joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404609
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x414
mov ecx, dword [ebp + 8]
push ebx
cmp ecx, dword [0x40ae60]
push esi
push edi
jae 0x40479d
mov eax, ecx
push ecx
pop esi
sar eax, 5
and esi, 0x1f
lea ebx, [eax*4 + 0x40ad60]
shl esi, 3
mov eax, dword [ebx]
mov al, byte [eax + esi + 4]
test al, 1
je 0x40479d
sub edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jne 0x40465a
xor eax, eax
jmp 0x4047b1
test al, 0x20
je 0x40466a
push 2
push edi
push ecx
call fcn.004040c7
add esp, 0xc
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x404739
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jbe 0x404771
lea eax, [ebp - 0x414]
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x10]
jae 0x4046c4
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
mov cl, byte [ecx]
cmp cl, 0xa
jne 0x4046af
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
mov byte [eax], cl
inc eax
mov ecx, eax
lea edx, [ebp - 0x414]
sub ecx, edx
cmp ecx, 0x400
jl 0x404690
mov edi, eax
lea eax, [ebp - 0x414]
sub edi, eax
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 0x414]
push edi
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x40472e
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp eax, edi
jl 0x404700
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x40468a
sub edi, edi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x404798
cmp dword [ebp + 8], edi
je 0x404771
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x404766
mov dword [0x40a964], 9
mov dword [0x40a968], eax
jmp 0x4047ae
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 8], eax
jmp 0x404700
lea ecx, [ebp - 0xc]
push edi
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
or eax, eax
je 0x40475b
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], edi
mov dword [ebp - 8], eax
jmp 0x404702
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 8], eax
jmp 0x404702
push dword [ebp + 8]
call fcn.004053de
pop ecx
jmp 0x4047ae
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x404786
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x404653
mov dword [0x40a964], 0x1c
mov dword [0x40a968], edi
jmp 0x4047ae
sub eax, dword [ebp - 0x10]
jmp 0x4047b1
and dword [0x40a968], 0
mov dword [0x40a964], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c40
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x40aadc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
sub esi, esi
sub edi, edi
cmp eax, ebx
jne 0x404c8e
call ebp
push eax
pop esi
cmp esi, ebx
je 0x404c6f
mov dword [0x40aadc], 1
jmp 0x404c97
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings]
push eax
pop edi
cmp edi, ebx
je 0x404d69
mov dword [0x40aadc], 2
jmp 0x404d1d
cmp eax, 1
jne 0x404d18
cmp esi, ebx
jne 0x404ca7
call ebp
mov esi, eax
cmp esi, ebx
je 0x404d69
cmp word [esi], bx
push esi
pop eax
je 0x404cbc
inc eax
inc eax
cmp word [eax], bx
jne 0x404cae
inc eax
inc eax
cmp word [eax], bx
jne 0x404cae
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
push eax
pop ebp
cmp ebp, ebx
je 0x404d0d
push ebp
call fcn.00401781
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x404d0d
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
or eax, eax
jne 0x404d09
push dword [esp + 0x10]
call fcn.00401a9e
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x404d6b
cmp eax, 2
jne 0x404d69
cmp edi, ebx
jne 0x404d2d
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x404d69
cmp byte [edi], bl
mov eax, edi
je 0x404d3d
inc eax
cmp byte [eax], bl
jne 0x404d33
inc eax
cmp byte [eax], bl
jne 0x404d33
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.00401781
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x404d53
xor esi, esi
jmp 0x404d5e
push ebp
push edi
push esi
call fcn.00402d30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x404d6b
sub eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x404f7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
sub ecx, ecx
mov eax, 0x40a430
cmp edx, dword [eax]
je 0x404f9f
add eax, 8
inc ecx
cmp eax, 0x40a4c0
jb 0x404f90
push esi
push ecx
pop esi
shl esi, 3
cmp edx, dword [esi + 0x40a430]
jne 0x4050cd
mov eax, dword [0x40a9b8]
cmp eax, 1
je 0x4050a7
or eax, eax
jne 0x404fd0
cmp dword [0x4080d4], 1
je 0x4050a7
cmp edx, 0xfc
je 0x4050cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x405007
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004060b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405100
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40504a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405100
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x407454
push edi
call fcn.00401c20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004060b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004060c0
lea eax, [ebp - 0xa0]
push 0x407434
push eax
call fcn.004060c0
push dword [esi + 0x40a434]
lea eax, [ebp - 0xa0]
push eax
call fcn.004060c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406580
add esp, 0x2c
pop edi
jmp 0x4050cd
lea eax, [ebp + 8]
lea esi, [esi + 0x40a434]
push 0
push eax
push dword [esi]
call fcn.00405100
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret
Function at 0x406753
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00405a20
push ebx
mov ebx, dword [ebp + 8]
push esi
sub esi, esi
cmp ebx, dword [0x40ae60]
jae 0x406888
push ebx
pop eax
push ebx
pop ecx
sar eax, 5
and ecx, 0x1f
mov eax, dword [eax*4 + 0x40ad60]
test byte [eax + ecx*8 + 4], 1
je 0x406888
push 1
push esi
push ebx
call fcn.004040c7
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x406892
push 2
push esi
push ebx
call fcn.004040c7
add esp, 0xc
cmp eax, 0xffffffff
je 0x406892
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
or edi, edi
jle 0x406835
push 0x1000
lea eax, [ebp - 0x1000]
push esi
push eax
call fcn.00405d90
push 0x8000
push ebx
call fcn.00406c31
add esp, 0x14
mov dword [ebp + 0xc], eax
mov eax, 0x1000
cmp edi, eax
jge 0x4067f4
push edi
pop eax
push eax
lea eax, [ebp - 0x1000]
push eax
push ebx
call fcn.00404609
add esp, 0xc
cmp eax, 0xffffffff
je 0x406812
sub edi, eax
test edi, edi
jle 0x406828
jmp 0x4067e9
cmp dword [0x40a968], 5
jne 0x406825
mov dword [0x40a964], 0xd
or esi, 0xffffffff
push dword [ebp + 0xc]
push ebx
call fcn.00406c31
pop ecx
pop ecx
jmp 0x406875
jge 0x406875
push 0
push dword [ebp + 0xc]
push ebx
call fcn.004040c7
push ebx
call fcn.004055cb
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
push eax
pop esi
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x406875
mov dword [0x40a964], 0xd
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x40a968], eax
push 0
push dword [ebp + 8]
push ebx
call fcn.004040c7
add esp, 0xc
mov eax, esi
pop edi
jmp 0x406895
mov dword [0x40a964], 9
or eax, 0xffffffff
pop esi
pop ebx
leave
ret

Function at 0x43cf63
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43ccda
sub ecx, 0xeb7fcb2a
call fcn.0043cf83
xor dword [ebx], eax
add edi, 1
inc ebx
sub edi, edi
cmp ebx, edx
jne fcn.0043cf63
ret
Function at 0x4069f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
and dword [ebp + 8], 0
add esi, edi
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x20]
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x1c]
add eax, edi
add ebx, edi
cmp dword [esi + 0x18], 0
mov dword [ebp - 8], eax
jbe 0x406a49
mov eax, dword [ebp + 8]
mov eax, dword [ebx + eax*4]
add eax, edi
push eax
push dword [ebp + 0xc]
call dword [0x10002024]
or eax, eax
pop ecx
pop ecx
je 0x406a52
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x406a26
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx eax, word [eax + ecx*2]
sub eax, dword [esi + 0x10]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 4]
add eax, edi
jmp 0x406a4b

Function at 0x403a94
Capabilities:
Terminate process

Disassembly:
jmp 0x45565e
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45566f
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004062c6
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403c10
Capabilities:
Query environment variable

Disassembly:
jmp 0x493e45
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x493e59
xor edi, edi
jmp 0x493e90
push ebx
push esi
call fcn.00493d4f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00404633
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x493e80
push ebx
push esi
push edi
call fcn.00406050
add esp, 0xc
push 0
call fcn.00406dac
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x406127
Capabilities:
Parse pe header

Disassembly:
jmp 0x44440f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44444e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44444e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44444e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44444e
cmp dword [ecx + 0x74], 0xe
jbe 0x44444e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406438
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x41b650
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x5348d8], eax
pop edi
pop esi
ret

Function at 0x4eccc9
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4eca52
sub esi, 0xa1db8f47
call fcn.004ecd05
mov ecx, esi
mov ecx, 0xb4aa3096
sub esi, esi
xor dword [edi], ebx
or esi, ecx
add edi, 1
or esi, esi
cmp edi, eax
jl fcn.004eccc9
or ecx, ecx
sub ecx, 0x44dadfeb
ret
Function at 0x402880
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4028bd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4028dd
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.00403e50
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x4029c8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029f7
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403d08
jmp 0x402a15
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402950
mov edi, eax
test ebx, ebx
je 0x402a15
cmp dword [esi], 0
je 0x402a15
dec ebx
jmp 0x4029fe
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e00
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402de0
xor eax, eax
push ebp
push 0x402dd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e1c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402de0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403bd4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402714
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x485049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403b9c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4051c8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405384
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405229
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4053a0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40529b
xor eax, eax
push ebp
push 0x405294
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00405020
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40527d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4053c0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40529b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40537c
cmp byte [ebp - 0xd], 0
jne 0x4052dd
cmp byte [ebp - 0x12], 0
je 0x40537c
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4052f6
dec ebx
cmp byte [ebx], 0x2e
je 0x405305
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4052f5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40537c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405332
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40537c
cmp byte [ebp - 0xd], 0
je 0x40537c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40537c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405930
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x40598c
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x40597e
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x405973
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x40596e
mov eax, 0x64
jmp 0x405983
call sub.kernel32.dll_GetLastError
call fcn.00402804
xor eax, eax
jmp 0x40596e
mov eax, 0x67
jmp 0x405983

Function at 0x405a14
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x405a44
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x405a3a
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.00402814
or eax, 0xffffffff
jmp 0x405a38
mov eax, 0x67
call fcn.00402804
or eax, 0xffffffff
jmp 0x405a38

Function at 0x40a484
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a4bd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d08
jmp 0x40a4c6
mov eax, ebx
mov edx, esi
call fcn.00403c74
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a4d0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a4f1
mov al, byte [esp]
jmp 0x40a4f3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x414374
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x414389
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x416398
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41639e
ret

Function at 0x418ad0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x418b21
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x418b08
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x418af8
jmp 0x418b21
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x418b09
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426a1c
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x426a70
mov eax, dword [0x484d08]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x426a48
push ebx
push 0x426a78
call fcn.004418bc
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x426a6c
mov ecx, dword [0x484acc]
mov dl, 1
mov eax, dword [0x4075fc]
call fcn.0040ad34
call fcn.00403650
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret

Function at 0x426a98
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00426a1c
xor edx, edx
push ebp
push 0x426b6a
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x426b3c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x426b2b
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00402910
mov eax, dword [ebp - 4]
call fcn.004269d4
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426b32
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x426b9c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00426a1c
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x426c0e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x426be2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00403dd8
jmp 0x426be9
mov eax, ebx
call fcn.00403c20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426c15
cmp dword [ebp - 8], 0
je 0x426c05
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.004269f0
ret