joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b6270
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b6447
sub esp, 0x3c
lea eax, [0x6d01e0]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [esp + 0x38], eax
mov dword [eax], 0
lea ecx, [0x72b6d3]
mov dword [esp], ecx
mov dword [esp + 4], 0x28
lea ecx, [0x6d0220]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00526ad0
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6b638a
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6b6330
mov dword [esp + 0x24], ecx
lea eax, [0x6db180]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.0046c5c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov dword [esp + 0x30], edx
mov ecx, dword [ecx + 4]
mov dword [esp + 0x2c], ecx
xor ebx, ebx
jmp 0x6b63c1
lea eax, [0x7261cc]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x3c
ret
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x3c
ret
mov dword [esi], edi
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
cmp ebx, ecx
jge 0x6b641d
mov dword [esp + 0x28], ebx
lea eax, [edx + ebx*8]
lea ecx, [edx + ebx*8]
mov ecx, dword [ecx]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004d0bb0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jae 0x6b6441
mov edx, dword [esp + 0x34]
lea ebx, [edx + eax*8 + 4]
mov ebp, dword [esp + 0xc]
lea esi, [edx + eax*8]
mov edi, dword [esp + 8]
mov dword [ebx], ebp
mov ebx, dword [0x93f150]
test ebx, ebx
je 0x6b63b2
mov ebx, edi
call fcn.00471840
mov dword [edi], ebx
mov ebp, dword [esi]
mov dword [edi + 4], ebp
mov edi, ebx
jmp 0x6b63b2
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x3c
ret
call fcn.004718b0
nop
call fcn.00470430
jmp fcn.006b6270
Function at 0x6b6460
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b6637
sub esp, 0x3c
lea eax, [0x6d01e0]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [esp + 0x38], eax
mov dword [eax], 0
lea ecx, [0x72b6fb]
mov dword [esp], ecx
mov dword [esp + 4], 0x28
lea ecx, [0x6d0220]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00526ad0
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6b657a
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6b6520
mov dword [esp + 0x24], ecx
lea eax, [0x6db180]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.0046c5c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov dword [esp + 0x30], edx
mov ecx, dword [ecx + 4]
mov dword [esp + 0x2c], ecx
xor ebx, ebx
jmp 0x6b65b1
lea eax, [0x7292e3]
mov dword [esp], eax
mov dword [esp + 4], 0x23
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x3c
ret
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x3c
ret
mov dword [esi], edi
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
cmp ebx, ecx
jge 0x6b660d
mov dword [esp + 0x28], ebx
lea eax, [edx + ebx*8]
lea ecx, [edx + ebx*8]
mov ecx, dword [ecx]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004d0bb0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jae 0x6b6631
mov edx, dword [esp + 0x34]
lea ebx, [edx + eax*8 + 4]
mov ebp, dword [esp + 0xc]
lea esi, [edx + eax*8]
mov edi, dword [esp + 8]
mov dword [ebx], ebp
mov ebx, dword [0x93f150]
test ebx, ebx
je 0x6b65a2
mov ebx, edi
call fcn.00471840
mov dword [edi], ebx
mov ebp, dword [esi]
mov dword [edi + 4], ebp
mov edi, ebx
jmp 0x6b65a2
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x3c
ret
call fcn.004718b0
nop
call fcn.00470430
jmp fcn.006b6460
Function at 0x6b6840
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b6a17
sub esp, 0x3c
lea eax, [0x6d0060]
mov dword [esp], eax
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [esp + 0x38], eax
mov dword [eax], 0
lea ecx, [0x732da2]
mov dword [esp], ecx
mov dword [esp + 4], 0x64
lea ecx, [0x6d00a0]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00526ad0
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6b695a
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6b6900
mov dword [esp + 0x24], ecx
lea eax, [0x6db180]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.0046c5c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov dword [esp + 0x30], edx
mov ecx, dword [ecx + 4]
mov dword [esp + 0x2c], ecx
xor ebx, ebx
jmp 0x6b6991
lea eax, [0x7233e2]
mov dword [esp], eax
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x3c
ret
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
add esp, 0x3c
ret
mov dword [esi], edi
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
cmp ebx, ecx
jge 0x6b69ed
mov dword [esp + 0x28], ebx
lea eax, [edx + ebx*8]
lea ecx, [edx + ebx*8]
mov ecx, dword [ecx]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004d0bb0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jae 0x6b6a11
mov edx, dword [esp + 0x34]
lea ebx, [edx + eax*8 + 4]
mov ebp, dword [esp + 0xc]
lea esi, [edx + eax*8]
mov edi, dword [esp + 8]
mov dword [ebx], ebp
mov ebx, dword [0x93f150]
test ebx, ebx
je 0x6b6982
mov ebx, edi
call fcn.00471840
mov dword [edi], ebx
mov ebp, dword [esi]
mov dword [edi + 4], ebp
mov edi, ebx
jmp 0x6b6982
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x3c
ret
call fcn.004718b0
nop
call fcn.00470430
jmp fcn.006b6840
Function at 0x6b6c80
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b6eb6
sub esp, 0x34
mov eax, 0
mov dword [esp + 0x30], eax
mov byte [esp + 0x27], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp], 0x80000002
lea eax, [0x7316d1]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x42
mov dword [esp + 0xc], 1
call fcn.0052a1e0
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x6b6e8d
mov eax, dword [esp + 0x10]
lea ecx, [0x6b6ec0]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x30], ecx
mov byte [esp + 0x27], 1
mov dword [esp], eax
lea eax, [0x71d849]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xd
call fcn.0052a4f0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x6b6e60
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [0x71b1f5]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
call fcn.004d0d00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea eax, [0x71b1f6]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
call fcn.004d0d00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004d0bb0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x6b6e01
mov ecx, dword [esp + 8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov byte [esp + 0x27], 0
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
call eax
add esp, 0x34
ret
lea eax, [0x725014]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov byte [esp + 0x27], 0
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
call eax
add esp, 0x34
ret
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov byte [esp + 0x27], 0
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
call eax
add esp, 0x34
ret
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x34
ret
call fcn.00470430
jmp fcn.006b6c80
Function at 0x6b71a0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [0x93ee7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b73b9
sub esp, 0x34
mov eax, dword [esp + 0x38]
mov dword [eax + 0x88], 0
mov dword [eax + 0x8c], 0
mov ecx, dword [0x93f150]
test ecx, ecx
je 0x6b71e6
mov ecx, dword [eax + 0x84]
call fcn.00471830
mov dword [edi], ecx
mov dword [eax + 0x84], 0
lea ecx, [0x6d0160]
mov dword [esp], ecx
call fcn.0040bb90
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
mov dword [eax], 0
lea ecx, [0x7304a6]
mov dword [esp], ecx
mov dword [esp + 4], 0x39
lea ecx, [0x6d01a0]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00526ad0
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6b7310
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6b72c6
mov dword [esp + 0x28], ecx
lea eax, [0x6db180]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.0046c5c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
mov dword [edx + 0x88], ecx
mov dword [edx + 0x8c], ecx
mov ecx, dword [0x93f150]
test ecx, ecx
je 0x6b72ab
call fcn.00471840
mov dword [edi], eax
mov ecx, dword [edx + 0x84]
mov dword [edi + 4], ecx
mov dword [edx + 0x84], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov eax, dword [eax + 4]
mov dword [esp + 0x28], eax
xor ebx, ebx
jmp 0x6b7339
lea eax, [0x727471]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004c2050
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x34
ret
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x34
ret
mov dword [ecx], esi
lea ebx, [edx + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
cmp ebx, eax
jge 0x6b7399
mov dword [esp + 0x24], ebx
lea eax, [ecx + ebx*8]
lea edx, [ecx + ebx*8]
mov edx, dword [edx]
mov eax, dword [eax + 4]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.004d0bb0
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x88]
mov edx, dword [esp + 0x24]
cmp edx, ecx
jae 0x6b73b1
mov ecx, dword [eax + 0x84]
lea ebx, [ecx + edx*8 + 4]
mov ebp, dword [esp + 0xc]
lea ecx, [ecx + edx*8]
mov esi, dword [esp + 8]
mov dword [ebx], ebp
mov ebx, dword [0x93f150]
test ebx, ebx
je 0x6b7328
call fcn.00471840
mov dword [edi], esi
mov ebx, dword [ecx]
mov dword [edi + 4], ebx
jmp 0x6b7328
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x34
ret
mov eax, edx
call fcn.004718b0
nop
call fcn.00470430
jmp fcn.006b71a0
Function at 0xb87598
Capabilities:
Encode data using xor

Disassembly:
jmp 0xb875a2
pushal
call 0xb875a8
pop ebp
sub ebp, 0x10
sub ebp, 0x787598
jmp 0xb875be
mov eax, 0x787598
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0xffc110df
xor byte [eax], dl
inc eax
dec ecx
jne 0xb875d5
jmp 0xb875e8
push esp
adc dl, byte [esi + edx*2 - 0x1d]
invalid
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push esi
push edi
push 0x9c
lea eax, [esp + 0x10]
push 0
push eax
or edi, 0xffffffff
call fcn.00402200
mov ebx, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x9c
call ebx
mov esi, eax
test esi, esi
jne 0x401076
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x94
call ebx
test eax, eax
jne 0x401076
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004021e3
add esp, 0xa0
ret
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x4010be
sub eax, 1
jne 0x4010e6
mov eax, dword [esp + 0x10]
cmp eax, 4
ja 0x401094
mov edi, 4
jmp 0x4010e6
cmp eax, 5
jne 0x4010a4
cmp dword [esp + 0x14], 0
jne 0x4010a4
mov edi, eax
jmp 0x4010e6
test esi, esi
je 0x4010e6
cmp eax, 5
jne 0x4010b2
lea edi, [eax + 1]
jmp 0x4010e6
cmp eax, 6
jb 0x4010e6
mov edi, 7
jmp 0x4010e6
cmp dword [esp + 0x10], 4
jne 0x4010e6
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4010d2
lea edi, [eax + 1]
jmp 0x4010e6
cmp eax, 0xa
jne 0x4010dc
lea edi, [eax - 8]
jmp 0x4010e6
cmp eax, 0x5a
jne 0x4010e6
mov edi, 3
mov ecx, dword [esp + 0xa8]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004021e3
add esp, 0xa0
ret
Function at 0x402080
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x15c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x158], eax
push esi
mov esi, dword [esp + 0x164]
push edi
call fcn.00401000
cmp eax, 7
jne 0x402123
mov edi, 1
cmp dword [0x40cc94], edi
jne 0x402123
mov eax, dword [0x40cc98]
mov eax, dword [eax]
push 0x5c
push eax
call fcn.00402280
inc eax
lea edx, [esp + 0x68]
add esp, 8
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, edi
test cl, cl
jne 0x4020d0
xor eax, eax
lea edx, [esp + 0x24]
lea ecx, [esp + 0x60]
push edx
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], str.runas
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0x4093b8
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor eax, eax
jmp 0x4021ca
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x14
push 0x40cc74
push 0x67
push esi
call edi
push 0x14
push 0x40cc60
push 0x6d
push esi
call edi
push esi
call fcn.00401ff0
mov eax, dword [esp + 0x178]
push eax
push esi
call fcn.004017c0
add esp, 0xc
test eax, eax
je 0x40211c
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
call edi
test eax, eax
je 0x4021c6
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
lea esp, [esp]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push esi
push eax
call ebp
test eax, eax
jne 0x4021b3
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
jne 0x402190
pop ebp
pop ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x160]
pop edi
pop esi
xor ecx, esp
call fcn.004021e3
add esp, 0x15c
ret 0x10

Function at 0x4021e3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4021ed
repz ret
jmp fcn.00402796
Function at 0x4052c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402ab3
and dword [ebp - 4], 0
cmp dword [0x40d5fc], 0
mov ebx, eax
jne 0x405375
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405426
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405426
push eax
call fcn.00402a41
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40d5fc], eax
call esi
push eax
call fcn.00402a41
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40d600], eax
call esi
push eax
call fcn.00402a41
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40d604], eax
call esi
push eax
call fcn.00402a41
pop ecx
mov dword [0x40d60c], eax
test eax, eax
je 0x405375
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402a41
pop ecx
mov dword [0x40d608], eax
mov eax, dword [0x40d608]
cmp eax, ebx
je 0x4053cd
cmp dword [0x40d60c], ebx
je 0x4053cd
push eax
call fcn.00402abc
push dword [0x40d60c]
mov esi, eax
call fcn.00402abc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4053cd
test edi, edi
je 0x4053cd
call esi
test eax, eax
je 0x4053c4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4053c4
test byte [ebp - 0xc], 1
jne 0x4053cd
or dword [ebp + 0x10], 0x200000
jmp 0x405406
mov eax, dword [0x40d600]
cmp eax, ebx
je 0x405406
push eax
call fcn.00402abc
pop ecx
test eax, eax
je 0x405406
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405406
mov eax, dword [0x40d604]
cmp eax, ebx
je 0x405406
push eax
call fcn.00402abc
pop ecx
test eax, eax
je 0x405406
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40d5fc]
call fcn.00402abc
pop ecx
test eax, eax
je 0x405426
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405428
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003020
Capabilities:
Encode data using xor
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x10011040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1000e9b0]
xor eax, eax
movups xmmword [ebp - 0xc8], xmm0
mov word [ebp - 0x78], 0x7b
movaps xmm0, xmmword [0x1000eb00]
movups xmmword [ebp - 0xb8], xmm0
movaps xmm0, xmmword [0x1000eb20]
movups xmmword [ebp - 0xa8], xmm0
movaps xmm0, xmmword [0x1000e9d0]
movups xmmword [ebp - 0x98], xmm0
movaps xmm0, xmmword [0x1000eac0]
movups xmmword [ebp - 0x88], xmm0
mov cl, byte [ebp - 0xc8]
xor byte [ebp + eax - 0xc7], cl
inc eax
cmp eax, 0x50
jb 0x10003081
push esi
lea esi, [ebp - 0xc7]
mov byte [ebp - 0x77], 0
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100030a3
sub esi, ecx
inc esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
lea eax, [ebp - 0xc7]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x6c
lea eax, [ebp - 0x70]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.USER32.dll_SendInput]
add esp, 0xc
mov eax, 0x10
mov dword [ebp - 0x74], 1
mov word [ebp - 0x70], ax
mov ecx, 0xd
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x74]
push 0x1c
push eax
push 4
mov dword [ebp - 0x58], 1
mov word [ebp - 0x54], cx
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], cx
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], 2
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call esi
mov eax, 0x56
mov dword [ebp - 0x74], 1
mov word [ebp - 0x54], ax
mov ecx, 0x11
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x74]
push 0x1c
push eax
push 4
mov word [ebp - 0x70], cx
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], cx
mov dword [ebp - 0x18], 2
call edi
push 0xc8
call esi
mov eax, 0xd
mov dword [ebp - 0x74], 1
mov word [ebp - 0x70], ax
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x74]
push 0x1c
push eax
push 2
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x50], 2
call edi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000c15a
mov esp, ebp
pop ebp
ret