joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004710
Capabilities:
Terminate process

Disassembly:
sub esp, 0x38c
push esi
push 0x104
lea eax, [esp + 0x194]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x190]
push 0x104
push ecx
call fcn.10007f0b
lea edx, [esp + 0x198]
push 0x5c
push edx
call fcn.1000808f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000475b
add esi, 2
jmp 0x10004762
lea esi, [esp + 0x190]
push esi
push 0x1001641c
call fcn.100080bb
add esp, 8
test eax, eax
je 0x100047d6
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x10]
push 0x10015d38
push eax
call esi
lea ecx, [esp + 0x58]
push str.P_u_b_tg
push ecx
call esi
mov ecx, dword [0x1001b3ec]
xor eax, eax
add esp, 0x10
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push eax
lea edx, [esp + 0x14]
push 0
mov dword [esp + 0xc], 0x1040400
mov dword [esp + 0x10], 0x180
mov dword [esp + 0x14], edx
mov edx, dword [ecx + 0x54]
push 0x4a
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100047e8
push esi
push str.procexp.exe
call fcn.100080bb
add esp, 8
test eax, eax
je 0x100047f8
mov eax, dword [esp + 0x394]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
add esp, 0x38c
ret 4
Function at 0x10005f8a
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x10016750
call fcn.1000868c
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov edx, dword [ebp - 0x30]
cmp word [edx], ax
jne 0x10005ff2
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x10005ff2
mov ecx, dword [eax + 0xd8]
lea esi, [ecx + edx]
cmp dword [ebp + 0xc], esi
jb 0x10005ff2
mov eax, dword [eax + 0xdc]
add eax, ecx
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x10005ff2
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x10005ffb
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.100086d1
ret
Function at 0x100060f3
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
push edi
mov ebx, 0x10000
cmp esi, 0x7ff80000
jbe 0x10006116
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x10006119
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x1000612c
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x10006133
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x1001a504]
mov ecx, dword [0x1001a500]
test eax, eax
jne 0x1000614d
test ecx, ecx
je 0x10006162
mov eax, ecx
mov dword [0x1001a504], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x10006162
cmp edx, dword [ebp - 4]
jb 0x10006162
cmp edx, dword [ebp - 8]
jbe 0x10006233
mov eax, ecx
test ecx, ecx
jmp 0x10006186
test eax, eax
je 0x10006181
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10006181
cmp ecx, dword [ebp - 4]
jb 0x10006181
cmp ecx, dword [ebp - 8]
jbe 0x10006233
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x1001a504], eax
jne 0x10006168
mov eax, esi
and eax, 0xffff
sub esi, eax
mov edi, esi
cmp esi, dword [ebp - 4]
jbe 0x100062c8
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x100061b3
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100062c8
cmp dword [ebp - 0x30], ebx
jne 0x100061d2
cmp dword [ebp - 0x34], ebx
jae 0x100061e5
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x100061a1
jmp 0x100062c8
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1001a504], eax
test eax, eax
je 0x100062c8
mov ecx, dword [0x1001a500]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x1001a500], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x10006225
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x100062cd
cmp esi, dword [ebp - 8]
ja 0x100062cd
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.10008880
add esp, 0xc
mov eax, esi
jmp 0x100062cf
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x10006274
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100062cd
cmp dword [ebp - 0x14], ebx
jne 0x100062bf
cmp dword [ebp - 0x18], ebx
jb 0x100062bf
movzx ecx, si
test ecx, ecx
je 0x100062a3
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1001a504], eax
test eax, eax
jne 0x10006201
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x10006262
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100062f5
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x10016770
call fcn.1000868c
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10006350
and dword [ebp - 4], 0
mov ecx, 0x5a4d
mov eax, dword [ebp - 0x30]
cmp word [eax], cx
jne 0x10006349
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10006349
cmp word [ecx + 0x14], 0
je 0x10006349
mov dword [ebp - 4], 0xfffffffe
jmp 0x10006352
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.100086d1
ret

Function at 0x1000636a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x1001a50c], edi
je 0x1000637d
mov eax, 0x10dd
jmp 0x100063d8
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x1001a50c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x10006376
push esi
mov esi, dword [0x1001a500]
mov dword [0x1001a508], edi
mov dword [0x1001a51c], edi
mov dword [0x1001a518], edi
mov dword [0x1001a510], edi
mov dword [0x1001a514], edi
jmp 0x100063d1
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x100063bb
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x100063db
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001a50c], eax
je 0x100063f1
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x1001a51c]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x1000643c
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x1000642d
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x1000642d
call fcn.100062d4
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.10008184
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x10006400
mov dword [0x1001a51c], ebx
call fcn.100060cc
mov esi, dword [0x1001a518]
cmp esi, ebx
je 0x10006469
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.10008184
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x10006451
pop edi
pop esi
mov dword [0x1001a518], ebx
mov dword [0x1001a50c], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x100066c0
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x1001a510]
test eax, eax
jne 0x10006730
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x100066dc
xor eax, eax
jmp 0x1000672f
push esi
push 8
call fcn.100083d8
mov esi, eax
pop ecx
test esi, esi
jne 0x100066f0
push 8
pop edi
jmp 0x1000670b
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000671c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.10008184
pop ecx
and dword [0x1001a514], 0
mov dword [0x1001a510], edi
mov eax, edi
jmp 0x1000672e
mov eax, dword [0x1001a518]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x1001a518], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x10006986
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001a50c], eax
je 0x100069a2
mov eax, 0x10dd
jmp 0x10006a83
mov eax, dword [0x1001a510]
test eax, eax
jne 0x10006a83
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100069bf
push 6
pop eax
jmp 0x10006a82
cmp dword [edi], 0
jne 0x100069d7
push 6
pop eax
mov dword [0x1001a510], eax
mov dword [0x1001a514], edi
jmp 0x10006a82
push ebx
push esi
push 0x18
call fcn.100083d8
mov esi, eax
pop ecx
test esi, esi
jne 0x100069ec
push 8
pop edi
jmp 0x10006a65
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.10006358
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x10006a5a
cmp ecx, 0x17
ja 0x10006a5a
cmp dword [edi + 0x1c], eax
jne 0x10006a5a
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push ebx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10006a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10006a65
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x1001a51c]
mov dword [esi], eax
mov dword [0x1001a51c], esi
xor eax, eax
jmp 0x10006a80
push 9
pop edi
cmp dword [0x1001a508], edx
jne 0x10006a6b
mov dword [0x1001a510], edi
test esi, esi
je 0x10006a76
push esi
call fcn.10008184
pop ecx
mov eax, dword [ebp + 8]
mov dword [0x1001a514], eax
mov eax, edi
pop esi
pop ebx
pop edi
leave
ret 8

Function at 0x100088fa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10019030]
jne 0x10008904
repz ret
jmp fcn.1000df43
Function at 0x100102d1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000b36f
and dword [ebp - 4], 0
cmp dword [0x1001aecc], 0
mov ebx, eax
jne 0x10010382
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10010433
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10010433
push eax
call fcn.1000b2fd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1001aecc], eax
call esi
push eax
call fcn.1000b2fd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001aed0], eax
call esi
push eax
call fcn.1000b2fd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001aed4], eax
call esi
push eax
call fcn.1000b2fd
pop ecx
mov dword [0x1001aedc], eax
test eax, eax
je 0x10010382
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000b2fd
pop ecx
mov dword [0x1001aed8], eax
mov eax, dword [0x1001aed8]
cmp eax, ebx
je 0x100103da
cmp dword [0x1001aedc], ebx
je 0x100103da
push eax
call fcn.1000b378
push dword [0x1001aedc]
mov esi, eax
call fcn.1000b378
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100103da
test edi, edi
je 0x100103da
call esi
test eax, eax
je 0x100103d1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100103d1
test byte [ebp - 0xc], 1
jne 0x100103da
or dword [ebp + 0x10], 0x200000
jmp 0x10010413
mov eax, dword [0x1001aed0]
cmp eax, ebx
je 0x10010413
push eax
call fcn.1000b378
pop ecx
test eax, eax
je 0x10010413
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10010413
mov eax, dword [0x1001aed4]
cmp eax, ebx
je 0x10010413
push eax
call fcn.1000b378
pop ecx
test eax, eax
je 0x10010413
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001aecc]
call fcn.1000b378
pop ecx
test eax, eax
je 0x10010433
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10010435
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10298df
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1033348]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.01029820
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1029952
cmp dword [ebp - 0x94], 5
jb 0x1029973
jmp 0x102996f
cmp dword [ebp - 0x88], 1
jne 0x1029973
cmp dword [ebp - 0x94], 4
ja 0x102996f
jne 0x1029973
cmp dword [ebp - 0x90], 0
jbe 0x1029973
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10061a8
call fcn.01007bb9
test eax, eax
jge 0x1029994
mov byte [0x1033fa8], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01008aac
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x460020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403098
xor eax, eax
push ebp
push 0x403091
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403098
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x460020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x460020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d84
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46204c], 0
je 0x403de5
cmp word [0x462220], 0xd7b2
jne 0x403dad
cmp dword [0x462228], 0
jbe 0x403dad
mov eax, 0x46221c
call dword [0x462238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46006c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e0c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x460030], 0
jne 0x403e01
push 0
push 0x460064
push 0x46006c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405d54
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405dba
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404170
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402be4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405da4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405dc1
lea eax, [ebp - 0x10]
call fcn.00403f00
ret

Function at 0x40ae94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aecd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403ff0
jmp 0x40aed6
mov eax, ebx
mov edx, esi
call fcn.00403f54
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aee0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40af01
mov al, byte [esp]
jmp 0x40af03
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b588
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b400
mov eax, dword [0x4611dc]
cmp byte [eax], 0
je 0x40b604
mov eax, dword [0x460fe0]
call fcn.00402a50
call fcn.004028c4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004086d4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b64c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b63a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x460f8c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x462668]
call fcn.0040524c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bef4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bfca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f98
lea eax, [ebp - 8]
call fcn.00404410
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043c0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bfb4
mov eax, ebx
call fcn.0040275c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bfad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043c0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bf97
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bfdc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bf97
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bfb4
mov eax, dword [ebp - 0x10]
call fcn.0040277c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bfd1
lea eax, [ebp - 8]
call fcn.00403f00
ret

Function at 0x40c4dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c540
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404170
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004081fc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c547
lea eax, [ebp - 0xc]
call fcn.00403f00
ret

Function at 0x41dd90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x462888
cmp dword [edi], 0
jne 0x41de0c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x462884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4603fc
mov ecx, 2
call fcn.00402958
mov edx, 0x41dd68
lea eax, [esi + 5]
call fcn.0041dd88
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041dd88
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41dde1
mov dword [0x462884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f428
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f42e
ret
Function at 0x42a998
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004043b0
xor eax, eax
push ebp
push 0x42aac6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42aa99
xor eax, eax
push ebp
push 0x42aa92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041c0
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42aa67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x42aa56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041c0
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004043c0
mov edx, ebx
pop ecx
call fcn.00402958
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42aa5d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x460f28]
mov dl, 1
mov eax, dword [0x4070d4]
call fcn.0040b718
call fcn.0040393c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42aacd
lea eax, [ebp - 4]
call fcn.00403f00
ret