joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412d96
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x4187bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x428], 0xf
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
lea ecx, [ebp - 0x484]
mov dword [ebp - 4], ebx
call fcn.004077d0
mov ecx, dword [ebp + 8]
push 1
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x444]
mov dword [ebp - 0x448], ecx
push eax
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 1
mov dword [ebp - 0x444], 0x64
call fcn.00407680
push 0xfde9
lea ecx, [ebp - 0x440]
push ecx
push esi
call fcn.00403870
add esp, 0xc
push 1
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x444], 0xc9
call fcn.00407550
push 0xfde9
lea ecx, [ebp - 0x440]
push ecx
push edi
call fcn.00403870
add esp, 0xc
push 1
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x444], 0xca
call fcn.00407550
mov edx, dword [ebp - 0x44c]
push 0xfde9
lea ecx, [ebp - 0x440]
push ecx
push edx
call fcn.00403870
add esp, 0xc
push 1
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x44c]
push ecx
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x44c], 0xcb
call fcn.00407550
push ebx
lea edx, [ebp - 0x448]
push edx
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x448], ebx
call fcn.00406200
mov edi, eax
cmp edi, ebx
je 0x4044cc
cmp dword [ebp - 0x448], ebx
je 0x4044cc
push 0x410
lea eax, [ebp - 0x422]
push ebx
push eax
mov word [ebp - 0x424], bx
call fcn.00408110
lea ecx, [ebp - 0x424]
push 0x208
push ecx
call fcn.004028f0
add esp, 0x14
cmp eax, ebx
je 0x404450
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], bl
call fcn.00407d80
cmp dword [ebp - 0x428], 0x10
jb 0x4044f2
mov edx, dword [ebp - 0x43c]
push edx
jmp 0x4044ea
push 0x4144dc
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push ebx
push 4
push ebx
push 3
push 0xc0000000
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4044b1
push 2
push ebx
push ebx
push esi
mov dword [ebp - 0x450], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x448]
push ebx
lea edx, [ebp - 0x450]
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], bl
call fcn.00407d80
lea ecx, [ebp - 0x440]
call fcn.004063b0
jmp 0x4044f2
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], bl
call fcn.00407d80
cmp dword [ebp - 0x428], 0x10
jb 0x4044f2
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.00408087
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004080f8
mov esp, ebp
pop ebp
ret
Function at 0x407e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x407f93
mov edx, dword [ebp + 0x10]
test edx, edx
jle 0x407f93
cmp edx, 8
push esi
mov esi, dword [ebp + 8]
not esi
jl 0x407f65
push ebx
push edi
mov edi, edx
shr edi, 3
mov eax, edi
neg eax
lea edx, [edx + eax*8]
jmp 0x407e90
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x414580]
add ecx, 1
sub edi, 1
mov esi, eax
jne 0x407e90
pop edi
pop ebx
test edx, edx
je 0x407f8c
lea esp, [esp]
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x414580]
add ecx, 1
sub edx, 1
jne 0x407f70
mov eax, esi
not eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
ret

Function at 0x40818a
Capabilities:
Encode data using xor

Disassembly:
adc al, 6
sub edx, dword [ebx + 0x1971fcfa]
xor eax, 0x86a61767
pop ebp
clc
out 0x15, al
inc ecx
sub cl, 0x52
sbb ecx, ecx
dec edi
clc
adc al, 0x52
push ds
scasd eax, dword es:[edi]
out 0xe9, al
or edi, ecx
int1
dec ecx
mov dword [eax], edi
jno 0x408167
aam 0xda
rol dword [esi - 0x5f], cl
push esi
mov eax, 0xbba65bd3
ror dword [ebp + 0x54], cl
or byte [edi + 3], 0x1e
sal byte [edi], cl
cdq
sbb bl, byte [esi]
jne 0x4081ee
xor byte [eax - 0x2e3b97f4], cl
sti
xchg ebx, eax
sbb al, 0xd5
cmpsb byte [esi], byte es:[edi]
or al, 0xdd
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
loopne 0x408224
aas
fist word [edx + edi*2 - 0x20ed5318]
mov byte [ebx], bl
xlatb
loopne fcn.00408205
mov eax, dword [0xca9c1acd]
xor byte [edx + ebp*8], bl
and ah, dh
je 0x4081cd
hlt
movsb byte es:[edi], byte [esi]
xor byte [ebp - 0xa], al
xchg ebp, eax
cmp dword [esi - 0x1cbaba32], ecx
aad 0x2f
jp 0x4081ce
push ecx
jmp 0x40817f
ret 0x4cfb
Function at 0x408c39
Capabilities:
Encode data using xor

Disassembly:
pop ecx
or edx, dword [ecx + 0x1c]
mov bh, 0x68
mov bl, 0x38
xor esi, 0x28c9d46e
lds edx, [esi - 0x78964409]
jge 0x408c11
push ss
loop 0x408c62
and al, 0xe7
pushfd
inc edx
mov dh, 0xf1
sti
ret
imul ebp, dword [ebp + 0x14e39f1a], 0x748351ab
xor dword [eax], eax
push eax
lodsd eax, dword [esi]
sbb bl, byte [edi + 0x51ab14e3]
xor dword [ecx + esi], 0x50
div dword [esi]
sbb byte [edi - 0x5ba28770], 0xe
push esp
and edi, edx
inc edx
stc
or al, 0x57
mov dword [ecx + 0xe], ecx
or edi, edx
popal
inc esp
dec edi
daa
fisttp qword [eax - 0x67]
sar byte [edi - 0x2c], 0xe2
aaa
jg 0x408c38
loop 0x408c9d
cmp byte [edx], bl
lcall 0xc1f7, 0xa8a415be
cdq
je 0x408c15
insb byte es:[edi], dx
adc dword [ebp - 0x54], eax
les esi, [eax + 0x5fbe016]
scasb al, byte es:[edi]
fmul st(1), st(0)
and dword [ecx], 0xccf2c6b6
sbb ch, bh
xchg ecx, eax
xchg cl, al
mov al, 0x45
adc dword [ebp - 0x67], eax
and eax, 0xe8506392
rol bl, 1
salc
inc ebp
aad 0x29
aas
invalid
fldcw word [ecx]
jl 0x408ccf
and al, 0x8b
xchg edx, eax
xlatb
aad 0x84
xchg esp, eax
outsd dx, dword [esi]
inc ebx
jge 0x408cf0
inc edi
iretd
xchg dword [eax + ebx*4 + 0x53], esp
daa
adc byte [ebx - 0x61d5c419], dl
invalid
cmp al, 0xd8
or dword [edx + 0x3f9b4db6], ecx
pushfd
mov ah, 0x2d
out dx, al
Function at 0x402ae4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404214
test esi, esi
jne 0x402b1a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404304
jmp 0x402b38
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029f8
mov edi, eax
test esi, esi
je 0x402b38
cmp dword [ebx], 0
je 0x402b38
dec esi
jmp 0x402b21
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e14
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4d6008], 0x8088405
inc edx
mov dword [ebx + 0x4d6008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d6024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403328
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403308
xor eax, eax
push ebp
push 0x403301
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403344
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403308
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4d6024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d6024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403ff4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4dc04c], 0
je 0x404055
cmp word [0x4dc220], 0xd7b2
jne 0x40401d
cmp dword [0x4dc228], 0
jbe 0x40401d
mov eax, 0x4dc21c
call dword [0x4dc238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d6070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40407c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d6034], 0
jne 0x404071
push 0
push 0x4d6068
push 0x4d6070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4041c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027b0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4dc04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404190
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4060cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406132
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404484
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e30
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40611c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406139
lea eax, [ebp - 0x10]
call fcn.00404214
ret

Function at 0x408e64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004046d4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408e7d
test al, 0x10
jne 0x408e81
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c28c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c2c5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404304
jmp 0x40c2ce
mov eax, ebx
mov edx, esi
call fcn.00404268
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c2d8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c2f9
mov al, byte [esp]
jmp 0x40c2fb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c980
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c7f8
mov eax, dword [0x4dae50]
cmp byte [eax], 0
je 0x40c9fc
mov eax, dword [0x4daaf4]
call fcn.00402c80
call fcn.00402924
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409188
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ca44
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ca32
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4daa68]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4dc668]
call fcn.0040559c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d2ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d3c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042ac
lea eax, [ebp - 8]
call fcn.00404724
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046d4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d3ac
mov eax, ebx
call fcn.004027b0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d3a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046d4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d38f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d3d4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d38f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3ac
mov eax, dword [ebp - 0x10]
call fcn.004027d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3c9
lea eax, [ebp - 8]
call fcn.00404214
ret

Function at 0x40d980
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d9e4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404484
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408ac4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d9eb
lea eax, [ebp - 0xc]
call fcn.00404214
ret

Function at 0x41fbbc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4dc888
cmp dword [edi], 0
jne 0x41fc38
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4dc884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4d6480
mov ecx, 2
call fcn.004029b8
mov edx, 0x41fb94
lea eax, [esi + 5]
call fcn.0041fbb4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041fbb4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41fc0d
mov dword [0x4dc884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42128c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x421292
ret
Function at 0x423d10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x423d61
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x423d48
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x423d38
jmp 0x423d61
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x423d49
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d414
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004046c4
xor eax, eax
push ebp
push 0x42d542
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42d515
xor eax, eax
push ebp
push 0x42d50e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004044d4
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42d4e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x42d4d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004044d4
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004046d4
mov edx, ebx
pop ecx
call fcn.004029b8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d4d9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4da9b8]
mov dl, 1
mov eax, dword [0x4076c8]
call fcn.0040cb10
call fcn.00403bac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d549
lea eax, [ebp - 4]
call fcn.00404214
ret
Function at 0x42d550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d701
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004048c4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42d718
call fcn.00404520
mov eax, ebx
call fcn.0041f150
mov edi, eax
dec edi
test edi, edi
jl 0x42d608
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041f124
mov edx, dword [0x436da0]
call fcn.004035ac
test al, al
je 0x42d604
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041f124
lea edx, [ebp - 0x14]
call fcn.00444434
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004048c4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404594
inc esi
dec edi
jne 0x42d5b6
mov al, byte [0x42d71c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42d728
mov eax, dword [ebp - 0xc]
call fcn.0040df58
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004042ac
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00444434
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42d718
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00444434
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42d718
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42d718
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42d734
call fcn.00409c00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d708
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404238
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404238
lea eax, [ebp - 0x14]
call fcn.00404214
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404238
ret
Function at 0x4323a4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43250d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004042ac
mov eax, dword [ebp - 0x10]
call fcn.00431ff4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4323f6
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404774
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004327ac
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4324cb
xor eax, eax
push ebp
push 0x4324c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004321a0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0043253c
test al, al
je 0x4324a2
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00404304
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4324a2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004046d4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x43249c
mov eax, dword [ebp - 0x14]
call fcn.004046d4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040440c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004323a4
dec ebx
cmp ebx, 0xffffffff
jne 0x432455
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4324cb
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004321a0
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.004046d4
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0043218c
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432514
lea eax, [ebp - 0x3c]
call fcn.00404214
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404238
ret