joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d9d4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d9fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d9fa
xor al, al
jmp 0x40da1a
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004122c0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x41196e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x411987
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + ecx - 4]
mov dword [ebp - 4], ecx
lea esi, [eax + edi]
jmp 0x4119aa
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x4119af
inc esi
cmp esi, dword [ebp - 4]
jb 0x4119a1
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 4]
mov dword [ebp - 8], eax
jae 0x411aa4
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x411a03
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp + 0xc], eax
je 0x4119da
cmp cl, 0xff
jne 0x411a2e
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x411a3c
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x411a43
dec ecx
shl edx, cl
and edx, 7
je 0x4119cb
movzx ecx, byte [edx + 0x414fe0]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x414fd8], 0
mov cl, byte [ebx + 4]
je 0x411a2b
test cl, cl
je 0x411a2b
cmp cl, 0xff
jne 0x4119cb
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x41199c
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x411a77
movzx edi, byte [edx + 0x414fe0]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
mov eax, ebx
shr eax, cl
test al, al
je 0x411a62
cmp al, 0xff
jne 0x411a74
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x4119f5
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x41199c
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x43f6bd
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0043f86d
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x43f7bb
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x43f75e
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x43f7a1
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x43f775
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x43f790
test al, 0x40
je 0x43f787
mov ecx, dword [edi + 0x20]
jmp 0x43f78e
test al, 0x80
je 0x43f7a1
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x43f7a1
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x43f72d
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x402a1c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404098
test esi, esi
jne 0x402a52
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404188
jmp 0x402a70
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402930
mov edi, eax
test esi, esi
je 0x402a70
cmp dword [ebx], 0
je 0x402a70
dec esi
jmp 0x402a59
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d1c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x520008], 0x8088405
inc edx
mov dword [ebx + 0x520008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403198
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x520024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403230
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403210
xor eax, eax
push ebp
push 0x403209
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40324c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403210
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x520024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x520024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403efc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52504c], 0
je 0x403f5d
cmp word [0x525220], 0xd7b2
jne 0x403f25
cmp dword [0x525228], 0
jbe 0x403f25
mov eax, 0x52521c
call dword [0x525238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x520070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f84
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x520034], 0
jne 0x403f79
push 0
push 0x520068
push 0x520070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4057ac
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059dc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40582f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40582f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4058b8
xor eax, eax
push ebp
push 0x4058b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004055f4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405896
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405a18
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405896
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058b8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4059d2
cmp byte [ebp - 0xd], 0
jne 0x4058ff
cmp byte [ebp - 0x12], 0
je 0x4059d2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405918
dec ebx
cmp byte [ebx], 0x2e
je 0x405927
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405917
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4059d2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405964
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4059d2
cmp byte [ebp - 0xd], 0
je 0x4059d2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4059d2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4060d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40613e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404308
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406128
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406145
lea eax, [ebp - 0x10]
call fcn.00404098
ret

Function at 0x40b968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b9a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404188
jmp 0x40b9aa
mov eax, ebx
mov edx, esi
call fcn.004040ec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b9b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b9d5
mov al, byte [esp]
jmp 0x40b9d7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c05c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bed4
mov eax, dword [0x5242d4]
cmp byte [eax], 0
je 0x40c0d8
mov eax, dword [0x523fb8]
call fcn.00402b4c
call fcn.0040285c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408f94
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c120
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c10e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x523f40]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x525668]
call fcn.004055b8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c9bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ca92
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404130
lea eax, [ebp - 8]
call fcn.004045a8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404558
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40ca7c
mov eax, ebx
call fcn.004026f4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40ca75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404558
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40ca5f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40caa4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40ca5f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ca7c
mov eax, dword [ebp - 0x10]
call fcn.00402714
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ca99
lea eax, [ebp - 8]
call fcn.00404098
ret

Function at 0x40d05c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d0c0
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404308
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040892c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d0c7
lea eax, [ebp - 0xc]
call fcn.00404098
ret

Function at 0x41f050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x525888
cmp dword [edi], 0
jne 0x41f0cc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x525884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x520480
mov ecx, 2
call fcn.004028f0
mov edx, 0x41f028
lea eax, [esi + 5]
call fcn.0041f048
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f048
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f0a1
mov dword [0x525884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4206c8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4206ce
ret
Function at 0x422d8c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x422ddd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x422dc4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x422db4
jmp 0x422ddd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x422dc5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d438
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404548
xor eax, eax
push ebp
push 0x42d566
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42d539
xor eax, eax
push ebp
push 0x42d532
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404358
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42d507
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x42d4f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404358
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404558
mov edx, ebx
pop ecx
call fcn.004028f0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d4fd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x523e98]
mov dl, 1
mov eax, dword [0x407600]
call fcn.0040c1e0
call fcn.00403ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d56d
lea eax, [ebp - 4]
call fcn.00404098
ret
Function at 0x42d574
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d725
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404748
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42d73c
call fcn.004043a4
mov eax, ebx
call fcn.0041e5e4
mov edi, eax
dec edi
test edi, edi
jl 0x42d62c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041e5b8
mov edx, dword [0x43d228]
call fcn.004034b4
test al, al
je 0x42d628
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041e5b8
lea edx, [ebp - 0x14]
call fcn.00445cdc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404748
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404418
inc esi
dec edi
jne 0x42d5da
mov al, byte [0x42d740]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42d74c
mov eax, dword [ebp - 0xc]
call fcn.0040d634
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404130
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00445cdc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42d73c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00445cdc
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42d73c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42d73c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42d758
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d72c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004040bc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004040bc
lea eax, [ebp - 0x14]
call fcn.00404098
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004040bc
ret
Function at 0x430dd4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x430ea6
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x430e78
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x430e67
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004028f0
mov eax, dword [ebp - 4]
call fcn.00430d10
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430e6e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x430eb8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x430f2a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x430efe
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404290
jmp 0x430f05
mov eax, ebx
call fcn.00404098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430f31
cmp dword [ebp - 8], 0
je 0x430f21
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x430f60
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x431002
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x430fd5
mov edx, ebx
mov eax, dword [0x42018c]
call fcn.004249bc
test al, al
je 0x430fc5
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.004248cc
call fcn.00403b60
jmp 0x431009
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x430f90
mov ecx, dword [0x523f28]
mov dl, 1
mov eax, dword [0x407600]
call fcn.0040c1e0
call fcn.00403ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431009
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret