joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ede0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x508068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x50e574]
test eax, eax
je 0x47ee3f
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x47ee28
cmp byte [0x5102e0], al
je 0x47ee28
push eax
push str.GetExitCodeThread__
push 0x4fa150
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 8]
push eax
push dword [0x50e574]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x50e574], 0
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax + 0x3d8]
cmp esi, dword [eax + 0x3dc]
je 0x47ee7b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x18]
cmp ecx, 0xffffffff
je 0x47ee6d
push ecx
call edi
mov dword [esi + 0x18], 0xffffffff
mov eax, dword [ebp + 8]
add esi, 0x148
cmp esi, dword [eax + 0x3dc]
jne 0x47ee58
mov edi, dword [0x5108d4]
mov esi, dword [edi]
cmp esi, edi
je 0x47eedd
push ebx
lea ebx, [eax + 0x33c]
nop
push ebx
lea ecx, [esi + 8]
call fcn.00409da0
test al, al
jne 0x47eeb4
mov esi, dword [esi]
cmp esi, edi
jne 0x47ee90
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad19c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
dec dword [0x5108d8]
call fcn.00407cb0
push 0x28
push esi
call fcn.004ad677
add esp, 8
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ad19c
mov esp, ebp
pop ebp
ret
Function at 0x497400
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d87e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x508068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004911a0
mov edi, dword [ebp + 0x10]
mov ebx, eax
mov dword [ebp - 4], 0
push edi
mov dword [ebp + 0xc], ebx
lea esi, [ebx + 8]
mov ecx, esi
mov dword [ebp + 8], esi
call fcn.00406910
lea eax, [edi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x18]
call fcn.00406910
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov al, byte [edi + 0x38]
mov byte [esi + 0x38], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4ac3f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ac400
Function at 0x4c529e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c4f61

Function at 0x4c52a9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c50e2

Function at 0x4cb5f3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cb2b3
Function at 0x503c06
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00503db6
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x503d04
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x503ca7
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x503cea
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x503cbe
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x503cd9
test al, 0x40
je 0x503cd0
mov ecx, dword [edi + 0x20]
jmp 0x503cd7
test al, 0x80
je 0x503cea
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x503cea
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x503c76
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x44a880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x478
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 0x240]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x240]
push eax
call fcn.0044a810
add esp, 4
lea ecx, [esp + 4]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0x104
pop edi
jbe 0x44a8c1
xor eax, eax
mov edx, dword [esp + 0x47c]
lea eax, [esp + eax*2]
push edx
push str._s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp]
push 8
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x478
ret 4

Function at 0x48055d
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xed9f5adf]
dec esi
mov edx, 0x174d2aa
push ss
add byte [ecx - 0x37333097], cl
push es
lodsd eax, dword [esi]
xor ah, al
push 0x47
invalid

Function at 0x493c25
Capabilities:
Encode data using xor

Disassembly:
xor dh, bh
jno 0x493c36
adc al, 0x26
or byte [eax - 0x3f], dl
pop ecx
dec eax
or eax, 0x54ba59c0
rcr eax, cl

Function at 0x56fb3a
Capabilities:
Encode data using xor

Disassembly:
cmc
rcr byte [edx], 1
xchg ebp, eax
pushfd
adc byte [edx - 0x5cab02e], ah
cmpsb byte [esi], byte es:[edi]
add al, 0x6d
xor eax, 0xda12fb97
insd dword es:[edi], dx
add eax, 0x9a3c4525
mov edi, 0xe2706526
jo 0x56fb1f
jo 0x56fb1f
inc eax
mov ebx, 0x932b67dc
pop edx
lodsd eax, dword [esi]
xchg ecx, eax
jae 0x56fb62
into
or cl, byte [ebx - 0x4c]
movsd dword es:[edi], dword [esi]
dec ebx
mov ah, 0xa5
int3
push es
fistp word [ecx - 0x456ac55d]
test dword [eax], esp
or al, 0x2a
xor dh, byte [edi + eax*2 - 0x20]
in eax, 0x9c
inc edi
loopne 0x56fb4a
pushfd
xchg esp, eax
das
push esp
xor byte [eax - 0x2a8952a5], al
mov ah, 0x6c
std
sbb bl, byte es:[eax - 0x3c]
push ebp
or ch, byte [edx + 0x641b7674]
xchg edx, eax
cmc
xchg edi, eax
dec edx
rcl byte [esi - 0x2464912b]
add al, 0xef
mov dl, 0x89
pop esi
pop edx
push ebp
call 0x8c300cb5
out dx, eax
xchg ebp, eax
inc edx
adc ah, byte [edx + 0x692c541f]
jbe 0x56fb54
daa
xor edx, dword [eax + 0x5f4978dc]
sti
int3
Function at 0x5c91e7
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x6a62898c
dec eax
nop
xchg esi, eax
popal
mov eax, dword [0x387e17cb]
sbb esp, dword [edi + ebp + 0x4c95718]
add al, 0x56
add al, 0x56
ja 0x5c925f
shr dword [esi + 0x50], cl
adc dword [ebx - 0x78], ebp
mov esi, 0xcf9cef20
xor dword [ebp - 0x6575c340], ecx
push ss
sahf
jl 0x5c91d3
mov edx, 0x4bd6e528
fstp dword [eax + 0x4677ce78]
ror byte [edi + 0x72e41f5b], 1
mov ebx, 0x9e2e87a9
lcall 0x8dab, 0xe5e4cfee
jbe 0x5c925f
adc dword [eax + esi*8], edi
and dh, byte [eax + esi*4 + 0x234b0f1e]
insb byte es:[di], dx
push esp
pushal
test al, 0xf
push esp
insd dword es:[edi], dx
and dword [edi - 0x5b], ebp
lahf
insd dword es:[edi], dx
mov eax, dword [0xf7080224]
xor eax, 0x2922d6dd
aam 0x1a
sub eax, 0x22c50b40
or dword fs:[ebx + 0x1e], 0x571f614c
or dword [ebx + 0x1e], 0x571f614c
cmpsb byte [esi], byte es:[edi]
aaa
sbb al, 0xc1
mov word [bx + si - 0x73], es
invalid
inc eax
lea esp, [edx - 0x1b]
enter 0xffffffffffff97af, 0xffffffffffffffdb
mov ah, 0xbe
fsubr qword [ecx + edi*2 + 0x21ced6a]
mov esi, 0x6a79acdc
in eax, dx
sbb al, 2
push edx
push ebp
jg 0x5c92c5
dec edi
inc eax
mov esi, 0xa2d1cea5
inc esp
jne 0x5c9256
shl byte [eax - 0x57], 1
loop 0x5c9249
mov ch, 0xef
invalid
pop edi
cmp eax, 0x100b0053
or al, 0x40
and bh, bh
test byte [esi - 0x5779b6a6], bl
mov ds, word [edi + 0x2034ae19]
xchg ebp, eax
inc edi
int3
Function at 0x4029a8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029e5
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402a05
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404b94
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b6c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404924
test esi, esi
jne 0x402ba2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a14
jmp 0x402bc0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a80
mov edi, eax
test esi, esi
je 0x402bc0
cmp dword [ebx], 0
je 0x402bc0
dec esi
jmp 0x402ba9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403a04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a5020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a9c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a7c
xor eax, eax
push ebp
push 0x403a75
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403ab8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4a5020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a5020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4047a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4a804c], 0
je 0x404809
cmp word [0x4a8220], 0xd7b2
jne 0x4047d1
cmp dword [0x4a8228], 0
jbe 0x4047d1
mov eax, 0x4a821c
call dword [0x4a8238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4a5070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404830
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4a5030], 0
jne 0x404825
push 0
push 0x4a5068
push 0x4a5070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4062f4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406524
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406377
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406524
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406377
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406540
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406400
xor eax, eax
push ebp
push 0x4063f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040613c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4063de
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406560
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4063de
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406400
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40651a
cmp byte [ebp - 0xd], 0
jne 0x406447
cmp byte [ebp - 0x12], 0
je 0x40651a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406460
dec ebx
cmp byte [ebx], 0x2e
je 0x40646f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40645f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40651a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4064ac
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40651a
cmp byte [ebp - 0xd], 0
je 0x40651a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40651a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406bec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406c52
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404b94
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040346c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406c3c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c59
lea eax, [ebp - 0x10]
call fcn.00404924
ret

Function at 0x40c784
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c7bd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404a14
jmp 0x40c7c6
mov eax, ebx
mov edx, esi
call fcn.00404978
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c7d0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c7f1
mov al, byte [esp]
jmp 0x40c7f3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ce78
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ccf0
mov eax, dword [0x4a7248]
cmp byte [eax], 0
je 0x40cef4
mov eax, dword [0x4a6f34]
call fcn.00403054
call fcn.00402934
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409914
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cf3c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40cf2a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4a6ec0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4a8668]
call fcn.00406100
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d7fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d8d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004049bc
lea eax, [ebp - 8]
call fcn.00404e34
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404de4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d8bc
mov eax, ebx
call fcn.004027cc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d8b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404de4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d89f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d8e4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d89f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d8bc
mov eax, dword [ebp - 0x10]
call fcn.004027ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d8d9
lea eax, [ebp - 8]
call fcn.00404924
ret

Function at 0x40dde4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40de48
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b94
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409378
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de4f
lea eax, [ebp - 0xc]
call fcn.00404924
ret

Function at 0x4273a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4a8888
cmp dword [edi], 0
jne 0x427420
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4a8884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4a5654
mov ecx, 2
call fcn.00402a40
mov edx, 0x42737c
lea eax, [esi + 5]
call fcn.0042739c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042739c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4273f5
mov dword [0x4a8884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42899c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4289a2
ret
Function at 0x42af64
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42afb5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42af9c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42af8c
jmp 0x42afb5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42af9d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433bf4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404dd4
xor eax, eax
push ebp
push 0x433d22
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x433cf5
xor eax, eax
push ebp
push 0x433cee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404be4
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x433cc3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x433cb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404be4
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404de4
mov edx, ebx
pop ecx
call fcn.00402a40
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433cb9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4a6e20]
mov dl, 1
mov eax, dword [0x408004]
call fcn.0040d020
call fcn.00404360
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433d29
lea eax, [ebp - 4]
call fcn.00404924
ret
Function at 0x433d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433ee1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404fd4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x433ef8
call fcn.00404c30
mov eax, ebx
call fcn.00426938
mov edi, eax
dec edi
test edi, edi
jl 0x433de8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042690c
mov edx, dword [0x43ac3c]
call fcn.00403d20
test al, al
je 0x433de4
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042690c
lea edx, [ebp - 0x14]
call fcn.004458a0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404fd4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ca4
inc esi
dec edi
jne 0x433d96
mov al, byte [0x433efc]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x433f08
mov eax, dword [ebp - 0xc]
call fcn.0040e3bc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004049bc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004458a0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x433ef8
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004458a0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x433ef8
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x433ef8
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x433f14
call fcn.0040a018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433ee8
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404948
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404948
lea eax, [ebp - 0x14]
call fcn.00404924
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404948
ret