joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9536a6
Capabilities:
Encode data using xor

Disassembly:
push ecx
inc edx
sub byte [ebp + 0x64], cl
fnstsw word [esi - 0x4725fd3f]
push ss
push eax
sbb edi, esp
mov al, 0x2c
in al, dx
add ebx, dword [eax]
lock sub esi, dword ss:[ebp + 0xc]
aad 0xc5
xchg byte [esi], bh
xor edi, dword [esi - 0x5c43440f]
das
invalid
Function at 0x10016e2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
push edi
push 0
push esi
dec eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [ebp + 0x14], eax
je 0x1001741
cmp dword [esi], 0
jbe 0x1001741
push 0x10011b4
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_strstr]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1001741
sub eax, dword [esi]
push 1
sub eax, dword [ebp + 0xc]
push 0
inc eax
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100173e
xor eax, eax
jmp 0x1001744
and byte [edi], 0
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1001e20
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10011c0
call fcn.01001fbc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1001e5b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001e5b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1001e73
cmp eax, 0x20b
je 0x1001e60
mov dword [ebp - 0x1c], edi
jmp 0x1001e87
cmp dword [ecx + 0x84], 0xe
jbe 0x1001e5b
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1001e81
cmp dword [ecx + 0x74], 0xe
jbe 0x1001e5b
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10059c4], 0xffffffff
or dword [0x10059c8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10052bc]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10052b8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10059cc], eax
call fcn.01001fb8
cmp dword [0x1005098], edi
jne 0x1001ee2
push fcn.01001fb8
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001fa6
push 0x100114c
push 0x1001148
call sub.msvcrt.dll__initterm
mov eax, dword [0x10052b4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x10052b0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001144
push 0x1001140
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001a3e
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1001f59
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1001f8e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001ff5
ret
Function at 0x1003458
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0xc
lea eax, [ebp + eax*2 - 0x100]
dec eax
dec eax
mov cx, word [eax]
cmp cx, 0x5c
je 0x1003499
cmp cx, 0x2f
jne 0x100349f
and word [eax], 0
jmp 0x1003488
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
leave
ret 4

Function at 0x10034ba
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
push esi
push dword [edi + 4]
mov esi, dword [sym.imp.ntdll.dll_wcscpy]
lea eax, [ebp - 0x108]
push eax
call esi
push dword [edi + 4]
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp + eax*2 - 0x108]
push 0x1001450
push eax
mov dword [ebp - 8], eax
call esi
add esp, 0x14
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1003522
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x100364c
push ebx
mov ebx, dword [sym.imp.ntdll.dll_wcscmp]
lea eax, [ebp - 0x32c]
push 0x100144c
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1003624
lea eax, [ebp - 0x32c]
push 0x1001444
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1003624
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push dword [ebp - 8]
call esi
mov eax, dword [edi + 0xc]
add esp, 0xc
test eax, eax
je 0x1003586
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x32c]
push eax
push dword [edi + 8]
call fcn.01003821
test eax, eax
je 0x1003624
cmp dword [edi + 0xc], 0
je 0x10035ff
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x458]
push eax
lea edx, [ebp - 0x108]
call fcn.01003393
test eax, eax
je 0x10035ff
test byte [ebp - 0x358], 0x10
je 0x1003624
lea eax, [ebp - 0x458]
push eax
call fcn.01003458
test eax, eax
je 0x1003624
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x458]
push eax
mov eax, dword [ebp + 8]
call fcn.010031fc
jmp 0x1003624
lea eax, [ebp - 0x108]
push eax
call fcn.01003458
test eax, eax
je 0x1003624
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 0xc]
call fcn.010032cc
mov ebx, eax
test ebx, ebx
jne 0x1003649
lea eax, [ebp - 0x358]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
test ebx, ebx
jne 0x1003523
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1003649
mov eax, ebx
pop ebx
pop esi
leave
ret 8
Function at 0x1006ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030f8
push 0x1007170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x100933c], 0xffffffff
mov dword [0x1009340], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x1009330]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x100932c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x1009338], ecx
call fcn.01007160
mov eax, dword [0x1009220]
test eax, eax
jne 0x1006f71
push 0x1007150
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.01007130
push 0x100901c
push 0x1009018
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x1009328]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x1009324]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x1009014
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x100707f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x1006fe5
cmp al, 0x22
jne 0x1006fd7
cmp byte [esi], 0x22
jne 0x1006fee
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x1006ffe
cmp al, 0x20
ja 0x1006ffe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x1006fee
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x100701f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x1007024
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x1007064
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x1006fee
inc esi
mov dword [ebp - 0x74], esi
jmp 0x100707f
Function at 0x1003b014
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1003b023
pop dword [ebp - 8]
mov eax, 0x1003b023
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x1a0fbad
add dword [ebp - 0x18], 0x4cb1499e
mov dword [ebp - 0x14], 0xaba41b33
add dword [ebp - 0x14], 0x868f3112
mov dword [ebp - 0x10], 0x36aaca2c
add dword [ebp - 0x10], 0x15a17a02
mov dword [ebp - 0xc], 0x933671bc
sub dword [ebp - 0xc], 0x933671bc
lea eax, [ebp - 0x18]
push eax
mov eax, 0x2e754a7
add eax, 0xd1c8bd5
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc28486c8
sub dword [ebp - 0x18], 0x4e121d72
mov dword [ebp - 0x14], 0xebcca86b
sub dword [ebp - 0x14], 0xaa6046f6
mov dword [ebp - 0x10], 0x1c904c79
sub dword [ebp - 0x10], 0xb920e00d
mov dword [ebp - 0xc], 0xd1b1c462
add dword [ebp - 0xc], 0x2e4e3b9e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe8565722
add eax, 0x27ad8962
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3b930
push 0
call eax
mov ecx, 0x6202e1b6
sub ecx, 0x6202a219
xor edx, edx
add edx, eax
mov edi, 0x10071200
add edi, dword [ebp - 8]
mov esi, 0x588f1665
sub esi, 0xd71696d4
xor dword [ebp - 4], edx
mov ebx, dword [edi]
sub ebx, esi
sub dword [ebp - 4], 0x84c48965
mov dword [edx], ebx
add edx, 0x81407f6a
add edx, 0x7ebf809a
add edi, 0x5336559
sub edi, 0x5336555
loop 0x1003b13c
add eax, 0x77a98d54
sub eax, 0x77a89c0d
mov ebx, eax
add eax, 0xbac34d7f
sub eax, 0xbac34d7a
mov ecx, 0xa02a9be8
add ecx, 0x6fd56418
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100058be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100058cd
pop dword [ebp - 0x48]
mov eax, 0x100058cd
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc640a284
add dword [ebp - 0x58], 0x8811a2c7
mov dword [ebp - 0x54], 0xc94e4e1e
add dword [ebp - 0x54], 0x68e4fe27
mov dword [ebp - 0x50], 0x96cf7a25
add dword [ebp - 0x50], 0xb57cca09
mov dword [ebp - 0x4c], 0xc5035992
sub dword [ebp - 0x4c], 0xc5035992
lea eax, [ebp - 0x58]
push eax
mov eax, 0x55776062
add eax, 0xba8a3fa6
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x53f3e546
add dword [ebp - 0x58], 0x207e8410
mov dword [ebp - 0x54], 0xce883ded
add dword [ebp - 0x54], 0x72e42388
mov dword [ebp - 0x50], 0x2115e079
sub dword [ebp - 0x50], 0xbda6740d
mov dword [ebp - 0x4c], 0xf7f5aa43
add dword [ebp - 0x4c], 0x80a55bd
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x44ebe4b4
add eax, 0xcb15bb58
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4203d
push 0
call eax
mov ecx, 0x1b4a1f76
add ecx, 0xe4b64791
xor ebx, ebx
add ebx, eax
mov edx, 0x78cc093f
sub edx, 0x68c9bf3f
add edx, dword [ebp - 0x48]
mov edi, 0x740e2720
sub dword [ebp - 0x1c], edi
mov esi, dword [edx]
xor dword [ebp - 0x40], edx
sub esi, edi
sub dword [ebp - 8], 0xe75369f1
mov dword [ebx], esi
mov dword [ebp - 0x3c], 0x4fb9559c
add ebx, 0x26f41822
sub ebx, 0x26f4181e
add edx, 4
loop 0x100059e6
add eax, 0x18eef
mov ebx, eax
add eax, 0x127da8ec
sub eax, 0x127da8e7
mov ecx, 0xe05caf93
add ecx, 0x2fa3506d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0xa12dc0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0xa12dfd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0xa12e1d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00a15030
add esp, 0x210
pop esi
pop ebx
ret

Function at 0xa13098
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xa130f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00a12f34
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00a12f34
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0xa130db
inc ebx
jmp 0xa130c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa130f8
lea eax, [ebp - 8]
call fcn.00a14db0
ret

Function at 0xa13100
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00a14db0
test esi, esi
jne 0xa13137
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00a14ea0
jmp 0xa13158
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00a12f34
mov dword [esp], eax
test esi, esi
je 0xa13158
cmp dword [ebx], 0
je 0xa13158
dec esi
jmp 0xa1313f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0xa13784
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xb5f008], 0x8088405
inc edx
mov dword [ebx + 0xb5f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xa13db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0xb5f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0xa13e48
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0xa13e28
xor eax, eax
push ebp
push 0xa13e21
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0xa13e64
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa13e28
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0xb5f024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0xb5f024], ax
mov esp, ebp
pop ebp
ret
Function at 0xa14ba8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0xb7504c], 0
je 0xa14c09
cmp word [0xb75220], 0xd7b2
jne 0xa14bd1
cmp dword [0xb75228], 0
jbe 0xa14bd1
mov eax, 0xb7521c
call dword [0xb75238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0xb5f074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0xa14c30
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0xb5f034], 0
jne 0xa14c25
push 0
push 0xb5f06c
push 0xb5f074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0xa14d64
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00a12b88
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0xb7504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0xa14d2c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0xa361c8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
lea ebx, [ebp - 0xc]
mov esi, 0xb7588c
cmp dword [esi], 0
jne 0xa3626e
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [0xb75888]
mov dword [eax], edx
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0xb5f530
mov ecx, 2
call fcn.00a12ef4
mov edx, 0xa361a0
mov eax, dword [ebp - 8]
add eax, 5
call fcn.00a361c0
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebx], eax
mov eax, dword [ebx]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebx]
call fcn.00a361c0
mov edx, dword [ebx]
mov dword [edx + 1], eax
mov eax, dword [ebx]
mov edx, dword [esi]
mov dword [eax + 5], edx
mov eax, dword [ebx]
mov dword [esi], eax
add dword [ebx], 0xd
mov eax, dword [ebx]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0xa36235
mov eax, dword [ebp - 8]
mov dword [0xb75888], eax
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 5]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xa3791c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0xa37922
ret

Function at 0xa3a344
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0xa3a395
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0xa3a37c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0xa3a36c
jmp 0xa3a395
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0xa3a37d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa4c360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 4]
xor eax, eax
push ebp
push 0xa4c520
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
call fcn.00a5d2e0
mov eax, dword [ebx]
cmp byte [eax + 0x210], 0
je 0xa4c505
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
sub eax, dword [edx + 0x220]
cmp eax, 0x1f4
jb 0xa4c3c3
mov eax, dword [ebx]
add eax, 0x21c
call fcn.00a14db0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 8
je 0xa4c494
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [0xb744bc]
and eax, 0xff
bt dword [edx], eax
jae 0xa4c456
push 1
push 0x102
push 0x102
mov eax, dword [ebx]
call fcn.00a5e3dc
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0xa4c4d4
mov eax, dword [ebx]
push dword [eax + 0x21c]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00a14f98
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.00a14f98
push dword [ebp - 0x2c]
mov eax, dword [ebx]
add eax, 0x21c
mov edx, 3
call fcn.00a15140
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0xa4c4d4
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00a14f98
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx]
add eax, 0x21c
call fcn.00a15088
jmp 0xa4c4d4
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00a15080
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.00a15320
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00a15080
mov edx, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00a1e6cc
cmp al, 2
je 0xa4c474
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00a15080
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.00a15320
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00a15080
test eax, eax
jle 0xa4c4ee
push ebp
call fcn.00a4c27c
pop ecx
jmp 0xa4c505
xor edx, edx
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov eax, dword [ebx]
mov si, 0xffeb
call fcn.00a1414c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa4c527
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00a14dd4
ret
Function at 0xa50408
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00a15270
xor eax, eax
push ebp
push 0xa50538
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0xa5050b
xor eax, eax
push ebp
push 0xa50504
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00a15080
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xa504d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xa504c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00a15080
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00a15280
mov edx, dword [ebp - 0xc]
pop ecx
call fcn.00a12ef4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa504cf
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0xb73de8]
mov dl, 1
mov eax, dword [0xa18a28]
call fcn.00a1dd7c
call fcn.00a14724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa5053f
lea eax, [ebp - 4]
call fcn.00a14db0
ret