joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78ea62
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edx*4]
push dword [esp + 0xc]
popal
rdtsc
xchg dword [esp], esi
mov ah, byte [esp + 3]
jmp 0x78e994
neg bp
and si, 0x9b2a
xchg byte [esp + 0x12], bl
mov dx, word [esp + 0x1f]
xchg byte [esp], al
xchg word [esp + 0xd], bp
jmp 0x78e942
push dword [esp + 3]
inc esi
neg ch
bswap esi
mov si, dx
pop ebp
jmp 0x78e9c4
mov dx, word [esp + 2]
mov bp, word [esp]
mov ebx, eax
pushal
rdtsc
add eax, ebp
jmp 0x78e97e
mov ebp, dword [esp + 1]
lea esp, [esp + 9]
push dword [esp + 6]
sub esp, 0x16
btr esi, edx
bsr ax, bp
jmp 0x78e963
mov dl, dh
lea eax, [ebp - 0xc7]
rdtsc
not di
lea ebx, [ecx - 0x63]
add dx, 0x557e
jmp 0x78ea44
push dword [esp + 4]
neg ch
mov ebp, esi
mov ax, word [esp + 0xe]
xchg bp, dx
xchg ch, dl
jmp 0x78e9ac
lea edx, [esi - 0x540084b3]
mov bp, sp
mov ecx, dword [esp + 3]
inc dl
pop dx
sub esp, 0xa
jmp 0x78e9df
mov dword [esp + 0x11], ecx
push dword [esp + 0x14]
call fcn.0078ea27
inc ecx
rcl byte [esi + 0x31], 0xc0
and bh, cl
jge 0x78ea47
adc edi, edi
je 0x78ea6f
adc al, 0xe8
salc
invalid
je 0x78e9e3
insb byte es:[edi], dx
int3
mov bx, sp
jmp 0x78e9fa
xor dword [edi], ecx
mov byte [0x59c78b66], al
pop ecx
jmp 0x78ea91
add esp, 0x11
mov word [esp + 1], bx
mov dl, dh
mov dword [esp], eax
mov bp, word [esp + 3]
xchg dword [esp], edx
jmp 0x78eae0
mov si, dx
lea esp, [esp + 0x28]
push word [esp]
cpuid
lea eax, [ecx + 0x4136347b]
jmp 0x78eaf6
mov ah, byte [esp]
push word [esp + 2]
push dword [esp + 4]
lea edx, [eax - 1]
mov ch, byte [esp + 2]
pushal
jmp 0x78eac7
lea edx, [ebx*4]
lea ebp, [esp + ebp]
cmc
xchg word [esp + 2], bp
add esp, 3
mov edi, ebp
jmp 0x78ebe3
lea esp, [esp + 0x15]
push dword [esp + 2]
xchg byte [esp + 3], cl
lea eax, [eax - 0xe1]
bsf si, si
call fcn.0078eb4c
lea edx, [esp + ecx]
mov ax, bx
mov byte [esp], dh
inc si
xchg di, dx
xchg bh, cl
jmp 0x78ec0e
xchg byte [esp], al
mov dh, byte [esp]
add esp, 0
mov al, ah
mov ebx, 0x5b279362
call fcn.0078ebf8
fnstcw word [eax]
sbb esi, dword [edx - 0x7d]
les eax, [ecx]
add esp, 1
xchg dx, bx
mov edx, 0x95deea5e
cpuid
pushal
xchg word [esp + 0x15], si
jmp 0x78eb9d
cmc
not ecx
lea esp, [esp]
xchg byte [esp], dl
mov al, ah
btc edx, edi
jmp 0x78ebca
Function at 0x78ebf8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + ebp]
jmp 0x78ecf1
mov si, 0x2603
mov bl, 8
sub bl, ah
mov ax, word [esp]
lea esp, [esp + 1]
neg bh
jmp 0x78eca7
xchg byte [esp], al
lea eax, [ecx - 0xb3]
pop ebx
lea eax, [ebp*4]
btr eax, esp
jmp 0x78ec33
mov di, 0x29f
mov byte [esp + 3], bh
mov bp, word [esp]
mov word [esp + 2], di
rcr eax, 1
bsf dx, si
jmp 0x78ec4c
xchg word [esp + 0x1d], bx
neg ebp
mov dword [esp + 0x1e], eax
pop esi
xchg dword [esp], eax
mov bp, dx
jmp 0x78ecd7
xchg ch, dl
push esp
lea eax, [eax + edi]
pushal
mov di, word [esp + 0x16]
mov ebx, dword [esp + 0xe]
jmp 0x78ec83
lea esi, [esi*4]
mov byte [esp + 0xf], ch
mov dl, 0xf4
sub ebx, eax
push esp
mov bp, 0x5201
jmp 0x78ef04
push word [esp + 0x19]
bswap edi
mov dword [esp + 0x20], eax
lea esp, [esp + 0x11]
jmp 0x78ecb9
add esp, 1
xchg cx, ax
push dword [esp]
mov ax, bx
mov ebx, dword [esp + 3]
rdtsc
jmp 0x78ec6a
rdtsc
mov ecx, 0x183d44e
inc dx
push dword [esp + 0xc]
btc eax, edi
call fcn.0078ed85
lds ebx, [ebp - 0x33]
xchg esp, eax
invalid
lea ebp, [esi + 0xcd]
not edi
mov al, ah
sub esp, 2
mov di, word [esp + 0xe]
cpuid
jmp 0x78edae
xchg edx, eax
inc ebp
setnp ah
cpuid
rdtsc
bsr bp, bp
jmp 0x78edd4

Function at 0x78ef85
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xe], si
pop word [esp + 4]
mov ebx, dword [esp + 0xe]
lea ecx, [edx + edx]
jmp 0x78f01b
mov bl, bh
xchg byte [esp], bl
mov byte [esp + 3], bh
mov ah, byte [esp + 1]
sub esp, 0xa
bswap ebp
jmp 0x78ef52
mov cx, word [esp + 3]
jmp 0x78ef6a
neg bx
clc
and cx, 0x5762
pop dword [esp + 7]
mov edx, 0x1b3b9b70
xchg byte [esp + 0xc], cl
jmp 0x78efc4
mov dh, byte [esp + 0xa]
neg dh
add eax, ebp
mov edx, 0x5588db4a
push word [esp + 0x13]
cld
jmp 0x78ef8c
clc
sub esp, 0x1c
lea esp, [esp + 0x45]
bsf di, ax
ror ebx, 0x1f
neg esi
jmp 0x78f04f
rdtsc
mov eax, 0x7c45e168
mov al, 0x86
pop edi
mov dl, dh
lea ebp, [ecx + 0xdb]
jmp 0x78efaf
ror ch, 5
push dword [esp + 7]
add ebx, ebp
pushal
mov dx, word [esp + 0x1d]
not ecx
jmp 0x78efdc
mov esi, 0x8c63b46c
pop eax
rdtsc
mov word [esp + 7], dx
sete ch
xchg bx, bp
jmp 0x78eff4
bsf dx, ax
not ah
mov bp, 0x2fe9
mov eax, dword [esp]
rdtsc
lea eax, [eax + edx]
jmp 0x78f0fa
rcr eax, 7
not ah
mov ebp, 0xcfb7b5e8
xchg cx, si
neg edi
lea esi, [esi + 0xc5]
jmp 0x78f030
mov ecx, 0x33d61602
mov word [esp], dx
mov ebx, 0xb599cbee
mov edi, ecx
lea ebx, [ebp - 0x6f]
not ebx
jmp 0x78f0c2
bsf bp, ax
mov ecx, dword [esp + 3]
xor bx, 0x7efc
mov dword [esp], eax
btc ebx, edi
mov ecx, eax
jmp 0x78f066
pop cx
bswap edx
not eax
mov cl, 0x4a
bsr bp, bp
mov bx, 0xd27b
jmp 0x78f0d7
mov ebp, 0xc084ea64
pop ax
xchg word [esp], cx
rdtsc
xchg byte [esp], dl
mov di, dx
jmp 0x78f0a5
cpuid
sub esp, 4
rdtsc
lea esp, [esp + 3]
xchg edx, edi
inc eax
jmp 0x78f137
stc
mov cx, word [esp]
lea ebp, [eax*4]
lea ebx, [esp + ebx]
mov cx, word [esp]
push esp
jmp 0x78f08e
xchg ah, bl
not ah
cpuid
mov cl, 0xaa
lea esp, [esp]
mov word [esp], bx
jmp 0x78f178
lea ecx, [esi - 0x6d]
not ax
lea edi, [esi*4]
btr esi, edx
push edx
xor dx, 0xba9c
jmp 0x78f113
Function at 0x78f400
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
lea edx, [ecx + edi]
xchg ch, dl
mov si, 0x14a1
pop eax
mov ebx, eax
jmp 0x78f41d
lea ecx, [ebx + ebx]
jmp 0x78f3e1
mov bx, 0x6277
setno ch
mov esi, ebp
mov bx, dx
ror dh, 7
not bh
jmp 0x78f445
pushal
lea esp, [esp + 0x52]
mov bp, 0x64d9
mov cl, 0x72
not ah
xchg ebx, esi
jmp 0x78f405

Function at 0x78f772
Capabilities:
Execute anti-debugging instructions

Disassembly:
and cl, bh
mov dh, byte [esp + 0x1f]
bsr si, bp
mov bl, bh
bswap eax
sub esp, 6
jmp 0x78f7d8
mov cx, bx
lea esp, [esp + 1]
pushal
xchg esi, eax
not eax
mov dword [esp + 1], ebp
jmp 0x78f739
jmp 0x78f757
lea esi, [esi + 0x345256ed]
neg ebx
mov di, 0x49eb
lea esi, [ebp - 0x10f80be1]
popal
mov ecx, 0xc0227f0a
jmp 0x78f80b
xor di, 0xc324
mov dh, byte [esp + 0x3d]
inc bp
rdtsc
xchg dword [esp + 0x13], ebp
jmp 0x78f774
clc
lea edi, [edi*4]
mov ah, byte [esp + 9]
inc cl
sub esp, 0x16
setg ah
jmp 0x78f79c
mov byte [esp + 0x1f], ah
xchg dword [esp + 4], ebp
pop dword [esp + 0xf]
mov byte [esp + 0xb], ah
mov ch, byte [esp + 5]
lea ebx, [edx + ebx]
jmp 0x78f7b7
mov byte [esp + 0x14], ah
pop word [esp + 0x19]
push word [esp + 0x11]
mov word [esp + 0x1a], sp
jmp 0x78f866
lea edi, [esi*4]
mov dx, bx
xchg dword [esp + 0x11], esi
rdtsc
lea esp, [esp + 1]
xchg dword [esp + 0x12], ebp
jmp 0x78f7f1
xchg esi, eax
bswap esi
pop dword [esp + 0x14]
mov dl, 0x14
bsf cx, ax
mov cl, ch
jmp 0x78f846

Function at 0x78fb67
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [eax + edi]
mov byte [esp + 5], bh
mov edi, ecx
mov byte [esp + 0xb], ch
jmp 0x78fab6
xchg byte [esp + 6], bl
bsf di, ax
xchg ebp, ebx
not bp
setnp ch
push word [esp + 4]
jmp 0x78fa4f
inc edi
cpuid
pop eax
mov bl, bh
rdtsc
xchg byte [esp + 6], dl
jmp 0x78fb14
neg ecx
pop esi
sub esp, 8
pop dword [esp + 8]
xchg word [esp + 2], dx
mov si, 0xa351
jmp 0x78fa7d
lea eax, [ecx*4]
lea edx, [eax + edx]
mov cl, 0xa2
mov ax, 0x933f
lea edx, [edx + edx]
rcl di, cl
jmp 0x78fa96
lea esp, [esp + 8]
popal
sub esp, 0x1a
add esp, 5
add esp, 0x13
mov byte [esp], bh
jmp 0x78fafe
xchg word [esp + 7], cx
btr ebp, esp
rdtsc
neg di
mov ebx, 0x8b4b4b10
lea esp, [esp + 3]
jmp 0x78face
cld
mov word [esp], dx
stc
add esp, 1
mov byte [esp], bh
call fcn.0078fb48
fdivr dword [ebx]
adc cl, byte [ebp + 0x4b898d1c]
invalid
lea ecx, [ecx + 0x1bdff04b]
rdtsc
rdtsc
push word [esp + 6]
xchg byte [esp + 6], bl
jmp 0x78fae6
pop dword [esp]
btr ecx, esp
mov byte [esp + 1], dh
push word [esp + 4]
mov ecx, esi
mov al, 0x3e
jmp 0x78fa66
jmp 0x78fb30

Function at 0x78fd7c
Capabilities:
Parse pe header

Disassembly:
mov eax, dword fs:[0x30]
jmp 0x78fd7e
mov byte [esp + 0x17], dh
pop dword [esp + 0x1a]
pop dword [esp + 0xa]
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x78fd47
jmp 0x78fd60
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x78fd8c
mov eax, dword [eax + 8]
jmp 0x78fdd1
Function at 0x402fd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x471020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40306c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40304c
xor eax, eax
push ebp
push 0x403045
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403088
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40304c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x471020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x471020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x473048], 0
je 0x403d91
cmp word [0x47321c], 0xd7b2
jne 0x403d59
cmp dword [0x473224], 0
jbe 0x403d59
mov eax, 0x473218
call dword [0x473234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47106c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403db8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x471030], 0
jne 0x403dad
push 0
push 0x471064
push 0x47106c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405c90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405cf6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040411c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b98
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405ce0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405cfd
lea eax, [ebp - 0x10]
call fcn.00403eac
ret

Function at 0x40b05c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b095
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f9c
jmp 0x40b09e
mov eax, ebx
mov edx, esi
call fcn.00403f00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b0a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b0c9
mov al, byte [esp]
jmp 0x40b0cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b750
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b5c8
mov eax, dword [0x472234]
cmp byte [eax], 0
je 0x40b7cc
mov eax, dword [0x472028]
call fcn.00402a04
call fcn.0040283c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004087bc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b814
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b802
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x471fd4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x473664]
call fcn.004051a4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c068
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c13e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f44
lea eax, [ebp - 8]
call fcn.004043bc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040436c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c128
mov eax, ebx
call fcn.004026d4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c121
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040436c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c10b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c150
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c10b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c128
mov eax, dword [ebp - 0x10]
call fcn.004026f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c145
lea eax, [ebp - 8]
call fcn.00403eac
ret

Function at 0x40c650
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c6b4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040411c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004082c0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c6bb
lea eax, [ebp - 0xc]
call fcn.00403eac
ret

Function at 0x41b2c8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x473884
cmp dword [edi], 0
jne 0x41b344
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x473880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4713ec
mov ecx, 2
call fcn.004028d0
mov edx, 0x41b2a0
lea eax, [esi + 5]
call fcn.0041b2c0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b2c0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b319
mov dword [0x473880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41c8e8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c8ee
ret
Function at 0x427b44
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040435c
xor eax, eax
push ebp
push 0x427c72
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x427c45
xor eax, eax
push ebp
push 0x427c3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040416c
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x427c13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x427c02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040416c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040436c
mov edx, ebx
pop ecx
call fcn.004028d0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427c09
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x471f78]
mov dl, 1
mov eax, dword [0x407018]
call fcn.0040b8d4
call fcn.004038e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427c79
lea eax, [ebp - 4]
call fcn.00403eac
ret
Function at 0x427c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427e31
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040455c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x427e48
call fcn.004041b8
mov eax, ebx
call fcn.0041a85c
mov edi, eax
dec edi
test edi, edi
jl 0x427d38
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041a830
mov edx, dword [0x435534]
call fcn.004032e8
test al, al
je 0x427d34
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041a830
lea edx, [ebp - 0x14]
call fcn.004419ac
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040455c
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040422c
inc esi
dec edi
jne 0x427ce6
mov al, byte [0x427e4c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x427e58
mov eax, dword [ebp - 0xc]
call fcn.0040cc28
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00403f44
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004419ac
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x427e48
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004419ac
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x427e48
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x427e48
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x427e64
call fcn.00408e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427e38
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00403ed0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403ed0
lea eax, [ebp - 0x14]
call fcn.00403eac
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403ed0
ret

Function at 0x43c214
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x43c160
call sub.user32.dll_EnumWindows
ret
Function at 0x43c334
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43c3b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0043bd94
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43c359
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0043b994
cmp dword [ebp - 4], 0
je 0x43c39b
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0040436c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c3b8
lea eax, [ebp - 4]
call fcn.00403eac
ret

Function at 0x43f4fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x473b88], 0
je 0x43f64b
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4721c8]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43f64b
mov eax, dword [0x473b8c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x473b88]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43f61a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x473b88]
call fcn.004140f0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43f612
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43f612
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43f612
mov eax, dword [ebp - 0x14]
call fcn.004482a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43f612
push ebp
call fcn.0043f4b8
pop ecx
test al, al
jne 0x43f612
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43f5ce
mov eax, dword [ebp - 0x14]
call fcn.00446dd8
dec eax
jle 0x43f612
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403358
cmp byte [ebp - 1], 0
je 0x43f612
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43f612
mov edx, dword [ebp - 0x14]
mov eax, dword [0x473b8c]
call fcn.0043ec84
inc edi
dec ebx
jne 0x43f561
mov eax, dword [0x473b8c]
cmp dword [eax + 8], 0
jle 0x43f632
mov eax, dword [0x473b8c]
call fcn.0043ed14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43f64b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043f320
pop ecx
test al, al
jne 0x43f64b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret