joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006c7d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x10241550], 0x1981
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x10006cdc
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [0x1024154c], 0x1811
mov dword [ebp - 0x34], eax
call fcn.10006a59
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10006b31
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0
je 0x10006ca1
jmp 0x10006d08
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x100086d6]
mov dh, byte [eax + 0x100086a7]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x10006ca9
jmp 0x10006cdc
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1024154c], 0x886
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1000687d
xor eax, eax
mov dword [0x10241550], 0x263c
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x50], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx], ecx
mov dword [0x1024154c], 0xf39
add ecx, 0x10a4
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10006da6
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x10006dde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1024154c], 0xf5e
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
xor edx, edx
lea esi, section..data
imul edi, ecx, 0x118
mov ebx, esi
add ebx, edi
add ebx, 0x6c
imul edi, ecx, 0x118
add esi, edi
add esi, 0x24
add ecx, 1
mov edi, dword [ebx]
movzx esi, word [esi]
xor esi, edi
add esi, eax
cmp ecx, 0x1ad
mov eax, esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x140], edx
jne 0x10006e0d
mov eax, dword [ebp - 0x140]
mov cl, byte [eax + 0x100086d6]
mov dl, byte [eax + 0x100086a7]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x140], eax
jne 0x10006e70
lea eax, [ebp - 0x12c]
mov dword [0x1024154c], 0xfffeb770
mov dword [ebp - 0x144], eax
call fcn.10006a59
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call fcn.10006b31
mov ecx, eax
mov dword [0x10241564], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0x6c
mov esi, dword [edi]
imul edi, eax, 0x118
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x118
add edx, ebx
add edx, 0x24
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.10005cba
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x1ad
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x10006f0d
lea eax, [0x100086b5]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x1024154c], 0x14c0
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.1000658d
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.100061a7
xor eax, eax
mov ecx, dword [0x10241550]
add ecx, 0x571
mov dword [0x10241550], ecx
mov ecx, dword [ebp - 0x148]
add ecx, 0x1235d0
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x12da00
mov dword [0x1024154c], 0x733
mov ecx, dword [ebp - 0x148]
add ecx, 0x11a329
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x2000
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505

Function at 0x401206
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.Mig1
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4030c0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x401325
push 1
push dword [0x4030c0]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Gendalf
push str.Mig1
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x4030c8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4030c8]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401325
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401308
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4012f0
Capabilities:
Schedule task via itaskservice

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea eax, [ebp - 0x4c]
sub esp, 0x8c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x406480
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x406320
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
js 0x401429
xor ecx, ecx
xor edi, edi
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov word [ebp - 0x38], cx
xor ebx, ebx
mov word [ebp - 0x18], di
mov ecx, dword [ebp - 0x18]
mov word [ebp - 0x48], dx
mov edx, dword [eax]
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp - 0x14]
mov word [ebp - 0x28], bx
mov dword [esp + 0x38], ecx
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0x40], ecx
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0x48]
mov dword [esp + 4], ecx
mov ecx, dword [ebp - 0x44]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x10], ecx
call dword [edx + 0x28]
sub esp, 0x44
test eax, eax
js 0x401420
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x18]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x1c]
mov ebx, eax
mov eax, dword [ebp - 0x4c]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x18]
sub esp, 4
test ebx, ebx
js 0x401440
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test byte [section..data], 1
jne 0x401460
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test byte [section..data], 1
je 0x401429
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.GetFolder_failed:__08lx_n
jmp 0x40146c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Connect_failed:__08lx_n
mov dword [esp + 8], str.get_tasks_root_folder
mov dword [esp + 4], 0x404000
mov dword [esp], 0
call fcn.004012a0
xor eax, eax
jmp 0x40142b
Function at 0x403210
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x403280
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401fc0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x47474fda
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58542df1
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401110
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x42b00c]
mov dword [eax], 1
jmp fcn.00401120
Function at 0x408070
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
test eax, eax
je 0x4080da
mov edi, eax
push 0xa
push 2
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4080da
mov ebx, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4080dc
mov ebp, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4080dc
mov edi, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4080dc
mov ebx, eax
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x4080dc
jmp 0x4080e0
mov ebp, dword [esp + 0x14]
push 0x42d2f2
push dword [ebp]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
test eax, eax
je 0x408117
mov ebx, eax
push eax
push edi
push 1
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x408117
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
test eax, eax
sete al
jmp 0x408119
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4086b0
Capabilities:
Create process on windows
Get common file path
Resume thread
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x16c
lea esi, [esp + 0x68]
mov dword [esp + 0x10], esi
movaps xmm0, xmmword [0x42d310]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4087d9
mov edi, dword [esp + 0x16c]
push esi
call fcn.00401350
add esp, 4
mov esi, eax
push str.DiscordUpdate.exe___processStart_Discord.exe
push eax
call fcn.00401670
add esp, 8
cmp dword [edi + 8], 0
je 0x408734
xor ebx, ebx
nop word cs:[eax + eax]
push 0x42d3aa
push esi
call fcn.00401670
add esp, 8
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push dword [eax]
push esi
call fcn.00401670
add esp, 8
inc ebx
cmp ebx, dword [edi + 8]
jb 0x408710
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movups xmmword [esp + 0x34], xmm0
movups xmmword [esp + 0x44], xmm0
mov dword [esp + 0x10], 0x44
movups xmmword [esp], xmm0
mov eax, dword [esi]
sub esp, 0x28
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], ecx
movaps xmm0, xmmword [0x42d320]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp]
test eax, eax
je 0x4087f4
test ecx, ecx
je 0x4087f4
push ecx
push dword [esp + 0x16c]
call fcn.0041cb20
add esp, 8
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp]
call esi
push dword [esp + 4]
call esi
add esp, 0x158
pop esi
pop edi
pop ebx
ret
push 0x10
push 0x42d372
push str.Could_not_get_the_LocalAppData_directory_path
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test ecx, ecx
je 0x408801
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
push 0x42d372
push str.Could_not_create_process__Update.exe_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x40b840
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
cmp eax, 0x47
jbe 0x40b981
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push eax
push 8
push dword [0x43d404]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [eax], edi
mov dword [eax + 0x3c], ebp
test edi, 0x40000
jne 0x40b8a1
test ebx, ebx
jne 0x40b8a1
mov eax, dword [0x43d3b4]
test eax, eax
je 0x40b9a1
mov ebx, dword [eax*4 + 0x43d370]
mov dword [esp + 0x18], ebx
test edi, 0x200000
je 0x40b8ad
jmp 0x40b8eb
mov ebx, dword [esp + 0x18]
test edi, 0x200000
jne 0x40b8eb
test ebx, ebx
je 0x40b8eb
test byte [ebx + 3], 0x40
jne 0x40b8e7
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x40b8d1
lea ecx, [esp + 0x18]
push ecx
push 0
push 9
push ebx
call eax
add esp, 0x10
test eax, eax
jne 0x40b8e7
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x40b8e7
lea ecx, [esp + 0x18]
push ecx
push 0
push 9
push ebx
call eax
add esp, 0x10
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x40b914
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov dword [esi + 8], ebx
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x40b956
nop
mov eax, ecx
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x40b900
add eax, 0xc
mov dword [eax], esi
test byte [ebx + 3], 0x40
jne 0x40b961
mov eax, dword [esp + 0x24]
mov dword [esi + 0x44], eax
mov eax, dword [0x43d40c]
inc eax
mov dword [0x43d40c], eax
mov dword [esi + 4], eax
test edi, 0x80000
je 0x40b94f
mov eax, dword [0x43d3b4]
cmp eax, 0x10
je 0x40b9c1
lea ecx, [eax + 1]
mov dword [0x43d3b4], ecx
mov dword [eax*4 + 0x43d374], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebx + 0x10]
mov dword [eax], esi
test byte [ebx + 3], 0x40
je 0x40b914
mov byte [0x43d408], 1
push 0
push 0
push str.Assertion_failure_on_line_1570
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [0x43d408], 1
push 0
push 0
push str.Assertion_failure_on_line_1540
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [0x43d408], 1
push 0
push 0
push str.Assertion_failure_on_line_1546
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [0x43d408], 1
push 0
push 0
push str.Assertion_failure_on_line_1589
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x412dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
movzx edx, byte [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov ecx, dword [ebp + 0x50]
cmp byte [esp + 0x20], 0
je 0x412ea5
test dl, dl
je 0x412ecd
test ecx, ecx
jle 0x412ec5
mov eax, dword [ebp + 0x4c]
mov dword [esp], eax
dec ecx
jmp 0x412e1b
mov ecx, esi
cmp edi, 2
jl 0x412ec5
lea edi, [ecx + 1]
mov dword [ebp + 0x50], ecx
mov esi, ecx
sub esi, 1
jb 0x412e10
cmp dword [esp], ecx
je 0x412e10
mov edx, ebp
mov ebp, dword [ebp + 0x48]
movzx eax, byte [ebp + ecx - 1]
mov ah, al
and ah, 0xdf
add ah, 0xbf
mov bl, 1
cmp ah, 0x1a
jb 0x412e58
mov ah, al
add ah, 0xd0
cmp ah, 0xa
setb ah
cmp al, 0x5f
sete bl
or bl, ah
movzx eax, byte [ebp + ecx]
mov ecx, eax
and cl, 0xdf
add cl, 0xbf
cmp cl, 0x19
ja 0x412e80
cmp edi, 2
setge al
mov ecx, esi
test bl, al
mov ebp, edx
jne 0x412e1b
jmp 0x412ec5
mov ecx, eax
add cl, 0xd0
cmp cl, 0xa
setb cl
cmp al, 0x5f
sete al
cmp edi, 2
jl 0x412ec5
mov ebp, edx
or al, cl
xor bl, al
mov ecx, esi
je 0x412e1b
jmp 0x412ec5
test ecx, ecx
jle 0x412eb2
mov eax, 0xffffffff
test dl, dl
jne 0x412ec0
cmp ecx, dword [ebp + 0x4c]
jge 0x412ec5
mov eax, 1
test dl, dl
jne 0x412ec5
add ecx, eax
mov dword [ebp + 0x50], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x4c]
jmp 0x412ee4
cmp bh, bl
jne 0x412ec5
cmp ecx, edx
jge 0x412ec5
inc ecx
mov dword [ebp + 0x50], ecx
test ecx, ecx
je 0x412ee4
cmp edx, ecx
je 0x412ee4
mov esi, dword [ebp + 0x48]
movzx eax, byte [esi + ecx - 1]
mov ah, al
and ah, 0xdf
add ah, 0xbf
mov bl, 1
mov bh, 1
cmp ah, 0x1a
jb 0x412f1f
mov ah, al
add ah, 0xd0
cmp ah, 0xa
setb ah
cmp al, 0x5f
sete bh
or bh, ah
movzx eax, byte [esi + ecx]
mov ah, al
and ah, 0xdf
add ah, 0xbf
cmp ah, 0x1a
jb 0x412ee0
mov ah, al
add ah, 0xd0
cmp ah, 0xa
setb ah
cmp al, 0x5f
sete bl
or bl, ah
jmp 0x412ee0

Function at 0x413750
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41378e
call dword [sym.imp.USER32.dll_EmptyClipboard]
test edi, edi
je 0x413791
mov ecx, 0xffffffff
nop dword [eax]
lea eax, [ecx + 1]
cmp byte [edi + ecx + 1], 0
mov ecx, eax
jne 0x413780
jmp 0x413793
pop esi
pop edi
ret
xor eax, eax
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
movzx ecx, byte [edi]
test cl, cl
je 0x4137bd
xor edx, edx
nop
mov byte [eax + edx], cl
movzx ecx, byte [edi + edx + 1]
inc edx
test cl, cl
jne 0x4137b0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x4137e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x18]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
xor esi, esi
test eax, eax
je 0x41394c
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x413946
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x413946
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
test eax, eax
je 0x41393f
mov ebp, dword [esp + 0x1c]
lea ecx, [eax + 1]
push ecx
push 0
push dword [0x43d404]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp]
mov esi, eax
xor eax, eax
cmp edx, 8
jb 0x4138b5
mov ecx, esi
sub ecx, ebx
cmp ecx, 0x20
jb 0x4138b5
xor eax, eax
cmp edx, 0x20
jb 0x413892
mov eax, edx
and eax, 0xffffffe0
xor ecx, ecx
nop
movups xmm0, xmmword [ebx + ecx]
movups xmm1, xmmword [ebx + ecx + 0x10]
movups xmmword [esi + ecx], xmm0
movups xmmword [esi + ecx + 0x10], xmm1
add ecx, 0x20
cmp eax, ecx
jne 0x413870
cmp edx, eax
je 0x413909
test dl, 0x18
je 0x4138b5
mov ecx, eax
mov eax, edx
and eax, 0xfffffff8
nop dword [eax]
movsd xmm0, qword [ebx + ecx]
movsd qword [esi + ecx], xmm0
add ecx, 8
cmp eax, ecx
jne 0x4138a0
cmp edx, eax
je 0x413909
mov ebp, eax
not ebp
add ebp, edx
and edx, 3
je 0x4138cb
movzx ecx, byte [ebx + eax]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x4138c0
cmp ebp, 3
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp]
jb 0x413909
nop word [eax + eax]
movzx ecx, byte [ebx + eax]
mov byte [esi + eax], cl
movzx ecx, byte [ebx + eax + 1]
mov byte [esi + eax + 1], cl
movzx ecx, byte [ebx + eax + 2]
mov byte [esi + eax + 2], cl
movzx ecx, byte [ebx + eax + 3]
mov byte [esi + eax + 3], cl
add eax, 4
cmp edx, eax
jne 0x4138e0
mov byte [esi + edx], 0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebp, ebp
je 0x41394c
mov eax, 0xffffffff
nop word cs:[eax + eax]
cmp byte [esi + eax + 1], 0
lea eax, [eax + 1]
jne 0x413930
mov dword [ebp], eax
jmp 0x41394c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret