joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448639
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00448550
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x448670
mov al, byte [ebp - 0x110]
test al, al
je 0x448639
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x624470
call fcn.00462020
mov edx, 0x4485ca
mov ecx, ebp
call fcn.00414920
jmp 0x448670
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x624470
call fcn.00462020
mov edx, 0x448639
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x448734
mov al, byte [ebp - 0x110]
test al, al
je 0x4486fd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x624470
call fcn.00462020
mov edx, 0x44868e
mov ecx, ebp
call fcn.00414920
jmp 0x448734
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x624470
call fcn.00462020
mov edx, 0x4486fd
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00447ef0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44b8e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x625178
call fcn.0040d6e0
test al, al
je 0x44b9c6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0044b9e0
xor eax, eax
push fcn.0044b8d0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408bc0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0044ab10
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0044a660
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044b8d0
jmp 0x44b9d1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0044e530
mov esp, ebp
pop ebp
ret

Function at 0x44d860
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x44d87c
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4584e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.004584d0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408bc0
lea eax, [ebp - 0xc10]
call fcn.00403d40
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x458540
mov eax, 0x6722f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x4585ea
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.00410170
xor eax, eax
push fcn.004584c0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x45859c
mov eax, 0x6722f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4585d8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x629e6c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4585d8
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004584c0
jmp 0x458648
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x45860c
mov eax, 0x6722f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x458648
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x629e6c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x458648
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004584d0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x463590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x62add8
lea eax, [ebp - 0x268]
call fcn.0040eef0
xor eax, eax
push fcn.00463570
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4635d3
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x46361b
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x4635ef
clc
jmp 0x4635f6
bt dword [0x62a340], eax
jb 0x46360f
mov eax, ebp
call fcn.004636c0
test al, al
je 0x46360f
mov byte [ebp - 0x26c], 1
jmp 0x4636a0
mov byte [ebp - 0x26c], 0
jmp 0x4636a0
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x5f5df0]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x4636a0
and esi, 0x400
je 0x4636a0
lea ebx, [ebp - 0x268]
mov edx, 0x62add8
mov eax, ebx
call fcn.0040efb0
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.00463230
test eax, eax
je 0x463674
sub eax, 1
je 0x46368c
jmp 0x463698
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00463590
mov byte [ebp - 0x26c], al
jmp 0x4636a0
mov byte [ebp - 0x26c], 1
jmp 0x4636a0
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00463570
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4638b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x4638bc
mov eax, 0x6722f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x463a00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.004639f0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x463a70
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0040bbf0
cmp ebx, 1
jle 0x463a60
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0040b280
jmp 0x463a7b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00408bc0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004639f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4646a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x673b60], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x6739c0], eax
mov eax, dword [ebp - 0x90]
mov dword [0x6739d0], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x6739e0], eax
mov eax, dword [ebp - 0x88]
mov dword [0x6739f0], eax
mov edx, 0x673a01
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.004037b0
lea eax, [ebp - 0x80]
call fcn.00404980
mov byte [0x673a00], al
mov eax, 0x62a410
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x673b70], eax
test eax, eax
je 0x464740
mov eax, 0x62a41c
push eax
push dword [0x673b70]
call sub.kernel32.dll_GetProcAddress
mov dword [0x673b60], eax
nop
cmp dword [0x6739d0], 6
jae 0x464754
mov dword [0x5f56b0], 0
nop
cmp dword [0x6739d0], 6
jb 0x464770
cmp dword [0x6739e0], 1
jb 0x464770
mov dword [0x5f56c0], 2
mov esp, ebp
pop ebp
ret
Function at 0x4b7270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4b72a1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4b7290
pop esi
pop ebx
ret

Function at 0x4b8a80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4b8aa4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4b8b6a
mov esi, esi
xor eax, eax
push 0x4b8b4b
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040d7c0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x624d58
call fcn.00449e80
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004b8d00
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004b8d70
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004b8de0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4b8b40
cmp dword [ebp - 4], 0
je 0x4b8b40
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4b8b6a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c10c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x4c10e8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x4c1196
mov esi, esi
xor eax, eax
push 0x4c1177
push ebp
push 0x414de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
je 0x4c114c
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00447ef0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x4c116c
cmp dword [ebp - 8], 0
je 0x4c116c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4c1196
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x541390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
mov eax, esi
mov edx, 0x666ac8
call fcn.0040eef0
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00541380
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 8], 0
mov dword [esi], 0
lea eax, [esi + 0x34]
xor edx, edx
call fcn.00408bc0
mov eax, fcn.004e26b0
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [edi]
lea ecx, [ebp - 4]
xor dx, dx
call fcn.00409510
mov edx, dword [ebp - 4]
lea eax, [esi + 0x30]
call fcn.00408bc0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x10]
lea edx, [esi + 0xc]
mov eax, ebx
call fcn.0053f860
mov edx, esi
mov eax, ebx
call fcn.00541920
test dword [ebx + 0x28], 0x10
jne 0x541458
mov eax, ebx
call fcn.004feb40
test al, al
jne 0x541458
or dword [esi + 0x24], 0x8000000
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00541380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f90bab2
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f918454]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x114], eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x110], eax
movzx eax, word [0x4f918810]
push edi
push eax
mov dword [ebp - 0x118], ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x4f90bb67
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x4f90bb67
cmp dword [ebp + 0x18], 1
jne 0x4f90bb36
push esi
mov esi, 0x106
lea ecx, [ebp - 0x10c]
mov edx, esi
call fcn.4f903b61
push 0x4f9019a8
mov edx, esi
lea ecx, [ebp - 0x10c]
call fcn.4f903b94
lea esi, [ebp - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x118]
mov edx, str.Package
push 2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x110]
push dword [ebp - 0x114]
push ebx
push 0
push esi
call fcn.4f909932
jmp 0x4f90bb6a
push 0xb
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4f915360
leave
ret 0x14

Function at 0x4f90c3ff
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 3
mov edi, edx
and dword [esi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x4f90c439
push dword [ebp + 0x10]
mov edx, ebx
mov ecx, eax
push dword [ebp + 8]
push edi
push 0
call fcn.4f90c05c
mov dword [esi], eax
test eax, eax
je 0x4f90c439
xor eax, eax
jmp 0x4f90c43c
push 4
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4f90c443
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push 0x10
mov esi, ecx
mov dword [ebp - 4], edx
push 2
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4f90c4a8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4f90c4a1
mov ecx, dword [ebp - 4]
add esi, 0x3c
push edi
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
test ecx, ecx
je 0x4f90c486
mov dword [eax + 0xc], ecx
jmp 0x4f90c48d
mov eax, dword [ebp - 8]
and dword [eax + 0x48], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 3
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
jmp 0x4f90c4ab
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 4
pop eax
pop esi
pop ebx
leave
ret
Function at 0xbd92fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 1]
call fcn.00bd92df

Function at 0xbd9307
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00bd9367
mov dword [reloc.WINMM.dll_midiStreamOut], eax
xchg ebp, eax
out 0x67, eax
not dword [edx + reloc.WINMM.dll_midiStreamOut]
xchg edi, eax
dec byte [ecx - 0x16efdb8c]
mov bl, 0
add byte [eax], al
pushfd
jmp 0xbd921e
Function at 0xbda489
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xbda4d9
push cx
lea edx, [eax*4]
mov dl, bh
mov dx, 0x2bd2
jmp 0xbda511
lea esp, [esp + 4]
add al, 0xcd
btr edx, ebp
jl 0xbda4c3
jge 0xbda504
mov dx, 0x2bd2
shr dx, 0xb
jmp 0xbda515
push cx
lea edx, [eax*4]
mov dl, bh
jmp 0xbda4e6
shr dx, 0xb
add esp, 0
xchg byte [esp], dh
sete dl
lea esp, [esp + 2]
jmp 0xbda55e
btc dx, ax
jmp 0xbda586
add cl, al
btr ax, cx
ja 0xbda547
btc dx, ax
bsr eax, ebx
mov dx, si
jmp 0xbda58c
bsr eax, ebx
mov dx, si
inc esi
call fcn.00bda62e
jge 0xbda5fa
xchg edx, eax
lea edx, [ecx + esi]
dec ah
jmp 0xbda670
rdtsc
neg ax
or dx, 0x8825
mov dl, byte [esp]
not edx
mov al, 0xd5
jmp 0xbda6a5
lea esi, [esi + 1]
mov ax, cx
lea edx, [edx + edx]
bswap edx
inc dl
mov dl, dh
jmp 0xbda609
and al, 0x18
xchg edx, eax
mov ah, byte [esp]
rdtsc
mov ax, word [esp]
jmp 0xbda5d8
xchg dword [esp + 0x18], esi
mov edx, 0x71fb9ed6
mov dx, cx
mov edx, dword [esp]
lea eax, [ebx*4]
mov ah, 0xaf
jmp 0xbda819
jns 0xbda67c
ror byte [ebp - 0x24], cl
das
or dx, 0x8825
or dx, 0x8825
mov dl, byte [esp]
not edx
call fcn.00bda63b
xor byte [ecx + 0x12a35031], ah
jb 0xbda64a
jo 0xbda681
loop 0xbda6c3
mov dword [reloc.WINMM.dll_midiStreamOut], eax
mov byte [edx], ch
invalid
js 0xbda5a0
rdtsc
neg ax
jmp 0xbda651
aam 0xb2
mov word [edi], cs
enter 0x348a, 0x24
mov dl, 0x8c
bswap eax
mov dh, byte [esp]
call fcn.00bda6bd
add byte [eax], al
inc esp
fisttp dword [ebx + 0x2e]
fstp qword [ecx]
mov esi, 0x664b2889
mov edx, edi
bsf dx, bp
rdtsc
mov dh, 0x31
xchg dword [esp], ecx
rdtsc
jmp 0xbda67d
not bl
neg edx
jge 0xbda6da
xchg edx, eax
jmp 0xbda6dc
add bl, ch
sbb edx, dword [eax - 0x3c]
pop edx
cmp eax, 0x71e67dcc
loope 0xbda650
jae 0xbda687
call 0x73458749
mov ah, 0xf3
ljmp 0xffff
xchg edx, eax
call 0xbda6c4
mov dword [esp], ecx
push sp
mov edx, 0xda8f8e53
mov ax, bp
sub esp, 3
jns 0xbda733
lea esp, [esp + 1]
jmp 0xbda74b
lea esp, [esp + 1]
jmp 0xbda74b
jmp 0xbda71d
neg ah
pushfd
xchg edx, eax
lea edx, [esp - 0xff]
btc dx, cx
jmp 0xbda7d9
lea esp, [esp + 8]
xor bl, 0x3a
neg dx
jge 0xbda735
jl 0xbda761
dec edx
aam 0x4a
sub eax, 0x80c162dc
neg ah
pushfd
xchg edx, eax
jmp 0xbda76c
lea edx, [esp - 0xff]
btc dx, cx
jmp 0xbda7d9
xchg al, dl
ror eax, 0x17
bswap eax
jmp 0xbda7b8
jmp 0xbda7a0
shl edx, cl
sub bl, 0x6f
pushal
sbb edx, 0x8f89adff
jmp 0xbda859
mov edx, 0x6efc9a14
lea esp, [esp + 4]
dec bl
bsr eax, edx
ja 0xbda7b6
xchg al, dl
ror eax, 0x17
bswap eax
shl edx, cl
jmp 0xbda7ba
push word [esp + 6]
mov dh, bl
not ah
jmp 0xbda836
not ah
stc
dec eax
jmp 0xbda838
push dword [esp + 0x18]
ret 0x1c
rol bl, 0
xchg edx, eax
bsf ax, cx
jle 0xbda83f
jg 0xbda83f
sbb dword [esi + 0x15a66b0c], ebx
outsd dx, dword [esi]
jbe 0xbda897
stc
dec eax
pop word [esp + 0x19]
jmp 0xbda820
mov eax, ebx
jmp 0xbda87a
shl eax, 2
jmp 0xbda864
jne 0xbda7f4
push word [esp + 6]
mov dh, bl
jmp 0xbda803
mov edx, dword [esp]
lea edx, [ecx + edi]
mov edx, ebp
jmp 0xbd92ba
mov edx, eax
setge dl
neg dl
jnp 0xbda843
jp 0xbda843
Function at 0xbdb049
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx - 0x45]
sub esp, 1
lea esp, [esp + 1]
jmp 0xbdb062
stc
jmp 0xbdb033
xchg dword [esp + 4], ecx
call fcn.00bdb04c
pop esi
popfd
jmp 0xbdb073
Function at 0xbdb2af
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 6
push word [esp + 2]
mov dl, bh
lea edx, [edx + 0xf6]
jmp 0xbdb2c0
btr edx, ebp
lea edx, [ecx + edi]
lea edx, [edx + edi]
lea edx, [ecx + 3]
xchg dword [esp], edi
jmp 0xbdb299
lea edi, [edi + 0x30]
mov dx, word [esp]
call fcn.00bdbaa1
add eax, 0x10bbb7bc
call fcn.00bdc832
mov eax, dword [reloc.WINMM.dll_midiStreamOut]

Function at 0xbdb564
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x8a99b894
jmp 0xbdb5e9
add eax, 0x7f08aec8
jmp 0xbdb657
jo 0xbdb3cf
jno 0xbdb3cf
imul edi, ebx, 0x3ffd0e6b
inc ecx
fdiv qword [edx + 0x15]
in al, 0x25
test eax, 0x3d826bc8
or al, 0x8d
and al, 4
lea esp, [esp + 4]
not bl
lea edx, [esi*4]
xchg edx, eax
jmp 0xbdb412
mov eax, edx
neg edx
jmp 0xbdb3b9
xor bl, 0x3a
lea eax, [esp - 0x72]
jmp 0xbdb431
mov dl, byte [esp]
xor dh, bh
jne 0xbdb3f7
je 0xbdb3f7
add ax, 0x945c
lea edx, [ebx + edi]
rcl dx, cl
jmp 0xbdb44e
mov ah, ch
inc dx
jle 0xbdb41b
add ax, 0x945c
jmp 0xbdb442
lea edx, [ebx + edi]
rcl dx, cl
jmp 0xbdb44e
dec bl
btc ax, bp
jo 0xbdb4e9
mov ah, byte [esp]
mov dl, byte [esp]
mov ah, 0xc
mov dx, bx
jmp 0xbdb50c
mov ah, byte [esp]
call fcn.00bdb477
rdtsc
mov dh, al
mov eax, dword [esp]
ror ax, 1
js 0xbdb511
jns 0xbdb593
inc eax
add edi, dword [edx + reloc.WINMM.dll_midiStreamOut]
mov edx, ebx
sub bl, 0x6f
jmp 0xbdb4f1
sub esp, 0x11
mov ax, 0x5498
bswap eax
push di
lea esp, [esp + 3]
jmp 0xbdb52c
rol bl, 0
xchg edx, eax
mov eax, 0x48e0e74d
dec dl
jmp 0xbdb59e
push di
lea esp, [esp + 3]
call 0xbdb564
fisttp word [edi]
xor dword [esi - 9], esp
ror byte [ebp - 0x2053], 1
push dword [eax - 0x1437f0b5]
adc eax, 0x53d05126
retf 0xb8f9
sub esp, 0x11
mov ax, 0x5498
bswap eax
jmp 0xbdb542
je 0xbdb5b4
mov eax, 0xde6d70ba
jmp 0xbdb5b9
mov eax, 0xde6d70ba
mov eax, ebx
push bx
jmp 0xbdb5c3
bswap edx
lea esp, [esp + 2]
shl eax, 2
lea edx, [eax*4]
mov edx, esp
jmp 0xbdb5ff
lea edx, [eax + edi]
mov dl, 0x89
jmp 0xbdb61c
mov edx, ecx
jmp 0xbdb204
jmp 0xbdb850
mov eax, dword [eax + reloc.WINMM.dll_midiStreamOut]
mov dx, word [esp]
mov dx, 0x2e63
sub esp, 0x1f
jno 0xbdb606
mov edx, esi
jmp 0xbdb681
mov esp, edi
jmp 0xbdb665
mov edx, 0x1b55808
adc dx, 0x7ec6
jno 0xbdb641
jo 0xbdb641
bswap edx
inc dl
jo 0xbdb6b1
jno 0xbdb6b1
stosb byte es:[edi], al
cmp ch, byte [eax - 0x7770c531]
pop ds
invalid
lea esp, [esp + 3]
jmp 0xbdb265
push eax
ret
mov edx, esi
lea esp, [esp + 3]
jmp 0xbdb265