joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402760
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40276e
call dword [0x47d014]
or eax, eax
je 0x40276f
ret
mov al, 1
jmp fcn.00402838

Function at 0x402778
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402786
call dword [0x47d018]
or eax, eax
jne 0x402787
ret
mov al, 2
jmp fcn.00402838

Function at 0x402790
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4027c8
test edx, edx
je 0x4027b2
push eax
mov eax, ecx
call dword [0x47d01c]
pop ecx
or eax, eax
je 0x4027c1
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402838
mov dword [eax], edx
mov eax, ecx
call dword [0x47d018]
or eax, eax
jne 0x4027ab
ret
mov al, 1
jmp fcn.00402838
test edx, edx
je 0x4027dc
push eax
mov eax, edx
call dword [0x47d014]
pop ecx
or eax, eax
je 0x4027c1
mov dword [ecx], eax
ret

Function at 0x402838
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x481004]
test ecx, ecx
je 0x402848
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402861]
jns 0x40285c
call fcn.00406a34
mov eax, dword [eax + 4]
jmp fcn.00403adc

Function at 0x4029c0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029ef
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403bcc
jmp 0x402a0d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402948
mov edi, eax
test ebx, ebx
je 0x402a0d
cmp dword [esi], 0
je 0x402a0d
dec ebx
jmp 0x4029f6
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402dac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e44
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e24
xor eax, eax
push ebp
push 0x402e1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4030c4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4030de
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x4030de
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4030ca
mov al, 0xa
jmp fcn.00402838
ret

Function at 0x403110
Capabilities:
Terminate process

Disassembly:
cmp dword [0x481018], 0
je 0x402a63
call dword [0x481018]
mov eax, 0xd2
jmp fcn.00403adc
push eax
push ecx
mov eax, dword [eax]
call fcn.004030e0
pop ecx
pop eax
je 0x40311f
jmp ebx
pop ecx
jmp 0x402a54
Function at 0x403128
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.004030e0
mov eax, ebx
pop ebx
jne 0x40313d
pop ecx
jmp 0x402a54
ret

Function at 0x4039b8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4814a0
mov esi, 0x481034
mov edi, 0x481038
cmp byte [ebx + 0x24], 0
jne 0x4039e7
cmp dword [edi], 0
je 0x4039e7
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x4039d6
cmp dword [0x48103c], 0
je 0x403a2e
call fcn.00403934
cmp byte [0x481044], 0
je 0x403a14
mov edx, 0x47d024
mov eax, 0x481218
call fcn.004062d0
call fcn.00406253
jmp 0x403a27
push 0
push 0x47d044
push 0x47d024
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x48103c], eax
cmp byte [ebx + 0x24], 2
jne 0x403a3e
cmp dword [esi], 0
jne 0x403a3e
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403808
cmp byte [ebx + 0x24], 1
jbe 0x403a4e
cmp dword [esi], 0
je 0x403a6b
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403a6b
call fcn.00405cd4
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403a6b
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.004037e0
cmp byte [ebx + 0x24], 1
jne 0x403a79
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403a84
call fcn.00403984
cmp dword [ebx], 0
jne 0x403a91
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403a2e

Function at 0x40414c
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404110
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404110
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x4040f8
ret

Function at 0x4041f4
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402838
test ecx, ecx
je fcn.00404110
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4040f8
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x4042bc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4042fb
cmp al, 0xb
je 0x4042fb
cmp al, 0xc
je 0x404305
cmp al, 0xd
je 0x404318
cmp al, 0xe
je 0x404336
cmp al, 0xf
je 0x4042fb
cmp al, 0x11
je 0x4042fb
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402838
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4042fb
jmp 0x40434a
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404305
jmp 0x40434a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004042bc
dec edi
jg 0x40431b
pop ebp
jmp 0x40434a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404290
dec edi
jg 0x404339
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404350
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004042bc

Function at 0x404388
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4043cf
cmp al, 0xb
je 0x4043e9
cmp al, 0xc
je 0x404400
cmp al, 0xd
je 0x40440f
cmp al, 0xe
je 0x40442d
cmp al, 0xf
je 0x404443
cmp al, 0x11
je 0x404452
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402838
cmp ecx, 1
mov eax, ebx
jg 0x4043e0
call fcn.00403ae8
jmp 0x404461
mov edx, ecx
call fcn.00403b0c
jmp 0x404461
cmp ecx, 1
mov eax, ebx
jg 0x4043f7
call fcn.00404110
jmp 0x404461
mov edx, ecx
call fcn.00404128
jmp 0x404461
mov eax, ebx
add ebx, 0x10
call fcn.00405080
dec edi
jg 0x404400
jmp 0x404461
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404388
dec edi
jg 0x404412
pop ebp
jmp 0x404461
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.0040435c
dec edi
jg 0x404430
pop ebp
jmp 0x404461
mov eax, ebx
add ebx, 4
call fcn.00405d9c
dec edi
jg 0x404443
jmp 0x404461
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00405930
dec edi
jg 0x404452
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404468
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404388

Function at 0x404474
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4044a0
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402908
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x4044df
cmp cl, 0xb
je 0x4044f0
cmp cl, 0xc
je 0x404501
cmp cl, 0xd
je 0x404512
cmp cl, 0xe
je 0x404532
cmp cl, 0xf
je 0x40454b
cmp cl, 0x11
je 0x40455c
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402838
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403b3c
mov eax, 4
jmp 0x40456d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.0040414c
mov eax, 4
jmp 0x40456d
lea edx, [esi + eax]
add eax, ebx
call fcn.00404830
mov eax, 0x10
jmp 0x40456d
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404590
pop eax
jmp 0x40456d
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404474
pop eax
jmp 0x40456d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405db4
mov eax, 4
jmp 0x40456d
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.0040596c
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x40448e
pop ecx
sub ecx, eax
jle 0x404589
lea edx, [ebx + eax]
add eax, esi
call fcn.00402908
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404590
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x4045d6
cmp cl, 0xb
je 0x4045ed
cmp cl, 0xc
je 0x404601
cmp cl, 0xd
je 0x404615
cmp cl, 0xe
je 0x404636
cmp cl, 0xf
je 0x404653
cmp cl, 0x11
je 0x404667
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402838
mov eax, ebx
mov edx, dword [esi]
call fcn.00403b3c
add ebx, 4
add esi, 4
dec ebp
jne 0x4045d6
jmp 0x40467b
mov eax, ebx
mov edx, dword [esi]
call fcn.0040414c
add ebx, 4
add esi, 4
dec ebp
jne 0x4045ed
jmp 0x40467b
mov eax, ebx
mov edx, esi
call fcn.00404830
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404601
jmp 0x40467b
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404590
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x40461e
jmp 0x40467b
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404474
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x404636
jmp 0x40467b
mov eax, ebx
mov edx, dword [esi]
call fcn.00405db4
add ebx, 4
add esi, 4
dec ebp
jne 0x404653
jmp 0x40467b
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.0040596c
add ebx, 4
add esi, 4
dec ebp
jne 0x404667
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x404830
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402838
cmp eax, edx
je 0x4048c7
cmp word [eax], 8
jb 0x404868
push eax
push edx
cmp word [eax], 0x100
je 0x40485e
cmp word [eax], 0x101
je 0x404856
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x404866
call dword [0x4813e4]
jmp 0x404866
add eax, 8
call fcn.00403ae8
pop edx
pop eax
cmp word [edx], 8
jae 0x40487f
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40489a
cmp word [edx], 0x101
jne 0x4048b3
push eax
call 0x40486e
pop eax
jmp dword [0x4813ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x4048aa
mov ecx, dword [edx - 8]
inc ecx
jle 0x4048aa
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x4047e4
ret
Function at 0x404e08
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00405088
xor eax, eax
push ebp
push 0x404dfa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x4813e8]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.00404e08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404e01
lea eax, [ebp - 0x10]
call fcn.00405080
ret
cmp word [edx], 0x101
je 0x404da4
cmp word [edx], 0x100
jne fcn.00404830
cmp word [eax], 8
jb 0x404e2d
push eax
push edx
call fcn.004047ec
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.00404218

Function at 0x404f70
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x404f96
cmp eax, 0x100
jne 0x404fc5
mov eax, 8
cmp edx, 0x11
jbe 0x404fa8
cmp edx, 0x100
jne case.default.0x404fbc
mov edx, 8
mov al, byte [eax + 0x47d05c]
mov dl, byte [edx + 0x47d05c]
movzx ecx, byte [edx + eax*8 + 0x47d070]
jmp dword [ecx*4 + 0x404fd7]
mov eax, edx
cmp eax, 0x101
jne case.0x404fbc.0
pop edi
pop esi
call fcn.00404edc
push eax
popf
ret
pop edi
pop esi
jmp 0x4047e4
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404b34
xchg edi, eax
call fcn.00404b34
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00404bd4
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404bd4
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00404c30
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404c30
fld xword [esp]
add esp, 0xc
jmp 0x40502f
mov eax, edi
mov edx, esi
call fcn.00404e74
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00404ba0
xchg edi, eax
call fcn.00404ba0
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x4059f0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405ba8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405a51
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405bc4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405abe
xor eax, eax
push ebp
push 0x405ab7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405aa0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405be4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405abe
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405b9f
cmp byte [ebp - 0xd], 0
jne 0x405b00
cmp byte [ebp - 0x12], 0
je 0x405b9f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405b19
dec ebx
cmp byte [ebx], 0x2e
je 0x405b28
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405b18
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405b9f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405b55
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405b9f
cmp byte [ebp - 0xd], 0
je 0x405b9f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405b9f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b3b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3e9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403bcc
jmp 0x40b3f2
mov eax, ebx
mov edx, esi
call fcn.00403b80
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b3fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b41d
mov al, byte [esp]
jmp 0x40b41f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x417938
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41793e
ret

Function at 0x419fac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x419ffd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x419fe4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x419fd4
jmp 0x419ffd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x419fe5
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a87c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0041a45a
push eax
push esi
push dword [ebp + 8]
call fcn.0041a40f
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x41a8e5
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041a45a
push eax
push esi
push dword [ebp + 8]
call fcn.0041a40f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041a44a
rcl dword [edx]
cli
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0041a44a
call 0x8e3c0c67
invalid
Function at 0x423df0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x423e7a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 4], 0
jne 0x423e61
mov eax, dword [0x47ff20]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x423e2f
push ebx
push 0x423e88
call fcn.0043cd34
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x423e5d
lea edx, [ebp - 4]
mov eax, dword [0x47fc2c]
call fcn.00405d44
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x407af4]
call fcn.0040bb50
call fcn.004035e0
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423e81
lea eax, [ebp - 4]
call fcn.00403ae8
ret

Function at 0x423ea8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00423df0
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x423f1a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x423eee
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00403c9c
jmp 0x423ef5
mov eax, ebx
call fcn.00403ae8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423f21
cmp dword [ebp - 8], 0
je 0x423f11
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.00423dc4
ret

Function at 0x423f28
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x424006
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00423df0
xor edx, edx
push ebp
push 0x423fe9
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x423fb2
mov edx, ebx
mov eax, dword [0x41740c]
call fcn.0041b6c4
test al, al
je 0x423fa2
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041b598
call fcn.00403680
jmp 0x423ff0
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x423f6d
lea edx, [ebp - 8]
mov eax, dword [0x47fca8]
call fcn.00405d44
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407af4]
call fcn.0040bb50
call fcn.004035e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423ff0
mov eax, dword [ebp - 4]
call fcn.00423dc4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42400d
lea eax, [ebp - 8]
call fcn.00403ae8
ret