joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27a547bc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jns 0x27a547d6
push ebp
jns 0x27a54819
pop ebp
add byte [eax], dl
push eax
and ecx, dword [eax]
pop eax
add edx, 0x30
mov byte [esp + 0x39], dl
add ecx, 2
and bl, byte [esi + 0x7c35dc97]
or byte [esi + 0x1707c00a], ah
xor eax, 0xaa6087c
rol byte [edi], 0x17
mov edi, 0xa7820f58
adc ecx, dword [ebx + eax*2]
add al, byte [ebx + 0x5a7d08f9]
or esp, dword fs:[eax]
sbb eax, 0x411701bf
dec edi
sub byte [ebx - 0x3fe223ff], ah
leave
sub byte [ecx + 0x78ed011], ah
push es
mov eax, edi
dec edi
mov byte [eax], 0x2d
inc edi
mov esi, dword [ebp + 0x29]
pushal
out 0x5b, al
push cs
jge 0xb7cd9911
and esp, edx
and byte [ebx], dh
cmpsb byte [esi], byte es:[edi]
add ecx, ebx
cld
jl 0x27a5482d
not dword [ebx]
fsubp st(2)
mov edx, dword [edx]
and eax, 0xb0d5c34
test dword [edx], 0x1408c02e
or ch, byte [esi]
ror byte [eax], 0x14
ljmp 0x4c00:0x4cdb4042
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x4014ad
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x500, 0
sub ebp, 0x86
lea eax, [ebp - 0x272]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
xor eax, eax
push 0x104
mov word [ebp + 0x66], ax
lea eax, [ebp - 0x47a]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [ebp + 0x16]
push eax
push eax
mov byte [ebp + 0x16], 0
call dword [sym.imp.SHLWAPI.DLL_PathAppendA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x272]
push eax
mov byte [ebp + 0x76], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
xor al, al
mov byte [ebp + 0x7e], al
xor ah, ah
push ebx
mov word [ebp + 0x56], ax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp + 0x7e]
push eax
lea eax, [ebp + 0x76]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
call dword [sym.imp.USER32.DLL_GetDesktopWindow]
mov ebx, eax
lea eax, [ebp - 0x47a]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp + 0x56]
push eax
lea eax, [ebp + 0x66]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 5
push ebx
call dword [sym.imp.USER32.DLL_GetWindow]
push 0
push 0
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
xor eax, eax
mov word [ebp - 0x6a], ax
lea eax, [ebp - 0x6a]
push eax
push eax
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
lea eax, [esi - 3]
lea esp, [ebp + 0x86]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4020af
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov cl, byte [0x403050]
mov edx, eax
mov ebx, eax
shl edx, cl
mov eax, 0x403054
add edx, dword [0x403050]
call fcn.00401fe8
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x402baf
push edx
sub edi, fcn.00402359
push edi
xor eax, eax
push fcn.00402359
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x402121
mov eax, fcn.00402359
mov ebx, esi
mov edx, edi
call fcn.00401fe8
mov edx, 0x1c000
mov eax, 0x403054
mov ebx, esi
call fcn.00401d13
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x402359
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
inc esi
popal
add byte [ebx + 0x6c], al
inc ebp
add byte [edx - 1], dh
add byte [ebp + 0x72], ah
invalid
Function at 0x100028e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x100028f1
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10005060
cmp dword [ebp - 4], 8
lea eax, [ebp - 0x18]
push 0x10031634
cmovae eax, dword [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10012db5
mov ecx, dword [ebp + 8]
xor edx, edx
add esp, 0x14
test eax, eax
cmovne ecx, edx
xor esi, esi
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x1000298f
push edi
push 2
push esi
push ecx
call fcn.1001275b
push dword [ebp + 8]
call fcn.10012b6e
push esi
push esi
push dword [ebp + 8]
mov edi, eax
call fcn.1001275b
push edi
call fcn.10013657
mov esi, eax
add esp, 0x20
test esi, esi
je 0x10002978
push dword [ebp + 8]
push 1
push edi
push esi
call fcn.10012620
add esp, 0x10
cmp eax, 1
jne 0x10002978
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10002983
mov dword [eax], edi
jmp 0x10002983
push esi
call fcn.10013652
add esp, 4
xor esi, esi
push dword [ebp + 8]
call fcn.100122da
add esp, 4
pop edi
cmp dword [ebp - 4], 8
jb 0x100029a0
push dword [ebp - 0x18]
call fcn.10010cae
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
lea eax, [ebp - 0x220]
push esi
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x100041af
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0x10031630
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.10001b90
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10004f50
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
add esp, 8
mov ecx, esi
push eax
call fcn.10002500
cmp dword [ebp - 4], 0x10
jb 0x100041e1
push dword [ebp - 0x18]
call fcn.10010cae
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010000
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push esi
mov esi, ecx
mov ecx, dword [0x1003edd0]
test ecx, ecx
je 0x1001015c
mov eax, dword [esi + 0x20]
cmp eax, dword [ebp + 8]
jl 0x1001015c
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], 0
je 0x10010150
push edi
xor edi, edi
cmp byte [ebp + 0xc], 0
jne 0x10010055
cmp byte [esi + 0x24], 0
je 0x10010055
mov byte [ebp - 0x818], 0xa
mov edi, 1
mov byte [esi + 0x24], 0
cmp byte [esi + 0x24], 0
push ebx
mov ebx, 0x800
jne 0x1001009d
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.10010210
add esp, 8
cmp dword [eax + 0x14], 0x10
jb 0x10010077
mov eax, dword [eax]
push eax
mov eax, ebx
sub eax, edi
push str._s__
push eax
lea eax, [ebp - 0x818]
add eax, edi
push eax
call fcn.100149b0
add esp, 0x10
lea ecx, [ebp - 0x18]
add edi, eax
call fcn.10001560
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x818]
sub ebx, edi
add ecx, edi
push dword [eax]
push dword [ebp + 0x10]
push ebx
push ecx
call fcn.100200f5
push dword [esi]
lea eax, [ebp - 0x818]
push eax
call fcn.10012351
push dword [esi]
call fcn.10014873
mov al, byte [ebp + 0xc]
add esp, 0x1c
mov byte [esi + 0x24], al
mov eax, dword [esi + 4]
pop ebx
test eax, eax
je 0x1001012c
push eax
push edi
lea eax, [ebp - 0x818]
push 1
push eax
call fcn.10012d33
lea eax, [esi + 8]
add esp, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x100100fa
mov eax, dword [eax]
push dword [esi + 4]
push eax
call fcn.10012351
push dword [esi + 4]
push 0x10033704
call fcn.10012351
push dword [esi + 4]
lea eax, [ebp - 0x818]
add eax, edi
push eax
call fcn.10012351
push dword [esi + 4]
call fcn.10014873
add esp, 0x1c
cmp byte [esi + 0x25], 0
pop edi
je 0x10010150
call fcn.10010320
test al, al
je 0x10010150
lea eax, [ebp - 0x818]
mov byte [ebp - 0x418], 0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x1003edd0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002cf80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.1002cb9c
push eax
push esi
push dword [ebp + 8]
call fcn.1002cb51
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1002cb9c
push eax
push esi
push dword [ebp + 8]
call fcn.1002cb51
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1002cb8c
xchg esi, eax
invalid
Function at 0x1002d1e9
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1002d240
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1002d23b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1002d225
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1002d22d
cmp edx, ebx
jne 0x1002d37b
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1002d1fc
add eax, dword [eax + 4]
jmp fcn.1002d1e9
mov dword [ebp + 0xc], ebx
jmp 0x1002d24b
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1002d263
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1002d281
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push esp
invalid
invalid
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1002d2df
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1002d2c6
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1002d2cf
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1002d2d9
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1002d2bb
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1002d245
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1002d32c
dec eax
je 0x1002d323
sub eax, 3
je 0x1002d31a
mov dword [ebp - 4], 0x40
jmp 0x1002d349
mov dword [ebp - 4], 4
jmp 0x1002d32f
mov dword [ebp - 4], 0x20
jmp 0x1002d32f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1002d37b
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1002d2fb
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1002cb8c
mov al, byte [edx + 6]
dec ebp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1002d387
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002f374
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002e875
Function at 0x403d30
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403d44
inc dword [0x51604c]
add dword [0x51161c], 0x108
mov edx, dword [0x51161c]
push esi
push edi
mov ecx, 0x42
mov esi, 0x514b10
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403d73
push 0
mov eax, 0x516ea8
call fcn.0041e240
cmp dword [0x516080], 0
mov dword [0x517990], 0
mov dword [0x517994], 0
je 0x403dab
mov eax, dword [0x511644]
test eax, eax
je 0x403d9f
mov eax, dword [eax]
test eax, eax
jne 0x403da4
mov eax, 0x4e1a4c
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x403e30
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x403ddb
xor eax, eax
cmp word [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x403ddb
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x51799c], 0
je 0x403ded
cmp dword [0x517998], 0
jne 0x403df6
cmp byte [esi + 0xee], 0
je 0x403e30
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x403e30
cmp dword [0x51799c], 0
jge 0x403e18
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x51799c]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret
Function at 0x404c10
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x404c3c
call fcn.00404f20
test eax, eax
jne 0x404c3c
push 0x4e1df8
call fcn.0049fc00
add esp, 4
push eax
call fcn.00404d30
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x404c7e
cmp dword [esi + 0x18], ebx
je 0x404c67
cmp dword [esi + 8], ebx
je 0x404c5c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4e1e4c
call fcn.0049fc00
add esp, 4
push eax
call fcn.00404d30
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404cb7
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x404cde
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x404cde
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404cd4
cmp dword [esi + 8], ebx
je 0x404cc9
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x404cf3
mov dword [esi + 4], ebx
jmp 0x404cb7
cmp dword [esi + 0x18], ebx
je 0x404d10
cmp dword [esi + 8], ebx
je 0x404d05
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4e1e7c
call fcn.0049fc00
add esp, 4
push eax
call fcn.00404d30
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x404e00
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x404e10
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x404f01
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
push 0x4e1eb0
call fcn.0049fc00
add esp, 4
push eax
lea edx, [esp + 8]
push edx
call fcn.004c56eb
add esp, 0xc
test eax, eax
je 0x404ef8
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.004c4e9d
add esp, 8
test eax, eax
je 0x404ef8
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.004c4e9d
add esp, 8
test eax, eax
je 0x404ef8
lea edx, [esp]
push str.Native
push edx
call fcn.004c4e9d
add esp, 8
test eax, eax
je 0x404ef8
push 0x4e1f14
call fcn.0049fc00
push eax
lea eax, [esp + 8]
push eax
call fcn.004c4e9d
add esp, 0xc
test eax, eax
je 0x404ef8
push 0x4e1f40
call fcn.0049fc00
push eax
lea ecx, [esp + 8]
push ecx
call fcn.004c4e9d
add esp, 0xc
test eax, eax
je 0x404eee
push 0x4e1f74
call fcn.0049fc00
push eax
lea edx, [esp + 8]
push edx
call fcn.004c4e9d
add esp, 0xc
test eax, eax
jne 0x404f07
test esi, esi
je 0x404ef8
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret

Function at 0x404f20
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ecx + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x404faa
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
mov eax, dword [0x515edc]
push eax
call ebx
test eax, eax
jne 0x404f9f
mov eax, dword [0x511520]
cmp eax, 0xffffffff
je 0x404f6f
test eax, eax
je 0x404fb6
call esi
mov ecx, dword [0x511520]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x404fb6
push 1
push 0x8000012f
mov dword [0x511524], 0
call fcn.00401930
mov edx, dword [0x515edc]
add esp, 8
push edx
mov dword [0x511524], 1
call ebx
test eax, eax
je 0x404f50
mov eax, dword [esp + 0xc]
mov dword [eax + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4093c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x51600c], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x4093e4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x516010], 0
je 0x4093f3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x409609
test al, al
jne 0x409436
cmp byte [ebp + 0xc], al
jne 0x409436
push 0x514dd0
push 0
push 0
push 0x4096f0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x516708], eax
test eax, eax
je 0x4094c7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x514dd0]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x40946c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x409446
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4094d3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x40953a
cmp dword [esp + 0x2c], 0
je 0x4094e2
mov byte [esp + 0x1f], 1
call fcn.00409a10
test al, al
jne 0x4094e2
cmp byte [ebp + 0xc], al
jne 0x4095ce
mov byte [ebp + 8], al
jmp 0x409481
call fcn.00409a30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x40951e
call fcn.00409a10
test al, al
jne 0x40953a
cmp byte [ebp + 0xc], 0
jne 0x4095c7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x51600c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x409572
test byte [esp + 0x1e], 1
jne 0x40958b
push str._3d34OcT429dY:PacULT
push 0
push 0
call esi
mov dword [0x516700], eax
jmp 0x40958b
mov ecx, dword [0x516708]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x409552
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x4094e2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409481
mov edx, dword [0x516708]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x516708], 0
call fcn.00409a30
jmp 0x4094f2
test byte [esp + 0x1e], 1
je 0x40958b
mov eax, dword [0x516700]
push eax
call edi
mov dword [0x516700], 0
cmp dword [0x516010], 0
je 0x4095ad
test byte [esp + 0x1e], 2
jne 0x4095c7
push str.UB34731_2SLMDdc_
push 0
push 0
call esi
mov dword [0x516704], eax
jmp 0x4095c7
test byte [esp + 0x1e], 2
je 0x4095c7
mov ecx, dword [0x516704]
push ecx
call edi
mov dword [0x516704], 0
cmp byte [esp + 0x1f], 0
je 0x409609
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x511524], 0
push 0
push 0
push 0x10000
push 0x4e5e90
call fcn.0049fc00
add esp, 4
push eax
call fcn.004abe70
add esp, 0x18
mov dword [0x511524], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1004
call fcn.004d0b30
cmp byte [0x519520], 0
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push esi
push edi
jne 0x40b21b
cmp dword [0x516724], 0
jne 0x40b0d6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x516724], eax
mov ebx, 1
add dword [0x519524], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x519524]
mov esi, dword [0x511538]
mov ecx, eax
sub ecx, dword [0x516724]
mov dword [0x516728], eax
cmp edx, dword [0x511534]
jbe 0x40b10c
cmp ecx, esi
jb 0x40b173
xor ebx, ebx
cmp ecx, esi
jbe 0x40b129
mov dword [0x519524], 0
mov dword [0x516724], eax
test ebx, ebx
jne 0x40b21b
mov esi, dword [esp + 0x1018]
mov cl, byte [esi + 0xf]
push 0
mov byte [0x51796e], cl
mov ecx, dword [ebp]
inc byte [ebp + 0x16]
push 0
push 0
push 0x4e1a40
xor eax, eax
mov ebx, ecx
call fcn.00499bd0
dec byte [ebp + 0x16]
xor ebx, ebx
add esp, 0x10
cmp eax, ebx
jne 0x40b1ec
mov byte [ebp + 0x1b], bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
push ecx
push edx
push str.wr:97_r:3_7r077_r_717__76r__r:7r_3_rw__XX
call fcn.0049fc00
add esp, 4
push eax
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.004a71f0
add esp, 0xc
call fcn.0040a060
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x519520], bl
mov dword [0x511524], 0
call fcn.004abe70
add esp, 0x18
cmp eax, 7
jne 0x40b1d5
push 0
push 5
push 0x516ea8
call fcn.0041e5a0
mov eax, dword [0x516728]
mov dword [0x511524], ebx
mov byte [0x519520], 0
jmp 0x40b112
cmp byte [ebp + 0x1b], bl
je 0x40b21b
mov byte [ebp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x40b21b
movzx edx, word [esi + 4]
mov eax, dword [0x515edc]
push ebx
push edx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8