joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411a6e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x45b420]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411ab1
cmp word [esi], dx
jne 0x411ab1
or byte [edi + eax + 0x28], 4
jmp 0x411ab6
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x411c09
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x411be9
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x411af8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x411b2e
cmp eax, edx
jae 0x411b3a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x411ad0
jmp 0x411c09
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411be5
cmp dword [ebp - 0x14], 0
je 0x411be5
mov eax, dword [ebx*4 + 0x45b420]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x411bbd
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x411b86
mov word [esi], cx
jmp 0x411bb9
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x45b420]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x45b420]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x45b420]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x411c09
pop ebx
cmp word [ebp - 4], bx
jne 0x411bce
cmp esi, dword [ebp + 0xc]
jne 0x411bce
mov word [esi], bx
jmp 0x411c06
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004124a2
add esp, 0x10
cmp word [ebp - 4], bx
je 0x411c09
push 0xd
jmp 0x411c02
mov ecx, dword [ebx*4 + 0x45b420]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411c00
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411c09
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4065fe
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0x24
je 0x406614
xor eax, eax
jmp 0x40671b
push esi
push edi
xor edi, edi
cmp dword [0x43f340], edi
jne 0x40667c
push 0x2c
lea eax, [ebp - 0x3c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x40], 0x30
mov dword [ebp - 0x18], str.ColorChooserClass
mov dword [ebp - 0x20], 5
push 0x7f00
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x38], 0x405973
mov dword [ebp - 0x30], 0x38
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov dword [0x43f340], 1
push edi
mov esi, 0xc80000
mov dword [ebp - 0xc], edi
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
mov dword [ebp - 8], 0x15f
mov dword [ebp - 4], 0xd1
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push edi
push edi
push edi
push dword [ebx + 4]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov eax, 0x80000000
push eax
push eax
push esi
push str.Choose_Color
push str.ColorChooserClass
push 1
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
push 5
push esi
mov dword [edi], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0xc]
push esi
call fcn.00406a8d
pop ecx
pop ecx
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.00437955
mov esi, dword [edi + 0x44]
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4083a5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
xor edi, edi
add eax, 0x14
mov ebx, edi
mov edx, edi
mov ecx, dword [eax]
lea esi, [eax - 8]
cmp ecx, eax
je 0x4083e4
mov edi, dword [ebp + 8]
cmp dword [esi + 0x18], ebx
jbe 0x4083d9
cmp dword [esi + 0x18], edi
jae 0x4083d9
mov ebx, dword [esi + 0x18]
mov edx, dword [esi + 0x28]
lea esi, [ecx - 8]
mov ecx, dword [ecx]
cmp ecx, eax
jne 0x4083c9
xor edi, edi
movzx ecx, word [edx]
or eax, 0xffffffff
mov esi, edx
jmp 0x4083fc
cmp cx, 0x5c
lea esi, [esi + 2]
movzx ecx, word [esi]
cmove eax, edi
inc edi
test cx, cx
jne 0x4083ee
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40840a
mov dword [ecx], ebx
inc eax
pop edi
pop esi
pop ebx
lea eax, [edx + eax*2]
pop ebp
ret
Function at 0x40863d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0xcc010000
mov dword [ebp - 0x1c], 0x1400d801
mov dword [ebp - 0x18], 0x3c00f001
mov dword [ebp - 0x14], 0xe4012800
mov dword [ebp - 0x10], 0x6c00a001
mov dword [ebp - 0xc], 0xb4017800
mov dword [ebp - 8], 0x9c015000
mov dword [ebp - 4], 0x44008801
push esi
movzx esi, ax
test ebx, ebx
jle 0x4086d0
push edi
mov edi, dword [ebp + 8]
movzx edx, byte [edi]
mov ecx, esi
and ecx, 0xf
shr si, 4
mov eax, edx
shr edx, 4
and eax, 0xf
mov cx, word [ebp + ecx*2 - 0x20]
xor cx, word [ebp + eax*2 - 0x20]
xor cx, si
movzx ecx, cx
mov eax, ecx
shr cx, 4
and eax, 0xf
mov ax, word [ebp + eax*2 - 0x20]
xor ax, word [ebp + edx*2 - 0x20]
xor ax, cx
inc edi
movzx esi, ax
dec ebx
jne 0x40868e
pop edi
mov ax, si
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408b6b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp + 8]
mov edi, eax
mov dword [ebp - 0xc], ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x408b9a
sub ecx, edx
sar ecx, 1
cmp ecx, 9
jb 0x408bf3
push 9
push str..pipe_
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x408bf3
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x408c20
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push ebx
push eax
push 4
lea eax, [ebp - 4]
push eax
push edi
call esi
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push eax
call fcn.00403c44
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push esi
call dword [ebp + 0x10]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x408cac
cmp dword [esi + 0xc], ebx
je 0x408c78
push ebx
push ebx
push dword [esi + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.00403b85
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
mov esi, eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
push eax
call fcn.00403c8a
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409f1b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409f4b
xor eax, eax
jmp 0x409fd5
push ebx
push edi
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push 1
push ebx
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
call fcn.00409e42
pop ecx
pop ecx
test eax, eax
je 0x409fa7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push edi
call fcn.0040a683
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x14
mov eax, esi
jmp 0x409fd3
push edi
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp + 0x1c]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.0040a218
mov eax, dword [ebp - 4]
add esp, 0x20
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4130aa
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x43f35c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x43f350]
xor ebx, ebx
mov esi, dword [0x43f34c]
or edx, 0xffffffff
mov ecx, ebx
test eax, eax
jle 0x4130e3
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + ecx*4], edi
je 0x4130e0
inc ecx
cmp ecx, eax
jl 0x4130d4
jmp 0x4130e2
mov edx, ecx
pop edi
sub eax, edx
lea ecx, [esi + edx*4]
dec eax
push eax
lea eax, [ecx + 4]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
dec dword [0x43f350]
jne 0x41312c
push dword [0x43f34c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push ebx
push dword [0x43f358]
mov dword [0x43f34c], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x43f358], ebx
mov dword [0x43f348], ebx
push 0x43f35c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
pop ebp
ret
Function at 0x413a70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov ebx, 0x43f35c
inc esi
cmp dword [0x43f354], 0
push edi
jne 0x413a95
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x43f354], esi
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x43f348], 0
mov edi, dword [ebp + 8]
jne 0x413ac8
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push edi
push 0x411c8c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x43f358], eax
mov dword [0x43f348], esi
mov ecx, dword [0x43f34c]
test ecx, ecx
jne 0x413ae5
push 4
push esi
call dword [sym.imp.msvcrt.dll_calloc]
inc dword [0x43f350]
mov dword [eax], edi
jmp 0x413b04
mov esi, dword [0x43f350]
lea eax, [esi*4 + 4]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_realloc]
mov dword [eax + esi*4], edi
inc esi
mov dword [0x43f350], esi
pop ecx
pop ecx
push ebx
mov dword [0x43f34c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419c79
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov edi, dword [esi + 0x40]
imul edi, dword [esi + 0x3c]
push esi
call fcn.00419f79
xor edx, edx
xor ebx, ebx
pop ecx
inc edx
pop ecx
test edi, edi
jle 0x419cd2
cmp dword [esi + 0x28], 8
mov eax, dword [esi + 0x38]
setne cl
dec cl
and cl, 0x10
or cl, byte [ebx + eax]
lea eax, [ebp + 0xb]
push edx
push eax
push dword [ebp + 0xc]
or cl, 0x20
mov byte [ebp + 0xb], cl
call fcn.00403cda
add esp, 0xc
inc ebx
push 1
pop edx
cmp ebx, edi
jl 0x419ca0
xor ebx, ebx
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x1c], 0x4b4e494c
mov dword [ebp - 0x18], 2
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], bl
mov dword [ebp - 0x28], 0x544e4d43
mov dword [ebp - 0x24], 2
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1f], bl
mov dword [ebp - 0x40], 0x45444f4d
mov dword [ebp - 0x3c], 4
mov byte [ebp - 0x38], dl
mov word [ebp - 0x37], 0
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x34], 0x455a4953
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], 0
mov dword [ebp - 8], 0x20524556
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x20444e45
mov dword [ebp - 0xc], 0
test ecx, ecx
jne 0x419d50
mov ecx, ebx
jmp 0x419d5c
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419d53
sub ecx, edi
mov eax, dword [esi + 0x30]
mov dword [ebp + 8], ecx
test eax, eax
je 0x419d74
mov ebx, eax
lea edi, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x419d6b
sub ebx, edi
mov edi, dword [ebp + 0xc]
lea eax, [ecx + 2]
mov dword [ebp - 0x18], eax
lea eax, [ebx + 2]
push 3
mov dword [ebp - 0x24], eax
pop eax
push 8
mov byte [ebp - 0x13], cl
pop ecx
cmp dword [esi + 0x28], ecx
push 0xa
cmove edx, eax
mov byte [ebp - 0x1f], bl
mov ax, word [esi + 0x18]
mov word [ebp - 0x2c], ax
mov ax, word [esi + 0x1c]
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x1c]
push eax
push edi
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], ecx
call fcn.00403cda
push dword [ebp + 8]
push dword [esi + 0x34]
push edi
call fcn.00403cda
push 0xa
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.00403cda
push ebx
push dword [esi + 0x30]
push edi
call fcn.00403cda
push 0xc
lea eax, [ebp - 0x40]
push eax
push edi
call fcn.00403cda
push 0xc
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.00403cda
add esp, 0x48
lea eax, [ebp - 8]
push 8
push eax
push edi
call fcn.00403cda
push 8
push str.IS_ACG03
push edi
call fcn.00403cda
push 8
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00403cda
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d097
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push 0x41ceca
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x41d92d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push edi
mov dword [ebp - 0x28], 0x4c43434e
mov dword [ebp - 0x24], 0x100feff
mov edi, dword [ebx + 0x30]
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x10010
mov dword [ebp - 0x18], 0x544c4150
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x544e4d43
mov dword [ebp - 4], 0xc
test edi, edi
jne 0x41d97e
mov edi, ecx
jmp 0x41d990
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41d981
sub edi, ecx
add edi, 4
and edi, 0xfffffffc
push esi
mov esi, edi
lea eax, [edi + 8]
neg esi
push 0
sbb esi, esi
and esi, eax
lea eax, [edx*2 + 0x10]
lea ecx, [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, edx
mov dword [ebp - 4], esi
cdq
lea ecx, [ecx + esi]
mov dword [ebp - 0x20], ecx
pop ecx
setne cl
inc cx
mov word [ebp - 0x1a], cx
mov ecx, dword [ebx + 0x1c]
idiv ecx
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
call fcn.00403cda
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.00403cda
mov eax, dword [ebx + 0x18]
add eax, eax
push eax
push dword [ebx + 0x2c]
push dword [ebp + 0xc]
call fcn.00403cda
add esp, 0x24
test esi, esi
pop esi
je 0x41da59
and dword [ebp + 8], 0
lea eax, [ebp - 8]
push 8
push eax
push dword [ebp + 0xc]
call fcn.00403cda
mov ecx, dword [ebx + 0x30]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41da1c
sub ecx, edx
lea eax, [ecx + 1]
push eax
push dword [ebx + 0x30]
push dword [ebp + 0xc]
call fcn.00403cda
mov ecx, dword [ebx + 0x30]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41da3d
sub ecx, edx
lea eax, [ebp + 8]
sub edi, ecx
dec edi
push edi
push eax
push dword [ebp + 0xc]
call fcn.00403cda
add esp, 0xc
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41da61
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], 0x4e434c52
mov dword [ebp - 0xc], 0x100feff
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov word [ebp - 4], 0x10
mov dword [ebp - 0x38], 0x504c5454
mov dword [ebp - 0x24], 0x10
lea edi, [eax*2 + 0x18]
mov dword [ebp - 0x20], 0x50434d50
mov dword [ebp - 0x16], 0x8beef
mov word [ebp - 0x12], bx
test edx, edx
je 0x41dac0
cmp dword [esi + 0x28], ebx
je 0x41dac0
lea ebx, [edx*2 + 0x10]
xor ecx, ecx
mov dword [ebp - 0x34], edi
test ebx, ebx
push 0x10
setne cl
xor eax, eax
inc ecx
cmp dword [esi + 0x14], 8
mov word [ebp - 2], cx
sete al
add eax, 3
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [edi + 0x10]
mov edi, dword [ebp + 0xc]
add eax, ebx
mov dword [ebp - 8], eax
mov ax, dx
mov word [ebp - 0x18], ax
lea eax, [edx*2 + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00403cda
push 0x18
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.00403cda
mov eax, dword [esi + 0x18]
add eax, eax
push eax
push dword [esi + 0x2c]
push edi
call fcn.00403cda
add esp, 0x24
test ebx, ebx
je 0x41db52
push 0x10
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.00403cda
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push dword [esi + 0x28]
push edi
call fcn.00403cda
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dbe5
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.0041e027
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea eax, [edi*8 + 8]
push eax
push 0x42
call esi
lea ecx, [edi*8 + 0x28]
mov ebx, eax
push ecx
push 0x42
mov dword [ebp - 0x1c], ebx
call esi
lea ecx, [edi*4 + 4]
mov dword [ebp - 0x10], eax
push ecx
push 0x42
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov dword [ebp - 0xc], eax
call esi
push dword [ebp - 0x10]
mov edi, eax
call esi
push dword [ebp - 0xc]
mov ebx, eax
call esi
mov dword [edi + 4], 1
lea ecx, [edi + 8]
push 3
lea esi, [ebx + 0x20]
lea edx, [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
mov dword [edi], edx
xor edi, edi
inc edi
mov dword [ebx], 0xc208b8
mov dword [ebx + 4], edi
mov dword [ebx + 0x1c], edi
pop edi
mov dword [ebx + 0x18], edx
mov word [eax], di
xor edi, edi
mov word [eax + 2], dx
test edx, edx
jle 0x41dcfa
lea eax, [ecx + edx*4]
mov dword [ebp - 4], eax
mov eax, esi
sub eax, ecx
sub ecx, esi
sub dword [ebp - 8], esi
mov ebx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.004057cf
mov dword [ebx + esi], eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.004057cf
mov dword [esi], eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.004057cf
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + edx], eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.004057cf
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
movzx eax, word [eax + edi*2]
push eax
call fcn.004057cf
mov ecx, dword [ebp - 8]
add esp, 0x14
add dword [ebp - 4], 4
inc edi
mov dword [ecx + esi], eax
lea esi, [esi + 4]
cmp edi, dword [ebp + 0xc]
jl 0x41dc90
mov edi, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
mov ebx, dword [ebp - 0x10]
push ebx
call esi
push dword [ebp - 0xc]
call esi
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push dword [0x43f374]
call esi
push ebx
push dword [0x43f378]
call esi
push dword [ebp - 0xc]
push dword [0x43f37c]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ffcd
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.0041e027
push dword [0x43f374]
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
call esi
push dword [0x43f378]
mov dword [ebp - 8], eax
call esi
push dword [0x43f37c]
mov ebx, eax
mov dword [ebp - 0x10], ebx
call esi
mov edi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edi
test eax, eax
je 0x42001f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [eax + 4]
imul esi, dword [eax]
add eax, 8
jmp 0x420048
test ebx, ebx
je 0x420036
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [eax + 0x1c]
imul esi, dword [eax + 0x18]
add eax, 0x20
jmp 0x420048
test edi, edi
je 0x420093
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
movsx esi, word [eax + 2]
add eax, 4
cmp esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmovg esi, dword [ebp + 0xc]
test esi, esi
jle 0x420075
xor ebx, ebx
mov edi, eax
push dword [edi + ebx*4]
call fcn.0040580c
pop ecx
mov ecx, dword [ebp + 8]
mov word [ecx + ebx*2], ax
inc ebx
cmp ebx, esi
jl 0x42005a
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x420085
push eax
call esi
test ebx, ebx
je 0x42008c
push ebx
call esi
test edi, edi
je 0x420093
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4203fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xc
push 1
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
lea ecx, [ebp + 8]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x420224
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x422cb5
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 4]
mov edi, eax
cmp ecx, 1
jle 0x422d14
dec ecx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
test ecx, ecx
jle 0x422d13
mov eax, dword [edi + esi*4 + 4]
cmp word [eax], 0x2f
je 0x422d03
cmp dword [ebp + 0xc], 0
push eax
push dword [ebp + 8]
jne 0x422cfc
call fcn.00422498
pop ecx
jmp 0x422d0c
call fcn.00422c64
jmp 0x422cf9
add eax, 2
push eax
call fcn.004216d6
inc esi
pop ecx
cmp esi, dword [ebp - 4]
jl 0x422ce0
pop esi
pop edi
mov esp, ebp
pop ebp
ret