joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001f8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001c7f1
call fcn.1001c3b8
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000219d
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x10001fdd
sub edx, ecx
sar edx, 1
inc edx
push ecx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], edx
call fcn.10001357
test eax, eax
js 0x1000219d
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1000202e
mov ecx, esi
call fcn.10001387
test al, al
je 0x1000202e
mov eax, esi
call fcn.1001c519
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000203a
push esi
lea ecx, [ebp - 0x428]
call fcn.10019b5b
push 3
push esi
mov edx, edi
mov ecx, eax
call fcn.10019b5b
mov edi, eax
test edi, edi
je 0x10002197
push 0x60
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x10002088
push 2
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], eax
test esi, esi
jne 0x10002088
call fcn.10001543
mov edi, eax
jmp 0x1000217c
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100020ab
call fcn.10001543
jmp 0x1000216f
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100020a1
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x100020de
mov edi, 0x8007000e
jmp 0x10002171
mov byte [ebp - 4], 2
call fcn.10005d4e
cmp eax, 0x400
jbe 0x100020fc
push eax
lea ecx, [ebp - 0x418]
call fcn.10019b5b
jmp 0x10002108
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1000212c
cmp dword [ebp - 0x418], 0
je 0x100020d4
mov ecx, dword [ebp - 0x418]
mov edx, edi
push edi
push dword [ebp - 0x420]
call fcn.10019b5b
pop ecx
pop ecx
mov ecx, eax
call fcn.100014e5
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x418]
call fcn.10019b5b
mov edi, eax
test esi, esi
je 0x1000217c
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100021b7
lea ecx, [ebp - 0x418]
call fcn.100058b0
jmp 0x100021b7
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x100021b2
lea ecx, [ebp - 0x418]
call fcn.100058b0
mov edi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.10005668
mov eax, edi
lea esp, [ebp - 0x440]
call fcn.1001c309
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x35744f04
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x32a34dab
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x40b840
Capabilities:
Encode data using xor

Disassembly:
push ecx
cmp eax, 0x100a
lea ecx, [esp + 8]
jb 0x40b860
xor dword [0xba1000], 0x10002d
inc ebx
test dword [ecx], eax
cmp eax, 0x775c1000
ja 0x40b8d2
in al, dx
Function at 0x40ceff
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
invalid
outsb dx, byte [esi]
je 0x40cd71
push ss
jge 0x40cdd1
xor bl, byte [edi - 7]
sub eax, dword [ebx + 0x1a]
int3
pop edx
jb 0x40ce52
and eax, 0x271a2552
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
cmp dword [edx], edi
inc ebx
lea ebp, [ebx + 0x7e1e0215]
cli
iretd
and byte [eax], dh
push edx
xor dword [edi - 0x5894b5bb], 0xa61ad2d5
outsd dx, dword [esi]
xor byte [edx - 0x7f], dl
mov bh, 0x45
dec edx
imul esp, dword [edi - 0x59e52d2b], 0x6f
pop eax
mov edx, 0x1a5219bb
mov byte [0x9fc60867], al
pop ss
mov eax, 0xe70fdd48
cli
push ebx
in eax, 0xf5
cmp eax, dword [ecx]
test dword [eax + ebp*2 + 0x3fa6163d], ebp
cmc
jp 0x40cdef
sub eax, 0xcb4dce67
jmp 0x40cdf0
dec edx
in al, 0x27
in eax, dx
push edx
rol dword es:[edi - 2], 1
fimul word [edi - 0x10]
fisub dword [esi - 0x1860b16d]
in eax, 0xd
dec esp
xchg edi, eax
movsb byte es:[edi], byte [esi]
dec ecx
xor ebx, ebx
jecxz 0x40ce72
sahf
pop ebx
push 0x65
pop edi
mov word [esi - 0x75], gs
jle 0x40ce64
mov edi, dword [esi - 0x11]
inc edi
xchg ebp, eax
pop edx
adc dl, ah
cmp dword [esi], esp
xchg ecx, eax
and byte [ebx + 0x3d9eef5], 0x2e
jbe 0x40ce8a
pop edx
in al, dx
push ds
dec esi
cwde
je 0x40ce16
insb byte es:[edi], dx
dec ebp
movsb byte es:[edi], byte [esi]
lea esp, [ecx + edx*2 + 0x50]
ficom dword [esi]
push ss
push 0x509dfb99
lodsd eax, dword [esi]
sub al, 0x51
test byte [ecx + 0x74], bh
cmp byte [edx], dh
xchg ebp, eax
je 0x40cee2
adc byte [edx - 0x64], 0xa7
cmc
push ecx
jo 0x40ce4e
lahf
add dword [edx - 0x72], ecx
ror dword [edi + ebx + 0x45c8cc52], 0x4a
xchg ebx, eax
mov word [esi + eax*4 + 0x2c], cs
in eax, dx
inc ebp
invalid
pop es
xlatb
invalid
in al, 0x6d
push ebp
mov dword [eax + ebx - 0x2e6899d0], edx
mov dword [edi + 0x78], ebp
dec ebx
xchg edi, eax
ror dword [ecx + 0x4bf2786f], 1
js 0x40ceda
dec ebx
jno 0x40ced0
daa
mov dword [ebp + ecx*2 + 0x1a3611f7], edx
inc esi
or ecx, edi
inc esi
dec ebp
add dh, byte [eax - 0x73]
fild dword [eax]
mov al, byte [0x70386e52]
outsb dx, byte [esi]
cmp byte [eax - 0x73], dh
push ebp
pushal
xor al, 0x29
sbb bh, dh
in eax, dx
sbb dword [ebp - 0x43396601], ebx
push edi
jo 0x40cee6
push edx
loop 0x40ceae
inc dword [ebx]
not byte cs:[ebx]
xchg ecx, eax
inc ebx
jno 0x40cef6
rcr byte [edi], 0x61
or byte [ecx + 0x126e01df], dl
pushfd
out 0x87, al
pop edi
or dword [ecx + 0x3cf8ca3c], ebx
retf
Function at 0x455e23
Capabilities:
Encode data using xor

Disassembly:
aad 0x56
jns 0x455e3c
loopne 0x455e1c
cmp dword [eax + 0x5f], edi
mov eax, dword [0x631ff7fa]
sub dword [ebp - 0x21], ebx
sbb ebp, dword [esi - 0x367b1916]
in al, dx
into
pushal
xor byte ss:[edi + 0xfbcbfb2], bh
mov edi, 0xfbcbfb2
int 0xd8
sub ebx, dword [edi + ebx*4]
xlatb
sar dh, 1
adc dh, byte [edx]
jmp 0x455ddc
lea edi, [ecx + 0x6d]
lodsb al, byte [esi]
test al, 0x63
xchg dword [edi + 0x701a40c9], ebx
lahf
leave
inc eax
sbb dh, byte [eax + 0x4f]
or ch, byte [esi]
jno 0x455e8b
ret 0xb22b
adc byte [ecx], cl
push 0x61
jecxz 0x455e84
shr bh, cl
or eax, 0xc4a83ee7
invalid
pushfd
cmp al, 0xe5
fcomp qword [ebx + 2]
lds ecx, [ecx + ecx]
jns 0x455ead
or dword [ecx + 0x26], edi
jb 0x455e8c
cld
add al, 0x85
test ebx, edx
les eax, [esi + 0x15ddf0d9]
jae 0x455eb2
rol esp, cl
xchg cl, bl
invalid
hlt
mov esp, 0xa1e07297
daa
cmp dword [ecx + 0x52d36c01], 0xffffff8f
loop 0x455e7c
or edx, dword [ebp + 0x684949d]
adc al, 0x18
invalid

Function at 0x45c93f
Capabilities:
Encode data using xor

Disassembly:
pop ds
jge 0x45c967
dec edi
jno 0x45c990
movsd dword es:[edi], dword [esi]
shl byte [ebp - 0x1b], cl
jecxz 0x45c948
out dx, al
int3
in al, dx
stc
or eax, 0xaf9177cc
xchg ecx, eax
scasd eax, dword es:[edi]
xor eax, 0x8d79e79a
push ss
out 0x79, eax
lea edx, [esi]
jno 0x45c960
cmp al, 0x58
adc al, 7
mov edi, 0xf2af295d
fidivr dword [edx]
mov bl, al
pop esi
cmp eax, 0xb488b9c8
je 0x45c944
mov ah, 0x74
loope 0x45c9d2
outsb dx, byte [esi]
sti
mov cl, 0xee
add eax, 0xf6ff7538
sbb ebp, dword [0x536ddb96]
mov edx, 0xb4385950
mov ch, 0xed
xor esi, dword [ebp - 0x74]
sub dword [ebx], eax
mov dh, 2
outsb dx, byte [esi]
add dword [eax], edi
mov bh, 0xe7
sub ch, byte [ecx - 0x6f]
aad 0xf2
paddsw mm3, qword [esi - 0x6e]
pop ecx
jl 0x45c916
fsubr qword [edx]
salc
outsd dx, dword [esi]
xlatb
aas
ret 0x8aca
jp 0x45ca2d
pcmpgtd mm2, mm4
jo 0x45ca12
aad 0xf7
retf 0x5f11
and eax, 0x8c73de02
pop ecx
dec ebx
mov word [ecx + 0x4b], ds
stc
cld
push esp
dec ebp
pop dword [eax]
xor al, 0x3d
push eax
ja 0x45ca83
sbb cl, ch
and eax, 0x88646f2a
invalid
pop esi
inc ebx
jmp 0x45ca0e
inc esp
aam 0xae
push esp
mov cl, 0xf9
jne 0x45ca9d
cmp ch, al
test byte [esi + 0x66b742c4], dl
xor edi, ebp
lahf
xor bh, dh
add ah, cl
adc dword [ecx - 0x3af61924], eax
jno 0x45cae3
out 9, al
lds esi, [ecx + 0x41]
movsb byte es:[edi], byte [esi]
invalid
add eax, 0xe98bad13
pop esp
sub eax, 0xc3716243
sub bl, byte [edx]
setb byte [edx]
invalid

Function at 0x4a556f
Capabilities:
Encode data using xor

Disassembly:
adc dword [edx - 0x2456deee], edx
aam 0xdc
neg byte [esi + 0x1d6662a4]
adc al, 0x8b
xlatb
lodsd eax, dword [esi]
std
mov ebp, 0xd4b6d91a
sahf
jge 0x4a55f2
push edi
inc ebp
xchg byte [ebx + 0x5d6a14b9], dh
xchg byte [eax - 0x5e], ah
salc
mov bl, 0xa4
movsd dword es:[edi], dword [esi]
wait
invalid
push edi
mov ecx, dword [eax + 0x4a]
dec edx
xor al, 0x76
loopne 0x4a55ea
adc byte [0x77f54df2], al
int1
dec ebp
cmc
ja 0x4a55e7
or dword [eax], 0x3cf1f466
jmp 0x5f4dca7d
Function at 0x4bf59e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c7368
cmp edx, dword [eax]
je 0x4bf5c0
add eax, 8
inc ecx
cmp eax, 0x4c73f8
jl 0x4bf5b1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c7368]
jne 0x4bf6ee
mov eax, dword [0x4cba7c]
cmp eax, 1
je 0x4bf6c8
test eax, eax
jne 0x4bf5f1
cmp dword [0x4c72a8], 1
je 0x4bf6c8
cmp edx, 0xfc
je 0x4bf6ee
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bf628
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bfcb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bfee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bf66b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bfee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c3b80
push edi
call fcn.004c16b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bfcb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bfcc0
lea eax, [ebp - 0xa0]
push 0x4c3b60
push eax
call fcn.004bfcc0
push dword [esi + 0x4c736c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bfcc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c1624
add esp, 0x2c
pop edi
jmp 0x4bf6ee
lea eax, [ebp + 8]
lea esi, [esi + 0x4c736c]
push 0
push eax
push dword [esi]
call fcn.004bfee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x50ec02eb
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5916542b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40181c
Capabilities:
Hash data using murmur3

Disassembly:
ror ecx, 0x10
mov dword [ebp - 0x74], ecx
pop ebx
pop esi
pop edi
ret
push edi
push esi
push ebx
mov ebx, dword [ebp - 0x60]
test ebx, ebx
rol ebx, 0xf
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x20]
test ebx, eax
ror eax, 0x11
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x200000
rol ecx, 0xd
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x24]
test edi, eax
rol eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x800000
ror ecx, 0x15
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x2c]
test edi, eax
rol eax, 0x12
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x8000000
ror ecx, 0x19
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x38]
test esi, eax
ror eax, 0xc
cmp ecx, eax
jne 0x4018d4
mov ecx, 0x1000
ror ecx, 0xa
add ebx, ecx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
test esi, eax
rol eax, 0xf
cmp ecx, eax
jne 0x4018d4
jmp 0x401990
xor ecx, eax
xor esi, esi
mov edx, 0xff
ror edx, 8
jmp 0x401a00
cmp ecx, esi
je 0x401990
mov ecx, esi
jmp 0x401808
inc ecx
jmp 0x401808
mov edi, eax
and edi, edx
cmp edi, edx
jne 0x40197c
shl ecx, 8
shl eax, 8
jmp 0x401a00

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x24f36cac
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7109349f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 2], eax
call fcn.004080f0
mov dh, 0xc4
adc al, 0x8b
invalid
add byte [edx + 0x30], 0x88
push ss
stosb byte es:[edi], al
add cl, 0x30
jae 0x407ebc
jmp 0x40740c
pop ebp
ret
push ebp
mov eax, dword [edi - 0x7d]
dec ebx
adc al, 0x30
jge 0x407f09
outsd dx, dword [esi]
fiadd word [edi]
mov dword [ebp + 0x10], 0xb9004e
fld qword [ebp + 8]
fcomp qword [0x40c230]
mov ecx, dword [ebp + 0x18]
adc bh, 0xc
and byte [esi - 7], dl
xor dl, al
inc eax
add byte [ebx - 0x287fe7b3], cl
or al, 0x20
push esi
stc
ret 0x40
not byte [edi - 0x21]
loopne 0x407ea3
mov cl, 0xfc
cwde
cmpsb byte [esi], byte es:[edi]
test ah, 0x2c
mov ebx, 0xdd0e7a61
pushfd
or cl, bl
loopne 0x407f08
pop ebp
mov dword [0x101c7], eax
add byte [eax], al
xchg byte [ebp + 0xc], cl
jge 0x407fa3
or byte [ebp + 0x51500145], cl
push edx
call dword [0x9bc181]
push ebx
pop ebp
or ch, bl
inc ebp
in al, dx
inc ebx
sbb eax, 0x40c230
rol ah, 1
or al, 0xdf
xor dl, al
inc eax
add al, dl
les ecx, [edi + ebx*8]
loopne 0x407f4d
les eax, [ebx + edi*2 + 0x72]
in al, 0xe2
push eax
cmp esi, ebx
test dword [ebp + ebx*8 + 0x1db8ec45], 0xd13ec230
fnstsw ax
test ah, 0x44
jnp 0x407fba
fld qword [ebp - 0x14]
in al, dx
mov eax, 0x3ec2301d
rcr edi, 1
loopne 0x407f64
les eax, [ebx + edi*2 + 0x48]
fld qword [ebp - 0xd]
fmul qword [ecx]
mov ebx, es
rol byte [eax], cl
lea eax, [ebp - 0x14]
push eax
sub esp, 8
xor ebx, dword [esp]
mov al, 0x15
invalid
xor eax, 0x5d8b0000
and byte [ecx - 0x7737d530], dh
cmpsd dword [esi], dword es:[edi]
inc esi
dec ebp
cld
inc ecx
cmp esp, edx
mov dword [ebp - 4], ecx
ja 0x407f62
test dword [ebx + 0x50], 0x5c14f03b
and al, 0x16
std
pop ss
inc edi
inc esi
cmp esi, eax
jb 0x407fc1
jmp 0x40801d
mov ebp, dword [esi + 0x18774e10]
mov eax, dword [ebp - 0x43]
test eax, eax
lcall 0x4d8b, 0xfc75035d
adc al, 0x3b
rcl dword [ebx], 0x9d
inc ebp
xchg byte [edi - 9], bl
fmul dword [ecx + 0x3c601]
push 0x8b5b5ec3
in eax, 0x5d
ret
Function at 0x40ae50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ah, byte [edi - 0x779cc3ba]
jp 0x40ae15
jbe 0x40ae1d
mov edx, edx
adc byte [ebx + 0x210064], bh
and eax, 0xc3ff
insd dword es:[edi], dx
idiv dword [ecx - 0x6277cffc]
adc byte [eax + 0x4eb4101], cl
mov byte [ebp + 0x41018810], bl
jmp 0x40ae21
cmp al, 9
jbe 0x40ae38
mov edx, dword [ebx + 0x10]
mov cs, word [edx]
das
add byte [0xff], ah
adc byte [esi + 0x2f360a], cl
and eax, 0xff
cdq
not dword [eax]
add al, 0x30
mov byte [ebx - 0x7d], ch
mov al, dl
add al, 0x30
aam 0x23
inc ecx
mov byte [ecx], 0x2e
inc ecx
clc
jne 0x40adf9
dec esp
inc ebp
or al, 0x5f
pop esi
mov byte [ecx - 1], 0
pop ebx
mov bl, 0x87
push ebp
mov ebp, esp
sub esp, 0xc
popfd
push esi
mov esi, dword [ebp + 0x10]
adc byte [edi - 0x7d], dl
add byte ds:[eax + 0x1f5cc711], bh
adc edi, eax
pop esp
pop ds
adc edi, eax
pop esp
pop ds
add byte [eax], al
mov ebp, 0xc033a44d
mov al, byte [0xc2cfe58b]
or al, 0
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x2c4f618]
je 0x40ae23
mov eax, dword [ebx + 0x54]
test eax, eax
sbb ebx, dword [esi - 0x75]
add ebp, dword [edx + 0x14]
push eax
xor edi, ebp
call fcn.00404a60
mov ecx, eax
mov dword [eax], edi
push 0x78
add al, 0x89
js 0x40aea2
mov dword [eax - 0x4b], edi
push edi
push edi
push edi
mov dword [eax + 0x10], edi
and eax, 0xff0c4b89
adc byte [0xff0c4b89], ah
adc eax, sym.imp.KERNEL32.dll_CreateEventA
mov edx, dword [ebx + 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x10]
mov cl, cl
and eax, 0xc0e8f8db
inc edi
add bh, bh
salc
test eax, eax
jne 0x40aed2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push eax
or al, 0
salc
ret
Function at 0x4045d0
Capabilities:
Set current directory

Disassembly:
push ecx
mov al, byte [esp + 8]
mov byte [esp + 3], dl
mov edx, ecx
push ebx
mov ebx, dword [0x4e211c]
test al, al
je 0x4045f8
inc dword [0x4e4b84]
add ebx, 0x108
mov dword [0x4e211c], ebx
mov ecx, 0x42
push esi
mov esi, 0x4e4860
push edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], edx
pop edi
pop esi
test al, al
je 0x40461d
push 0
mov ecx, 0x4e6d58
call fcn.0042a850
cmp dword [0x4e4b94], 0
xorps xmm0, xmm0
movlpd qword [0x4e7858], xmm0
je 0x40463c
push 0x4e4970
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 7], 0
jne 0x4046bf
mov cl, byte [ebx + 0xee]
test cl, cl
jne 0x404671
cmp byte [esp + 0x10], 0x65
sete cl
mov byte [ebx + 0xee], cl
jne 0x404671
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4e7864], 0
je 0x404683
cmp dword [0x4e7860], 0
jne 0x404687
test cl, cl
je 0x4046bf
mov byte [ebx + 0xec], 0
test cl, cl
jne 0x4046bf
cmp dword [0x4e7864], 0
jge 0x4046a8
mov dword [ebx + 0xe0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xdc], eax
mov eax, dword [0x4e7864]
mov dword [ebx + 0xe0], eax
pop ebx
pop ecx
ret
Function at 0x405e80
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x405ea2
call fcn.004061b0
test eax, eax
jne 0x405ea2
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.00405fb0
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x405ee8
cmp dword [esi + 0x18], eax
je 0x405ed8
cmp dword [esi + 8], eax
je 0x405ec5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4b9184
mov ecx, esi
call fcn.00405fb0
pop esi
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x405f2a
mov ecx, dword [esi + 0xc]
push ebx
xor bl, bl
test ecx, ecx
je 0x405f1b
cmp word [ecx], 0
push eax
sete bl
call edi
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
test bl, bl
pop ebx
push eax
je 0x405f5e
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x405f54
cmp dword [esi + 8], 0
je 0x405f41
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
ret 4
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x405f73
mov dword [esi + 4], 0
jmp 0x405f2a
cmp dword [esi + 0x18], 0
je 0x405f9d
cmp dword [esi + 8], 0
je 0x405f8a
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4b91a4
mov ecx, esi
call fcn.00405fb0
pop edi
pop esi
ret 4

Function at 0x4060a0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
test esi, esi
je 0x4060ba
mov dword [esi], 0
mov ebx, dword [esp + 0x21c]
lea eax, [ebx - 0xc000]
cmp eax, 0x3fff
ja 0x406190
push 0x104
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea eax, [esp + 0x10]
push str.Link_Source
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x406182
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [esp + 0xc]
push str.ObjectLink
push eax
call edi
add esp, 8
test eax, eax
je 0x406182
lea eax, [esp + 0xc]
push str.OwnerLink
push eax
call edi
add esp, 8
test eax, eax
je 0x406182
lea eax, [esp + 0xc]
push str.Native
push eax
call edi
add esp, 8
test eax, eax
je 0x406182
lea eax, [esp + 0xc]
push str.Embed_Source
push eax
call edi
add esp, 8
test eax, eax
je 0x406182
lea eax, [esp + 0xc]
push str.MSDEVColumnSelect
push eax
call edi
add esp, 8
test eax, eax
je 0x406178
lea eax, [esp + 0xc]
push str.MSDEVLineSelect
push eax
call edi
add esp, 8
test eax, eax
jne 0x406197
test esi, esi
je 0x406182
mov dword [esi], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret 8
xor eax, eax
mov word [esp + 0xc], ax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
Function at 0x4061b0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x18], 0
je 0x4061c0
mov eax, 1
pop ebx
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push dword [0x4e4b98]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
call edi
test eax, eax
jne 0x40622e
nop
mov eax, dword [0x4e2124]
cmp eax, 0xffffffff
je 0x4061ff
test eax, eax
je 0x40623f
call esi
mov ecx, dword [0x4e2124]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x40623f
mov edx, 1
mov dword [0x4e2114], 0
mov ecx, 0x8000012f
call fcn.00401a30
push dword [0x4e4b98]
mov dword [0x4e2114], 1
call edi
test eax, eax
je 0x4061e0
pop edi
pop esi
pop ebp
mov dword [ebx + 0x18], 1
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret