joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444b78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x444cf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f6
jb 0x444bd7
cmp byte [ebp - 5], 0x80
jb 0x444bd7
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
xor edx, edx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.00403418
xor ecx, ecx
mov cl, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f4
jb 0x444cca
cmp byte [esi + 0x37], 0
je 0x444c3a
mov eax, dword [0x56fb20]
mov edx, dword [esi + 0x33]
call fcn.004057c4
je 0x444c29
mov eax, dword [esi + 0x33]
call fcn.00437658
mov eax, 0x56fb20
mov edx, dword [esi + 0x33]
call fcn.004053f0
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.004376f8
jmp 0x444c73
cmp byte [ebx], 0
je 0x444c73
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405600
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00437a60
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x444d10
call fcn.004056c4
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.00405654
cmp byte [ebp - 6], 0
je 0x444cdc
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00405600
push dword [ebp - 0x1c]
push 0x444d1c
lea ecx, [ebp - 0x120]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00444b78
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
call fcn.00405600
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405738
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0xff
call fcn.00405654
jmp 0x444cdc
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x444cdc
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x444cd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444cfe
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004053c0
ret

Function at 0x448ca8
Capabilities:
Hide graphical window

Disassembly:
push ebx
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00442ac8
mov ebx, eax
test ebx, ebx
je 0x448d01
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x448cea
push 0
push 0xf120
push 0x112
push ebx
call sub.user32.dll_PostMessageA
call fcn.00448c48
push 5
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_SetForegroundWindow
jmp 0x448d01
push ebx
call sub.user32.dll_GetLastActivePopup
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
je 0x448d01
push ebx
call sub.user32.dll_SetForegroundWindow
pop ebx
ret
Function at 0x44b630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x180]
mov ecx, 0x5e
rep movsd dword es:[edi], dword [esi]
mov edi, eax
xor eax, eax
push ebp
push 0x44b71f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x44b738
lea eax, [ebp - 0x184]
call fcn.00440fd0
push dword [ebp - 0x184]
push 0x44b744
push edi
lea edx, [ebp - 0x188]
mov eax, ebx
call fcn.0040c878
push dword [ebp - 0x188]
lea eax, [ebp - 4]
mov edx, 5
call fcn.00405738
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00405878
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x44b6ef
push 0
lea eax, [ebp - 8]
push eax
push 0x178
lea eax, [ebp - 0x180]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
inc ebx
cmp ebx, 4
jne 0x44b66e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b726
lea eax, [ebp - 0x188]
mov edx, 2
call fcn.004053c0
lea eax, [ebp - 4]
call fcn.0040539c
ret

Function at 0x44ec84
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
cmp byte [0x5582a8], 0
jne 0x44ecd1
xor esi, esi
mov edx, 0x56fdd8
mov eax, esi
mov ebx, 8
test al, 1
je 0x44ecb7
shr eax, 1
xor eax, 0xedb88320
jmp 0x44ecb9
shr eax, 1
dec ebx
jne 0x44ecaa
mov dword [edx], eax
inc esi
add edx, 4
cmp esi, 0x100
jne 0x44eca3
mov byte [0x5582a8], 1
mov eax, dword [esp + 4]
dec eax
test eax, eax
jl 0x44ecfe
inc eax
xor esi, esi
mov edx, dword [esp]
movzx edx, byte [edx + esi]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x56fdd8]
shr edi, 8
xor edx, edi
mov edi, edx
inc esi
dec eax
jne 0x44ecdd
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x44fde8
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
mov eax, dword [ebx]
call fcn.00405878
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.0040548c
add esp, 0x800
pop ebx
ret
Function at 0x451ba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
mov eax, dword [ebp - 8]
call fcn.00405868
mov eax, dword [ebp - 0xc]
call fcn.00405868
xor eax, eax
push ebp
push 0x451d9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x451db4
mov eax, 0x80000000
call fcn.0042bd1c
lea eax, [ebp - 0x14]
call fcn.0044fde8
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00403ac0
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x10
call fcn.00403ac0
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], 3
lea eax, [ebp - 0x1c]
mov ecx, dword [0x56f928]
mov edx, 0x451dd8
call fcn.004056c4
push 0x451de8
push dword [ebp - 4]
push 0x451df8
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 8]
call fcn.00451abc
push dword [ebp - 0x78]
push 0x451e0c
lea eax, [ebp - 0x80]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.004056c4
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00451abc
push dword [ebp - 0x7c]
lea eax, [ebp - 0x10]
mov edx, 6
call fcn.00405738
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x451e1c
mov eax, dword [ebp - 0x14]
call fcn.0042bad8
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x4000020
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405878
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x451d52
xor ebx, ebx
mov eax, dword [ebp - 0x74]
mov esi, eax
push 0x2710
push eax
call sub.user32.dll_WaitForInputIdle
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x6c]
call fcn.00442ac8
test eax, eax
je 0x451d21
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call sub.user32.dll_SetWindowPos
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0xffffffff
je 0x451d3e
lea eax, [ebp - 0x20]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x451d6f
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x84]
call fcn.00410874
mov edx, dword [ebp - 0x84]
mov al, 4
call fcn.004427c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451da1
lea eax, [ebp - 0x84]
mov edx, 4
call fcn.004053c0
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004053c0
ret
Function at 0x4529e8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4529f0
push ebx
push esi
mov esi, 0x56f868
xor eax, eax
push ebp
push 0x452c90
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x56fad9], 1
mov eax, dword [0x56fb28]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x56fb2c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x56fb30]
mov edx, dword [eax]
call dword [edx + 0x44]
call fcn.00442904
call fcn.00451958
xor eax, eax
push ebp
push 0x452c6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x56fda8]
call fcn.00446284
xor eax, eax
push ebp
push 0x452c49
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00446350
xor eax, eax
push ebp
push 0x452c1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [esi]
cmp byte [eax + 0x1e0], 0
je 0x452a9c
mov al, 1
call fcn.00452920
mov eax, dword [esi]
cmp byte [eax + 0x1e0], 0
je 0x452a9c
push ebp
call fcn.004521f8
pop ecx
and bl, al
mov eax, dword [esi]
cmp byte [eax + 0x1e1], 0
je 0x452ad8
mov eax, dword [esi]
cmp byte [eax + 0x1e0], 0
je 0x452abd
mov eax, dword [esi]
cmp byte [eax + 0x1be], 0
je 0x452ac4
xor eax, eax
call fcn.00452920
mov eax, dword [esi]
cmp byte [eax + 0x1e1], 0
je 0x452ad8
push ebp
call fcn.00452808
pop ecx
and bl, al
test bl, bl
jne 0x452af1
mov eax, dword [esi]
test byte [eax + 0x205], 0x20
je 0x452af1
mov eax, dword [0x56f928]
call fcn.00442b64
mov eax, dword [esi]
test byte [eax + 0x1c2], 2
je 0x452b6e
test bl, bl
je 0x452b38
push 0x242040
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [esi]
call fcn.0042ca5c
mov eax, dword [ebp - 0x10]
call fcn.00405878
push eax
lea ecx, [ebp - 0x14]
mov dl, 0x5e
mov eax, dword [esi]
call fcn.0042ca5c
mov eax, dword [ebp - 0x14]
call fcn.00405878
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x452b6e
push 0x242010
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [esi]
call fcn.0042ca5c
mov eax, dword [ebp - 0x18]
call fcn.00405878
push eax
lea ecx, [ebp - 0x1c]
mov dl, 0x5f
mov eax, dword [esi]
call fcn.0042ca5c
mov eax, dword [ebp - 0x1c]
call fcn.00405878
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [esi]
test byte [eax + 0x205], 0x40
je 0x452be2
test bl, bl
jne 0x452be2
mov eax, dword [esi]
test byte [eax + 0x1c3], 2
je 0x452bb1
lea eax, [ebp - 0x20]
call fcn.00451fe8
mov eax, dword [ebp - 0x20]
call fcn.00405878
push eax
lea eax, [ebp - 0x24]
call fcn.004460c8
mov eax, dword [ebp - 0x24]
call fcn.00405878
push eax
call sub.kernel32.dll_MoveFileA
jmp 0x452bc7
lea eax, [ebp - 0x28]
call fcn.00451fe8
mov eax, dword [ebp - 0x28]
mov edx, dword [0x56fb28]
call fcn.00451ef8
lea eax, [ebp - 0x30]
call fcn.00451fe8
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040d234
mov eax, dword [ebp - 0x2c]
call fcn.00452074
mov eax, dword [esi]
test byte [eax + 0x1c3], 2
je 0x452bfd
lea eax, [ebp - 0x34]
call fcn.004460c8
mov eax, dword [ebp - 0x34]
call fcn.0040d0dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c22
lea eax, [ebp - 0x38]
call fcn.004461d8
mov eax, dword [ebp - 0x38]
call fcn.0040d0dc
ret
Function at 0x452f30
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040560c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45386c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4538e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x4538ec]
call fcn.0040348c
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040c964
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x4538f8
call fcn.004056c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4538e7
lea eax, [ebp - 0x24]
call fcn.0040539c
ret

Function at 0x4538fc
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x453970
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x45397c]
call fcn.0040348c
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040c964
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x453988
call fcn.004056c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453977
lea eax, [ebp - 0x24]
call fcn.0040539c
ret
Function at 0x45853c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x458638
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, pe_nt_image_headers32
push ebx
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x45860b
mov eax, esi
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040560c
lea eax, [ebp - 0x10c]
call fcn.004584e4
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.0040c3d4
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 4]
call fcn.0040c664
mov edx, dword [ebp - 4]
mov eax, 0x458650
call fcn.004059bc
test eax, eax
jle 0x458612
push 0xfffffffffffffff0
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_GetWindowLongA
test al, 0x20
je 0x458612
mov eax, dword [esi]
call fcn.00405678
mov edi, eax
test edi, edi
jbe 0x458612
mov ebx, 1
mov eax, esi
call fcn.004058d0
mov byte [eax + ebx - 1], 0x2a
inc ebx
dec edi
jne 0x4585f9
jmp 0x458612
mov eax, esi
call fcn.0040539c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45863f
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.004053c0
lea eax, [ebp - 4]
call fcn.0040539c
ret

Function at 0x45b404
Capabilities:
Terminate thread

Disassembly:
call fcn.0042be70
test al, al
jne 0x45b461
cmp dword [0x56f8fc], 0
je 0x45b461
mov eax, dword [0x56f8fc]
call fcn.00428614
mov eax, dword [0x56c668]
call fcn.00442e40
test al, al
jne 0x45b440
push 0xffffffffffffffff
mov eax, dword [0x56f8fc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x45b450
push 1
mov eax, dword [0x56f8fc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x56f8fc]
call fcn.0040444c
xor eax, eax
mov dword [0x56f8fc], eax
ret
Function at 0x45b72c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
lea esi, [ebp - 8]
call fcn.0044380c
mov dword [esi], eax
mov eax, dword [esi]
mov ebx, dword [eax]
dec ebx
jmp 0x45b746
dec ebx
test ebx, ebx
jl 0x45b755
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp dword [eax + ebx*8], 0
je 0x45b745
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov eax, dword [eax + ebx*8]
test eax, eax
je 0x45b7a0
mov dword [0x56f888], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea eax, [eax + ebx*8]
call fcn.0045b5c0
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea eax, [eax + ebx*8]
call fcn.0045b5c0
mov dword [0x56f8d0], eax
mov eax, 0x45b6e4
mov edx, dword [0x56f8d0]
mov dword [edx], eax
mov eax, dword [esi]
mov ebx, dword [eax]
dec ebx
jmp 0x45b7a8
dec ebx
test ebx, ebx
jl 0x45b7b8
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp dword [eax + ebx*8 + 4], 0
je 0x45b7a7
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov eax, dword [eax + ebx*8 + 4]
test eax, eax
je 0x45b7f4
mov dword [0x56f88c], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea eax, [eax + ebx*8 + 4]
call fcn.0045b5c0
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0x45b71c
mov edx, dword [esi]
mov edx, dword [edx + 4]
mov dword [edx + ebx*8 + 4], eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45dbf4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x45dbfa
ret

Function at 0x4600f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x460149
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x460130
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x460120
jmp 0x460149
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x460131
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469704
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x469832
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x469805
xor eax, eax
push ebp
push 0x4697fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405678
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4697d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4697c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405678
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00405878
mov edx, ebx
pop ecx
call fcn.00403168
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4697c9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x56a890]
mov dl, 1
mov eax, dword [0x40b6f8]
call fcn.0041116c
call fcn.00404cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469839
lea eax, [ebp - 4]
call fcn.0040539c
ret
Function at 0x469840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4699f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405a68
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x469a08
call fcn.004056c4
mov eax, ebx
call fcn.00428ce4
mov edi, eax
dec edi
test edi, edi
jl 0x4698f8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00428cb8
mov edx, dword [0x471484]
call fcn.004045e4
test al, al
je 0x4698f4
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00428cb8
lea edx, [ebp - 0x14]
call fcn.0047882c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405a68
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405738
inc esi
dec edi
jne 0x4698a6
mov al, byte [0x469a0c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x469a18
mov eax, dword [ebp - 0xc]
call fcn.0041273c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00405434
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0047882c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x469a08
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0047882c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x469a08
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x469a08
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x469a24
call fcn.0040e1f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4699f8
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004053c0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004053c0
lea eax, [ebp - 0x14]
call fcn.0040539c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004053c0
ret