joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6379d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
popfd
jmp fcn.0062bd75
mov esi, dword [esp + 3]
mov esi, dword [esp + 4]
call 0x63777b
bsr bp, bp
jmp 0x63789f
mov bl, cl
xchg al, ch
mov edx, dword [esp]
lea edx, [ebx + edi]
xchg dword [esp + 0x3c], edi
sub esp, 7
jmp 0x6378b5
mov ah, dl
mov cx, word [esp]
jmp 0x637905
pushal
sub esp, 7
lea esp, [esp + 1]
mov dword [esp + 0x11], esi
lea esp, [esp + 2]
lea edi, [edi + 0x7d]
jmp 0x63785e
jne 0x637871
mov ah, dl
mov cx, word [esp]
jmp 0x637905
lea ebp, [ebp*4]
xchg dword [esp], ebp
mov ecx, ebp
push dword [esp + 6]
lea esp, [esp + 3]
push dword [esp + 0x44]
ret 0x48
sbb dword [ecx + 0x1f29707], 0xec833ab0
adc ah, byte [esi + 0xf]
mov bl, 0xe5
bswap ebx
sub esp, 6
xchg dword [esp + 0x18], edi
jmp 0x63788a
push esi
inc ecx
jl 0x63792e
mov dl, al
pushfd
mov dx, word [esp + 3]
mov si, word [esp]
jmp 0x637999
push edi
not dx
lea ecx, reloc.KERNEL32.dll_TlsSetValue
rdtsc
mov ch, 0xd4
jmp 0x6378ef
pushfd
mov dx, word [esp + 3]
mov si, word [esp]
jmp 0x637932
mov dl, al
jmp 0x637915
xchg edx, ecx
sub esp, 8
mov ecx, eax
add esp, 0xc
jmp 0x637975
pop edi
neg esi
jl 0x637979
jge 0x637981
loopne 0x6379c8
in eax, dx
je 0x6378d5
cmp edx, edx
dec esi
fdivr qword [ebx - 0x59a06aaa]
rcl dword [eax - 0x2d]
neg esi
jo 0x63782c
mov esi, dword [esp + 3]
mov esi, dword [esp + 4]
stc
stc
lea esp, [esp + 8]
jmp 0x63774c
js 0x637942
jns 0x637942
adc ebx, ebx
jmp 0x6379b3
adc ebx, ebx
cpuid
call 0x6379ba
xor dword [edx + reloc.KERNEL32.dll_TlsSetValue], ebp
mov ecx, 0x3ebb4829
sbb byte [ebx + 0x52], bh
xchg edx, ecx
jmp 0x637934
cpuid
call 0x63799d
setnp al
inc ch
bswap eax
stc
call fcn.00637a93
and ah, byte [edi + 0x1ba15237]
pop eax
fmul dword [esi + 0x29]
fsub dword [esi - 0x4b]
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
aaa
push edx
mov eax, dword [reloc.KERNEL32.dll_TlsSetValue]
sub eax, ebx
mov ch, 0xa4
jmp 0x63795a

Function at 0x644996
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 0xfc
sub eax, ecx
jmp 0x6449ae
cmc
push cx
mov word [esp], bx
mov byte [esp], dl
stc
lea esp, [esp + 2]
jmp 0x6449e0
jmp 0x64496e
mov word [esp], bx
mov byte [esp], dl
stc
jmp 0x644983
jp 0x644978
cmc
push cx
jmp 0x644998
push esi
push edi
push ecx
jmp 0x6449be
pushal
bswap eax
mov al, byte [esp]
mov dword [esp + 4], edx
popal
jmp 0x644a02
mov esp, eax
pushfd
lea ebp, [eax + ecx - 0x40]
jmp 0x6449b5
clc
jnp 0x644a24
sub esp, 0x11
lea esp, [esp + 1]
mov dword [esp + 0x28], ecx
sub esp, 0x10
jmp 0x644a85
mov edi, eax
pushal
mov si, 0xfe50
lea eax, [ecx + ebx]
jmp 0x6449e9
mov dword [esp + 0x28], ecx
sub esp, 0x10
add esp, 0xa
lea esp, [esp + 2]
jmp 0x644a6c
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x644a0e
cld
jmp 0x644aa0
lea esp, [esp + 0x14]
popal
jmp 0x644a56
add esp, 0xa
jmp 0x644a18
pop esi
jmp 0x644abc
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
jmp 0x644a8a
popfd
jmp 0x62998b

Function at 0x6adfad
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6ae021
xchg word [esp + 1], dx
mov word [edi], cx
jmp 0x6adfcd
btr edx, ebp
js 0x6adfe3
xchg word [esp + 1], dx
jmp 0x6adfe8
Function at 0x6adfc3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, eax
mov dx, 0x5bdf
call fcn.006adfad
sbb dh, 0x13
js 0x6ae003
cmp dh, 0x5f
bsr edx, eax
jmp 0x64495c
cmp dh, 0x5f
bsr edx, eax
jmp 0x64495c
Function at 0x404971
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x404980
pop dword [ebp - 0x10]
mov eax, 0xb2910d8d
add eax, 0x4daf3bf3
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x5260c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x44498b94
sub ecx, 0x44493a7d
mov esi, eax
mov edi, 0xc1d70e08
add edi, 0x3e704ff8
add edi, dword [ebp - 0x10]
mov edx, 0xa1336288
mov dword [ebp - 0xc], 0xe9b65f1e
mov ebx, dword [edi]
add dword [ebp - 0xc], esi
sub ebx, edx
add dword [ebp - 8], 0x3d03fe9
mov dword [esi], ebx
xor dword [ebp - 4], 0x752aefeb
add esi, 0x57083747
add esi, 0xa8f7c8bd
add edi, 4
loop 0x4049d4
add eax, 0x4e8110b
add eax, 0xfb192624
mov ebx, eax
add eax, 0x4ea4380d
add eax, 0xb15bc7f8
mov ecx, 0xec7f4cee
add ecx, 0x13c0b312
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x41d1eb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x30]
push esi
mov esi, dword [ebp + 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x34]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x60], ecx
xor ecx, ecx
push ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
push ecx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x34]
push eax
push 0x41ad19
push ecx
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edx
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x41d2c0
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41d29a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41d2a1
mov esi, 0x80004005
push esi
push 0x465
push str.c:_agent_work138_s_src_burnengineelevation.cpp
call fcn.004038f5
push str.Failed_to_create_elevated_cache_thread.
push esi
call main
pop ecx
pop ecx
jmp 0x41d30a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x41c779
push dword [ebp + 0xc]
call main
mov esi, eax
test esi, esi
jns 0x41d2ea
push str.Failed_to_pump_messages_in_child_process.
push esi
call main
pop ecx
pop ecx
jmp 0x41d303
push dword [ebp - 8]
push edi
call main
mov ecx, dword [ebp + 0x38]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x38
Function at 0x41e9e2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [ebp - 0x14]
xor eax, eax
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
mov esi, ebx
push ebx
push ebx
push 1
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x41ea4c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41ea26
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41ea2d
mov esi, 0x80004005
push esi
push 0x33
push str.c:_agent_work138_s_src_burnengineuithread.cpp
call fcn.004038f5
push str.Failed_to_create_initialization_event.
push esi
call main
mov eax, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x41eac4
mov edi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0x41e720
push ebx
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x41eaa7
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41ea8c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41ea93
mov esi, 0x80004005
push esi
push 0x3c
push str.c:_agent_work138_s_src_burnengineuithread.cpp
call fcn.004038f5
push str.Failed_to_create_the_UI_thread.
jmp 0x41ea3f
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 4]
mov dword [edi + 0x3e4], eax
mov eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x41ead4
push eax
call edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x41eade
push dword [ebp - 8]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0xa22058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa221a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa2207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa2206a
add dl, dl
jne 0xa22089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa220dc
xor eax, eax
add dl, dl
jne 0xa22096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa2217d
add dl, dl
jne 0xa220a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa220b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa220bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa220c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa220d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa22075
mov eax, 1
add dl, dl
jne 0xa220ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa220f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa220e1
sub eax, ebx
mov ebx, 1
jne 0xa22128
mov ecx, 1
add dl, dl
jne 0xa2210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa22119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa22105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa22075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa2213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa2214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa22136
cmp eax, 0x7d00
jae 0xa2216d
cmp eax, 0x500
jb 0xa22168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa22075
cmp eax, 0x7f
ja 0xa22170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa22075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa2219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa22075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x7f4f90
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7f4f9a
pushal
call 0x7f4fa0
pop ebp
sub ebp, 0x10
sub ebp, 0x3f4f90
jmp 0x7f4fb6
mov eax, 0x3f4f90
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f7
mov edx, 0xabe44b75
xor byte [eax], dl
inc eax
dec ecx
jne 0x7f4fcd
jmp 0x7f4fe0
invalid
Function at 0x40ee88
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ed00
mov eax, dword [0x4ef308]
cmp byte [eax], 0
je 0x40ef04
mov eax, dword [0x4eee28]
call fcn.004039dc
call fcn.004030f4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040b644
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ef4c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ef3a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4eed88]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4f27f8]
call fcn.00406d3c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40f804
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f8da
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405590
lea eax, [ebp - 4]
call fcn.004059fc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004059a4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40f8c4
mov eax, ebx
call fcn.00402f98
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40f8bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004059a4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40f8a7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40f8ec
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40f8a7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f8c4
mov eax, dword [ebp - 0x10]
call fcn.00402fb4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f8e1
lea eax, [ebp - 4]
call fcn.004054f8
ret

Function at 0x422314
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00421fe0
dec esi
jne 0x422336
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x4234bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4f49f0
cmp dword [edi], 0
jne 0x423538
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4f49ec]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4e7b18
mov ecx, 2
call fcn.004032d4
mov edx, 0x423494
lea eax, [esi + 5]
call fcn.004234b4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004234b4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42350d
mov dword [0x4f49ec], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x425ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004059a4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x425f18
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4ef5c0]
mov dl, 1
mov eax, dword [0x425878]
call fcn.0040f054
call fcn.00404e50
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00425980
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x427258
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42725e
ret
Function at 0x43df34
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x43e108
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [esi]
call fcn.0045e09c
mov eax, dword [esi]
cmp byte [eax + 0x258], 0
je 0x43e0ed
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [esi]
sub eax, dword [edx + 0x268]
mov edx, dword [esi]
cmp eax, dword [edx + 0x2c0]
jb 0x43df9a
mov eax, dword [esi]
add eax, 0x264
call fcn.004054f8
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [esi]
mov dword [edx + 0x268], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 8
je 0x43e074
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [0x4ef57c]
movzx eax, al
bt dword [edx], eax
jae 0x43e031
push 1
push 0x102
push 0x102
mov eax, dword [esi]
call fcn.0045f200
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x43e0b8
mov eax, dword [esi]
push dword [eax + 0x264]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.004056e0
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.004056e0
push dword [ebp - 0x2c]
mov eax, dword [esi]
add eax, 0x264
mov edx, 3
call fcn.004058a8
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x43e0b8
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.004056e0
mov edx, dword [ebp - 0x30]
mov eax, dword [esi]
add eax, 0x264
call fcn.004057e0
jmp 0x43e0b8
mov eax, dword [esi]
mov ebx, dword [eax + 0x264]
test ebx, ebx
je 0x43e061
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
add eax, 0x264
mov ecx, 1
mov edx, ebx
call fcn.00405a4c
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
call fcn.004057d4
mov edx, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
call fcn.0040f96c
cmp al, 2
je 0x43e050
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
test eax, eax
je 0x43e0a5
sub eax, 4
mov eax, dword [eax]
mov edx, dword [esi]
add edx, 0x264
mov ecx, 1
xchg edx, eax
call fcn.00405a4c
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
test eax, eax
je 0x43e0c9
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x43e0d6
push ebp
call fcn.0043de4c
pop ecx
jmp 0x43e0ed
xor edx, edx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xe0]
mov eax, dword [esi]
mov si, 0xffeb
call fcn.004047d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e10f
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0040551c
ret
Function at 0x447940
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x447a75
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x447a48
xor edx, edx
push ebp
push 0x447a41
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x44798d
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x447a16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x447a05
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4479cc
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.004059a4
lea ecx, [ebx + 1]
mov edx, esi
call fcn.004032d4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447a0c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4eec64]
mov dl, 1
mov eax, dword [0x408f6c]
call fcn.0040f018
call fcn.00404e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447a7c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x448e68
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x448f10
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x448ee3
mov edx, ebx
mov eax, dword [0x426bfc]
call fcn.0042b474
test al, al
je 0x448ed3
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0042b384
call fcn.00404efc
jmp 0x448f17
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x448e9b
mov ecx, dword [0x4eed68]
mov dl, 1
mov eax, dword [0x408f6c]
call fcn.0040f018
call fcn.00404e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448f17
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x448f20
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x448f78
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448f7f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x448f88
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x448fdd
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448fe4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret