joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4518bb
Capabilities:
Encode data using xor

Disassembly:
fidiv dword [esi + 8]
dec esi
test dword [edx + 5], esp
pushal
adc byte [edx - 0x6fdb7dc8], al
mov eax, dword [0xa1458905]
aas
dec eax
add cl, byte [edx + esi - 0x1dd78493]
insd dword es:[edi], dx
jnp 0x4517bb
loop 0x451778
mov ah, 0xd
mov dword [ecx + 0xf], ebx
invalid
mov byte [0x8419608f], al
mov byte [ecx], bh
pop ds
mov eax, dword [0x1fb93baa]
into
insd dword es:[edi], dx
fdivr st(3)
mov byte [ebx - 0x4f5f2493], dl
cli
int 0x6c
mov dl, 0x2a
ret
insd dword es:[edi], dx
invalid
cmp bl, 0x4c
mov esi, 0x78e32638
test al, 9
cld
shr byte [esi], cl
jge 0x4517ce
wait
inc esp
aam 0x62
mov ecx, 0xaa24da6b
jb 0x451790
lodsb al, byte [esi]
fnsave dword [esi - 0x22]
pop ss
fldenv [esi]
mov esi, dword [ebx + ebp*8 + 0x6f9460a0]
in al, 0x8e
add bh, cl
dec edi
jne 0x45181d
clc
pop ebp
mov dword [edx - 0x6f7a70e8], edx
push edx
ret
xchg edx, eax
sbb byte [edi - 0x3cad6f7b], cl
or edi, ebp
scasd eax, dword es:[edi]
pop edi
sub al, cl
xchg esi, eax
mov ebx, 0x58e7966d
out 0x39, eax
js 0x4518b0
hlt
pop edi
dec ecx
mov dh, 0xec
aaa
les esi, [edx]
dec esp
jo 0x4518fb
mul byte [edx + eax*2]
fist dword [ebx + 0x6a]
adc edx, dword [eax]
xor ecx, dword [ebp + 0x33]
popfd
jl 0x4518fe
mov al, 0xb2
pop es
pause
sbb al, 0x77
scasb al, byte es:[edi]
or ecx, dword [esi + 3]
cmp ebp, dword [ebp + 0x42]
xor al, 0x63
xor byte [esi], bh
pop eax
insb byte es:[edi], dx
and esp, dword [edi]
mov dword [esi], ebp
xor byte [edi + 0x1ebef3d8], ah
aam 0x5b
invalid
daa
int1
xor byte [edx - 0x20], ah
mov bl, byte [edx + esi*4]
out 0x70, al
js 0x45196b
sbb al, 0x5c
jge 0x4518c0
btc dword [edx + esi*2 + 0x1d88ac6c], 0xaf
xor edi, dword [edi]
cli
std
jmp 0x45194c
pushfd
sahf
inc ecx
mov al, 0xc8
push ds
mov ebp, 0xe37662a3
pushfd
nop
push 0x101d7b33
jmp 0x4519d0
insd dword es:[edi], dx
mov ebp, 0x7ab5a20a
outsb dx, byte fs:[esi]
inc ecx
ret 0x97a8
lcall 0xf819, 0x7dd5a488
or bh, byte [eax - 0x175d9709]
salc
enter 0x6830, 0xffffffffffffffce
pop edx
adc eax, 0x99d835fe
xor edx, dword [edi]
fcomp dword [ecx + 0x19581938]
js 0x4519d6
jle 0x4519e4
cmp byte [ebp + 0x5ff49503], al
mov esi, 0x3fdf3495
adc eax, 0x7f581510
cmp byte [ecx - 0x3983b356], bl
cdq
stosb byte es:[edi], al
dec esp
jl 0x45199b
sbb byte [edi], dl
pop ss
hlt
mov eax, 0xe84af546
sal esi, 0xf9
cmpsd dword [esi], dword es:[edi]
inc esi
cmc
dec edx
call 0xa83f10ad
add dword [eax - 0x47], ebx
jo 0x451a27
and bl, byte [eax - 0x4fe2afab]
sti
inc ebp
cmp eax, 0x5391703d
pop edi
xor ecx, dword [edx + 0x4d]
add dword [edi + edi*2 - 0x3c], ebp
and al, 0x9d
xchg esp, eax
sbb dword [edx + 0x78384c01], eax
jne 0x451a3c
stc
test eax, 0xe3bf9899
cld
fidiv word [eax + 0x3e4379cd]
les ebx, [ecx - 0x27]
cmp byte [ecx + 0x18], dl
aam 0x35
cmp dh, ch
retf
xor eax, 0x17cbf53a
push ebp
hlt
sub byte [ebp + 0x29], dl
adc eax, 0x34c7d01d
sal byte [ebp + ebx*4 - 0x56], 0xef
mov byte [0x9dd164ef], al
sbb esp, eax
sbb eax, 0x9d3aa414
push eax
pop esp
insd dword es:[edi], dx
fxch st(0)
mov al, byte [0x6c55b88c]
aas
jmp 0x4519e3
Function at 0x47f9fb
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x5139f1fa
insb byte es:[edi], dx
dec esp
pop ds
add eax, 0xaff9fd66
cmp al, 0x33
fimul dword [ebp - 0x4b]
jnp 0x47fa09
xor ebx, edx
dec ebp
mov ch, 0x7b
cli
and ebx, edi
out 0xfd, al
cmp byte [ecx + 0xf], al
jo 0x47fa87
add byte [edi + esi*2 - 0x6e], dh
cmpsb byte ss:[esi], byte es:[edi]
adc ah, dl
setno byte [ebx]
sub edx, dword [eax - 0x40]
les ebp, [edx + 0x21f5acc2]
invalid
invalid
Function at 0x627cd9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303a8
cmp edx, dword [eax]
je 0x627cfb
add eax, 8
inc ecx
cmp eax, 0x630438
jl 0x627cec
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303a8]
jne 0x627e29
mov eax, dword [0x639d34]
cmp eax, 1
je 0x627e03
test eax, eax
jne 0x627d2c
cmp dword [0x6302d4], 1
je 0x627e03
cmp edx, 0xfc
je 0x627e29
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d63
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627da6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ca3c
push edi
call fcn.0062aa20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006286c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006286d0
lea eax, [ebp - 0xa0]
push 0x62ca1c
push eax
call fcn.006286d0
push dword [esi + 0x6303ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.006286d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a994
add esp, 0x2c
pop edi
jmp 0x627e29
lea eax, [ebp + 8]
lea esi, [esi + 0x6303ac]
push 0
push eax
push dword [esi]
call fcn.00628b50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40d6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
push edx
mov ebp, dword [esp + 0x18]
lea esi, [ebp + 2]
movzx eax, byte [ebp]
mov byte [esp + 3], al
movzx edx, byte [ebp + 1]
mov byte [esp + 2], dl
cmp edi, dword [esp + 0x20]
jge 0x40d728
inc byte [esp + 3]
movzx ecx, byte [esp + 3]
movzx edx, byte [esi + ecx]
add byte [esp + 2], dl
movzx ebx, byte [esp + 2]
movzx eax, byte [esi + ebx]
mov byte [esi + ecx], al
mov byte [esi + ebx], dl
add dl, byte [esi + ecx]
movzx eax, dl
mov edx, dword [esp + 0x1c]
movzx eax, byte [esi + eax]
xor byte [edx + edi], al
inc edi
jmp 0x40d6ee
movzx eax, byte [esp + 3]
mov byte [ebp], al
movzx edx, byte [esp + 2]
mov byte [ebp + 1], dl
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x410544
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x54], 0
ret

Function at 0x41133e
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x444610], 0
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
je 0x41140e
mov edx, dword [0x444b20]
mov eax, 0x40
sub eax, edx
cmp esi, eax
jl 0x4113f3
mov eax, 0x40
xor ebx, ebx
sub eax, edx
push eax
add edx, 0x444ae0
push edi
push edx
call 0x43ca70
push 0x444ae0
mov edx, dword [0x444b20]
mov eax, edi
push 0x444acc
sub eax, edx
lea esi, [esi + edx - 0x40]
lea edi, [eax + 0x40]
call fcn.00415244
mov ecx, dword [0x444ac8]
add esp, 0x14
movzx edx, byte [ebx + 0x444ae0]
mov eax, ecx
inc ecx
xor byte [eax + 0x444618], dl
cmp ecx, 0x4b0
mov eax, 0
cmovge ecx, eax
inc ebx
cmp ebx, 0x13
jle 0x4113ab
mov dword [0x444ac8], ecx
cmp ecx, 0x13
jg 0x4113df
call fcn.0041121c
mov dword [0x444b20], 0
xor edx, edx
cmp esi, 0x40
jmp 0x411365
push esi
mov eax, dword [0x444b20]
push edi
add eax, 0x444ae0
push eax
call 0x43ca70
add dword [0x444b20], esi
add esp, 0xc
pop ebx
pop esi
pop edi
ret

Function at 0x41153a
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push 1
push 0x258
call fcn.00403771
mov ebx, eax
call fcn.0041121c
push 0x258
mov eax, dword [0x444ac8]
add eax, 0x444618
push eax
push ebx
call 0x43ca70
mov dword [esi], 0x258
add esp, 0x14
mov dword [edi], ebx
pop ebx
pop esi
pop edi
jmp fcn.0041121c
Function at 0x415244
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x15c
xor ebx, ebx
mov edx, dword [esp + 0x174]
mov eax, dword [edx + ebx*4]
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
cmp ebx, 0xf
jle 0x415257
mov ebx, 0x10
mov eax, dword [esp + ebx*4 - 4]
xor eax, dword [esp + ebx*4 + 0x10]
xor eax, dword [esp + ebx*4 - 0x1c]
xor eax, dword [esp + ebx*4 - 0x24]
rol eax, 1
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
cmp ebx, 0x4f
jle 0x415269
mov eax, dword [esp + 0x170]
xor ebx, ebx
mov edx, dword [esp + 0x170]
mov eax, dword [eax]
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov dword [esp + 0x10], eax
mov ebp, dword [edx + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp + 0x14], eax
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov edx, esi
mov ecx, esi
not edx
and ecx, edi
and edx, ebp
rol eax, 5
or ecx, edx
add eax, ecx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
add eax, 0x5a827999
cmp ebx, 0x13
mov dword [esp + 0x18], eax
jle 0x4152be
mov ebx, 0x14
mov edx, dword [esp + 0x18]
mov eax, esi
xor eax, edi
xor eax, ebp
rol edx, 5
add edx, eax
add edx, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add edx, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
add edx, 0x6ed9eba1
cmp ebx, 0x27
mov dword [esp + 0x18], edx
jle 0x4152fe
mov ebx, 0x28
mov eax, dword [esp + 0x18]
mov edx, edi
mov ecx, edi
or edx, ebp
and ecx, ebp
and edx, esi
rol eax, 5
or edx, ecx
add eax, edx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
sub eax, 0x70e44324
cmp ebx, 0x3b
mov dword [esp + 0x18], eax
jle 0x415339
mov ebx, 0x3c
mov eax, dword [esp + 0x18]
mov edx, esi
xor edx, edi
xor edx, ebp
rol eax, 5
add eax, edx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
sub eax, 0x359d3e2a
cmp ebx, 0x4f
mov dword [esp + 0x18], eax
jle 0x415379
add eax, dword [esp + 0x10]
mov edx, dword [esp + 0x170]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
add eax, esi
mov dword [edx + 4], eax
mov eax, dword [esp + 8]
add eax, edi
mov dword [edx + 8], eax
mov eax, dword [esp + 4]
add eax, ebp
mov dword [edx + 0xc], eax
mov eax, dword [esp]
add eax, dword [esp + 0x14]
mov dword [edx + 0x10], eax
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x433def
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov edi, dword [eax + 0x1a8]
cmp dword [eax + 0x4c], 1
jne 0x433e12
mov dword [esp + 8], 0x1fe
mov byte [edi + 0x1c], 1
jmp 0x433e1e
mov dword [esp + 8], 0
mov byte [edi + 0x1c], 0
push dword [esi + 0x64]
mov eax, dword [esi + 4]
mov edx, dword [esp + 0xc]
add edx, 0x100
push edx
push 1
push esi
call dword [eax + 8]
mov dword [esp + 0x28], 0
mov dword [edi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
add esp, 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esi + 0x64]
jge 0x433f2f
mov eax, dword [esp + 0x18]
mov eax, dword [edi + eax*4 + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cdq
idiv dword [esp + 0x14]
cmp dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
je 0x433e89
mov eax, dword [edi + 0x18]
mov edx, dword [esp + 0x18]
add dword [eax + edx*4], 0xff
mov dword [esp + 0xc], 0
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x18]
mov ebp, dword [eax + edx*4]
mov eax, dword [esp + 0x14]
dec eax
push eax
mov eax, esi
push 0
mov edx, dword [esp + 0x20]
call fcn.00433dd4
pop ebx
xor ebx, ebx
pop edx
mov dword [esp], 0
cmp ebx, eax
jle 0x433ee1
inc dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 4]
add dword [esp], edx
dec eax
push eax
mov eax, esi
push dword [esp + 0x10]
mov edx, dword [esp + 0x20]
call fcn.00433dd4
pop edx
pop ecx
jmp 0x433eb9
movzx edx, byte [esp]
mov byte [ebp + ebx], dl
inc ebx
cmp ebx, 0xff
jle 0x433eb9
cmp dword [esp + 8], 0
je 0x433f1f
mov ebx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
mov byte [edx], al
dec edx
movzx eax, byte [ebp + 0xff]
mov byte [ebp + ebx + 0xff], al
inc ebx
cmp ebx, 0xff
jle 0x433f01
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [esi + 0x64]
jmp 0x433e51
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403304
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x453020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40339c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40337c
xor eax, eax
push ebp
push 0x403375
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40337c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x453020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x453020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404098
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x455048], 0
je 0x4040f9
cmp word [0x45521c], 0xd7b2
jne 0x4040c1
cmp dword [0x455224], 0
jbe 0x4040c1
mov eax, 0x455218
call dword [0x455234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45306c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404120
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x453030], 0
jne 0x404115
push 0
push 0x453064
push 0x45306c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405f02
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040448c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ec8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405eec
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f09
lea eax, [ebp - 0x10]
call fcn.0040421c
ret

Function at 0x40b000
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b039
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040430c
jmp 0x40b042
mov eax, ebx
mov edx, esi
call fcn.00404270
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b04c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b06d
mov al, byte [esp]
jmp 0x40b06f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b704
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b56c
mov eax, dword [0x454084]
cmp byte [eax], 0
je 0x40b780
mov eax, dword [0x453ea4]
call fcn.00402d34
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004087f0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b7c8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b7b6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x453e54]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x455664]
call fcn.00405308
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c024
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c0fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042b4
lea eax, [ebp - 8]
call fcn.0040472c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046dc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c0e4
mov eax, ebx
call fcn.00402a28
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c0dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046dc
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c0c7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c10c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c0c7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0e4
mov eax, dword [ebp - 0x10]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c101
lea eax, [ebp - 8]
call fcn.0040421c
ret

Function at 0x40c668
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c6cc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040448c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408324
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c6d3
lea eax, [ebp - 0xc]
call fcn.0040421c
ret

Function at 0x41a9a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x455884
cmp dword [edi], 0
jne 0x41aa24
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x455880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4533ec
mov ecx, 2
call fcn.00402c48
mov edx, 0x41a980
lea eax, [esi + 5]
call fcn.0041a9a0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a9a0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a9f9
mov dword [0x455880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41bf98
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41bf9e
ret
Function at 0x41e464
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e4b5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e49c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e48c
jmp 0x41e4b5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e49d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426fd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004046cc
xor eax, eax
push ebp
push 0x4270fe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4270d1
xor eax, eax
push ebp
push 0x4270ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004044dc
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42709f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x42708e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004044dc
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004046dc
mov edx, ebx
pop ecx
call fcn.00402c48
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427095
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x453e00]
mov dl, 1
mov eax, dword [0x4071c4]
call fcn.0040b888
call fcn.00403c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427105
lea eax, [ebp - 4]
call fcn.0040421c
ret