joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5645f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 8]
mov byte [eax], 0
mov byte [esi], 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, eax
lea eax, [ebx - 2]
cmp eax, 4
ja case.default.0x56461b
jmp dword [eax*4 + 0x5646f4]
push 0x5ae4e8
jmp 0x56465e
push str.CD_DVD_Drive
jmp 0x56465e
push str.RAM_Disk
jmp 0x56465e
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x41
je 0x56464b
cmp al, 0x42
je 0x56464b
push str.Removable_Disk
jmp 0x56465e
push 0x5ae510
jmp 0x56465e
push str.Network_Drive
jmp 0x56465e
push str.Unknown
push 0x100
push esi
call fcn.0054cc60
mov esi, dword [ebp + 8]
add esp, 0xc
cmp ebx, 4
je 0x564699
push 0x100
push dword [ebp + 0x14]
push 0
push 0
push 0
push 0x100
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x564699
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5646a0
sub ecx, edx
cmp ecx, 1
jae 0x5646e8
cmp ebx, 5
jne 0x5646ba
push str.BD_ROM_Drive
jmp 0x5646da
cmp ebx, 2
jne 0x5646d0
mov al, byte [esi]
cmp al, 0x41
je 0x5646c9
cmp al, 0x42
jne 0x5646e8
push str.Floppy_Disk_Drive
jmp 0x5646da
cmp ebx, 3
jne 0x5646e8
push str.Local_Disk
push 0x100
push edi
call fcn.0054cc60
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10

Function at 0x564710
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push str.IsWow64Process
push str.kernel32.dll
mov esi, 0xf003f
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dfa40], eax
mov dword [ebp - 8], 0
test eax, eax
je 0x564760
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5dfa40]
cmp dword [ebp - 8], 0
mov eax, 0xf013f
cmovne esi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0
push 0x5a7053
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
test eax, eax
je 0x564795
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
push str.NoDrives
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x5647be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x5647e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x20019
push str.IsWow64Process
push str.kernel32.dll
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dfa40], eax
mov dword [ebp + 0xc], 0
test eax, eax
je 0x56483a
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5dfa40]
cmp dword [ebp + 0xc], 0
mov eax, 0x20119
cmovne esi, eax
lea eax, [ebp - 4]
push eax
push esi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x56485d
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x5ae0e8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x5648a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push str.IsWow64Process
push str.kernel32.dll
mov esi, 0xf003f
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dfa40], eax
mov dword [ebp - 0xc], 0
test eax, eax
je 0x5648f7
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5dfa40]
cmp dword [ebp - 0xc], 0
mov eax, 0xf013f
cmovne esi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0
push 0x5a7052
push 0
push 0x5add34
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x56492c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x564980
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x5adde8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x564968
call esi
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x56496b
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], 0
je 0x564976
or dword [ebp + 0xc], ecx
jmp 0x564980
mov eax, dword [ebp + 0xc]
not eax
and eax, ecx
mov dword [ebp + 0xc], eax
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push 0x5adf48
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x5649b0
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5662c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576048
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5d4e64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 2
push 0
push 0
mov dword [ebp - 4], 0
push dword [ebp + 8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push dword [edi + 0x20]
mov esi, eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00405bca
cmp esi, 0x20
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
setae bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x566365
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x566363
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CWin32Heap.0
jne 0x566361
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x566365
mov ecx, eax
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x413a0c
push 0x14
push 0x4516c8
call fcn.00413a30
push 1
call fcn.004135f7
pop ecx
test al, al
jne 0x4138c3
push 7
call fcn.00413d0e
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004135c2
mov byte [ebp - 0x24], al
mov eax, dword [0x458abc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4138bc
test eax, eax
jne 0x41392d
mov dword [0x458abc], ecx
push 0x447384
push 0x44736c
call fcn.00418511
pop ecx
pop ecx
test eax, eax
je 0x413910
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x413a06
push 0x447368
push 0x447314
call fcn.004184b5
pop ecx
pop ecx
mov dword [0x458abc], 2
jmp 0x413932
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00413751
pop ecx
call fcn.00413fb8
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x413962
push esi
call fcn.004136c7
pop ecx
test al, al
je 0x413962
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00413a1b
call esi
call fcn.00413fbe
mov esi, eax
cmp dword [esi], edi
je 0x413980
push esi
call fcn.004136c7
pop ecx
test al, al
je 0x413980
push dword [esi]
call fcn.00417974
pop ecx
call fcn.00413e29
movzx eax, ax
push eax
call fcn.00418462
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00417883
test al, al
jne 0x4139ab
push esi
call fcn.004179ac
test bl, bl
jne 0x4139b4
call fcn.0041794f
push edi
push 1
call fcn.0041376e
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x413a06
call fcn.00413a76
ret
call fcn.00413eb4
jmp 0x4138a4

Function at 0x40540d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443cf3
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x457008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0xcc]
call fcn.004131af
push dword [esi + 0xc0]
call fcn.004131af
push dword [esi + 0x9c]
call fcn.004131af
push dword [esi + 0x90]
call fcn.004131af
push dword [esi + 0x30]
call fcn.004131af
push dword [esi + 0x24]
call fcn.004131af
push dword [esi + 0x18]
call fcn.004131af
add esp, 0x1c
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40548a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40549e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4054b2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi]
test ecx, ecx
je 0x4054c5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405c98
Capabilities:
Hide graphical window

Disassembly:
push dword [esp + 4]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
neg eax
sbb eax, eax
neg eax
ret 4
Function at 0x406933
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x457008]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
push 0x208
xor ebp, ebp
lea eax, [esp + 0x18]
push ebp
push eax
mov edi, edx
mov ebx, ecx
call fcn.00415bf0
add esp, 0xc
lea eax, [esp + 0x14]
push 0x104
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocStringLen
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4069c5
mov edx, edi
mov ecx, esi
call fcn.00442d26
push dword [edi]
mov dword [esp + 0x14], ebp
call fcn.004132b7
pop ecx
push ebp
lea ecx, [esp + 0x14]
mov dword [ebx], eax
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041319e
add esp, 0x210
ret
Function at 0x4223c1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
shr edi, 2
xor ebp, ebp
mov eax, edi
xor ebx, ebx
shr eax, 1
inc ebp
add eax, 3
mov ecx, ebx
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x4223f2
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x4223e5
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [esp + 0x14], eax
test ebx, ebx
jne 0x42245b
movzx eax, dl
mov ebx, edi
push 0x1b
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + str.cw]
xor edx, ebp
add ebp, ebp
or edx, ecx
test ebp, 0x100
pop eax
cmovne ebp, eax
jmp 0x4224a8
cmp ebx, 4
jne 0x4224ac
cmp edi, 6
jbe 0x4224ac
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + str.cw]
or edx, ecx
mov eax, dword [esp + 0x14]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x422402
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4232b8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x4232cc
xor eax, eax
jmp 0x4232e9
call fcn.00423361
push 7
pop edx
cmp eax, edx
jb 0x4232c8
lea ecx, [ebp - 0x10]
call fcn.00423349
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4232f9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x42330d
xor eax, eax
jmp 0x42331c
lea ecx, [ebp - 0x10]
call fcn.0042332c
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4233f7
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x457008]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x423440
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x423440
push 0xc00
call eax
test eax, eax
jne 0x4234db
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4234db
cmp eax, 0x104
ja 0x4234db
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x423477
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x4234da
push ebx
push edi
lea edi, [ebp - 0x2d4]
push 0x6c
lea edi, [edi + eax*2]
pop ebx
mov ecx, edi
jmp 0x4234a1
movzx eax, al
mov word [ecx], ax
add ecx, 2
mov al, byte [esi]
inc esi
test al, al
jne 0x423498
push 0x2e
pop eax
push 0x64
mov word [ecx], ax
pop eax
mov word [ecx + 2], ax
xor eax, eax
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov word [ecx + 4], bx
mov word [ecx + 6], bx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x423494
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041319e
mov esp, ebp
pop ebp
ret
Function at 0x4274c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
xor ebp, ebp
xor eax, eax
push esi
mov esi, ecx
inc eax
push edi
push 0x20
pop ebx
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esi + 0x78], ebp
cmova eax, ebx
mov dword [esi + 0x7c], ebp
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x70], ebp
mov dword [esi + 0x88], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x60], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x80], ebp
mov dword [esi + 0x84], ebp
mov dword [esi + 0x58], ebp
cmp eax, dword [esi + 0x20]
je 0x427567
lea edi, [esi + 0xc8]
cmp dword [edi + 8], ebp
je 0x427548
mov ecx, edi
call fcn.0042729c
add edi, 0x28
sub ebx, 1
jne 0x42753c
cmp dword [esi + 0x5c], ebp
je 0x427562
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
mov dword [esi + 0x5c], ebp
mov eax, dword [esi]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], ebp
mov dword [esi + 0xa0], ebp
mov dword [esi + 0xa4], ebp
mov dword [esi + 0xa8], ebp
mov dword [esi + 0xac], ebp
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
mov ecx, ebx
call fcn.004272f9
mov edi, eax
test edi, edi
jne 0x4275e4
lea ecx, [ebx + 0x20]
call fcn.0042929b
mov edi, eax
test edi, edi
jne 0x4275e4
lea ecx, [ebx + 0x1c]
call fcn.0042929b
mov edi, eax
test edi, edi
jne 0x4275e4
push ebx
call fcn.00426626
mov edi, eax
test edi, edi
je 0x4275e4
mov ecx, esi
mov dword [esi + 0x44], ebp
call fcn.0042724b
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x4275f8
mov dword [esi + 0x40], eax
cmp dword [esi + 0x38], ebp
jne 0x42760a
cmp dword [esi + 0x40], ebp
jne 0x42760a
cmp dword [esi + 0x3c], ebp
jne 0x42760a
mov dword [esi + 0x44], ebp
pop edi
xor ecx, ecx
cmp dword [esi + 0x44], ebp
pop esi
pop ebp
cmovne eax, ecx
pop ebx
ret

Function at 0x4276d3
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov edi, ecx
push 4
pop ecx
mov esi, dword [edi + 8]
mov eax, dword [edi + 0x24]
movzx edx, byte [esi + 1]
mov dword [edi + 0x20], eax
add edx, ecx
mov eax, dword [edi]
add word [eax + 2], cx
mov byte [esi + 1], dl
cmp edx, 0x7c
jbe 0x4276fe
mov ecx, edi
call fcn.00427865
mov ecx, edi
pop edi
pop esi
jmp fcn.00427a83
Function at 0x427707
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, dword [ebx]
movzx ecx, byte [edi + 1]
movzx edx, word [esi + 2]
lea eax, [ecx + ecx]
cmp edx, eax
sbb eax, eax
add ecx, 4
neg eax
add dword [ebx + 0x20], eax
mov dword [ebx + 0x14], eax
lea eax, [edx + 4]
mov word [esi + 2], ax
mov byte [edi + 1], cl
cmp ecx, 0x7c
jbe 0x427741
mov ecx, ebx
call fcn.00427865
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.004277ad

Function at 0x4277ad
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 8]
movzx edx, word [eax + 4]
movzx eax, word [eax + 2]
shl edx, 0x10
or edx, eax
cmp dword [ecx + 0xc], 0
jne 0x4277ce
cmp edx, dword [ecx + 0x40]
jbe 0x4277ce
mov dword [ecx], edx
mov dword [ecx + 4], edx
ret
jmp fcn.00427a83
Function at 0x4289f2
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
push 0x38
pop ebp
mov esi, dword [edi + 8]
and esi, 0x3f
mov byte [esi + edi + 0x40], 0x80
inc esi
cmp esi, ebp
jbe 0x428a33
push 0x40
pop ecx
cmp esi, ecx
je 0x428a27
sub ecx, esi
lea eax, [edi + 0x40]
push ecx
add eax, esi
push 0
push eax
call fcn.00415bf0
add esp, 0xc
push 1
lea edx, [edi + 0x40]
lea ecx, [edi + 0x20]
call dword [edi]
xor esi, esi
sub ebp, esi
lea eax, [edi + 0x40]
push ebp
add eax, esi
push 0
push eax
call fcn.00415bf0
mov ecx, dword [edi + 8]
lea esi, [edi + 0x20]
mov eax, dword [edi + 0xc]
lea edx, [edi + 0x40]
shld eax, ecx, 3
add esp, 0xc
shl ecx, 3
bswap ecx
bswap eax
mov dword [edi + 0x7c], ecx
mov ecx, esi
push 1
mov dword [edi + 0x78], eax
call dword [edi]
push 4
pop edx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea esi, [esi + 8]
bswap eax
mov dword [ebx], eax
lea ebx, [ebx + 8]
bswap ecx
mov dword [ebx - 4], ecx
sub edx, 1
jne 0x428a6c
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
jmp 0x428e20

Function at 0x428e14
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x457780]
mov dword [ecx], eax
jmp 0x428e20
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x4292e7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push edi
push edi
call fcn.00417164
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x429311
call fcn.0042928a
mov edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ae19
Capabilities:
Open clipboard

Disassembly:
push 0x1c
mov eax, 0x444292
call fcn.0041eaf8
mov esi, edx
and dword [ebp - 4], 0
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp - 0xd], al
test al, al
je 0x42aed7
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x42aed7
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea eax, [eax*2 + 2]
push eax
push 0xd
pop ecx
call fcn.0042aee9
push 0
mov edx, esi
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.0042a809
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc ecx
push ecx
mov ecx, eax
call fcn.0042aee9
push 1
pop edi
test al, al
movzx ebx, bl
push edi
mov edx, esi
lea ecx, [ebp - 0x28]
cmovne ebx, edi
call fcn.0042a809
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00429fc1
push dword [ebp - 0x28]
call fcn.004131af
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc eax
pop ecx
push eax
push 7
pop ecx
call fcn.0042aee9
push dword [ebp - 0x1c]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.004131af
pop ecx
jmp 0x42aed9
xor bl, bl
lea ecx, [ebp - 0xd]
call fcn.0042af52
mov al, bl
call fcn.0041ead2
ret
Function at 0x42aee9
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
mov esi, edx
call fcn.0042d7b7
test al, al
je 0x42af3f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x42af3f
push dword [ebp + 8]
push esi
push eax
call fcn.004207f0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x42af3f
mov dword [ebp - 4], ebx
mov bl, 1
lea ecx, [ebp - 4]
call fcn.0042d79a
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42ba58
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x344
lea ebp, [esp - 4]
mov eax, dword [0x457008]
xor eax, ebp
mov dword [ebp + 0x344], eax
push 0x10
mov eax, 0x4443ba
call fcn.0041eaf8
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 4], ebx
mov edi, 0x114
mov word [eax], cx
cmp byte [0x4591b1], cl
jne 0x42baeb
lea eax, [ebp + 0x22c]
mov byte [ebp + 0x22c], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x42bae4
cmp eax, edi
jae 0x42bae4
lea edx, [ebp + 0x22c]
mov byte [ebp + 0x340], bl
lea ecx, [ebp - 0x1c]
call fcn.0042978b
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0042a508
push dword [ebp - 0x1c]
call fcn.004131af
mov al, 1
jmp 0x42bb85
xor al, al
jmp 0x42bb86
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
je 0x42bae4
cmp esi, edi
jae 0x42bb1f
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebp + 0x228], ax
lea eax, [ebp]
push eax
call fcn.0042a473
mov al, 1
jmp 0x42bb86
lea ecx, [ebp - 0x1c]
call fcn.0042a44f
mov dword [ebp - 4], 1
cmp esi, dword [ebp - 0x14]
jbe 0x42bb3c
push esi
lea ecx, [ebp - 0x1c]
call fcn.00429ef5
mov edi, dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x42bb7d
xor eax, eax
mov word [edi + esi*2], ax
mov eax, ebx
cmp word [edi], bx
je 0x42bb61
inc eax
cmp word [edi + eax*2], bx
jne 0x42bb5a
mov dword [ebp - 0x18], eax
cmp eax, ecx
jne 0x42bb7d
lea eax, [esi - 1]
cmp eax, ecx
jne 0x42bb7d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.0042a508
mov bl, 1
push edi
call fcn.004131af
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.0041319e
lea esp, [ebp + 0x348]
pop ebp
ret