joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42306b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 8], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret 8

Function at 0x42306f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 8], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret 8

Function at 0x4241c2
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
cmp edi, 0xffffffff
je 0x4242b1
cmp byte [esp + 0x24], 0
mov ebp, dword [esp + 0x20]
je 0x424217
test byte [ebp], 8
je 0x424217
xor eax, eax
mov dword [esp + 0x1c], eax
call fcn.004227a5
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push 0x80
push 0xffff
push ebp
push edi
call fcn.004257c4
add esp, 0x1c
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00422b53
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4242b1
call fcn.00425cac
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x2733
call fcn.004060e5
pop ecx
pop ecx
test al, al
jne 0x424279
call fcn.00425cac
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x4d5
call fcn.004060e5
pop ecx
pop ecx
test al, al
je 0x4242ad
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [ebp], 0xfc
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00422b53
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x4242bc
call fcn.004227a5
and dword [ebx], 0
mov dword [ebx + 4], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x424fff
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x4d5734
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x425049
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x42505f
push method.Poco::Util::Subsystem.virtual_20
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
leave
ret

Function at 0x4257c4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
or edi, 0xffffffff
cmp dword [ebp + 8], edi
jne 0x4257e8
call fcn.00425cac
mov ecx, dword [ebp + 0x20]
mov dword [ecx + 4], eax
mov eax, edi
mov dword [ecx], 0x2719
jmp 0x42589b
cmp dword [ebp + 0x10], 0xa5100000
push esi
mov esi, dword [ebp + 0x14]
jne 0x42584a
cmp esi, 2
jne 0x425810
call fcn.00425cac
mov ecx, dword [ebp + 0x20]
mov dword [ecx], 0x2726
mov dword [ecx + 4], eax
jmp 0x425898
cmp esi, 1
jne 0x425861
cmp dword [ebp + 0x1c], 4
jne 0x4257fa
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
mov al, cl
or cl, 4
and al, 0xfb
movzx edx, cl
movzx ecx, al
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
cmove edx, ecx
mov byte [esi], dl
call fcn.004227a5
mov ecx, dword [ebp + 0x20]
and dword [ecx], 0
mov dword [ecx + 4], eax
xor eax, eax
jmp 0x42589a
cmp dword [ebp + 0x10], 0xffff
jne 0x425861
cmp esi, 0x80
jne 0x425861
mov eax, dword [ebp + 0xc]
or byte [eax], 8
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [ebp + 0x20]
push esi
push eax
call fcn.00422b53
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x425898
call fcn.004227a5
and dword [esi], edi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebp
ret

Function at 0x425be0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4cf284]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
inc eax
lock xadd dword [esi], eax
inc eax
cmp eax, 1
jne 0x425c29
movzx ecx, byte [ebp + 0x10]
lea eax, [ebp - 0x194]
push eax
movzx eax, byte [ebp + 0xc]
shl cx, 8
or cx, ax
movzx eax, cx
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea ecx, [esi + 4]
xchg dword [ecx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00430461
leave
ret
Function at 0x42a288
Capabilities:
Set thread local storage value

Disassembly:
push 0x28
mov eax, 0x48936b
call fcn.004304a9
mov ebx, ecx
mov edi, dword [ebp + 8]
push dword [edi]
call fcn.0042bde1
pop ecx
test eax, eax
je 0x42a2c8
xor esi, esi
lea ecx, [ebp + 0xb]
push esi
call fcn.0042b30c
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
call fcn.0042a005
pop ecx
pop ecx
xchg dword [ebp + 0xc], eax
jmp 0x42a355
mov esi, dword [ebp + 0xc]
push esi
push 0x38
mov dword [ebp - 0x28], esi
call fcn.00424199
pop ecx
pop ecx
push esi
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0042ad27
push eax
push edi
mov ecx, ebx
mov dword [ebp + 0xc], eax
call fcn.0042c347
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
test al, al
je 0x42a34d
push dword [edi]
lea ecx, [ebp - 0x34]
call fcn.0042b045
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], esi
call fcn.004227a5
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp + 0xc]
push dword [ebx + 0x14]
call fcn.0042c055
add esp, 0x10
lea ecx, [ebp - 0x1c]
call fcn.0042b3d2
push dword [ebp - 0x2c]
push dword [0x4d573c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x28]
call fcn.0042d370
call fcn.00430472
ret 8
Function at 0x42d5cd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x42d5e8
push 0
push 0
jmp 0x42d651
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x42d5fb
push 0
push 0x2719
jmp 0x42d651
mov eax, dword [ebp + 0x14]
and dword [ebp + 0x18], 0
push edi
push 0
push dword [ebp + 0x1c]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x42d634
mov eax, 0x2746
jmp 0x42d641
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test edi, edi
pop edi
je 0x42d65e
cmp eax, 0x3e5
je 0x42d65e
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.00425386
jmp 0x42d669
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.004253e3
pop esi
pop ebp
ret 0x18

Function at 0x42d66e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x42d689
push 0
push 0
jmp 0x42d6df
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x42d69c
push 0
push 0x2719
jmp 0x42d6df
and dword [ebp + 0x18], 0
lea ecx, [ebp + 0x18]
push esi
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
pop esi
je 0x42d6ec
cmp eax, 0x3e5
je 0x42d6ec
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
mov ecx, dword [edi + 4]
call fcn.00425386
jmp 0x42d6f7
push dword [ebp + 0x1c]
mov ecx, dword [edi + 4]
call fcn.004253e3
pop edi
pop ebp
ret 0x18
Function at 0x42edf4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x42ee18
jl 0x42ee0f
test esi, esi
jne 0x42ee18
xor eax, eax
xor edx, edx
jmp 0x42ef0f
cmp dword [edi + 0x38], 0
je 0x42ee2d
push ebx
push esi
push dword [ebp + 8]
call fcn.0040cd75
jmp 0x42ef0f
mov eax, dword [edi + 0x1c]
mov edx, esi
mov dword [ebp - 8], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x42ee42
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x42ee44
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
test eax, eax
je 0x42ee85
cmp eax, esi
jb 0x42ee57
mov eax, esi
mov dword [ebp - 4], eax
push eax
push ecx
push dword [ebp + 8]
call fcn.00450d00
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp + 8]
sub edx, ecx
add eax, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], edx
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x42ee8b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x42ef03
mov ecx, edi
call fcn.0042e79f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x42eedf
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.0045dbf9
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x42eedb
cmp edx, eax
ja 0x42eea8
jmp 0x42eee2
sub esi, edx
jmp 0x42ef08
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x42ef06
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.0045dbf9
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x42ef06
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43bbd3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x43bbec
mov eax, dword [ecx + 0x100]
push 1
and dword [eax], 0
call fcn.0043c188
lea ecx, [esi + 4]
pop esi
jmp fcn.00417c00

Function at 0x43bd3e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x468acc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468942

Function at 0x46d151
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046cca4

Function at 0x474c59
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x474cad
test byte [esi + 0x48], 1
je 0x474cad
test byte [esi + 0x48], 2
je 0x474c7c
mov eax, dword [esi]
call dword [eax + 0x34]
mov eax, dword [esi + 0x68]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x474ca1
lea eax, [esi + 0x50]
push eax
call fcn.0041656e
pop ecx
mov eax, dword [ebp - 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
jmp 0x474cb0
or eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x474f24
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
je 0x474fb4
test byte [esi + 0x48], 2
je 0x474fb4
push edi
xor edi, edi
test byte [esi + 0x48], 8
je 0x474f85
push 2
lea ecx, [ebp - 8]
xorps xmm0, xmm0
push ecx
push edi
push eax
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x474f79
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x474f76
lea eax, [esi + 0x50]
push eax
call fcn.0041656e
pop ecx
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x70], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x68]
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x474fa8
lea eax, [esi + 0x50]
push eax
call fcn.0041656e
pop ecx
mov eax, dword [ebp - 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], edi
pop edi
jmp 0x474fb7
or eax, 0xffffffff
pop esi
leave
ret 0xc
Function at 0x4032ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x455020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403384
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403364
xor eax, eax
push ebp
push 0x40335d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403364
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x455020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x455020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404088
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x457048], 0
je 0x4040e9
cmp word [0x45721c], 0xd7b2
jne 0x4040b1
cmp dword [0x457224], 0
jbe 0x4040b1
mov eax, 0x457218
call dword [0x457234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45506c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404110
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x455030], 0
jne 0x404105
push 0
push 0x455064
push 0x45506c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406054
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4060ba
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040447c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402eb0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4060a4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060c1
lea eax, [ebp - 0x10]
call fcn.0040420c
ret

Function at 0x40b2e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b321
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004042fc
jmp 0x40b32a
mov eax, ebx
mov edx, esi
call fcn.00404260
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b334
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b355
mov al, byte [esp]
jmp 0x40b357
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b9ec
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b854
mov eax, dword [0x456058]
cmp byte [eax], 0
je 0x40ba68
mov eax, dword [0x455e6c]
call fcn.00402d1c
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004089d0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bab0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ba9e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x455e18]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x457664]
call fcn.004054c0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c30c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c3e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042a4
lea eax, [ebp - 8]
call fcn.0040471c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046cc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c3cc
mov eax, ebx
call fcn.00402a28
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c3c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046cc
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c3af
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c3f4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c3af
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c3cc
mov eax, dword [ebp - 0x10]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c3e9
lea eax, [ebp - 8]
call fcn.0040420c
ret

Function at 0x40c948
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c9ac
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040447c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004084e4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c9b3
lea eax, [ebp - 0xc]
call fcn.0040420c
ret

Function at 0x41ddac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x457884
cmp dword [edi], 0
jne 0x41de28
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x457880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4553ec
mov ecx, 2
call fcn.00402c48
mov edx, 0x41dd84
lea eax, [esi + 5]
call fcn.0041dda4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041dda4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41ddfd
mov dword [0x457880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f2ac
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f2b2
ret
Function at 0x421730
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x421781
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x421768
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x421758
jmp 0x421781
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x421769
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a880
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x42a952
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x42a924
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x42a913
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00402c48
mov eax, dword [ebp - 4]
call fcn.0042a7bc
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a91a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x42a98c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x42aa2e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x42aa01
mov edx, ebx
mov eax, dword [0x41ed70]
call fcn.00422c10
test al, al
je 0x42a9f1
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00422b20
call fcn.00403ccc
jmp 0x42aa35
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x42a9bc
mov ecx, dword [0x455e10]
mov dl, 1
mov eax, dword [0x4073a0]
call fcn.0040bb70
call fcn.00403c20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42aa35
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42aa3c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x42aa94
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42aa9b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret