joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415be4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x415c14
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
xor eax, eax
xor edx, edx
mov dword [ebx], edx
pop esi
pop ebx
ret
call fcn.00405dac
xor edx, edx
mov dword [eax + 8], edx
mov al, 1
pop esi
pop ebx
ret

Function at 0x415c28
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test bl, 8
je 0x415c47
call fcn.00405dac
mov dword [eax + 8], 5
xor eax, eax
pop esi
pop ebx
ret
push ebx
push esi
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x415c63
call fcn.00405dac
xor edx, edx
mov dword [eax + 8], edx
mov al, 1
jmp 0x415c79
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
xor eax, eax
pop esi
pop ebx
ret

Function at 0x415c7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x415cac
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
xor eax, eax
xor edx, edx
mov dword [ebx], edx
pop esi
pop ebx
ret
call fcn.00405dac
xor edx, edx
mov dword [eax + 8], edx
mov al, 1
pop esi
pop ebx
ret

Function at 0x415cc0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test bl, 8
je 0x415cdf
call fcn.00405dac
mov dword [eax + 8], 5
xor eax, eax
pop esi
pop ebx
ret
push ebx
push esi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x415cfb
call fcn.00405dac
xor edx, edx
mov dword [eax + 8], edx
mov al, 1
jmp 0x415d11
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
xor eax, eax
pop esi
pop ebx
ret

Function at 0x415d84
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
mov byte [esp + 4], 0
call fcn.00405dac
xor edx, edx
mov dword [eax + 8], edx
test bl, bl
jne 0x415dd4
lea eax, [esp + 4]
push eax
push 0x103
call sub.kernel32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x415e12
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
mov byte [esi], 0
xor eax, eax
jmp 0x415e2a
add bl, 0x41
dec ebx
mov byte [esi], bl
mov byte [esi + 1], 0x3a
mov byte [esi + 2], 0
push esp
lea eax, [esp + 8]
push eax
push 0x103
push esi
call sub.kernel32.dll_GetFullPathNameA
test eax, eax
jne 0x415e12
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
mov byte [esi], 0
xor eax, eax
jmp 0x415e2a
lea edx, [esp + 4]
mov ecx, 0x103
mov eax, esi
call fcn.0040d86c
cmp eax, 0x103
setl al
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x415e34
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
call fcn.00405dac
xor edx, edx
mov dword [eax + 8], edx
mov word [esp + 4], 0
test bl, bl
jne 0x415e88
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jne 0x415ed7
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
mov word [esi], 0
xor eax, eax
jmp 0x415efb
movzx eax, bl
add ax, 0x41
dec eax
lea edx, [esi]
mov word [edx], ax
lea eax, [esi + 2]
mov word [eax], 0x3a
lea eax, [esi + 4]
mov word [eax], 0
push esp
lea eax, [esp + 8]
push eax
push 0x103
push esi
call sub.kernel32.dll_GetFullPathNameW
test eax, eax
jne 0x415ed7
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
mov word [esi], 0
xor eax, eax
jmp 0x415efb
cmp word [esp + 4], 0
je 0x415ef9
lea edx, [esp + 4]
mov ecx, 0x103
mov eax, esi
call fcn.0040da74
cmp eax, 0x103
setl al
jmp 0x415efb
xor eax, eax
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4160a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, eax
cmp byte [0x666c48], 0
jne 0x4160cb
mov ecx, 0x416178
mov eax, 0x666c4c
xor edx, edx
call fcn.00411bec
mov byte [0x666c48], 1
cmp dword [0x666c4c], 0
je 0x416101
lea eax, [ebp - 8]
push eax
push esi
call dword [0x666c4c]
test eax, eax
je 0x4160f1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x41616a
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
jmp 0x41616a
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call sub.kernel32.dll_GetFileSize
mov ebx, eax
mov dword [ebp - 8], ebx
inc ebx
jne 0x41614a
call fcn.00405dac
lea eax, [eax + 8]
push eax
call sub.kernel32.dll_GetLastError
pop edx
mov dword [edx], eax
call fcn.00405dac
cmp dword [eax + 8], 0
je 0x41614a
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
jmp 0x41616a
mov eax, dword [ebp - 4]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41672c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
je 0x416748
test byte [ebx], 0x10
sete al
pop esi
pop ebx
ret
xor eax, eax
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
ret

Function at 0x416754
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x416763
test al, 0x10
je 0x416766
xor eax, eax
ret
mov al, 1
ret
Function at 0x41676c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x41677d
test al, 0x10
setne al
ret
xor eax, eax
ret

Function at 0x416780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x416791
test al, 0x10
setne al
ret
xor eax, eax
ret

Function at 0x4170a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov byte [ebp - 5], 0
jmp 0x41714f
cmp word [ebx], 0x3f
je 0x417146
mov eax, dword [ebp + 0xc]
cmp dword [eax - 4], 0
je 0x417137
movzx eax, word [ebx]
mov edx, dword [ebp + 0xc]
cmp eax, dword [edx + 8]
setl al
mov edx, dword [ebp - 4]
movzx edx, word [edx]
mov ecx, dword [ebp + 0xc]
cmp edx, dword [ecx + 8]
setl dl
xor al, dl
jne 0x4171d3
movzx eax, word [ebx]
mov edx, dword [ebp + 0xc]
cmp eax, dword [edx + 8]
jge 0x417126
movzx eax, word [ebx]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx - 4]
movzx eax, word [edx + eax*2]
mov edx, dword [ebp - 4]
movzx edx, word [edx]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx - 4]
cmp ax, word [ecx + edx*2]
jne 0x4171d3
jmp 0x417146
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, word [ebx]
jne 0x4171d3
jmp 0x417146
movzx eax, word [ebx]
mov edx, dword [ebp - 4]
cmp ax, word [edx]
jne 0x4171d3
add ebx, 2
dec edi
add dword [ebp - 4], 2
dec esi
test edi, edi
jle 0x417161
cmp word [ebx], 0x2a
je 0x417161
test esi, esi
jg 0x4170c4
test edi, edi
jne 0x417180
test esi, esi
sete byte [ebp - 5]
jmp 0x4171d3
cmp ax, 0x3f
jne 0x41717c
test esi, esi
je 0x4171d3
add dword [ebp - 4], 2
dec esi
add ebx, 2
dec edi
movzx eax, word [ebx]
cmp ax, 0x2a
je 0x41716d
cmp ax, 0x3f
je 0x41716d
mov dword [ebp - 0xc], esi
jmp 0x4171b8
mov eax, dword [ebp + 0xc]
push eax
push esi
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004170a8
pop ecx
test al, al
je 0x4171b0
mov byte [ebp - 5], 1
jmp 0x4171d3
add dword [ebp - 4], 2
dec esi
dec dword [ebp - 0xc]
test esi, esi
jle 0x4171c2
cmp dword [ebp - 0xc], 0
jg 0x417194
test esi, esi
jne 0x4171ca
test edi, edi
je 0x4171ce
xor eax, eax
jmp 0x4171d0
mov al, 1
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4173e4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdfc
mov edi, ecx
mov ebx, edx
mov ebp, eax
mov dword [esp], ebp
mov byte [esp + 4], 0
test ebx, ebx
jne 0x41741d
push 0x1ff
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
test eax, eax
jne 0x41744d
mov word [ebp], 0
jmp 0x41745a
call sub.kernel32.dll_GetCommandLineA_1
mov esi, eax
test ebx, ebx
jle 0x41743b
mov ecx, edi
xor edx, edx
mov eax, esi
call fcn.00417368
mov esi, eax
test esi, esi
je 0x41744d
jmp 0x41744a
lea edx, [esp + 4]
mov ecx, edi
mov eax, esi
call fcn.00417368
jmp 0x41744d
dec ebx
jmp 0x417424
lea eax, [esp + 4]
mov ecx, edi
mov edx, ebp
call fcn.0041432c
mov eax, dword [esp]
add esp, 0x204
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41750c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov ebx, edx
mov ebp, eax
mov eax, dword [0x66d7e4]
cmp dword [eax + 0x10], 2
jae 0x41752e
mov ecx, edi
mov edx, ebx
mov eax, ebp
call fcn.004173e4
jmp 0x417576
test ebx, ebx
jne 0x417548
inc edi
push edi
push ebp
push 0
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
jne 0x417576
mov word [ebp], 0
jmp 0x417576
call sub.kernel32.dll_GetCommandLineW
mov esi, eax
test ebx, ebx
jle 0x417566
mov ecx, edi
xor edx, edx
mov eax, esi
call fcn.00417468
mov esi, eax
test esi, esi
je 0x417576
jmp 0x417573
mov ecx, edi
mov edx, ebp
mov eax, esi
call fcn.00417468
jmp 0x417576
dec ebx
jmp 0x41754f
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4187b8
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], 0x40
mov byte [eax + 8], 1
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov byte [eax + 0x58], 0
mov byte [eax + 0x59], 0
test edx, edx
je 0x4187f7
lea edi, [eax + 0x5c]
mov esi, edx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret
lea edi, [eax + 0x5c]
mov esi, 0x666c64
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x418940
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
call fcn.00418918
xor bx, 0xffff
test edi, edi
jle 0x41897f
movzx eax, byte [esi]
xor ax, bx
and ax, 0xff
movzx eax, ax
mov edx, dword [0x666d84]
movzx eax, word [edx + eax*2]
movzx edx, bx
shr edx, 8
xor ax, dx
mov ebx, eax
inc esi
dec edi
test edi, edi
jg 0x418957
mov eax, ebx
xor ax, 0xffff
pop edi
pop esi
pop ebx
ret

Function at 0x4189ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
call fcn.004189c4
xor ebx, 0xffffffff
test edi, edi
jle 0x418a21
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [0x666d88]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jg 0x418a01
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x418a60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
call fcn.00418a38
xor ebx, 0xffffffff
test edi, edi
jle 0x418a95
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [0x666d8c]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jg 0x418a75
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x418abc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test ecx, ecx
jle 0x418ae8
mov ebx, dword [eax]
mov esi, ebx
movzx edi, byte [edx]
xor esi, edi
and esi, 0xff
mov edi, dword [0x666d88]
mov esi, dword [edi + esi*4]
shr ebx, 8
xor esi, ebx
mov dword [eax], esi
inc edx
dec ecx
test ecx, ecx
jg 0x418ac3
pop edi
pop esi
pop ebx
ret
Function at 0x41a77c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
xor eax, eax
mov dword [ebp - 0x42c], eax
xor eax, eax
push ebp
push 0x41a8f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x6674e4], 0
mov byte [ebp - 0x22], 0
lea eax, [ebp - 0x22]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov edx, dword [fcn.0041a4a8]
lea eax, [ebp - 0x14]
call fcn.0041a4a8
xor edx, edx
push ebp
push 0x41a8d5
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0x80000002
mov edx, 0x41a904
lea eax, [ebp - 0x228]
mov ecx, 0x1ff
call fcn.004081f4
lea edx, [ebp - 0x22]
lea eax, [ebp - 0x228]
mov ecx, 0x1ff
call fcn.00408264
lea edx, [ebp - 0x228]
lea eax, [ebp - 0x14]
call fcn.0041a610
test al, al
je 0x41a8bf
push 0x1ff
lea ecx, [ebp - 0x428]
mov edx, 0x41a938
lea eax, [ebp - 0x14]
call fcn.0041a6cc
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x428]
mov ecx, 0x200
call fcn.00404818
mov eax, dword [ebp - 0x42c]
mov edx, 0x8000
call fcn.0040cae0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41a8bf
xor edx, edx
push ebp
push 0x41a8b8
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, 0x41a944
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
call fcn.00411bec
test al, al
je 0x41a8a1
call dword [ebp - 0x28]
mov ebx, eax
test ebx, ebx
je 0x41a8a1
call fcn.0041a738
test eax, eax
je 0x41a891
mov eax, dword [ebx + 0x50]
jmp 0x41a894
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x6674e4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a8bf
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a8dc
lea eax, [ebp - 0x14]
call fcn.0041a4cc
ret

Function at 0x41d7dc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x5a], 1
mov eax, ebx
call fcn.0041cc84
mov byte [ebx + 0x5a], 0
push 5
mov eax, dword [ebx]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx]
push eax
call sub.user32.dll_UpdateWindow
cmp dword [0x666fc0], 0
jne 0x41d80f
mov dword [0x666fc0], ebx
mov edx, ebx
xor eax, eax
call fcn.0041c418
mov eax, dword [ebx]
mov dword [ebx + 0x40], eax
pop ebx
ret
Function at 0x4218b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov word [edx], 0
mov ecx, eax
add ecx, 0xffffff00
sub ecx, 3
jb 0x42192e
dec ecx
je 0x42192e
sub ecx, 0xd
je 0x4218f8
add ecx, 0xffffff11
sub ecx, 9
jb 0x421a4a
jmp 0x421b39
mov eax, esi
shr eax, 0x10
test ax, ax
jne 0x421906
mov cl, 1
jmp 0x42190d
cmp ax, 1
sete cl
test cl, cl
je 0x421b39
mov word [edx], ax
mov word [ebx], pe_nt_image_headers32
mov word [ebx + 8], si
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
mov al, 1
jmp 0x421b40
mov edx, esi
movzx ecx, dx
cmp ecx, 0x1b
jg 0x421949
je 0x42195b
add ecx, 0xfffffff8
sub ecx, 2
jb 0x42195b
sub ecx, 3
je 0x42195b
jmp 0x42196e
add ecx, 0xffffffdf
sub ecx, 8
jb 0x421981
add ecx, 0xfffffffc
sub ecx, 2
jb 0x421981
jmp 0x42196e
cmp eax, 0x102
jne 0x421981
mov word [ebx], 0
xor eax, eax
jmp 0x421b40
cmp eax, 0x102
je 0x421981
mov word [ebx], 0
xor eax, eax
jmp 0x421b40
mov edi, edx
mov edx, dword [0x66d1d8]
cmp byte [edx], 0
je 0x4219a4
cmp di, 0x27
jne 0x42199a
mov di, 0x25
jmp 0x4219a4
cmp di, 0x25
jne 0x4219a4
mov di, 0x27
mov byte [ebx + 8], 0
mov word [ebx + 8], 0
cmp eax, 0x102
jne 0x4219f3
mov word [ebx], 0x10
movzx eax, byte [ebp + 8]
mov byte [ebx + 6], al
cmp byte [ebp + 8], 0
jne 0x4219dc
mov eax, esi
mov byte [ebx + 8], al
test al, al
jne 0x421a0d
mov word [ebx], 0
xor eax, eax
jmp 0x421b40
mov eax, esi
mov word [ebx + 8], ax
test ax, ax
jne 0x421a0d
mov word [ebx], 0
xor eax, eax
jmp 0x421b40
cmp eax, 0x100
je 0x421a01
cmp eax, 0x104
jne 0x421a08
mov word [ebx], 0x10
jmp 0x421a0d
mov word [ebx], 0x20
test di, di
jne 0x421a1e
mov word [ebx], 0
xor eax, eax
jmp 0x421b40
call fcn.00421898
or di, ax
mov word [ebx + 4], di
cmp word [ebx + 4], 0x400d
jne 0x421a43
cmp esi, 0xd
je 0x421a43
mov word [ebx], 0
xor eax, eax
jmp 0x421b40
mov al, 1
jmp 0x421b40
xor edx, edx
test esi, 1
je 0x421a57
or dl, 1
test esi, 2
je 0x421a62
or dl, 2
movsx ecx, word [ebp - 4]
mov dword [ebx + 0xc], ecx
mov ecx, dword [ebp - 4]
shr ecx, 0x10
movsx ecx, cx
mov dword [ebx + 0x10], ecx
mov ecx, eax
sub ecx, 0x200
je 0x421a92
dec ecx
je 0x421aa9
add ecx, 0xfffffffe
sub ecx, 2
jb 0x421aa9
dec ecx
sub ecx, 2
jb 0x421aa9
jmp 0x421ab0
test dl, dl
jne 0x421aa2
xor eax, eax
mov word [ebx], 0
jmp 0x421b40
mov word [ebx], 4
jmp 0x421ab5
mov word [ebx], 1
jmp 0x421ab5
mov word [ebx], 2
mov byte [ebx + 4], dl
cmp eax, 0x203
sete al
mov byte [ebx + 5], al
mov edx, esi
and edx, 8
test edx, edx
setne al
mov byte [ebx + 6], al
mov eax, esi
and eax, 4
test eax, eax
setne cl
mov byte [ebx + 7], cl
xor ecx, ecx
mov dword [ebx + 8], ecx
test eax, eax
je 0x421af1
or word [0x6675b4], 0x2000
jmp 0x421afa
and word [0x6675b4], 0xdfff
test edx, edx
je 0x421b09
or word [0x6675b4], 0x4000
jmp 0x421b12
and word [0x6675b4], 0xbfff
push 0x12
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
je 0x421b2c
or word [0x6675b4], 0x8000
jmp 0x421b35
and word [0x6675b4], 0x7fff
mov al, 1
jmp 0x421b40
mov word [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x42e2a8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
test esi, esi
jg 0x42e2e1
test edi, edi
je 0x42e2e1
cmp byte [esp], 0
je 0x42e2d7
mov edx, 0x7fff
mov eax, edi
call fcn.0040d9e4
inc eax
mov esi, eax
add esi, esi
jmp 0x42e2e1
mov eax, edi
call fcn.00408154
mov esi, eax
inc esi
test edi, edi
je 0x42e2e9
test esi, esi
jne 0x42e2ed
xor ebp, ebp
jmp 0x42e325
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebp, eax
test ebp, ebp
je 0x42e384
push ebp
call sub.kernel32.dll_GlobalLock
test eax, eax
jne 0x42e314
push ebp
call sub.kernel32.dll_GlobalFree
jmp 0x42e384
mov edx, eax
mov eax, edi
mov ecx, esi
call fcn.00402da0
push ebp
call sub.kernel32.dll_GlobalUnlock
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x42e33c
test ebp, ebp
je 0x42e384
push ebp
call sub.kernel32.dll_GlobalFree
jmp 0x42e384
call sub.user32.dll_EmptyClipboard
test eax, eax
jne 0x42e356
call sub.user32.dll_CloseClipboard
test ebp, ebp
je 0x42e384
push ebp
call sub.kernel32.dll_GlobalFree
jmp 0x42e384
cmp byte [esp], 0
je 0x42e363
mov ebx, 0xd
jmp 0x42e368
mov ebx, 1
test ebp, ebp
je 0x42e37b
push ebp
push ebx
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x42e37b
xor eax, eax
jmp 0x42e37d
mov al, 1
mov ebx, eax
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e38c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov byte [esp], dl
mov esi, eax
mov byte [esp + 1], 0
cmp byte [esp], 0
je 0x42e3a9
mov ebx, 0xd
jmp 0x42e3ae
mov ebx, 1
push ebx
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x42e407
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42e407
push ebx
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x42e402
push ebx
call sub.kernel32.dll_GlobalLock
test eax, eax
je 0x42e402
cmp byte [esp], 0
je 0x42e3ec
mov ecx, edi
mov edx, eax
mov eax, esi
call fcn.0040da74
jmp 0x42e3f7
mov ecx, edi
mov edx, eax
mov eax, esi
call fcn.004081f4
mov byte [esp + 1], 1
push ebx
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
movzx eax, byte [esp + 1]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4314cc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
mov esi, ecx
mov ebx, edx
mov byte [ebx], 0
mov edx, dword [0x66d818]
cmp byte [edx], 0
je 0x43150c
push 0x800
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetWindowTextW
push esi
lea eax, [esp + 4]
or ecx, 0xffffffff
mov edx, ebx
call fcn.0040d1d4
jmp 0x431517
inc esi
push esi
push ebx
push eax
call sub.user32.dll_GetWindowTextA
mov edi, eax
mov eax, edi
add esp, 0x1004
pop edi
pop esi
pop ebx
ret
Function at 0x431578
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7fc
mov ebx, ecx
mov esi, edx
mov edi, eax
mov word [esi], 0
mov eax, dword [0x66d818]
cmp byte [eax], 0
je 0x4315a1
inc ebx
push ebx
push esi
push edi
call sub.user32.dll_GetWindowTextW
jmp 0x4315d3
cmp ebx, 0x800
jle 0x4315ae
mov ebx, 0x800
lea eax, [ebx + 1]
push eax
lea eax, [esp + 4]
push eax
push edi
call sub.user32.dll_GetWindowTextA
test eax, eax
jg 0x4315c5
xor eax, eax
jmp 0x4315d3
push ebx
lea eax, [esp + 4]
mov cl, 1
mov edx, esi
call fcn.00414308
add esp, 0x804
pop edi
pop esi
pop ebx
ret

Function at 0x435194
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
push edx
mov eax, dword [eax]
push eax
call sub.user32.dll_GetDlgItem
test eax, eax
je 0x4351ba
test bl, bl
je 0x4351b2
push 4
push eax
call sub.user32.dll_ShowWindow
jmp 0x4351ba
push 0
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x4368dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
mov esi, dword [esi - 4]
mov eax, esi
call fcn.004343d4
test al, al
je 0x436a09
mov edx, dword [esi + 0x2cc8]
dec edx
test edx, edx
jl 0x436a09
inc edx
lea eax, [esi + 0x20c8]
movzx ecx, word [eax]
cmp ecx, dword [ebp - 4]
jne 0x4369ff
movzx ebx, word [esi + 0x2cd0]
movzx eax, byte [eax + 2]
sub al, 2
jb 0x436937
add al, 0xf6
sub al, 4
jae 0x436955
cmp byte [ebp - 5], 0
je 0x43694a
movzx eax, word [ebp - 4]
mov word [esi + 0x2cd0], ax
jmp 0x43695e
mov word [esi + 0x2cd0], 0
jmp 0x43695e
mov word [esi + 0x2cd0], 0
cmp bx, word [esi + 0x2cd0]
je 0x436a09
test bx, bx
je 0x436988
push 5
push 0
push 0
movzx eax, bx
push eax
mov eax, dword [esi]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_RedrawWindow
movzx edi, word [esi + 0x2cd0]
test di, di
je 0x4369ac
push 5
push 0
push 0
movzx eax, di
push eax
mov eax, dword [esi]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_RedrawWindow
cmp word [esi + 0x2ccc], 0
je 0x4369f6
movzx eax, word [esi + 0x2cd0]
movzx edi, word [esi + 0x2ccc]
cmp ax, di
je 0x4369f6
cmp bx, di
je 0x4369f6
test bx, bx
sete dl
test ax, ax
sete al
xor dl, al
je 0x4369f6
push 5
push 0
push 0
movzx eax, di
push eax
mov eax, dword [esi]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_RedrawWindow
mov eax, esi
call fcn.0043658c
jmp 0x436a09
add eax, 6
dec edx
jne 0x436916
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret