joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100223f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1004004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1001290
push 0x80000002
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10023da
push edi
push edi
push edi
push edi
push 2
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov dword [ebp - 0x21c], eax
cmp eax, edi
jne 0x10022ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10023c5
push eax
call fcn.0100210d
mov esi, eax
cmp esi, edi
jne 0x10023c5
push ebx
mov ebx, dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov dword [ebp - 0x218], edi
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x218]
mov esi, eax
cmp esi, edi
jne 0x10023aa
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.01001c16
mov esi, eax
cmp esi, edi
jne 0x10023b4
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x214]
call fcn.01001cec
mov esi, eax
cmp esi, edi
jne 0x10023b4
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x228]
push eax
push dword [ebp - 0x210]
call fcn.01001e53
mov esi, eax
cmp esi, edi
jne 0x10023b4
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], edi
jmp 0x10022cb
cmp esi, 0x103
jne 0x10023c4
xor esi, esi
cmp dword [ebp - 0x214], edi
je 0x10023c4
push dword [ebp - 0x214]
call ebx
pop ebx
cmp dword [ebp - 0x21c], edi
je 0x10023da
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x210], edi
je 0x10023ee
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01002a47
leave
ret
Function at 0x1002a38
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003388
call fcn.01002be4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1004420
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100284d
cmp eax, esi
jne 0x1002840
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002850
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002827
xor esi, esi
inc esi
mov eax, dword [0x100441c]
cmp eax, esi
jne 0x1002863
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100289e
mov eax, dword [0x100441c]
test eax, eax
jne 0x1002898
mov dword [0x100441c], esi
push 0x1001114
push 0x1001108
call fcn.010027a4
pop ecx
pop ecx
test eax, eax
je 0x100289e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002968
mov dword [0x10040d4], esi
mov eax, dword [0x100441c]
cmp eax, esi
jne 0x10028c2
push 0x1001104
push 0x10010fc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100441c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10028cf
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1004424], ebx
je 0x10028f0
push 0x1004424
call fcn.01002b59
pop ecx
test eax, eax
je 0x10028f0
push ebx
push 2
push ebx
call dword [0x1004424]
push dword [0x10040bc]
push dword [0x10040c0]
push dword [0x10040b8]
call fcn.01002403
add esp, 0xc
mov dword [0x10040d0], eax
cmp dword [0x10040c4], ebx
jne 0x100294e
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10040d4], ebx
jne 0x100295c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10040d0]
call fcn.01002c29
ret
call fcn.01002d31
jmp 0x1002805
Function at 0x70c9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x22c000]
push edi
or ebp, 0xffffffff
jmp 0x70ca02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x70ca09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70c9f8
mov eax, 1
add ebx, ebx
jne 0x70ca1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70ca2c
jne 0x70ca4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ca4b
dec eax
add ebx, ebx
jne 0x70ca38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x70ca10
add ebx, ebx
jne 0x70ca47
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70ca9d
xor ecx, ecx
sub eax, 3
jb 0x70ca63
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x70cad2
sar eax, 1
mov ebp, eax
jmp 0x70ca6e
add ebx, ebx
jne 0x70ca6e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ca3c
inc ecx
add ebx, ebx
jne 0x70ca7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ca3c
add ebx, ebx
jne 0x70ca89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x70ca7e
jne 0x70ca9a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x70ca7e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70cabc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70caae
jmp 0x70c9fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70cabc
add edi, ecx
jmp 0x70c9fe
pop esi
mov edi, esi
mov ecx, 0x19e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70cada
cmp byte [edi], 9
jne 0x70cada
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x70cadf
lea edi, [esi + 0x30a000]
mov eax, dword [edi]
or eax, eax
je 0x70cb57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30ccc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30ccfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x70cb0c
mov ecx, edi
jns 0x70cb3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30cd00]
or eax, eax
je 0x70cb51
mov dword [ebx], eax
add ebx, 4
jmp 0x70cb29
call dword [esi + 0x30cd10]
mov ebp, dword [esi + 0x30cd04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x70cb8b
sub esp, 0xffffff80
jmp 0x401298
Function at 0x10020fb
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ax, word [esi]
cmp ax, 0x22
push 2
pop ecx
jne 0x100212e
add esi, ecx
mov ax, word [esi]
test ax, ax
je 0x1002126
cmp ax, 0x22
jne 0x1002116
cmp word [esi], 0x22
jne 0x1002146
jmp 0x1002144
cmp ax, 0x20
jbe 0x1002146
add esi, ecx
cmp word [esi], 0x20
ja 0x1002134
jmp 0x1002146
cmp ax, 0x20
ja 0x100214e
add esi, ecx
mov ax, word [esi]
test ax, ax
jne 0x100213e
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x1002168
movzx eax, word [ebp - 0x14]
jmp 0x100216b
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1022e840
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1022ea2d
pushal
mov esi, section..data
lea edi, [esi - 0xc3000]
push edi
or ebp, 0xffffffff
jmp 0x1022e86a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1022e871
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022e860
mov eax, 1
add ebx, ebx
jne 0x1022e883
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1022e894
jne 0x1022e8b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022e8b3
dec eax
add ebx, ebx
jne 0x1022e8a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1022e878
add ebx, ebx
jne 0x1022e8af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1022e905
xor ecx, ecx
sub eax, 3
jb 0x1022e8cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1022e93a
sar eax, 1
mov ebp, eax
jmp 0x1022e8d6
add ebx, ebx
jne 0x1022e8d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022e8a4
inc ecx
add ebx, ebx
jne 0x1022e8e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1022e8a4
add ebx, ebx
jne 0x1022e8f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1022e8e6
jne 0x1022e902
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1022e8e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1022e924
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1022e916
jmp 0x1022e866
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1022e924
add edi, ecx
jmp 0x1022e866
pop esi
mov edi, esi
mov ecx, 0x4328
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1022e942
cmp byte [edi], 0x12
jne 0x1022e942
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1022e947
lea edi, [esi + 0x227000]
mov eax, dword [edi]
or eax, eax
je 0x1022e9bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22e324]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22e43c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1022e974
mov ecx, edi
jns 0x1022e9a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22e440]
or eax, eax
je 0x1022e9b9
mov dword [ebx], eax
add ebx, 4
jmp 0x1022e991
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1022e9f0
cmp al, 0xef
ja 0x1022e9e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1022e9c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1022e9d2
mov ebp, dword [esi + 0x22e444]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1022ea24
sub esp, 0xffffff80
jmp 0x10061afd
Function at 0x438c79
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x438a14
pop esi
dec ecx
sub esp, 4
mov dword [esp], ecx
pop ecx
call fcn.00438cc0
sub ecx, 0x5193d23
xor dword [eax], esi
add ecx, 0x31a87963
inc eax
sub ebx, ecx
mov ebx, ecx
sub ebx, 0x673cb9f5
cmp eax, edi
jne fcn.00438c79
push 0x7a87070f
pop ecx
add ecx, 0xd509b485
ret
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3fe424e7
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..7LWLf
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x65d72e1c
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401460
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
sub esp, 0x58
mov dword [esp + 4], 0x39
mov dword [esp], 0x2002
mov dword [esp + 0x17], 0x414f4447
mov dword [esp + 0x1b], 0x444c5742
mov dword [esp + 0x1f], 0x45474b32
mov dword [esp + 0x23], 0x5555444a
mov dword [esp + 0x27], 0x58324958
mov dword [esp + 0x2b], 0x54593454
mov dword [esp + 0x2f], 0x424b4c57
mov dword [esp + 0x33], 0x41463645
mov dword [esp + 0x37], 0x5657454f
mov dword [esp + 0x3b], 0x59335249
mov dword [esp + 0x3f], 0x4c444e36
mov dword [esp + 0x43], 0x4a514241
mov dword [esp + 0x47], 0x34514b37
mov dword [esp + 0x4b], 0x59375432
mov byte [esp + 0x4f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x17]
mov dword [eax], edx
mov edx, dword [esp + 0x1b]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1f]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x23]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x27]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x2b]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2f]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x33]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x37]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x3b]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x3f]
mov dword [eax + 0x28], edx
mov edx, dword [esp + 0x43]
mov dword [eax + 0x2c], edx
mov edx, dword [esp + 0x47]
mov dword [eax + 0x30], edx
mov edx, dword [esp + 0x4b]
mov dword [eax + 0x34], edx
movzx edx, byte [esp + 0x4f]
mov byte [eax + 0x38], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4015a1
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x58
pop ebx
ret
Function at 0x401610
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3335
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x71316362
mov dword [esp + 0x19], 0x64686437
mov dword [esp + 0x1d], 0x7965386b
mov dword [esp + 0x21], 0x66766330
mov dword [esp + 0x25], 0x6a6a6777
mov dword [esp + 0x29], 0x68336a36
mov dword [esp + 0x2d], 0x67677a76
mov dword [esp + 0x31], 0x6d366a6e
mov dword [esp + 0x35], 0x717a777a
mov dword [esp + 0x39], 0x75783934
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401728
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x401730
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x776e
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x74367a71
mov dword [esp + 0x19], 0x7170686a
mov dword [esp + 0x1d], 0x67363378
mov dword [esp + 0x21], 0x34337a75
mov dword [esp + 0x25], 0x776b6c70
mov dword [esp + 0x29], 0x71776674
mov dword [esp + 0x2d], 0x72793670
mov dword [esp + 0x31], 0x6b717572
mov dword [esp + 0x35], 0x6a33357a
mov dword [esp + 0x39], 0x3968336b
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401848
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x401850
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
sub esp, 0x48
mov dword [esp + 4], 0x2d
mov dword [esp], 0x2002
mov dword [esp + 0x13], 0x46576139
mov dword [esp + 0x17], 0x70716332
mov dword [esp + 0x1b], 0x48626d38
mov dword [esp + 0x1f], 0x734a6565
mov dword [esp + 0x23], 0x584b6f63
mov dword [esp + 0x27], 0x515a7457
mov dword [esp + 0x2b], 0x42667839
mov dword [esp + 0x2f], 0x4e474868
mov dword [esp + 0x33], 0x65363150
mov dword [esp + 0x37], 0x39656668
mov dword [esp + 0x3b], 0x72776f59
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x13]
mov dword [eax], edx
mov edx, dword [esp + 0x17]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1b]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x1f]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x23]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x27]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2b]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x2f]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x33]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x37]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x3b]
mov dword [eax + 0x28], edx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2c], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401964
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x4019d0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x5248
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x44533531
mov dword [esp + 0x21], 0x75705739
mov dword [esp + 0x25], 0x6f4b6371
mov dword [esp + 0x29], 0x774c3137
mov dword [esp + 0x2d], 0x63674138
mov dword [esp + 0x31], 0x456d3932
mov dword [esp + 0x35], 0x43615279
mov dword [esp + 0x39], 0x316a6a56
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401aca
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x401b30
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x436a
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x31474433
mov dword [esp + 0x21], 0x4c4a3648
mov dword [esp + 0x25], 0x5a324858
mov dword [esp + 0x29], 0x6a555670
mov dword [esp + 0x2d], 0x39483674
mov dword [esp + 0x31], 0x44354c4a
mov dword [esp + 0x35], 0x41673963
mov dword [esp + 0x39], 0x636e4179
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401c2a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x401c30
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3733
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x64667830
mov dword [esp + 0x19], 0x65356266
mov dword [esp + 0x1d], 0x33333730
mov dword [esp + 0x21], 0x35326430
mov dword [esp + 0x25], 0x31343362
mov dword [esp + 0x29], 0x65646462
mov dword [esp + 0x2d], 0x38383066
mov dword [esp + 0x31], 0x32393237
mov dword [esp + 0x35], 0x36333564
mov dword [esp + 0x39], 0x65386264
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401d48
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret