joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484330
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
cmp word [0x4870c8], 0
push esi
jne 0x484347
mov dword [0x4870a8], 0x271
jmp 0x48435e
mov eax, dword [0x4870a8]
cmp eax, 0x270
jl 0x484525
cmp eax, 0x271
jne 0x484368
push 0x1571
call fcn.00483f70
push ebx
push ebp
push edi
xor esi, esi
mov ebp, dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
cmp esi, 0x270
jb 0x48437d
call ebp
mov edi, esi
add edi, 1
jo 0x48458d
cmp edi, 0x270
jb 0x484392
call ebp
mov ecx, dword [0x48709c]
mov ebx, esi
mov eax, dword [ecx + esi*4]
mov edi, dword [ecx + edi*4]
xor edi, eax
and edi, 0x7fffffff
xor edi, eax
add ebx, 0x18d
jo 0x48458d
cmp ebx, 0x270
jb 0x4843c0
call ebp
mov ebp, edi
and ebp, 1
cmp ebp, 3
jb 0x4843d0
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
cmp esi, 0x270
jb 0x4843de
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
push 2
push edi
call fcn.00483ee0
mov edx, dword [0x4870bc]
mov ecx, eax
mov eax, dword [0x48709c]
mov edi, dword [edx + ebp*4]
mov edx, dword [eax + ebx*4]
xor ecx, edi
xor ecx, edx
mov dword [eax + esi*4], ecx
add esi, 1
jo 0x48458d
cmp esi, 0xe2
jle 0x48436d
cmp esi, 0x26e
jg 0x4844c9
mov ebp, dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
cmp esi, 0x270
jb 0x484431
call ebp
mov edi, esi
add edi, 1
jo 0x48458d
cmp edi, 0x270
jb 0x484446
call ebp
mov ecx, dword [0x48709c]
mov ebx, esi
mov eax, dword [ecx + esi*4]
mov edi, dword [ecx + edi*4]
xor edi, eax
and edi, 0x7fffffff
xor edi, eax
sub ebx, 0xe3
jo 0x48458d
cmp ebx, 0x270
jb 0x484474
call ebp
mov ebp, edi
and ebp, 1
cmp ebp, 3
jb 0x484484
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
cmp esi, 0x270
jb 0x484492
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
push 2
push edi
call fcn.00483ee0
mov edx, dword [0x4870bc]
mov ecx, eax
mov eax, dword [0x48709c]
mov edi, dword [edx + ebp*4]
mov edx, dword [eax + ebx*4]
xor ecx, edi
xor ecx, edx
mov dword [eax + esi*4], ecx
add esi, 1
jo 0x48458d
cmp esi, 0x26e
jle 0x484421
mov ecx, dword [0x48709c]
mov eax, dword [ecx + 0x9bc]
mov ebx, dword [ecx]
mov esi, eax
xor esi, ebx
and esi, 0x7fffffff
xor esi, eax
mov edi, esi
and edi, 1
cmp edi, 3
jb 0x4844f3
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
push 2
push esi
call fcn.00483ee0
mov edx, dword [0x4870bc]
mov ecx, eax
mov eax, dword [0x48709c]
mov esi, dword [edx + edi*4]
pop edi
mov edx, dword [eax + 0x630]
xor ecx, esi
xor ecx, edx
pop ebp
mov dword [eax + 0x9bc], ecx
xor eax, eax
mov dword [0x4870a8], eax
pop ebx
mov esi, eax
cmp esi, 0x270
jb 0x48453a
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov eax, dword [0x4870a8]
mov ecx, dword [0x48709c]
add eax, 1
push 0x800
mov esi, dword [ecx + esi*4]
jo 0x48458d
push esi
mov dword [0x4870a8], eax
call fcn.00483ee0
xor esi, eax
push 0x80
push esi
call fcn.00483c00
and eax, 0x9d2c5680
push 0x8000
xor esi, eax
push esi
call fcn.00483c00
and eax, 0xefc60000
push 0x40000
xor esi, eax
push esi
call fcn.00483ee0
xor eax, esi
pop esi
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6ad1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006ad140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006ad140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006ad140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006ad140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6adbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6adc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6bf87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6adc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6adc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1000f64a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [0x10067d40], 0x40
mov dword [ebp - 0x48], eax
jae 0x1000f740
push esi
lea esi, [edx + ecx]
add ecx, dword [ebp + 0x10]
push edi
cmp ecx, 0x80000000
lea eax, [ecx + 0x7ff80000]
push 8
mov edx, 0xfff80000
cmovb edx, eax
and dword [ebp - 0x44], ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x48], edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc eax
cmp esi, 0x80000000
lea edi, [esi - 0x7fff0000]
mov esi, dword [ebp - 0x48]
cmovb edi, eax
cmp edi, esi
jae 0x1000f73e
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000f719
cmp dword [ebp - 0x10], 0x10000
jne 0x1000f70d
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x1000f710
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x1000f710
lea eax, [ecx - 1]
add eax, edi
xor edx, edx
div ecx
push 0x20
push 0x3000
push 0x6c
imul eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1000f71d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x1000f6c2
test ebx, ebx
je 0x1000f73e
xor eax, eax
cmp dword [eax*4 + 0x10067ed0], 0
je 0x1000f731
inc eax
cmp eax, 0x40
jb 0x1000f71f
jmp 0x1000f73e
inc dword [0x10067d40]
mov dword [eax*4 + 0x10067ed0], ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1001f816
leave
ret

Function at 0x1000f77e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
push 0
push 0x1f03ff
mov dword [ebp - 0x2d4], edx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f81e
test esi, esi
je 0x1000f81e
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000f815
mov dword [ebp - 0x2d0], 0x10001
xor edi, edi
jmp 0x1000f801
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x218], eax
jb 0x1000f81e
add eax, dword [ebp + 8]
cmp dword [ebp - 0x218], eax
jae 0x1000f81e
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp edi, 3
jge 0x1000f815
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc edi
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1000f7cc
jmp 0x1000f81e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1001f816
leave
ret
Function at 0x1000f82e
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10067d4c], esi
jbe 0x1000f880
mov eax, dword [0x10067d48]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10067d48]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x10067d4c]
jb 0x1000f85b
push dword [0x10067d48]
call fcn.1001f825
and dword [0x10067d48], 0
and dword [0x10067d4c], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
leave
ret
Function at 0x1000fac8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x100405a0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
mov eax, ecx
push esi
mov esi, dword [eax]
push edi
mov edi, edx
mov dword [esp + 0x1c], eax
xor ebx, ebx
call fcn.1000f59d
mov ecx, esi
call fcn.1000f5da
mov esi, eax
mov ecx, edi
mov dword [esp + 0x10], esi
call fcn.1000f5da
push 0x50
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [esp + 0x2c], xmm0
call fcn.10022310
add esp, 0xc
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.1000fa14
mov edi, eax
pop ecx
cmp edi, 5
jb 0x1000fc9b
mov edx, edi
mov ecx, esi
call fcn.1000f8aa
push dword [esp + 0x2c]
mov ecx, esi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.1000f64a
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x1000fc96
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x80], 0
and dword [esp + 0x7c], 0
lea ecx, [esp + 0x80]
push ecx
push 0x40
push edi
push esi
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1000fc7d
lea eax, [esp + 0x7c]
push eax
push 0x40
push 0x6c
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1000fc56
xor ecx, ecx
lea eax, [ebx + 0x2c]
test edi, edi
je 0x1000fbd7
mov edx, eax
sub esi, eax
mov al, byte [esi + edx]
mov byte [edx], al
mov byte [ebx + ecx + 0x4c], al
inc ecx
inc edx
cmp ecx, edi
jb 0x1000fbc1
mov esi, dword [esp + 0x10]
lea eax, [ebx + 0x2c]
lea edx, [edi + esi]
lea ecx, [eax + edi]
call fcn.1000f60b
mov edx, dword [esp + 0x14]
mov ecx, esi
sub ecx, edx
mov eax, edx
sub eax, esi
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1000fc1b
lea esi, [ebx + 0xc]
mov ecx, esi
call fcn.1000f60b
sub eax, ebx
sub eax, 0xc
push eax
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, esi
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.1000f60b
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
push edi
lea eax, [ebx + 0x2c]
push eax
push dword [esp + 0x14]
mov dword [ebx + 4], edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x80]
push 0x6c
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x80]
push eax
push dword [esp + 0x84]
push edi
push esi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [ebx], 0
je 0x1000fc8d
mov ecx, dword [esp + 0x1c]
lea eax, [ebx + 0x2c]
mov dword [ecx], eax
jmp 0x1000fc96
mov ecx, ebx
call fcn.1000f74f
xor ebx, ebx
call fcn.1000f82e
push 0x10067fd0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x84]
pop edi
xor eax, eax
test ebx, ebx
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.1001f816
mov esp, ebp
pop ebp
ret
Function at 0x1000fd0d
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
mov edi, ecx
