joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ece4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40eece
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40ed18
mov eax, dword [ebp - 8]
call fcn.00403734
jmp 0x40eeb8
mov eax, dword [ebp - 4]
call fcn.004039c4
mov dword [ebp - 0xc], eax
test byte [ebp - 0xc], 3
je 0x40ed57
push 0x40eee4
push dword [ebp - 4]
push 0x40ef08
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403a84
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x40b250]
call fcn.0040d174
call fcn.00403174
mov eax, dword [ebp - 0xc]
shr eax, 2
lea eax, [eax + eax*2]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
call fcn.00403824
mov ebx, 1
mov esi, 1
cmp ebx, dword [ebp - 0xc]
jg 0x40ee8d
mov edx, 4
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + ebx - 1]
cmp ecx, 0x3d
jg 0x40edac
je 0x40edf2
sub ecx, 0x2b
je 0x40ede8
sub ecx, 4
je 0x40eded
dec ecx
sub ecx, 0xa
jb 0x40edda
jmp 0x40edf7
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x40edbe
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x40edcc
jmp 0x40edf7
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
sub cl, 0x41
mov byte [eax], cl
jmp 0x40ee22
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
sub cl, 0x47
mov byte [eax], cl
jmp 0x40ee22
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
add cl, 4
mov byte [eax], cl
jmp 0x40ee22
mov byte [eax], 0x3e
jmp 0x40ee22
mov byte [eax], 0x3f
jmp 0x40ee22
mov byte [eax], 0
jmp 0x40ee22
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, 0x40ef18
mov dl, 1
mov eax, dword [0x40b250]
call fcn.0040d1b0
call fcn.00403174
inc ebx
inc eax
dec edx
jne 0x40ed8b
mov eax, dword [ebp - 8]
call fcn.00403c1c
xor edx, edx
mov dl, byte [ebp - 0x14]
shl edx, 2
xor ecx, ecx
mov cl, byte [ebp - 0x13]
shr ecx, 4
or edx, ecx
mov byte [eax + esi - 1], dl
mov eax, dword [ebp - 8]
call fcn.00403c1c
xor edx, edx
mov dl, byte [ebp - 0x13]
shl edx, 4
xor ecx, ecx
mov cl, byte [ebp - 0x12]
shr ecx, 2
or edx, ecx
mov byte [eax + esi], dl
mov eax, dword [ebp - 8]
call fcn.00403c1c
xor edx, edx
mov dl, byte [ebp - 0x12]
shl edx, 6
xor ecx, ecx
mov cl, byte [ebp - 0x11]
or edx, ecx
mov byte [eax + esi + 1], dl
add esi, 3
cmp ebx, dword [ebp - 0xc]
jle 0x40ed83
mov edx, dword [ebp - 4]
mov eax, 0x40ef3c
call fcn.00403cac
mov ebx, eax
test ebx, ebx
je 0x40eeb8
mov eax, dword [ebp - 0xc]
sub eax, ebx
inc eax
mov ebx, eax
mov edx, dword [ebp - 0x10]
sub edx, ebx
inc edx
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.00403c64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eed5
lea eax, [ebp - 0x18]
call fcn.00403734
ret

Function at 0x40f884
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004027ac
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4115ec
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov byte [0x41b628], 1
push esp
xor edx, edx
mov al, 1
call fcn.00405204
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
add esp, 0x190
ret

Function at 0x411628
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403bb4
xor eax, eax
push ebp
push 0x41185d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 4]
call fcn.004082ec
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.004082b4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
call fcn.004037cc
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406be8
test eax, eax
jl 0x4116d9
lea ecx, [ebp - 0x110]
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406cdc
cmp dword [ebp - 0x110], 0
je 0x4116d9
mov ecx, esi
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406cdc
jmp 0x411827
cmp byte [0x41b628], 0
jne 0x4116ee
mov eax, esi
call fcn.00403734
jmp 0x411827
lea eax, [ebp - 0x104]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004027ac
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 4]
call fcn.00408354
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4117ad
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4117a4
mov edi, dword [edx]
test edi, edi
je 0x41179b
push esi
xor eax, eax
mov al, byte [edi]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
xor eax, eax
mov al, byte [edi + 1]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
xor eax, eax
mov al, byte [edi + 2]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
xor eax, eax
mov al, byte [edi + 3]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x114], 0
lea edx, [ebp - 0x130]
mov ecx, 3
mov eax, 0x411874
call fcn.004083ec
jmp 0x4117b4
mov eax, esi
call fcn.00403734
jmp 0x4117b4
mov eax, esi
call fcn.00403734
jmp 0x4117b4
mov eax, esi
call fcn.00403734
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406be8
test eax, eax
jl 0x4117d2
mov ecx, dword [esi]
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406d88
jmp 0x4117fa
push dword [ebp - 4]
push 0x411888
push dword [esi]
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.00403a84
mov edx, dword [ebp - 0x134]
mov eax, dword [ebx + 0x40]
call fcn.0040a1e0
cmp dword [esi], 0
jne 0x411827
lea eax, [ebp - 0x138]
mov ecx, 0x411894
mov edx, dword [ebp - 4]
call fcn.00403a10
mov edx, dword [ebp - 0x138]
mov eax, dword [0x41b874]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
call fcn.00413258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411864
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.00403758
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403758
lea eax, [ebp - 4]
call fcn.00403734
ret
Function at 0x411b3c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403bb4
xor eax, eax
push ebp
push 0x411ca6
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x411b82
inc eax
jne 0x411bb0
push 0x411cc0
push dword [esi + 0xc]
push 0x411cdc
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.00408200
push dword [ebp - 0x18]
lea eax, [esi + 4]
mov edx, 4
call fcn.00403a84
xor ebx, ebx
jmp 0x411c88
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1005
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
je 0x411be8
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1006
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x411c09
lea eax, [esi + 4]
mov edx, 0x411ce8
call fcn.00403788
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
jmp 0x411c88
cmp dword [esi + 0x58], 0
je 0x411c36
mov eax, dword [esi + 0x58]
call fcn.00403bc4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov ax, word [esi + 0x5c]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
jmp 0x411c57
mov eax, dword [ebp - 4]
call fcn.00403bc4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x411c88
lea eax, [esi + 4]
mov edx, 0x411d08
call fcn.00403788
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411cad
lea eax, [ebp - 0x18]
call fcn.00403734
lea eax, [ebp - 4]
call fcn.00403734
ret
Function at 0x414a74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
lea esi, [esp + 4]
mov eax, ebx
call fcn.00403734
push esp
push 0x20019
push 0
push 0x414b5c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x414aee
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x414aac
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x414b84
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x414aee
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403998
jmp 0x414b51
push esp
push 0x20019
push 0
push 0x414b5c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x414b51
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x414b11
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x414b84
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x414b51
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403998
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x69ac30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c1000]
push edi
or ebp, 0xffffffff
jmp 0x69ac52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x69ac59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69ac48
mov eax, 1
add ebx, ebx
jne 0x69ac6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x69ac7c
jne 0x69ac9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69ac9b
dec eax
add ebx, ebx
jne 0x69ac88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x69ac60
add ebx, ebx
jne 0x69ac97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x69aced
xor ecx, ecx
sub eax, 3
jb 0x69acb3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x69ad22
sar eax, 1
mov ebp, eax
jmp 0x69acbe
add ebx, ebx
jne 0x69acbe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69ac8c
inc ecx
add ebx, ebx
jne 0x69accc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69ac8c
add ebx, ebx
jne 0x69acd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x69acce
jne 0x69acea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x69acce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x69ad0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x69acfe
jmp 0x69ac4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x69ad0c
add edi, ecx
jmp 0x69ac4e
pop esi
mov edi, esi
mov ecx, 0x5299
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x69ad2a
cmp byte [edi], 0x13
jne 0x69ad2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x69ad2f
lea edi, [esi + 0x297000]
mov eax, dword [edi]
or eax, eax
je 0x69ada7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a06d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a0804]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x69ad5c
mov ecx, edi
jns 0x69ad8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a0808]
or eax, eax
je 0x69ada1
mov dword [ebx], eax
add ebx, 4
jmp 0x69ad79
call dword [esi + 0x2a0818]
mov ebp, dword [esi + 0x2a080c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x69addb
sub esp, 0xffffff80
jmp 0x4d0746
Function at 0x401570
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x140
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x4015c3
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x4015bc
lea esp, [esp]
mov ecx, dword [edi + esi*4]
push 0x4928c0
push ecx
call fcn.0046f9ec
add esp, 8
test eax, eax
je 0x4015cf
inc esi
cmp esi, dword [esp + 0x10]
jl 0x4015a0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
pop edi
pop esi
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x14]
push edx
call fcn.004304c0
lea ebx, [esp + 0xc]
lea esi, [esp + 0x13c]
mov dword [esp + 0xc], 0
call fcn.0042f970
test eax, eax
jne 0x401608
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401608
mov eax, esi
jmp 0x401620
lea ebx, [esp + 0x18]
lea esi, [esp + 0x13c]
call fcn.0042f970
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
push 0
push 0x12c
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x14]
call fcn.00430650
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x140
ret
Function at 0x401e40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x60
push ebx
mov ebx, eax
mov ecx, dword [ebx + 0xb8]
mov eax, dword [ebx + 0xb4]
mov edx, dword [ebx + 0xbc]
push ebp
push esi
mov dword [esp + 0x34], ecx
push edi
mov dword [esp + 0x34], eax
mov eax, dword [ebx + 0xc0]
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x401ffe
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
sub esi, dword [esp + 0x34]
sub edi, dword [esp + 0x38]
push 0x2c
xor ebp, ebp
lea edx, [esp + 0x48]
push ebp
push edx
call fcn.00474b70
add esp, 0xc
push ebp
push ebp
lea edx, [esp + 0x1c]
push edx
mov eax, 0x18
mov word [esp + 0x5e], ax
push ebp
lea eax, [esp + 0x54]
push eax
mov ecx, 1
push ebp
mov dword [esp + 0x5c], 0x28
mov word [esp + 0x68], cx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], edi
mov dword [esp + 0x2c], ebp
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ecx, dword [ebx + 0x8c0]
push ecx
lea ebx, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.00402b10
mov edx, dword [esp + 0x18]
push edx
lea ebx, [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
call fcn.00402b10
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
push 0xcc0020
push ebp
push ebp
push eax
push edi
push esi
push ebp
push ebp
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
cmp ebx, ebp
je 0x401f61
mov ecx, dword [esp + 0x30]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x401f5a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, dword [esp + 0x20]
cmp ebx, ebp
je 0x401f8b
mov edx, dword [esp + 0x24]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x401f84
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ebx, [esi + esi*2 + 3]
and ebx, 0xfffffffc
imul ebx, edi
lea eax, [ebx + 0x28]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
mov ecx, 0xa
lea esi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
push ebx
push ecx
add eax, 0x28
push eax
call fcn.00474720
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x74]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401ffe
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebp
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x402010
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4a4100]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esi + 0x8c0]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00474b70
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x402070
push str.sample_snap.png
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [esi + 0xec]
call fcn.00402190
mov ecx, dword [esp + 0x214]
pop edi
pop ebx
xor ecx, esp
call fcn.0046f01c
add esp, 0x214
ret

Function at 0x402a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402a49
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402a84
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402a80
lea ebx, [ebx]
cmp esi, eax
jae 0x402a84
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402a70
cmp esi, eax
jb 0x402a8a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402f70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x4a4100]
xor eax, esp
mov dword [esp + 0x10], eax
mov al, 0x39
mov byte [esp + 1], al
mov byte [esp + 4], al
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, edx
and eax, 0xfffffff0
push esi
mov byte [esp + 8], 0x53
mov byte [esp + 0xa], 0x73
mov byte [esp + 0xb], 0x83
mov byte [esp + 0xd], 0x45
mov byte [esp + 0xe], 0x25
mov byte [esp + 0xf], 0x86
mov byte [esp + 0x10], 1
mov byte [esp + 0x11], 0x94
mov byte [esp + 0x12], 0x55
mov byte [esp + 0x13], 0x17
mov byte [esp + 0x14], 0x49
mov byte [esp + 0x15], 0x48
mov byte [esp + 0x16], 0x28
mov byte [esp + 0x17], 0x97
mov esi, 0
jbe 0x403035
push ebx
push edi
lea edi, [eax - 1]
shr edi, 4
inc edi
mov esi, edi
lea ecx, [ebp + 1]
shl esi, 4
xor eax, eax
jmp 0x403000
movzx ebx, byte [esp + eax + 0x10]
xor byte [ecx + eax - 1], bl
movzx ebx, byte [esp + eax + 0x11]
xor byte [ecx + eax], bl
movzx ebx, byte [esp + eax + 0x12]
xor byte [ecx + eax + 1], bl
movzx ebx, byte [esp + eax + 0x13]
xor byte [ecx + eax + 2], bl
add eax, 4
cmp eax, 0x10
jb 0x403000
add ecx, 0x10
sub edi, 1
jne 0x402ff1
pop edi
pop ebx
cmp esi, edx
jae 0x40304b
lea eax, [esp + 8]
lea ecx, [ecx]
mov cl, byte [eax]
xor byte [esi + ebp], cl
inc esi
inc eax
cmp esi, edx
jb 0x403040
mov ecx, dword [esp + 0x18]
pop esi
pop ebp
xor ecx, esp
call fcn.0046f01c
add esp, 0x14
ret
Function at 0x4030e0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, eax
mov edi, edx
lea edx, [edi + 2]
mov eax, 0xaaaaaaab
mul edx
mov ebp, edx
shr ebp, 1
add ebp, ebp
add ebp, ebp
test ebx, ebx
je 0x403104
mov dword [ebx], ebp
cmp dword [esp + 0x18], ebp
jae 0x403114
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
cmp edi, 3
jb 0x403189
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____________________________________________________________________________________________________________________________________________]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____________________________________________________________________________________________________________________________________________]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____________________________________________________________________________________________________________________________________________]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____________________________________________________________________________________________________________________________________________]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edi, 3
sub edx, 1
jne 0x403122
test edi, edi
jbe 0x4031db
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____________________________________________________________________________________________________________________________________________]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jbe 0x4031b1
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____________________________________________________________________________________________________________________________________________]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jae 0x4031c6
mov al, 0x3d
jmp 0x4031d4
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____________________________________________________________________________________________________________________________________________]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
cmp ebp, dword [esp + 0x18]
jae 0x4031e4
mov byte [ecx], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x403fa0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4a4100]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.CrashReport.exe
push esi
lea eax, [esp + 0x10]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
push ecx
call ebx
test eax, eax
jne 0x403ff3
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0046f01c
add esp, 0x20c
ret
push str.CrashUL.exe
push esi
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 8]
push eax
call ebx
mov ecx, dword [esp + 0x210]
test eax, eax
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.0046f01c
add esp, 0x20c
ret

Function at 0x404030
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
xor esi, esi
push esi
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40406c
cmp dword [esp + 4], 4
lea eax, [esi + 1]
je 0x40406e
mov eax, esi
pop esi
add esp, 8
ret