joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413ed0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
inc esi
push esi
mov dword [ebp - 8], edi
call fcn.00414c09
push esi
push 0
push eax
mov dword [ebp - 4], eax
call fcn.0042eaf0
mov ebx, dword [ebp + 0x10]
add esp, 0x10
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x413f00
sub esi, ecx
xor ecx, ecx
add edi, 0x20
nop
mov eax, ecx
xor edx, edx
div esi
mov al, byte [edx + ebx]
mov byte [edi + ecx + 0x100], al
mov byte [edi + ecx], cl
inc ecx
cmp ecx, 0xff
jle 0x413f10
xor bl, bl
mov dword [ebp + 0x10], 0x100
mov esi, edi
nop word [eax + eax]
mov dl, byte [esi]
lea esi, [esi + 1]
movzx eax, byte [esi + 0xff]
add al, dl
add bl, al
movzx ecx, bl
add ecx, edi
sub dword [ebp + 0x10], 1
movzx eax, byte [ecx]
mov byte [esi - 1], al
mov byte [ecx], dl
jne 0x413f40
mov eax, dword [ebp - 4]
xor bh, bh
xor cl, cl
cmp dword [ebp + 0xc], 0
jbe 0x413fbc
sub dword [ebp + 8], eax
mov esi, eax
inc bh
lea esi, [esi + 1]
movzx edx, bh
mov bl, byte [edx + edi]
add cl, bl
mov byte [ebp + 0x13], cl
movzx ecx, cl
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
mov byte [ecx + edi], bl
movzx ecx, byte [edx + edi]
movzx eax, bl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp - 8]
movzx eax, byte [eax + ecx + 0x20]
mov ecx, dword [ebp + 8]
xor al, byte [ecx + esi - 1]
sub dword [ebp + 0xc], 1
mov cl, byte [ebp + 0x13]
mov byte [esi - 1], al
jne 0x413f75
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4144a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00421be1
test eax, eax
jne 0x4144e2
push str.Fatal_Error:_MFC_initialization_failed_n
call fcn.00414660
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x26c
call fcn.00414bcc
add esp, 4
test eax, eax
je 0x414506
mov ecx, eax
call fcn.0040f070
mov edi, eax
jmp 0x414508
xor edi, edi
mov ebx, 1
call fcn.00435cdf
cmp dword [eax], ebx
jle 0x4145fd
nop word [eax + eax]
call fcn.00435ce5
mov eax, dword [eax]
mov esi, dword [eax + ebx*4]
call fcn.004153de
test eax, eax
je 0x41464d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [esp + 0xc]
push esi
mov dword [esp + 0x10], eax
call fcn.004020d0
test al, al
jne 0x41457a
test esi, esi
jne 0x41455b
xor eax, eax
jmp 0x41456f
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414560
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.00402420
cmp dword [edi + 0x260], 0
mov esi, dword [esp + 0xc]
jne 0x4145c8
mov ecx, 0x4578dc
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4145b6
test dx, dx
je 0x4145b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4145b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x414590
xor eax, eax
jmp 0x4145bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4145c8
mov byte [edi + 0x220], 1
jmp 0x4145d7
lea ecx, [edi + 0x258]
push esi
push dword [ecx + 8]
call fcn.00415157
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4145ef
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc ebx
call fcn.00435cdf
cmp ebx, dword [eax]
jl 0x414520
mov ecx, edi
call fcn.0040fff0
cmp byte [edi + 0x220], 0
jne 0x414635
mov eax, dword [edi + 0x23c]
cmp dword [eax - 0xc], 0
je 0x414635
mov eax, dword [edi + 0x240]
cmp dword [eax - 0xc], 0
je 0x414635
mov ecx, edi
call fcn.0040fad0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
call fcn.0040b600
mov ecx, eax
call fcn.0040bad0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004025f0
int3
Function at 0x427795
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4277e8
push esi
push dword [ebp + 8]
call fcn.0042797e
mov edi, eax
test edi, edi
je 0x4277e3
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4277e3
mov eax, dword [ebp - 8]
jmp 0x4277fa
mov eax, dword [ebp + 0x10]
jmp 0x4277fa
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x43ad61
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043abd7
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x40a561
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0040a5e0
jae 0x40a56d
xor ecx, ecx
call fcn.0040a5e0
jae 0x40a597
xor eax, eax
call fcn.0040a5e0
jae 0x40a5a8
mov al, 0x10
call fcn.0040a5e0
adc al, al
jae 0x40a589
jne 0x40a5d5
stosb byte es:[edi], al
jmp 0x40a56e
call fcn.0040a5ec
dec ecx
loop 0x40a5b4
mov eax, ebp
call fcn.0040a5ea
jmp 0x40a5d6
lodsb al, byte [esi]
shr eax, 1
je 0x40a5fc
adc ecx, 2
mov ebp, eax
jmp 0x40a5d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0040a5ea
cmp eax, 0x7d00
jae 0x40a5d4
cmp eax, 0x500
jae 0x40a5d5
cmp eax, 0x7f
ja 0x40a5d6
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40a56e
pop ebp
ret 8

Function at 0x431005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401249
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x406080
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0xc], 0
jne 0x406095
xor eax, eax
pop ebx
add esp, 0xc
ret 8
push ebp
call fcn.00401d39
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
mov dword [esp + 0xc], eax
push edi
jmp 0x4060b0
mov eax, dword [0x56c728]
or eax, dword [0x56c72c]
jne 0x4060d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
mov eax, edx
shr eax, 3
jmp 0x406107
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0
push 0x64
push eax
push ecx
call fcn.004c0bd0
mov ecx, dword [0x56c72c]
push ecx
mov ecx, dword [0x56c728]
push ecx
push edx
push eax
call fcn.004c0b20
and eax, 0x7fffffff
sub eax, dword [esp + 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esp + 0x24]
jge 0x406168
mov esi, dword [ebx + 0xc]
lea edi, [esi + 0x224]
mov ecx, edi
call fcn.004808e0
mov esi, dword [esi + 0x84]
mov ecx, edi
call fcn.004808f0
cmp esi, 1
jne 0x406168
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x406168
mov edx, dword [ebx]
mov eax, dword [edx + 0xa0]
push esi
mov ecx, ebx
call eax
cmp eax, dword [esp + 0x20]
jne 0x4060b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x40128f
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
jmp 0x409b50
mov eax, dword [esp + 4]
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x409b60
mov eax, dword [esp + 0x14]
mov dword [esi], eax
imul eax, eax, 0x1b8
push eax
mov dword [esi + 0x208], 0
call fcn.004c2308
mov ecx, dword [esi]
imul ecx, ecx, 0x1b8
push ecx
push 0
push eax
mov dword [esi + 0x204], eax
call fcn.004c14b0
push 0x510e68
push edi
call fcn.004c20fd
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x409c88
push ebp
call fcn.004c2845
add esp, 4
test eax, eax
jne 0x409c7f
push ebx
lea esp, [esp]
mov eax, dword [esi + 0x208]
cmp eax, dword [esi]
jge 0x409c7e
imul eax, eax, 0x1b8
add eax, dword [esi + 0x204]
push ebp
push 4
push 1
push eax
call fcn.004c1e2a
mov edx, dword [esi + 0x208]
mov eax, dword [esi + 0x204]
imul edx, edx, 0x1b8
push ebp
push 0x1b0
lea ecx, [edx + eax + 8]
push 1
push ecx
call fcn.004c1e2a
mov edx, dword [esi + 0x208]
mov eax, dword [esi + 0x204]
imul edx, edx, 0x1b8
add edx, eax
lea ecx, [edx + 8]
lea edi, [ecx + 0x1b0]
add esp, 0x20
or eax, 0xffffffff
cmp ecx, edi
jae 0x409c61
movzx ebx, byte [ecx]
xor ebx, eax
sar eax, 8
and ebx, 0xff
and eax, 0xffffff
xor eax, dword [ebx*4 + 0x53a208]
add ecx, 1
cmp ecx, edi
jb 0x409c40
not eax
mov dword [edx + 4], eax
add dword [esi + 0x208], 1
push ebp
call fcn.004c2845
add esp, 4
test eax, eax
je 0x409bd0
pop ebx
push ebp
call fcn.004c1af7
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x40139d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
jmp 0x409eb0
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
lea edi, [esi + 0x1b0]
or eax, 0xffffffff
cmp esi, edi
mov ebp, ecx
mov ecx, esi
jae 0x409ef1
lea esp, [esp]
movzx edx, byte [ecx]
xor edx, eax
sar eax, 8
and edx, 0xff
and eax, 0xffffff
xor eax, dword [edx*4 + 0x53a208]
add ecx, 1
cmp ecx, edi
jb 0x409ed0
xor edi, edi
not eax
xor edx, edx
cmp dword [ebp + 0x208], edi
mov dword [esp + 0x10], eax
jle 0x409f3b
mov ebx, dword [ebp + 0x204]
xor eax, eax
xor ecx, ecx
lea ecx, [ecx]
mov esi, dword [esp + 0x10]
cmp dword [ecx + ebx + 4], esi
je 0x409f8d
mov esi, dword [ecx + ebx]
cmp esi, dword [eax + ebx]
jge 0x409f26
mov edi, edx
mov eax, ecx
add edx, 1
add ecx, 0x1b8
cmp edx, dword [ebp + 0x208]
jl 0x409f10
mov esi, dword [esp + 0x1c]
mov eax, dword [ebp + 0x208]
cmp eax, dword [ebp]
jge 0x409f51
mov edi, eax
add eax, 1
mov dword [ebp + 0x208], eax
mov eax, dword [ebp + 0x204]
imul edi, edi, 0x1b8
mov ecx, dword [esp + 0x10]
push 0
mov dword [eax + edi + 4], ecx
call fcn.004c2809
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0x204]
mov dword [edi + edx], eax
mov eax, dword [ebp + 0x204]
lea edi, [eax + edi + 8]
mov ecx, 0x6c
add esp, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x401569
Capabilities:
Read file on windows

Disassembly:
jmp 0x47fa60
push 0xffffffffffffffff
push 0x50b908
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53bbf0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esi + 4], vtable.InputTarget.0
mov ecx, dword [esp + 0x4c]
mov dword [esi + 8], vtable.ScrollBarTarget.0
xor ebp, ebp
push 0x510e68
push eax
mov dword [esp + 0x40], ebp
mov dword [esi], vtable.ViewFileScreen.2.0
mov dword [esi + 4], vtable.ViewFileScreen.1.0
mov dword [esi + 8], vtable.ViewFileScreen.0
mov dword [esi + 0x27128], ecx
mov dword [esi + 0x20], ebp
call fcn.004c20fd
mov edi, eax
add esp, 8
cmp edi, ebp
je 0x47fb23
push edi
call fcn.004c200c
push eax
call fcn.004c1f0d
mov ebx, eax
lea ebp, [ebx + 0x2000]
push ebp
call fcn.004c2308
push ebp
push 0
push eax
mov dword [esi + 0x20], eax
call fcn.004c14b0
mov edx, dword [esi + 0x20]
push edi
push ebx
push 1
push edx
call fcn.004c1e2a
push edi
call fcn.004c1af7
add esp, 0x2c
xor ebp, ebp
cmp dword [esi + 0x20], ebp
je 0x47fc0c
mov dword [esp + 0x14], ebp
mov eax, dword [esi + 0x20]
push 0x516f64
push eax
call fcn.004c4d20
add esp, 8
test eax, eax
je 0x47fc0c
mov eax, dword [0x563908]
cmp dword [eax + 0x6bc4], ebp
je 0x47fbaa
mov eax, dword [eax + 0x6bc4]
mov ecx, dword [esi + 0x20]
add eax, 0x20
push eax
push str.name
push ecx
call fcn.0048d100
mov edx, dword [0x563908]
mov eax, dword [edx + 0x6bc4]
mov ecx, dword [esi + 0x20]
add eax, 0x40
push eax
push str.squad
push ecx
call fcn.0048d100
mov edx, dword [0x563908]
mov eax, dword [edx + 0x6bc4]
mov ecx, dword [esi + 0x20]
push eax
push str.team
push ecx
call fcn.0048d100
add esp, 0x24
xor edi, edi
lea esp, [esp]
mov ecx, dword [0x56390c]
push edi
call fcn.004a9de0
mov ecx, dword [0x56390c]
push eax
call fcn.004aa690
mov ebx, eax
cmp ebx, ebp
je 0x47fbf0
push edi
lea edx, [esp + 0x20]
push str._dkey
push edx
call fcn.004c1313
mov ecx, dword [esi + 0x20]
push ebx
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.0048d100
add esp, 0x18
add edi, 1
cmp edi, 0x46
jl 0x47fbb0
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, 0xa
mov dword [esp + 0x14], eax
jl 0x47fb30
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
mov ecx, esi
mov dword [esi + 0x27124], ebp
mov dword [esi + 0x1c], edx
mov dword [esi + 0x2713c], ebp
mov dword [esi + 0x27130], ebp
mov dword [esi + 0x27138], ebp
call fcn.004022f2
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004c118f
add esp, 0x28
ret 0x10
Function at 0x401645
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x411e70
push 0xffffffffffffffff
push 0x50931b
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53bbf0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor eax, eax
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
xor edi, edi
cmp eax, edi
jne 0x412062
push 0x6c
call fcn.004c1ea3
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, edi
mov dword [esp + 0x58], edi
je 0x411ef4
push 0x400
push 0x14
push 0x2000
push 0x1000
push edi
push 4
push 0x4027ca
push edi
push edi
mov ecx, eax
call fcn.004a7c00
mov edi, eax
mov eax, dword [ebx + ebp*4 + 0x2144]
push 1
mov ecx, ebp
shl ecx, 8
lea edx, [ecx + ebx + 0x1f44]
push eax
push edx
mov ecx, edi
mov dword [esp + 0x64], 0xffffffff
call fcn.004a88e0
mov esi, eax
test esi, esi
je 0x41203a
call fcn.00401d39
mov ebp, eax
jmp 0x411f30
mov eax, dword [0x56c728]
or eax, dword [0x56c72c]
jne 0x411f53
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
mov eax, edx
shr eax, 3
jmp 0x411f8b
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push 0x64
push eax
push ecx
call fcn.004c0bd0
mov ecx, dword [0x56c72c]
push ecx
mov ecx, dword [0x56c728]
push ecx
push edx
push eax
call fcn.004c0b20
and eax, 0x7fffffff
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x2bc
jge 0x411fb8
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x411fb8
cmp dword [esi + 0xc], 2
je 0x411fbe
mov ecx, edi
call fcn.004a96a0
jmp 0x411f30
cmp dword [esi + 0xc], 2
jne 0x41202f
lea eax, [ebx + 0x224c]
lea edx, [esp + 0x29]
mov dword [esp + 0x14], 1
mov byte [esp + 0x28], 1
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x411fd7
push 0x21
lea edx, [esp + 0x2c]
push edx
push 0
mov ecx, esi
call fcn.004a9380
call fcn.00401d39
test ebx, ebx
mov dword [0x53e6ac], ebx
je 0x41202f
cmp dword [esi + 0xc], 2
jne 0x41202f
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x412027
mov ecx, edi
call fcn.004a96a0
cmp dword [0x53e6ac], 0
jne 0x412002
jmp 0x41202f
mov dword [esp + 0x18], 2
mov ecx, esi
call fcn.004a8450
mov ebp, dword [esp + 0x18]
test edi, edi
je 0x41204e
mov ecx, edi
call fcn.004a8870
push edi
call fcn.004c130e
add esp, 4
mov eax, dword [esp + 0x14]
add ebp, 1
cmp ebp, 2
mov dword [esp + 0x18], ebp
jl 0x411eb0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004c118f
add esp, 0x48
ret
Function at 0x401668
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
jmp 0x442640
push ecx
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4426ad
add esi, 0x9420
mov eax, esi
lea edx, [eax + 1]
jmp 0x442660
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x442660
sub eax, edx
je 0x4426a3
push edi
push 0x3e8
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [esi]
mov byte [eax], cl
add esi, 1
add eax, 1
test cl, cl
jne 0x442684
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
add esp, 4
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ecx
ret
Function at 0x401c17
Capabilities:
Write file on windows

Disassembly:
jmp 0x434540
mov eax, 0x2000
call fcn.004c11d0
push esi
push 0
call fcn.004c2809
push eax
call fcn.004c119e
push 0x2000
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004c14b0
add esp, 0x14
xor esi, esi
push edi
nop
call fcn.004c11ab
mov edi, eax
shl edi, 0x10
call fcn.004c11ab
or eax, edi
test esi, esi
mov dword [esp + esi*8 + 8], eax
jne 0x43458d
mov dword [esp + 8], esi
mov ecx, dword [esp + esi*8 + 8]
push ecx
call fcn.004020fe
mov dword [esp + esi*8 + 0x10], eax
add esi, 1
add esp, 4
cmp esi, 0x400
jl 0x434570
push 0x5111c8
push str.stbl
call fcn.004c20fd
add esp, 8
mov esi, eax
test esi, esi
pop edi
je 0x4345dd
push esi
push 0x2000
lea edx, [esp + 0xc]
push 1
push edx
call fcn.004c2a02
push esi
call fcn.004c1af7
add esp, 0x14
pop esi
add esp, 0x2000
ret
Function at 0x401c3a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x439ba0
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi], vtable.Door.0
xor ebx, ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
movsx eax, word [ecx + 0x28]
cdq
and edx, 0xf
add eax, edx
movsx edx, word [ecx + 0x3c]
sar eax, 4
add eax, edx
mov dword [esi + 0xc], eax
movsx eax, word [ecx + 0x2a]
cdq
and edx, 0xf
add eax, edx
movsx edx, word [ecx + 0x3e]
sar eax, 4
add eax, edx
mov dword [esi + 0x10], eax
movsx edx, word [ecx + 0x40]
mov eax, dword [esi + 0xc]
add edx, eax
mov dword [esi + 0x14], edx
movsx ecx, word [ecx + 0x42]
mov edx, dword [esi + 0x10]
add ecx, edx
mov dword [esi + 0x18], ecx
mov ecx, dword [0x563908]
mov ecx, dword [ecx + 0x1790]
mov ecx, dword [ecx + 4]
cmp ecx, eax
push edi
mov edi, ecx
jl 0x439c1e
mov edi, eax
cmp edi, ebx
jge 0x439c26
xor eax, eax
jmp 0x439c2c
cmp ecx, eax
jge 0x439c2c
mov eax, ecx
mov dword [esi + 0xc], eax
mov eax, dword [0x563908]
mov ecx, dword [eax + 0x1790]
