joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41886b
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x41ba47
call fcn.00406ce8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00413e46
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x42241c]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.0041202b
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.0041202b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x41a03e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41a06c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a08a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00419fa4
jmp 0x41a08a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41a08a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00419fa4
test edi, edi
mov eax, edi
jne 0x41a074
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402d24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], ecx
push ebx
mov ebx, edx
test eax, eax
je 0x402d7e
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x402d7d
cmp esi, ebx
push edi
cmova edx, esi
xor edi, edi
mov ecx, edi
mov dword [ebp - 4], ecx
test edx, edx
je 0x402d7c
mov al, byte [edi + eax]
mov esi, dword [ebp - 8]
xor byte [ecx + esi], al
lea ecx, [edi + 1]
mov eax, dword [ebp - 4]
xor edi, edi
inc eax
cmp eax, ebx
cmovne edi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edi
xor edi, edi
cmp ecx, dword [ebp + 0xc]
cmovne edi, ecx
mov ecx, dword [ebp - 4]
sub edx, 1
jne 0x402d4f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402df5
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
jne 0x402e23
call fcn.004039dc
cmp dword [esi + 4], edi
jne 0x402e1c
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 4], eax
mov ecx, esi
call fcn.004039f2
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x402e38
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.fstLockSystemMutex:_Mutex_was_abadoned
call fcn.00403ec8
int3

Function at 0x403100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x493004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0xa0], ebx
cmp eax, 1
jb 0x40322d
mov ecx, dword [ebx + 0x14]
add eax, 0xff
add ecx, dword [ebx + 0x10]
shr eax, 8
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xc], 0x30de5d94
mov dword [ebp - 8], 0xaa456b63
lea ecx, [eax*8 + 0x249f0]
mov dword [ebp - 0x14], 0xb98f8367
mov dword [ebp - 0xa4], ecx
mov eax, esi
mov dword [ebp - 0x10], 0x8fcdc0d5
xor byte [ebp + eax - 0xc], dl
inc eax
cmp eax, 8
jb 0x40316a
mov dword [ebp - 0x98], esi
mov edx, esi
push edi
test ecx, ecx
je 0x403226
mov edi, dword [ebp + 8]
mov ebx, esi
mov esi, dword [ebp + 0xc]
mov cl, byte [ebp + ebx - 0x14]
mov al, byte [edx + edi]
xor al, cl
xor byte [ebp + ebx - 0xc], al
mov al, byte [edx + edi + 1]
xor al, cl
mov byte [ebp + ebx - 0x14], al
lea eax, [edx + 2]
cmp eax, esi
sbb edx, edx
and edx, eax
inc ebx
cmp ebx, 8
jb 0x40318d
mov dword [ebp - 0xa8], edx
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x94]
call fcn.00404199
lea eax, [ebp - 0x94]
lea edx, [ebp - 0x14]
push 1
push eax
mov ecx, edx
call fcn.004040ff
mov edi, dword [ebp - 0x98]
xor edx, edx
mov eax, edi
mov ebx, dword [ebp - 0xa0]
div dword [ebp - 0x9c]
mov al, byte [ebp - 0x11]
xor esi, esi
pop ecx
pop ecx
mov ecx, dword [ebx + 0x18]
mov byte [edx + ecx], al
mov ecx, esi
mov al, byte [ebp + ecx - 0x14]
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 8
jb 0x4031ff
mov edx, dword [ebp - 0xa8]
inc edi
mov dword [ebp - 0x98], edi
cmp edi, dword [ebp - 0xa4]
jb 0x403185
mov esi, dword [ebp - 0x10]
mov dword [ebx + 8], esi
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b964
leave
ret
Function at 0x4036d2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
xor ecx, ecx
add eax, ecx
adc edx, ecx
leave
ret

Function at 0x40483d
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
mov ebx, dword [ecx + 0x34]
push esi
push edi
mov esi, edx
shr edx, 5
lea edi, [ebx + 0x1f]
and esi, 0x1f
shr edi, 5
cmp edx, edi
jae 0x4049cb
mov eax, dword [ecx + 0xf4]
lea ecx, [eax + edx*4]
cmp dword [ecx], 0
je 0x4049bd
cmp dword [ecx], 0x10000
jae 0x40491b
cmp dword [ecx], 0x100
jae 0x4048c3
cmp dword [ecx], 0x10
jae 0x4048a1
cmp dword [ecx], 4
jae 0x404894
cmp dword [ecx], 2
sbb eax, eax
inc eax
jmp 0x4049b9
cmp dword [ecx], 8
sbb eax, eax
add eax, 3
jmp 0x4049b9
cmp dword [ecx], 0x40
jae 0x4048b3
cmp dword [ecx], 0x20
sbb eax, eax
add eax, 5
jmp 0x4049b9
cmp dword [ecx], 0x80
sbb eax, eax
add eax, 7
jmp 0x4049b9
cmp dword [ecx], 0x1000
jae 0x4048f3
cmp dword [ecx], 0x400
jae 0x4048e3
cmp dword [ecx], 0x200
sbb eax, eax
add eax, 9
jmp 0x4049b9
cmp dword [ecx], 0x800
sbb eax, eax
add eax, 0xb
jmp 0x4049b9
cmp dword [ecx], 0x4000
jae 0x40490b
cmp dword [ecx], 0x2000
sbb eax, eax
add eax, 0xd
jmp 0x4049b9
cmp dword [ecx], 0x8000
sbb eax, eax
add eax, 0xf
jmp 0x4049b9
cmp dword [ecx], 0x1000000
jae 0x40496f
cmp dword [ecx], 0x100000
jae 0x40494d
cmp dword [ecx], 0x40000
jae 0x404940
cmp dword [ecx], 0x20000
sbb eax, eax
add eax, 0x11
jmp 0x4049b9
cmp dword [ecx], 0x80000
sbb eax, eax
add eax, 0x13
jmp 0x4049b9
cmp dword [ecx], 0x400000
jae 0x404962
cmp dword [ecx], 0x200000
sbb eax, eax
add eax, 0x15
jmp 0x4049b9
cmp dword [ecx], 0x800000
sbb eax, eax
add eax, 0x17
jmp 0x4049b9
cmp dword [ecx], 0x10000000
jae 0x404999
cmp dword [ecx], 0x4000000
jae 0x40498c
cmp dword [ecx], 0x2000000
sbb eax, eax
add eax, 0x19
jmp 0x4049b9
cmp dword [ecx], 0x8000000
sbb eax, eax
add eax, 0x1b
jmp 0x4049b9
cmp dword [ecx], 0x40000000
jae 0x4049ae
cmp dword [ecx], 0x20000000
sbb eax, eax
add eax, 0x1d
jmp 0x4049b9
cmp dword [ecx], 0x80000000
sbb eax, eax
add eax, 0x1f
cmp eax, esi
jae 0x4049d1
xor esi, esi
add ecx, 4
inc edx
cmp edx, edi
jb 0x404862
mov eax, ebx
pop edi
pop esi
pop ebx
ret
shl edx, 5
add eax, edx
jmp 0x4049cd
Function at 0x40510f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x493004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
push 8
lea edx, [ebx + 0x20]
mov dword [ebp - 0x34], ebx
pop eax
mov ecx, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x40]
lea edi, [ebp - 0x24]
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4d34d34d
mov ecx, 0x34d34d34
add eax, esi
add dword [edx], eax
mov eax, dword [edx]
mov edx, 0x2cb2cb2d
cmp eax, dword [ebp - 0x24]
sbb eax, eax
neg eax
sub eax, edx
add dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x24]
cmp eax, dword [ebp - 0x20]
sbb eax, eax
neg eax
add eax, ecx
add dword [ebx + 0x28], eax
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp - 0x1c]
sbb eax, eax
neg eax
add eax, esi
add dword [ebx + 0x2c], eax
mov eax, dword [ebx + 0x2c]
cmp eax, dword [ebp - 0x18]
sbb eax, eax
neg eax
sub eax, edx
add dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x30]
cmp eax, dword [ebp - 0x14]
sbb eax, eax
neg eax
add eax, ecx
add dword [ebx + 0x34], eax
mov eax, dword [ebx + 0x34]
cmp eax, dword [ebp - 0x10]
sbb eax, eax
neg eax
add eax, esi
add dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x38]
cmp eax, dword [ebp - 0xc]
sbb eax, eax
neg eax
sub eax, edx
add dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x3c]
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
mov dword [ebx + 0x40], eax
lea eax, [ebp - 0x24]
sub eax, ebx
mov dword [ebp - 0x30], eax
mov edi, dword [ebx + 0x20]
add edi, dword [ebx]
movzx ecx, di
mov edx, edi
shr edx, 0x10
mov esi, ecx
imul esi, ecx
mov eax, edx
imul eax, ecx
imul edx, edx
imul edi, edi
shr esi, 0x11
add esi, eax
mov eax, dword [ebp - 0x30]
shr esi, 0xf
add esi, edx
xor esi, edi
sub dword [ebp - 0x28], 1
mov dword [eax + ebx], esi
lea ebx, [ebx + 4]
jne 0x4051cc
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
rol eax, 0x10
mov esi, dword [ebp - 0x1c]
rol ecx, 0x10
add ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebx], eax
mov eax, edx
rol eax, 8
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x20]
rol eax, 0x10
add eax, esi
rol edx, 0x10
add edx, eax
mov eax, esi
rol eax, 8
add eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x18]
rol eax, 0x10
add eax, ecx
rol esi, 0x10
add esi, eax
mov dword [ebx + 8], edx
mov eax, ecx
mov dword [ebx + 0x10], esi
rol eax, 8
add eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x10]
rol eax, 0x10
add eax, edi
rol ecx, 0x10
rol edi, 8
add ecx, eax
add edi, dword [ebp - 0x10]
add edi, dword [ebp - 8]
mov dword [ebx + 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x1c], edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040b964
leave
ret
Function at 0x4052e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0x10
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
je 0x405300
or eax, 0xffffffff
jmp 0x4053e8
mov edx, dword [edi + 4]
push ebx
mov ebx, dword [edi]
push esi
mov esi, dword [edi + 8]
mov edi, dword [edi + 0xc]
mov ecx, edi
mov dword [eax + 0x10], esi
mov dword [eax + 0x18], edi
mov dword [eax], ebx
mov dword [eax + 8], edx
mov eax, esi
shr eax, 0x10
shl ecx, 0x10
or ecx, eax
mov eax, dword [ebp - 4]
push 4
mov dword [eax + 4], ecx
mov ecx, edi
shr ecx, 0x10
mov eax, ebx
shl eax, 0x10
or ecx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ecx
mov ecx, edx
shl ecx, 0x10
mov eax, ebx
shr eax, 0x10
or ecx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], ecx
mov ecx, esi
shl ecx, 0x10
mov eax, edx
shr eax, 0x10
or ecx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ecx
mov eax, esi
mov ecx, dword [ebp - 4]
rol eax, 0x10
mov dword [ecx + 0x20], eax
mov eax, edi
rol eax, 0x10
mov dword [ecx + 0x28], eax
mov eax, ebx
rol eax, 0x10
mov dword [ecx + 0x30], eax
mov eax, edx
rol eax, 0x10
mov dword [ecx + 0x38], eax
mov eax, edx
xor eax, ebx
movzx eax, ax
xor eax, ebx
mov dword [ecx + 0x24], eax
mov eax, esi
xor eax, edx
movzx eax, ax
xor eax, edx
mov dword [ecx + 0x2c], eax
mov eax, edi
xor eax, esi
movzx eax, ax
xor eax, esi
mov dword [ecx + 0x34], eax
mov eax, edi
xor eax, ebx
movzx eax, ax
xor eax, edi
xor esi, esi
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], esi
pop edi
call fcn.0040510f
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x4053bb
mov edx, ecx
mov eax, dword [edx + esi*4]
lea ecx, [esi - 4]
and ecx, 7
xor dword [edx + ecx*4 + 0x20], eax
inc esi
cmp esi, 8
jb 0x4053ca
pop esi
mov dword [edx + 0x54], 0x10
xor eax, eax
pop ebx
pop edi
leave
ret
Function at 0x4054a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 4], edx
test edi, edi
je 0x4054dc
mov eax, dword [esi + 0x54]
cmp eax, 0x10
jae 0x4054dc
mov al, byte [eax + esi + 0x44]
xor al, byte [edx]
mov byte [ebx], al
inc ebx
inc dword [esi + 0x54]
inc edx
mov eax, dword [esi + 0x54]
mov dword [ebp - 4], edx
sub edi, 1
jne 0x4054bf
cmp edi, 0x10
jb 0x405531
mov eax, edi
shr eax, 4
mov dword [ebp + 0xc], eax
mov ecx, esi
call fcn.0040510f
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.00405299
mov edx, dword [ebp - 4]
sub edi, 0x10
mov eax, dword [edx]
xor eax, dword [ebp - 0x14]
mov dword [ebx], eax
mov eax, dword [edx + 4]
xor eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov eax, dword [edx + 8]
xor eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov eax, dword [edx + 0xc]
add edx, 0x10
xor eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
add ebx, 0x10
sub dword [ebp + 0xc], 1
mov dword [ebp - 4], edx
jne 0x4054e9
test edi, edi
je 0x40556a
mov ecx, esi
call fcn.0040510f
lea edx, [esi + 0x44]
mov ecx, esi
call fcn.00405299
mov edx, dword [ebp - 4]
and dword [esi + 0x54], 0
sub edx, ebx
test edi, edi
je 0x40556a
mov eax, dword [esi + 0x54]
mov cl, byte [edx + ebx]
xor cl, byte [eax + esi + 0x44]
mov byte [ebx], cl
inc ebx
inc dword [esi + 0x54]
dec edi
cmp dword [esi + 0x54], 0x10
jb 0x40554f
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x41c3dc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c252
Function at 0x40106d
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0xd
xor ebp, ebp
pop ecx
lea ebx, [esi + 0x14]
mov dword [esi + 0xd0], eax
push ebp
xor eax, eax
mov edi, ebx
push ebp
push 0x406
rep stosd dword es:[edi], eax
push dword [esi + 0xd0]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx], 0x34
call edi
push ebp
push ebp
push 0x407
mov dword [esi + 4], eax
push dword [esi + 0xd0]
call edi
push ebx
push ebp
push 0x164
mov dword [esi + 8], eax
push dword [esi + 4]
call edi
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
push esi
push 0xffffffffffffffeb
push dword [esi + 0x44]
call edi
push esi
push 0xffffffffffffffeb
push dword [esi + 0xd0]
call edi
push 0x4011c2
push 0xfffffffffffffffc
push dword [esi + 0x44]
call edi
push 0x401111
push 0xfffffffffffffffc
push dword [esi + 0xd0]
mov dword [esi + 0xc8], eax
call edi
push 1
mov dword [esi + 0xcc], eax
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x401ccc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov eax, 0x309
xor ebx, ebx
cmp dword [ebp + 0xc], eax
push esi
push edi
mov esi, ecx
jne 0x401d0b
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
call fcn.0040209e
cmp dword [esi + 0x44], ebx
je 0x401e77
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 0x6f1
cmp dword [ebp + 0xc], eax
jne 0x401df0
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x74]
cmp eax, ebx
je 0x401d4a
mov ecx, dword [esi + 0x70]
cmp ecx, ebx
je 0x401d4a
mov eax, dword [ecx]
push ebx
push ebx
push ecx
call dword [eax + 0x3c]
mov esi, dword [esi + 0x70]
push 1
push ebx
push esi
mov eax, dword [esi]
call dword [eax + 0x3c]
jmp 0x401e77
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x4af600
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x401e77
lea edx, [ebp - 8]
mov dword [ebp - 8], ebx
mov ecx, dword [eax]
push edx
push 0x4ab318
push 2
push eax
call dword [ecx + 0x3c]
cmp dword [ebp - 8], ebx
je 0x401e77
push dword [ebp - 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.00401ea3
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x401dab
mov eax, dword [ecx]
mov dword [ebp - 0x18], ecx
cmp eax, ebx
jne 0x401db8
lea ecx, [ebp - 0x10]
call fcn.00401e80
jmp 0x401e77
push 1
inc eax
pop edx
cmp eax, edx
mov dword [ebp - 4], edx
jbe 0x401de8
lea edi, [ecx + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add edx, dword [edi]
push 1
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x18]
inc dword [ebp - 4]
add edi, 4
mov eax, dword [eax]
inc eax
cmp dword [ebp - 4], eax
jb 0x401dc6
lea ecx, [ebp - 0x10]
call fcn.00401e80
mov eax, 0x30a
cmp dword [ebp + 0xc], eax
jne 0x401e67
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x74], ebx
je 0x401e77
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x401e77
mov eax, dword [0x4bc51c]
push 0x7f
mov dword [ebp - 0x218], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x74]
cmp eax, ebx
je 0x401e77
mov ecx, dword [eax]
push ebx
push dword [ebp - 4]
push eax
call dword [ecx + 0x34]
cmp dword [ebp + 0xc], 0x6f2
jne 0x401e77
mov ecx, esi
call fcn.00402801
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x402519
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0xc]
push 0x8000
lea ecx, [edi + 0x58]
push eax
call fcn.00489a5c
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
mov esi, dword [eax - 8]
call fcn.004038fb
cmp esi, 2
jle 0x402607
lea esi, [ebp + 8]
lea eax, [ebp + 0xc]
neg esi
sbb esi, esi
lea ecx, [edi + 0x58]
and esi, eax
lea ebx, [edi + 0x5c]
neg ecx
mov eax, dword [esi]
sbb ecx, ecx
push eax
and ecx, ebx
mov ecx, dword [ecx]
push ecx
call fcn.00489b2a
pop ecx
test al, al
pop ecx
jne 0x402607
lea eax, [ebp - 0xc]
lea ecx, [ebp + 8]
push eax
call fcn.00489a02
push 0x4af6b4
lea ecx, [ebp - 8]
call fcn.00403927
push str.ERSTELLE
lea ecx, [ebp - 4]
call fcn.00403927
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
mov ecx, ebx
call fcn.00403816
push esi
mov ecx, ebx
call fcn.004042a3
lea eax, [edi + 0x58]
mov ecx, edi
push eax
call fcn.00402616
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004893ad
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402616
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x74], edi
je 0x4027fa
cmp dword [esi + 0x70], edi
mov dword [esi + 0x54], edi
je 0x4027fa
mov eax, dword [esi + 0x6c]
cmp eax, edi
je 0x4027fa
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
lea ebx, [esi + 0x58]
mov dword [ebp - 8], edi
mov eax, ebx
neg eax
lea ecx, [ebx + 4]
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x18]
push eax
call fcn.004042a3
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 0x1c], 0x4a9988
and eax, ecx
mov ecx, esi
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.00402405
cmp dword [ebp - 8], edi
je 0x4027f2
push str.________________________:
lea ecx, [ebp - 4]
mov dword [esi + 0x54], edi
mov dword [ebp - 0xc], edi
call fcn.00403927
lea eax, [ebp - 0x14]
push 0x8000
push eax
mov ecx, ebx
call fcn.00489a5c
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
cmp dword [esi + 0x50], 3
je 0x4027cf
mov eax, ebx
add ebx, 4
push ecx
push ecx
neg eax
sbb eax, eax
mov edi, esp
and eax, ebx
push eax
lea ecx, [edi + 4]
call fcn.004042a3
lea eax, [ebp - 4]
mov dword [edi], 0x4a9988
push eax
call fcn.00492128
add esp, 0xc
lea ecx, [ebp - 0x14]
push str.image
call fcn.00403927
mov eax, dword [eax]
xor edi, edi
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00403d34
mov ebx, eax
lea ecx, [ebp - 0x14]
neg ebx
sbb bl, bl
inc bl
call fcn.004038fb
test bl, bl
jne 0x4027a3
push str.video
lea ecx, [ebp - 0x10]
call fcn.00403927
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00403d34
test eax, eax
je 0x40278a
push str.audio
lea ecx, [ebp - 0x14]
call fcn.00403927
mov eax, dword [eax]
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00403d34
mov ebx, eax
lea ecx, [ebp - 0x14]
neg ebx
sbb bl, bl
inc bl
call fcn.004038fb
test bl, bl
je 0x40278c
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.004038fb
test bl, bl
jne 0x4027a3
push 1
pop eax
mov dword [ebp - 0xc], eax
mov dword [esi + 0x54], eax
jmp 0x4027a6
push 1
pop eax
cmp dword [esi + 0x54], edi
jne 0x4027c5
cmp dword [esi + 0x40], edi
je 0x4027c5
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x40], edi
call fcn.004038fb
xor edi, edi
jmp 0x4027d5
lea ecx, [ebp - 4]
call fcn.004038fb
xor edi, edi
mov eax, dword [esi + 0x54]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x6c]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0xc], edi
jne 0x4027f2
mov esi, dword [esi + 0x70]
push 5
push edi
push esi
mov eax, dword [esi]
call dword [eax + 0x3c]
lea ecx, [ebp - 0x1c]
call fcn.004893ad
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4044ac
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00424cc0
lea eax, [ebp + 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.00424ce8
lea ecx, [ebp - 0x18]
call fcn.00424d0e
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40453c
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x18]
call fcn.00424ddd
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.00424ddd
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.00424dd9
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], edi
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
mov ecx, eax
push 0xf
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
lea ecx, [ebp - 0x18]
call fcn.00424cd3
lea ecx, [ebp + 8]
call fcn.004038fb
leave
ret

Function at 0x4047a6
Capabilities:
Check os version

Disassembly:
cmp dword [0x4bc7b8], 0
push esi
push edi
jne 0x404820
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x45
mov edx, 0x4bc678
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
push edx
mov dword [0x4bc678], 0x114
call esi
mov ecx, dword [0x4bc67c]
movzx edx, word [0x4bc680]
movzx eax, cx
shl eax, 0x10
or eax, edx
cmp ecx, 5
mov dword [0x4bc7b8], eax
jb 0x404820
push 0x47
mov edx, 0x4bc558
pop ecx
xor eax, eax
mov edi, edx
push edx
rep stosd dword es:[edi], eax
mov dword [0x4bc558], 0x11c
call esi
mov eax, dword [0x4bc55c]
mov dword [0x4bc67c], eax
mov eax, dword [0x4bc560]
mov dword [0x4bc680], eax
mov edi, dword [esp + 0xc]
cmp dword [edi], 0
je 0x404894
push dword [0x4bc680]
push dword [0x4bc67c]
push str.Windows__d._d
push edi
call fcn.00403d66
mov eax, dword [0x4bc688]
add esp, 0x10
cmp eax, 2
jne 0x404854
mov esi, str._Win32_NT
jmp 0x40486e
cmp eax, 1
jne 0x404860
mov esi, str._Win32_WINDOWS
jmp 0x40486e
test eax, eax
mov esi, str._Win32s
je 0x40486e
mov esi, str._Unbekannt
mov eax, esi
test eax, eax
je 0x40487b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
mov ecx, edi
call fcn.00403bd8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404894
mov ecx, dword [0x4bc688]
mov dword [eax], ecx
mov eax, dword [0x4bc7b8]
pop edi
pop esi
ret