joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d7d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e058
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4be004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.004081d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00406360
cmp dword [ebp - 0x18], 2
jbe 0x43d8d9
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 8
cmovae eax, edx
cmp word [eax], 0x5c
jne 0x43d84a
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax + 2], 0x5c
jne 0x43d84a
mov bl, 1
jmp 0x43d942
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x2f
jne 0x43d86d
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax + 2], 0x2f
je 0x43d940
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.004061d0
mov edx, dword [ebp - 0x28]
mov eax, ecx
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
jne 0x43d940
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax + 4], 0x5c
jne 0x43d940
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x61
jb 0x43d940
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x7a
ja 0x43d940
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
jmp 0x43d929
jne 0x43d940
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 8
cmovae eax, edx
cmp word [eax + 2], 0x3a
jne 0x43d940
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x61
jb 0x43d940
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, edx
cmp word [eax], 0x7a
ja 0x43d940
push 1
push 0x4ab018
lea ecx, [ebp - 0x28]
call fcn.004083a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43d940
shr eax, 4
mov bl, 1
and al, 1
mov byte [esi], al
jmp 0x43d942
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43d97f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43d975
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43d9b0
push edx
push ecx
call fcn.00466b59
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00466b67
mov esp, ebp
pop ebp
ret
call fcn.0046a99a
int3
Function at 0x440540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x44054b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00440560
Function at 0x446a00
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x494832
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4be004]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x446a44
call fcn.00446c10
cmp byte [0x4c05d0], 0
jne 0x446a57
mov eax, 0x80000001
jmp 0x446bd9
mov eax, dword [esi]
test eax, eax
jne 0x446ac2
push 8
call fcn.00466b29
mov edi, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 0
push 1
call fcn.00466b29
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 4]
push eax
call fcn.00468960
add esp, 0x14
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x446ab1
cmp dword [ebp + 4], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x446bc8
call fcn.00402ad0
test al, al
jne 0x446b04
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.004031e0
test al, al
je 0x446bc8
mov ecx, dword [esi]
add ecx, 4
call fcn.00402510
call fcn.00402ad0
test al, al
je 0x446bc8
push 0xc
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
push str.Advapi32.dll
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call fcn.004042d0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x24]
push eax
call fcn.00409300
mov ecx, eax
call fcn.004093c0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x446b8b
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446b81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446bfd
push edx
push ecx
call fcn.00466b59
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
test edi, edi
je 0x446bc8
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x446bc8
push dword [esi]
push 0x20019
call eax
test eax, eax
je 0x446bc8
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x446bd7
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.00466b67
lea esp, [ebp + 0x120]
pop ebp
ret 4
call fcn.0046a99a
int3
Function at 0x44df90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495878
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4be004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.0040aae0
test al, al
jne 0x44dff0
mov eax, 1
jmp 0x44e16d
push 0x10000
call fcn.0046725d
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.00468960
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x44e146
test ebx, ebx
je 0x44e146
cmp dword [eax], 0xffffffff
je 0x44e146
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44e146
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x44e13c
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.00466090
test al, al
je 0x44e12f
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x44e0e2
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x44e0d1
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x44e13c
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x44e0ec
add ebx, eax
cmp ebx, 0x8000
je 0x44e0fc
cmp dword [ebp - 0x28], 0xf
ja 0x44e125
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x44e080
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x44e11e
add ecx, 4
add esi, 4
sub edx, 4
jae 0x44e106
mov esi, 4
jmp 0x44e157
mov esi, 5
jmp 0x44e157
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x44e157
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x44e151
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x44e157
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x44e16b
push ebx
call fcn.00466dc3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00466b67
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4747f1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004744b1
Function at 0x402f8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47f020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403024
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403004
xor eax, eax
push ebp
push 0x402ffd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403040
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403004
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47f020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47f020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403ce8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x481048], 0
je 0x403d49
cmp word [0x48121c], 0xd7b2
jne 0x403d11
cmp dword [0x481224], 0
jbe 0x403d11
mov eax, 0x481218
call dword [0x481234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47f06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d70
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47f030], 0
jne 0x403d65
push 0
push 0x47f064
push 0x47f06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a18
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a7e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040d4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b50
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a68
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a85
lea eax, [ebp - 0x10]
call fcn.00403e64
ret

Function at 0x40ae68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aea1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f54
jmp 0x40aeaa
mov eax, ebx
mov edx, esi
call fcn.00403eb8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aeb4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aed5
mov al, byte [esp]
jmp 0x40aed7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b55c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b3d4
mov eax, dword [0x480bbc]
cmp byte [eax], 0
je 0x40b5d8
mov eax, dword [0x480904]
call fcn.004029bc
call fcn.0040283c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408570
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b620
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b60e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x480898]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x481664]
call fcn.00404f2c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40be98
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bf6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403efc
lea eax, [ebp - 8]
call fcn.00404374
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404324
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bf58
mov eax, ebx
call fcn.004026d4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bf51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404324
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bf3b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bf80
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bf3b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bf58
mov eax, dword [ebp - 0x10]
call fcn.004026f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bf75
lea eax, [ebp - 8]
call fcn.00403e64
ret

Function at 0x40c538
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c59c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040d4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408028
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c5a3
lea eax, [ebp - 0xc]
call fcn.00403e64
ret

Function at 0x41b548
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x481884
cmp dword [edi], 0
jne 0x41b5c4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x481880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47f46c
mov ecx, 2
call fcn.004028d0
mov edx, 0x41b520
lea eax, [esi + 5]
call fcn.0041b540
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b540
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b599
mov dword [0x481880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41cb70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41cb76
ret
Function at 0x41f0b4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41f105
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41f0ec
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41f0dc
jmp 0x41f105
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41f0ed
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429114
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404314
xor eax, eax
push ebp
push 0x429242
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x429215
xor eax, eax
push ebp
push 0x42920e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404124
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4291e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4291d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404124
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404324
mov edx, ebx
pop ecx
call fcn.004028d0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4291d9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x480820]
mov dl, 1
mov eax, dword [0x406eac]
call fcn.0040b704
call fcn.004038a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429249
lea eax, [ebp - 4]
call fcn.00403e64
ret
Function at 0x429250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x429401
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404514
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x429418
call fcn.00404170
mov eax, ebx
call fcn.0041aadc
mov edi, eax
dec edi
test edi, edi
jl 0x429308
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041aab0
mov edx, dword [0x436568]
call fcn.004032a0
test al, al
je 0x429304
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041aab0
lea edx, [ebp - 0x14]
call fcn.0043e680
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404514
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041e4
inc esi
dec edi
jne 0x4292b6
mov al, byte [0x42941c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x429428
mov eax, dword [ebp - 0xc]
call fcn.0040cb10
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00403efc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0043e680
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x429418
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0043e680
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x429418
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x429418
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x429434
call fcn.00408c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429408
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00403e88
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403e88
lea eax, [ebp - 0x14]
call fcn.00403e64
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e88
ret
Function at 0x42ea5c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0042e6c0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404324
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42eaba
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x480a9c]
mov dl, 1
mov eax, dword [0x42e5b8]
call fcn.0040b740
call fcn.004038a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42eac4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404324
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42eb1c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x480d34]
mov dl, 1
mov eax, dword [0x42e5b8]
call fcn.0040b740
call fcn.004038a0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042e6f0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x438d7c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x438cc8
call sub.user32.dll_EnumWindows
ret

Function at 0x438e9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x438f19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004388fc
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x438ec1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004384fc
cmp dword [ebp - 4], 0
je 0x438f03
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404324
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438f20
lea eax, [ebp - 4]
call fcn.00403e64
ret