joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee8b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4eeb17
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4ee91a
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004ee380
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d38c
cmp al, 1
jne 0x4ee91a
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004ee698
test al, al
je 0x4eeaa6
cmp dword [ebp - 8], 0
jge 0x4ee938
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004ee380
mov eax, dword [ebp - 0x210]
call fcn.00404188
cmp ebx, eax
jge 0x4ee982
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004ee380
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x767cb8]
and eax, 0xff
bt dword [edx], eax
jae 0x4ee982
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0x4ee996
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ee894
cmp ebx, dword [ebp - 8]
je 0x4eea98
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4ee9c2
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.0040336c
and eax, 0x7f
movzx eax, word [eax*2 + 0x734b58]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0x4eea85
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.0040336c
and eax, 0x7f
movzx eax, word [eax*2 + 0x734b58]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0043d5f0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.0040336c
and eax, 0x7f
movzx eax, word [eax*2 + 0x734b58]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0043d5f0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eea8c
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0x4eeaf9
cmp dword [ebp - 8], 0
jge 0x4eeab1
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004ee380
mov eax, dword [ebp - 0x218]
call fcn.00404188
cmp eax, dword [ebp - 8]
jg 0x4eeaeb
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004ee380
mov eax, dword [ebp - 0x21c]
call fcn.00404188
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ee894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eeb1e
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403f1c
ret
Function at 0x4fc1a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040433c
xor eax, eax
push ebp
push 0x4fc29e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x410b84]
call fcn.00414760
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4fc281
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 4]
cmp word [ebp - 0xe], 0x5a4d
je 0x4fc20c
call fcn.004039c8
jmp 0x4fc288
xor ecx, ecx
mov edx, 0x3c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 4]
movzx edx, word [ebp - 0xe]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 4]
cmp word [ebp - 0xe], 0x4550
je 0x4fc25d
cmp word [ebp - 0xe], 0x454e
je 0x4fc25d
xor eax, eax
jmp 0x4fc25f
mov al, 1
mov byte [ebp - 5], al
cmp word [ebp - 0xe], 0x4550
sete byte [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc288
mov eax, dword [ebp - 0xc]
call fcn.00403170
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc2a5
lea eax, [ebp - 4]
call fcn.00403ef8
ret

Function at 0x4ff534
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040433c
xor eax, eax
push ebp
push 0x4ff62e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x410b84]
call fcn.00414760
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ff611
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 4]
cmp word [ebp - 0xe], 0x5a4d
je 0x4ff59c
call fcn.004039c8
jmp 0x4ff618
xor ecx, ecx
mov edx, 0x3c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 4]
movzx edx, word [ebp - 0xe]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 4]
cmp word [ebp - 0xe], 0x4550
je 0x4ff5ed
cmp word [ebp - 0xe], 0x454e
je 0x4ff5ed
xor eax, eax
jmp 0x4ff5ef
mov al, 1
mov byte [ebp - 5], al
cmp word [ebp - 0xe], 0x4550
sete byte [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff618
mov eax, dword [ebp - 0xc]
call fcn.00403170
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff635
lea eax, [ebp - 4]
call fcn.00403ef8
ret
Function at 0x51d950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00466d90
cmp eax, 5
jl 0x51d97c
mov eax, ebx
call fcn.004098c8
test al, al
je 0x51d97c
mov eax, ebx
call fcn.0040434c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x51d980
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x524bc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x524c24
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404138
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409778
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524c2b
lea eax, [ebp - 0xc]
call fcn.00403ef8
ret

Function at 0x524c7c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x524cd8
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x524ca7
call fcn.0052357c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402a0c
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x524cd8
call fcn.0052357c
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x5672a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040433c
xor eax, eax
push ebp
push 0x567363
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005671e0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00403f90
mov eax, dword [ebp - 4]
call fcn.00404188
mov esi, eax
cmp esi, 7
jge 0x567301
mov dword [ebp - 8], 0xb
jmp 0x567345
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404188
dec eax
sub eax, 2
jl 0x567325
inc eax
mov edx, 2
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
xor ebx, ecx
inc edx
dec eax
jne 0x567317
mov eax, ebx
mov ecx, 0x1e
cdq
idiv ecx
inc edx
mov eax, 0x56737c
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 4]
cmp al, byte [edx + esi - 1]
je 0x567345
inc dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56736a
lea eax, [ebp - 0xc]
call fcn.00403ef8
lea eax, [ebp - 4]
call fcn.00403ef8
ret

Function at 0x56739c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040433c
mov eax, dword [ebp - 8]
call fcn.0040433c
xor eax, eax
push ebp
push 0x5674d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005671e0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00403f90
mov eax, dword [ebp - 4]
call fcn.00404188
cmp eax, 7
jge 0x5673fb
mov esi, 0xb
jmp 0x5674bc
cmp dword [ebp - 8], 0
je 0x5674bc
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00404188
dec eax
test eax, eax
jle 0x567427
mov edx, 1
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + edx - 1]
add ebx, ecx
inc edx
dec eax
jne 0x567419
mov eax, ebx
mov ecx, 0x1e
cdq
idiv ecx
inc edx
mov eax, 0x5674f0
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 1]
je 0x567444
inc esi
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004092e4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx]
call fcn.004040a0
mov eax, dword [ebp - 0x14]
mov edx, 0x5674f0
call fcn.00404474
test eax, eax
jle 0x56747e
lea eax, [ebp - 4]
call fcn.00404358
mov edx, dword [ebp - 0xc]
mov dl, byte [edx]
mov byte [eax], dl
jmp 0x5674bc
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00404188
dec eax
test eax, eax
jle 0x5674a0
mov edx, 1
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + edx - 1]
xor ebx, ecx
inc edx
dec eax
jne 0x567492
mov eax, ebx
mov ecx, 0x1e
cdq
idiv ecx
inc edx
mov eax, 0x5674f0
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 4]
cmp al, byte [edx]
je 0x5674bc
inc esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5674de
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403f1c
ret
Function at 0x56b46c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00466d90
cmp eax, 5
jl 0x56b498
mov eax, ebx
call fcn.004098c8
test al, al
je 0x56b498
mov eax, ebx
call fcn.0040434c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x56b49c
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x573430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x50], 0
je 0x5734aa
mov eax, dword [ebp + 8]
and eax, 0xffffffff
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
shrd eax, edx, 0x10
shr edx, 0x10
shrd eax, edx, 0x10
shr edx, 0x10
mov dword [ebp - 4], eax
push 0
push 0
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
cmp dword [ebx + 0x4c], 0
je 0x5734aa
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x57349c
lea eax, [ebp - 0xc]
push eax
push 0x64
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
test eax, eax
je 0x5734aa
cmp eax, 0x40268
je 0x5734aa
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0x2710
jb 0x573482
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x575b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x575bcb
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x575c4c
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.00573f04
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x575c19
mov cx, word [ebp - 4]
sub cx, si
jmp 0x575c1b
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x575c02
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x575c41
mov cx, word [ebp - 4]
sub cx, si
jmp 0x575c43
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x575c2a
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x575cae
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.00575854
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x575c99
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x575cae
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x575b9f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x57ab10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x738f00
test edx, edx
jne 0x57ab2f
xor eax, eax
jmp 0x57ac4d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x57ab4c
push esi
push edx
push eax
call fcn.0057ac54
add esp, 0xc
jmp 0x57ac4d
push esi
push edx
push eax
call fcn.0057af14
add esp, 0xc
jmp 0x57ac4d
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x584014
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x584044
mov eax, ebx
call fcn.00584b38
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x58403d
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x5840bc
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x5840ae
mov edx, dword [ebx + 8]
test edx, edx
je 0x58406a
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x58407c
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5840ae
mov edx, dword [ebx + 8]
test edx, edx
je 0x58405c
cmp eax, 3
je 0x584090
dec eax
jne 0x58405c
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x58405c
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x58405c
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x5840dc
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x5840dc
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005840e8
pop ebx
ret
Function at 0x5acf9c
Capabilities:
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov edi, dword [ebx + 0x234]
sub edi, dword [ebx + 0x230]
test edi, edi
jle 0x5ad0e2
call fcn.0069c0f8
test al, al
je 0x5ad0e2
call sub.user32.dll_EmptyClipboard
mov eax, edi
add eax, eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [esp], eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov esi, dword [ebx + 0x230]
xor eax, eax
jmp 0x5ad010
mov ecx, dword [ebx + 0x1f8]
mov cl, byte [ecx + esi]
mov byte [edx + eax], cl
cmp byte [edx + eax], 0xa
jne 0x5ad00e
mov byte [edx + eax], 0xd
mov byte [edx + eax + 1], 0xa
inc eax
inc eax
inc esi
cmp esi, dword [ebx + 0x234]
jl 0x5acff2
mov byte [edx + eax], 0
mov eax, dword [esp]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [esp]
push eax
push 1
call sub.user32.dll_SetClipboardData
lea eax, [edi + 1]
imul edx, edi, 0x118
add eax, edx
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [esp], eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1f8]
mov edx, dword [ebx + 0x230]
add eax, edx
mov edx, dword [esp + 4]
mov ecx, edi
call fcn.00402a0c
mov eax, dword [esp + 4]
mov byte [eax + edi], 0
mov esi, dword [ebx + 0x230]
mov ebp, dword [ebx + 0x234]
dec ebp
sub ebp, esi
jl 0x5ad0c5
inc ebp
mov eax, dword [ebx + 0x26c]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx + 0x268]
call fcn.004120b8
lea edx, [edi + 1]
mov ecx, esi
sub ecx, dword [ebx + 0x230]
imul ecx, ecx, 0x118
add edx, ecx
mov ecx, dword [esp + 4]
lea edx, [ecx + edx]
mov ecx, 0x118
call fcn.00402a0c
inc esi
dec ebp
jne 0x5ad089
mov eax, dword [esp]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [esp]
push eax
mov eax, dword [0x7697d0]
push eax
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ad0ec
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, eax
call fcn.0069c0f8
test al, al
je 0x5ad1b3
mov eax, dword [0x7697d0]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5ad172
mov eax, dword [0x7697d0]
push eax
call sub.user32.dll_GetClipboardData
mov ebp, eax
test ebp, ebp
je 0x5ad1ae
push ebp
call sub.kernel32.dll_GlobalLock
mov ebx, eax
mov eax, ebx
call fcn.00409e50
mov dword [esp], eax
xor esi, esi
jmp 0x5ad164
mov eax, dword [esp]
inc eax
imul edx, esi, 0x118
add eax, edx
lea eax, [ebx + eax]
mov edx, dword [edi + 0x240]
mov ecx, 0x118
call fcn.00402a0c
mov dl, byte [ebx + esi]
mov eax, edi
call fcn.005aa260
inc esi
cmp byte [ebx + esi], 0
jne 0x5ad13a
push ebp
call sub.kernel32.dll_GlobalUnlock
jmp 0x5ad1ae
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5ad1ae
push 1
call sub.user32.dll_GetClipboardData
mov ebp, eax
test ebp, ebp
je 0x5ad1ae
push ebp
call sub.kernel32.dll_GlobalLock
mov ebx, eax
jmp 0x5ad1a2
cmp al, 0xd
je 0x5ad1a1
mov edx, eax
mov eax, edi
call fcn.005aa260
inc ebx
mov al, byte [ebx]
test al, al
jne 0x5ad194
push ebp
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c4690
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 8], 3
je 0x5c4826
mov ecx, dword [edx]
xor ebx, ebx
mov dword [ebp - 4], ecx
xor esi, esi
test byte [edx + 8], 2
je 0x5c46e9
movzx edi, byte [eax]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
movzx edi, byte [eax + 1]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
xor ecx, ecx
movzx edi, byte [eax + 2]
inc ebx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
jmp 0x5c46f9
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 3]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
test byte [edx + 8], 4
je 0x5c470f
xor ecx, ecx
mov cl, byte [edx + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
lea eax, [ebp - 0x20]
cmp ebx, ecx
jle 0x5c472f
cmp dword [eax], 0
jg 0x5c4723
xor edi, edi
mov dword [eax], edi
jmp 0x5c4727
mov si, 1
inc ecx
add eax, 4
cmp ebx, ecx
jg 0x5c4718
test si, si
je 0x5c4826
mov al, byte [edx + 9]
sub al, 2
je 0x5c4754
sub al, 2
je 0x5c4774
sub al, 4
je 0x5c47af
sub al, 8
je 0x5c47d6
jmp 0x5c4826
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jbe 0x5c4826
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x5c4764
jmp 0x5c4826
mov esi, dword [ebp - 0x20]
mov ebx, 0xf0
mov ecx, esi
mov edx, dword [edx + 4]
sar ebx, cl
mov ecx, esi
mov esi, 0xf
sar esi, cl
mov ecx, esi
and bl, 0xf0
or bl, cl
xor esi, esi
cmp edx, esi
mov eax, dword [ebp + 0xc]
jbe 0x5c4826
mov ecx, dword [ebp - 0x20]
inc esi
shr byte [eax], cl
and byte [eax], bl
inc eax
cmp edx, esi
ja 0x5c47a0
jmp 0x5c4826
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
imul ebx
mov dword [ebp - 8], eax
xor esi, esi
cmp esi, dword [ebp - 8]
jae 0x5c4826
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr byte [edi], cl
inc edi
inc esi
cmp esi, dword [ebp - 8]
jb 0x5c47c1
jmp 0x5c4826
mov edi, dword [ebp + 0xc]
mov eax, ebx
imul dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0x5c4826
movzx esi, byte [edi]
shl esi, 8
xor eax, eax
mov al, byte [edi + 1]
xor edx, edx
add si, ax
mov eax, dword [ebp - 0xc]
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr si, cl
movzx eax, si
sar eax, 8
mov edx, esi
mov byte [edi], al
inc edi
and dl, 0xff
mov byte [edi], dl
inc edi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jb 0x5c47ee
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e6ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov edx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
mov ecx, dword [edx]
mov eax, ecx
movzx eax, word [eax]
cmp eax, esi
jbe 0x5e6ef7
mov eax, ecx
movzx esi, word [eax + 2]
xor esi, 1
mov eax, dword [eax + 8]
mov dword [edx], eax
jmp 0x5e6f05
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
movzx esi, word [eax + 2]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov edx, dword [ebx + 8]
test edx, edx
jne 0x5e6fd4
mov ecx, dword [ebx + 0x20]
test ecx, ecx
jne 0x5e6fc7
mov eax, dword [ebx + 0x18]
test byte [eax + 8], 7
jne 0x5e6f74
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x5e6f47
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x5e6f47
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x5e6f77
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x5e6f60
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.005edf48
mov edi, eax
jmp 0x5e6f77
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x5e6f77
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x5e6f88
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x5e6fb9
cmp edi, 0x8f
jle 0x5e6fab
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x5e6fd4
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x5e6fd4
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x5e6fd4
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x5e6f05
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret