joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ba90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100555c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1007d930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.10053ef4
mov dword [esp + 0x28], 0
mov edi, dword [0x1007f104]
mov ecx, 0x1007f108
mov dword [esp + 0xc], edi
call fcn.100070f0
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1000bb0b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1000bb0f
cmp byte [eax + 0x14], 0
je 0x1000bb0f
call fcn.10053f82
cmp esi, dword [eax + 0xc]
jae 0x1000bb15
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x1000bb11
xor ecx, ecx
jmp 0x1000baf3
mov esi, ecx
test esi, esi
jne 0x1000bb66
test edi, edi
je 0x1000bb1d
mov esi, edi
jmp 0x1000bb66
lea eax, [esp + 0xc]
push eax
call fcn.1000b7b0
add esp, 4
cmp eax, 0xffffffff
jne 0x1000bb4c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.1003fc46
push 0x10075a98
lea ecx, [esp + 0x18]
push ecx
call fcn.1003fd96
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1007f104], esi
call fcn.10007170
push esi
call fcn.10054050
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10053f15
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x1003d5a0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2038
call fcn.1003f030
mov eax, dword [0x1007d930]
xor eax, esp
mov dword [esp + 0x2034], eax
push esi
mov esi, dword [esp + 0x2040]
cmp dword [esi + 0x1c], 0xffffffff
je 0x1003d697
push edi
push 0x1002
lea eax, [esp + 0x103c]
push 0
push eax
call fcn.1003f3d0
lea ecx, [esp + 0x18]
push ecx
call fcn.10040462
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.100406e1
mov ecx, dword [esp + 0x2060]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x50]
push edx
add eax, 1
push eax
add ecx, 0x76c
push ecx
push str.__0.4d__0.2d__0.2d__0.2d:_0.2d:_0.2d___s_r_n
lea edx, [esp + 0x70]
push 0x800
push edx
call fcn.10040c49
add esp, 0x40
lea eax, [esp + 0x204c]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1040]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
push esi
mov edi, eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi + 0x18], 1
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x1c]
lea ecx, [edi + edi]
push ecx
lea edx, [esp + 0x1044]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [esi + 0x18], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [esp + 0x2038]
pop esi
xor ecx, esp
call fcn.1003f012
add esp, 0x2038
ret
Function at 0x1003d6c0
Capabilities:
Create directory
Get file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1005addb
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1007d930]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007d930]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebp, ebp
cmp eax, 0x10
je 0x1003d712
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi + 0x18], 1
push ebp
push 0x80
push 2
push ebp
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
or ebx, 0xffffffff
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x1003d7bc
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
mov dword [esp + 0x40], ebp
push 0xfeff
push 1
push ebp
lea ecx, [esp + 0x24]
call fcn.1003d920
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
mov dword [esp + 0x14], ebp
jae 0x1003d77b
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push ebp
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edx + edx]
mov edx, dword [esi + 0x1c]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x30], edi
jb 0x1003d7ab
mov eax, dword [esp + 0x1c]
push eax
call fcn.1003fa16
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
add dword [esi + 0x18], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1003f012
add esp, 0x30
ret 8
Function at 0x1003f012
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007d930]
jne 0x1003f01c
repz ret
jmp fcn.1004115e

Function at 0x1004fe8f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100421c6
xor ebx, ebx
cmp dword [0x1008008c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1004ff64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1004fecf
xor eax, eax
jmp 0x10050028
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1004fec8
push eax
call fcn.10042163
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1008008c], eax
call esi
push eax
call fcn.10042163
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10080090], eax
call esi
push eax
call fcn.10042163
mov dword [0x10080094], eax
lea eax, [ebp - 8]
push eax
call fcn.10047e54
test eax, eax
pop ecx
pop ecx
je 0x1004ff32
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1003fdea
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1004ff64
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10042163
cmp eax, ebx
pop ecx
mov dword [0x1008009c], eax
je 0x1004ff64
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10042163
pop ecx
mov dword [0x10080098], eax
mov eax, dword [0x10080098]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1004ffdd
cmp dword [0x1008009c], esi
je 0x1004ffdd
push eax
call fcn.100421cf
pop ecx
call eax
cmp eax, ebx
je 0x1004ffaa
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1008009c]
call fcn.100421cf
pop ecx
call eax
test eax, eax
je 0x1004ffaa
test byte [ebp - 0x18], 1
jne 0x1004ffdd
lea eax, [ebp - 0xc]
push eax
call fcn.10047e8b
test eax, eax
pop ecx
je 0x1004ffc5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1003fdea
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1004ffd4
or dword [ebp + 0x10], 0x200000
jmp 0x1005000e
or dword [ebp + 0x10], 0x40000
jmp 0x1005000e
mov eax, dword [0x10080090]
cmp eax, esi
je 0x1005000e
push eax
call fcn.100421cf
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1005000e
mov eax, dword [0x10080094]
cmp eax, esi
je 0x1005000e
push dword [ebp - 4]
push eax
call fcn.100421cf
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1008008c]
call fcn.100421cf
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100014e5
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10001516
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x10b
mov dword [ebp - 0x10], eax
je 0x10001644
jmp 0x10001516
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [ebp - 0x18], eax
jmp 0x100014f2
mov eax, dword [ebp - 0x10]
mov ecx, 0xa53151
mov dword [ebp - 8], ecx
mov ecx, esp
lea edx, [ebp - 8]
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x2be
mov dword [ecx], 0xae00e1
mov ecx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x14], eax
call ecx
sub esp, 0xc
mov ecx, dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [ebp - 0x1c], eax
call ecx
mov ecx, dword [sym.imp.USER32.dll_GetInputState]
mov dword [ebp - 0x20], eax
call ecx
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, 0xe
mov dword [ebp - 0x2c], eax
xor edx, edx
div ecx
cmp edx, 2
jne 0x10001583
mov eax, dword [sym.imp.USER32.dll_GetCaretBlinkTime]
call eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x1b8
mov dword [ebp - 0x28], eax
jne 0x10001562
mov eax, esp
mov dword [eax + 8], 0x6a4
mov dword [eax + 4], 0x833
mov dword [eax], 0x833
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
call eax
sub esp, 0xc
mov ecx, dword [ebp - 0x14]
sub ecx, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x1000150a
jmp 0x100015c9
mov eax, dword [ebp - 0x14]
sub eax, 0x5b
mov dword [ebp - 0x3c], eax
jne 0x100014f2
jmp 0x100015da
mov byte [ebp - 1], 6
mov eax, esp
lea ecx, [ebp - 1]
mov dword [eax], ecx
mov dword [eax + 0x18], 0xf25
mov dword [eax + 0x14], 0xdb9
mov dword [eax + 0x10], 0x5a3
mov dword [eax + 0xc], 0x1ba
mov dword [eax + 8], 0x5a2
mov dword [eax + 4], 0x1ba
mov eax, dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], 0x59e
mov ecx, esp
lea edx, [ebp - 0xc]
mov dword [ecx + 4], edx
mov dword [ecx], 0xce68f5
mov ecx, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov dword [ebp - 0x40], eax
call ecx
sub esp, 8
mov dword [ebp - 0x44], eax
jmp 0x1000150a
add esp, 0x60
pop ebp
ret
Function at 0x101037bf
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10115e50], 0
mov byte [0x10115e54], 0
mov dword [0x10115e48], 0xdd8
mov dword [0x10115e44], 0x1867
mov dword [0x10115e4c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10103833
mov eax, 0x1c52
xor ecx, ecx
mov dword [0x10115e44], 0x1c52
mov dword [0x10115e4c], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x1010385b
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10115e4c]
add eax, 1
mov dword [0x10115e4c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10103833
jmp 0x10103810
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
add ecx, 0xfffff22e
mov dword [0x10115e58], 0
mov edi, dword [0x10115e50]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10115e58], esi
mov dword [0x10115e44], ecx
mov eax, esi
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x10115e50], edx
mov esi, dword [ebp - 0x28]
mov cl, byte [ebx + esi]
mov byte [0x10115e54], cl
mov dword [0x10115e44], 0x1300
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10115e54]
mov edx, dword [0x10115e50]
mov byte [ebx + edx], cl
mov edx, dword [0x10115e48]
mov ecx, edx
add ecx, 0xfffff3f9
mov dword [0x10115e44], ecx
mov esi, dword [0x10115e4c]
add esi, 1
mov dword [0x10115e4c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], esi
jl 0x1010385b
mov eax, dword [ebp - 0x30]
add eax, 0xffffef7b
mov dword [0x10115e44], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1010417c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x10115e48], 0xbaf
mov dword [0x10115e44], 0x77a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x101041cb
mov eax, dword [ebp - 0x30]
add eax, 0x2191
mov ecx, dword [0x10115e48]
add ecx, 0xfffff237
mov dword [0x10115e44], ecx
mov dword [ebp - 0x34], eax
jmp 0x101042cf
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101053fc]
mov dh, byte [eax + 0x101053cd]
sub dh, dl
mov byte [ebp + eax - 0x20], dh
cmp ecx, 0xe
mov dword [ebp - 0x2c], ecx
jne 0x101041cb
lea eax, [ebp - 0x20]
mov dword [0x10115e48], 0x8c2
mov dword [0x10115e44], 0x2310
mov dword [ebp - 0x38], eax
call fcn.10103ccf
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.10103539
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ecx
je 0x101042cf
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x10115e44]
add ecx, 0xffffee8b
mov dword [0x10115e44], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x30], eax
call fcn.10103b8a
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x10115e48], 0x322
mov dword [ecx + 0xd0], 0x4550
mov dword [0x10115e44], 0xfb1
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x38], ecx
mov ecx, dword [ebp - 0x30]
mov dword [edx + 0x2c], ecx
cmp ecx, 0
mov dword [ebp - 0x34], eax
jne 0x101041a9
mov eax, dword [ebp - 0x34]
add esp, 0x4c
pop ebp
ret
Function at 0x10104363
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.101047bc
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x10115e44], 0xda3
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x10115e48], 0xffffecc6
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
jne 0x101043c1
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x1010443e
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x101043ed
mov al, byte [ebp - 0x42]
test al, 1
jne 0x10104474
jmp 0x10104447
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov edx, dword [ebp - 0x34]
add edx, 2
mov esi, dword [ebp - 0x18]
cmp ecx, esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
jb 0x101043d3
jmp 0x101043b6
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10115e44], 0x47ea
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [0x10115e48], 0x114b
mov dword [ebp - 0x24], edx
jmp 0x101043b6
Function at 0x101044a8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10115e48]
add eax, 0xfffffd5c
mov dword [0x10115e48], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x10115e44], 0x2650
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10115e48], 0x129
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1010458b
mov eax, 0x29da
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x18], eax
je 0x1010456f
jmp 0x10104628
mov eax, 0x199d
mov dword [0x10115e44], 0x388
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x18], eax
je 0x10104553
jmp 0x10104628
mov eax, 1
mov dword [0x10115e48], 0xfa2
mov dword [ebp - 0x1c], eax
jmp 0x10104635
mov eax, 0x199d
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x18], eax
je 0x101045e2
jmp 0x10104628
mov eax, 0x29da
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x1010453c
jmp 0x10104628
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x101045b8
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
jl 0x1010458b
mov eax, dword [ebp - 0x24]
mov ecx, 0x35f0
mov dword [0x10115e44], 0x1fdb
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
je 0x10104516
jmp 0x10104628
mov eax, 0xfffff9e7
mov dword [0x10115e44], 0xffffe3d2
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x18], eax
jne 0x10104628
mov eax, 0x29da
mov dword [0x10115e44], 0x13c5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x18], eax
je 0x101044fa
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [0x10115e44], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add esp, 0x24
pop ebp
ret
Function at 0x10104946
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10115e4c], 0
mov dword [0x10115e50], 0
mov dword [0x10115e5c], 0
mov dword [0x10115e44], 0x2bc
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x10104a9b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, eax
add edi, 1
add edx, 1
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x10115e4c], edx
mov dword [0x10115e44], 0x97e
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x10115e50], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x10115e54], cl
mov ebx, dword [0x10115e48]
add ebx, 0xfffff27d
mov dword [0x10115e44], ebx
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10115e54]
mov edx, dword [0x10115e50]
mov byte [ebx + edx], cl
mov edx, dword [0x10115e4c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x10115e50]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x10115e5c], ecx
mov dword [0x10115e44], 0x2e2
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
xor cl, byte [edx + esi]
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], cl
mov dword [0x10115e44], 0x130b
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x34], edi
je 0x10104a9b
mov eax, dword [0x10115e50]
mov ecx, dword [0x10115e4c]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x101049a9
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10104aa3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov dword [0x10115e44], 0x1b4a
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10103e51
lea ecx, [0x1010376a]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x38], edx
mov dword [esp + 0x68], 0x15f600
mov dword [0x10115e48], 0x894
mov edx, dword [0x10115e30]
mov dword [esp + 0x30], edx
mov edx, dword [0x10115e34]
mov dword [esp + 0x40], edx
mov edx, dword [0x10115e38]
mov dword [esp + 0x7c], edx
mov edx, dword [0x10115e3c]
mov dword [esp + 0x28], edx
mov edx, dword [0x10115e40]
mov dword [esp + 0x64], edx
mov dword [0x10115e44], 0x1e0a
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10104b64
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10104b78
jmp 0x10104b64
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10104b37
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov dword [0x10115e48], 0xe2d
mov dword [0x10115e44], 0xf67
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x44], edx
call fcn.101044a8
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x10104b5c
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1010417c
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x10115e48], 0x5b1
mov dword [esp + 8], eax
jmp 0x10104b5c
Function at 0x406d80
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x218]
push edi
test esi, esi
je 0x406d99
mov dword [esi], 0
mov edi, dword [esp + 0x218]
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x406e79
push 0x104
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea eax, [esp + 0xc]
push str.Link_Source
push eax
call fcn.0049f442
add esp, 0xc
test eax, eax
je 0x406e6c
lea eax, [esp + 8]
push str.ObjectLink
push eax
call fcn.0049f2c1
add esp, 8
test eax, eax
je 0x406e6c
lea eax, [esp + 8]
push str.OwnerLink
push eax
call fcn.0049f2c1
add esp, 8
test eax, eax
je 0x406e6c
lea eax, [esp + 8]
push str.Native
push eax
call fcn.0049f2c1
add esp, 8
test eax, eax
je 0x406e6c
lea eax, [esp + 8]
push str.Embed_Source
push eax
call fcn.0049f2c1
add esp, 8
test eax, eax
je 0x406e6c
lea eax, [esp + 8]
push str.MSDEVColumnSelect
push eax
call fcn.0049f2c1
add esp, 8
test eax, eax
je 0x406e62
lea eax, [esp + 8]
push str.MSDEVLineSelect
push eax
call fcn.0049f2c1
add esp, 8
test eax, eax
jne 0x406e80
test esi, esi
je 0x406e6c
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
xor eax, eax
mov word [esp + 8], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
add esp, 0x20c
ret 8

Function at 0x406ea0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
cmp dword [0x4ea608], 0
push ebx
push esi
push edi
jne 0x406f28
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [0x4e8c5c]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
call edi
test eax, eax
jne 0x406f1e
nop dword [eax + eax]
mov eax, dword [0x4e4798]
cmp eax, 0xffffffff
je 0x406eef
test eax, eax
je 0x406f31
call esi
mov ecx, dword [0x4e4798]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x406f31
mov edx, 1
mov dword [0x4e4780], 0
mov ecx, 0x8000012f
call fcn.004015e0
push dword [0x4e8c5c]
mov dword [0x4e4780], 1
call edi
test eax, eax
je 0x406ed0
mov dword [0x4ea608], 1
mov eax, 1
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret