joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x208]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x210]
push ecx
call edi
push str.system.ini
lea edx, [esp + 0xc]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea edx, [esp + 8]
push edx
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x417f2d
push str.install.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417f2d
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret

Function at 0x424173
Capabilities:
Encode data using xor

Disassembly:
das
and dh, bl
sal byte [di - 0x3e], 1
inc ebx
hlt
inc eax
jae 0x42418c
or eax, 0x7516dc40
xor byte [esi + 8], bh
jle 0x424151
pop edi
js 0x424136
rcr ch, 1
nop
and ah, byte [ebx + 0x1155c1d4]
cmp byte [0xe195117e], 0x2f
ror byte [0x2bddfea], 0x71
jle 0x4241ac
lahf
cmp al, 0x60
loopne 0x4241c5
loopne 0x424149
jo 0x4241c3
mov al, 0xe
adc dword [edx], esp
mov eax, dword [0x8a5f3c8b]
pop edi
xchg esp, eax
les esi, [edx + eax]
mov esp, 0x8c44306e
fisub word [ecx + 0x3c5d3c9e]
inc esp
mov esi, ds
mov eax, dword [0x3c5d3c9e]
push edx
pushal
mov eax, dword [0x2abca636]
rol byte [esi + 0x10], 1
pop ds
mov esp, 0x1f9f7689
pop esi
xor dword [edx - 0x2453fdca], eax
mov ah, 0xde
fidivr word [ebp + 0x3d9fa10a]
mov ebp, 0x3d9fa10a
cmp al, 0x3e
and dword [esi], ebp
and dword [ebx], eax
cmp bh, bl
jge 0x42421b
mov edi, 0x3c9fe001
pop ebx
cmp al, 0x85
cmp ebx, dword [esi]
cmp al, 0xdc
ja 0x4241ad
push esp
ljmp 0x7e08
pop edx
push es
adc ecx, dword [esi + 0x26]
sal byte [ebp + 0x68], 0x15
jp 0x424219
push 0xff057755
mov edi, edx
pop edi
mov byte [edi], bh
ret 0x44c5
Function at 0x42f577
Capabilities:
Check for software breakpoints

Disassembly:
xchg edi, eax
pop esp
ret
mov dword [edx + 0x48ad90e8], ecx
or al, 0xe9
push edx
or al, 0x38
cmp al, 0xc0
inc ebx
sub dh, al
test edi, ebp
nop
mov edi, 0xd14208c1
inc edx
xchg dword [edi + 0x6c], esi
xchg ecx, eax
mov ch, 0x1e
and byte [ecx], al
sahf
ja 0x42f4a5
or dword [ebp - 0x782dc06c], eax
out 0x97, eax
xchg ebp, eax
pop ss
in eax, 0x46
jecxz 0x42f4fb
test al, 0xc7
cmp byte [ebp + 0x77ede694], al
xchg ebx, eax
invalid
outsb dx, byte [esi]
out 0xc4, eax
invalid
out 0x87, eax
sub ebx, dword [0x4e029fe1]
enter 0x454c, 0x75
pop ds
loope 0x42f4b1
add cl, byte [esi - 0x38]
dec esp
inc ebp
jne 0x42f538
jae 0x42f510
lodsd eax, dword [esi]
xchg ebp, eax
xchg ebx, eax
adc dword [ebx - 0xc1c3b04], edi
push cs
outsb dx, byte [esi]
push cs
invalid
les eax, [ebp - 0x1a43a3b2]
add al, 0xd4
push eax
xor al, 0x4f
push edi
enter 0x838, 0xe
shl edx, cl
or al, 0x20
cmp al, 0xba
shr ah, 0x59
pop es
and dword gs:[esi - 0x6b7c88bc], 0x71
invalid
xchg esp, eax
jno 0x42f51d
invalid
insb byte es:[edi], dx
push edi
loop 0x42f50c
or al, 0x22
sbb byte [edx], 2
pop esi
invalid

Function at 0x4475c7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.004689e5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447612
push 0x80004005
call fcn.00446397
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.004689e5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447642
push 0x80004005
call fcn.00446397
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.004689e5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44766f
push 0x80004005
call fcn.00446397
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
and byte [edx + 0x79], ch
Function at 0x453a03
Capabilities:
Check for software breakpoints

Disassembly:
in eax, dx
cli
std
lds edi, [edx - 0x5b]
enter 0xffffffffffff9628, 0x28
invalid

Function at 0x45e4a7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0047f8c5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e4f2
push 0x80004005
call fcn.0045d277
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0047f8c5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e522
push 0x80004005
call fcn.0045d277
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0047f8c5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e54f
push 0x80004005
call fcn.0045d277
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0045dca7
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0045dca7
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472ff3
Capabilities:
Encode data using xor

Disassembly:
dec ebx
sbb al, 0xe4
add dword [edi - 0x60], eax
jmp [ecx - 0x1cf07d2c]
xchg dword [ebp + 0x14], ebx
outsd dx, dword [esi]
mov edx, 0x5e884b4c
xor bh, byte [ecx - 2]
rcl dword [edx], 0xe
ror byte [ebp + 0x12], cl
in eax, dx
stosd dword es:[edi], eax
fld xword [edi - 0x2f]
mov ebx, 0x7cb9aea9
xchg ebx, eax
or ebx, dword [esi - 0x1c]
xor cl, byte [ebx + 0x18]
dec ebx
sbb bh, ch
dec ebx
sbb bh, ch
adc byte [eax - 0x26], ah
xchg edi, eax
adc ch, byte [esi + esi*8]
jp 0x472fa3
fstp dword [eax - 0x4c]
sub bl, bh
adc byte [ebx + 0x411c4342], 0x72
lds eax, [esi + 0x132bc169]
xchg ebx, eax
inc edx
inc ebx
sbb al, 0x41
jb 0x472fd1
xchg byte [ecx - 0x3f], ch
sub edx, dword [ebx]
jne 0x472fa4
adc byte [esi - 0x21], dl
out 0xd4, eax
xchg ebp, eax
mov ebx, 0x7bca5eac
and al, 0xe9
xchg ebx, eax
shr edx, 0x4b
sub dword [edx + edx*8], eax
mov bh, 0xd3
mov eax, dword [0x39bdc9a9]
xor bh, byte [eax + 0x74]
popal
sub dword [edx - 0x6494a38b], 0xc96afdfd
rcl byte [esi + eax - 0x5a88668b]
jno 0x473005
push ebp
leave
adc ch, byte [edi - 0x29]
xlatb
push esi
mov ch, 0x9e
pop dword [ebp - 0x1488d6f]
je 0x4730b6
mov al, byte [0x577b1871]
invalid
js 0x473049
push esp
arpl word [esi + ebx - 0x7d], di
cdq
pushfd
lea eax, [edi]
mov byte [edi - 0x101ee0c6], 0x2d
add byte [ecx], dl
push edi
sbb al, 0xf6
ret
cmp bl, byte [edi]
loope 0x4730a9
sub eax, 0x1c571100
test bl, 2
push esp
int3

Function at 0x4756a7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.00496ac5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4756f2
push 0x80004005
call fcn.00474477
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.00496ac5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x475722
push 0x80004005
call fcn.00474477
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.00496ac5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x47574f
push 0x80004005
call fcn.00474477
invalid
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
Function at 0x480324
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
xchg ebx, eax
jmp 0x48039b
cmp ebp, dword [ebx - 0x6dd88a70]
cmp esi, edx
dec ebx
invalid
mov al, byte [0xa06fa979]
xor eax, 0xeda6f031
jns 0x480346
outsd dx, dword [esi]
mov al, byte [0xf0313564]
cmpsb byte [esi], byte es:[edi]
in eax, dx
clc
sbb al, 0xec
popal
inc eax
in al, dx
add byte fs:[edx], bh
in al, dx
js 0x48039a
dec ecx
wait
dec eax
xor byte [esi], dh
ftst
mov esp, 0xe1ec62b4
test byte [ecx - 6], 0x3c
call 0x1939ec17
xchg edx, eax
in eax, 0xa1
push 0xffffffffffffffd8
inc esp
mov cl, 0xbc
or al, 0xbf
adc dl, ch
ljmp 0x8c25

Function at 0x481723
Capabilities:
Encode data using xor

Disassembly:
invalid
jae 0x48172f
jle 0x481716
fisubr word [eax + 0x7750d670]
salc
inc ecx
xchg esi, eax
inc eax
test al, 0x4c
mov eax, dword [0x1152843e]
cli
inc esi
xor esp, dword [ebp + 0x70]
aam 0xa9
jl 0x481731
mov esp, 0x687dd916
mov ecx, 0xb745bf55
jl 0x48177b
sbb dword [esp + ecx*2 - 0x62], ecx
pop eax
das
nop
std
mov al, byte [0x4549f110]
fdiv qword [ebx - 0x1b]
int1
enter 0x5383, 0xfffffffffffffffa
push eax
push ds
clc
cwde
push edi
mov dh, 0xcf
mov al, byte [0xb9d34e85]
cmp eax, 0x876a2a5d
invalid
ret
Function at 0x4a3e97
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c52b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3ee2
push 0x80004005
call fcn.004a2c67
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c52b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f12
push 0x80004005
call fcn.004a2c67
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c52b5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f3f
push 0x80004005
call fcn.004a2c67
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a3697
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a3697
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5c9853f5
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2bde2dba
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402970
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029ad
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029cd
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.004040fc
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x402ab8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402ae7
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fa4
jmp 0x402b05
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402a40
mov edi, eax
test ebx, ebx
je 0x402b05
cmp dword [esi], 0
je 0x402b05
dec ebx
jmp 0x402aee
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d34
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x596044], 0x8088405
inc edx
mov dword [0x596044], edx
mul edx
mov eax, edx
ret

Function at 0x402f0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402fa4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402f84
xor eax, eax
push ebp
push 0x402f7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402fc0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402820
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x596049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403e38
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4068e0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406a9c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406941
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406ab8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4069b3
xor eax, eax
push ebp
push 0x4069ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00406738
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406995
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406ad8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4069b3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406a94
cmp byte [ebp - 0xd], 0
jne 0x4069f5
cmp byte [ebp - 0x12], 0
je 0x406a94
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406a0e
dec ebx
cmp byte [ebx], 0x2e
je 0x406a1d
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406a0d
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406a94
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406a4a
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406a94
cmp byte [ebp - 0xd], 0
je 0x406a94
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406a94
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xc], eax
lea esi, [ebp - 8]
xor eax, eax
push ebp
push 0x409e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x34
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x409e8c
lea eax, [ebp - 0x114]
mov edx, ebx
call fcn.00404064
push dword [ebp - 0x114]
push 0x409eb0
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.0040420c
mov eax, dword [ebp - 0x110]
call fcn.00404310
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x409e45
mov dword [esi], 0xff
push esi
lea eax, [ebp - 0x10b]
push eax
push esi
push 0
push 0x409eb4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x409e3c
lea eax, [ebp - 0xc]
call fcn.00403ebc
mov dword [esi], 1
jmp 0x409dc8
lea eax, [ebp - 0x118]
mov edx, dword [esi]
mov dl, byte [ebp + edx - 0x10c]
call fcn.00404064
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0xc]
call fcn.00404154
inc dword [esi]
mov eax, dword [esi]
cmp byte [ebp + eax - 0x10c], 0
jne 0x409da4
push 0x409ec4
push dword [ebp - 0xc]
push 0x409ed0
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.0040420c
mov eax, dword [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
mov ecx, 0x409eec
mov edx, dword [ebp - 0xc]
call fcn.00404198
mov eax, dword [ebp - 0x120]
push eax
push dword [ebp - 0xc]
push 0x409f04
push 0x409f28
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.0040420c
mov eax, dword [ebp - 0x124]
pop edx
pop ecx
call fcn.004097f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc ebx
cmp bl, 0x38
jne 0x409d17
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409e7c
lea eax, [ebp - 0x124]
mov edx, 6
call fcn.00403ee0
lea eax, [ebp - 0xc]
call fcn.00403ebc
ret

Function at 0x40de38
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40de71
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403fa4
jmp 0x40de7a
mov eax, ebx
mov edx, esi
call fcn.00403f10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40de84
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40dea5
mov al, byte [esp]
jmp 0x40dea7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41ade8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x41adfd
mov byte [ebx + 0xd], 0
pop ebx
ret
Function at 0x41ce4c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41ce52
ret

Function at 0x41f84c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41f89d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41f884
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41f874
jmp 0x41f89d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41f885
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f22c
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x42f280
mov eax, dword [0x595220]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x42f258
push ebx
push 0x42f288
call fcn.0044a430
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x42f27c
mov ecx, dword [0x594cfc]
mov dl, 1
mov eax, dword [0x409fb8]
call fcn.0040e6e8
call fcn.004038ec
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret

Function at 0x42f2a8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0042f22c
xor edx, edx
push ebp
push 0x42f37a
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x42f34c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x42f33b
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00402a00
mov eax, dword [ebp - 4]
call fcn.0042f1e4
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f342
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x42f38c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0042f22c
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42f3fe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x42f3d2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404084
jmp 0x42f3d9
mov eax, ebx
call fcn.00403ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f405
cmp dword [ebp - 8], 0
je 0x42f3f5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.0042f200
ret