joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43f500
mov ebx, eax
sar ebx, 1
add ebx, 4
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x43f525
mov ecx, 0xffffffff
jmp 0x43f527
add ecx, ecx
push ecx
call fcn.004095a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f571
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f560
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 4], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 6], cx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x80b0a05
mov byte [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43f610
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x1dede7e7
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x1d
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43f5e0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x44ab54]
test ecx, ecx
je 0x43f673
xor edx, edx
mov ebx, dword [0x44ab58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x8896be63
je 0x43f64a
mov edi, edx
xor edi, 1
and edx, 1
lea edx, [edi + edx*2]
cmp edx, ecx
jb 0x43f630
jmp 0x43f673
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f673
lea edx, [esp + 0x28]
lea esi, [esp + 0x10]
push edx
push esi
push 2
push dword [0x44ab5c]
push ecx
mov ebx, eax
call fcn.0043d150
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.004095b0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43f689
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x10], 0x80b0a05
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x43f703
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
add eax, 0x1dede7e7
xor eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x1d
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x43f6d0
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x44ab54]
test edx, edx
je 0x43f758
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44ab58]
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x43f730
inc edi
cmp edx, edi
jne 0x43f720
jmp 0x43f758
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43f758
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x44ab5c]
push edx
call fcn.0043d150
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43f765
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x43f771
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f780
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x80b0a05
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43f7de
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x1dede7e7
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x1d
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43f7b0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab54]
test ecx, ecx
je 0x43f83c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44ab58]
cmp dword [ebp + ebx*8], 0x72e9dc72
je 0x43f811
inc ebx
cmp ecx, ebx
jne 0x43f800
jmp 0x43f83c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x43f83c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44ab5c]
push ecx
call fcn.0043d150
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x43f8f6
mov dword [esp + 8], 0x80b0a05
mov byte [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x43f8a1
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x1dede7e7
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x1d
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x43f870
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab54]
test ecx, ecx
je 0x43f8ee
xor edx, edx
mov ebx, dword [0x44ab58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x43f8d0
inc edx
cmp ecx, edx
jne 0x43f8c0
jmp 0x43f8ee
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43f8ee
push 0
push 0
push esi
push 3
push dword [0x44ab5c]
push ecx
call fcn.0043d150
add esp, 0x18
test eax, eax
js 0x43f8f6
mov eax, dword [esp + 0x10]
test edi, edi
je 0x43f909
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f907
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f920
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x80b0a05
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43f97e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x1dede7e7
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x1d
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43f950
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab54]
test ecx, ecx
je 0x43f9dc
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44ab58]
cmp dword [ebp + ebx*8], 0xe6919031
je 0x43f9b1
inc ebx
cmp ecx, ebx
jne 0x43f9a0
jmp 0x43f9dc
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x43f9dc
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44ab5c]
push ecx
call fcn.0043d150
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x43fa96
mov dword [esp + 8], 0x80b0a05
mov byte [esp + 0xc], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x43fa41
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x1dede7e7
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x1d
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x43fa10
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab54]
test ecx, ecx
je 0x43fa8e
xor edx, edx
mov ebx, dword [0x44ab58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x43fa70
inc edx
cmp ecx, edx
jne 0x43fa60
jmp 0x43fa8e
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43fa8e
push 0
push 0
push esi
push 3
push dword [0x44ab5c]
push ecx
call fcn.0043d150
add esp, 0x18
test eax, eax
js 0x43fa96
mov eax, dword [esp + 0x10]
test edi, edi
je 0x43faa0
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43fad0
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 0xc], bx
add ebx, 2
mov word [esp + 0xe], bx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x80b0a05
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43fb6e
nop
nop
nop
nop
mov eax, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
add eax, 0x1dede7e7
xor eax, edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x1d
mov edi, dword [esp]
mov byte [esp + edi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43fb40
mov eax, dword [esp + 4]
mov edi, dword [0x44ab54]
test edi, edi
je 0x43fbc2
xor ebx, ebx
mov ebp, dword [0x44ab58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x81105f7a
je 0x43fba1
inc ebx
cmp edi, ebx
jne 0x43fb90
jmp 0x43fbc2
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43fbc2
lea eax, [esp + 0x18]
push esi
push eax
push edx
push ecx
push 4
push dword [0x44ab5c]
push edi
call fcn.0043d150
add esp, 0x1c
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402990
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029cd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029ed
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404ca4
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402bb4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a3c
test esi, esi
jne 0x402bea
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b2c
jmp 0x402c08
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a68
mov edi, eax
test esi, esi
je 0x402c08
cmp dword [ebx], 0
je 0x402c08
dec esi
jmp 0x402bf1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403324
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4fe008], 0x8088405
inc edx
mov dword [ebx + 0x4fe008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403a94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4fe010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403b2c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403b0c
xor eax, eax
push ebp
push 0x403b05
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403b48
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b0c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4fe010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4fe010], ax
mov esp, ebp
pop ebp
ret

Function at 0x40481c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50304c], 0
je 0x40487d
cmp word [0x503220], 0xd7b2
jne 0x404845
cmp dword [0x503228], 0
jbe 0x404845
mov eax, 0x50321c
call dword [0x503238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4fe078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4048a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4fe020], 0
jne 0x404899
push 0
push 0x4fe098
push 0x4fe078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4049f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040277c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x50304d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4049b8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4099a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404eec
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4099b9
test al, 0x10
jne 0x4099bd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c7ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c7e5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404b2c
jmp 0x40c7ee
mov eax, ebx
mov edx, esi
call fcn.00404a90
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c7f8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c819
mov al, byte [esp]
jmp 0x40c81b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cea0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40cd18
mov eax, dword [0x502648]
cmp byte [eax], 0
je 0x40cf0d
mov eax, dword [0x502398]
call fcn.00403020
call fcn.004028e4
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409e00
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cf54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40cf43
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x50233c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x503718]
call fcn.00406394
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40ddb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40de14
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404ca4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004095b8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de1b
lea eax, [ebp - 0xc]
call fcn.00404a3c
ret
Function at 0x42147c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceA
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x4214b2
push ebp
call fcn.0042140c
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x4214d8
push ebp
call fcn.0042140c
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.00420e6c
mov esp, ebp
pop ebp
ret 4

Function at 0x427200
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setge dl
mov eax, dword [ebp - 4]
call fcn.00427018
cmp dword [ebp - 8], 1
jne 0x427234
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
pop ecx
pop ecx
pop ebp
ret

Function at 0x428ad8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x503a80], 0
jne 0x428b85
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [0x503a7c]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x4fe624
mov ecx, 2
call fcn.00402a28
mov edx, 0x428a94
mov eax, dword [ebp - 8]
add eax, 5
call fcn.00428ab4
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.00428ab4
mov edx, dword [ebp - 0xc]
mov dword [edx + 1], eax
mov eax, dword [0x503a80]
mov edx, dword [ebp - 0xc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0xc]
mov dword [0x503a80], eax
add dword [ebp - 0xc], 0xd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x428b3f
mov eax, dword [ebp - 8]
mov dword [0x503a7c], eax
mov eax, dword [0x503a80]
mov dword [ebp - 4], eax
mov eax, dword [0x503a80]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 5]
mov dword [0x503a80], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x42a194
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42a19a
ret
Function at 0x42c87c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42c8cd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42c8b4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42c8a4
jmp 0x42c8cd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42c8b5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f73c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 4]
xor eax, eax
push ebp
push 0x43f8fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
call fcn.0046a01c
mov eax, dword [ebx]
cmp byte [eax + 0x210], 0
je 0x43f8e1
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebx]
sub eax, dword [edx + 0x220]
cmp eax, 0x1f4
jb 0x43f79f
mov eax, dword [ebx]
add eax, 0x21c
call fcn.00404a3c
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebx]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 8
je 0x43f870
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [0x5027bc]
and eax, 0xff
bt dword [edx], eax
jae 0x43f832
push 1
push 0x102
push 0x102
mov eax, dword [ebx]
call fcn.0046afec
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x43f8b0
mov eax, dword [ebx]
push dword [eax + 0x21c]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00404c1c
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.00404c1c
push dword [ebp - 0x2c]
mov eax, dword [ebx]
add eax, 0x21c
mov edx, 3
call fcn.00404db4
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x43f8b0
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00404c1c
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx]
add eax, 0x21c
call fcn.00404cfc
jmp 0x43f8b0
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404cf4
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.00404f8c
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404cf4
mov edx, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.0040d844
cmp al, 2
je 0x43f850
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404cf4
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.00404f8c
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404cf4
test eax, eax
jle 0x43f8ca
push ebp
call fcn.0043f654
pop ecx
jmp 0x43f8e1
xor edx, edx
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebx]
mov si, 0xffeb
call fcn.00403e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f903
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404a60
ret
Function at 0x44651c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404edc
xor eax, eax
push ebp
push 0x44664a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x44661d
xor eax, eax
push ebp
push 0x446616
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404cf4
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4465eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4465da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404cf4
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404eec
mov edx, ebx
pop ecx
call fcn.00402a28
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4465e1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x502290]
mov dl, 1
mov eax, dword [0x4083ec]
call fcn.0040d014
call fcn.004043f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446651
lea eax, [ebp - 4]
call fcn.00404a3c
ret