joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429d10
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x429d2e
add esp, 0xfffffff0
call fcn.00403c50
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bdc
xor eax, eax
push ebp
push 0x429f01
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404bec
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
mov dword [esi + 0x20], edi
cmp edi, 0xffffffff
jne 0x429d96
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x429f30
call fcn.00404a38
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x425798]
call fcn.0040e054
call fcn.004040b8
push 0
push 0
push 0
push 2
push 0
mov eax, dword [esi + 0x20]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
mov dword [esi + 0x24], edi
test edi, edi
jne 0x429dd6
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x429f4c
call fcn.00404a38
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x425798]
call fcn.0040e054
call fcn.004040b8
push 0
push 0
push 0
push 4
mov eax, dword [esi + 0x24]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov dword [esi + 0x28], edi
test edi, edi
jne 0x429e29
push 0x429f78
push dword [ebp - 4]
push 0x429f94
lea eax, [ebp - 0x14]
call fcn.00426960
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404aac
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x425798]
call fcn.0040e054
call fcn.004040b8
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x28]
mov dword [esi + 0x2c], eax
mov byte [esi + 4], 0
mov edx, dword [esi + 0x2c]
xor ecx, ecx
mov eax, esi
call fcn.00429cf8
cmp eax, 0x950412de
je 0x429e74
cmp eax, 0xde120495
je 0x429e74
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x429fb4
call fcn.00404a38
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x425798]
call fcn.0040e054
call fcn.004040b8
cmp eax, 0xde120495
sete al
mov byte [esi + 4], al
mov edx, dword [esi + 0x2c]
mov ecx, 4
mov eax, esi
call fcn.00429cf8
mov edx, dword [esi + 0x2c]
mov ecx, 8
mov eax, esi
call fcn.00429cf8
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c]
mov ecx, 0xc
mov eax, esi
call fcn.00429cf8
mov dword [esi + 0x10], eax
mov edx, dword [esi + 0x2c]
mov ecx, 0x10
mov eax, esi
call fcn.00429cf8
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x18], 1
test eax, eax
je 0x429edb
shr eax, 1
shl dword [esi + 0x18], 1
test eax, eax
jne 0x429ed2
shr dword [esi + 0x18], 1
mov eax, dword [esi + 0x18]
shr eax, 1
mov dword [esi + 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429f08
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404740
ret
Function at 0x42b10c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418488]
call fcn.004054e8
xor eax, eax
push ebp
push 0x42b250
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x50f4e8], 0
jne 0x42b15f
mov ecx, dword [0x513894]
mov dl, 1
mov eax, dword [0x408448]
call fcn.0040e110
call fcn.004040b8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030e0
mov eax, ebx
call fcn.00405110
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x42b260
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004065a0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405120
test eax, eax
jle 0x42b1f7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x42b1f0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004049b4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040499c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004093cc
test eax, eax
jne 0x42b1f0
mov ebx, 0x15
jmp 0x42b1fc
mov ebx, 0x10
jmp 0x42b1fc
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x50f4e8]
call fcn.0042b008
mov eax, dword [ebp - 8]
call fcn.0042b008
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004065b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b257
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404740
lea eax, [ebp - 0x10]
mov edx, dword [0x418488]
call fcn.004055b8
ret

Function at 0x42cd48
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004030e0
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x513f70]
cmp byte [edx + 0xc], 0
je 0x42cdac
mov edx, dword [0x513f60]
cmp dword [edx], 2
jne 0x42cdac
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x42cdb0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42ce68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0042cd48
test al, al
je 0x42ce4a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.0040480c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x42ce4a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404bec
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404bec
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404924
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x42ce03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ce6f
lea eax, [ebp - 0x2c]
call fcn.0040471c
lea eax, [ebp - 0xc]
call fcn.0040471c
ret

Function at 0x42cfd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0042ca8c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404bec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42d032
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x513c40]
mov dl, 1
mov eax, dword [0x42c984]
call fcn.0040e14c
call fcn.004040b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42d03c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404bec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42d094
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x513f7c]
mov dl, 1
mov eax, dword [0x42c984]
call fcn.0040e14c
call fcn.004040b8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042cabc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430e8c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x430ee6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x513940]
cmp byte [eax], 0
je 0x430eb6
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x430ed0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404954
mov eax, dword [ebp - 4]
call fcn.00404bec
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430eed
lea eax, [ebp - 4]
call fcn.0040471c
ret

Function at 0x431244
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00407da0
cmp ax, 0xffff
jne 0x431265
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4312e6
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4312e6
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4312ac
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x43129f
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4312e6
cmp dword [ebp + 8], 0
jle 0x4312e6
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042ab58
mov esi, eax
test esi, esi
jle 0x4312dd
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407db4
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x431fa0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x432004
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040499c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409dfc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43200b
lea eax, [ebp - 0xc]
call fcn.0040471c
ret

Function at 0x432084
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4320e0
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4320af
call fcn.0040f6d8
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004029b0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4320e0
call fcn.0040f6d8
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x434e54
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x434e5a
ret

Function at 0x437534
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x437585
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x43756c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x43755c
jmp 0x437585
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x43756d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441218
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404bdc
xor eax, eax
push ebp
push 0x441346
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x441319
xor eax, eax
push ebp
push 0x441312
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004049ec
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4412e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4412d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004049ec
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404bec
mov edx, ebx
pop ecx
call fcn.004029b0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4412dd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x51390c]
mov dl, 1
mov eax, dword [0x408448]
call fcn.0040e110
call fcn.004040b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44134d
lea eax, [ebp - 4]
call fcn.0040471c
ret
Function at 0x441354
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x441505
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404ddc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x44151c
call fcn.00404a38
mov eax, ebx
call fcn.00424938
mov edi, eax
dec edi
test edi, edi
jl 0x44140c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042490c
mov edx, dword [0x459b54]
call fcn.00403a78
test al, al
je 0x441408
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042490c
lea edx, [ebp - 0x14]
call fcn.0047c590
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404ddc
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404aac
inc esi
dec edi
jne 0x4413ba
mov al, byte [0x441520]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x44152c
mov eax, dword [ebp - 0xc]
call fcn.0040f59c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004047b4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0047c590
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x44151c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0047c590
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x44151c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x44151c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x441538
call fcn.0040ae14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44150c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404740
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404740
lea eax, [ebp - 0x14]
call fcn.0040471c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404740
ret
Function at 0x4449f4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x444ac6
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x444a98
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x444a87
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004029b0
mov eax, dword [ebp - 4]
call fcn.00444930
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444a8e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x444b00
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x444ba2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x444b75
mov edx, ebx
mov eax, dword [0x434878]
call fcn.00438dc4
test al, al
je 0x444b65
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00438cd4
call fcn.00404164
jmp 0x444ba9
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x444b30
mov ecx, dword [0x5139b4]
mov dl, 1
mov eax, dword [0x408448]
call fcn.0040e110
call fcn.004040b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444ba9
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x444bb0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x444c08
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444c0f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x444c18
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x444c6d
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444c74
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x444ce4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x444d59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00444930
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00438d98
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x444d43
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444d60
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x444d68
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x444ddd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00444930
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x444dc7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444de4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x450ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00450a87
push eax
push esi
push dword [ebp + 8]
call fcn.00450a3c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00450a77
fsub qword [ebp + 0x64]
ror byte [eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
Function at 0x45112c
Capabilities:
Inspect section memory permissions

Disassembly:
pop ebp
or al, 0xeb
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x45114e
invalid
Function at 0x460974
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4608c0
call sub.user32.dll_EnumWindows
ret

Function at 0x460a94
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x460b11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004604f4
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x460ab9
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004600f4
cmp dword [ebp - 4], 0
je 0x460afb
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404bec
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460b18
lea eax, [ebp - 4]
call fcn.0040471c
ret

Function at 0x464510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x464560]
test si, 4
je 0x464524
or bl, 1
test si, 8
je 0x46452e
or bl, 4
test si, 1
je 0x464538
or bl, 8
test si, 2
je 0x464542
or bl, 0x10
test si, 0x10
je 0x46454c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46455b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x464564
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x46459c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46457d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46458c
or bl, 4
test esi, 0x20000000
je 0x464597
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret