joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c310
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x44c3d4
mov ebx, 1
sub ebx, 1
mov esi, esi
add ebx, 1
lea eax, [ebx*4 + 0x5f5abc]
mov edx, 0
call fcn.00408d20
mov dword [ebx*4 + 0x5f5adc], 0xffffffff
cmp ebx, 7
jl 0x44c348
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x44c3d4
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0xa
call fcn.004096e0
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.004440d0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x44c3d4
push 4
push ebx
push esi
mov eax, 0x44c1d0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x44c270
push eax
call sub.kernel32.dll_EnumCalendarInfoA
call fcn.0040dae0
lea eax, [ebp - 0x38]
call fcn.00403d50
pop eax
test eax, eax
je 0x44c3eb
call fcn.0040dc10
pop esi
pop ebx
leave
ret
Function at 0x44ca90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x48]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x44cbdc
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.004436f0
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00408d20
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.0040a320
mov eax, dword [ebp - 0x48]
mov edx, 0
call fcn.00408d20
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x44]
jmp 0x44cbcb
lea ecx, [ebp - 0x34]
mov eax, ebx
mov dx, 0
call fcn.00409640
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 8]
call fcn.00408d20
mov eax, dword [ebp - 8]
test eax, eax
je 0x44cb43
mov eax, dword [eax - 4]
mov dword [ebp - 0x40], eax
lea esi, [ebp - 8]
mov al, 0
mov dx, 1
mov cl, al
mov eax, esi
call fcn.0040a320
mov edx, dword [ebp - 8]
mov al, 0x3d
call fcn.00409c40
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [edi - 1]
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00409b10
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.004436f0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 4]
call fcn.004097e0
test eax, eax
jne 0x44cbc0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x44cba2
mov eax, dword [eax - 4]
sub eax, edi
mov ecx, eax
lea eax, [edi + 1]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00409b10
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
call fcn.00408d20
jmp 0x44cbd4
mov edx, dword [ebp - 0x40]
lea eax, [ebx + edx]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x44cb20
push dword [ebp - 0x44]
call sub.kernel32.dll_FreeEnvironmentStringsA
call fcn.0040dae0
lea eax, [ebp - 0x3c]
call fcn.00403d50
lea eax, [ebp - 0x38]
call fcn.00403d50
lea eax, [ebp - 0x34]
call fcn.00403d50
lea eax, [ebp - 4]
call fcn.00403d50
lea eax, [ebp - 8]
call fcn.00403d50
pop eax
test eax, eax
je 0x44cc13
call fcn.0040dc10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44cc20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x44cd24
mov eax, dword [ebp - 0x3c]
mov edx, 0
call fcn.0040b240
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0044a540
jmp 0x44cd13
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b1f0
mov edx, dword [ebp - 4]
mov al, 0x3d
call fcn.0040b990
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebx - 1]
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040b8e0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0044a540
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.0040b750
test eax, eax
jne 0x44cd02
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x44cce4
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea eax, [ebx + 1]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0040b8e0
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
call fcn.0040b240
jmp 0x44cd1e
mov eax, esi
call fcn.00404250
shl eax, 1
lea eax, [esi + eax]
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x44cc90
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
call fcn.0040dae0
lea eax, [ebp - 0x38]
call fcn.0040af90
lea eax, [ebp - 0x34]
call fcn.0040af90
lea eax, [ebp - 4]
call fcn.0040af90
lea eax, [ebp - 8]
call fcn.0040af90
pop eax
test eax, eax
je 0x44cd53
call fcn.0040dc10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4695e0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
mov byte [ebp - 4], al
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x469735
cmp byte [ebp - 4], 0
je 0x4696df
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040aa20
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040aa20
lea eax, [ebp - 0x44]
call fcn.0040af90
movzx eax, byte [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x48]
call fcn.0040b4f0
mov edx, dword [ebp - 0x48]
mov ecx, 0x5a646c
lea eax, [ebp - 0x44]
call fcn.0040b280
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
call fcn.0040b180
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x4696df
push 0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea ecx, [ebp - 0x4c]
mov dx, 0
call fcn.004095e0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov ecx, 0x5a647c
call fcn.00408e20
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x469735
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040aa20
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040aa20
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
call fcn.0040ade0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00408d20
cmp byte [ebp - 4], 0
je 0x469735
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
call fcn.0040dae0
lea eax, [ebp - 0x4c]
call fcn.00403d50
lea eax, [ebp - 0x48]
call fcn.0040af90
lea eax, [ebp - 0x44]
call fcn.0040af90
lea eax, [ebp - 0xc]
call fcn.0040a480
lea eax, [ebp - 0x10]
call fcn.0040a480
lea eax, [ebp - 0x14]
call fcn.0040a480
pop eax
test eax, eax
je 0x469774
call fcn.0040dc10
leave
ret

Function at 0x4698b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x4698fb
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0040c580
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4698f2
mov eax, 0x5f42e0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
call fcn.0040dae0
lea eax, [ebp - 0x34]
call fcn.0040af90
pop eax
test eax, eax
je 0x469912
call fcn.0040dc10
mov eax, dword [ebp - 8]
leave
ret
Function at 0x487ef0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 4]
mov edi, edx
mov dword [esp], eax
lea eax, [ecx - 1]
mov esi, eax
mov ecx, 0
cmp esi, ecx
jl 0x487f38
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov al, byte [esp]
mov dl, byte [edi]
xor dl, al
movzx eax, dl
mov ebx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ebx*4 + 0x5f6120]
xor edx, eax
mov dword [esp], edx
add edi, 1
cmp esi, ecx
jg 0x487f10
mov eax, dword [esp]
lea esp, [esp + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x4a73c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov ecx, eax
mov eax, 0
lea ebx, [ecx + 1]
movzx edx, byte [ecx]
add edx, 1
and edx, 0xff
lea edx, [ecx + edx]
jmp 0x4a73f1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor esi, ecx
mov eax, esi
add ebx, 1
cmp ebx, edx
jb 0x4a73e0
pop esi
pop ebx
ret

Function at 0x4b2f30
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4b2f60
mov eax, esi
call fcn.004b7390
cmp byte [esi + 0x40], 0
je 0x4b2f59
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4b2ff8
mov dword [esi + 0x14], 0xcb
cmp dword [esi + 0x14], 0xcb
jne 0x4b2fda
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4b2fd2
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4b2f89
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4b2f9d
mov bl, 0
jmp 0x4b2ff8
cmp edi, 2
je 0x4b2fd2
cmp dword [esi + 8], 0
je 0x4b2f7c
cmp edi, 3
je 0x4b2fb2
cmp edi, 1
jne 0x4b2f7c
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
cmp eax, dword [edx + 8]
jl 0x4b2f7c
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
jmp 0x4b2f7c
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4b2fef
cmp dword [esi + 0x14], 0xcc
je 0x4b2fef
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004b32e0
mov eax, esi
call fcn.004b3000
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x4cf340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4cf356
jmp 0x4cf391
mov eax, dword [0x578180]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x168]
cmp eax, dword [edx + 0x28]
je 0x4cf36b
jmp 0x4cf391
mov eax, dword [0x578180]
cmp byte [eax + 0x114], 0
je 0x4cf37b
jmp 0x4cf391
mov eax, dword [0x578550]
mov edx, dword [0x578550]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x578550]
mov edx, dword [0x578550]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
je 0x4cf3ae
jmp 0x4cf48d
mov eax, dword [0x578180]
cmp byte [eax + 0x114], 0
je 0x4cf3c1
jmp 0x4cf48d
mov eax, dword [0x578550]
mov edx, dword [0x578550]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.005486b0
mov eax, dword [0x578180]
cmp dword [eax + 0x168], 0
jne 0x4cf3e6
jmp 0x4cf452
push 0x10
push 0
mov eax, dword [0x578180]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x578180]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x578180]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x578180]
mov eax, dword [eax + 0x168]
call fcn.004eee00
test al, al
jne 0x4cf440
jmp 0x4cf452
push 0
mov eax, dword [0x578180]
call fcn.0041f790
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x578180]
call fcn.00422800
jmp 0x4cf52c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4cf498
jmp 0x4cf4e6
mov eax, dword [ebp - 4]
mov edx, dword [0x578180]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x168]
je 0x4cf4ae
jmp 0x4cf4e6
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x578180]
call fcn.00422800
jmp 0x4cf52c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4cf4f1
jmp 0x4cf52c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x488], 8
jne 0x4cf505
jmp 0x4cf52c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x578550]
mov edx, dword [0x578550]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
leave
ret
Function at 0x4d5850
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
jne 0x4d5881
jmp 0x4d5900
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jg 0x4d589d
jmp 0x4d5900
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x4d58e2
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040dae0
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4d58fc
call fcn.0040dc10
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
leave
ret
Function at 0x4d5f80
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x78]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, 1
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x4d60ee
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4d5fe5
jmp 0x4d6089
lea eax, [ebp - 0x40]
call fcn.00403d50
lea eax, [ebp - 0x44]
call fcn.00403d50
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
call fcn.0046acd0
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
call fcn.00408d20
lea eax, [ebp - 0x44]
call fcn.00403d50
lea eax, [ebp - 0x54]
call fcn.00403d50
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x10]
call fcn.0046ac80
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x44]
call fcn.00408d20
call fcn.0046b2c0
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0046c750
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4d60ee
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040d860
call fcn.0040f450
push eax
test eax, eax
jne 0x4d60cc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
call fcn.0040dae0
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4d60e3
call fcn.0040dc10
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
call fcn.0040dae0
lea eax, [ebp - 0x54]
call fcn.00403d50
lea eax, [ebp - 0x44]
call fcn.00403d50
lea eax, [ebp - 0x40]
call fcn.00403d50
pop eax
test eax, eax
je 0x4d6115
call fcn.0040dc10
pop ebx
leave
ret
Function at 0x52cde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
cmp ebx, esi
jl 0x52ce4b
sub esi, 1
lea esi, [esi]
add esi, 1
push dword [ebp - 8]
push esi
mov ecx, esi
mov eax, ecx
sar eax, 0x1f
mov edx, eax
mov eax, ecx
xor eax, edx
sub eax, edx
and eax, 0x1f
mov ecx, edx
xor ecx, eax
mov eax, ecx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 4]
push dword [eax + edx*4]
push edi
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0052c380
cmp ebx, esi
jg 0x52ce10
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x5647c0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
leave
ret
Function at 0x1401bd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1572540
push 0x1420310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x1401c72
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1401c72
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x1401c72
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x1401c72
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1401f20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x1401fe8
nop word [eax + eax]
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x1401f65
sub edi, 0x8000000
jmp 0x1401fe0
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1401fe8
cmp dword [ebp - 0xc], 0x10000
jne 0x1401fcb
cmp dword [ebp - 0x10], 0x10000
jb 0x1401fcb
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x14020a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x1401fe8
sub edi, 0x10000
jmp 0x1401fe0
mov ecx, dword [ebp - 0x18]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x1401f50
movzx eax, si
test eax, eax
je 0x1401ff7
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 8]
cmp esi, edi
jae 0x14020a2
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [eax + eax]
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x1402025
add esi, 0x8000000
jmp 0x140209a
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call ebx
test eax, eax
je 0x14020a2
cmp dword [ebp - 0xc], 0x10000
mov ecx, dword [ebp - 0x10]
jne 0x1402085
cmp ecx, 0x10000
jb 0x1402085
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x14020a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x14020a2
add esi, 0x10000
jmp 0x140209a
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x140209a
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x1402010
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x14020b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x159e0c0], 0
jne 0x140212c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x159e0c0
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x140212c
push esi
mov esi, dword [0x159e0cc]
mov dword [0x159e0d4], eax
mov dword [0x159e0d0], eax
mov dword [0x159e0c8], eax
push edi
test esi, esi
je 0x140210e
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x140211b
mov esi, dword [esi + 4]
test esi, esi
jne 0x14020f5
xor eax, eax
pop edi
mov dword [0x159e0bc], eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x159e0bc], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret