joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004c3d
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0x38], 0x4b
mov byte [ebp - 0x37], 0x45
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x4e
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x4c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x20], 0x56
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
push ecx
push 0
call fcn.10004680
add esp, 0xc
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
xor eax, eax
mov ax, word [ecx + 0x14]
lea ecx, [edx + eax + 0x18]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x28], 0
jmp 0x10004cfb
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
xor eax, eax
mov ax, word [edx + 6]
cmp dword [ebp - 0x28], eax
jge 0x10004da8
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
jne 0x10004d5f
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x38]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x10004d5d
push 4
push 0x1000
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
add eax, dword [edx + 0xc]
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001f280
add esp, 0xc
jmp 0x10004ce9
push 4
push 0x1000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx + 0xc]
push edx
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001f8b0
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
jmp 0x10004ce9
mov esp, ebp
pop ebp
ret
Function at 0x100056a6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x100056f5
mov dword [ebp - 0x1c], 0x4c
push 0x1002a840
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1001fcb9
jmp 0x10005714
mov dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1002d460
call fcn.10004961
add esp, 4
mov dword [ebp - 0x18], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x18], 0
jne 0x10005746
jmp 0x1000581d
mov dword [ebp - 4], 2
mov edx, 1
test edx, edx
je 0x1000576b
mov dword [ebp - 0x20], 0x51
push 0x1002a840
lea eax, [ebp - 0x20]
push eax
call fcn.1001fcb9
jmp 0x10005786
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x100057dd
mov dword [ebp - 4], 4
mov eax, 1
test eax, eax
je 0x100057b8
mov dword [ebp - 0x24], 0x33
push 0x1002a840
lea ecx, [ebp - 0x24]
push ecx
call fcn.1001fcb9
jmp 0x100057d4
mov dword [ebp - 4], 0xffffffff
jmp 0x1000581d
sub esp, 0x84c
mov ecx, 0x213
mov esi, 0x1013d480
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0
je 0x10005815
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
push eax
call fcn.1000540f
add esp, 4
mov dword [ebp - 0x18], 0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000597b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x114]
push ecx
push 0x1013dcdc
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100059eb
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.1001fdd4
add esp, 4
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x10005a17
mov ecx, dword [ebp - 0x11c]
call fcn.10005b60
mov dword [ebp - 0x120], eax
jmp 0x10005a21
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
call dword [eax]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10007df0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002653c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x11c]
call fcn.10009100
mov dword [ebp - 4], 0
push 0x2001f
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx]
push edx
lea ecx, [ebp - 0x11c]
call fcn.10007da0
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x10007e7b
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x124], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.10007c90
mov eax, dword [ebp - 0x124]
jmp 0x10007f41
mov dword [ebp - 0x120], 0x100
lea ecx, [ebp - 0x118]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10007f09
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x11c]
call fcn.10007df0
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x10007efa
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x128], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.10007c90
mov eax, dword [ebp - 0x128]
jmp 0x10007f41
mov dword [ebp - 0x120], 0x100
jmp 0x10007e85
lea ecx, [ebp - 0x11c]
call fcn.10007cf0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x130]
call fcn.10007cb0
mov dword [ebp - 0x12c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.10007c90
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100083f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8

Function at 0x10008600
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jge 0x10008659
mov edx, 1
test edx, edx
je 0x10008641
jmp 0x10008655
push 0x1013e084
push 0
push 0x100
call fcn.1001b340
add esp, 0xc
xor eax, eax
jmp 0x10008662
xor eax, eax
cmp eax, dword [ebp - 4]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10008670
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.1001fdf0
mov dword [ebp - 0x1010], ecx
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100086d8
mov edx, 1
test edx, edx
je 0x100086c0
jmp 0x100086d4
push 0x1013e09c
push 0
push 0x100
call fcn.1001b340
add esp, 0xc
xor eax, eax
jmp 0x10008732
cmp dword [ebp - 8], 1
jne 0x10008729
mov dword [ebp - 0x100c], 0x1000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0x1008]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10008725
movsx eax, byte [ebp - 0x1008]
test eax, eax
je 0x10008725
mov eax, 1
jmp 0x10008732
xor eax, eax
jmp 0x10008732
xor ecx, ecx
cmp ecx, dword [ebp - 8]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040c272
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040c272
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040c272
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040c272
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040c272
mov dword [0x41203c], eax
call fcn.0040c272
test eax, eax
jge 0x402550
push 8
call fcn.0040c272
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040c272
pop ecx
push 1
call fcn.0040c272
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040c272
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040c272
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040c272
jmp 0x402495

Function at 0x40c272
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c281
pop dword [ebp - 0x30]
mov eax, 0x9bd0c5a8
sub eax, 0x9b900327
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3c0ba
push 0
mov eax, 0xaedf92b5
add eax, 0x51614e23
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x51fe
xor edi, edi
add edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x30]
mov esi, 0xc24ec905
sub esi, 0xf542954a
add dword [ebp - 0x24], ecx
mov edx, dword [ebx]
xor dword [ebp - 0x1c], eax
sub edx, esi
xor dword [ebp - 0x24], 0x60c099e
mov dword [edi], edx
mov dword [ebp - 0x10], 0xb41d7a7d
add edi, 0x95029d2d
add edi, 0x6afd62d7
add ebx, 0x398f84af
sub ebx, 0x398f84ab
loop 0x40c2d6
add eax, 0x14807661
sub eax, 0x147f3b96
xor ebx, ebx
add ebx, eax
add eax, 0xe6ea2ec
sub eax, 0xe6ea2e7
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0x7d00a017
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x7d0189d0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
jmp 0x7d00a039
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x7d00a1a1
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x7d0189e8], 0
jne 0x7d00a0fd
push 0x90
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x7d0189e8], eax
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x7d0189e8], 0
je 0x7d00a0aa
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x7d0189e8]
push 0x7d00a282
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx*4 + 0x7d0189e8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x7d0189e8]
cmp dword [eax], 0
jne 0x7d00a0e2
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x7d0189e8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
and dword [eax*4 + 0x7d0189e8], 0
jmp 0x7d00a1a1
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx*4 + 0x7d0189e8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x7d0189e8]
cmp dword [eax + 0xc], 0x20
je 0x7d00a11d
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x7d0189e8]
cmp dword [eax + 8], 0
je 0x7d00a122
jmp 0x7d00a032
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx*4 + 0x7d0189e8]
mov dword [eax + 0x18], ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], eax
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x7d0189e8]
push dword [eax]
push 0x7d00a1b1
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
je 0x7d00a181
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push dword [eax + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x18], 0
setne cl
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push dword [eax + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
and dword [eax + 0x24], 0
cmp dword [ebp - 8], 0
je 0x7d00a19c
jmp 0x7d00a1a1
jmp 0x7d00a032
push 0x7d0189d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x7d00aa92
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x110
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x7d00ab03
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
push 0x7d00ab08
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x7d00ab03
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret

Function at 0x7d010c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x7d010c30
cmp dword [ebp - 0xc], 1
je 0x7d010c3d
cmp dword [ebp - 0xc], 2
je 0x7d010c4a
jmp 0x7d010c57
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 8], eax
jmp 0x7d010c5d
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 8], eax
jmp 0x7d010c5d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 8], eax
jmp 0x7d010c5d
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x7d010c7e
or eax, 0xffffffff
jmp 0x7d010c81
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x7d010f30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x7d011066
lea edx, [ebp + 8]
sub edx, 4
mov dword [ebp - 0x10], edx
push str.Stack_dump:__n
push 0x7d018cf4
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
jmp 0x7d010f7d
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x40
jge 0x7d010fc8
mov ecx, dword [ebp - 0x18]
and ecx, 7
cmp ecx, 7
jne 0x7d010f97
mov dword [ebp - 0x20], str._08x_r_n
jmp 0x7d010f9e
mov dword [ebp - 0x20], str._08x
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x7d018cf4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x14], ecx
jmp 0x7d010f74
push str._nCopy_to_clipboard_
mov edx, dword [ebp - 0x14]
add edx, 0x7d018cf4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push 0x14
push 0x7d0186dc
push 0x7d018cf4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x7d011066
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x7d011007
jmp 0x7d011066
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x1000
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x7d01102e
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x7d011066
push 0x7d018cf4
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x1c]
push edx
push 7
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
test eax, eax
jne 0x7d010ff9
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
mov byte [ebp - 0xc], dl
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 0xc]
mov byte [eax], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
movsx ecx, byte [ebp - 0xc]
test ecx, ecx
jne 0x7d011066
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x405f02
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422254], 0
push esi
jne 0x405f39
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f13
mov dword [ecx*4 + 0x422250], eax
inc ecx
cmp ecx, 0x100
jl 0x405f0e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f6a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422250]
xor eax, esi
inc ecx
dec edx
jne 0x405f4c
pop edi
not eax
pop esi
ret 0xc

Function at 0x401040
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x412004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push edi
mov edi, dword [ebp + 8]
push 0x7f00
push 0
mov dword [ebp - 0x50], 0x30
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0x401000
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], str.dummyWindowClass
call esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x4010f5
push 0x30
push str.Error_
push str.Window_Registration_Failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004011b3
mov esp, ebp
pop ebp
ret 0x10
push 0
push edi
push 0
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x20cf0000
push str.DummyWindow
push str.dummyWindowClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x40114e
push 0x30
push str.Error_
push str.Window_Creation_Failed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004011b3
mov esp, ebp
pop ebp
ret 0x10
push 0xb
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x40119e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jg 0x401181
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
xor ecx, ebp
pop edi
pop esi
call fcn.004011b3
mov esp, ebp
pop ebp
ret 0x10