joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422e65
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
xor bl, byte [edi + 0x26]
std
xchg edx, eax
imul esp, dword [esi], 0xccbff94f
sahf
inc edx
push ecx
stc
mov edi, 0x51429ecc
jle 0x422d0c
mov cl, 0xc6
sub dword [edx + 0x57], edi
lcall 0x3c73, 0x47e28784
loop 0x422d6e
jae 0x422d65
mov esi, 0x2ef5be3f
adc al, bh
out 0x73, eax
aaa
xchg ebx, eax
outsb dx, byte [esi]
xor bh, ah
push es
xlatb
or bh, bl
jbe 0x422d25
pop esi
movsd dword es:[edi], dword [esi]
push ebx
into
pop ss
shr eax, 1
push dword [edx + 0x3b8fc94f]
pop eax
cmp al, 0xcc
enter 0x1825, 0x2f
dec ebp
out 0x37, eax
dec edi
xlatb
fstp xword [ebx]
cmc
dec ebx
pop es
and dword [edi], 0x3985d4e1
invalid
mov ecx, 0x58da4218
or byte [esi], dl
jl 0x422dbe
push edx
cmp dword [eax - 0xd99876a], edi
je 0x422d15
bnd je 0x422d15
inc edx
test al, 0x6e
sub ebp, ecx
sbb esi, dword [edx - 0x30]
xchg esi, eax
mov cl, 0x82
mov eax, 0xd1675b30
imul ebp, dword [ebx + 0x343ddeb3], 0x43
jb 0x422d97
push 0x2813daa4
dec esp
mov bl, 0x3e
ror dword [ebx + eax*8 - 0x57894f87], 0xd2
ror dword ds:[ebx + eax*8 - 0x57894f87], 0xd2
cmp dword [ecx + 0x28], eax
ret 0xae12
stosb byte es:[edi], al
xor dword [edx + 0x587e3b7d], ecx
lahf
popfd
or al, 0x4b
invalid
bound edi, qword [eax]
jmp 0x422d73
mov byte [esi + 0x6c], al
cmp byte [esi + 0x3d0c441e], dl
insd dword es:[edi], dx
outsd dx, dword [esi]
push edi
xor bl, byte [edi + 0x772ff688]
mov al, byte [0x68dece8c]
inc edi
add ebp, dword [ebx + 0x16]
insb byte es:[edi], dx
jecxz 0x422e14
mov al, 1
mov al, byte [0x1072949c]
hlt
scasd eax, dword es:[edi]
iretd
je 0x422dd5
jecxz 0x422e50
pop esi
pop ecx
and dh, bl
cmpsd dword [esi], dword es:[edi]
jp 0x422dfb
sub byte [ebp - 0x6387309], ch
sub bl, dl
inc edx
mov ch, 0x96
xchg esi, eax
push esi
fsubr dword [esi - 0x47]
mov es, word [edx]
pop edx
mov byte [edi], bh
outsb dx, byte [esi]
mov ecx, 0x885a028e
aas
js 0x422e8d
lahf
push 0x1c
push ss
xor byte [eax], dl
cmp dword [ebp + 0x5ee4a2a4], 0x76c74e39
xchg edi, eax
pop esi
cmp dword [esi - 0x39], ecx
jbe 0x422de2
xchg byte [ecx - 0x7d], cl
and dword [esi + 0x12], edx
pop ds
adc bl, byte [edi]
mov eax, 0x6000c46f
inc edi
fiadd dword [0x38c4abae]
jno 0x422e45
dec esp
loope 0x422eaa
or al, byte [edi - 0xb255756]
dec esp
xchg dword [edx + 0x4cf4daa8], ebp
stosd dword es:[edi], eax
adc eax, dword [esi + 0x30]
xor dword [ecx], eax
or eax, 0x7d680dd7
cmp al, 0x82
or bh, 0x4c
fbstp tbyte [edi - 2]
add dword [edx - 5], edi
xchg esi, eax
jbe 0x422e19
xchg ecx, eax
enter 0xffffffffffffa7a0, 0xffffffffffffff90
jne 0x422e3e
pop es
jnp 0x422e2e
mov al, byte [0xa615f2d7]
popal
je 0x422eee
xlatb
adc eax, 0x597461a6
inc ebp
in al, 0x33
xor dword [eax], ebp
push edx
jnp 0x422e31
test al, 0xc4
pushal
pop ecx
push cs
fsub qword [esi + 0x43a3da7f]
call 0x646d33e0
push edi
pop ecx
add eax, 0x5957642b
adc ecx, dword [edi + 0x6f22b7b1]
invalid
mov esp, 0xf8e76df9
mov word [edi - 0x3d], ss
int 0x22
sbb al, 0x31
adc al, 4
adc eax, dword [eax - 0x5845e8bb]
int3
Function at 0x429ef5
Capabilities:
Encode data using xor

Disassembly:
cdq
jmp 0x429f14
push ss
jbe 0x429eb1
pop ecx
dec ebp
adc byte [edx], al
retf 0x4fdc
pop ecx
add eax, 0xa1659dbc
xor dword [ebp - 0x19], eax
lea ebp, [esi + ebx*8 + 0x45]
adc dword ds:[edi], 0x5d93f950
add edi, ecx
out 0xdf, al
loop 0x429f39
salc
jo 0x429f6b
or al, 0xe4
xchg dword [ecx - 0x4e], esp
div byte [ecx]
cli
cwde
rol ebx, 0x5a
and dword [edx + eax + 0x5923c43b], ebx
inc esi
mov byte [0x3563677a], al
sbb eax, eax
div edx
mov ss, word cs:[eax + 0x73]
int3
movsd dword es:[edi], dword [esi]
cmp al, 0xdc
call 0xb808c209
xor al, 0x9b
mov dh, 0x4a
mov ebx, 0x803edacc
or cl, dh
sub cl, al
sub al, 0xd5
sal ecx, cl
call 0xc002b4
cmp eax, 0x96a4c926
cmp ah, byte [ebx - 0x4e]
mov esi, 0x3cf3c688
rcl dword [0x488e7c7e]
push ecx
loopne 0x429f3b
out 0xc, al
and eax, 0x27eb7fdd
push edi
push edx
aaa
sbb esi, dword [ecx]
sub al, 0xe7
dec ebp
jp 0x429fc7
sbb eax, 0x379c2d33
aas
adc byte [eax], 0xae
seto byte [edi]
mov eax, 0xbcefba70
mov cl, 0x85
jmp 0x42a007
adc dword [ebx - 0x2a639c0c], eax
add esp, ebx
sti
pop esp
sbb al, 0xf1
fnsave dword [0xe7406a21]
mov ebx, 0xcc12198c
shl dword [edx + 0x57ee144], 1
fcom qword [ebp + edx*8 + 0x29]
pop esi
xchg ebx, eax
mov al, 0x89
or dword [ebp - 0x43], 0x964ad25c
insb byte es:[edi], dx
aad 0xbd
push eax
adc ch, dl
sub bl, byte [ecx - 0x5f893596]
pop ebp
sahf
pushal
and esi, dword [esi]
sbb al, 0x66
inc esi
xchg edi, eax
sub eax, 0x60d9c531
cmp al, 0xbf
sti
sub dl, byte [0x2ba4d72c]
shl bh, 1
cmpsb byte [esi], byte es:[edi]
sub al, 0x62
inc edi
in al, dx
mov esi, 0xfaa436ee
aad 0x8f
insd dword es:[edi], dx
mov ebx, 0x92bd8c46
inc edi
xor esp, dword [eax - 0x6b5358d8]
or al, 0x6c
loop 0x42a03c
retf 0xa076
xchg edi, eax
sahf
test dword [edx + 0x55a70da6], 0x5a964a04
pop ebp
test dword [edi + eax*2], ebp
mov ebp, esp
insb byte es:[edi], dx
sub al, byte [esi - 0x7a]
and byte cs:[ebp - 0x2d], ch
xchg byte [esi], ch
and byte [ebp - 0x2d], ch
sub dl, ch
lodsd eax, dword [esi]
xor cl, cl
cmp dword [eax], ecx
scasd eax, dword es:[edi]
xlatb
push edi
fcomp dword [ebp + 0xddaf2c]
into
xchg esi, eax
test ebx, edi
adc ch, dl
fst qword [ecx]
xchg esi, eax
rcl byte [eax - 0x70], cl
outsd dx, dword [esi]
inc esp
jl 0x42a08c
test dword es:[ecx + edi*2 - 0x4fd43701], esp
or al, 0xcc
retf
Function at 0x44efc5
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax - 1], 0x5e
jl 0x44ee53
cmpsd dword ss:[esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
mov dh, 0xcb
retf
mov esi, 0x5656664c
nop
sub cl, ch
ret
or dword [esi + 0x45d6ca16], ecx
enter 0xffffffffffffff1e, 0xffffffffffffff8f
xor edx, 0xffffff89
invalid
sahf
in al, dx
jno 0x44ee2d
sbb al, 0xd6
pop edi
int1
cmp al, 0xc9
cmc
outsd dx, dword [esi]
jno 0x44ee17
arpl word [edx + 0x3f], cx
aas
xchg ebp, eax
cmp eax, 0x31f26187
mov ah, 0x61
push 0x80bf6281
mov cl, 0x58
pop ds
pop edx
mov byte [esi - 0x4cd2e636], al
jae 0x44ee1c
out dx, eax
jno 0x44ee67
int 0xd1
sbb al, 6
ljmp 0xd7b3
xor ebp, edx
sbb eax, 0x71a255f4
mov eax, dword [0xa83ba2b8]
lodsb al, byte [esi]
xchg edx, eax
add dword [ecx + 0x7524e53f], ebp
mov cl, 0xe2
ja 0x44ee77
adc ah, byte [eax + 0x6f]
mov dh, al
out 0xf0, al
and dl, byte [ecx - 0x7e]
mov ah, 0x66
ljmp 0xa344
bound edx, qword [edx + 0x55a07177]
invalid
rcl edx, 1
mov esp, 0xae0ce727
sbb esi, dword [eax - 0x2b]
jb 0x44eeb5
mov bl, 0x58
xchg ebx, eax
bound esi, qword [edx - 0x73d1c089]
adc ecx, edx
jne 0x44eef8
int1
cmp esi, dword fs:[edi]
cmp esi, dword [edi]
outsb dx, byte [esi]
xor dword [ecx - 0x761f882b], eax
mov bl, byte [ecx + 0x34]
sub al, 0xea
loopne 0x44ef37
jb 0x44ef27
inc esp
ljmp 0xf1f6
div cl
sub byte [edx - 0x652e2c73], 0x49
imul esp, dword [eax + 0x61e166b2], 0x7a20e8d3
test byte [eax], dh
jno 0x44ef43
stosb byte es:[edi], al
invalid
mov dl, 0x66
loope 0x44efcb
shr eax, cl
and byte [edx - 0x7c], bh
xor byte [ecx - 0x2f], dh
jge 0x44ef66
pop edx
cmp dword [ebp + ecx*4 + 0x71e26032], eax
push ds
imul ebp, dword [ebx + 0x72bf6cce], 0x7b4e908e
jae 0x44ef9c
imul ebp, dword [ecx + 0x41], 0x2aa24212
das
div dword [ecx]
test byte [eax - 0xb], dh
pop es
xchg edx, eax
xchg esp, eax
xor dword [eax + esi*2 - 0x6b6df80b], eax
mov byte [0x4ec11233], al
js 0x44ef5a
mov ch, 0x91
mov eax, 0x5472f5bf
xor edx, eax
mov cl, 0x21
pop ebp
adc ecx, eax
jl 0x44ef9d
test dword [eax], edi
les edx, [edi + 0x4ebfc511]
jb 0x44efc1
mov edi, 0x67fc724e
in al, 0xb5
in al, 0xb5
jne 0x44efad
jb 0x44ef5e
mov cl, 0xd7
xor eax, 0x1b62e1fd
xchg edx, eax
xor dl, byte [ecx - 0x1b0782d3]
clc
fcomp qword [ecx]
das
xor dword [esi + ecx], ebx
insd dword es:[edi], dx
cli
mov dword [0x97c6823f], eax
invalid
Function at 0x492ce5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
push esi
push edi
test ebx, ebx
jne 0x492d01
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0xc984], 0xffffffff
jle 0x492d16
mov eax, 0xfffffff6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
lea edi, [ebx + 0x11fb0]
mov eax, 0x4a2d20
mov ecx, 0x62
cmovne eax, edx
lea edx, [ebx + 0x12838]
mov esi, eax
mov dword [ebp - 0x2c], eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x12138]
mov edi, 0x40
lea esi, [ebx + 0x9a0]
nop dword [eax]
nop dword [eax + eax]

Function at 0x492dd6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea eax, [esi - 0x80]
mov dword [ecx - 0x11e14], esi
mov dword [ecx - 0x11e18], eax
lea ecx, [ecx + 0x18]
mov dword [ecx - 0x14], edx
lea eax, [edx - 0x100]
mov dword [ecx - 0x18], eax
lea eax, [esi + 0x80]
mov dword [ecx - 0x11e28], eax
lea eax, [edx + 0x100]
mov dword [ecx - 0x10], eax
lea eax, [esi + 0x100]
mov dword [ecx - 0x11e24], eax
lea eax, [edx + 0x200]
mov dword [ecx - 0xc], eax
lea eax, [esi + 0x180]
mov dword [ecx - 0x11e20], eax
lea eax, [edx + 0x300]
mov dword [ecx - 8], eax
lea eax, [esi + 0x200]
mov dword [ecx - 0x11e1c], eax
add esi, 0x300
lea eax, [edx + 0x400]
add edx, 0x600
mov dword [ecx - 4], eax
sub edi, 1
jne 0x492d55
Function at 0x493105
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
movups xmm0, xmmword [edx]
push esi
mov esi, ecx
movups xmmword [esp + 0x1c], xmm0
push edi
movups xmm0, xmmword [edx + 0x10]
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], 0x203
movups xmmword [esp + 0x30], xmm0
mov byte [esp + 0x22], 1
movups xmm0, xmmword [edx + 0x20]
movups xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [edx + 0x30]
movaps xmmword [esp + 0x50], xmm0
psrldq xmm0, 8
movd eax, xmm0
cmp eax, 0x3f
jle 0x49315d
mov dword [esp + 0x58], 0x3f
jmp 0x49316b
test eax, eax
mov ecx, 0x20
cmovs eax, ecx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x20]
xor ecx, ecx
test eax, eax
push 4
cmovs eax, ecx
mov ecx, esi
mov dword [esp + 0x58], eax
call fcn.00496785
add esp, 4
test eax, eax
js 0x4934f4
mov edi, dword [fcn.004995b8]
push 0x60
push dword [esi + 0xf8]
call edi
push 2
push dword [esi + 0xd8]
mov dword [esi + 0xc974], eax
call edi
mov dword [esi + 0xc978], eax
mov eax, dword [esi + 0xf8]
shl eax, 2
push eax
call dword [fcn.004995bc]
mov edi, dword [esi + 0x30]
add esp, 0x14
mov dword [esi + 0xc97c], eax
mov ecx, edi
mov edx, dword [esi + 0x7c]
mov eax, 1
shr ecx, 1
not edi
not ecx
and edi, 1
and ecx, 1
shl eax, cl
add ecx, edi
imul edx, eax
mov dword [esi + 0xca28], eax
mov eax, edx
shl edx, 4
shl eax, 5
shr eax, cl
add eax, edx
shl eax, 2
push eax
call dword [fcn.004995bc]
mov dword [esi + 0xca2c], eax
add esp, 4
lea eax, [esi + 0xca3c]
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], eax
lea eax, [esi + 0x78]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
nop
Function at 0x4aa3c5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
movups xmm0, xmmword [edx]
push esi
mov esi, ecx
movups xmmword [esp + 0x1c], xmm0
push edi
movups xmm0, xmmword [edx + 0x10]
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], 0x203
movups xmmword [esp + 0x30], xmm0
mov byte [esp + 0x22], 1
movups xmm0, xmmword [edx + 0x20]
movups xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [edx + 0x30]
movaps xmmword [esp + 0x50], xmm0
psrldq xmm0, 8
movd eax, xmm0
cmp eax, 0x3f
jle 0x4aa41d
mov dword [esp + 0x58], 0x3f
jmp 0x4aa42b
test eax, eax
mov ecx, 0x20
cmovs eax, ecx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x20]
xor ecx, ecx
test eax, eax
push 4
cmovs eax, ecx
mov ecx, esi
mov dword [esp + 0x58], eax
call fcn.004ada45
add esp, 4
test eax, eax
js 0x4aa7b4
mov edi, dword [fcn.004995b8]
push 0x60
push dword [esi + 0xf8]
call edi
push 2
push dword [esi + 0xd8]
mov dword [esi + 0xc974], eax
call edi
mov dword [esi + 0xc978], eax
mov eax, dword [esi + 0xf8]
shl eax, 2
push eax
call dword [fcn.004995bc]
mov edi, dword [esi + 0x30]
add esp, 0x14
mov dword [esi + 0xc97c], eax
mov ecx, edi
mov edx, dword [esi + 0x7c]
mov eax, 1
shr ecx, 1
not edi
not ecx
and edi, 1
and ecx, 1
shl eax, cl
add ecx, edi
imul edx, eax
mov dword [esi + 0xca28], eax
mov eax, edx
shl edx, 4
shl eax, 5
shr eax, cl
add eax, edx
shl eax, 2
push eax
call dword [fcn.004995bc]
mov dword [esi + 0xca2c], eax
add esp, 4
lea eax, [esi + 0xca3c]
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], eax
lea eax, [esi + 0x78]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
nop
mov edi, dword [eax]
shl edi, 2
lea eax, [edi + 4]
shl eax, 6
push eax
call dword [fcn.004995bc]
mov ecx, eax
add esp, 4
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4aa535
mov eax, ecx
mov edx, 0x40
add ecx, 0x100
nop dword [eax]
mov dword [eax], ecx
lea eax, [eax + 4]
add ecx, edi
sub edx, 1
jne 0x4aa525
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esi - 0xc], eax
mov edi, dword [edi]
shl edi, 2
lea eax, [edi + 4]
shl eax, 6
push eax
call dword [fcn.004995bc]
mov ecx, eax
add esp, 4
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4aa578
mov eax, ecx
mov edx, 0x40
add ecx, 0x100
mov dword [eax], ecx
lea eax, [eax + 4]
add ecx, edi
sub edx, 1
jne 0x4aa568
mov eax, dword [esp + 0x18]
mov dword [esi], eax
add esi, 4
mov eax, dword [esp + 0x10]
add eax, 0x20
sub dword [esp + 0x14], 1
mov dword [esp + 0x10], eax
jne 0x4aa4f5
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.004b47f5
mov ecx, dword [esi + 0x3c]
mov edx, 1
mov al, byte [esi + 0x38]
shl edx, cl
cmp dword [esi + 0x34], 0
mov dword [esi + 0xc988], edx
mov byte [esi + 0x31b], al
mov byte [esi + 0x31a], 1
mov dword [esi + 0x2ac08], 0
lodsb al, byte [esi]
add al, byte [eax]
add byte [eax], al
add byte [eax], al

Function at 0x4abad5
Capabilities:
Encode data using xor

Disassembly:
and ch, byte [eax]
aaa
and byte [ebx - 0x64], 0x67
jo 0x4abab4
aad 0x62
jge 0x4aba7c
pop ebp
cmp eax, 0x27c05b25
Function at 0x4bae36
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c13d0
cmp edx, dword [eax]
je 0x4bae58
add eax, 8
inc ecx
cmp eax, 0x4c1460
jl 0x4bae49
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c13d0]
jne 0x4baf86
mov eax, dword [0x4c5a60]
cmp eax, 1
je 0x4baf60
test eax, eax
jne 0x4bae89
cmp dword [0x4c1310], 1
je 0x4baf60
cmp edx, 0xfc
je 0x4baf86
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baec0
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb550
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb780
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4baf03
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb780
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be7e8
push edi
call fcn.004bcf50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb550
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb560
lea eax, [ebp - 0xa0]
push 0x4be7c8
push eax
call fcn.004bb560
push dword [esi + 0x4c13d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb560
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcec4
add esp, 0x2c
pop edi
jmp 0x4baf86
lea eax, [ebp + 8]
lea esi, [esi + 0x4c13d4]
push 0
push eax
push dword [esi]
call fcn.004bb780
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40c7f4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546d6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov dword [ebp - 0x5c], ecx
call dword [sym.imp.DataMgr.dll_class_CDataMgr____cdecl_gf_GetDataMgr_void_]
mov dword [ebp - 0x10], eax
call dword [sym.imp.DataMgr.dll_class_CFrameWnd____cdecl_gf_GetMainFrame_void_]
mov ecx, eax
call fcn.0040ea30
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40c990
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40c98a
push 0x19000
lea ecx, [ebp - 0x44]
call sub.MFC42u.DLL_CMemFile::CMemFile
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.DataMgr.dll_public:_int___thiscall_CDataMgr::GetPickCount_void_const]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
jmp 0x40c88f
