joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43530d
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x49bd20
call fcn.00435564
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x43534d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43534d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x435365
cmp eax, 0x20b
je 0x435352
mov dword [ebp - 0x1c], ebx
jmp 0x435379
cmp dword [ecx + 0x84], 0xe
jbe 0x43534d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x435373
cmp dword [ecx + 0x74], 0xe
jbe 0x43534d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4b4030], 0xffffffff
or dword [0x4b4034], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4b4028]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x4b4024]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4b402c], eax
call fcn.004355c2
call fcn.00435662
cmp dword [0x4b2854], ebx
jne 0x4353d9
push fcn.00435662
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00435650
push 0x4b22fc
push 0x4b22f8
call sub.MSVCR71.dll__initterm
push 0x435606
call fcn.004351bc
mov eax, dword [0x4b4020]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4b401c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x43542d
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4b22f4
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4354ab
cmp al, bl
je 0x435457
cmp dword [ebp - 0x20], ebx
jne 0x4354ab
mov al, byte [esi]
cmp al, bl
je 0x435467
cmp al, 0x20
ja 0x435467
inc esi
mov dword [ebp - 0x24], esi
jmp 0x435457
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x435483
movzx eax, word [ebp - 0x54]
jmp 0x435486
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00435780
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4354a3
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x435500
cmp al, 0x22
jne 0x4354ba
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x4354cd
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x435445
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0043559f
ret
Function at 0x435780
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
lea ecx, [esp + 4]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::constructor_void_]
mov eax, dword [sym.imp.QtCore4.dll_enum_QSysInfo::WinVersion_const_QSysInfo::WindowsVersion]
test byte [eax], 0xf
jne 0x4357dc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xc]
push ecx
push 0xffffffffffffffff
push eax
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromUtf16_unsigned_short_int_const___int_]
add esp, 0xc
mov ecx, eax
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QString::toLocal8Bit_void_]
push eax
lea ecx, [esp + 8]
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray____thiscall_QByteArray::operator_class_QByteArray_const__]
lea ecx, [esp + 0xc]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
jmp 0x4357ed
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 8]
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray____thiscall_QByteArray::operator_char_const__]
push 0x30
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_void____cdecl_qMalloc_unsigned_int_]
mov dword [esp + 4], eax
mov dword [eax], 1
mov ecx, dword [esp + 4]
mov eax, 8
mov dword [ecx + 8], eax
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
mov eax, dword [esp + 4]
or dword [eax + 0xc], 1
mov eax, dword [esp + 4]
push 0x20
add eax, 0x10
push 0
push eax
call dword [sym.imp.QtCore4.dll_void____cdecl_qMemSet_void___int__unsigned_int_]
mov eax, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.QtCore4.dll_public:_char____thiscall_QByteArray::data_void_]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call sub.QtCore4.dll_void___cdecl_qWinMain_struct_HINSTANCE_____struct_HINSTANCE_____char___int__int___class_QVector_char____
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
add esp, 0x18
cmp ecx, 1
je 0x435881
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
push ecx
push edx
lea ecx, [esp + 8]
call fcn.004356e0
mov eax, dword [esp]
add eax, 0x10
push esi
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.0040e740
mov esi, eax
mov eax, dword [esp + 0xc]
add esp, 8
test eax, eax
je 0x4358b4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4358b4
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
lea ecx, [esp + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov eax, esi
pop esi
add esp, 0x14
ret 0x10
Function at 0x10001010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1006d600]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x31b0da04
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
sub eax, 0x31b0da04
je 0x1000105f
jmp 0x10001047
mov eax, dword [ebp - 0x18]
sub eax, 0x5a0465e1
je 0x1000108f
jmp 0x1000105a
jmp 0x1000109f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor ecx, ecx
xor edi, edi
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
not byte [edi]
xor eax, eax
xor eax, 0x55
sub byte [edi], 0x63
add byte [edi], 0x55
nop
nop
imul byte [edi]
inc edi
loop 0x1000106f
mov dword [ebp - 0x10], 0x5a0465e1
jmp 0x1000109f
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000ef70
add esp, 0x14
pop edi
pop ebp
ret
jmp 0x10001031
Function at 0x10012875
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100128b4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100128b4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100128b4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100128b4
cmp dword [ecx + 0x74], 0xe
jbe 0x100128b4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100155ca
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10015667
push ebx
push esi
call fcn.10015593
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10015527
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10015614
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10015666
push edi
push eax
call fcn.10016585
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10015634
call fcn.100140f1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10015665
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10015527
add esp, 0x20
test eax, eax
jne 0x10015653
push edi
call fcn.100140f1
jmp 0x1001565b
push ebx
call fcn.100140f1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100158d4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e348
push 0x1001e340
push str.FlsAlloc
push 0x1f
call fcn.100157f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015908
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c150]
call esi
jmp 0x1001590e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10015952
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e358
push 0x1001e350
push str.FlsGetValue
push 0x21
call fcn.100157f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015989
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10015991
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001e360
push 0x1001e358
push str.FlsSetValue
push 0x22
call fcn.100157f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100159cb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001c150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001aef0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001af1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001af1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4068fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40691f
xor eax, eax
test eax, eax
je 0x406932
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406932
xor ecx, ecx
jmp 0x406935
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x46590c], 0
push esi
jne 0x406a8f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a69
mov dword [ecx*4 + 0x465908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a64
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406ac0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x465908]
xor eax, esi
inc ecx
dec edx
jne 0x406aa2
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x56ae7aa3
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x14331c49
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4f9038f0
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
push 0xe
mov dword [ebp - 4], ecx
and dword [edi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x4f90393e
push dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.4f90377e
mov esi, eax
test esi, esi
je 0x4f903948
push 0
push dword [ebp - 4]
push ebx
push esi
call fcn.4f903710
test eax, eax
je 0x4f903948
push esi
call fcn.4f9031d0
and dword [edi], 0
push 4
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [edi], esi
test esi, esi
je 0x4f90393e
xor eax, eax
jmp 0x4f903941

Function at 0x4f903c00
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
test ecx, ecx
jne 0x4f903c15
push 7
pop eax
jmp 0x4f903c32
push 0
lea edx, [ebp - 4]
call fcn.4f904108
test eax, eax
jne 0x4f903c27
push 4
jmp 0x4f903c12
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
leave
ret 4

Function at 0x4f903f14
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 2
mov edi, edx
and dword [esi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x4f903f4d
push dword [ebp + 0x10]
mov edx, ebx
push dword [ebp + 8]
push edi
push ecx
mov ecx, eax
call fcn.4f903f5d
mov dword [esi], eax
test eax, eax
je 0x4f903f4d
xor eax, eax
jmp 0x4f903f50
push 4
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4f905195
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4f919454]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x204]
push 0x100
push eax
movzx eax, word [esi + 0x3e]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
je 0x4f905347
cmp dword [esi + 0x40], 0
mov byte [ebp - 0x104], 0x20
je 0x4f9051fd
push 0xff
lea eax, [ebp - 0x103]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
neg eax
sbb al, al
and byte [ebp - 0x103], al
jmp 0x4f905257
push ecx
push 0x4f90171c
push ecx
mov edx, 0xff
lea ecx, [ebp - 0x103]
call fcn.4f9043f7
cmp dword [esi + 0x44], 0
mov edi, 0xf000
je 0x4f90524c
mov eax, dword [esi + 0x4c]
and eax, edi
cmp eax, 0x3000
jne 0x4f90524c
push 0xf2
lea eax, [ebp - 0xf7]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
neg eax
sbb al, al
and byte [ebp - 0xf7], al
mov ecx, dword [esi + 0x4c]
test ecx, 0x400
je 0x4f90525c
push 2
pop esi
jmp 0x4f905278
xor esi, esi
inc esi
test cl, 5
jne 0x4f905278
mov eax, esi
mov esi, ecx
and esi, edi
sub esi, 0x1000
neg esi
sbb esi, esi
not esi
and esi, eax
push ecx
lea eax, [ebp - 0x204]
mov edi, 0x200
push eax
push ecx
mov edx, edi
lea ecx, [ebp - 0x404]
call fcn.4f9043f7
test eax, eax
js 0x4f905347
lea eax, [ebp - 0x104]
mov edx, edi
push eax
lea ecx, [ebp - 0x404]
call fcn.4f904392
test eax, eax
js 0x4f905347
push esi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, eax
cmp ecx, 0x20
jae 0x4f905343
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f9052d5
sub ecx, edx
lea eax, [ebp - 0x204]
add eax, ecx
jmp 0x4f9052f8
cmp cl, 0x3a
je 0x4f9052ff
lea ecx, [ebp - 0x204]
cmp eax, ecx
je 0x4f905347
dec eax
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x4f9052e8
push ecx
inc eax
mov edx, edi
push eax
push ecx
lea ecx, [ebp - 0x404]
call fcn.4f9043f7
test eax, eax
js 0x4f905347
lea eax, [ebp - 0x104]
mov edx, edi
push eax
lea ecx, [ebp - 0x404]
call fcn.4f904392
test eax, eax
js 0x4f905347
push esi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
sbb ecx, ecx
not ecx
and ecx, eax
mov eax, ecx
jmp 0x4f905349
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.4f916670
leave
ret

Function at 0x4f9059b0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
test ecx, ecx
jne 0x4f9059c4
push 7
pop eax
jmp 0x4f9059df
push 2
pop edx
call fcn.4f910100
test eax, eax
jne 0x4f9059d4
push 4
jmp 0x4f9059c1
push eax
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop ebp
ret 4
Function at 0x4f905cea
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 8
mov esi, edx
mov edi, ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x4f905d06
push 4
pop eax
jmp 0x4f905d1e
push dword [ebp + 0x10]
mov edx, edi
push dword [ebp + 8]
push esi
push ecx
mov ecx, eax
call fcn.4f905a40
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4f9071e0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x40]
test ecx, ecx
jne 0x4f9071f5
push 7
pop eax
jmp 0x4f907213
push 2
pop edx
call fcn.4f910100
test eax, eax
jne 0x4f907205
push 4
jmp 0x4f9071f2
push eax
movzx eax, word [esi + 0x38]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4f9074f1
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov si, word [ebp + 0x14]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
and dword [edi], 0
test si, si
jne 0x4f907512
push 0xc
jmp 0x4f907551
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x4f90754f
push dword [ebp + 0x18]
mov edx, dword [ebp - 4]
push dword [ebp + 8]
push ebx
push ecx
mov ecx, eax
call fcn.4f90739d
mov dword [edi], eax
test eax, eax
je 0x4f90754f
push dword [ebp + 0x10]
mov word [eax + 0x38], si
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [edi]
mov word [ecx + 0x3a], ax
xor eax, eax
jmp 0x4f907552
push 4
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x4f907cf0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x4f907d09
push 0xd
pop eax
jmp 0x4f907db9
mov ecx, dword [esi + 0x94]
push edi
sub ecx, 0x10
push 2
pop edi
cmp ecx, 5
ja 0x4f907d2d
mov ecx, esi
call fcn.4f90b887
cmp eax, edi
jne 0x4f907d2d
mov eax, edi
jmp 0x4f907db8
cmp dword [esi + 0x10], edi
jne 0x4f907d4f
mov ecx, dword [esi + 0x70]
mov edx, edi
call fcn.4f910100
test eax, eax
je 0x4f907d63
push eax
movzx eax, word [0x4f91980c]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, esi
call fcn.4f908d01
mov edx, edi
mov ecx, eax
call fcn.4f910100
test eax, eax
jne 0x4f907d68
push 4
pop eax
jmp 0x4f907db8
push eax
movzx eax, word [0x4f919818]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp dword [esi + 0x10], 1
jne 0x4f907d9d
cmp word [esi + 0x5c], bx
je 0x4f907d9d
mov ecx, esi
call fcn.4f9091df
test eax, eax
je 0x4f907d9d
push eax
movzx eax, word [0x4f919824]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x4f907db6
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4f91b33c]
call esi
jmp 0x4f907db8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f9089f7
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
mov eax, edx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
push 4
mov ebx, ecx
mov dword [ebp - 0xc], eax
pop edi
push 1
mov ecx, eax
mov dword [ebp - 0x10], ebx
call fcn.4f90835c
mov esi, eax
test esi, esi
je 0x4f908b2e
cmp dword [0x4f919834], 0
mov dword [esi + 0xc], ebx
je 0x4f908b28
movzx eax, word [ebp + 0x18]
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4f908a4f
mov dword [esi + 0x40], 1
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.4f908c19
test eax, eax
je 0x4f908b28
push esi
call sym.OLECLI32.dll_SetNetName
mov edi, eax
test edi, edi
je 0x4f908aca
movzx ecx, word [0x4f919824]
push ecx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4f908b28
movzx eax, word [0x4f919824]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x4f908b28
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
test eax, eax
je 0x4f908b28
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [esi + 0x5c], ax
test ax, ax
je 0x4f908b28
mov ecx, esi
call fcn.4f909178
mov edx, dword [ebp - 0xc]
lea ebx, [esi + 0x64]
mov ecx, dword [ebp - 0x10]
push 5
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.4f90c478
mov edi, eax
test edi, edi
jne 0x4f908b28
mov ecx, esi
call fcn.4f9083f7
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebx]
test eax, eax
je 0x4f908b02
mov dword [eax + 0x34], esi
xor edx, edx
mov ecx, esi
call fcn.4f904ed4
test eax, eax
je 0x4f908b30
push 2
pop edx
push edx
mov ecx, esi
mov dword [esi + 0x4c], 0x18
call fcn.4f908fb5
call fcn.4f909cb9
jmp 0x4f908b30
push esi
call sym.OLECLI32.dll_OleDelete
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4f908b3d
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, word [0x4f919818]
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 4
pop edi
mov esi, edx
mov ebx, ecx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4f908b73
push 0xb
pop eax
jmp 0x4f908c0c
mov edx, dword [ebp + 8]
mov ecx, esi
push 2
call fcn.4f90835c
mov esi, eax
test esi, esi
je 0x4f908c0a
cmp dword [0x4f919834], 0
mov dword [esi + 0xc], ebx
je 0x4f908c04
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.4f908c19
test eax, eax
je 0x4f908c04
mov ecx, esi
call fcn.4f908de1
movzx eax, word [0x4f91980c]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
push 2
pop edx
mov ecx, eax
call fcn.4f910100
mov dword [esi + 0x70], eax
test eax, eax
je 0x4f908c04
mov edx, dword [ebp - 8]
lea ebx, [esi + 0x64]
mov ecx, dword [ebp - 0xc]
push 5
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.4f90c478
mov edi, eax
test edi, edi
jne 0x4f908c04
mov ecx, esi
call fcn.4f9083f7
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
mov ecx, dword [ebx]
test ecx, ecx
je 0x4f908c0a
mov dword [ecx + 0x34], esi
jmp 0x4f908c0a
push esi
call sym.OLECLI32.dll_OleDelete
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4f9090aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], edi
cmp eax, 0xf
je 0x4f90911d
cmp eax, 0xd
jne 0x4f9090d0
cmp dword [esi + 0xa0], edi
je 0x4f90911d
mov eax, dword [esi + 0xa0]
dec eax
cmp eax, 7
ja case.default.0x4f9090dc
jmp dword [eax*4 + 0x4f909152]
pop edi
pop esi
jmp fcn.4f907792
pop edi
pop esi
jmp fcn.4f909cb9
pop edi
pop esi
jmp fcn.4f90945d
pop edi
pop esi
jmp fcn.4f9097ff
pop edi
pop esi
jmp fcn.4f90a0af
pop edi
pop esi
jmp fcn.4f90a6e5
pop edi
pop esi
jmp fcn.4f90b5e1
pop edi
xor edx, edx
pop esi
jmp fcn.4f907fcb
mov eax, dword [esi + 0xac]
mov dword [esi + 0x98], 1
mov dword [esi + 0xa8], eax
call fcn.4f908ff9
cmp dword [esi + 0xb8], edi
je case.default.0x4f9090dc
mov dword [esi + 0xb8], edi
mov ecx, esi
pop edi
pop esi
jmp fcn.4f9054f8
pop edi
pop esi
ret