joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4100a9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push ecx
push edx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrlenW
shl eax, 1
mov ebx, eax
add esi, eax
or eax, eax
jne 0x4100d4
mov esi, 2
jmp 0x410161
cmp eax, 2
jne 0x4100f4
cmp word [esi - 2], 0xd
je 0x4100e7
cmp word [esi - 2], 0xa
jne 0x4100f4
mov word [esi - 2], 0
mov esi, 2
jmp 0x410161
cmp word [esi - 2], 0xa
jne 0x410102
cmp word [esi - 4], 0xd
je 0x410110
cmp word [esi - 2], 0xd
jne 0x410114
cmp word [esi - 4], 0xa
jne 0x410114
xor esi, esi
jmp 0x410127
cmp word [esi - 2], 0xd
jne 0x410122
mov esi, 1
jmp 0x410127
mov esi, 2
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
or eax, eax
je 0x410176
or esi, esi
je 0x410176
cmp esi, 1
jne 0x410161
mov edx, 0x4186b0
add edx, 2
push 0
lea eax, [ebp - 4]
push eax
push 2
push edx
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
jmp 0x410176
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x4186b8
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
pop esi
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x40c0db]
shl eax, 2
mov dword [0x40c0df], eax
push edi
push ecx
xor eax, eax
mov edi, 0x40e788
mov ecx, 0x40ec88
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00401c6b
pop ecx
push 0x40c0a4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40c0e3], eax
push 0
jmp fcn.0040bb84
Function at 0x401231
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
call fcn.00407e20
mov ebx, eax
call fcn.00407e20
imul ebx, eax
mov dword [ebp - 4], ebx
call fcn.00407e20
mov edi, eax
and edi, 3
inc edi
mov eax, dword [ebp - 4]
xor ebx, ebx
cmp ebx, dword [ebp + 0x14]
jge 0x401403
mov edx, eax
and dl, 0xff
mov ecx, dword [ebp + 0x10]
xor byte [ecx + ebx], dl
mov ecx, edi
mov edx, eax
shl edx, cl
and edx, 0xffffffff
mov dword [ebp - 8], edx
mov ecx, 0x20
sub ecx, edi
shr eax, cl
and eax, 0xffffffff
or eax, dword [ebp - 8]
inc ebx
cmp ebx, dword [ebp + 0x14]
jl 0x401277
jmp 0x401403
mov eax, dword [ebp - 0x10]
cmp eax, 0x13
ja case.default.0x4012b4
jmp dword [eax*4 + 0x4012bb]
mov byte [esi], 0x55
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x8b
inc esi
mov byte [esi], 0xec
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x53
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x51
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x52
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x8b
inc esi
mov byte [esi], 0x5d
inc esi
mov byte [esi], 8
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0xb9
inc esi
mov edx, dword [ebp + 0x14]
mov dword [esi], edx
add esi, 4
jmp case.default.0x4012b4
mov byte [esi], 0xba
inc esi
mov eax, dword [ebp - 4]
mov dword [esi], eax
add esi, 4
jmp case.default.0x4012b4
mov dword [ebp - 0x14], 1
mov byte [esi], 0x8a
inc esi
mov byte [esi], 3
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x43
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x32
inc esi
mov byte [esi], 0xc2
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0xc1
inc esi
mov byte [esi], 0xc2
inc esi
mov edx, edi
mov byte [esi], dl
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x88
inc esi
mov byte [esi], 0x43
inc esi
mov byte [esi], 0xff
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0xe2
inc esi
mov byte [esi], 0xf3
inc esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
jmp case.default.0x4012b4
mov byte [esi], 0x5a
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x59
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x5b
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0x5d
inc esi
jmp case.default.0x4012b4
mov byte [esi], 0xc3
inc esi
jmp case.default.0x4012b4
mov dword [ebp - 0xc], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0
jne 0x401403
call fcn.00407e20
mov ebx, eax
and ebx, 3
test ebx, ebx
je 0x401403
push esi
call fcn.0040117c
pop ecx
mov esi, eax
dec ebx
test ebx, ebx
jne 0x4013f5
cmp dword [ebp - 0xc], 0
je 0x4012a8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406254
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.0040a088
pop ecx
mov ebx, eax
test eax, eax
jne 0x406278
xor eax, eax
jmp 0x406321
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x406299
cmp esi, 0x104
jb 0x4062a4
push ebx
call fcn.00409f80
pop ecx
xor eax, eax
jmp 0x406321
cmp byte [ebx + 1], 0x3a
jne 0x4062d4
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
jae 0x4062d4
push ebx
call fcn.00409f80
pop ecx
xor eax, eax
jmp 0x406321
inc esi
test edi, edi
je 0x406317
cmp esi, dword [ebp + 0x10]
jbe 0x4062e9
push ebx
call fcn.00409f80
pop ecx
xor eax, eax
jmp 0x406321
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.00409f80
pop ecx
mov eax, edi
jmp 0x406321
push esi
push ebx
call fcn.0040a51c
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x406328
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x40636d
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
je 0x40635c
cmp eax, dword [ebp + 0x10]
jle 0x4063f6
mov dword [0x40e558], 8
xor eax, eax
jmp 0x406461
cmp dword [0x40eba4], 1
jne 0x4063b2
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x4063f6
xor eax, eax
jmp 0x406461
call sub.KERNEL32.dll_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x4063f2
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
jmp 0x4063f6
xor eax, eax
jmp 0x406461
lea edx, [ebp - 0x10c]
push edx
call fcn.004018bc
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x406416
mov dword [0x40e558], 0x22
xor eax, eax
jmp 0x406461
test edi, edi
jne 0x406438
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040a088
pop ecx
mov edi, eax
test eax, eax
jne 0x406438
mov dword [0x40e558], 8
xor eax, eax
jmp 0x406461
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406994
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4069b3
mov eax, dword [0x40d784]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4069c0
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4069ed
je 0x4069ff
sub ecx, 0x100
je 0x406a0d
sub ecx, 0x100
je 0x406a14
sub ecx, 0x100
je 0x406a06
jmp 0x406a1b
sub ecx, 0x600
je 0x406a14
sub ecx, 0x100
je 0x4069ff
jmp 0x406a1b
mov edi, 1
jmp 0x406a20
mov edi, 2
jmp 0x406a20
mov edi, 4
jmp 0x406a20
mov edi, 5
jmp 0x406a20
mov edi, 3
test byte [ebp + 0xd], 1
je 0x406a47
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x40dc8c]
test al, 0x80
je 0x406a40
mov ebx, 0x80
jmp 0x406a59
mov ebx, 1
jmp 0x406a59
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x406a59
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x406a6b
je 0x406a74
dec eax
je 0x406a7d
jmp 0x406a86
mov dword [ebp - 4], 0x80000000
jmp 0x406a95
mov dword [ebp - 4], 0x40000000
jmp 0x406a95
mov dword [ebp - 4], 0xc0000000
jmp 0x406a95
push 1
call fcn.0040670c
pop ecx
mov ebx, eax
jmp 0x406b81
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x406ab1
sub eax, 0x10
je 0x406ab8
sub eax, 0x10
je 0x406ac1
sub eax, 0x10
je 0x406aca
jmp 0x406aca
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x406ad1
mov dword [ebp - 8], 1
jmp 0x406ad1
mov dword [ebp - 8], 2
jmp 0x406ad1
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x406b3a
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x406b2f
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x406b2f
add ebx, 0xffffffb2
push ebx
call fcn.0040670c
pop ecx
mov ebx, eax
jmp 0x406b81
mov edi, esi
push edi
call fcn.00406904
pop ecx
test eax, eax
je 0x406b4e
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x406b5a
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00406468
add esp, 8
mov ebx, eax
inc eax
jne 0x406b81
push 4
call fcn.0040670c
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a364
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40a7c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x40e55c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40a878
cmp byte [0x40c0da], 0
je 0x40a832
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.004098d4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40a81b
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.004098d4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40a81b
lea ebx, [ebp - 0x54]
jmp 0x40a81c
inc ebx
call fcn.0040a778
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x40a899
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40e560
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004018bc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40e563
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x40a899
cmp dword [0x40e55c], 0xffffffff
je 0x40a899
mov eax, dword [0x40e55c]
test eax, eax
je 0x40a899
cmp byte [eax], 0
je 0x40a899
push esi
push eax
call fcn.0040a928
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b564
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x40ec34], 0
jne 0x40b5e5
cmp dword [0x40ec50], 0
jne 0x40b594
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x40ec50], eax
test eax, eax
jne 0x40b594
push str.GetEnvironmentStrings_failed
call fcn.0040a8b0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x40ec50]
jmp 0x40b5a8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004018bc
pop ecx
mov edi, eax
test eax, eax
jne 0x40b5a0
lea edi, [ebp + 1]
push edi
call fcn.0040a088
pop ecx
mov ebx, eax
mov dword [0x40ec38], ebx
test ebx, ebx
jne 0x40b5d2
xor eax, eax
jmp 0x40b6a8
push edi
mov edx, dword [0x40ec50]
push edx
push ebx
call fcn.004016cc
add esp, 0xc
jmp 0x40b605
xor esi, esi
mov ebx, dword [0x40ec34]
jmp 0x40b5ff
push eax
call fcn.004018bc
pop ecx
test eax, eax
jne 0x40b5fb
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40b5ef
lea ebx, [esi + 4]
push 4
mov dword [0x40ec3c], ebx
inc ebx
push ebx
call fcn.0040992c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40b628
xor eax, eax
jmp 0x40b6a8
cmp dword [0x40ec34], 0
jne 0x40b659
xor esi, esi
mov ebx, dword [0x40ec38]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40b64a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004018bc
pop ecx
mov edi, eax
test eax, eax
jne 0x40b640
jmp 0x40b68a
xor esi, esi
mov ebx, dword [0x40ec34]
mov eax, dword [esp]
mov edi, eax
jmp 0x40b684
push eax
call fcn.004018bc
pop ecx
test eax, eax
je 0x40b679
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40b67d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40b668
mov eax, dword [0x40ec34]
test eax, eax
je 0x40b69a
push eax
call fcn.00409f80
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x40ec34], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401320
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push eax
push 0xf003f
push 0
push str.SOFTWAREPKPMMAINPATH
push 0x80000002
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x160
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401360
mov ecx, dword [esp + 0x14]
pop esi
mov byte [ecx], 0
add esp, 0xc
ret
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push esi
push eax
push 0
push 0x4031fc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401388
mov byte [esi], 0
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x4013c3
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
pop edi
cmp byte [ecx + esi], 0x5c
je 0x4013bf
test ecx, ecx
je 0x4013bf
mov byte [ecx + esi], 0
mov al, byte [ecx + esi - 1]
dec ecx
cmp al, 0x5c
jne 0x4013ae
mov byte [ecx + esi], 0
pop esi
add esp, 0xc
ret
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x403a94
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x41b550]
push ebx
push esi
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x18], ebx
test al, 8
je 0x403abc
and eax, 0xfffffff7
inc dword [0x41b58c]
mov dword [0x41b550], eax
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403c47
push dword [0x41b5a0]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x403c41
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x403c38
mov eax, dword [eax]
mov esi, dword [0x41b55c]
push edi
mov edi, dword [0x41b558]
add eax, edi
cmp eax, esi
jle 0x403b5c
xor esi, esi
mov dword [ebp - 0x10], esi
cmp eax, edi
jb 0x403b40
push 2
mov esi, eax
push esi
push dword [0x41b554]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x403b3d
mov edi, dword [0x41b558]
mov dword [0x41b554], edx
mov dword [0x41b55c], esi
jmp 0x403b62
mov esi, dword [ebp - 0x10]
push 0
push 0x10
push 0x70
push 0x76
push ebx
push dword [0x41be1c]
call fcn.0049adb9
add esp, 0x18
jmp 0x403c37
mov edx, dword [0x41b554]
mov eax, dword [0x41b590]
cmp eax, dword [0x41b594]
je 0x403b8b
push 8
pop edx
mov ecx, ebx
call fcn.004038c7
mov esi, dword [0x41b55c]
mov edi, dword [0x41b558]
mov edx, dword [0x41b554]
mov ebx, dword [0x41b58c]
sub edi, ebx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], edi
lea ecx, [edx + ebx]
mov eax, dword [eax]
mov dword [ebp - 8], eax
add eax, ecx
mov dword [ebp - 0x10], ecx
add edi, eax
lea ecx, [edx + esi]
mov dword [ebp - 4], eax
cmp edi, ecx
mov edi, dword [0x41b558]
ja 0x403beb
mov eax, dword [ebp - 0x14]
cmp eax, esi
jge 0x403beb
test eax, eax
js 0x403beb
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_memmove]
mov ebx, dword [0x41b58c]
add esp, 0xc
mov esi, dword [0x41b55c]
mov edi, dword [0x41b558]
mov edx, dword [0x41b554]
lea eax, [edx + esi]
cmp dword [ebp - 4], eax
mov eax, dword [ebp - 8]
jae 0x403c10
cmp eax, esi
jae 0x403c10
push eax
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
push dword [ebp - 0x10]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ebx, eax
add edi, eax
mov dword [0x41b58c], ebx
mov dword [0x41b558], edi
mov dword [0x41b590], ebx
mov dword [0x41b594], ebx
call fcn.00402bbe
xor esi, esi
inc esi
pop edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40636d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, 0x2000
mov dword [ebp - 8], ecx
push esi
call dword [sym.imp.msvcrt.dll_malloc]
push esi
mov edi, eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x401828
push MenuHelp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4064a3
push 3
push 0x1000
push edi
xor ebx, ebx
push ebx
push 9
push 0x110a
push dword [0x41b080]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x41b080]
mov edx, eax
call fcn.0040af0b
mov ebx, edi
test edi, edi
je 0x406433
push 0x5c
push ebx
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x406433
lea ebx, [eax + 1]
add ebx, 1
jne 0x4063e1
jmp 0x406433
xor ecx, ecx
cmp word [esi], cx
je 0x406433
push ecx
push ecx
lea eax, [ebp - 0xc]
push eax
push ecx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40645e
push 0x10
push 0xac
push 0xab
push dword [ebp - 8]
push dword [0x41be1c]
call fcn.0049adb9
add esp, 0x14
push ebx
mov edx, 0x1000
mov ecx, esi
call fcn.00404881
push esi
push 0x406290
push dword [ebp - 8]
push 0x70
push dword [0x41be1c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
je 0x4063fa
jmp 0x40648a
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x406465
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.msvcrt.dll_free]
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret