joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f9600
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr si, cl
pop bx
xchg ecx, eax
push dword [esp + 4]
push word [esp + 6]
jmp 0x5f963f
mov edi, dword [esp + 0xd]
add esp, 0x10
bts di, bp
neg al
xchg byte [esp + 5], cl
jmp 0x5f95ea
xchg word [esp + 5], bp
inc ebx
xchg byte [esp + 9], dh
mov edi, 0x624e2d4
pop dword [esp + 3]
jmp 0x5f9629

Function at 0x5f9bff
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5ff37a
bsr bp, ax
cmc
rdtsc
push dword [esp + 0x1a]
btc edi, edx
rol si, cl
jmp 0x5feef8
inc edi
sub esp, 0x19
mov ebp, 0x2b609226
mov cl, 0x17
bsf si, bp
mov bl, 0xdb
jmp 0x5feea9
seto dl
pop eax
rdtsc
clc
setbe ch
xchg byte [esp + 0x12], ah
jmp 0x5fef0f
xchg word [esp + 7], bp
mov byte [esp + 5], dl
push sp
mov si, bx
xchg dword [esp + 6], edx
neg cx
jmp 0x5feee2
pop eax
inc al
mov cx, 0x90cb
rdtsc
mov bx, word [esp + 0x14]
pop ebx
jmp 0x5ff190
mov bp, ax
dec ebp
mov cx, word [esp + 2]
cpuid
add ebx, esi
mov ch, byte [esp + 1]
jmp 0x5feecf
sbb dl, 0x56
mov dh, 0x67
mov cx, 0x2e67
setg dh
lea edx, [edi + edi]
lea ebx, [ecx + ecx]
jmp 0x5ff07d
mov edx, dword [esp]
mov ecx, 0x53b57192
bsr ebx, ebx
mov dx, word [esp]
rdtsc
xchg dx, bx
jmp 0x5fef3d
lea eax, reloc.kernel32.dll_DeleteCriticalSection
xchg edx, ebx
bts ebp, ebx
bswap edi
sub esp, 0xe
call fcn.005fef8d
mov ebx, 0x2387111b
xchg dword [esp + 0x16], ebx
pop word [esp + 0x19]
jmp 0x5ff005
adc bh, 0xb1
add esp, 0x22
neg dx
pop edi
mov cl, byte [esp + 8]
jmp 0x5ff01b
mov ecx, dword [esp + 0x30]
mov byte [esp + 0xd], bh
dec esi
xor ch, bl
mov ah, byte [esp + 0xd]
xchg word [esp + 0xb], di
jmp 0x5fefef
lea ecx, [edx + ebx]
mov byte [esp + 6], cl
call fcn.005ff05a
retf
mov ecx, 0x40557885
and dh, dh
bsf esi, esi
cpuid
sbb dx, bx
mov cx, word [esp]
jmp 0x5fefb0
pushal
lea esp, [esp + 0x4f]
mov edi, dword [esp]
mov ecx, edi
lea edi, [ebx + ebx]
xor dh, 0x2c
jmp 0x5fef61
sub esp, 0x17
mov bp, word [esp + 0x2e]
mov esi, dword [esp + 0x23]
xchg byte [esp + 0x2b], al
rdtsc
mov ebp, 0x4c14fc11
jmp 0x5ff0c8
pop word [esp]
pop dx
not di
btc si, si
pushfd
xchg word [esp], cx
jmp 0x5fef2a

Function at 0x5ff216
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror edx, cl
mov ecx, 0x1d8ccb84
mov ecx, 0x6992506f
xchg dword [esp + 0xb], ebx
stc
jmp 0x5ff1d2
Function at 0x401750
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x210
mov eax, dword [0x40701c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 0x468], ebp
mov eax, 0x40539c
jne 0x4017a1
mov eax, dword [edi + 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi + 0x480]
pop edi
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00403c5c
add esp, 0x210
ret
cmp dword [edi + 4], ebp
je 0x4017bd
push 0x40539c
lea ecx, [edi + 0x152]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
jne 0x4017ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401870
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401806
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40186f
push 0
push ebx
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x401824
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40186f
push ebx
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
lea edx, [ebx - 4]
mov dword [edi + 0x470], esi
call fcn.004014b0
cmp eax, dword [esi + ebx - 4]
je 0x401852
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40186b
push edi
call fcn.00401f00
test eax, eax
je 0x401865
call fcn.004018c0
test eax, eax
jne 0x40186b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x10]
pop ebx
mov eax, dword [edi + 0x470]
test eax, eax
je 0x40188b
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 0x470], 0
test ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401898
push ebp
call edi
cmp esi, 0xffffffff
je 0x4018a0
push esi
call edi
mov ecx, dword [esp + 0x218]
pop esi
pop edi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00403c5c
add esp, 0x210
ret
Function at 0x4020d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4046d6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x40701c]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov eax, dword [0x40701c]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x16]
push 0
mov dword [esp + 0x10], 0
push eax
mov word [esp + 0x1c], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x402150
push esi
mov ecx, 0x405374
call fcn.00402c20
jmp 0x4021e3
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x14]
call fcn.00402c20
push eax
lea eax, [esp + 0x10]
push eax
mov ebx, 0x4053f0
mov dword [esp + 0x22c], 0
call fcn.00402dc0
push eax
push esi
mov ebx, 0x4053e0
mov byte [esp + 0x234], 1
call fcn.00402dc0
mov byte [esp + 0x234], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4021b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x224], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4021e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00403c5c
add esp, 0x220
ret
Function at 0x4022a0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40468b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x40701c]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x40701c]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
xor esi, esi
push 0x206
lea eax, [esp + 0x12]
push esi
push eax
mov word [esp + 0x18], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
push 0x1a
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x402367
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x10]
call fcn.00402c20
push 0x1a
push 0x405414
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x22c], esi
call fcn.00403470
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ecx
call esi
test eax, eax
jne 0x40236b
mov dword [esp + 0x220], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402367
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4023c6
push 6
push 0x40544c
lea ecx, [esp + 0x10]
push ecx
call fcn.00403470
mov edx, dword [esp + 8]
push edx
call esi
or edx, 0xffffffff
mov dword [esp + 0x220], 0xffffffff
test eax, eax
mov eax, dword [esp + 8]
jne 0x4023a8
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40235b
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4023c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00403c5c
add esp, 0x21c
ret

Function at 0x4023f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x40701c]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x114]
sbb eax, eax
xor ecx, esp
add eax, 1
call fcn.00403c5c
add esp, 0x118
ret
Function at 0x406047
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x406215
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
movsd dword es:[edi], dword [esi]
xchg eax, edi
invalid
inc dword [eax]
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
test dword [ebx - 0x42000008], edx
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
invalid
invalid
cdq
clc
invalid
invalid

Function at 0x4068b4
Capabilities:
Get common file path

Disassembly:
sbb al, 3
fisttp word [ebx - 0x38fc74fc]
push eax
call fcn.0040469a
jo 0x4068d3
pop eax
jno 0x4068c6
push dword [ebp + 8]
jne 0x4068d1
push dword [ebp + 4]
push dword [ebp]
call fcn.00404e9a
add dh, byte [ebx]
rcr byte [esi - 0x3e], 4
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
in eax, 0xff
inc dword [edx]
xor eax, eax
pop esi
ret 4
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
sbb al, 3
fisttp word [ebx - 0x38fc74fc]
push eax
call fcn.0040469a
jo 0x4068d3
pop eax
jno 0x4068c6
push dword [ebp + 8]
jne 0x4068d1
push dword [ebp + 4]
push dword [ebp]
call fcn.00404e9a
add dh, byte [ebx]
rcr byte [esi - 0x3e], 4
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
in eax, 0xff
inc dword [edx]
xor eax, eax
pop esi
ret 4
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x1ff869ab
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
mov ecx, 0x36ca1a26
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x429cae
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
jmp 0x429cb9
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 4
jae 0x429cd0
push 0
mov edx, dword [ebp - 8]
push dword [edx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x429cb6
leave
ret
Function at 0x474e0e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
call fcn.00426b52
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0x3fe
push 0x500c7e
call fcn.0042de63
mov ecx, dword [ebp + 0xc]
inc eax
cmp al, 3
je 0x474e41
mov byte [ecx], al
or al, 0x40
cmp al, 3
je 0x474e49
mov byte [ecx], al
call fcn.00423842
mov ecx, dword [ebp + 8]
mov byte [ecx], 2
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
call fcn.00426ba0
pop ebp
ret 8
Function at 0x405b23
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405dee
test bl, 8
mov dword [ebp - 8], eax
je 0x405b62
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434fa8], eax
jmp 0x405cdf
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b7c
test eax, eax
je 0x405c8d
test bl, 2
je 0x405c8d
mov esi, str.C:UsersADMINI1AppDataLocalTemp_nsrCEF4.tmpdownload.exe
push edi
push esi
call fcn.00406411
cmp dword [ebp + 8], 0
je 0x405b9b
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405ba1
push edi
call fcn.00405d32
cmp word [edi], 0
jne 0x405bb1
cmp word [str.C:UsersADMINI1AppDataLocalTemp_nsrCEF4.tmpdownload.exe], 0x5c
jne 0x405bbc
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c82
cmp word [ebp - 0x22c], 0x2e
jne 0x405c06
cmp word [ebp - 0x22a], 0
je 0x405c65
cmp word [ebp - 0x22a], 0x2e
jne 0x405c06
cmp word [ebp - 0x228], 0
je 0x405c65
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406411
test byte [ebp - 0x258], 0x10
je 0x405c31
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c65
push dword [ebp + 0xc]
push edi
call fcn.00405b23
jmp 0x405c65
push dword [ebp - 4]
push edi
call fcn.00405adb
test eax, eax
jne 0x405c5d
cmp dword [ebp - 4], eax
je 0x405c55
push edi
push 0xfffffffffffffff1
call fcn.00405479
push 0
push edi
call fcn.004061d7
jmp 0x405c65
inc dword [0x434fa8]
jmp 0x405c65
push edi
push 0xfffffffffffffff2
call fcn.00405479
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405bde
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405c8d
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405cdf
cmp dword [ebp - 8], esi
jne 0x405ca1
inc dword [0x434fa8]
jmp 0x405cdf
push edi
call fcn.0040676f
test eax, eax
je 0x405cdf
push edi
call fcn.00405ce6
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405adb
test eax, eax
jne 0x405cd7
cmp dword [ebp - 4], esi
je 0x405c99
push edi
push 0xfffffffffffffff1
call fcn.00405479
push esi
push edi
call fcn.004061d7
jmp 0x405cdf
push edi
push 0xffffffffffffffe5
call fcn.00405479
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x409028
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404a9c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409041
test al, 0x10
jne 0x409045
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c004
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c03d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004046dc
jmp 0x40c046
mov eax, ebx
mov edx, esi
call fcn.00404640
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c050
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c071
mov al, byte [esp]
jmp 0x40c073
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c6f8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c570
mov eax, dword [0x4bd13c]
cmp byte [eax], 0
je 0x40c765
mov eax, dword [0x4bceec]
call fcn.00402e74
call fcn.004028b4
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040937c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c7ac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c79b
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4bce90]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4be718]
call fcn.00405d80
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d588
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d5ec
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404854
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408ce4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d5f3
lea eax, [ebp - 0xc]
call fcn.004045ec
ret
Function at 0x4240ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4bea28
cmp dword [edi], 0
jne 0x424168
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4bea24]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4bb670
mov ecx, 2
call fcn.00402948
mov edx, 0x4240c4
lea eax, [esi + 5]
call fcn.004240e4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004240e4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42413d
mov dword [0x4bea24], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4256a4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4256aa
ret

Function at 0x427df4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x427e45
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x427e2c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x427e1c
jmp 0x427e45
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x427e2d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478fd0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4790a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4becb0], 0
jne 0x47908c
lea eax, [ebp - 4]
mov edx, 0x4790c0
call fcn.00404684
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a9c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47908c
mov eax, ebx
call fcn.0040274c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x479085
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47906f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4790d0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47906f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4becb0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47908c
mov eax, dword [ebp - 0xc]
call fcn.0040276c
ret
mov ebx, dword [0x4becb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4790af
lea eax, [ebp - 4]
call fcn.004045ec
ret

Function at 0x483c04
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4becd4], 0
jne 0x483c27
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x483b78
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4becd4], eax
ret

Function at 0x484da8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0044b48c
test al, al
je 0x484e03
cmp bl, 7
jne 0x484ddf
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x484de4
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
je 0x484e03
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, edi
call fcn.0042e404
mov byte [esi + 0x220], bl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b86b8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.00404a8c
mov eax, dword [ebp + 8]
call fcn.00404a8c
xor eax, eax
push ebp
push 0x4b880a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048a4
add eax, 2
call fcn.0040274c
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
call fcn.004048a4
add eax, 2
call fcn.0040274c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b87e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.00403030
mov eax, dword [ebp + 8]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.00403030
mov eax, dword [ebp - 4]
call fcn.00404a9c
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004093b8
mov eax, dword [ebp + 8]
call fcn.00404a9c
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004093b8
mov dword [ebp - 0x2a], ebx
mov dword [ebp - 0x26], 2
mov eax, 0x4b8818
mov dword [ebp - 0x22], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x22], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1e], eax
mov word [ebp - 0x1a], 0x18
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2a]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x4b87ad
call fcn.0040dc04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b87ec
mov eax, dword [ebp - 4]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 8]
call fcn.0040276c
mov eax, dword [ebp + 8]
call fcn.004048a4
mov edx, eax
add edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040276c
ret