call fcn.1001a059
and dword [ebp - 0x2d8], 0
test eax, eax
je 0x1000fdfe
lea ecx, [ebp - 0x2d8]
push ecx
mov ecx, eax
call fcn.10019f6d
cmp dword [ebp - 0x2d8], 0
je 0x1000fdfe
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2d4], ax
lea eax, [ebp - 0x2d2]
push eax
call fcn.10022310
add esp, 0xc
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x2d8]
call fcn.1001a12d
lea eax, [ebp - 0x2d4]
push eax
push 0x104
push dword [edi + 4]
call fcn.1001faa7
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call fcn.10022310
add esp, 0x18
push dword [edi + 4]
lea eax, [ebp - 0xcc]
push 0x64
push eax
push 0x10038494
push str.entry
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xcc]
push eax
mov ecx, edi
call fcn.1001003c
push dword [edi + 4]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x2d8]
call fcn.1001f825
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.1001f816
leave
ret 4
Function at 0x100157b6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10067df0]
push esi
xor esi, esi
cmp dword [eax + 0x11f4], esi
mov eax, dword [0x10067e8c]
je 0x100157df
mov eax, dword [eax + 8]
jmp 0x100157e2
mov eax, dword [eax + 0xc]
push eax
call sym.wbcom.dll_WebHost_GetIEServerHWND
push esi
push esi
push eax
push 0x1001837a
push esi
push esi
call fcn.100219a5
add esp, 0x18
mov esi, eax
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 1
mov eax, dword [0x10067df0]
pop esi
jne 0x10015827
mov eax, dword [eax + 0x11f0]
jmp 0x1001582d
mov eax, dword [eax + 0x11ec]
test eax, eax
je 0x10015851
push 0x1001654e
push 0x1388
push 0x3eb
push dword [0x10067d38]
mov dword [0x10067df0], eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f816
leave
ret

Function at 0x10015d15
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10067df0]
push ebx
xor ebx, ebx
cmp dword [eax + 0x11f4], ebx
mov eax, dword [0x10067e8c]
je 0x10015d2f
mov eax, dword [eax + 8]
jmp 0x10015d32
mov eax, dword [eax + 0xc]
push esi
push edi
push eax
call sym.wbcom.dll_WebHost_GetIEServerHWND
push 0x20
mov esi, eax
call fcn.1001f85d
pop ecx
mov ecx, dword [0x10067df0]
add ecx, 0x190
mov edi, eax
push ecx
lea ecx, [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [0x10067df0]
push ebx
push ebx
push edi
push fcn.100199c7
mov dword [edi], esi
mov ecx, dword [ecx + 0x1a0]
push ebx
push ebx
mov dword [edi + 0x1c], ecx
call fcn.100219a5
mov ecx, dword [0x10067df0]
add esp, 0x18
mov eax, dword [ecx + 0x11f0]
pop edi
pop esi
test eax, eax
je 0x10015d99
mov dword [0x10067df0], eax
jmp 0x10015da7
cmp dword [ecx + 0x11ec], ebx
je 0x10015dc2
mov dword [0x10067df0], ebx
push 0x1001654e
push 0x1388
push 0x3eb
push dword [0x10067d38]
call dword [sym.imp.USER32.dll_SetTimer]
pop ebx
ret
Function at 0x10017d92
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], edi
call esi
push 1
mov dword [ebx], eax
call esi
push 0x10038494
push str.Shell_TrayWnd
mov dword [edi], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x10017df8
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
jge 0x10017df0
sub dword [edi], eax
jmp 0x10017df8
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
add dword [ebx], eax
call fcn.1001b736
mov ecx, dword [ebx]
shr ecx, 2
mov edi, eax
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x18]
mov eax, edi
mov ecx, dword [ecx]
shr ecx, 2
mov esi, edx
xor edx, edx
div ecx
mov ecx, dword [ebx]
mov eax, ecx
sub eax, esi
cmp eax, 0x3c0
jbe 0x10017e2e
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
sub dword [eax], edx
jmp 0x10017e33
lea eax, [ecx - 0x11]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f816
leave
ret 8
Function at 0x10018e67
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x10018f18
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10018e85
sub ecx, edx
sar ecx, 1
push ebx
lea eax, [ecx*2 + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x10018f17
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, esi
mov edx, eax
lea eax, [ecx + 2]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10018ebe
sub ecx, dword [ebp - 4]
push esi
sar ecx, 1
lea eax, [ecx + 1]
push eax
push edx
call fcn.1001faa7
add esp, 0xc
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x10018edf
mov eax, dword [ebp - 8]
sub esi, ecx
sar esi, 1
xor ecx, ecx
push ebx
mov word [eax + esi*2], cx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x10018f10
xor edi, edi
inc edi
jmp 0x10018f17
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x10018f24
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
call sym.wbcom.dll_WebHost_GetIEServerHWND
push 8
mov ebx, eax
pop eax
mov word [ebp - 0x24], ax
mov eax, dword [esi]
push 0
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x1c], 0x10038494
lea esi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push str.value
push esi
call dword [eax + 0x1c]
xor edi, edi
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10018fe0
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x10018fd7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10018fd0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 0xc], eax
lea eax, [eax*2 + 2]
push eax
call fcn.1001f85d
mov edi, eax
pop ecx
test edi, edi
je 0x10018fd0
push dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push edi
call fcn.1001faa7
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [ebp - 8]
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10018ff9
mov ecx, dword [ebp - 0x10]
call fcn.10018e67
mov ecx, eax
xor eax, eax
jmp 0x10018ffd
xor eax, eax
mov ecx, eax
test ecx, ecx
je 0x100190a9
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push 0x10033530
push esi
call dword [eax]
test eax, eax
js 0x10019030
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10019030
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc8]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x1d0001
push 0x11
push 0x100
push ebx
call esi
push 0x2f0001
push 0x56
push 0x100
push ebx
call esi
push 0
push 0x1001a
push 0x111
push ebx
call esi
push 0xc02f0001
push 0x56
push 0x101
push ebx
call esi
push 0xc01d0001
push 0x11
push 0x101
push ebx
call esi
test edi, edi
je 0x100190a0
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10019097
mov ecx, edi
call fcn.10018e67
push edi
call fcn.1001f825
pop ecx
jmp 0x100190a6
call dword [sym.imp.USER32.dll_EmptyClipboard]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f816
leave
ret 0xc
Function at 0x10019209
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0x120]
push edi
push eax
call fcn.10022310
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10019264
cmp dword [ebp - 0x11c], 6
jb 0x10019264
push edi
push edi
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
call fcn.10019151
cmp dword [0x10067d3c], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x100192ac
push str.Winmm.dll
call edi
test eax, eax
jne 0x1001929b
push str.Winmm.dll
call esi
test eax, eax
jne 0x1001929b
mov eax, dword [0x10067d3c]
jmp 0x100192a8
push str.waveOutWrite
push eax
call ebx
mov dword [0x10067d3c], eax
test eax, eax
je 0x100192bb
mov edx, method.CWebBrowser.3.virtual_32
mov ecx, 0x10067d3c
call fcn.1000fac8
cmp dword [0x10067eb4], 0
jne 0x100192f2
push str.Winmm.dll
call edi
test eax, eax
jne 0x100192e1
push str.Winmm.dll
call esi
test eax, eax
jne 0x100192e1
mov eax, dword [0x10067eb4]
jmp 0x100192ee
push str.midiStreamOut
push eax
call ebx
mov dword [0x10067eb4], eax
test eax, eax
je 0x10019301
mov edx, method.CWebBrowser.3.virtual_32
mov ecx, 0x10067eb4
call fcn.1000fac8
cmp dword [0x10067eac], 0
jne 0x10019338
push str.DSound.dll
call edi
test eax, eax
jne 0x10019327
push str.DSound.dll
call esi
test eax, eax
jne 0x10019327
mov eax, dword [0x10067eac]
jmp 0x10019334
push str.DirectSoundCreate
push eax
call ebx
mov dword [0x10067eac], eax
test eax, eax
je 0x10019347
mov edx, method.CWebBrowser.3.virtual_32
mov ecx, 0x10067eac
call fcn.1000fac8
cmp dword [0x10067e9c], 0
jne 0x1001937e
push str.DSound.dll
call edi
test eax, eax
jne 0x1001936d
push str.DSound.dll
call esi
test eax, eax
jne 0x1001936d
mov eax, dword [0x10067e9c]
jmp 0x1001937a
push str.DirectSoundCreate8
push eax
call ebx
mov dword [0x10067e9c], eax
test eax, eax
je 0x1001938d
mov edx, method.CWebBrowser.3.virtual_32
mov ecx, 0x10067e9c
call fcn.1000fac8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f816
leave
ret

Function at 0x10019959
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 5
xor ecx, ecx
mov word [ebp - 0x16], cx
pop ecx
xor edx, edx
mov word [ebp - 0x18], cx
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push edx
push edx
push 0x200
push edx
push edx
push edx
push eax
push edx
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], 0x10038494
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.1001f816
leave
ret 0x10