joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a5bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x52e564]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x47a662
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x47a601
cmp eax, dword [esp]
pop edx
pop eax
jae 0x47a63d
jmp 0x47a605
pop edx
pop eax
jge 0x47a63d
mov eax, dword [0x52e564]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00474fd8
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x47a662
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x47a662
cmp dword [ebx + 0x11c], 0
je 0x47a662
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.004370fc
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x48151c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4815d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405928
mov eax, dword [0x52e1bc]
cmp byte [eax], 0
je 0x48158b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405c8c
mov eax, dword [ebx]
call fcn.00405ab8
push eax
mov eax, dword [ebx]
call fcn.00405aa8
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405ab8
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405c8c
jmp 0x4815bd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a4e4
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405a98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4815dd
lea eax, [ebp - 0x3f0]
call fcn.00405120
ret

Function at 0x484744
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48479e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x310], ecx
mov dword [esi + 0x314], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x304], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x310]
mov eax, esi
call fcn.004847a8
mov eax, dword [esi + 0x310]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4847a5
ret
Function at 0x4994af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x499509
mov eax, ebx
add eax, dword [eax + 0x3c]
mov edi, dword [eax + 0x78]
add edi, ebx
xor esi, esi
jmp 0x499504
mov eax, dword [edi + 0x20]
lea edx, [ebx + eax]
mov eax, dword [edx + esi*4]
add eax, ebx
push dword [ebp + 0xc]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x499503
mov edx, dword [edi + 0x24]
lea ecx, [ebx + edx]
mov ax, word [ecx + esi*2]
movzx edx, ax
mov ecx, dword [edi + 0x1c]
lea eax, [ebx + ecx]
mov eax, dword [eax + edx*4]
add eax, ebx
mov dword [ebp - 4], eax
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4994d0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49a590
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004038dc
ret
Function at 0x49a97c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x49abf3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x49ac08
call fcn.0049a7e4
lea eax, [ebp - 0x3f0]
call fcn.00405120
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004055b0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x49abb4
xor eax, eax
push ebp
push 0x49abad
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x49ac48
call fcn.0049a7e4
mov eax, dword [ebp - 0x408]
call fcn.004055b0
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49aa7f
push ebp
mov eax, 0x49ac74
call fcn.0049a8d4
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x40c]
mov eax, 0x49ac80
call fcn.0049a7e4
mov eax, dword [ebp - 0x40c]
call fcn.004055b0
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49ab09
push dword [ebp - 0x3f0]
push 0x49aca8
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405390
push dword [ebp - 0x410]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004054b4
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x414]
mov eax, 0x49acb4
call fcn.0049a7e4
mov eax, dword [ebp - 0x414]
call fcn.004055b0
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49ab93
push dword [ebp - 0x3f0]
push 0x49aca8
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405390
push dword [ebp - 0x418]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004054b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49abb4
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.00405174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49abfa
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.00405144
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.00405144
ret
Function at 0x49e9e4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055a0
xor eax, eax
push ebp
push 0x49eb1f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x49eaef
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004055b0
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.00409f34
test al, al
jne 0x49ea5f
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403674
lea eax, [ebp - 0x1d0]
call fcn.00403410
call fcn.0040304c
push dword [0x533e68]
push 0x49eb38
push dword [0x533e6c]
push 0x49eb38
push dword [0x533e70]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004054b4
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.0049f868
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.004058d0
call fcn.00403d30
call fcn.0040304c
lea eax, [ebp - 0x1d0]
call fcn.0040373c
call fcn.0040304c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eaf9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eb26
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405144
lea eax, [ebp - 4]
call fcn.00405120
ret
Function at 0x49f3d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055a0
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x49f540
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0049ee58
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.0049ee78
mov ebx, eax
jmp 0x49f512
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405390
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a158
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004093e4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004093e4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405548
je 0x49f4f2
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405390
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004093e4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004093e4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405548
jne 0x49f507
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.0049ee98
mov ebx, eax
test ebx, ebx
jne 0x49f453
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f547
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405144
lea eax, [ebp - 4]
call fcn.00405120
ret
Function at 0x49fd6c
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x49fe28
call fcn.00409f58
test al, al
jne 0x49fd84
mov eax, 0x49fe28
call fcn.0040a288
mov eax, dword [0x533ee0]
mov edx, 0x49fe40
call fcn.00405548
jne 0x49fe1f
mov eax, 0x533f28
mov ecx, dword [0x533f3c]
mov edx, dword [0x533f38]
call fcn.00405438
mov edx, dword [0x533f28]
mov eax, dword [0x533f00]
call fcn.0049fac4
mov eax, dword [0x533ee0]
mov edx, 0x49fe40
call fcn.00405548
jne 0x49fe1f
mov eax, dword [0x52e304]
mov eax, dword [eax]
mov edx, 0x49fe4c
call fcn.00405548
jne 0x49fded
mov eax, dword [0x533edc]
call fcn.00461328
mov eax, dword [0x533f28]
call fcn.00409f34
test al, al
je 0x49fe1f
push 5
mov eax, dword [0x533f28]
call fcn.004055b0
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x533edc]
mov eax, dword [eax + 0x360]
mov dl, 1
call fcn.004370fc
ret
Function at 0x1ffb21a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb0
push ebx
push esi
mov esi, dword [esp + 0xc4]
push edi
push ebp
mov edi, 0
test esi, esi
je 0x1ffb21c3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov eax, 1
test edi, edi
je 0x1ffb2343
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x10], edi
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0xd8]
and eax, 1
mov dword [esp + 0x14], eax
je 0x1ffb2231
mov ebx, dword [esp + 0xc4]
push 2
lea eax, [esp + 0x70]
push eax
push ebx
call dword [ebx + 4]
add esp, 0xc
cmp eax, 2
je 0x1ffb2210
mov eax, 0xfffffffb
jmp 0x1ffb226f
lea eax, [esp + 0x10]
push 4
push eax
push ebx
call dword [ebx + 4]
add esp, 0xc
cmp eax, 4
je 0x1ffb222a
mov eax, 0xfffffffb
jmp 0x1ffb226f
mov eax, 1
jmp 0x1ffb226f
mov eax, dword [esp + 0xc8]
lea ecx, [esp + 0x18]
push eax
push str._s_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x24]
mov ebx, dword [esp + 0xd0]
add esp, 0xc
mov ebp, eax
push ebp
push ecx
push ebx
call dword [ebx + 4]
add esp, 0xc
sub eax, ebp
cmp eax, 1
sbb eax, eax
and eax, 6
sub eax, 5
cmp eax, 1
jne 0x1ffb2343
cmp dword [esp + 0x14], 0
jne 0x1ffb22d0
lea eax, [esp + 0x18]
push edi
mov dword [esp + 0x14], edi
push 0x1ffe5274
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x78]
add esp, 0xc
push eax
push str._s_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x78]
add esp, 0xc
mov ebp, eax
push ebp
push ecx
push ebx
call dword [ebx + 4]
add esp, 0xc
sub eax, ebp
cmp eax, 1
sbb eax, eax
and eax, 6
sub eax, 5
cmp eax, 1
jne 0x1ffb2343
cmp dword [esp + 0xd0], 0
je 0x1ffb22fa
mov edx, edi
mov ebp, esi
mov cl, 0x55
test edi, edi
je 0x1ffb22fa
test esi, esi
je 0x1ffb22fa
test edi, edi
je 0x1ffb22fa
mov al, byte [ebp]
inc ebp
xor al, cl
dec edx
mov cl, al
mov byte [ebp - 1], al
jne 0x1ffb22ec
cmp dword [esp + 0x14], 0
push edi
push esi
push ebx
je 0x1ffb2319
call dword [ebx + 4]
add esp, 0xc
sub eax, edi
cmp eax, 1
sbb eax, eax
and eax, 6
sub eax, 5
jmp 0x1ffb231e
call fcn.1ffb2050
cmp dword [esp + 0xd0], 0
je 0x1ffb2343
mov cl, 0x55
test edi, edi
je 0x1ffb2343
test esi, esi
je 0x1ffb2343
test edi, edi
je 0x1ffb2343
mov dl, byte [esi]
inc esi
xor cl, dl
dec edi
mov byte [esi - 1], cl
mov cl, dl
jne 0x1ffb2336
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xb0
ret 0x18
Function at 0x1ffb8780
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov cl, 0x55
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x1ffb8796
mov eax, 1
pop esi
pop ebx
ret 8
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x1ffb87a8
mov eax, 0xfffffff3
pop esi
pop ebx
ret 8
test esi, esi
je 0x1ffb87bb
mov dl, byte [eax]
inc eax
mov bl, dl
xor bl, cl
mov cl, dl
dec esi
mov byte [eax - 1], bl
jne 0x1ffb87ac
mov eax, 1
pop esi
pop ebx
ret 8

Function at 0x1ffb8fd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
test byte [esi + 0x20], 1
jne 0x1ffb8ff0
mov eax, 0xfffffffe
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 4
mov eax, dword [esi + 0x14]
push eax
call sub.LTKRN13N.dll_Ordinal_282
mov ebx, eax
test ebx, ebx
jne 0x1ffb900e
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 4
push esi
call sub.LTKRN13N.dll_Ordinal_173
mov edi, dword [esi + 0xc]
mov dword [esp + 0x10], eax
dec edi
js 0x1ffb905a
mov eax, dword [esi + 0x14]
mov ebp, ebx
push eax
push edi
push ebx
push esi
call sub.LTKRN13N.dll_Ordinal_129
mov edx, dword [esi + 0x14]
mov al, 0x55
test edx, edx
je 0x1ffb904b
test ebx, ebx
je 0x1ffb904b
test edx, edx
je 0x1ffb904b
mov cl, byte [ebp]
inc ebp
xor cl, al
dec edx
mov al, cl
mov byte [ebp - 1], cl
jne 0x1ffb903d
mov eax, dword [esi + 0x14]
push eax
push edi
push ebx
push esi
call sub.LTKRN13N.dll_Ordinal_137
dec edi
jns 0x1ffb901e
mov eax, dword [esp + 0x10]
push eax
push esi
call sub.LTKRN13N.dll_Ordinal_156
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 4

Function at 0x1ffb9080
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push ebp
test byte [esi + 0x20], 1
jne 0x1ffb90a0
mov eax, 0xfffffffe
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 0x14]
push eax
call sub.LTKRN13N.dll_Ordinal_282
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1ffb90c0
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 4
push esi
call sub.LTKRN13N.dll_Ordinal_173
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], eax
dec edi
js 0x1ffb9118
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push edi
push ecx
push esi
call sub.LTKRN13N.dll_Ordinal_129
mov ebx, dword [esi + 0x14]
mov ebp, dword [esp + 0x10]
mov al, 0x55
test ebx, ebx
je 0x1ffb9105
test ebp, ebp
je 0x1ffb9105
test ebx, ebx
je 0x1ffb9105
mov cl, byte [ebp]
inc ebp
mov dl, cl
xor dl, al
mov al, cl
dec ebx
mov byte [ebp - 1], dl
jne 0x1ffb90f5
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push edi
push ecx
push esi
call sub.LTKRN13N.dll_Ordinal_137
dec edi
jns 0x1ffb90d0
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.LTKRN13N.dll_Ordinal_156
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x1ffba0a0
Capabilities:
Check if file exists

Disassembly:
push esi
push edi
push 0
call sub.LTKRN13N.dll_Ordinal_196
test eax, eax
je 0x1ffba0b7
mov eax, 0xffffff71
pop edi
pop esi
ret 0x14
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x1ffba0c9
mov eax, 0xfffffff3
pop edi
pop esi
ret 0x14
push pe_nt_image_headers32
push 0x8002
push edi
call sub.LTKRN13N.dll_Ordinal_189
mov esi, eax
test esi, esi
jge 0x1ffba10a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1ffba10a
push pe_nt_image_headers32
push 0x8302
push edi
call sub.LTKRN13N.dll_Ordinal_189
mov esi, eax
test esi, esi
jge 0x1ffba10a
mov eax, 0xfffffff2
pop edi
pop esi
ret 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push 0
push 0
push esi
call sym.LTANN13N.dll_L_AnnSaveOffset
mov edi, eax
push esi
call sub.LTKRN13N.dll_Ordinal_188
mov eax, edi
pop edi
pop esi
ret 0x14
Function at 0x1ffba6b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x48
push ebx
push esi
push edi
push ebp
push 0
call sub.LTKRN13N.dll_Ordinal_196
test eax, eax
je 0x1ffba6d1
mov eax, 0xffffff71
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret 8
mov esi, dword [esp + 0x60]
test esi, esi
jne 0x1ffba6e8
mov eax, 0xfffffff3
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret 8
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1ffba703
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret 8
mov eax, dword [0x1ffe7e34]
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x1ffba72f
mov eax, dword [0x1ffe7cac]
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x1ffba737
mov eax, dword [0x1ffe7cb0]
push eax
call edi
mov ebx, eax
test ebx, ebx
je 0x1ffba878
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebp, eax
push 0
call sub.LTKRN13N.dll_Ordinal_196
test eax, eax
je 0x1ffba75e
mov edi, 0xffffff71
jmp 0x1ffba86f
mov ax, word [edi]
cmp ax, 0x4949
je 0x1ffba845
cmp ax, 0x4d4d
je 0x1ffba845
test esi, esi
jne 0x1ffba783
mov edi, 0xfffffff3
jmp 0x1ffba86f
test edi, edi
jne 0x1ffba791
mov edi, 0xfffffff3
jmp 0x1ffba86f
mov dword [esp + 0x14], 0x1ffae7e0
mov dword [esp + 0x18], 0x1ffae830
mov dword [esp + 0x1c], 0x1ffae8f0
mov dword [esp + 0x24], edi
push 0x1ffe5010
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
xor ebp, ebp
mov dword [esp + 0x34], ebp
push ebp
mov dword [esp + 0x28], ebp
call fcn.1ffd6fc0
add esp, 8
push 1
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push ebp
lea ecx, [esp + 0x28]
push ebp
push ebp
push ebp
push ebp
push eax
push ecx
call fcn.1ffb2c30
mov edi, eax
push 0x1ffe3624
push ebp
call fcn.1ffd6fc0
add esp, 8
cmp edi, 1
jne 0x1ffba86f
cmp dword [esp + 0x10], 0
je 0x1ffba838
mov eax, dword [esp + 0x10]
push 0
push eax
call fcn.1ff9b150
cmp dword [esp + 0x10], 0
je 0x1ffba82b
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
mov edi, 1
call ebp
mov dword [esi], eax
jmp 0x1ffba86f
mov edi, 1
mov dword [esi], 0
jmp 0x1ffba86f
mov edi, 1
mov dword [esi], 0
jmp 0x1ffba86f
lea eax, [esp + 0x14]
push ebp
push edi
push eax
call sub.LTFIL13N.DLL_Ordinal_176
push 0
push esi
push str.DUMMY
call sym.LTANN13N.dll_L_AnnLoad
push eax
mov edi, eax
lea eax, [esp + 0x18]
push 0
push 0
push eax
call sub.LTFIL13N.DLL_Ordinal_177
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1ffba87d
mov edi, 0xfffffff0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret 8
Function at 0x1ffc1ac0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
sub esp, 0x28
xor eax, eax
mov ecx, 7
push ebx
push esi
push edi
lea edi, [esp + 0x18]
push ebp
rep stosd dword es:[edi], eax
push eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x130b
mov eax, dword [esp + 0x48]
push 0x669f
push eax
call esi
push eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
call edi
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x1ffc1ca3
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
push eax
mov dword [esp + 0x20], 8
push ecx
push 0x1305
push 0x669f
push edx
call esi
push eax
call edi
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x18], 0
mov eax, dword [ecx]
cmp dword [eax + 0xf38], 0
mov edi, dword [eax + 0xf3c]
jbe 0x1ffc1ca3
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x18], eax
jne 0x1ffc1c7a
mov ecx, dword [edi + 0x10]
mov eax, dword [esp + 0x40]
push 5
mov dword [eax + 8], ecx
mov ecx, dword [edi + 0x10]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x65f4
mov ecx, dword [edi + 0x10]
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [esp + 0x3c]
push eax
push 0x65f4
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ebp, dword [edi + 0x10]
push 2
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [esp + 0x10], eax
push 0x65f4
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, dword [esp + 0x10]
jl 0x1ffc1bcf
push 0x65f4
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [esp + 0x10], eax
push 1
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, dword [esp + 0x10]
jl 0x1ffc1bf1
push 1
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
inc eax
push eax
call sub.LTKRN13N.dll_Ordinal_282
mov ebx, eax
test ebx, ebx
je 0x1ffc1c86
mov eax, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 0x3c]
push ebx
push 1
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esp + 0x10]
inc eax
push eax
push ebx
push 2
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 0x3c]
push ebx
push 2
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esp + 0x10]
inc eax
push eax
push ebx
push 0x65f4
push ebp
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 0x3c]
push ebx
push 0x65f4
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x1ffc1c86
push 0
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
add edi, 0x14
mov eax, dword [esp + 0x40]
inc dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [ecx + 0xf38], edx
ja 0x1ffc1b4a
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret