joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405250
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405362
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405362
cmp dword [esp + 0x2c], 0
je 0x405362
push esi
call fcn.0040cd00
add esp, 4
test eax, eax
je 0x4052ba
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4052c1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4052a0
jmp 0x4052c3
mov ebx, 0x1505
jmp 0x4052c3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x40536a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405327
call fcn.00405fc0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405362
push ecx
call fcn.0040cd00
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x4053dd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405388
inc edi
dec esi
je 0x4052dc
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x4052e1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405380
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cd00
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405380
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cd30
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405380
mov eax, 0xffffffff
jmp 0x405362
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4053f8
inc edi
dec esi
je 0x405322
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405327
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4053f0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cd00
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4053f0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cd30
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4053f0
jmp 0x405327
Function at 0x405d10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405efa
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405efa
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405efa
cmp dword [ecx], 0
jne 0x405efa
push esi
call fcn.0040cd00
add esp, 4
test eax, eax
je 0x405d7a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405d81
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405d60
jmp 0x405d83
mov edi, 0x1505
jmp 0x405d83
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405e54
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405de1
call fcn.00405fc0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405efa
push esi
call fcn.0040cd00
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405f10
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cd00
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44f008]
add esp, 4
test eax, eax
je 0x405ef5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cc00
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405efa
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405e78
inc ebx
dec edx
je 0x405d9c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405da1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405e70
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cd00
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405e70
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cd30
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405e70
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404e10
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405e49
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406fa0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407156
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40714f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x407035
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40714f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x4070b5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x407050
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406ffd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x407100
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4070e0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406ff0
jmp 0x40710f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406ff0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407120
jmp 0x406ff0
shl ecx, 0x10
or ecx, edi
jmp 0x40715b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x407170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4071ca
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4071cc
not eax
xor esi, esi
nop
nop
nop
nop
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi]
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x44cc50]
mov eax, edi
shr eax, 4
mov ebp, edi
and ebp, 0xf
shr ebx, 4
and edi, ebx
add ebx, ebp
add edi, edi
sub ebx, edi
xor eax, dword [ebx*4 + 0x44cc50]
inc esi
cmp edx, esi
jne 0x407190
not eax
jmp 0x4071cc
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40cb1c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40cafe
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40cb00
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40cae0
jmp 0x40cb00
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40cb1a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40cb1c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d3c0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00444c50
test al, al
je 0x40d5ae
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043c320
test al, al
je 0x40d5a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xa6ed989d
mov dword [esp + 8], 0x6a90d672
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d446
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d5c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d420
mov dword [esp + 4], 0x3a51a7d7
mov dword [esp + 8], 0x2c59fed1
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d496
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d630
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d470
test esi, esi
je 0x40d546
mov dword [esp], 0x999a9bb3
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x40d4e9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.0040d6b0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x40d4c0
mov dword [esp + 4], 0x1987ed53
mov dword [esp + 8], 0xc3c8bcfa
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d546
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d720
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d520
mov dword [esp + 4], 0x6e6d6c63
mov dword [esp + 8], 0x6a69686f
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40d596
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d7b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40d570
call fcn.0040ee70
test al, al
je 0x40d5a9
call fcn.00412610
call fcn.00410750
call fcn.00446130
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40dab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov ebx, dword [ecx + 0x60]
mov dword [esp + 4], 0xa1d1f
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 3
ja 0x40db0b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x10]
push eax
call fcn.0040e830
add esp, 8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 4
jb 0x40dae0
mov dword [esp + 8], 0x1210142e
mov dword [esp + 0xc], 0xd12
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 7
ja 0x40db5b
nop
nop
nop
nop
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 8]
push dword [esp + 0x10]
push eax
call fcn.0040e7b0
add esp, 8
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 8], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 8
jb 0x40db30
mov edi, dword [esp + 0x64]
mov dword [esp + 0x10], 0x3234f8ff
mov dword [esp + 0x14], 0x3e3accc0
mov dword [esp + 0x18], 0x3d3234cf
mov dword [esp + 0x1c], 0x26292231
mov dword [esp + 0x20], 0xd6211512
mov dword [esp + 0x24], 0x24cb818b
mov dword [esp + 0x28], 0x23291f26
mov dword [esp + 0x2c], 0x5ab29c1c
mov dword [esp + 0x30], 0x645b5b61
mov dword [esp + 0x34], 0x54516b5f
mov dword [esp + 0x38], 0x5b82a556
mov dword [esp + 0x3c], 0x8e4d7151
mov dword [esp + 0x40], 0x46764440
mov dword [esp + 0x44], 0x4a4497bd
mov dword [esp + 0x48], 0x8fb14847
mov byte [esp + 0x4c], 0xf0
mov dword [esp + 0x4d], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x40
ja 0x40dc26
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x10]
push dword [esp]
push eax
call fcn.0040e720
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x41
jb 0x40dc00
mov ecx, dword [esp + 0x68]
add edi, ebx
movzx edx, byte [esp + 0x10]
mov eax, edi
test dl, dl
je 0x40dc4b
lea ebx, [esp + 0x11]
mov eax, edi
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40dc40
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40dc6b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40dc60
mov ecx, dword [esp + 0x6c]
mov byte [eax], 0
movzx edx, byte [esp + 8]
test dl, dl
je 0x40dc8b
lea ebx, [esp + 9]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40dc80
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40dcab
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40dca0
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40dccb
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40dcc0
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x54
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x412610
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x4502f4]
Function at 0x42c070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042c090
add esp, 4
test al, al
je 0x42c740
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor ebp, ebp
mov esi, 0x20219
mov eax, 1
lea edi, [esp + 0x62]
jmp dword [eax*4 + 0x452174]
Function at 0x430fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x43102a
cmp edi, 1
je 0x43102a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x431001
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x431000
cmp ecx, 0x20
je 0x431000
cmp ecx, 0x2b
mov edx, edi
je 0x431020
cmp ecx, 0x2d
jne 0x43103f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x431044
xor edi, edi
test eax, eax
je 0x4311fd
mov dword [eax], 0x16
jmp 0x4311fd
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x43106d
cmp edx, 0x10
jne 0x431085
cmp byte [ebx], 0x30
jne 0x431066
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x431087
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x431087
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x4310e0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x431198
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x431107
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x4311c8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x4311c8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x4310c0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x431150
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x431159
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x43117d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x4311ad
test bl, bl
jne 0x4311ad
mov ebx, dword [esp + 0x10]
jmp 0x4310d3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x4310b5
mov esi, edi
test bl, bl
jne 0x4311bb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x4310b5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4311d6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x4311e4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x4311f4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x4311fd
cmp byte [esp + 3], 0
jne 0x4311fd
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436c50
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov dword [esp + 0x244], 0x452cbc
mov dword [esp + 0xc0], 0
lea eax, [esp + 0xc0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44dc50
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x44dc60
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x240], eax
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x240]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x23c], 0x452cc4
mov dword [esp + 0x234], 0x452ccc
mov dword [esp + 0x22c], 0x452cd4
mov dword [esp + 0x224], 0x452cdc
mov dword [esp + 0x21c], 0x452ce4
mov dword [esp + 0x214], 0x452600
mov dword [esp + 0x210], 0x88
mov dword [esp + 0x20c], 0x452cec
mov dword [esp + 0x204], 0x452600
mov dword [esp + 0x200], 0x8b
mov dword [esp + 0x1fc], 0x452600
mov dword [esp + 0x1f8], 0x8b
mov dword [esp + 0x1f4], 0x452cf4
mov dword [esp + 0x1ec], 0x452cfc
mov dword [esp + 0x1e4], 0x452600
mov dword [esp + 0x1e0], 0x8e
mov dword [esp + 0x1dc], 0x452d04
mov dword [esp + 0x1d4], 0x452d0c
mov dword [esp + 0x1cc], 0x452d14
mov dword [esp + 0x1c4], 0x452600
mov dword [esp + 0x1c0], 0x92
mov dword [esp + 0x1bc], 0x452d1c
mov dword [esp + 0x1b4], 0x452600
mov dword [esp + 0x1b0], 0x94
mov dword [esp + 0x1ac], 0x452600
mov dword [esp + 0x1a8], 0x95
mov dword [esp + 0x1a4], 0x452600
mov dword [esp + 0x1a0], 0x96
mov dword [esp + 0x19c], 0x452d24
mov dword [esp + 0x194], 0x452600
mov dword [esp + 0x190], 0x98
mov dword [esp + 0x18c], 0x452600
mov dword [esp + 0x188], 0x99
mov dword [esp + 0x184], 0x452600
mov dword [esp + 0x180], 0x9a
mov dword [esp + 0x17c], 0x452600
mov dword [esp + 0x178], 0x9b
mov dword [esp + 0x174], 0x452600
mov dword [esp + 0x170], 0x86
mov dword [esp + 0x16c], 0x452600
mov dword [esp + 0x168], 0x8f
xor ebx, ebx
jmp eax
Function at 0x4382a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
call fcn.0040ee60
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x4382c5
cmp eax, 0
setne al
jmp 0x4382cd
jmp 0x4382cf
jmp 0x4382d1
xor ebx, ebx
test al, 1
jne 0x4382dc
jmp 0x43840d
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x438407
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x438321
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0041af30
add esp, 4
mov edx, eax
jmp 0x438336
cmp edx, 0
setne al
jmp 0x43833e
xor ebx, ebx
test al, 1
jne 0x438349
jmp 0x4383fb
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0xd1
mov byte [ebp - 0x27], 0xff
mov byte [ebp - 0x26], 0xfd
mov byte [ebp - 0x25], 0xf9
mov byte [ebp - 0x24], 0xf6
mov byte [ebp - 0x23], 0xf6
mov byte [ebp - 0x22], 0xf9
mov byte [ebp - 0x21], 0x8b
mov byte [ebp - 0x20], 0xf8
mov byte [ebp - 0x1f], 0x31
mov byte [ebp - 0x1e], 0x8e
mov byte [ebp - 0x1d], 0x89
mov byte [ebp - 0x1c], 0x8c
mov byte [ebp - 0x1b], 0x1f
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x12
jne 0x43838b
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x12
jae 0x4383d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.0043c220
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x43839f
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040da30
mov bl, al
and bl, 1
jmp 0x4383fb
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret