joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4138d8
xor eax, eax
jmp 0x413999
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4138f6
xor eax, eax
jmp 0x413999
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x413910
xor eax, eax
jmp 0x413999
push 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectory]
mov dword [ebp - 0x18], eax
push 3
mov eax, dword [ebp - 0x18]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x413941
xor eax, eax
jmp 0x413999
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41395c
xor eax, eax
jmp 0x413999
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x413973
xor eax, eax
jmp 0x413999
push 0x30000
push 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_CreateIconFromResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x413cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 8], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 2
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x413ce0
xor eax, eax
jmp 0x413d4d
cmp dword [ebp - 0xc], 2
je 0x413cea
xor eax, eax
jmp 0x413d4d
mov word [ebp - 8], 1
push 0
lea eax, [ebp - 0xc]
push eax
push 2
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x413d0e
xor eax, eax
jmp 0x413d4d
cmp dword [ebp - 0xc], 2
je 0x413d18
xor eax, eax
jmp 0x413d4d
mov ax, word [ebp + 0xc]
mov word [ebp - 8], ax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x413d3e
xor eax, eax
jmp 0x413d4d
cmp dword [ebp - 0xc], 2
je 0x413d48
xor eax, eax
jmp 0x413d4d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4143c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5939b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x114], 0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00401bd0
push eax
push 0x100
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp + 0x14]
call fcn.00401bd0
push eax
lea ecx, [ebp + 0x10]
call fcn.00401bd0
push eax
lea ecx, [ebp + 0xc]
call fcn.00401bd0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0057731e
mov edx, dword [ebp - 0x114]
or edx, 1
mov dword [ebp - 0x114], edx
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.005772b0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.005772b0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.005772b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x414490
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5939d2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00401bd0
push eax
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.00401bd0
push eax
lea ecx, [ebp + 8]
call fcn.00401bd0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.005772b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.005772b0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4152e0
Capabilities:
Initialize winsock library
Rebuild import table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593a64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e4
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00416fe0
mov dword [ebp - 4], 0
push 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00416fe0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
call fcn.004089b0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x5a9634
mov ecx, 1
test ecx, ecx
je 0x415356
mov dword [ebp - 0x1b0], 0
jmp 0x41536d
mov edx, dword [ebp - 0x10]
push edx
push str.CIOCPServer_p_n
call fcn.0040b7b0
add esp, 8
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x5a9608
push 0x5a95f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1a4], eax
push 0x6068a8
call dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x70], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x78], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x25], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0x2710
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x88], 0x1d4c0
mov byte [ebp - 0x1ac], 0x4b
mov byte [ebp - 0x1ab], 0x75
mov byte [ebp - 0x1aa], 0x47
mov byte [ebp - 0x1a9], 0x6f
mov byte [ebp - 0x1a8], 0x75
push 5
lea eax, [ebp - 0x1ac]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x26
push ecx
call fcn.00450890
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415c60
Capabilities:
Create tcp socket
Create thread
Create udp socket
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x415c88
xor al, al
jmp 0x415d8f
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x74], 0
jne 0x415cb8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
jmp 0x415d8f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
shl eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x8c]
mov dword [edx + 0x90], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], 0xa
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x4b
mov ecx, dword [ebp - 4]
add ecx, 0x7c
call fcn.00408a70
mov ecx, dword [ebp - 0x20]
shl ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 0
mov dword [ebp - 0xc], 0
jmp 0x415d35
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x38]
jae 0x415d8d
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x415da0
push 0
push 0
call fcn.00451e9c
add esp, 0x18
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x415d72
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x415d8f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], ecx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415d2c
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416030
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593b1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push 0x18
call fcn.0057284c
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0
je 0x41607a
push 1
mov ecx, dword [ebp - 0x28]
call fcn.00417940
mov dword [ebp - 0x2c], eax
jmp 0x416081
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x8000
push 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 1
mov edx, dword [ebp + 8]
add edx, 0x50
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4160e2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4160e2
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00416b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416b30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593ba2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push str.RemoveStaleClient
lea ecx, [ebp - 0x20]
call fcn.0057731e
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x6068a8
lea ecx, [ebp - 0x18]
call fcn.004177d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.005772b0
mov ecx, 1
test ecx, ecx
je 0x416b94
mov dword [ebp - 0x24], 0
jmp 0x416ba4
push str.CIOCPServer::RemoveStaleClient_n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0xc], 0
jne 0x416bd2
mov word [ebp - 0x1c], 1
mov word [ebp - 0x1a], 0
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x80
push 0xffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00417310
test eax, eax
je 0x416c3c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xffffffff
mov edx, dword [ebp + 8]
cmp dword [edx], 0x103
jne 0x416c1d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x416c08
push 2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x10]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00416d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00417840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.00401bf0
mov dword [ebp - 0x10], eax
push 0x5aa2b4
push 0xba
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41b7cf
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41b7cf
call dword [sym.imp.SkinH.dll_SkinH_Attach]
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SkinH.dll_SkinH_AttachRes]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41cbc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ddc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
push 0
push 0x80
push 3
push 0
push 1
push OleUIAddVerbMenuA
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41de11
jmp 0x41df31
lea ecx, [ebp - 0x5c]
push ecx
call fcn.0041cbc0
add esp, 4
mov edx, 1
test edx, edx
je 0x41de6c
push 0
lea eax, [ebp - 0x474]
push eax
push 0x400
lea ecx, [ebp - 0x470]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x474], 0
jne 0x41de50
jmp 0x41de6c
mov eax, dword [ebp - 0x474]
push eax
lea ecx, [ebp - 0x470]
push ecx
lea edx, [ebp - 0x5c]
push edx
call fcn.0041cc10
add esp, 0xc
jmp 0x41de1d
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.0041dc60
add esp, 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x70], 0
jmp 0x41de98
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x10
jge 0x41df31
mov byte [ebp - 0x484], 0
xor ecx, ecx
mov dword [ebp - 0x483], ecx
mov dword [ebp - 0x47f], ecx
mov byte [ebp - 0x47b], cl
mov edx, dword [ebp - 0x70]
xor eax, eax
mov al, byte [ebp + edx - 0x6c]
and eax, 0xf0
sar eax, 4
push eax
push 0x5aa4f0
lea ecx, [ebp - 0x484]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x484]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00451160
add esp, 8
mov ecx, dword [ebp - 0x70]
xor edx, edx
mov dl, byte [ebp + ecx - 0x6c]
and edx, 0xf
push edx
push 0x5aa4f0
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x484]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00451160
add esp, 8
jmp 0x41de8f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f9c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push 0x80
push 3
push 0
push 1
push OleUIAddVerbMenuA
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41fa08
jmp 0x41fa87
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.0057284c
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41fa34
jmp 0x41fa87
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41fa52
jmp 0x41fa87
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x14]
je 0x41fa5c
jmp 0x41fa87
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041f6e0
add esp, 0xc
test eax, eax
jne 0x41fa76
jmp 0x41fa87
mov dword [ebp - 0x10], 1
xor eax, eax
test eax, eax
jne 0x41f9e1
cmp dword [ebp - 0xc], 0
je 0x41fa9f
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00572875
add esp, 4
cmp dword [ebp - 8], 0xffffffff
je 0x41faaf
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x422950
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x48]
call fcn.00410b50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x422995
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x48]
call fcn.00410bc0
mov dword [ebp - 0xc], eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x48]
call fcn.00571296
jmp 0x42296a
mov dword [ebp - 0x10], 0
mov ecx, dword [0x6067f0]
add ecx, 0x7c
call fcn.00417240
mov ecx, eax
call fcn.0045f2c0
push eax
call fcn.00573765
push eax
push 0x5aac50
call fcn.00578afd
add esp, 8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x48]
call fcn.00413610
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x4229ef
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jge 0x422a16
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x48]
call fcn.00571278
cmp eax, 1
jne 0x422a14
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x4229e6
cmp dword [ebp - 0x18], 0
jne 0x422a1e
jmp 0x422a82
mov dword [ebp - 0x20], 0
jmp 0x422a30
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x14]
jge 0x422a82
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x48]
call fcn.00571278
cmp eax, 1
jne 0x422a80
push str.send
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x48]
call fcn.00570c71
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x54]
call fcn.00416100
jmp 0x422a27
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x424ee0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x424ef7
jmp 0x424f67
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
call fcn.004027f0
add eax, 1
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x424f61
mov ecx, dword [ebp + 8]
call fcn.004027f0
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.005776e0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.00450bd0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
push edx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ae20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x5ac10c
mov dword [ebp - 0x44], 0x7f8a
mov dword [ebp - 0x40], 0x7f00
mov dword [ebp - 0x3c], 0x7f03
mov dword [ebp - 0x38], 0x7f89
mov dword [ebp - 0x34], 0x7f8b
mov dword [ebp - 0x30], 0x7f01
mov dword [ebp - 0x2c], 0x7f81
mov dword [ebp - 0x28], 0x7f88
mov dword [ebp - 0x24], 0x7f80
mov dword [ebp - 0x20], 0x7f86
mov dword [ebp - 0x1c], 0x7f83
mov dword [ebp - 0x18], 0x7f85
mov dword [ebp - 0x14], 0x7f82
mov dword [ebp - 0x10], 0x7f84
mov dword [ebp - 0xc], 0x7f04
mov dword [ebp - 8], 0x7f02
mov byte [ebp - 0x50], 0x4c
mov byte [ebp - 0x4f], 0x6f
mov byte [ebp - 0x4e], 0x61
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], 0x43
mov byte [ebp - 0x4b], 0x75
mov byte [ebp - 0x4a], 0x72
mov byte [ebp - 0x49], 0x73
mov byte [ebp - 0x48], 0x6f
mov byte [ebp - 0x47], 0x72
mov byte [ebp - 0x46], 0x41
mov byte [ebp - 0x45], 0
lea ecx, [ebp - 0x50]
push ecx
push 0x5ac100
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], 0
jmp 0x42af03
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], 0x10
jge 0x42af33
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov edx, dword [ebp + edx*4 - 0x44]
mov dword [ecx + eax*4 + 4], edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp + eax*4 - 0x44]
push ecx
push 0
call dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*4 + 0x44], eax
jmp 0x42aefa
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42af40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x5ac10c
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xd], 0x43
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0
lea ecx, [ebp - 0x14]
push ecx
push 0x5ac100
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
jmp 0x42afb8
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x10
jge 0x42afce
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 0x44]
push edx
call dword [ebp - 0x18]
jmp 0x42afaf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret