joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405630
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429626
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x43900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], esi
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x18
mov ecx, esp
push 0x43a27c
call fcn.004158a0
lea ecx, [ebp - 0x148]
call fcn.004029c0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4056d0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00415c00
push edi
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00415d50
mov edx, dword [ebp - 0x11c]
add esp, 4
cmp edx, 0x10
jb 0x405737
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40572d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057a5
push edx
push ecx
call fcn.00417475
add esp, 8
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp edx, 0x10
jb 0x405788
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40577e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4057a5
push edx
push ecx
call fcn.00417475
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416e02
mov esp, ebp
pop ebp
ret
call fcn.0041c0c8
int3
Function at 0x4057b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429626
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x43900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], esi
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x18
mov ecx, esp
push 0x43a27c
call fcn.004158a0
lea ecx, [ebp - 0x148]
call fcn.004029c0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405850
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00415c00
push edi
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00415d50
mov edx, dword [ebp - 0x11c]
add esp, 4
cmp edx, 0x10
jb 0x4058b7
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4058ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405925
push edx
push ecx
call fcn.00417475
add esp, 8
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp edx, 0x10
jb 0x405908
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4058fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405925
push edx
push ecx
call fcn.00417475
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416e02
mov esp, ebp
pop ebp
ret
call fcn.0041c0c8
int3
Function at 0x405930
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429626
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x43900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], esi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x18
mov ecx, esp
push 0x43a27c
call fcn.004158a0
lea ecx, [ebp - 0x148]
call fcn.004029c0
add esp, 0x18
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4059d0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00415c00
push edi
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00415d50
mov edx, dword [ebp - 0x11c]
add esp, 4
cmp edx, 0x10
jb 0x405a37
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405a2d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405aa5
push edx
push ecx
call fcn.00417475
add esp, 8
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp edx, 0x10
jb 0x405a88
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405a7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405aa5
push edx
push ecx
call fcn.00417475
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416e02
mov esp, ebp
pop ebp
ret
call fcn.0041c0c8
int3
Function at 0x407b90
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4298e0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x43900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x43a174
lea ecx, [ebp - 0x40]
call fcn.004158a0
mov dword [ebp - 4], 0
xor edx, edx
mov ecx, 7
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
xor esi, esi
mov ebx, dword [ebp - 0x40]
cmp dword [ebp - 0x30], esi
jbe 0x407c42
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, ebx
movsx ax, byte [eax + esi]
movzx edi, ax
cmp edx, ecx
jae 0x407c23
lea eax, [edx + 1]
cmp ecx, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
mov word [eax + edx*2], di
mov word [eax + edx*2 + 2], cx
jmp 0x407c34
push edi
mov byte [ebp - 0x44], 0
push dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004165c0
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x407c42
mov edx, dword [ebp - 0x18]
jmp 0x407bf0
cmp ecx, 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407cfd
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x407c9e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407c94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d04
push edx
push ecx
call fcn.00417475
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
cmp eax, 0x10
jb 0x407ce1
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x407cd7
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d04
push ecx
push ebx
call fcn.00417475
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416e02
mov esp, ebp
pop ebp
ret
push 0
call fcn.0041a88f
call fcn.0041c0c8
int3
Function at 0x415690
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x415560
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4155f0
push 0
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x7530
call esi
jmp 0x4156c0

Function at 0x42158f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421405
Function at 0x40e03a
Capabilities:
Encode data using xor

Disassembly:
loopne 0x40e029
mov bh, 0x95
rol byte [eax - 0x27], 0xee
fstp st(0)
mov esp, ebp
pop ebp
ret
add byte [eax + eax*8 - 0x6e17918c], al
push esi
add al, byte [eax]
test al, al
je 0x40e097
mov dword [esp], 0x89a16659
mov eax, 0xe0205ba0
dec esi
mov bh, 0x9b
nop
add al, ah
dec esi
mov bh, 0xb6
mov word [eax], es
movsb byte es:[edi], byte [esi]
shl byte [ecx + esi - 0x3f], 1
mov edx, ecx
xor edx, 0xde
and ecx, 0x5e
lea ecx, [edx + ecx*2]
add cl, 2
mov byte [esp + eax + 0x64d0a460], cl
inc eax
cmp eax, 0x9b2f5ba4
jne 0x40e04a
call dword [0x44319c]
call dword [0x4431c4]
test eax, eax
je 0x40e08a
add al, ch
sbb eax, 0xe8000027
mov eax, 0x6a0002e0
add bh, bh
adc eax, 0x443190

Function at 0x40e8e3
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x87
xor cl, byte [esp + eax + 0x44]
add cl, 0x5d
mov byte [esp + eax + 0x44], cl
inc eax
or dword [esi], 4
jmp 0x40e8e1
fcom dword [eax - 0x6f6f6f70]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edi]
inc edi
test cl, cl
jne 0x40e8ec
mov byte [eax], 0
movzx ecx, byte [ebp + 0x60]
test cl, cl
je 0x40e917
lea edi, [ebp + 0x61]
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edi]
inc edi
test cl, cl
jne 0x40e90c
mov byte [eax], 0
add al, ah
dec esi
mov bh, 0xb6

Function at 0x40f1ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp byte [eax], 0x13
lodsd eax, dword [esi]
in al, dx
dec eax
push eax
sub esp, 0x7c
mov dword [ebp - 0x1c], esp
sub esp, 0x100
mov eax, esp
mov dword [ebp - 0x20], eax
mov ebx, eax
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x70
mov dword [ebp - 0x14], esp
sub esp, 0x24
mov esi, esp
cmp byte [eax], 0x13
lodsd eax, dword [esi]
in al, dx
or al, 0x89
call 0xad542a6d
in al, dx
inc eax
mov dword [ebp - 0x28], esp
sub esp, 0x80
mov dword [ebp - 0x38], esp
mov eax, dword [0x449d18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0x717e677c
mov ecx, 0x95

Function at 0x426e47
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp byte [eax], 0x13
lodsd eax, dword [esi]
in al, 0xf8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x57aa49b7
mov dword [esp + 0x58], 0x53b355b9
mov dword [esp + 0x5c], 0x5f6c51a5
mov dword [esp + 0x60], 0x5ba25db1
mov dword [esp + 0x64], 0x676659b5
mov byte [esp + 0x68], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x8e
xor cl, byte [esp + eax + 0x54]
add cl, 0x3a
mov byte [esp + eax + 0x54], cl
inc eax
or dword [esi], 4
jmp 0x426f38
inc esp
and al, 0x70
invalid
Function at 0x43a1cc
Capabilities:
Hash data using murmur3

Disassembly:
add byte [eax], al
add byte [ebx + 0x4c892849], cl
and al, 0x54
add eax, ecx
add eax, ebp
rol eax, 0xe
add eax, ebx
rol esi, 0xa
mov ebp, edx
xor ebp, esi
xor ebp, eax
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x2c]
mov dword [esp + 0x50], ecx
add ebx, ecx
add ebx, ebp
rol ebx, 0xf
add ebx, edi
rol edx, 0xa
mov ebp, eax
xor ebp, edx
xor ebp, ebx
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x30]
mov dword [esp + 0x1c], ecx
add edi, ecx
add edi, ebp
rol edi, 6
add edi, esi
rol eax, 0xa
mov ebp, ebx
xor ebp, eax
xor ebp, edi
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x34]
mov dword [esp + 0x58], ecx
add esi, ecx
add esi, ebp
rol esi, 7
add esi, edx
rol ebx, 0xa
mov ebp, edi
xor ebp, ebx
xor ebp, esi
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x38]
mov dword [esp + 0x30], ecx
add edx, ecx
add edx, ebp
rol edx, 9
add edx, eax
rol edi, 0xa
mov ebp, esi
xor ebp, edi
xor ebp, edx
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x3c]
mov dword [esp + 0x34], ecx
add eax, ecx
add eax, ebp
rol eax, 8
add eax, ebx
rol esi, 0xa
mov ecx, edx
xor ecx, esi
and ecx, eax
xor ecx, esi
add ebx, dword [esp + 0x40]
add ecx, ebx
add ecx, 0x5a827999
rol ecx, 7
add ecx, edi
rol edx, 0xa
mov ebx, eax
xor ebx, edx
and ebx, ecx
xor ebx, edx
add edi, dword [esp + 0x2c]
add edi, ebx
add edi, 0x5a827999
rol edi, 6
push es
add edi, esi
rol eax, 0xa
mov ebx, ecx
xor ebx, eax
and ebx, edi
xor ebx, eax
add esi, dword [esp + 0x58]
add esi, ebx
add esi, 0x5a827999
rol esi, 8
add esi, edx
rol ecx, 0xa
mov ebx, edi
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add edx, dword [esp + 0x24]
add edx, ebx
add edx, 0x5a827999
rol edx, 0xd
add edx, eax
rol edi, 0xa
mov ebx, esi
xor ebx, edi
and ebx, edx
xor dword [esi], ecx
add al, 0xeb
jnp 0x43a301
inc esp
and al, 0x54
add eax, ebx
add eax, 0x5a827999
rol eax, 0xb
add eax, ecx
rol esi, 0xa
mov ebx, edx
xor ebx, esi
and ebx, eax
xor ebx, esi
add ecx, dword [esp + 0x44]
add ecx, ebx
add ecx, 0x5a827999
rol ecx, 9
add ecx, edi
rol edx, 0xa
mov ebx, eax
xor ebx, edx
and ebx, ecx
xor ebx, edx
add edi, dword [esp + 0x34]
add eax, edx
loopne 0x43a38a
mov bh, 0x81
invalid
xor dword [esi], ecx
add al, 0xeb
jnp 0x43a3b2
sal dword [ecx], cl
sti
add eax, dword [esp + 0x20]
add ebx, eax
add ebx, 0x5a827999
rol ebx, 0xc
add ebx, ecx
rol esi, 0xa
and al, 0x28

Function at 0x43a53f
Capabilities:
Hash data using murmur3

Disassembly:
rol edx, 0xf
add edx, esi
rol eax, 0xa
mov ebx, ecx
not ebx
or ebx, edx
xor ebx, eax
add esi, dword [esp + 0x48]
add esi, ebx
add esi, 0x6ed9eba1
rol esi, 0xe
add ebx, eax
cmp dword [edx], 0xac1c1de
mov ebx, edx
not ebx
or ebx, esi
xor ebx, ecx
add edi, dword [esp + 0x40]
add eax, edx
loopne 0x43a5c4
mov bh, 0x81
invalid
retf
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44f004]
jne 0x40100a
repz ret
jmp fcn.004018f4

Function at 0x4067a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040261d
and dword [ebp - 4], 0
cmp dword [0x450cdc], 0
mov ebx, eax
jne 0x406859
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40690a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40690a
push eax
call fcn.004025ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x450cdc], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x450ce0], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x450ce4], eax
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x450cec], eax
test eax, eax
je 0x406859
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x450ce8], eax
mov eax, dword [0x450ce8]
cmp eax, ebx
je 0x4068b1
cmp dword [0x450cec], ebx
je 0x4068b1
push eax
call fcn.00402626
push dword [0x450cec]
mov esi, eax
call fcn.00402626
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4068b1
test edi, edi
je 0x4068b1
call esi
test eax, eax
je 0x4068a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4068a8
test byte [ebp - 0xc], 1
jne 0x4068b1
or dword [ebp + 0x10], 0x200000
jmp 0x4068ea
mov eax, dword [0x450ce0]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4068ea
mov eax, dword [0x450ce4]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x450cdc]
call fcn.00402626
pop ecx
test eax, eax
je 0x40690a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40690c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44ac70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
cmp ebp, 0x19f
jne 0x44ac91
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
test ebp, ebp
jle 0x44ace6
push esi
jmp 0x44aca0
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.0044ac60
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
movsx eax, byte [edi + ebx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
xor dword [esp + 0x18], eax
mov cl, byte [esp + 0x18]
mov byte [edi + ebx], cl
inc edi
cmp edi, ebp
jl 0x44aca0
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x44ad01
mov dword [0x2b4eef8], 0xa62e7790
mov dword [0x2b4eefc], 0xffffffff
add esp, 8
ret
Function at 0x444c18
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x444c6d
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444c74
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x444ce4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x444d59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00444930
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00438d98
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x444d43
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444d60
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x444d68
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x444ddd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00444930
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x444dc7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444de4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x46b128
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46b2d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46b2b4
mov dl, 1
mov eax, dword [0x4196a4]
call fcn.004038bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040471c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46b2a3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00487b78
test al, al
je 0x46b296
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46b2e4
lea eax, [ebp - 0x254]
call fcn.0040ad94
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46b296
xor eax, eax
push ebp
push 0x46b28f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46b31c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46b278
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46b278
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040499c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b296
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46b199
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041dda4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b2da
lea eax, [ebp - 0x260]
call fcn.0040471c
ret
Function at 0x479ca4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00479947
push eax
push esi
push dword [ebp + 8]
call fcn.004798fc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00479947
push eax
push esi
push dword [ebp + 8]
call fcn.004798fc
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00479947
push eax
push esi
push dword [ebp + 8]
call fcn.004798fc
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00479937
add byte [ecx - 0x627782f6], ch
jl 0x479dbc
invalid
invalid