joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55de5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00558d70
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.00558e20
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00558e20
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x572415
lea ecx, [ebp - 0x200]
push ecx
call fcn.00558d70
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.00558e20
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.0055f2fc
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x55df6d
push esi
call fcn.00558e20
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00558e20
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00557f78
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x55df44
xor eax, eax
jmp 0x55dff4
push esi
call fcn.00558e20
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00558e20
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00558c9f
add esp, 0xc
jmp 0x55dfad
mov edi, dword [ebx + 0x24]
push edi
call fcn.00558e20
pop ecx
push eax
push esi
call fcn.00558e20
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00558e20
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00557f98
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x55dfad
xor eax, eax
jmp 0x55dff4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00558d70
add esp, 8
push 0x572417
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00558d70
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.00558d70
add esp, 8
push 0x572419
mov edx, dword [ebx + 0x24]
push edx
call fcn.00558d70
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56164c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x561679
jmp 0x5616b0
call fcn.005615fc
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00558e20
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00558e20
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x561734
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x572a54], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x56180e
cmp dword [0x572a50], 0
jne 0x56180e
cmp dword [0x572c50], 0
je 0x5617c8
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00561104
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5617ae
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00561104
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5617ae
lea ebx, [ebp - 0x84]
jmp 0x5617af
inc ebx
call fcn.005616ec
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x561849
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x572a58
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00558e20
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x572a5b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x561849
cmp dword [0x572a50], 0
je 0x561828
cmp dword [0x572a50], 0xffffffff
je 0x561849
push esi
call dword [0x572a50]
pop ecx
mov eax, dword [0x572a54]
test eax, eax
je 0x561849
cmp dword [0x572a54], 0xffffffff
je 0x561849
cmp byte [eax], 0
je 0x561849
push esi
push eax
call fcn.0056164c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001270
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x100df5b0]
mov ecx, 0x100df6d0
add eax, 0x40
mov dword [0x100df6bc], 0
push eax
call fcn.10007cd0
push 0
push 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x13
mov dword [0x100df6c4], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [0x100df6c8], eax
ret

Function at 0x100012b0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x228
push edi
mov edi, dword [0x100df5b0]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x100df5b0]
mov ecx, 0x100df6d0
add eax, 0x40
mov dword [0x100df6bc], 0
push eax
call fcn.10007cd0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 8
call esi
push 0
push 0x13
mov dword [0x100df6c4], eax
call esi
mov dword [0x100df6c8], eax
mov eax, dword [0x100df5b0]
pop edi
pop esi
mov dword [eax], 1
pop ebp
ret

Function at 0x10001410
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100ddcac]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100df904], 0
jne 0x10001480
lea eax, [ebp - 0x108]
mov byte [0x100df904], 1
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
push 0x1007257c
push eax
call fcn.100018f0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10001480
push 0x55c00
push section..data
lea ecx, [ebp - 0x109]
call fcn.10003970
push dword [ebp + 0x10]
mov eax, dword [0x100df5b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002503f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001530
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100df6c8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push esi
push edi
mov edi, dword [ebp + 8]
shl eax, 0x10
sub eax, 0x7fffffff
push eax
push 0x13
push 0x101
push edi
call ebx
mov eax, dword [0x100df5b0]
mov ecx, 0x101
cmp word [eax + 8], cx
jne 0x10001675
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x100df7c0]
xor ecx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov word [eax*2 + 0x100df846], cx
mov eax, dword [0x100df7c0]
mov byte [eax + 0x100df7c8], cl
mov eax, dword [0x100df7c0]
inc eax
mov dword [0x100df7c0], eax
add eax, eax
push eax
push 2
call esi
push dword [0x100df7c0]
mov edi, eax
push 2
mov dword [ebp - 4], edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push edi
call esi
push ebx
mov edi, eax
call esi
mov ecx, dword [0x100df7c0]
mov esi, eax
add ecx, ecx
push ecx
push 0x100df846
push edi
call fcn.100265d0
push dword [0x100df7c0]
push 0x100df7c8
push esi
call fcn.100265d0
mov edi, dword [ebp - 4]
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push ebx
call esi
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push 0xd
call esi
push ebx
push 1
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x100df5b8
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x10
call esi
push 0
push 1
push 0
push 0x2d
call esi
push 0
push 3
push 0
push 0x2d
call esi
test byte [0x100df5c8], 0x80
je 0x1000165a
test byte [0x100df659], 0x80
je 0x10001664
push 0
push 2
push 0
push 0x10
call esi
pop edi
pop esi
mov dword [0x100ddc00], 0
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp dword [0x100df7c0], esi
jle 0x1000169b
nop
movzx eax, byte [esi + 0x100df7c8]
push 1
push eax
push 0x102
push edi
call ebx
inc esi
cmp esi, dword [0x100df7c0]
jl 0x10001680
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007d30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 0x10
call esi
push 0x14
movzx edi, ax
call esi
movzx eax, ax
test edi, 0x8000
je 0x10007d93
test al, 1
jne 0x10007d97
xor esi, esi
mov dl, byte [ebp + 8]
mov eax, dword [ebx + 0xd4]
mov edi, dword [ebx + 0xe4]
movzx ecx, dl
mov eax, dword [eax + ecx*4]
shr eax, 5
and eax, 0xf
mov cl, byte [eax + edi - 1]
mov eax, dword [0x100df5b0]
mov byte [ebp + 0xb], cl
cmp dword [eax + 0x89c], 0
je 0x10007da9
cmp dl, 0x7b
jne 0x10007d9e
mov cl, byte [edi]
jmp 0x10007da6
test al, 1
jne 0x10007d58
mov esi, 1
jmp 0x10007d5a
cmp dl, 0x7d
jne 0x10007da9
mov cl, byte [edi + 1]
mov byte [ebp + 0xb], cl
mov eax, dword [ebx]
mov dword [ebx + 0xf0], 0
test eax, eax
jle 0x10007df0
mov al, byte [eax + ebx + 3]
cmp al, cl
jne 0x10007df0
mov byte [0x100df928], al
mov eax, dword [ebx]
pop edi
pop esi
mov byte [eax + ebx + 3], dl
mov eax, dword [ebx + 0xf0]
mov byte [eax + ebx + 0xf8], dl
inc dword [ebx + 0xf0]
mov dword [ebx + 0xf4], 1
pop ebx
pop ebp
ret 4
mov dword [ebx + 0xf4], 0
mov byte [ebx + 0xf8], cl
inc dword [ebx + 0xf0]
cmp dword [ebx], 0x28
jne 0x10007e3a
push 0x14
lea eax, [ebx + 0x18]
push eax
lea eax, [ebx + 4]
push eax
call fcn.10027e80
mov eax, dword [ebx]
add eax, 0xfffffff7
push 0x50
lea eax, [ebx + eax*4]
push eax
lea eax, [ebx + 0x2c]
push eax
call fcn.10027e80
mov cl, byte [ebp + 0xb]
add esp, 0x18
mov dword [ebx], 0x14
mov eax, dword [ebx]
pop edi
mov dword [ebx + eax*4 + 0x2c], esi
mov eax, dword [ebx]
pop esi
mov byte [eax + ebx + 4], cl
inc dword [ebx]
pop ebx
pop ebp
ret 4

Function at 0x1005a17a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10059d7f

Function at 0x10061daf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10061589

Function at 0x10061dba
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100617c4

Function at 0x1006e0ea
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006de71

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x92bcf0
Capabilities:
Encode data using xor

Disassembly:
call fcn.00c4ffc2
call fcn.00b9c6ee
movsx edx, bp
lea esi, [edx + esi - 0x6384]
mov ebp, ecx
push edx
shr dword [esp + edx*2 - 0xc710], 0x7b
pop ecx
jns 0x867306
mov dword [esp + 4], 0x8c91b020
xor esi, esi
test eax, eax
lea esp, [esp + 8]
je 0x90baf3
push 0x3b85362c
mov dword [esp], edi
movzx edi, byte [edx]
push 0xef028610
push 0x71958d10
xor edi, esi
and edi, 0xff
mov edi, dword [edi*4 + 0xb8e824]
shr esi, 8
xor esi, edi
rol dword [esp + 4], 0x53
inc edx
xor esi, 0x2005608
dec eax
push 0xb134b713
lea esp, [esp + 0xc]
jne 0x92bd0e
mov edi, 0xcbb54039
call fcn.0090baeb
xchg byte [edi], dh
mov bl, 0x8a
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
mov ah, bl
xchg di, ax
and eax, 0x6672b387
xor ebx, dword [edi - 0x3cc1802a]
adc al, al
jle 0x92bddc
iretd
dec edi
sar dword [ebx - 0x1b], 1
aas
mov dl, 3
pop es
push eax
push ecx
ret

Function at 0xc08542
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx cx, byte [edx]
jno 0xc1559b
adc edi, 2
mov word [edi], cx
lea esp, [esp + 4]
jmp fcn.00869bb0
Function at 0xc210c4
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test cl, cl
jmp 0xb9cade
add eax, edx
call fcn.00c0ab64
add esp, 4
test eax, eax
jmp 0x8f8727
mov edi, dword [ecx + edx + 0x18]
test eax, ebp
test edi, edi
jmp 0xc338be
jge 0xb88280
lea edi, [esi - 1]
jmp 0xc148f3
ret
pop edi
pop ebx
add si, 0xee1e
add eax, edx
pop esi
jmp 0xb663a0
jae 0x916f77
mov cl, byte [eax + edx]
sub si, bp
lea eax, [eax + edx]
and esi, edx
adc esi, ebp
mov esi, eax
test cl, cl
jmp 0xc0fbac
mov esp, ebp
bswap bp
pop ebp
jmp 0x909097
mov eax, dword [ebp - 0xc]
bts si, bx
mov ecx, dword [ebp + 0x10]
test cx, bp
lea esi, [edi + ebx]
cmc
cmp si, 0xafbe
sar esi, 1
clc
test ax, 0xbdac
cmc
mov eax, dword [eax + esi*4]
push ecx
sar cl, cl
and cx, bp
shrd ecx, edi, 0x97
mov ecx, dword [ebp + 0xc]
test edi, 0x24b67ab7
jmp 0x871430
mov esp, ebp
pop ebp
ret
jle 0xc33089
lea ebx, [esi + 1]
shl edx, 0x31
cmc
cmp ebx, edi
not dl
seta dh
mov edx, dword [ebp + 8]
jle 0x92c3a2
mov ecx, dword [ebp - 4]
jmp 0xbf5856
jb 0x916f77
mov esi, dword [ebp - 0x10]
add esi, ecx
cmp eax, esi
jmp 0x91ff18
jae 0xb9cae4
mov esi, dword [ecx + edx + 0x1c]
cmp edx, esi
clc
lea eax, [esi + eax*4]
jmp 0xc0978d
je 0xb9cae4
cmp eax, ecx
jmp 0xb8a520
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
ja 0x8f020a
mov eax, esi
clc
cmp ecx, eax
sub eax, dword [ecx + edx + 0x10]
jmp 0xc1ab6b
jne 0xc0fbb2
je 0x905cec
mov cl, byte [esi + 1]
jmp 0xc5d3ca
jmp 0xc330bf
mov eax, dword [edx + 0x3c]
test bx, 0xa88c
add eax, edx
cmp dword [eax], 0x4550
jne 0xc44da4
mov ecx, dword [eax + 0x78]
clc
mov dword [ebp - 4], ecx
test ebp, 0x70b6c09b
test ecx, ecx
jmp 0xc0a571
mov eax, dword [eax + edx]
clc
test bl, bl
test eax, eax
jmp 0xb8f170
je 0xc44da4
mov eax, dword [eax + 0x7c]
test ebp, edi
test sp, 0xeb29
push ebx
push edi
cmp si, di
jmp 0xb92170
je 0xb9cae4
cmp cl, 0x2e
jmp 0xbac961
jmp 0xb8828d
jmp 0xc330b9
push ebp
sar dh, cl
xor dh, al
sar dh, 0x3c
mov ebp, esp
xor dx, bp
mov edx, dword [ebp + 8]
sub esp, 0x114
cmc
test di, 0x480
push esi
cmp cx, 0xbdaa
test edx, edx
jmp 0xc5ae12
mov edx, dword [ebp - 4]
not al
mov eax, dword [ebp + 8]
rcl ch, cl
xchg ch, ch
clc
mov ecx, dword [edx + eax + 0x24]
lea edx, [ecx + esi*2]
sal cl, cl
movzx eax, word [edx + eax]
shr dh, cl
mov ecx, dword [ebp - 4]
btr edx, 0xb5
rol dx, cl
mov edx, dword [ebp + 8]
cmp edi, 0x131a231e
stc
mov dword [ebp - 8], eax
sbb ah, 4
mov eax, dword [ebp - 8]
cmp eax, dword [ecx + edx + 0x14]
jmp 0xb8c80a
je 0xc330bf
mov eax, dword [ecx + edx + 0x20]
jmp 0xc588da
jl 0xc330bf
jmp 0x92c3a9
je 0xc44da4
mov eax, 0x5a4d
clc
stc
cmp word [edx], ax
je 0xc0854c
sub eax, eax
mov esi, 0x992b8bb
not esi
pop esi
jmp 0x929680
dec edi
add eax, edx
cmp sp, 0xb11e
sub ebx, ebx
mov dword [ebp - 0xc], eax
cmc
test edi, edi
jmp 0xc3a396
je 0xc44da4
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0xc44d8e
inc esi
jmp 0x869c1b
Function at 0x4011b3
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448589
push dword [ebp + 8]
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448584
push dword [ebp + 8]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44907c]
call sub.kernel32.dll_ResumeThread
mov dword [0x449088], 0x10007
push 0xa
call sub.kernel32.dll_Sleep
push 0x449088
push dword [0x44907c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x449140], eax
jne 0x401237
jmp 0x401239
jmp 0x401213
push dword [0x44907c]
call sub.kernel32.dll_SuspendThread
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448589
push dword [ebp + 8]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
leave
ret 4

Function at 0x40126e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448589
push dword [ebp + 8]
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push 0
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448599
push dword [0x4486d9]
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448584
push dword [ebp + 8]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448584
push dword [0x4486d9]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44907c]
call sub.kernel32.dll_ResumeThread
push 0xa
call sub.kernel32.dll_Sleep
mov dword [0x449088], 0x10007
push 0x449088
push dword [0x44907c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x449140], eax
jne 0x401340
jmp 0x401351
mov eax, dword [0x4486d9]
mov ebx, dword [0x449140]
cmp eax, ebx
je 0x4013b4
jmp 0x401323
push dword [0x44907c]
call sub.kernel32.dll_SuspendThread
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448589
push dword [ebp + 8]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448599
push dword [0x4486d9]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 0
leave
ret 4
push dword [0x44907c]
call sub.kernel32.dll_SuspendThread
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448589
push dword [ebp + 8]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449354]
push 0
mov al, byte [0x448588]
movzx ax, al
push ax
push 0x448599
push dword [0x4486d9]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 1
leave
ret 4
Function at 0x401ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f1c
xor eax, eax
leave
ret 0xc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x20
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, 1
leave
ret 0xc

Function at 0x401ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x402032
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push eax
call fcn.00402250
mov esi, eax
push esi
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push ebx
call fcn.004022d0
call sub.user32.dll_CloseClipboard
mov eax, edi
jmp 0x40203b
xor eax, eax
call sub.user32.dll_CloseClipboard
jmp 0x40203b
pop edi
pop esi
pop ebx
ret

Function at 0x40206c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402097
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40258a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x449cc0]
push edi
test esi, esi
jne 0x4025e7
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [0x449cc0], esi
xor edi, edi
push edi
push 8
pop ecx
call fcn.0040256b
pop ecx
push 8
shl eax, 0x18
pop ecx
test eax, eax
jns 0x4025cc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4025ce
add eax, eax
dec ecx
jne 0x4025bf
push eax
push 0x20
pop ecx
call fcn.0040256b
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
pop ecx
jl 0x4025af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
jmp 0x40260a
movsx edx, byte [eax]
xor edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
and edx, 0xff
shr edi, 8
xor edi, dword [esi + edx*4]
inc eax
mov dword [ebp + 0x10], edi
cmp eax, ecx
jb 0x4025f1
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret
Function at 0x4038fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.004038aa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.004038bf
lea eax, [ebp - 0x72c]
push eax
push dword [ebp + 8]
call fcn.004038bf
add esp, 0x14
push 0x70
pop ebx
lea esi, [ebp - 0x71c]
mov edi, ebx
lea eax, [esi - 0x10]
push esi
push eax
call fcn.004038bf
push esi
call fcn.00403872
add esp, 0xc
add esi, 0x10
dec edi
jne 0x403937
movsx edx, word [0x449930]
xor esi, esi
shl edx, 2
mov edi, dword [ebp + 0x10]
movsx eax, si
mov ecx, eax
add eax, edx
mov eax, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and eax, dword [ebp + ecx - 0x1c]
inc esi
mov dword [ecx + edi], eax
cmp si, 4
jb 0x40395c
mov dword [ebp - 8], 0x449af8
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403872
and dword [ebp - 4], 0
pop ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx - 0x1c6]
movzx ecx, word [ecx]
movsx esi, cx
movsx edi, ax
shl esi, 2
shl edi, 2
movsx eax, word [ebp - 4]
mov edx, dword [ebp + 0x10]
lea ebx, [esi + eax]
mov ebx, dword [ebp + ebx*4 - 0x72c]
mov ecx, eax
add eax, edi
xor ebx, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and ebx, dword [ebp + ecx - 0x1c]
add edx, ecx
xor dword [edx], ebx
inc dword [ebp - 4]
cmp word [ebp - 4], 4
jb 0x4039af
add dword [ebp - 8], 2
dec dword [ebp - 0xc]
jne 0x403988
pop edi
pop esi
pop ebx
leave
ret