joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d42e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x5294c0]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4d432b
cmp word [edx], bx
jne 0x4d432b
or byte [edi + eax + 0x28], 4
jmp 0x4d4330
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4d4484
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4d4464
cmp ax, word [ebp - 0x10]
je 0x4d4369
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4d4459
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4d438f
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4d437f
push ecx
pop eax
push 4
jmp 0x4d4384
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4d4453
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4d444a
cmp dword [ebp - 0x18], 0
je 0x4d444a
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x5294c0]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4d4416
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4d43da
mov word [esi], ax
jmp 0x4d440e
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x5294c0]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x5294c0]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x5294c0]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4d4459
cmp word [ebp - 4], ax
jne 0x4d442b
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4d442b
mov word [esi], ax
add esi, 2
jmp 0x4d4459
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004c30ec
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4d4456
jmp 0x4d444d
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4d4349
jmp 0x4d4484
mov ecx, dword [ecx*4 + 0x5294c0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4d447b
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4d4484
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4f6d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d4b6d

Function at 0x4d4f78
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d4cf0

Function at 0x4da413
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d9b97

Function at 0x4da41e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d9dd6

Function at 0x4da716
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004da5e3
Function at 0x4e3a20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2dba
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x525248]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00419150
mov ecx, eax
test ecx, ecx
je 0x4e3be4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00419150
mov ecx, eax
test ecx, ecx
je 0x4e3bee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00419150
mov ecx, eax
test ecx, ecx
je 0x4e3bf8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x4e3b02
xor ecx, ecx
jmp 0x4e3b20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e3b10
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00403e00
push edi
mov ecx, ebx
call fcn.00405a70
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4e3b3c
xor ecx, ecx
jmp 0x4e3b54
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e3b44
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00403e00
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.004e4420
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00405a70
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4e3b95
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4e3bce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4e3bce
cmp dword [esi + 0x10], 0
je 0x4e3bc5
push dword [edi]
call fcn.004c1c71
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00402c10
push 0x80004005
call fcn.00402c10
push 0x80004005
call fcn.00402c10
int3
Function at 0x4e4220
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x525248]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4e43f4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e4275
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x4e43f4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e4293
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x4e43f4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e42b1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x4e43f4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e42cf
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x4e43f4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e43f4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4e42f4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x4e4327
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x4e433f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x4e437d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.00407dd0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.0048e480
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x5102b4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004e5200
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e43ab
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x4e43e4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4e43e4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.00409f70
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.00405560
lea ecx, [ebp - 0x28]
call fcn.00405560
lea ecx, [ebp - 0x34]
call fcn.00423ec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455e83
mov esp, ebp
pop ebp
ret 4
Function at 0x4e4d60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3067
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x525248]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4e4daa
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e4db6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.00420740
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x4e4e23
push 0x48
call fcn.00455ec3
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4e4e17
push 0x48
push 0
push ebx
call fcn.0048ef80
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.004e3a20
jmp 0x4e4e19
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e4e50
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.00420740
push 3
push 0x5102b4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0041beb0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e4e9f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x4e4eee
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4e4eee
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.00420740
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00405560
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4e4f24
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4e4f1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e4f61
push edx
push ecx
call fcn.00455a65
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4e4f43
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455e83
mov esp, ebp
pop ebp
ret 0x14
call fcn.004994e6
int3
Function at 0x402ad0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404144
test esi, esi
jne 0x402b06
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404234
jmp 0x402b24
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029e4
mov edi, eax
test esi, esi
je 0x402b24
cmp dword [ebx], 0
je 0x402b24
dec esi
jmp 0x402b0d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403264
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48a020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4032fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032dc
xor eax, eax
push ebp
push 0x4032d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403318
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48a020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48a020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403fc8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48d04c], 0
je 0x404029
cmp word [0x48d220], 0xd7b2
jne 0x403ff1
cmp dword [0x48d228], 0
jbe 0x403ff1
mov eax, 0x48d21c
call dword [0x48d238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48a06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404050
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48a030], 0
jne 0x404045
push 0
push 0x48a064
push 0x48a06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406270
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4062d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004043b4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e28
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4062c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062dd
lea eax, [ebp - 0x10]
call fcn.00404144
ret

Function at 0x408c9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404604
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408cb5
test al, 0x10
jne 0x408cb9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40bd14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bd4d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404234
jmp 0x40bd56
mov eax, ebx
mov edx, esi
call fcn.00404198
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bd60
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bd81
mov al, byte [esp]
jmp 0x40bd83
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c408
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c280
mov eax, dword [0x48c3c8]
cmp byte [eax], 0
je 0x40c484
mov eax, dword [0x48c0c4]
call fcn.00402bec
call fcn.00402910
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408ed8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c4cc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c4ba
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x48c060]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48d668]
call fcn.00405784
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cd98
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ce6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004041dc
lea eax, [ebp - 8]
call fcn.00404654
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404604
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40ce58
mov eax, ebx
call fcn.004027a8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40ce51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404604
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40ce3b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40ce80
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40ce3b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ce58
mov eax, dword [ebp - 0x10]
call fcn.004027c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ce75
lea eax, [ebp - 8]
call fcn.00404144
ret

Function at 0x40d404
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d468
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004043b4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408974
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d46f
lea eax, [ebp - 0xc]
call fcn.00404144
ret

Function at 0x4238dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48d888
cmp dword [edi], 0
jne 0x423958
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x48d884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48a5cc
mov ecx, 2
call fcn.004029a4
mov edx, 0x4238b4
lea eax, [esi + 5]
call fcn.004238d4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004238d4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42392d
mov dword [0x48d884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424e94
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424e9a
ret
Function at 0x4272e8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x427339
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x427320
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x427310
jmp 0x427339
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x427321
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432534
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x432480
call sub.user32.dll_EnumWindows
ret

Function at 0x432654
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4326d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004320b4
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x432679
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00431cb4
cmp dword [ebp - 4], 0
je 0x4326bb
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404604
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4326d8
lea eax, [ebp - 4]
call fcn.00404144
ret

Function at 0x435ba4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x435bf4]
test si, 4
je 0x435bb8
or bl, 1
test si, 8
je 0x435bc2
or bl, 4
test si, 1
je 0x435bcc
or bl, 8
test si, 2
je 0x435bd6
or bl, 0x10
test si, 0x10
je 0x435be0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435bef
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x435bf8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x435c30]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435c11
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435c20
or bl, 4
test esi, 0x20000000
je 0x435c2b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret