joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x37ec509c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x669242d1
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x401ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406c], eax
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.mifedount
push str.Deltapo
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b33
xor eax, eax
jmp 0x401b4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42a641
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push dword [edi + 0x14]
mov edx, dword [edi + 0x1c]
push dword [edi + 0x10]
mov ecx, dword [edi + 8]
push dword [edi + 0x18]
call fcn.0042a7eb
mov eax, dword [edi + 4]
mov esi, ebx
push dword [eax + 0x10]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
test eax, eax
jne 0x42a685
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42a687
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42a6dd
mov eax, dword [edi + 4]
push ebx
push ebx
push ebx
mov esi, dword [eax]
push ebx
push eax
mov ecx, dword [esi + 0x14]
call dword [0x43514c]
call dword [esi + 0x14]
mov esi, eax
test esi, esi
js 0x42a6dd
mov eax, dword [edi + 4]
push ebx
push dword [edi + 0x14]
mov esi, dword [eax]
push dword [edi + 0x10]
push eax
mov ecx, dword [esi + 0x10]
call dword [0x43514c]
call dword [esi + 0x10]
mov esi, eax
test esi, esi
js 0x42a6dd
mov eax, dword [edi + 4]
push ebx
push 2
push ebx
mov esi, dword [eax]
push ebx
push eax
mov ecx, dword [esi + 0x14]
call dword [0x43514c]
call dword [esi + 0x14]
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x433590
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x433e58
call fcn.00433a78
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x434514
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4333b8
cmp eax, esi
jne 0x4333ab
xor esi, esi
inc esi
mov edi, esi
jmp 0x4333bb
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x43338f
xor esi, esi
inc esi
cmp dword [0x434518], esi
jne 0x4333cd
push 0x1f
call fcn.005a4000
pop ecx
jmp 0x433407
cmp dword [0x434518], ebx
jne 0x433401
mov dword [0x434518], esi
push 0x401034
push 0x401028
call fcn.004334ec
pop ecx
pop ecx
test eax, eax
je 0x433407
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4334dc
mov dword [0x4341c8], esi
cmp dword [0x434518], esi
jne 0x43342a
push 0x401024
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x434518], 2
test edi, edi
jne 0x433437
xor eax, eax
mov ecx, 0x434514
xchg dword [ecx], eax
cmp dword [0x434524], 0
je 0x433463
push 0x434524
call fcn.004338d0
pop ecx
test eax, eax
je 0x433463
push ebx
push 2
push ebx
mov esi, dword [0x434524]
mov ecx, esi
call dword [0x43514c]
call esi
push dword [0x4341d4]
push dword [0x4341d0]
push dword [0x4341cc]
call fcn.004260e2
add esp, 0xc
mov dword [0x4341c4], eax
cmp dword [0x4341dc], 0
jne 0x4334c1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x4341c8], 0
jne 0x4334d5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x4341c4]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.004339c5
jmp 0x433373

Function at 0x4337b4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x433e98
call fcn.00433a78
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x433814
cmp eax, 0xffffffff
je 0x433814
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x43380d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x43380d
cmp edx, 0x10000000
jae 0x43380d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x43380a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x433880
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4338be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4338b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4338c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4338a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x433990
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4339c1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4339c1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x4339c1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x408150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc edi
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
adc ecx, dword [esi - 0x70]
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ebp, dword [esi]
adc byte [ebx - 0x75], dl
pop ebp
or byte [edi - 0x75], dl
jge 0x408179
in al, dx
sar byte [eax], 0xd
jb 0x40816c
cmp ebx, 0xffffffff
ja 0x408170
test ebp, ebx
jne 0x408191
test eax, eax
jg 0x4081a8
jl 0x40817e
cmp ebx, 0x7fffffff
ja 0x4081a8
invalid
cmp eax, 0xffffffff
jl 0x408201
jg 0x408144
cmp ebx, 0x803300b3
jb 0x4081a8
test ecx, ecx
jne 0x4081ac
mov eax, dword [ebp + 0x7b]
mov edx, dword [ebp + 0x14]
push eax
push edi
push edx
push ecx
push ebx
call 0x4d4080f0
add esp, 0x14
pop edi
pop ebx
pop ebp
ret
test ecx, ecx
loopne 0x4081b7
mov ecx, dword [ebp + 0x14]
sub bl, byte [ecx + 0x7000022]
jmp 0x4081da
test eax, eax
jg 0x4081c8
jl 0x4081c1
test ebx, ebx
add dword [edi], 0xffffffb9
add dword [eax], eax
add byte [ebx + ebp*8], dh
add dh, byte [ebx]
test eax, 0x85c0558b
mov ecx, 0x34000001
jmp 0x4081ca
xor ebp, dword [ecx - 0x7a3faa75]
mov edx, dword [ebp - 0x40]
test dword [ecx + 0x77405e2], edx
xchg ecx, eax
loop 0x4081d6
je 0x4081da
neg ebx
cmp dword [ecx + 0x56cf3800], 0x6a
add byte [edx + 0xa], ch
mov ecx, 0x56cf3800
push esi
push 0
push 0xa
not byte [ebx - 0x18]
stosb byte es:[edi], al
add byte ss:[eax], al
mov ecx, eax
xchg esp, eax
push edx
sal dword [edx + 0x2aeaf648], 0xd8
dec edi
add bl, 0x30
mov eax, esi
mov byte [edi], bl
mov esp, dword [ecx + 0xb]
into
jne 0x4081db
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
sub ecx, ecx
inc ebp
sbb byte [ebx - 0x36d4e3b3], cl
pop esi
mov dword [edx - 0x75], ebx
invalid

Function at 0x40a940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
outsd dx, dword [esi]
in eax, dx
xor eax, 0xc1a22d86
Function at 0x402bb8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x472008], 0x8088405
inc edx
mov dword [ebx + 0x472008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x472024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403088
xor eax, eax
push ebp
push 0x403081
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403088
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x472024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x472024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d6c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x474048], 0
je 0x403dcd
cmp word [0x47421c], 0xd7b2
jne 0x403d95
cmp dword [0x474224], 0
jbe 0x403d95
mov eax, 0x474218
call dword [0x474234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x472070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403df4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x472034], 0
jne 0x403de9
push 0
push 0x472068
push 0x472070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405b1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b82
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404158
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bd4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b6c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b89
lea eax, [ebp - 0x10]
call fcn.00403ee8
ret

Function at 0x40b030
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b069
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403fd8
jmp 0x40b072
mov eax, ebx
mov edx, esi
call fcn.00403f3c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b07c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b09d
mov al, byte [esp]
jmp 0x40b09f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b724
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b59c
mov eax, dword [0x4732c8]
cmp byte [eax], 0
je 0x40b7a0
mov eax, dword [0x473070]
call fcn.00402a24
call fcn.00402844
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004084e8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b7e8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b7d6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x473020]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x474664]
call fcn.00405000
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c03c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c112
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f80
lea eax, [ebp - 8]
call fcn.004043f8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043a8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c0fc
mov eax, ebx
call fcn.004026dc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c0f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043a8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c0df
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c124
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c0df
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0fc
mov eax, dword [ebp - 0x10]
call fcn.004026fc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c119
lea eax, [ebp - 8]
call fcn.00403ee8
ret

Function at 0x40c61c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c680
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404158
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408030
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c687
lea eax, [ebp - 0xc]
call fcn.00403ee8
ret

Function at 0x41a82c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x474884
cmp dword [edi], 0
jne 0x41a8a8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x474880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4723f0
mov ecx, 2
call fcn.004028d8
mov edx, 0x41a804
lea eax, [esi + 5]
call fcn.0041a824
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a824
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a87d
mov dword [0x474880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41bd3c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41bd42
ret
Function at 0x4297f4
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x429740
call sub.user32.dll_EnumWindows
ret

Function at 0x429914
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x429991
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00429374
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jbe 0x429939
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00428f74
cmp dword [ebp - 4], 0
je 0x42997b
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004043a8
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429998
lea eax, [ebp - 4]
call fcn.00403ee8
ret

Function at 0x42c634
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x474b54], 0
je 0x42c783
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x473240]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42c783
mov eax, dword [0x474b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x474b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42c752
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x474b54]
call fcn.00413dfc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42c74a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42c74a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42c74a
mov eax, dword [ebp - 0x14]
call fcn.004351e4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42c74a
push ebp
call fcn.0042c5f0
pop ecx
test al, al
jne 0x42c74a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42c706
mov eax, dword [ebp - 0x14]
call fcn.00433d14
dec eax
jle 0x42c74a
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403394
cmp byte [ebp - 1], 0
je 0x42c74a
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42c74a
mov edx, dword [ebp - 0x14]
mov eax, dword [0x474b58]
call fcn.0042bdbc
inc edi
dec ebx
jne 0x42c699
mov eax, dword [0x474b58]
cmp dword [eax + 8], 0
jle 0x42c76a
mov eax, dword [0x474b58]
call fcn.0042be4c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42c783
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042c458
pop ecx
test al, al
jne 0x42c783
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret