joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4722b4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4723d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004717d4
xor eax, eax
push ebp
push 0x4723b9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x472304
call fcn.00404578
jmp 0x4723c0
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.00470260
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4723a3
call fcn.004702a8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4723a3
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403e2c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4723a3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c024
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4723f0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4aaca0]
mov dl, 1
mov eax, dword [0x4702c0]
call fcn.0040c954
call fcn.004044cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4723c0
mov eax, dword [ebp - 4]
call fcn.004717e0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4723dd
lea eax, [ebp - 0x28]
call fcn.00404b5c
ret
Function at 0x47243c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x472586
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004717d4
xor eax, eax
push ebp
push 0x472569
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4724a1
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4724a1
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.00470238
jmp 0x472553
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4724b4
call fcn.00404578
jmp 0x472570
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call fcn.00470250
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x472553
call fcn.004702a8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x472553
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403e2c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x472553
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c024
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4725a0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4aaca0]
mov dl, 1
mov eax, dword [0x4702c0]
call fcn.0040c954
call fcn.004044cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472570
mov eax, dword [ebp - 4]
call fcn.004717e0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47258d
lea eax, [ebp - 0x28]
call fcn.00404b5c
ret

Function at 0x48c4a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a64c
cmp ebx, dword [ebp - 8]
jge 0x48c50b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042aa60
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042aa60
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042aa8c
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x48c4d1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48c514
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a64c
cmp ebx, dword [ebp - 8]
jge 0x48c577
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042aa60
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042aa60
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042aa8c
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x48c53d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4a27cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a2939
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406e54
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x408]
cmp eax, 0xc8
jb 0x4a291e
call fcn.00406e54
mov edx, dword [ebp - 4]
mov dword [edx + 0x408], eax
xor eax, eax
push ebp
push 0x4a2917
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x40c], 1
xor eax, eax
push ebp
push 0x4a28a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4aa8f4]
mov eax, dword [eax]
call fcn.0042fd44
mov eax, dword [0x4aa9b0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4a287e
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [0x4aa9b0]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4a2858
mov eax, dword [0x4aa9b0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a28ab
mov eax, dword [0x4aa8f4]
mov eax, dword [eax]
call fcn.0042fd4c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2940
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404b80
ret
Function at 0x4a42b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4a4490
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [0x4aad2c]
mov ebx, dword [ebx]
add ebx, ecx
mov edi, dword [0x4aacd4]
mov edi, dword [edi]
cmp ebx, 0x14
jl 0x4a4434
mov esi, edi
cmp dword [esi], 0xaa55aa55
jne 0x4a4429
mov eax, dword [esi + 0x10]
cdq
xor eax, edx
sub eax, edx
add eax, 0x14
cmp ebx, eax
jl 0x4a4434
mov eax, edi
add eax, 0x14
mov dword [ebp - 8], eax
movzx eax, word [esi + 0xa]
sub ax, 3
je 0x4a4339
sub ax, 2
je 0x4a43f3
dec ax
je 0x4a4353
dec ax
je 0x4a4398
jmp 0x4a440a
mov eax, dword [0x4aac20]
mov byte [eax], 0
call fcn.00406e54
mov edx, dword [0x4aa9d0]
mov dword [edx], eax
jmp 0x4a440a
cmp word [esi + 8], 0x3e8
jae 0x4a440a
movzx eax, word [esi + 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [0x4aad84]
mov eax, dword [edx + eax*8 + 0x44]
cmp eax, dword [esi + 4]
jne 0x4a440a
movzx eax, word [esi + 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [0x4aad84]
movzx ecx, word [esi + 0xc]
mov dword [edx + eax*8 + 0x14], ecx
jmp 0x4a440a
call fcn.00406e54
mov edx, dword [0x4aaa50]
sub eax, dword [edx]
mov edx, dword [0x4aac00]
mov dword [edx], eax
mov eax, dword [0x4aac00]
mov eax, dword [eax]
mov edx, dword [0x4aabc8]
cmp eax, dword [edx]
jbe 0x4a43cd
mov eax, dword [0x4aac00]
mov eax, dword [eax]
mov edx, dword [0x4aabc8]
mov dword [edx], eax
call fcn.00406e54
mov edx, dword [0x4aaa50]
mov dword [edx], eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 7
mov eax, dword [ebp - 4]
call fcn.0049e610
jmp 0x4a440a
mov eax, dword [ebp - 8]
push eax
mov eax, dword [esi + 0x10]
push eax
movzx ecx, word [esi + 8]
mov edx, dword [esi + 4]
mov eax, dword [ebp - 4]
call fcn.004a44e4
mov eax, dword [esi + 0x10]
cdq
xor eax, edx
sub eax, edx
add eax, 0x14
lea eax, [edi + eax]
mov edi, eax
mov eax, dword [esi + 0x10]
cdq
xor eax, edx
sub eax, edx
add eax, 0x14
sub ebx, eax
jmp 0x4a442b
inc edi
dec ebx
cmp ebx, 0x14
jge 0x4a42ed
test ebx, ebx
jle 0x4a4468
mov eax, ebx
call fcn.00402e98
mov esi, eax
mov edx, esi
mov eax, edi
mov ecx, ebx
call fcn.00403088
mov eax, dword [0x4aacd4]
mov eax, dword [eax]
call fcn.00402eb4
mov eax, dword [0x4aacd4]
mov dword [eax], esi
mov eax, dword [0x4aad2c]
mov dword [eax], ebx
jmp 0x4a4486
mov eax, dword [0x4aacd4]
mov eax, dword [eax]
call fcn.00402eb4
mov eax, dword [0x4aacd4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4aad2c]
xor edx, edx
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a44b5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a4bd4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x4a4d49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4aabf0]
mov eax, dword [eax]
call fcn.004744f8
xor eax, eax
push ebp
push 0x4a4d2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call fcn.00470228
mov edi, eax
mov eax, dword [0x4aabf0]
mov eax, dword [eax]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a4cd5
mov eax, dword [0x4aabf0]
mov eax, dword [eax]
mov edx, esi
call fcn.00419cfc
mov ebx, eax
cmp edi, dword [ebx]
jne 0x4a4ccb
call fcn.00406e54
sub eax, dword [ebx + 4]
mov edx, dword [0x4aa848]
cmp eax, dword [edx]
ja 0x4a4c9a
call fcn.00406e54
mov dword [ebx + 4], eax
inc dword [ebx + 8]
mov eax, dword [ebx + 8]
mov edx, dword [0x4aade4]
cmp eax, dword [edx]
jl 0x4a4cc5
mov edx, 0x10
mov eax, ebx
call fcn.00402eb4
mov eax, dword [0x4aabf0]
mov eax, dword [eax]
mov edx, esi
call fcn.00419bf0
mov byte [ebp - 5], 1
jmp 0x4a4cc5
mov eax, dword [ebx + 8]
mov edx, dword [0x4aade4]
cmp eax, dword [edx]
jle 0x4a4cab
mov byte [ebp - 5], 1
mov edx, 0x10
mov eax, ebx
call fcn.00402eb4
mov eax, dword [0x4aabf0]
mov eax, dword [eax]
mov edx, esi
call fcn.00419bf0
mov byte [ebp - 6], 1
jmp 0x4a4cd5
dec esi
cmp esi, 0xffffffff
jne 0x4a4c3c
cmp byte [ebp - 6], 0
jne 0x4a4d12
mov eax, 0x10
call fcn.00402e98
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.00403564
mov dword [ebx], edi
call fcn.00406e54
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 8], eax
mov eax, dword [0x4aabf0]
mov eax, dword [eax]
mov edx, ebx
call fcn.00419ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4d33
mov eax, dword [0x4aabf0]
mov eax, dword [eax]
call fcn.00474504
ret

Function at 0x4a5594
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov edx, dword [ebp + 0x10]
xor esi, esi
shl edx, 3
mov eax, dword [ebp + 0xc]
lea ecx, [edx*8 + 0x4aa410]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
sar edx, 2
xor ecx, ecx
mov cl, dl
sar ecx, 4
and cl, 3
and dl, 0xf
and ecx, 0xff
shl ecx, 4
mov ebx, dword [ebp - 8]
lea ecx, [ebx + ecx]
and edx, 0xff
mov dl, byte [ecx + edx - 0x40]
mov byte [eax], dl
shl byte [eax], 4
inc esi
inc eax
inc dword [ebp - 4]
cmp esi, 8
jl 0x4a55b9
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x4fc7d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x20], eax
push ecx
lea esp, [esp + 0x24]
call fcn.004a5420
xchg si, ax
rdtsc
lea ecx, [eax*4 + 0x16228fe7]
lea edi, [ebp - 0xd8]
lea ecx, [eax*2 + 0x3a348afe]
mov esi, 0x4aa690
rdtsc
rdtsc
movzx cx, bl
mov ecx, 0x20
cwde
lea eax, [ebp - 0xd8]
pushfd
movsx edx, al
pop edx
setge dl
rep movsd dword es:[edi], dword [esi]
push 0xbd97e4f1
mov dword [esp], eax
pushal
mov edx, dword [ebp + 0x14]
lea esp, [esp + 0x20]
jne 0x5171a6
pushal
mov dword [esp + 0x1c], edx
pushal
push 0xd7485787
jmp loc.00519caf
push edx
mov dword [esp], edx
pushal
push dword [esp]
lea esp, [esp + 0x24]
call fcn.004a5600
pushfd
lahf
call fcn.004fe652
Function at 0x403320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48e020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403398
xor eax, eax
push ebp
push 0x403391
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403398
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48e020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48e020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040fc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x491048], 0
je 0x40415d
cmp word [0x49121c], 0xd7b2
jne 0x404125
cmp dword [0x491224], 0
jbe 0x404125
mov eax, 0x491218
call dword [0x491234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48e06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404184
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48e030], 0
jne 0x404179
push 0
push 0x48e064
push 0x48e06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406124
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40618a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ee4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406174
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406191
lea eax, [ebp - 0x10]
call fcn.00404280
ret

Function at 0x40c3f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c429
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404370
jmp 0x40c432
mov eax, ebx
mov edx, esi
call fcn.004042d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c43c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c45d
mov al, byte [esp]
jmp 0x40c45f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cc40
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40caa8
mov eax, dword [0x4902c0]
cmp byte [eax], 0
je 0x40ccbc
mov eax, dword [0x4900b4]
call fcn.00402d50
call fcn.00402bc4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408de4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cd04
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ccf2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x49005c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x491664]
call fcn.00405590
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d560
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d636
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404318
lea eax, [ebp - 8]
call fcn.00404790
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404740
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d620
mov eax, ebx
call fcn.00402a38
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d619
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404740
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d603
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d648
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d603
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d620
mov eax, dword [ebp - 0x10]
call fcn.00402a68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d63d
lea eax, [ebp - 8]
call fcn.00404280
ret

Function at 0x40dba4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40dc08
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004087e0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dc0f
lea eax, [ebp - 0xc]
call fcn.00404280
ret

Function at 0x4233f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x491884
cmp dword [edi], 0
jne 0x423470
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x491880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48e498
mov ecx, 2
call fcn.00402c58
mov edx, 0x4233cc
lea eax, [esi + 5]
call fcn.004233ec
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004233ec
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x423445
mov dword [0x491880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4249fc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424a02
ret
Function at 0x426ff4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x427045
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42702c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42701c
jmp 0x427045
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42702d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4303a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404730
xor eax, eax
push ebp
push 0x4304ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4304a1
xor eax, eax
push ebp
push 0x43049a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404540
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43046f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x43045e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404540
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404740
mov edx, ebx
pop ecx
call fcn.00402c58
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430465
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x490000]
mov dl, 1
mov eax, dword [0x40753c]
call fcn.0040cdc4
call fcn.00403c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4304d5
lea eax, [ebp - 4]
call fcn.00404280
ret