joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d4ea8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101cf928]
jne 0x100d4eb2
repz ret
jmp fcn.100d6e39

Function at 0x100da1cf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100d5eb6
and dword [ebp - 4], 0
cmp dword [0x101d1d98], 0
mov ebx, eax
jne 0x100da280
push 0x101b71f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100da331
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101b71e4
push edi
call esi
test eax, eax
je 0x100da331
push eax
call fcn.100d5e44
mov dword [esp], 0x101b71d4
push edi
mov dword [0x101d1d98], eax
call esi
push eax
call fcn.100d5e44
mov dword [esp], 0x101b71c0
push edi
mov dword [0x101d1d9c], eax
call esi
push eax
call fcn.100d5e44
mov dword [esp], 0x101b71a4
push edi
mov dword [0x101d1da0], eax
call esi
push eax
call fcn.100d5e44
pop ecx
mov dword [0x101d1da8], eax
test eax, eax
je 0x100da280
push 0x101b718c
push edi
call esi
push eax
call fcn.100d5e44
pop ecx
mov dword [0x101d1da4], eax
mov eax, dword [0x101d1da4]
cmp eax, ebx
je 0x100da2d8
cmp dword [0x101d1da8], ebx
je 0x100da2d8
push eax
call fcn.100d5ebf
push dword [0x101d1da8]
mov esi, eax
call fcn.100d5ebf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100da2d8
test edi, edi
je 0x100da2d8
call esi
test eax, eax
je 0x100da2cf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100da2cf
test byte [ebp - 0xc], 1
jne 0x100da2d8
or dword [ebp + 0x10], 0x200000
jmp 0x100da311
mov eax, dword [0x101d1d9c]
cmp eax, ebx
je 0x100da311
push eax
call fcn.100d5ebf
pop ecx
test eax, eax
je 0x100da311
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100da311
mov eax, dword [0x101d1da0]
cmp eax, ebx
je 0x100da311
push eax
call fcn.100d5ebf
pop ecx
test eax, eax
je 0x100da311
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101d1d98]
call fcn.100d5ebf
pop ecx
test eax, eax
je 0x100da331
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100da333
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100daea4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [0x101cf8c4]
add edx, 0xfffff84d
mov dword [0x101cf8c4], edx
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x100daf96
lea eax, [0x101b6071]
mov ecx, 0xe
lea edx, [ebp - 0x12c]
mov esi, dword [0x101cf8c8]
add esi, 0x996
mov dword [0x101cf8c4], esi
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], ecx
call fcn.100db649
mov eax, dword [0x101cf8c8]
add eax, 0xffffde88
mov dword [0x101cf8c8], eax
mov dword [0x101cf8c4], 0xc09
call fcn.100db94e
mov dword [esp], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp + 4], eax
call fcn.100db2ee
mov ecx, eax
mov dword [0x101cf8e4], eax
mov eax, esp
mov edx, dword [ebp - 0x144]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
jmp 0x100daff5
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x150
mov edi, edx
add edi, esi
add edi, 0xc4
mov esi, dword [edi]
imul edi, eax, 0x150
add edx, edi
add edx, 4
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x11f
mov ecx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
je 0x100daee0
jmp 0x100daf96
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0x150
mov edi, edx
add edi, esi
add edi, 0xc4
mov esi, dword [edi]
imul edi, eax, 0x150
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x150
add edx, ebx
add edx, 4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.100db446
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x11f
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x100daff5
lea eax, [0x101b607f]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x101cf8c8], 0x1ed
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.100db4e1
mov eax, dword [0x101cf8c4]
add eax, 0xfffff7bb
mov dword [0x101cf8c4], eax
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x144]
mov dword [esp + 0xc], edx
call fcn.100dc1a5
xor eax, eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x3fee9
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x15f400
mov ecx, dword [ebp - 0x148]
add ecx, 0x31018
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f50
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100db142
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x101cf8c4]
add eax, 0xfffffdcf
mov dword [0x101cf8c4], eax
call fcn.1000108e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x100db20b
jmp 0x100db195
mov eax, dword [esp + 0x28]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
jmp 0x100db2b1
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x94], ecx
mov dword [0x101cf8c8], 0x2382
mov edx, dword [esp + 0x1c]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x60], esi
mov dword [0x101cf8c4], 0x17e8
mov esi, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.100dbd75
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x101cf8c4]
add ecx, 0xfffff71a
mov dword [0x101cf8c4], ecx
mov dword [esp + 0x18], eax
jmp 0x100db2e1
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
mov dword [0x101cf8c8], 0xcff
call fcn.100db9fa
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x100db2e1
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.100daea4
lea ecx, [esp + 0x40]
mov edx, dword [esp + 0x30]
add ecx, 0x3c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
lea eax, [0x100dc3b7]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
mov dword [esp + 0x40], 0x15f400
mov esi, dword [0x101cf8b0]
mov dword [esp + 0x44], esi
mov esi, dword [0x101cf8b4]
mov dword [esp + 0x74], esi
mov esi, dword [0x101cf8b8]
mov dword [esp + 0x78], esi
mov esi, dword [0x101cf8bc]
mov dword [esp + 0x68], esi
mov esi, dword [0x101cf8c0]
mov dword [esp + 0x64], esi
mov dword [0x101cf8c4], 0xfffff70e
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov dword [esp + 0x28], eax
jne 0x100db176
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x1c], ecx
je 0x100db19f
jmp 0x100db176
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
jmp 0x100db195
Function at 0x100db4e1
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x101cf8d0], 0
mov byte [0x101cf8d4], 0
mov dword [0x101cf8c4], 0x2002
mov dword [0x101cf8c8], 0xf6c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x101cf8cc], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101cf8c4], 0x142c
mov eax, dword [0x101cf8cc]
add eax, 1
mov dword [0x101cf8cc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100db530
jmp 0x100db579
mov eax, dword [0x101cf8c8]
add eax, 0xffffeb75
mov dword [0x101cf8c8], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x101cf8c8], 0x1a2c
mov dword [0x101cf8cc], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101cf8d8], 0
mov edx, dword [0x101cf8d0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x101cf8d8], edi
mov dword [0x101cf8c8], 0x232c
mov eax, edi
cdq
idiv ecx
mov dword [0x101cf8d0], edx
mov dword [0x101cf8c4], 0x347
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x101cf8d4], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x101cf8d4]
mov edx, dword [0x101cf8d0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x101cf8cc]
add edx, 1
mov dword [0x101cf8cc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x100db592
jmp 0x100db562
Function at 0x100db9fa
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x101cf8c8]
mov edi, esi
add edi, 0xffffde83
mov dword [0x101cf8c4], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
jmp 0x100dba69
mov eax, dword [ebp - 0x24]
mov dword [0x101cf8c8], 0x9f
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
je 0x100dba98
jmp 0x100dbb42
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], edx
je 0x100dba42
mov eax, dword [ebp - 0x30]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jl 0x100dba69
jmp 0x100dba42
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
jne 0x100dbb42
mov dword [0x101cf8c8], 0x1815
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
jne 0x100dbb42
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
jne 0x100dbb42
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
jne 0x100dbb42
mov eax, dword [ebp - 0x1c]
add eax, 0xffffdce0
mov dword [0x101cf8c4], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x100dbb42
mov eax, 1
mov ecx, 0xadf
mov dword [0x101cf8c4], 0xadf
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], eax
je 0x100dbb54
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
add eax, 0xfffff184
mov dword [0x101cf8c8], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x100dbd75
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x101b6071]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.100db649
mov eax, dword [0x101cf8c4]
add eax, 0xffffe70f
mov dword [0x101cf8c4], eax
call fcn.100db94e
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.100db2ee
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0
jne 0x100dbdea
xor eax, eax
add esp, 0x50
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x101cf8c4]
add ecx, 0x1acf
mov dword [0x101cf8c4], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.100dbb80
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x10], ecx
mov dword [0x101cf8c4], 0x112
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x4c], ecx
add ecx, 0x1e1e
mov esi, dword [ebp - 0x40]
cmp esi, 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x100dbe87
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x100dc02b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [0x101cf8c4]
add ecx, 0x4b29
mov dword [0x101cf8c4], ecx
mov dword [ebp - 0x10], eax
call fcn.100db758
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x101cf8c8], 0x47e5
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x101cf8c4], 0x660
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x100dc19a
jmp 0x100dc122
mov eax, dword [ebp - 0x28]
add eax, 1
mov cl, byte [ebp - 0x29]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x30], eax
jne 0x100dc13e
jmp 0x100dc16b
xor eax, eax
mov ecx, dword [ebp - 0x34]
add ecx, 2
mov edx, dword [ebp - 0x38]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x24], eax
jae 0x100dc19a
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
xor esi, esi
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + eax*4]
add edx, 0x24f8
mov dword [0x101cf8c4], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x30], esi
jmp 0x100dc13e
mov eax, 0x660
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x40], ecx
jmp 0x100dc0f4
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x29], bh
mov byte [ebp - 0x2a], cl
jne 0x100dc099
mov al, byte [ebp - 0x2a]
test al, 1
jne 0x100dc177
jmp 0x100dc0c6
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x101cf8c4], 0xc39
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100dc1a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101cf8cc], 0
mov dword [0x101cf8d0], 0
mov dword [0x101cf8dc], 0
mov dword [0x101cf8c8], 0x14e0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x100dc216
mov dword [0x101cf8c8], 0xe7d
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x101cf8c4], 0xb69
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101cf8cc], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101cf8d0], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101cf8d4], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x101cf8c4], 0x226c
mov cl, byte [0x101cf8d4]
mov edx, dword [0x101cf8d0]
mov byte [edi + edx], cl
mov edx, dword [0x101cf8cc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101cf8d0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101cf8dc], ebx
mov dword [0x101cf8c4], 0x11c5
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x38], edx
je 0x100dc204
mov eax, dword [0x101cf8cc]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x101cf8d0]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x100dc216
Function at 0x4030a0
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x4030b4
inc dword [0x4a7e4c]
add dword [0x4a4440], 0xe8
mov edx, dword [0x4a4440]
push esi
push edi
mov ecx, 0x3a
mov esi, 0x4a6990
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4030e3
push 0
mov eax, 0x4a9d50
call fcn.00414dc0
cmp dword [0x4a7e7c], 0
mov dword [0x4aa338], 0
mov dword [0x4aa33c], 0
je 0x40310b
push 0x4a84e8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 0x10], 0
jne 0x40318f
or ecx, 0xffffffff
cmp byte [esi + 0xca], 0
jne 0x40313a
xor eax, eax
cmp byte [esp + 0x14], 0x64
sete al
mov byte [esi + 0xca], al
test al, al
je 0x40313a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4aa344], 0
je 0x40314c
cmp dword [0x4aa340], 0
jne 0x403155
cmp byte [esi + 0xca], 0
je 0x40318f
cmp byte [esi + 0xca], 0
mov byte [esi + 0xc8], 0
jne 0x40318f
cmp dword [0x4aa344], 0
jge 0x403177
pop edi
mov dword [esi + 0xbc], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb8], eax
mov edx, dword [0x4aa344]
mov dword [esi + 0xbc], edx
pop edi
pop esi
ret
Function at 0x403e20
Capabilities:
Write clipboard data

Disassembly:
cmp dword [0x4a9d40], 0
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
je 0x403e38
pop ebp
xor eax, eax
pop ebx
ret 4
push esi
test ebp, ebp
je 0x403e85
cmp ebx, 0xffffffff
jne 0x403e52
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403e47
sub eax, edx
mov ebx, eax
test ebx, ebx
je 0x403e85
push edi
lea edi, [ebx + 1]
mov esi, 0x4a9d34
call fcn.00403ea0
pop edi
test eax, eax
jne 0x403e6f
pop esi
pop ebp
pop ebx
ret 4
mov eax, dword [0x4a9d40]
push ebx
push ebp
push eax
mov esi, eax
call fcn.00485ee0
add esp, 0xc
mov byte [esi + ebx], 0
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4a9d34
jmp fcn.00403f10

Function at 0x403f10
Capabilities:
Write clipboard data

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x18], edi
jne 0x403f34
push esi
call fcn.004041f0
test eax, eax
jne 0x403f34
push str.Cant_open_clipboard_for_writing.
call fcn.00404020
pop edi
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x403f6e
cmp dword [esi + 0x18], edi
je 0x403f5f
cmp dword [esi + 8], edi
je 0x403f54
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
push 0x4969e0
call fcn.00404020
pop edi
pop esi
ret 4
mov ecx, dword [esi + 4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp ecx, edi
je 0x403fb1
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x403fd9
cmp dword [esp + 0x10], 0xd
push ebx
jne 0x403f90
cmp word [eax], di
jmp 0x403f93
cmp byte [eax], 0
push ecx
sete bl
call ebp
test bl, bl
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
pop ebx
je 0x403fd9
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], edi
je 0x403fce
cmp dword [esi + 8], edi
je 0x403fc3
mov edx, dword [esi]
push edx
call ebp
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
pop ebp
pop edi
mov eax, 1
pop esi
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x403ff1
mov dword [esi + 4], edi
jmp 0x403fb1
cmp dword [esi + 0x18], edi
je 0x40400e
cmp dword [esi + 8], edi
je 0x404003
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
push 0x4969f0
call fcn.00404020
pop ebp
pop edi
pop esi
ret 4
Function at 0x4040f0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x108
test esi, esi
je 0x404100
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x4041cf
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.004839c0
add esp, 0xc
test eax, eax
je 0x4041c6
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00482f41
add esp, 8
test eax, eax
je 0x4041c6
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00482f41
add esp, 8
test eax, eax
je 0x4041c6
lea edx, [esp]
push str.Native
push edx
call fcn.00482f41
add esp, 8
test eax, eax
je 0x4041c6
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00482f41
add esp, 8
test eax, eax
je 0x4041c6
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.00482f41
add esp, 8
test eax, eax
je 0x4041bc
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.00482f41
add esp, 8
test eax, eax
jne 0x4041d3
test esi, esi
je 0x4041c6
mov dword [esi], 1
xor eax, eax
add esp, 0x108
ret
mov byte [esp], 0
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x108
ret

Function at 0x4041f0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0
je 0x404202
mov eax, 1
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [0x4a7ce0]
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
push ecx
mov edi, eax
call ebx
test eax, eax
jne 0x404270
mov eax, dword [0x4a43a0]
cmp eax, 0xffffffff
je 0x404241
test eax, eax
je 0x404286
call esi
mov edx, dword [0x4a43a0]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x404286
push 1
push 0x8000012f
mov dword [0x4a43a4], 0
call fcn.00401280
mov eax, dword [0x4a7ce0]
add esp, 8
push eax
mov dword [0x4a43a4], 1
call ebx
test eax, eax
je 0x404222
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ecx + 0x18], 1
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 4