joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405260
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405372
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405372
cmp dword [esp + 0x2c], 0
je 0x405372
push esi
call fcn.0040ce90
add esp, 4
test eax, eax
je 0x4052ca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4052d1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4052b0
jmp 0x4052d3
mov ebx, 0x1505
jmp 0x4052d3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x40537a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405337
call fcn.00405fa0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405372
push ecx
call fcn.0040ce90
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x4053ed
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405398
inc edi
dec esi
je 0x4052ec
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x4052f1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405390
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040ce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405390
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040ceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405390
mov eax, 0xffffffff
jmp 0x405372
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405408
inc edi
dec esi
je 0x405332
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405337
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405400
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040ce90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405400
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040ceb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405400
jmp 0x405337
Function at 0x405cf0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405eda
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405eda
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405eda
cmp dword [ecx], 0
jne 0x405eda
push esi
call fcn.0040ce90
add esp, 4
test eax, eax
je 0x405d5a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405d61
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405d40
jmp 0x405d63
mov edi, 0x1505
jmp 0x405d63
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405e34
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405dc1
call fcn.00405fa0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405eda
push esi
call fcn.0040ce90
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405ef0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040ce90
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x405ed5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cca0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405eda
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405e58
inc ebx
dec edx
je 0x405d7c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405d81
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405e50
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040ce90
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405e50
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040ceb0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405e50
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404e10
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405e29
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406fa0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x407166
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x40715f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x407043
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x40715f
xor eax, eax
cmp edx, 8
mov dword [esp + 0xc], ebp
jb 0x4070c2
mov eax, edx
and eax, 0x1ff8
mov dword [esp + 4], eax
mov ebp, edx
xor edx, edx
nop
nop
nop
mov eax, edx
movzx edx, byte [ebx + edx]
mov esi, edi
and esi, edx
xor edi, edx
lea edx, [edi + esi*2]
add ecx, edx
movzx esi, byte [ebx + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x407060
add ebx, edx
mov edx, ebp
mov eax, dword [esp + 4]
mov esi, eax
sub esi, edx
mov dword [esp], edx
jae 0x406ffb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x407112
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x4070f0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x406ff0
jmp 0x40711f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x406ff0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x407130
jmp 0x406ff0
shl ecx, 0x10
or ecx, edi
jmp 0x40716b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ccf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x40cd4e
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x40cd4e
test ebx, ebx
je 0x40cded
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x40cd92
mov ebp, ebx
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov byte [edx + esi], bl
dec esi
cmp edi, esi
jne 0x40cd30
add ecx, esi
add edx, esi
mov ebx, ebp
add esi, ebp
cmp ebx, 8
jae 0x40cd99
jmp 0x40cded
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
xor ecx, 3
mov ebp, ebx
or ebp, 0xfffffffc
and ebp, ecx
lea edx, [eax + ebp]
add ebp, esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov esi, ebp
mov edi, edx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x40cded
and ebx, 2
movzx ecx, byte [ebp + ebx]
mov byte [edx + ebx], cl
jmp 0x40cded
mov esi, ebx
cmp ebx, 8
jb 0x40cded
neg esi
xor edi, edi
nop
nop
nop
movzx ebx, byte [ecx + edi]
mov byte [edx + edi], bl
movzx ebx, byte [ecx + edi - 1]
mov byte [edx + edi - 1], bl
movzx ebx, byte [ecx + edi - 2]
mov byte [edx + edi - 2], bl
movzx ebx, byte [ecx + edi - 3]
mov byte [edx + edi - 3], bl
movzx ebx, byte [ecx + edi - 4]
mov byte [edx + edi - 4], bl
movzx ebx, byte [ecx + edi - 5]
mov byte [edx + edi - 5], bl
movzx ebx, byte [ecx + edi - 6]
mov byte [edx + edi - 6], bl
movzx ebx, byte [ecx + edi - 7]
mov byte [edx + edi - 7], bl
add edi, 0xfffffff8
cmp esi, edi
jne 0x40cda0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d470
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00446040
test al, al
je 0x40d64e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043d9e0
test al, al
je 0x40d649
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x8245f0fd
mov dword [esp + 8], 0xd6e8a2d6
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40d4f6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d660
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40d4d0
mov dword [esp + 4], 0x6ac10f4f
mov dword [esp + 8], 0xa4f91641
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d546
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d6f0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d520
test esi, esi
je 0x40d5e6
mov dword [esp + 4], 0x13121131
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d596
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d780
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d570
mov dword [esp + 4], 0xc9679d33
mov dword [esp + 8], 0xa3b8acea
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d5e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d810
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d5c0
mov dword [esp + 4], 0x72737071
mov dword [esp + 8], 0x6e6f6c6d
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d636
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d880
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d610
call fcn.0040efe0
test al, al
je 0x40d649
call fcn.00412450
call fcn.00410680
call fcn.00447110
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40da8a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40d99c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40d9cd
cmp cx, 0x7f
jbe 0x40d990
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x40d9c0
add ebx, 2
jmp 0x40d991
mov ecx, ebx
xor ecx, 3
and ebx, 3
lea ebx, [ecx + ebx*2]
jmp 0x40d991
lea esi, [ebx + 1]
push esi
call fcn.0040cc70
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x40da98
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x40da08
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40da9a
movzx edx, word [edi]
test dx, dx
je 0x40da9a
cmp dx, 0x7f
jbe 0x40d9f0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x40da50
cmp esi, 0x7ff
ja 0x40da50
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x40d9f7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x40d9f7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x40d9f7
push 1
call fcn.0040cc70
add esp, 4
mov ebp, eax
jmp 0x40da9a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x40dab5
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x40dab0
test eax, eax
je 0x40dac9
mov ebx, eax
jmp 0x40dab0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004091e0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x41d610
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa50
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d630
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x457270]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d664
mov eax, 0xffffffff
jmp 0x41d667
lea eax, [ebx + ebx]
push eax
call fcn.0040cc70
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x457270]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41d69c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cc70
add esp, 4
mov esi, eax
mov dword [esp + 0x228], 0x9fd299c4
mov dword [esp + 0x22c], 0xa3d59dfd
mov dword [esp + 0x230], 0xa786a1d4
mov dword [esp + 0x234], 0xabcfa5fe
mov dword [esp + 0x238], 0xafd9a9de
mov dword [esp + 0x23c], 0xb3c1adc5
mov dword [esp + 0x240], 0xb7b6b1c2
mov word [esp + 0x244], 0
mov byte [esp + 0x246], 0
mov dword [esp + 0x668], 0
mov eax, dword [esp + 0x668]
cmp eax, 0x1e
ja 0x41d760
nop
nop
nop
mov eax, dword [esp + 0x668]
movzx eax, byte [esp + eax + 0x228]
push dword [esp + 0x668]
push eax
call fcn.00422610
add esp, 8
mov ecx, dword [esp + 0x668]
mov byte [esp + ecx + 0x228], al
inc dword [esp + 0x668]
mov eax, dword [esp + 0x668]
cmp eax, 0x1f
jb 0x41d720
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41d791
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d780
mov word [eax], 0
movzx ecx, word [esp + 0x228]
test cx, cx
je 0x41d7c1
lea edx, [esp + 0x22a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d7b0
mov word [eax], 0
lea eax, [esp + 0x108]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0044abe0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x452078]
Function at 0x424cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424cf0
cmp eax, 0xffffffdd
jge 0x424d07
mov eax, 0xffffffff
jmp 0x424d0a
add eax, 0x22
push eax
call fcn.0040cc70
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0xff69f904
mov dword [esp + 0x1c], 0xe371fd68
mov dword [esp + 0x20], 0xe707e176
mov dword [esp + 0x24], 0xeb0fe50f
mov dword [esp + 0x28], 0xef0ae914
mov dword [esp + 0x2c], 0x9378ed09
mov dword [esp + 0x30], 0x97039171
mov dword [esp + 0x34], 0x9b0e9578
mov word [esp + 0x38], 0x9998
mov dword [esp + 0x3a], 0
mov byte [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x26
ja 0x424dab
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00425b70
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x27
jb 0x424d80
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424dd1
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424dc0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424e01
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424df0
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xf345f145
mov dword [esp + 0x1c], 0xff8bfd46
mov dword [esp + 0x20], 0xfb42f955
mov dword [esp + 0x24], 0xc76bc578
mov dword [esp + 0x28], 0xc371c176
mov dword [esp + 0x2c], 0xcf79cd65
mov dword [esp + 0x30], 0xcba1c97e
mov dword [esp + 0x34], 0xd7bdd5bf
mov dword [esp + 0x38], 0xd374d1ba
mov dword [esp + 0x3c], 0xdf6ddd61
mov dword [esp + 0x40], 0xdb68d975
mov dword [esp + 0x44], 0x27912567
mov dword [esp + 0x48], 0x239e2196
mov dword [esp + 0x4c], 0x2f962d81
mov dword [esp + 0x50], 0x2b632994
mov dword [esp + 0x54], 0x37733598
mov dword [esp + 0x58], 0x3332315a
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x45
ja 0x424ee6
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425bf0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x46
jb 0x424ec0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x4251d0
push ecx
push esi
call fcn.00425fd0
add esp, 0x10
jmp dword [0x45252c]
Function at 0x439bd0
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x439d2b
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x439d25
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040ce90
mov ebp, eax
cmp ebp, 0
setne al
xor ebx, ebx
test al, 1
jne 0x439c54
jmp 0x439d19
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0xa3
mov byte [esp + 0x19], 0x7d
mov byte [esp + 0x1a], 0x7b
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], 0x7a
mov byte [esp + 0x1e], 0x47
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x7c
mov byte [esp + 0x21], 0x87
mov byte [esp + 0x22], 0x4e
mov byte [esp + 0x23], 0x53
mov byte [esp + 0x24], 0x48
mov byte [esp + 0x25], 0xdd
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x11
jne 0x439ca7
jmp 0x439cb6
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x11
jae 0x439cf3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043d8f0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x439cbe
jmp 0x439cf5
jmp 0x439cf7
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040db10
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x439d19
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
lea edi, [ebp - 3]
mov esi, section..rdata
push edi
pop edi
push 3
pop ecx
rep movsb byte es:[edi], byte [esi]
sub ebx, ebx
mov eax, ebx
movsx eax, al
add eax, 0x41
mov byte [ebp - 3], al
lea eax, [ebp - 3]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp + ebx*4 - 0x6c], eax
add ebx, 1
cmp ebx, 0x1a
jl 0x40109a
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x6c]
pushal
popal
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x21c
push esi
push edi
lea edi, [ebp - 0x1fe]
mov esi, 0x40c003
nop
nop
push 0x3f
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xff]
mov esi, 0x40c102
push 0x3f
pop ecx
nop
nop
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x214], 0xff
lea edi, [ebp - 0x208]
mov esi, 0x40c201
nop
nop
push 2
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x209]
mov esi, 0x40c20b
pushfd
xor ecx, ecx
inc ecx
popfd
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x21c]
mov esi, 0x40c20c
nop
push 8
nop
pop ecx
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0x209]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jbe 0x4011e4
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x4011e4
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xff]
push eax
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4011e4
push 0xa
lea eax, [ebp - 0x1fe]
push eax
lea eax, [ebp - 0xff]
push eax
call fcn.00403730
add esp, 0xc
test eax, eax
jne 0x4011e4
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pushfd
xor eax, eax
inc eax
popfd
jmp 0x4011f3
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret