joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d2585
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100d25bd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100d0612
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100d05ea
jmp 0x100d25c9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100d3c7b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100d3cbd
call fcn.100d9744
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100d3cbd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100d3cb4
xor eax, eax
jmp 0x100d3cc5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100d3ccb
pop edi
pop esi
pop ebx
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x1e22554c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x3651077b
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401461
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.004014b3
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
lea ebx, [ebp - 2]
or eax, 0x402054
call fcn.00401592
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x462a292f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text_1
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x5d604f64
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x429100
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [esp + 4], eax
mov al, byte [0x54d9f0]
test al, al
je 0x42916d
mov ecx, dword [0x54da60]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
and ecx, 0xffff
cmp ecx, 0xffffd7b2
push edi
jne 0x42913a
mov eax, dword [0x54bcdc]
test eax, eax
je 0x42913a
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0xc]
push 0
push edx
push 0x1d
push 0x54c9c0
push eax
call edi
push 0xfffffffffffffff5
call esi
lea ecx, [esp + 0xc]
push 0
push ecx
push 2
push 0x54da70
push eax
call edi
pop edi
pop esi
ret
mov al, byte [0x54c548]
test al, al
jne 0x429187
push 0
push 0
push 0x54c9c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret

Function at 0x48b7c7
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0xe5
js 0x48b836
out 0x46, al
push es
push ecx
mov edx, 0x559bb9f9
adc dword [eax + 0x66bb17d3], 0x44
in eax, 0xcd
inc esp
insd dword es:[edi], dx
and dword [eax + 0x292c47b9], ecx
jmp 0x174f5651
push edx
dec edx
xchg edi, eax
dec edx
aas
outsb dx, byte [esi]
adc dword [ecx], esi
aam 0xd2
sub edx, dword [esi]
invalid
cmpsb byte [esi], byte es:[edi]
imul esi, dword [edx - 0x72], 0x35
int3
push 0x6c
sbb eax, 0x45ffb24d
cld
lds ecx, [eax]
dec ecx
das
xor esi, edi
xor eax, 0x7f97847
je 0x48b829
dec ebp
push ebp
enter 0x2d8, 0xffffffffffffffe5
fnstsw word [ecx]
inc ecx
lds ecx, [esi + 0x7484d476]
xchg esi, eax
push eax
js 0x48b805
and ebx, 0x6bf96a1d
mov ecx, ecx
mov ch, byte [ebp + 0x1c]
cmc
and bl, dh
xchg esi, eax
retf

Function at 0x4ac6ce
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
stosd dword es:[edi], eax
loope 0x4ac6ff
enter 0x4aab, 0xffffffffffffffba
and eax, 0x4730544c
cmpsb byte [esi], byte es:[edi]
dec esp
push esp
xor byte [edi - 0x5a], al
inc esi
fcomi st(0)
cmpsd dword [esi], dword es:[edi]
mov dword [eax + edi*2 - 0x7a], esp
jns 0x4ac6d7
test al, 0x60
adc bh, byte [edi]
jg 0x4ac72c
int 0x64
invalid
push ebx
pop esp
xor dword [edi + ebp*2 - 0x72], 0xffffffdb
push cs
lea ecx, [eax + 0x60]
loopne 0x4ac6ff
ljmp 0xd2cb:0x332bc027
pop eax
xor eax, 0x1f101953
push ebp
dec esi
mov cl, 0xdd
mov cl, 0xde
pop ecx
adc esi, dword [eax]
stosd dword es:[edi], eax
out 0x58, al
dec ebp
inc ebx
insd dword es:[edi], dx
push ss
invalid
Function at 0x4dedab
Capabilities:
Encode data using xor

Disassembly:
mov cs, word [edx - 0x17d53532]
int3
mov byte [edi - 0x30], dl
imul byte [ecx + 0x56da3a7d]
xor ch, byte [ebx]
push 0xffffffffffffffea
loopne 0x4deda7
mov edi, 0x5469248c
jns 0x4ded46
cmp dword [edi - 8], ebx
sbb byte [eax - 0x7d], 0x69
sub byte [esi - 9], 0x99
out 0x17, eax
in al, dx
out 0xf7, eax
invalid
add al, 0xd0
mov al, 2
invalid
test dword [eax + edx*8], 0xda6202b0
cld
cmpsb byte [esi], byte es:[edi]
idiv dword [ebx - 0x40]
push 0xffffffffffffff99
sub eax, 0x9d59cde5
test byte [edi - 0x2208a674], 0x76
mov esi, 0x2864a5af
mov al, byte [0xd914d233]
mov bl, byte [ecx + 0x19d9ebaa]
sti
dec edx
xchg dword [ecx - 0x6b], ebx
pop ecx
xchg ebp, eax
aaa
fbld tbyte [esi + 0x45f07bef]
mov dword [0x9462c092], eax
out dx, al
lcall 0x76d2, 0xda4a3490
xor bh, bl
stosb byte es:[edi], al
sub eax, 0xea1d5ca7
jbe 0x4dedd8
jns 0x4ded86
pop edi
inc edx
pop edi
mov al, byte fs:[0xf3139c8c]
mov ebx, 0x3d538ff9
push esp
les esp, [edi]
movsb byte es:[edi], byte [esi]
add dh, byte [esi - 0x540ffd63]
shr dword [eax + 0xbb1f646], 1
cli
or eax, 0x9db33984
pushal
ljmp 0x8cdb

Function at 0x543b6e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x549390
cmp edx, dword [eax]
je 0x543b90
add eax, 8
inc ecx
cmp eax, 0x549420
jl 0x543b81
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x549390]
jne 0x543cbe
mov eax, dword [0x54da7c]
cmp eax, 1
je 0x543c98
test eax, eax
jne 0x543bc1
cmp dword [0x5492d4], 1
je 0x543c98
cmp edx, 0xfc
je 0x543cbe
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x543bf8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00544280
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005444b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x543c3b
lea eax, [ebp - 0x1a4]
push eax
call fcn.005444b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5476d0
push edi
call fcn.00545c80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00544280
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00544290
lea eax, [ebp - 0xa0]
push 0x5476b0
push eax
call fcn.00544290
push dword [esi + 0x549394]
lea eax, [ebp - 0xa0]
push eax
call fcn.00544290
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00545bf4
add esp, 0x2c
pop edi
jmp 0x543cbe
lea eax, [ebp + 8]
lea esi, [esi + 0x549394]
push 0
push eax
push dword [esi]
call fcn.005444b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4011b3
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448279
push dword [ebp + 8]
push dword [0x448d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448274
push dword [ebp + 8]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x448d6c]
call sub.kernel32.dll_ResumeThread
mov dword [0x448d78], 0x10007
push 0xa
call sub.kernel32.dll_Sleep
push 0x448d78
push dword [0x448d6c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x448e30], eax
jne 0x401237
jmp 0x401239
jmp 0x401213
push dword [0x448d6c]
call sub.kernel32.dll_SuspendThread
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448279
push dword [ebp + 8]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
leave
ret 4

Function at 0x40126e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448279
push dword [ebp + 8]
push dword [0x448d68]
call sub.kernel32.dll_ReadProcessMemory
push 0
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448289
push dword [0x4483c9]
push dword [0x448d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448274
push dword [ebp + 8]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448274
push dword [0x4483c9]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x448d6c]
call sub.kernel32.dll_ResumeThread
push 0xa
call sub.kernel32.dll_Sleep
mov dword [0x448d78], 0x10007
push 0x448d78
push dword [0x448d6c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x448e30], eax
jne 0x401340
jmp 0x401351
mov eax, dword [0x4483c9]
mov ebx, dword [0x448e30]
cmp eax, ebx
je 0x4013b4
jmp 0x401323
push dword [0x448d6c]
call sub.kernel32.dll_SuspendThread
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448279
push dword [ebp + 8]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448289
push dword [0x4483c9]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 0
leave
ret 4
push dword [0x448d6c]
call sub.kernel32.dll_SuspendThread
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448279
push dword [ebp + 8]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449044]
push 0
mov al, byte [0x448278]
movzx ax, al
push ax
push 0x448289
push dword [0x4483c9]
push dword [0x448d68]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 1
leave
ret 4
Function at 0x401ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f1c
xor eax, eax
leave
ret 0xc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x20
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, 1
leave
ret 0xc

Function at 0x401ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x402032
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push eax
call fcn.00402250
mov esi, eax
push esi
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push ebx
call fcn.004022d0
call sub.user32.dll_CloseClipboard
mov eax, edi
jmp 0x40203b
xor eax, eax
call sub.user32.dll_CloseClipboard
jmp 0x40203b
pop edi
pop esi
pop ebx
ret

Function at 0x40206c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402097
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40258a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x4499b0]
push edi
test esi, esi
jne 0x4025e7
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [0x4499b0], esi
xor edi, edi
push edi
push 8
pop ecx
call fcn.0040256b
pop ecx
push 8
shl eax, 0x18
pop ecx
test eax, eax
jns 0x4025cc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4025ce
add eax, eax
dec ecx
jne 0x4025bf
push eax
push 0x20
pop ecx
call fcn.0040256b
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
pop ecx
jl 0x4025af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
jmp 0x40260a
movsx edx, byte [eax]
xor edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
and edx, 0xff
shr edi, 8
xor edi, dword [esi + edx*4]
inc eax
mov dword [ebp + 0x10], edi
cmp eax, ecx
jb 0x4025f1
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret
Function at 0x4038fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.004038aa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.004038bf
lea eax, [ebp - 0x72c]
push eax
push dword [ebp + 8]
call fcn.004038bf
add esp, 0x14
push 0x70
pop ebx
lea esi, [ebp - 0x71c]
mov edi, ebx
lea eax, [esi - 0x10]
push esi
push eax
call fcn.004038bf
push esi
call fcn.00403872
add esp, 0xc
add esi, 0x10
dec edi
jne 0x403937
movsx edx, word [0x449620]
xor esi, esi
shl edx, 2
mov edi, dword [ebp + 0x10]
movsx eax, si
mov ecx, eax
add eax, edx
mov eax, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and eax, dword [ebp + ecx - 0x1c]
inc esi
mov dword [ecx + edi], eax
cmp si, 4
jb 0x40395c
mov dword [ebp - 8], 0x4497e8
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403872
and dword [ebp - 4], 0
pop ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx - 0x1c6]
movzx ecx, word [ecx]
movsx esi, cx
movsx edi, ax
shl esi, 2
shl edi, 2
movsx eax, word [ebp - 4]
mov edx, dword [ebp + 0x10]
lea ebx, [esi + eax]
mov ebx, dword [ebp + ebx*4 - 0x72c]
mov ecx, eax
add eax, edi
xor ebx, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and ebx, dword [ebp + ecx - 0x1c]
add edx, ecx
xor dword [edx], ebx
inc dword [ebp - 4]
cmp word [ebp - 4], 4
jb 0x4039af
add dword [ebp - 8], 2
dec dword [ebp - 0xc]
jne 0x403988
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ea7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
xor ecx, ecx
push esi
inc ecx
push edi
mov eax, ecx
xor edi, edi
mov esi, 0xe3
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ebf
cmp ax, cx
jne 0x403f01
mov eax, 0xe2
xor edi, edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ee5
jmp 0x403f22
push 0x71
pop edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
movzx eax, dx
mov edx, 0xe2
cmp di, dx
jl 0x403f04
mov eax, ecx
mov word [0x449620], ax
or eax, 0xffffffff
mov word [0x4497e6], ax
mov edi, ecx
mov dword [ebp - 8], 0x70
lea eax, [ecx + ecx]
cdq
mov ecx, esi
idiv ecx
movzx eax, dx
movsx ecx, ax
lea eax, [ecx + ecx]
mov edx, eax
neg edx
mov bx, word [ebp + edx - 0x10]
mov dx, word [ebp + edx - 0x14]
mov word [ebp - 0xe], dx
mov dx, word [ebp + eax - 0x1da]
mov ax, word [ebp + eax - 0x1d6]
mov word [ebp - 0xc], dx
xor edx, edx
mov word [ebp - 0x10], bx
mov word [ebp - 0xa], ax
mov dword [ebp - 4], edx
movsx eax, word [ebp - 4]
movzx eax, word [ebp + eax*2 - 0x10]
cmp ax, 0x71
jge 0x403fa3
movsx ebx, dx
imul ebx, ebx, 0xe3
add ebx, edi
mov word [ebx*2 + 0x449620], ax
inc edx
inc dword [ebp - 4]
cmp dx, 2
jl 0x403f80
inc edi
dec dword [ebp - 8]
jne 0x403f3c
push 0x70
pop ebx
xor eax, eax
push 0x10
mov word [0x449600], ax
pop eax
mov edx, eax
mov edi, 0xffff0000
mov esi, edi
and esi, ebx
je 0x403fd6
add word [0x449600], dx
mov ebx, esi
cdq
sub eax, edx
sar eax, 1
movzx edx, ax
movsx eax, dx
mov esi, edi
mov ecx, eax
shr esi, cl
xor edi, esi
test dx, dx
jne 0x403fc7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403ff3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038bf
lea eax, [ebp - 0x10]
push eax
call fcn.0040383c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038fa
mov esi, dword [ebp + 0xc]
add esp, 0x18
push dword [ebp + 0x10]
xor edi, edi
cmp word [esi], di
je 0x404042
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004038fa
add esp, 0xc
jmp 0x404048
call fcn.004038aa
pop ecx
mov edx, dword [ebp + 0x10]
movsx eax, di
mov ecx, eax
mov eax, dword [esi + eax*4 + 0x14]
shl ecx, 2
xor eax, dword [ebp + ecx - 0x20]
add edx, ecx
xor dword [edx], eax
inc edi
cmp di, 4
jb 0x404048
pop edi
pop esi
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x2fb20580
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0xa9c6a99
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219