joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4071f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4255d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
and dword [edi + 0x10], 0
xor eax, eax
mov esi, edx
mov dword [edi + 0x14], 7
push eax
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x238], esi
mov word [edi], ax
call fcn.0040dd40
push eax
call fcn.0040dd0d
pop ecx
pop ecx
call fcn.0040dd1f
cdq
mov ecx, 0x2710
idiv ecx
mov dword [ebp - 0x22c], edx
cmp dword [esi + 0x14], 8
jb 0x407258
mov esi, dword [esi]
push dword [ebp - 0x22c]
push esi
push 6
push 0x426190
call fcn.0040690d
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
lea esi, [ebp - 0x228]
call fcn.00401313
mov ebx, eax
mov eax, edi
call fcn.00401360
push 1
xor edi, edi
call fcn.0040147a
mov esi, dword [ebp - 0x234]
cmp dword [esi + 0x14], 8
jb 0x4072b0
mov eax, dword [esi]
jmp 0x4072b2
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4072dc
shr eax, 4
and al, 1
je 0x4072dc
inc dword [ebp - 0x22c]
mov esi, dword [ebp - 0x238]
mov edi, dword [ebp - 0x234]
jmp 0x407250
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b61b
leave
ret
Function at 0x4072ed
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e0
mov eax, dword [0x4255d4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x4dc], ecx
call fcn.004042ac
cmp dword [ebp - 0x238], 8
mov eax, dword [ebp - 0x24c]
jae 0x407329
mov eax, esi
lea ecx, [ebp - 0x4d4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x4d8], eax
cmp eax, 0xffffffff
jne 0x407366
xor bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0x24c]
call fcn.0040147a
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040b61b
leave
ret 4
push 0x422888
lea esi, [ebp - 0x284]
call fcn.00401313
push 0x42288c
lea esi, [ebp - 0x268]
call fcn.00401313
test byte [ebp - 0x4d4], 0x10
je 0x4073e5
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x284]
call fcn.004064b3
test eax, eax
je 0x40744f
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x268]
call fcn.004064b3
test eax, eax
je 0x40744f
lea eax, [ebp - 0x4a8]
push eax
lea esi, [ebp - 0x230]
call fcn.00401313
mov ecx, dword [ebp - 0x4dc]
mov eax, esi
push eax
call fcn.004072ed
jmp 0x407440
cmp dword [ebx + 0x14], 8
jb 0x4073ef
mov eax, dword [ebx]
jmp 0x4073f1
mov eax, ebx
lea ecx, [ebp - 0x4a8]
push ecx
push eax
push 5
push 0x42619c
call fcn.0040690d
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
lea esi, [ebp - 0x230]
call fcn.00401313
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x407439
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
xor edi, edi
lea esi, [ebp - 0x230]
call fcn.0040147a
lea eax, [ebp - 0x4d4]
push eax
push dword [ebp - 0x4d8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407386
push dword [ebp - 0x4d8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebx + 0x14], 8
jb 0x40747e
mov ebx, dword [ebx]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 1
xor edi, edi
lea esi, [ebp - 0x268]
call fcn.0040147a
push 1
lea esi, [ebp - 0x284]
call fcn.0040147a
mov bl, 1
jmp 0x407344
Function at 0x408bdb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x408be6
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x408c9a
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x422418]
add ecx, 8
sub edi, 8
dec esi
jne 0x408bfd
pop ebx
test edi, edi
je 0x408cb3
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x422418]
inc ecx
dec edi
jne 0x408c9e
pop esi
not eax
pop edi
ret

Function at 0x408cb8
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x422418]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x422418]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x40931b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x40934b
push 0
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409346
mov byte [esi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x409373
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x40935c
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0040e200
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret 0xc
Function at 0x40a0fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebx], 0
push esi
push edi
jne 0x40a1a2
cmp dword [ebx + 4], 0xffffffff
jne 0x40a1a2
lea esi, [ebx + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a12d
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp eax, 0x5c
je 0x40a165
cmp eax, 0x2f
je 0x40a165
sub esi, 2
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x40a151
mov edi, esi
mov esi, 0x421054
movsd dword es:[edi], dword [esi]
push 0x20
call fcn.0040bc63
and dword [eax + 0x1c], 0
and dword [eax + 0xc], 0
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0xc]
push eax
mov word [eax], 0x100
mov byte [eax + 0x10], 0
mov dword [eax + 0x18], ecx
call fcn.00409590
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
jmp 0x40a1a7
mov eax, 0x1000000
pop edi
pop esi
pop ebp
ret 8

Function at 0x40b61b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4255d4]
jne 0x40b625
repz ret
jmp fcn.00410111
Function at 0x41bb73
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4255d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410da6
and dword [ebp - 0x14], 0
cmp dword [0x428294], 0
mov dword [ebp - 0x18], eax
jne 0x41bc26
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41bcce
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420f8c
push ebx
call edi
test eax, eax
je 0x41bcce
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x428294], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x428298], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42829c], eax
call edi
push eax
call esi
mov dword [0x4282a4], eax
test eax, eax
je 0x41bc26
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4282a0], eax
mov eax, dword [0x4282a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41bc7f
cmp dword [0x4282a4], ecx
je 0x41bc7f
push eax
call esi
push dword [0x4282a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41bc7f
test ebx, ebx
je 0x41bc7f
call edi
test eax, eax
je 0x41bc76
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41bc76
test byte [ebp - 8], 1
jne 0x41bc7f
or dword [ebp + 0x10], 0x200000
jmp 0x41bcb2
mov eax, dword [0x428298]
cmp eax, dword [ebp - 0x18]
je 0x41bcb2
push eax
call esi
test eax, eax
je 0x41bcb2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41bcb2
mov eax, dword [0x42829c]
cmp eax, dword [ebp - 0x18]
je 0x41bcb2
push eax
call esi
test eax, eax
je 0x41bcb2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x428294]
call esi
test eax, eax
je 0x41bcce
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41bcd0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b61b
leave
ret
Function at 0x4019db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
sub eax, dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x1c]
add ebx, dword [ebx + 0x14]
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ecx + 0x18]
add edi, ebx
mov dword [ebp - 0x14], edi
mov esi, ebx
cmp ebx, edi
je 0x401a1e
imul eax, dword [ebp + 0xc], 0x19660d
add eax, 0x3c6ef35f
mov dword [ebp + 0xc], eax
xor byte [esi], al
inc esi
cmp esi, dword [ebp - 0x14]
jne 0x401a07
cmp ebx, dword [ebp - 0x14]
jae 0x401ada
mov ecx, dword [ebx]
mov dword [ebp - 0x18], ecx
add ebx, 4
cmp dword [0x407010], 0x492aa840
jne 0x401a60
mov edi, dword [ebp - 0x1c]
mov dword [esp + 0x14], edi
mov ecx, dword [ebp - 0x14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00405321
cmp dword [section..data], 0x7a0ec2f9
jne 0x401a99
mov dword [esp + 0x10], 0x453b79c5
mov eax, dword [0x40700c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x32df6558
mov dword [esp + 4], 0x312d8d41
mov dword [esp], 0x4586d651
call fcn.004050b4
mov eax, dword [ebx]
sub eax, 8
add ebx, 4
lea edx, [ebx + eax]
cmp ebx, edx
jae 0x401ad1
movzx eax, word [ebx]
shr eax, 0xc
je 0x401aca
cmp eax, 3
je 0x401ab6
int3
movzx eax, word [ebx]
and eax, 0xfff
add eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
add dword [eax + ecx], edi
add ebx, 2
cmp ebx, edx
jb 0x401aa8
cmp ebx, dword [ebp - 0x14]
jb 0x401a27
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b0c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
mov ebx, dword [esi]
cmp ebx, esi
je 0x401b6b
test edi, edi
jne 0x401b4c
mov dword [esp], ebx
call fcn.0040340c
test eax, eax
je 0x401b4c
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x401b6b
cmp edi, 1
jne 0x401b65
mov dword [esp], ebx
call fcn.0040158c
test eax, eax
je 0x401b65
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x401b6b
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x401b34
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401b76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, esi
add eax, dword [esi + 0x3c]
mov edi, esi
add edi, dword [eax + 0x78]
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004029ab
test eax, eax
jne 0x401be5
mov ebx, 0
cmp ebx, dword [edi + 0x18]
jae 0x401c02
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004029ab
test eax, eax
je 0x401bfc
lea eax, [ebx + ebx]
add eax, dword [edi + 0x24]
movzx eax, word [eax + esi]
shl eax, 2
add eax, dword [edi + 0x1c]
add esi, dword [eax + esi]
mov eax, esi
jmp 0x401c07
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x401bc2
mov eax, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4025b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
inc ecx
mov dl, al
inc dl
mov al, dl
xor al, byte [ecx]
movzx ax, al
inc ecx
mov word [ebx], ax
add ebx, 2
test ax, ax
jne 0x4025c3
pop ebx
pop ebp
ret

Function at 0x402761
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
movzx ecx, ax
mov ebx, eax
shr ebx, 0x10
mov eax, 1
test esi, esi
je 0x402877
test edi, edi
je 0x402870
mov edx, edi
cmp edi, 0x15b0
jbe 0x40279c
mov edx, 0x15b0
sub edi, edx
cmp edx, 0xf
jle 0x402835
movzx eax, byte [esi]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 1]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 2]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 3]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 4]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 5]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 6]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 7]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 8]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 9]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xa]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xb]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xc]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xd]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xe]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xf]
add ecx, eax
add ebx, ecx
add esi, 0x10
sub edx, 0x10
cmp edx, 0xf
jg 0x4027a7
test edx, edx
je 0x402844
movzx eax, byte [esi]
add ecx, eax
inc esi
add ebx, ecx
dec edx
jne 0x402839
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ecx, edx
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebx, edx
test edi, edi
jne 0x40278d
mov eax, ebx
shl eax, 0x10
or eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4029e5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov eax, dword [0x407020]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00403bae
mov dword [esp + 0x14], 0x22cb119c
mov dword [esp + 0x10], 0x3ed5b60c
mov dword [esp + 0xc], 0x74833826
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4d9c5573
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_MoveWindow
sub esp, 0x18
mov dword [esp], ebx
call sub.USER32.dll_BringWindowToTop
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], eax
call sub.USER32.dll_GetUpdateRect
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xe0f8273
mov dword [esp], 0x2b59ed7
call sub.USER32.dll_UnionRect
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004025dc
mov eax, dword [0x40701c]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_PtInRect
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.USER32.dll_GetKeyState
sub esp, 4
imul eax, edi, 0x42e827cd
or eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402ac3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
inc ecx
mov dl, al
inc dl
mov al, dl
xor al, byte [ecx]
inc ecx
mov byte [ebx], al
inc ebx
test al, al
jne 0x402ad3
pop ebx
pop ebp
ret

Function at 0x402bac
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x44
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x48]
mov dword [esp + 4], 0x4090ae
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.004025b3
cmp word [ebx], 0
je 0x402c36
cld
mov dword [ebp - 0x44], ebx
movzx eax, word [ebx]
add ebx, 2
test ax, ax
jne 0x402bf6
mov esi, dword [ebp - 0x44]
lea edi, [ebp - 0x38]
mov ecx, 0x10
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
jne 0x402c30
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 1
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x402c6a
cmp word [ebx], 0
jne 0x402bf3
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x30]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0x18]
cmp eax, dword [edx + 8]
jne 0x402c56
mov eax, dword [ecx + 0x28]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x402c6a
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
jne 0x402c36
mov eax, 0
add esp, 0x44
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40377c
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x14]
imul edi, dword [0x40700c], 0x7db2b63e
mov eax, dword [ebp + 0xc]
imul eax, dword [0x407010]
or edi, eax
mov esi, dword [0x407020]
call fcn.004013e3
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.USER32.dll_FillRect
sub esp, 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x204fed13
mov eax, dword [0x407008]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2ba40e16
mov eax, dword [0x407018]
mov dword [esp + 4], eax
mov dword [esp], 0x1c21545d
call fcn.004052d3
mov eax, dword [0x407018]
mov dword [esp], eax
call sub.USER32.dll_SetCursor
sub esp, 4
mov dword [esp], edi
call sub.USER32.dll_OpenClipboard
sub esp, 4
mov dword [esp + 0xc], esi
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [0x407014]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00401330
mov edx, eax
and ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], 0x5fb2bd50
mov eax, dword [0x407008]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov eax, dword [0x40700c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x567bbc
mov dword [esp + 4], 0x623c9e68
mov dword [esp], 0x63802a4a
call sub.USER32.dll_SetWindowPos
sub esp, 0x1c
mov edi, eax
xor edi, dword [0x407014]
xor edi, dword [ebp + 0xc]
or edi, 0x2dba1e12
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.USER32.dll_GetMenuState
sub esp, 0xc
mov eax, dword [section..data]
xor eax, dword [0x407020]
or eax, dword [0x40700c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403bae
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x407008]
mov dword [esp + 0x14], eax
mov eax, dword [0x40701c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xbd1ff35
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov eax, dword [0x407004]
mov dword [esp], eax
call fcn.004031ae
mov ebx, eax
mov dword [esp], eax
call sub.USER32.dll_IsZoomed
sub esp, 4
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextW
sub esp, 0xc
mov dword [esp + 0xc], 0x14ee5dcc
mov eax, dword [0x407008]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040182d
mov dword [esp + 0xc], 0x2732e1e4
mov dword [esp + 8], 0xbd5cb18
mov dword [esp + 4], 0x34ef6caf
mov eax, dword [0x40701c]
mov dword [esp], eax
call sub.USER32.dll_RegisterHotKey
sub esp, 0x10
mov dword [esp + 0x18], 0x3753b2bf
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xac3eb5b
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.USER32.dll_SetWindowPos
sub esp, 0x1c
call sub.USER32.dll_CreatePopupMenu
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
call fcn.0040287c
imul eax, dword [ebp + 0x10], 0x38afd438
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404bc9
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x40700c]
mov dword [esp + 4], eax
mov dword [esp], 0x7b8e07ff
call fcn.00403ca6
call sub.USER32.dll_CreateMenu
mov edx, eax
and edx, dword [0x407020]
mov dword [esp + 4], edx
mov dword [esp], edx
call sub.USER32.dll_KillTimer
sub esp, 8
call fcn.00403deb
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.0040182d
mov dword [esp], eax
call sub.USER32.dll_GetClipboardData
sub esp, 4
call fcn.00403deb
call sub.USER32.dll_GetCapture
mov edx, eax
and eax, 0x5b1c11df
xor eax, dword [0x407010]
or eax, edx
leave
ret