joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442ea0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x550]
test esi, esi
je 0x442eea
mov eax, dword [edi + 0xc]
test eax, eax
je 0x442eea
push 0x443aa0
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0
push dword [eax + 0x64]
call fcn.0044d0c0
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x442ef3
mov dword [edi + 0x550], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x442efc
mov dword [eax], esi
cmp dword [esi + 0x150], 0
mov edi, dword [esi + 0x130]
jne 0x442eea
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
or ecx, 0xffffffff
test eax, eax
cmove edi, ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x443190
Capabilities:
Check os version
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x48e300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x491e10]
mov dword [ebp - 0x9c], 0x4020
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], 4
test eax, eax
jne 0x44322a
push 0x94
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00424e10
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
mov dword [0x491e10], 1
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x443225
cmp dword [ebp - 0x94], 6
jb 0x443225
mov dword [0x491e10], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
mov eax, dword [0x491e10]
cmp eax, 2
je 0x44327e
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x443262
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x9c]
jg 0x44327e
push 4
lea eax, [ebp - 0x9c]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
Function at 0x443410
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x48e300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1a4], 0
mov ebx, dword [edi]
jne 0x443583
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
mov dword [ebp - 0x108], 0x80
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x44348e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0044e840
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.004427c0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
mov dword [ebp - 0x108], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4434e1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.0044e840
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.004427c0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0x9e]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00443ac0
add esp, 0xc
test eax, eax
jne 0x443532
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0044e840
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004427c0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x100]
push eax
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00443ac0
add esp, 0xc
test eax, eax
jne 0x443583
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.0044e840
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004427c0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
push edi
call fcn.00443130
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00420548
mov esp, ebp
pop ebp
ret
Function at 0x443dc0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x48e300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [esi + 0x408], eax
push edi
mov edi, dword [ebp + 0xc]
setne al
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x443e1d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00442860
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
push dword [esi + 0x40c]
mov dword [ebp - 0x10], 1
call fcn.0044ce00
imul eax, eax, 0x3e8
push dword [esi + 0x410]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.0044ce00
imul eax, eax, 0x3e8
add esp, 8
mov dword [ebp - 0x14], eax
push 0
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x443e8d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00442860
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00420548
mov esp, ebp
pop ebp
ret

Function at 0x443ea0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x443eea
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0044e840
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00442860
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00442860
add esp, 8
pop edi
pop esi
pop ebp
ret
Function at 0x44e2f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x44e301
jmp dword [eax*4 + 0x44e374]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret

Function at 0x44e490
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x44e617
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x44e603
push esi
lea esp, [esp]
cmp dword [edi + 4], 2
jne 0x44e594
cmp dword [edi + 0x18], 0
je 0x44e594
mov eax, dword [edi + 0x10]
test eax, eax
je 0x44e594
cmp eax, 0x10
jb 0x44e594
push 0x20
call dword [0x48f2b0]
mov esi, eax
add esp, 4
test esi, esi
je 0x44e5f8
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x48f2b0]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x44e5e7
mov ecx, dword [edi + 0x18]
movq xmm0, qword [ecx]
movq qword [eax], xmm0
movq xmm0, qword [ecx + 8]
movq qword [eax + 8], xmm0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x44e582
push eax
call dword [0x48f2bc]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x44e5cd
mov eax, dword [ebp - 4]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x44e591
mov dword [eax + 0x1c], esi
mov dword [ebp - 4], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x44e4d0
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
pop esi
test eax, eax
je 0x44e5b1
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x44e5ff
push ebx
call fcn.0044e440
mov eax, dword [ebp + 0x14]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x18]
mov edi, 8
call dword [0x48f2b4]
push esi
call dword [0x48f2b4]
add esp, 8
jmp 0x44e5a2
push esi
mov edi, 8
call dword [0x48f2b4]
add esp, 4
jmp 0x44e5a2
mov edi, 8
jmp 0x44e5a2
test ebx, ebx
jne 0x44e60f
mov edi, 0x2af9
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f200
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.00455df5
add esp, 0x18
test eax, eax
je 0x44f222
cmp eax, 0xffffffff
jne 0x44f224
xor eax, eax
pop ebp
ret

Function at 0x44f360
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x48e300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0042d7f1
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x44f3c4
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x44f3c4
lea eax, [ebp - 0x108]
push eax
call dword [0x48f2bc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420548
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00420548
mov esp, ebp
pop ebp
ret

Function at 0x44f3e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044f360
Function at 0x452790
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4527c2
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret
Function at 0x402ac4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004048c8
test esi, esi
jne 0x402afa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004049b8
jmp 0x402b18
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029d8
mov edi, eax
test esi, esi
je 0x402b18
cmp dword [ebx], 0
je 0x402b18
dec esi
jmp 0x402b01
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4033b4
Capabilities:
Clear file content

Disassembly:
movzx edx, word [eax + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x4033d2
push dword [eax]
call sub.kernel32.dll_SetEndOfFile
dec eax
je 0x4033dc
jmp fcn.00402928
mov eax, 0x67
jmp fcn.00402918
ret

Function at 0x4039ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x49600c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a44
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a24
xor eax, eax
push ebp
push 0x403a1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x49600c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x49600c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40472c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49804c], 0
je 0x40478d
cmp word [0x498220], 0xd7b2
jne 0x404755
cmp dword [0x498228], 0
jbe 0x404755
mov eax, 0x49821c
call dword [0x498238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x496074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4047b4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49601c], 0
jne 0x4047a9
push 0
push 0x496094
push 0x496074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406380
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406403
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406403
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4065cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40648c
xor eax, eax
push ebp
push 0x406485
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004061c8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40646a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4065ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40646a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40648c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4065a6
cmp byte [ebp - 0xd], 0
jne 0x4064d3
cmp byte [ebp - 0x12], 0
je 0x4065a6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4064ec
dec ebx
cmp byte [ebx], 0x2e
je 0x4064fb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4064eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4065a6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406538
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4065a6
cmp byte [ebp - 0xd], 0
je 0x4065a6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4065a6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4091e4
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d78
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x4091f8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404d78
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40921a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c18c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c1c5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004049b8
jmp 0x40c1ce
mov eax, ebx
mov edx, esi
call fcn.0040491c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c1d8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c1f9
mov al, byte [esp]
jmp 0x40c1fb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c880
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c6f8
mov eax, dword [0x497964]
cmp byte [eax], 0
je 0x40c8e8
mov eax, dword [0x4976b4]
call fcn.00402eec
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004093c8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c930
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c91e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x497664]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x498718]
call fcn.0040618c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d754
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d7b8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b30
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408fd8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d7bf
lea eax, [ebp - 0xc]
call fcn.004048c8
ret
Function at 0x421628
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x498a24
cmp dword [edi], 0
jne 0x4216a4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x498a20]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x496554
mov ecx, 2
call fcn.00402998
mov edx, 0x421600
lea eax, [esi + 5]
call fcn.00421620
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00421620
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x421679
mov dword [0x498a20], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x422ba8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x422bae
ret

Function at 0x425200
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x425251
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x425238
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x425228
jmp 0x425251
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x425239
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43490c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d68
xor eax, eax
push ebp
push 0x434a3a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x434a0d
xor eax, eax
push ebp
push 0x434a06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b80
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4349db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4349ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b80
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404d78
mov edx, ebx
pop ecx
call fcn.00402998
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4349d1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4975e4]
mov dl, 1
mov eax, dword [0x407e68]
call fcn.0040ca50
call fcn.00404308
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434a41
lea eax, [ebp - 4]
call fcn.004048c8
ret