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jge 0x40c8af
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.DataMgr.dll_public:_class_CEntity____thiscall_CDataMgr::GetPickEntity_int_const]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
jmp 0x40c886
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.DataMgr.dll_int___cdecl_ExportEzdFile_class_CFile___class_CEntity____int_]
add esp, 0xc
test eax, eax
jne 0x40c969
lea ecx, [ebp - 0x44]
call sub.MFC42u.DLL_CFile::GetLength
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jbe 0x40c969
mov edx, dword [ebp - 0x48]
add edx, 1
push edx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x40c952
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x40c937
push 0
push 0
lea ecx, [ebp - 0x44]
call sub.MFC42u.DLL_CMemFile::Seek
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x50]
push edx
lea ecx, [ebp - 0x44]
call fcn.0040ead0
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x40c952
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x4c], 0
cmp dword [ebp - 0x4c], 0
je 0x40c969
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.DataMgr.dll_unsigned_int___cdecl_gf_GetClipboardFormat_void_]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
push edx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.005414d0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46890e
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54adf5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.00468340
mov ecx, dword [ebp - 0x40]
cmp dword [ecx], 0
je 0x468965
push 0x14
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x10
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040f830
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::Draw3dRect
jmp 0x468991
mov edx, dword [ebp - 0x40]
cmp dword [edx + 4], 0
je 0x468991
push 0x10
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040f830
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::Draw3dRect
mov ecx, dword [ebp + 8]
call fcn.00468bc0
mov dword [ebp - 0x34], eax
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x38]
push 1
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::SetBkMode
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.0044faa0
mov dword [ebp - 4], 0
push 0x58
mov ecx, dword [ebp + 8]
call fcn.00468290
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0x60
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x24], eax
push 0
push str.Marlett
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x30]
call sub.MFC42u.DLL_CFont::CreatePointFont
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
mov dword [ebp - 0x38], eax
push 0x599b30
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString_2
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 0xc]
add eax, 2
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + 8]
add edx, 2
push edx
mov ecx, dword [ebp + 8]
call fcn.00468be0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::SetBkMode
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax + 0x38]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0044faf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4