp
mov ecx, 0xd
call fcn.00465a90
nop
call fcn.00464630
jmp fcn.00491450
Function at 0x4a51f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x59df44]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a52e1
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x4a522c
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x4a5265
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.00469fd0
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4a5221
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4a526f
inc eax
cmp eax, 4
jge 0x4a5284
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x4a52da
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0046a010
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x4a52ab
jmp 0x4a526e
call fcn.00464630
jmp fcn.004a51f0
Function at 0x73c928
Capabilities:
Encode data using xor

Disassembly:
rcr byte [eax + 0x79], 0xe9
mov ecx, 0xeffc5d20
push es
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 8], 0xb
mov ecx, dword [ebp - 0x28]
int3
or esp, dword [esi - 0x75]
clc
add dword [eax + esi*8 + 0x22], ecx
sub al, 0x7a
mov ebp, 0x10220399
insd dword es:[edi], dx
in al, dx
sub ebx, edi
pop ebp
adc eax, 0xc8b70fd5
add edx, 2
jecxz 0x73c877
jnp 0x73c900
adc byte [ecx], al
jne 0x73c898
jmp 0x73c92d
inc esp
sbb edi, dword [eax]
lodsd eax, dword [esi]
jecxz 0x73c97a
push ss
pop edi
call 0x3844a4c7
jle 0x73c948
pop es
jne 0x565d0391
add al, 0xe8
dec edi
wait
pop ecx
xlatb
aam 0x90
push esp
dec edi
inc ebp
adc esp, ecx
add bh, bh
jmp [esi - 0x1374aac2]
dec ebp
adc byte [ebx], cl
leave
je 0x73c980
mov esi, dword [ebp + 8]
pop es
je 0x73c972
or al, al
je 0x73c972
and eax, dword [ebx - 0x387cfe3a]
add dword [edx], edi
out 0x72, eax
push es
add esi, 1
add edi, 1
mov dword [ecx], 0x672e73a
ja 0x73c963
add ah, dh
cmp al, bh
or ebx, eax
invalid
leave
cmp ah, al
je 0x73c9f1
rcr edi, 0xc1
or dword [ecx + 0x272ff55], edi
neg ecx
mov eax, ecx
fist dword [edi + 0xd]
jne 0x73c94e
cmpsd dword [esi], dword es:[edi]
jle 0x73c9a0
xchg edi, eax
adc al, 0xec
add dword [eax - 0x17ef8711], 0x35
push eax
push esi
cmp eax, esi
pop ecx
sbb byte [ecx - 0x4676cc10], dh
push ds
jmp [eax]
or al, 0x1d
sub byte [edx - 0x17263233], ah
sbb dword [eax], 0xffffffe8
or al, 0xe8
push cs
mov esi, dword [ebp + 0x1d]
mov eax, dword [0xc04b9fba]
jne 0x73ca13
js 0x73c9e1
mov word [ebx - 0xac8728], cs
add eax, dword [edi + 0x12e85607]
dec ebx
add dword [eax], eax
call fcn.0075152a
jmp 0x9e7cb01
Function at 0x8de700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x64e00d
lea edi, [esi - 0x24d00d]
push edi
or ebp, 0xffffffff
jmp 0x8de722
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8de729
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8de718
mov eax, 1
add ebx, ebx
jne 0x8de73b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8de730
jne 0x8de74c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8de730
xor ecx, ecx
sub eax, 3
jb 0x8de760
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8de7d2
mov ebp, eax
add ebx, ebx
jne 0x8de76b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x8de778
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x8de79c
inc ecx
add ebx, ebx
jne 0x8de788
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8de77d
jne 0x8de799
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8de77d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8de7bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8de7ad
jmp 0x8de71e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8de7bc
add edi, ecx
jmp 0x8de71e
pop esi
mov edi, esi
mov ecx, 0x1740
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8de7da
cmp byte [edi], 0x11
jne 0x8de7da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8de7df
lea edi, [esi + 0x4da000]
mov eax, dword [edi]
or eax, eax
je 0x8de84e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4e60d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4e612c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8de80c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4e6134]
or eax, eax
je 0x8de848
mov dword [ebx], eax
add ebx, 4
jmp 0x8de829
call dword [esi + 0x4e6130]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x8de87f
cmp al, 0xef
ja 0x8de872
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x8de854
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x8de861
mov ebp, dword [esi + 0x4e6138]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8de8b3
sub esp, 0xffffff80
jmp 0x406c9c
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5808483e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x62d874e4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7afa0e7a
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x68f7c80
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402c88
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4b0008], 0x8088405
inc edx
mov dword [ebx + 0x4b0008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403178
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4b0024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403210
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031f0
xor eax, eax
push ebp
push 0x4031e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40322c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4b0024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4b0024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f1c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b304c], 0
je 0x403f7d
cmp word [0x4b3220], 0xd7b2
jne 0x403f45
cmp dword [0x4b3228], 0
jbe 0x403f45
mov eax, 0x4b321c
call dword [0x4b3238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4b0070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403fa4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b0034], 0
jne 0x403f99
push 0
push 0x4b0068
push 0x4b0070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4040d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402798
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4b304d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404098
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406370
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4063d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040438c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d10
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4063c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063dd
lea eax, [ebp - 0x10]
call fcn.0040411c
ret

Function at 0x40bf98
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bfd1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040420c
jmp 0x40bfda
mov eax, ebx
mov edx, esi
call fcn.00404170
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bfe4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c005
mov al, byte [esp]
jmp 0x40c007
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c68c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c504
mov eax, dword [0x4b2d90]
cmp byte [eax], 0
je 0x40c708
mov eax, dword [0x4b2934]
call fcn.00402ab8
call fcn.00402900
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004090f8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c750
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c73e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4b28a8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4b3668]
call fcn.00405884
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d010
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d0e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004041b4
lea eax, [ebp - 8]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004045dc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d0d0
mov eax, ebx
call fcn.00402798
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d0c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004045dc
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d0b3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d0f8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d0b3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d0d0
mov eax, dword [ebp - 0x10]
call fcn.004027b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d0ed
lea eax, [ebp - 8]
call fcn.0040411c
ret

Function at 0x40d6f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d75c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040438c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408ba8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d763
lea eax, [ebp - 0xc]
call fcn.0040411c
ret

Function at 0x424e00
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x424e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00424c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x424e65
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x424e6c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00424c14
dec esi
jne 0x424e8e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x425fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4b388c
cmp dword [edi], 0
jne 0x42604c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4b3888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b05f0
mov ecx, 2
call fcn.00402994
mov edx, 0x425fa8
lea eax, [esi + 5]
call fcn.00425fc8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00425fc8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x426021
mov dword [0x4b3888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4275c8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4275ce
ret

Function at 0x429bec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x429c3d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x429c24
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x429c14
jmp 0x429c3d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x429c25
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432a7c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004045cc
xor eax, eax
push ebp
push 0x432baa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x432b7d
xor eax, eax
push ebp
push 0x432b76
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004043dc
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x432b4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x432b3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004043dc
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004045dc
mov edx, ebx
pop ecx
call fcn.00402994
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432b41
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4b27c4]
mov dl, 1
mov eax, dword [0x407868]
call fcn.0040c834
call fcn.00403ad4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432bb1
lea eax, [ebp - 4]
call fcn.0040411c
ret
Function at 0x432bb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x432d69
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004047cc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x432d80
call fcn.00404428
mov eax, ebx
call fcn.00425564
mov edi, eax
dec edi
test edi, edi
jl 0x432c70
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00425538
mov edx, dword [0x439f44]
call fcn.00403494
test al, al
je 0x432c6c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00425538
lea edx, [ebp - 0x14]
call fcn.00442370
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004047cc
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040449c
inc esi
dec edi
jne 0x432c1e
mov al, byte [0x432d84]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x432d90
mov eax, dword [ebp - 0xc]
call fcn.0040dcd0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004041b4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00442370
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x432d80
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00442370
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x432d80
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x432d80
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x432d9c
call fcn.004097f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432d70
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404140
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404140
lea eax, [ebp - 0x14]
call fcn.0040411c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404140
ret