joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d5b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40d6da
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40d5ec
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40d615
cmp cx, 0x7f
jbe 0x40d5e0
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x40d610
mov ecx, ebx
and ecx, 2
xor ebx, 2
lea ebx, [ebx + ecx*2]
jmp 0x40d5e1
add ebx, 3
jmp 0x40d5e1
lea esi, [ebx + 1]
push esi
call fcn.0040c990
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x40d6e8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x40d658
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40d6ea
movzx edx, word [edi]
test dx, dx
je 0x40d6ea
cmp dx, 0x7f
jbe 0x40d640
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x40d6a0
cmp esi, 0x7ff
ja 0x40d6a0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x40d647
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x40d647
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x40d647
push 1
call fcn.0040c990
add esp, 4
mov ebp, eax
jmp 0x40d6ea
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x40d705
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x40d700
test eax, eax
je 0x40d719
mov ebx, eax
jmp 0x40d700
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00408fa0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40fc40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x454ba4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40fcee
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44fbd0]
Function at 0x410c00
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov esi, dword [0x454b98]
mov dword [esp + 0x3c], 0x832d81cd
mov dword [esp + 0x40], 0x872f853e
mov dword [esp + 0x44], 0x8b268924
mov dword [esp + 0x48], 0x8fe18d2d
mov dword [esp + 0x4c], 0x93fc91e5
mov dword [esp + 0x50], 0x97f695e4
mov dword [esp + 0x54], 0x9bcd99f0
mov dword [esp + 0x58], 0x9f309d35
mov dword [esp + 0x5c], 0xe34de144
mov dword [esp + 0x60], 0xe755e553
mov dword [esp + 0x64], 0xeba4e988
mov dword [esp + 0x68], 0xef8eedb8
mov dword [esp + 0x6c], 0xf382f181
mov dword [esp + 0x70], 0xf786f59a
mov dword [esp + 0x74], 0xfb9af983
mov dword [esp + 0x78], 0xff57fdab
mov dword [esp + 0x7c], 0xc3b4c16e
mov dword [esp + 0x80], 0xc7bdc5b0
mov dword [esp + 0x84], 0xcb72c9a8
mov dword [esp + 0x88], 0xcfbacdba
mov dword [esp + 0x8c], 0xd3b2d1b9
mov dword [esp + 0x90], 0xd766d595
mov dword [esp + 0x94], 0xdb76d968
mov dword [esp + 0x98], 0xdf89dd79
mov dword [esp + 0x9c], 0x23802185
mov dword [esp + 0xa0], 0x278f256f
mov dword [esp + 0xa4], 0x2b45299c
mov dword [esp + 0xa8], 0x2f5d2d59
mov dword [esp + 0xac], 0x335c3147
mov dword [esp + 0xb0], 0x37403547
mov dword [esp + 0xb4], 0x3b523958
mov dword [esp + 0xb8], 0x3f763d77
mov dword [esp + 0xbc], 0x34f0154
mov dword [esp + 0xc0], 0x76a0548
mov dword [esp + 0xc4], 0xba60968
mov dword [esp + 0xc8], 0xfa50da5
mov dword [esp + 0xcc], 0x137211b5
mov dword [esp + 0xd0], 0x17b31553
mov dword [esp + 0xd4], 0x1bb119bb
mov dword [esp + 0xd8], 0x1f771db3
mov dword [esp + 0xdc], 0x63216100
mov dword [esp + 0xe0], 0x67d465cc
mov dword [esp + 0xe4], 0x6bc769c7
mov dword [esp + 0xe8], 0x6f016dc9
mov dword [esp + 0xec], 0x73037101
mov dword [esp + 0xf0], 0x7718750d
mov dword [esp + 0xf4], 0x7b147908
mov dword [esp + 0xf8], 0x7f107d0c
mov dword [esp + 0xfc], 0x43224130
mov dword [esp + 0x100], 0x47e74517
mov dword [esp + 0x104], 0x4beb49ee
mov dword [esp + 0x108], 0x4fe74dfe
mov dword [esp + 0x10c], 0x5327513f
mov dword [esp + 0x110], 0x57215527
mov dword [esp + 0x114], 0x5b295936
mov dword [esp + 0x118], 0x5f5e5d2a
mov dword [esp + 0x11c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xe3
ja 0x410e9d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x3c]
push dword [esp + 4]
push eax
call fcn.00411e00
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x3c], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe4
jb 0x410e70
lea ebx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebx
call esi
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x44fd48]

Function at 0x412270
Capabilities:
Contain obfuscated stackstrings
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x45051c]
Function at 0x41e560
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb40
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41e580
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x455edc]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41e5b4
mov eax, 0xffffffff
jmp 0x41e5b7
lea eax, [ebx + ebx]
push eax
call fcn.0040c990
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x455edc]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41e5ec
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c990
add esp, 4
mov esi, eax
mov dword [esp + 0x68], 0x59065be8
mov dword [esp + 0x6c], 0x5deb5fff
mov dword [esp + 0x70], 0x513253e8
mov dword [esp + 0x74], 0x55ed57fa
mov dword [esp + 0x78], 0xa91fabe2
mov dword [esp + 0x7c], 0xad1faf17
mov dword [esp + 0x80], 0xa1a2a31e
mov dword [esp + 0x4a8], 0
mov eax, dword [esp + 0x4a8]
cmp eax, 0x1b
ja 0x41e68a
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x4a8]
movzx eax, byte [esp + eax + 0x68]
push dword [esp + 0x4a8]
push eax
call fcn.00422f40
add esp, 8
mov ecx, dword [esp + 0x4a8]
mov byte [esp + ecx + 0x68], al
inc dword [esp + 0x4a8]
mov eax, dword [esp + 0x4a8]
cmp eax, 0x1c
jb 0x41e650
mov edx, dword [esp + 0x2c]
movzx ecx, word [edx]
mov eax, esi
test cx, cx
je 0x41e6b1
add edx, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e6a0
mov word [eax], 0
movzx ecx, word [esp + 0x68]
test cx, cx
je 0x41e6e1
lea edx, [esp + 0x6a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e6d0
mov word [eax], 0
lea eax, [esp + 0x830]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0044a0d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x450f3c]
Function at 0x424f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424f40
cmp eax, 0xffffffdd
jge 0x424f57
mov eax, 0xffffffff
jmp 0x424f5a
add eax, 0x22
push eax
call fcn.0040c990
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x9719993c
mov dword [esp + 0x1c], 0x93019518
mov dword [esp + 0x20], 0x8f2f911e
mov dword [esp + 0x24], 0x8b178d17
mov dword [esp + 0x28], 0x871a892c
mov dword [esp + 0x2c], 0x83188519
mov dword [esp + 0x30], 0x7ff38121
mov dword [esp + 0x34], 0x7bf67de8
mov word [esp + 0x38], 0x7978
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x27
ja 0x424ffb
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00425db0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x28
jb 0x424fd0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x425021
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x425010
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x425051
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425040
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x3fad3995
mov dword [esp + 0x1c], 0x23cf3da2
mov dword [esp + 0x20], 0x27be2185
mov dword [esp + 0x24], 0x2b8f25b0
mov dword [esp + 0x28], 0x2fb929ba
mov dword [esp + 0x2c], 0x13812d85
mov dword [esp + 0x30], 0x17f91182
mov dword [esp + 0x34], 0x1bf515fb
mov dword [esp + 0x38], 0x1fbc19f6
mov dword [esp + 0x3c], 0x3951d89
mov dword [esp + 0x40], 0x79001a5
mov dword [esp + 0x44], 0xb9905c3
mov dword [esp + 0x48], 0xf9a099a
mov dword [esp + 0x4c], 0xf36a0da9
mov dword [esp + 0x50], 0xf73ff164
mov dword [esp + 0x54], 0xfb27f550
mov dword [esp + 0x58], 0xfffef916
mov dword [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x47
ja 0x425136
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425e30
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x48
jb 0x425110
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x425450
push ecx
push esi
call fcn.004262c0
add esp, 0x10
mov ebx, eax
jmp dword [0x451348]
Function at 0x428c80
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov edi, dword [0x455edc]
mov dword [esp + 0x14], 0x37623905
mov dword [esp + 0x18], 0x334d3547
mov dword [esp + 0x1c], 0x4f3a3151
mov dword [esp + 0x20], 0x4b3a4d0d
mov dword [esp + 0x24], 0x471a4938
mov dword [esp + 0x28], 0x43ce4525
mov dword [esp + 0x2c], 0x5f634121
mov dword [esp + 0x30], 0x5d5c
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x428d0b
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042b3e0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x428ce0
lea esi, [esp + 0x68]
lea eax, [esp + 0x14]
push esi
push 0
push 0
push 0xe
push eax
push 0
call edi
mov edi, dword [esp + 0x68]
test edi, edi
jns 0x428d2e
mov eax, 0xffffffff
jmp 0x428d31
lea eax, [edi + edi]
push eax
call fcn.0040c990
add esp, 4
mov ebp, eax
mov ebx, dword [0x455edc]
mov dword [esp + 0x14], 0xb7c289a5
mov dword [esp + 0x18], 0xb3ddb527
mov dword [esp + 0x1c], 0xbf2ab1d1
mov dword [esp + 0x20], 0xbb2abdfd
mov dword [esp + 0x24], 0xa7eab928
mov dword [esp + 0x28], 0xa33ea5c5
mov dword [esp + 0x2c], 0xaf83a1c1
mov dword [esp + 0x30], 0xadac
mov byte [esp + 0x34], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x20
ja 0x428dcb
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042b460
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x21
jb 0x428da0
push esi
push edi
push ebp
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebx
mov eax, dword [esp + 0x68]
mov ecx, eax
add ecx, 9
jns 0x428deb
mov eax, 0xffffffff
jmp 0x428df2
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c990
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0xf1aeff50
mov dword [esp + 0x18], 0xf557f353
mov dword [esp + 0x1c], 0xc955f749
mov dword [esp + 0x20], 0xcd6dcb71
mov dword [esp + 0x24], 0xc1cecf79
mov byte [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x14
ja 0x428e6b
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042b4d0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x15
jb 0x428e40
movzx ecx, word [ebp]
mov eax, edi
test cx, cx
je 0x428e91
lea edx, [ebp + 2]
mov eax, edi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428e80
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x428ec1
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428eb0
mov esi, dword [esp + 0x88]
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.0044a280
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x64], ebp
jmp dword [eax*4 + 0x45198c]
Function at 0x438fa0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x438fc0
jmp 0x438fc2
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x438fd3
jmp 0x439108
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x439010
jmp 0x439100
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0041b910
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x4390f2
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0xd9
mov byte [ebp - 0x27], 0xf3
mov byte [ebp - 0x26], 0xfd
mov byte [ebp - 0x25], 0xf1
mov byte [ebp - 0x24], 0xc2
mov byte [ebp - 0x23], 0xf2
mov byte [ebp - 0x22], 0xc1
mov byte [ebp - 0x21], 0xcf
mov byte [ebp - 0x20], 0xc0
mov byte [ebp - 0x1f], 0x89
mov byte [ebp - 0x1e], 0xd2
mov byte [ebp - 0x1d], 0xd1
mov byte [ebp - 0x1c], 0xd4
mov byte [ebp - 0x1b], 0x5b
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x11
jne 0x43907c
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x11
jae 0x4390c9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.0043c7c0
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x439090
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d760
mov bl, al
jmp 0x4390e9
and bl, 1
jmp 0x4390ee
jmp 0x4390f0
jmp 0x4390f2
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x439100
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x439108
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4476c0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
movzx esi, word [ebp]
mov dword [esp + 4], 0xb7b66f7d
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x447716
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00447c70
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x4476f0
xor ecx, ecx
cmp dword [esp + 4], esi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x45453c]
mov esi, dword [ebp + 0x3c]
mov edi, dword [ebp + esi]
mov dword [esp], 0x696a2034
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x447779
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.00447cf0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x447750
xor ecx, ecx
cmp edi, dword [esp]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x454544]
mov edi, dword [ebp + esi + 0x78]
cmp dword [ebp + esi + 0x7c], 0
sete al
test edi, edi
sete cl
or cl, al
movzx ecx, cl
xor eax, eax
jmp dword [ecx*4 + 0x45454c]
mov eax, dword [ebp + edi + 0x20]
add eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + edi + 0x24]
add eax, ebp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + edi + 0x1c]
add eax, ebp
mov dword [esp + 0x1c], eax
mov esi, dword [0x455ee4]
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x454554]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x2c]
jb 0x4481f7
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ebp, ebx
and ebp, 3
mov ecx, ebp
shr ecx, 1
mov eax, esi
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov ecx, ebp
xor ecx, 0xfffffffe
or ebp, 1
and ebp, ecx
je 0x4481f0
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [eax + ebx], cl
cmp ebp, 1
je 0x4481f0
movzx ecx, byte [edx + ebx + 1]
mov byte [eax + ebx + 1], cl
cmp ebp, 2
je 0x4481f0
movzx ecx, byte [edx + ebx + 2]
mov byte [eax + ebx + 2], cl
xor eax, eax
jmp 0x448361
mov dword [esp + 4], 0x34353637
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x448246
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00449110
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x448220
mov eax, dword [esp + 4]
mov ecx, dword [0x455ee0]
test ecx, ecx
je 0x4482a2
xor edx, edx
mov edi, dword [0x455ee4]
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x54ca534e
je 0x448274
inc edx
cmp ecx, edx
jne 0x448260
mov edi, dword [esp + 0x28]
jmp 0x4482a2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x28]
je 0x4482a2
lea eax, [esp + 0xc]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x455ee8]
push ecx
call fcn.00446c10
add esp, 0x28
test eax, eax
js 0x448361
push 0xc95dc39
push dword [0x45def4]
call fcn.00449760
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x24]
call eax
mov esi, eax
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0x34353637
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x448316
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00449110
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x4482f0
mov ecx, dword [0x455ee0]
test ecx, ecx
je 0x448341
mov edx, dword [esp + 4]
xor ebx, ebx
mov ebp, dword [0x455ee4]
mov eax, esi
nop
nop
cmp dword [ebp + ebx*8], 0x625b6034
je 0x448345
inc ebx
cmp ecx, ebx
jne 0x448330
jmp 0x448361
mov eax, esi
jmp 0x448361
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, edx
je 0x448361
push edi
push 1
push dword [0x455ee8]
push ecx
call fcn.00446c10
mov eax, esi
add esp, 0x10
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402add
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b4f
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b28
cmp dword [ebp + 0x10], ebx
jne 0x402b56
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402add
test eax, eax
jne 0x402b3a
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402b0f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x402b4f
Function at 0x402f47
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f74
mov ecx, dword [0x424398]
push edi
add eax, ecx
push edi
push eax
mov dword [0x4170ec], eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403072
cmp eax, edi
jl 0x40306b
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409024]
call ebx
test eax, eax
je 0x403068
cmp dword [ebp - 4], esi
jne 0x403068
push dword [ebp + 8]
add dword [0x4170ec], esi
call fcn.00403072
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x40306b
cmp dword [ebp + 0x10], edi
jne 0x403037
cmp dword [ebp + 8], edi
jle 0x403063
mov esi, 0x4130a8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fe7
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409024]
call ebx
test eax, eax
je 0x403068
cmp edi, dword [ebp - 4]
jne 0x403068
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403033
cmp dword [ebp + 0x14], edi
jne 0x403033
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4170ec], eax
cmp dword [ebp + 8], 0
jg 0x402fda
jmp 0x403063
push 0xfffffffffffffffe
jmp 0x40306a
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403042
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409024]
call ebx
test eax, eax
je 0x403068
mov eax, dword [ebp - 4]
add dword [0x4170ec], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40306b
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10