joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ae0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405cca
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405cca
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405cca
cmp dword [ecx], 0
jne 0x405cca
push esi
call fcn.0040ca10
add esp, 4
test eax, eax
je 0x405b4a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405b51
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405b30
jmp 0x405b53
mov edi, 0x1505
jmp 0x405b53
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405c24
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405bb1
call fcn.00405d90
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405cca
push esi
call fcn.0040ca10
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405ce0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040ca10
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44f008]
add esp, 4
test eax, eax
je 0x405cc5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c8e0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405cca
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405c48
inc ebx
dec edx
je 0x405b6c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405b71
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405c40
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040ca10
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405c40
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040ca40
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405c40
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404c10
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405c19
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406da0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406f46
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, ecx
not eax
or eax, 0xffff
lea edi, [ecx + eax]
inc edi
shr ecx, 0x10
test esi, esi
je 0x406f3f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406e35
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406f3f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406eae
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406e50
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406dfd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406ef0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406ed0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406df0
jmp 0x406eff
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406df0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406f10
jmp 0x406df0
shl ecx, 0x10
add ecx, edi
jmp 0x406f4b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406fb8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406fba
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44cc50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
or edi, ebp
xor edi, ebx
xor eax, dword [edi*4 + 0x44cc50]
inc esi
cmp edx, esi
jne 0x406f80
not eax
jmp 0x406fba
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cfe0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00445440
test al, al
je 0x40d1be
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043cdc0
test al, al
je 0x40d1b9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x2225f0ed
mov dword [esp + 8], 0xf6f802f6
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d066
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d1d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d040
mov dword [esp + 4], 0x56b9f333
mov dword [esp + 8], 0x4cb11239
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d0b6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d240
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d090
test esi, esi
je 0x40d156
mov dword [esp + 4], 0x595a5b23
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d106
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d2c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d0e0
mov dword [esp + 4], 0x71db3d97
mov dword [esp + 8], 0x1f00ec56
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d156
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d350
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d130
mov dword [esp + 4], 0x22252427
mov dword [esp + 8], 0x5e212023
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d1a6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d3e0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d180
call fcn.0040eb70
test al, al
je 0x40d1b9
call fcn.00412130
call fcn.00410300
call fcn.00446660
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40fcd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x454d4c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40fd7e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44fc5c]
xor eax, eax
jmp 0x4102f1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412130
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x450578]

Function at 0x420a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov esi, dword [esp + 0x60]
xor eax, eax
test esi, esi
setne al
xor edi, edi
mov dword [esp + 0x38], 0
xor ebx, ebx
jmp dword [eax*4 + 0x45113c]
Function at 0x4249a0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov ecx, dword [ebx + 4]
lea eax, [ecx - 2]
mov edx, ecx
nop
nop
nop
nop
nop
add eax, 2
cmp word [edx], 0
lea edx, [edx + 2]
jne 0x4249c0
mov edx, ecx
not edx
and edx, eax
add edx, edx
xor eax, ecx
sub edx, eax
cmp edx, 0xffffffdd
jge 0x4249e4
mov edx, 0xffffffff
jmp 0x4249e7
add edx, 0x22
push edx
call fcn.0040c8b0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x23b1214c
mov dword [esp + 0x1c], 0x27b925b0
mov dword [esp + 0x20], 0x5b3b59ca
mov dword [esp + 0x24], 0x5f3b5d3b
mov dword [esp + 0x28], 0x5336513c
mov dword [esp + 0x2c], 0x57305531
mov dword [esp + 0x30], 0x4bdf4929
mov dword [esp + 0x34], 0x4fda4dd0
mov word [esp + 0x38], 0x4140
mov dword [esp + 0x3a], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x25
ja 0x424a8b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.004258f0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x26
jb 0x424a60
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424ab1
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424aa0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424ae1
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424ad0
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x910f9f03
mov dword [esp + 0x1c], 0x95cd931a
mov dword [esp + 0x20], 0x891e9733
mov dword [esp + 0x24], 0x8d2d8b1c
mov dword [esp + 0x28], 0x811b8f12
mov dword [esp + 0x2c], 0x8513831b
mov dword [esp + 0x30], 0xf9db871a
mov dword [esp + 0x34], 0xfda7fba5
mov dword [esp + 0x38], 0xf150ffa6
mov dword [esp + 0x3c], 0xf567f367
mov dword [esp + 0x40], 0xe964f753
mov dword [esp + 0x44], 0xed7bebad
mov dword [esp + 0x48], 0xe17aef72
mov dword [esp + 0x4c], 0xe56ae347
mov dword [esp + 0x50], 0xd95de770
mov dword [esp + 0x54], 0xdd95db7c
mov dword [esp + 0x58], 0xd1dedf86
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x424bc6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425950
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x424ba0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x424f20
push ecx
push esi
call fcn.00426000
add esp, 0x10
jmp dword [0x45136c]
Function at 0x428b40
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x6c
mov esi, dword [0x456084]
mov dword [esp + 0x10], 0xf306f12d
mov dword [esp + 0x14], 0xef0ded7b
mov dword [esp + 0x18], 0xeb7ee909
mov dword [esp + 0x1c], 0xe776e525
mov dword [esp + 0x20], 0xe31ee170
mov dword [esp + 0x24], 0x9f129d7d
mov dword [esp + 0x28], 0x9b479979
mov dword [esp + 0x2c], 0x9594
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x428bcb
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x10]
push dword [esp + 4]
push eax
call fcn.0042b2f0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x428ba0
lea edi, [esp + 0x60]
lea eax, [esp + 0x10]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x60]
test ebx, ebx
jns 0x428bee
mov eax, 0xffffffff
jmp 0x428bf1
lea eax, [ebx + ebx]
push eax
call fcn.0040c8b0
add esp, 4
mov esi, eax
mov ebp, dword [0x456084]
mov dword [esp + 0x10], 0x29662b0f
mov dword [esp + 0x14], 0x2d4b2fb9
mov dword [esp + 0x18], 0x513e534b
mov dword [esp + 0x1c], 0x55c65717
mov dword [esp + 0x20], 0x591e5bc4
mov dword [esp + 0x24], 0x5dca5f3f
mov dword [esp + 0x28], 0x4169433b
mov word [esp + 0x2c], 0x4740
mov dword [esp + 0x2e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x21
ja 0x428c8b
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x10]
push dword [esp + 4]
push eax
call fcn.0042b370
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x22
jb 0x428c60
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x20]
push eax
push 0
call ebp
mov eax, dword [esp + 0x60]
mov ecx, eax
and ecx, 9
xor eax, 9
lea eax, [eax + ecx*2]
test eax, eax
jns 0x428cb3
mov eax, 0xffffffff
jmp 0x428cb5
add eax, eax
push eax
call fcn.0040c8b0
add esp, 4
mov edi, eax
mov dword [esp + 0x10], 0x578649ac
mov dword [esp + 0x14], 0x53bd55b5
mov dword [esp + 0x18], 0x5fbf51a7
mov dword [esp + 0x1c], 0x5bb75db7
mov dword [esp + 0x20], 0x676659a7
mov dword [esp + 0x24], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x17
ja 0x428d3b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x10]
push dword [esp + 4]
push eax
call fcn.0042b410
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x18
jb 0x428d10
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x428d61
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428d50
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x428d91
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428d80
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.0044a200
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x451a78]
Function at 0x42bd20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84c
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov edi, 0x20219
mov eax, 1
xor ebp, ebp
jmp dword [eax*4 + 0x4521f4]
Function at 0x438fe0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x439135
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
jmp 0x439038
xor ebx, ebx
test al, 1
jne 0x439043
jmp 0x43912f
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0041b090
mov ebp, eax
xor ebx, ebx
cmp ebp, 0
je 0x439123
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0xf9
mov byte [esp + 0x19], 0x93
mov byte [esp + 0x1a], 0x9d
mov byte [esp + 0x1b], 0x91
mov byte [esp + 0x1c], 0x82
mov byte [esp + 0x1d], 0x92
mov byte [esp + 0x1e], 0x81
mov byte [esp + 0x1f], 0x8f
mov byte [esp + 0x20], 0x80
mov byte [esp + 0x21], 0xc9
mov byte [esp + 0x22], 0xb2
mov byte [esp + 0x23], 0xb1
mov byte [esp + 0x24], 0xb4
mov byte [esp + 0x25], 0x3b
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x11
jne 0x4390b9
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x11
jae 0x439103
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043cca0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x4390ce
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d660
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4474f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
push eax
mov esi, esp
movzx edi, word [ebx]
mov dword [ebp - 0x1c], 0x1716ffed
mov word [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 5
ja 0x447546
nop
nop
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x1c]
push dword [ebp - 0x14]
push eax
call fcn.00447b00
add esp, 8
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x1c], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 6
jb 0x447520
xor ecx, ecx
cmp dword [ebp - 0x1c], edi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4546f4]
mov edi, dword [ebx + 0x3c]
mov ebx, dword [ebx + edi]
mov dword [esi], 0x7f7e3c08
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
cmp eax, 3
ja 0x4475a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x1c]
movzx eax, byte [esi + eax]
push dword [ebp - 0x1c]
push eax
call fcn.00447b70
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov byte [esi + ecx], al
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 4
jb 0x447580
xor ecx, ecx
cmp ebx, dword [esi]
setne cl
xor eax, eax
mov esi, dword [ebp + 8]
jmp dword [ecx*4 + 0x4546fc]
mov edx, dword [esi + edi + 0x78]
cmp dword [esi + edi + 0x7c], 0
sete al
test edx, edx
sete cl
or cl, al
movzx ecx, cl
xor eax, eax
jmp dword [ecx*4 + 0x454704]
mov eax, dword [esi + edx + 0x20]
add eax, esi
mov dword [ebp - 0x44], eax
mov eax, dword [esi + edx + 0x24]
add eax, esi
mov dword [ebp - 0x38], eax
mov eax, dword [esi + edx + 0x1c]
add eax, esi
mov dword [ebp - 0x34], eax
mov eax, dword [0x454714]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002a90
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013cf25
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10165004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x34]
mov ebx, dword [ebp + 8]
lea edx, [esi + 0xc]
push ecx
push edx
mov dword [ebp - 0x3c], eax
lea edi, [esi + 0x10]
mov dword [esi + 8], eax
lea eax, [esi + 0x18]
push eax
push edi
push dword [ebp - 0x3c]
mov dword [esi], 6
push ebx
mov dword [esi + 4], ebx
mov dword [edx], 0
mov dword [esi + 0x30], 0
mov dword [ecx], 0
mov dword [edi], 6
mov dword [esi + 0x14], eax
call dword [sym.imp.node.exe_napi_get_cb_info]
add esp, 0x18
test eax, eax
je 0x10002b5c
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x38]
call fcn.100023d0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.100029a0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x10002be5
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002bdb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c31
jmp 0x10002bdb
mov eax, dword [edi]
cmp eax, dword [esi]
jbe 0x10002c11
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101292c2
add esp, 4
mov dword [esi + 0x30], eax
mov dword [esi + 0x14], eax
push 0
push 0
push eax
push edi
push dword [ebp - 0x3c]
push ebx
call dword [sym.imp.node.exe_napi_get_cb_info]
add esp, 0x18
test eax, eax
je 0x10002c11
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x38]
call fcn.100023d0
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.100029a0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x10002be5
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002bdb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002c36
push ecx
push edx
call fcn.101292b4
add esp, 8
mov eax, dword [ebp - 0x34]
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
test eax, eax
je 0x10002c11
cmp byte [ebp - 0x30], 0
jne 0x10002c11
push eax
push dword [ebp - 0x38]
call dword [sym.imp.node.exe_napi_delete_reference]
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10129271
mov esp, ebp
pop ebp
ret 8
call fcn.1012ca60
call fcn.1012ca60
int3
Function at 0x100030e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013cffb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x10165004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebx + 8]
mov dword [esi], 0x10156b8c
mov dword [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [esi + 0x18], 0
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], 0
lea ecx, [eax + 4]
mov byte [ebp - 4], 1
call fcn.10006810
lea ecx, [ebx + 0xc]
call fcn.10001420
test eax, eax
je 0x1000319e
lea ecx, [ebx + 0xc]
call fcn.10001420
cmp eax, 7
jne 0x1000319e
push ecx
lea eax, [ebx + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.100069d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x100489f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x10048a1d
push esi
lea esi, [edx + 1]
nop dword [eax + eax]
mov ecx, dword [eax + 0x98]
mov edx, esi
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [eax + 0x98], edx
mov eax, dword [eax + 8]
test eax, eax
jne 0x10048a00
pop esi
ret