mov eax, dword [ecx + 8]
cmp eax, edx
mov ecx, eax
jl 0x439c45
mov ecx, edx
cmp ecx, ebx
jge 0x439c4d
xor edx, edx
jmp 0x439c53
cmp eax, edx
jge 0x439c53
mov edx, eax
mov dword [esi + 0x10], edx
mov eax, dword [0x563908]
mov ecx, dword [eax + 0x1790]
mov eax, dword [ecx + 4]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
mov edi, eax
jl 0x439c6f
mov edi, ecx
cmp edi, ebx
jge 0x439c77
xor eax, eax
jmp 0x439c7d
cmp eax, ecx
jl 0x439c7d
mov eax, ecx
mov dword [esi + 0x14], eax
mov eax, dword [0x563908]
mov ecx, dword [eax + 0x1790]
mov eax, dword [ecx + 8]
mov ecx, dword [esi + 0x18]
cmp eax, ecx
mov edi, eax
jl 0x439c99
mov edi, ecx
cmp edi, ebx
jge 0x439ca1
xor eax, eax
jmp 0x439ca7
cmp eax, ecx
jl 0x439ca7
mov eax, ecx
xor ecx, ecx
cmp edx, eax
mov dword [esi + 0x18], eax
jge 0x439d44
push ebp
mov edi, dword [esi + 0xc]
cmp edi, dword [esi + 0x14]
jge 0x439d37
lea ecx, [ecx]
mov eax, dword [0x563908]
mov ebx, dword [eax + 0x1790]
mov eax, dword [ebx + 4]
mov ebx, dword [ebx + 0x1430]
imul eax, edx
add eax, edi
lea eax, [eax + eax*2]
mov al, byte [eax + ebx + 2]
xor al, byte [esi + ecx + 0x24]
add ecx, 1
and al, 0x1f
xor byte [esi + ecx + 0x23], al
mov eax, dword [0x563908]
mov ebp, dword [eax + 0x1790]
mov eax, dword [ebp + 4]
mov ebx, dword [ebp + 0x1430]
imul eax, edx
add eax, edi
lea eax, [eax + eax*2]
mov bl, byte [eax + ebx + 2]
mov eax, dword [ebp + 4]
xor bl, byte [esi + ecx + 0x23]
imul eax, edx
mov ebp, dword [ebp + 0x1430]
add eax, edi
and bl, 0x1f
lea eax, [eax + eax*2]
xor bl, byte [eax + ebp + 2]
add edi, 1
mov byte [esi + ecx + 0x23], bl
cmp edi, dword [esi + 0x14]
jl 0x439cc0
xor ebx, ebx
add edx, 1
cmp edx, dword [esi + 0x18]
jl 0x439cb5
pop ebp
mov ecx, dword [esi + 8]
movzx eax, word [ecx + 0x46]
cmp ax, bx
je 0x439d6a
movsx edx, ax
mov eax, dword [0x563908]
mov ecx, dword [eax + 0x17a8]
push edx
call fcn.00402392
mov dword [esi + 0x124], eax
pop edi
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x401d48
Capabilities:
Encrypt data using rc4 prga
Get mac address on windows

Disassembly:
jmp 0x404e90
mov eax, 0x14408
call fcn.004c11d0
mov eax, dword [0x53bbf0]
xor eax, esp
mov dword [esp + 0x14404], eax
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 8], 0x14400
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x404ee6
lea ecx, [esp + 4]
mov eax, 6
jmp 0x404ed0
cmp dword [ecx + 0x190], eax
jne 0x404ee0
cmp dword [ecx + 0x1a0], eax
je 0x404eff
mov ecx, dword [ecx]
test ecx, ecx
jne 0x404ed0
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x14404]
xor ecx, esp
call fcn.004c118f
add esp, 0x14408
ret
movzx eax, byte [ecx + 0x194]
cdq
shld edx, eax, 8
push esi
shl eax, 8
mov esi, eax
movzx eax, byte [ecx + 0x195]
push edi
mov edi, edx
cdq
or esi, eax
movzx eax, byte [ecx + 0x196]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x197]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x198]
or edi, edx
shld edi, esi, 8
shl esi, 8
cdq
or esi, eax
movzx eax, byte [ecx + 0x199]
mov ecx, dword [esp + 0x1440c]
or edi, edx
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
mov edx, edi
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004c118f
add esp, 0x14408
ret