joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b11c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab4
xor eax, eax
push ebp
push 0x40b1e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404ac4
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40b1c4
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
push 0
push 0
push 0
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push esi
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x40b0f8]
call fcn.00405854
add esp, 4
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
call fcn.004056a0
mov edx, eax
mov ecx, edi
mov eax, dword [ebp - 8]
call fcn.0040b1f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b1ef
lea eax, [ebp - 8]
mov edx, dword [0x40b0f8]
call fcn.00405860
lea eax, [ebp - 4]
call fcn.00404658
ret

Function at 0x40be30
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bef7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040312c
mov eax, dword [0x421520]
lea eax, [eax + eax*2]
call fcn.00403154
inc eax
lea edx, [ebp - 8]
call fcn.00407370
mov edx, dword [ebp - 8]
mov eax, 0x421528
call fcn.004046ac
push 0x40bf0c
push dword [0x421518]
push 0x40bf1c
push 0x40bf30
push dword [0x42151c]
push 0x40bf40
push 0x40bf4c
mov eax, 0x11
call fcn.00403154
push dword [eax*4 + 0x41d8f0]
push 0x40bf40
push 0x40bf64
push dword [0x421528]
push 0x40bf40
push 0x40bf7c
push 0x40bf9c
lea eax, [ebp - 4]
mov edx, 0xe
call fcn.004049c8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004046ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40befe
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040467c
ret

Function at 0x40c0d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov ebx, 0x421518
xor eax, eax
push ebp
push 0x40c186
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x40c19c
call fcn.004046ac
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.004046ac
mov dword [ebx + 8], esi
mov eax, dword [ebp + 8]
dec eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov edx, 0x40c1a8
call fcn.004046ac
mov byte [0x421514], 1
mov esi, dword [ebx + 0xc]
test esi, esi
jl 0x40c15f
inc esi
mov ebx, 0x420ecc
push 0x421510
push 0
push 0
push 0x40bfb4
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebx], eax
add ebx, 4
dec esi
jne 0x40c140
mov eax, dword [0x41de30]
mov eax, dword [eax]
mov edx, 0x40c1b4
call fcn.0041a778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c18d
lea eax, [ebp - 4]
call fcn.00404658
ret
Function at 0x40c1cc
Capabilities:
Suspend thread

Disassembly:
push ebx
push esi
cmp byte [0x421514], 1
jne 0x40c1f8
mov byte [0x421514], 0
mov esi, eax
test esi, esi
jl 0x40c1f8
inc esi
mov ebx, 0x420ecc
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_SuspendThread
add ebx, 4
dec esi
jne 0x40c1ea
pop esi
pop ebx
ret

Function at 0x40fd10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40fd49
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404748
jmp 0x40fd52
mov eax, ebx
mov edx, esi
call fcn.004046ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40fd5c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40fd7e
movzx eax, byte [esp]
jmp 0x40fd80
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x410410
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x410288
mov eax, dword [0x41de48]
cmp byte [eax], 0
je 0x41048c
mov eax, dword [0x41dd44]
call fcn.004031ec
call fcn.00402e3c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040d614
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4104d4
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
jmp 0x4104c2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41dd20]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4207f8]
call fcn.00405918
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x419070
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4191ee
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.00404658
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.advapi32.dll_CryptAcquireContextA
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x8004
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x4191ba
push 0
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.00404ea0
mov eax, dword [ebp - 0x18]
call fcn.00404eec
inc eax
add eax, eax
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x4191ba
mov dword [ebp - 0x10], 0x14
push 0x14
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x419050]
call fcn.00405854
add esp, 4
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x4191ba
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptDestroyHash
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptReleaseContext
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jl 0x419193
inc eax
mov dword [ebp - 0x14], eax
xor edi, edi
mov eax, dword [ebp - 4]
add bl, byte [eax + edi]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x419204
call fcn.00407570
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00404900
inc edi
dec dword [ebp - 0x14]
jne 0x41915c
lea eax, [ebp - 0x28]
push eax
movzx eax, bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x419204
call fcn.00407570
mov edx, dword [ebp - 0x28]
mov eax, esi
call fcn.00404900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4191f5
lea eax, [ebp - 0x28]
call fcn.00404658
lea eax, [ebp - 0x1c]
call fcn.00404658
lea eax, [ebp - 0x18]
call fcn.00404d8c
lea eax, [ebp - 4]
mov edx, dword [0x419050]
call fcn.00405860
ret
Function at 0x419ae8
Capabilities:
Create thread

Disassembly:
push 0x423704
push 0
push 0
push 0x419aa8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x423700], eax
ret
Function at 0x41a39c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x41a3a5
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x200c], edx
mov dword [ebp - 0x2010], edx
mov dword [ebp - 0x2014], edx
mov dword [ebp - 0x2018], edx
mov dword [ebp - 0x2008], edx
mov ebx, eax
lea edi, [ebp - 0x2001]
xor eax, eax
push ebp
push 0x41a5ad
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406efc
lea eax, [ebx + 0x18]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x41a58f
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 4], eax
mov word [ebx + 8], 2
movzx eax, word [0x4236f4]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0xa], ax
lea ecx, [ebp - 0x2008]
mov edx, dword [0x4236f8]
mov eax, ebx
call fcn.0041a5f4
mov eax, dword [ebp - 0x2008]
call fcn.00404ac4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0xc], eax
push 0x10
lea eax, [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
test eax, eax
jne 0x41a561
push 0x41a5c4
push dword [0x41dc94]
push 0x41a5d4
push dword [0x4236fc]
push 0x41a5d4
lea eax, [ebp - 0x2010]
call fcn.00407334
push dword [ebp - 0x2010]
push 0x41a5d4
lea eax, [ebp - 0x2014]
call fcn.00406fb8
push dword [ebp - 0x2014]
push 0x41a5d4
push 0x41a5e0
push 0x41a5d4
lea edx, [ebp - 0x2018]
mov eax, dword [0x4236f4]
call fcn.00407370
push dword [ebp - 0x2018]
push 0x41a5d4
push dword [0x423710]
lea eax, [ebp - 0x200c]
mov edx, 0xe
call fcn.004049c8
mov edx, dword [ebp - 0x200c]
mov eax, ebx
call fcn.0041a778
mov eax, 0x423710
mov edx, 0x41a5f0
call fcn.004046ac
mov eax, edi
xor ecx, ecx
mov edx, 0x2001
call fcn.004032dc
push 0
push 0x2001
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_recv
mov esi, eax
jmp 0x41a55a
mov ecx, edi
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.00419b08
mov eax, edi
xor ecx, ecx
mov edx, 0x2001
call fcn.004032dc
push 0
push 0x2001
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
jle 0x41a561
inc esi
jne 0x41a52d
push 2
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_shutdown
call fcn.0041a7e0
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
mov eax, dword [0x41dc80]
push eax
call sub.KERNEL32.DLL_Sleep_1
jmp 0x41a409
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a5b4
lea eax, [ebp - 0x2018]
mov edx, 5
call fcn.0040467c
ret

Function at 0x41a5f4
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov ebx, edx
mov eax, ebp
call fcn.00404658
mov eax, ebx
call fcn.00404ac4
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x41a633
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x41a62c
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebp
call fcn.00404850
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x41a61b
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41aa6c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
call fcn.00404ab4
mov ebx, 0x423744
xor eax, eax
push ebp
push 0x41ab96
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004046ac
mov eax, dword [ebp - 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
test esi, esi
je 0x41aabd
test edi, edi
jne 0x41aae4
call fcn.0040312c
mov eax, 0x1770
call fcn.00403154
add eax, 0x32
mov dword [ebx + 0x10], eax
mov eax, 0x1770
call fcn.00403154
add eax, 0x32
mov dword [ebx + 8], eax
jmp 0x41aaea
mov dword [ebx + 0x10], edi
mov dword [ebx + 8], esi
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 8]
dec eax
mov dword [ebx + 0x18], eax
cmp dword [ebx + 0x10], 0xffdc
jle 0x41ab07
mov dword [ebx + 0x10], 0xffdc
cmp dword [ebx + 8], 0xffdc
jle 0x41ab17
mov dword [ebx + 8], 0xffdc
mov eax, dword [ebx + 4]
cmp eax, 0xffff
jg 0x41ab25
test eax, eax
jne 0x41ab2c
mov dword [ebx + 4], 0xbfe
cmp dword [ebx + 0x14], 0x18f
jle 0x41ab3c
mov dword [ebx + 0x14], 0x186
mov byte [0x41dc9c], 1
mov esi, dword [ebx + 0x18]
test esi, esi
jl 0x41ab6f
inc esi
mov ebx, 0x423760
push 0x423da4
push 0
push 0
push 0x41a910
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebx], eax
add ebx, 4
dec esi
jne 0x41ab50
mov eax, dword [0x41de30]
mov eax, dword [eax]
mov edx, 0x41abb0
call fcn.0041a778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ab9d
lea eax, [ebp - 4]
call fcn.00404658
ret

Function at 0x41abc8
Capabilities:
Suspend thread

Disassembly:
push ebx
push esi
cmp byte [0x41dc9c], 1
jne 0x41abf4
mov byte [0x41dc9c], 0
mov esi, eax
test esi, esi
jl 0x41abf4
inc esi
mov ebx, 0x423760
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_SuspendThread
add ebx, 4
dec esi
jne 0x41abe6
pop esi
pop ebx
ret

Function at 0x41af18
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x41de68]
push eax
push 0
push 0
push 0x41adf8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov edx, dword [0x41dce8]
mov dword [edx], eax
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40596d
pop dword [ebp - 0x30]
mov eax, 0xfcec8ef1
add eax, 0x353ca7c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xf9c65f6b
sub dword [ebp - 0x40], 0xab741a20
mov dword [ebp - 0x3c], 0xad4ea81c
sub dword [ebp - 0x3c], 0x7b1b5bd7
mov dword [ebp - 0x38], 0xe3003523
sub dword [ebp - 0x38], 0x96b3f0f5
mov dword [ebp - 0x34], 0x84460bff
sub dword [ebp - 0x34], 0x84460bff
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x5a3b5e49
add dword [ebp - 0x40], 0x1a370b0d
mov dword [ebp - 0x3c], 0xf395781e
add dword [ebp - 0x3c], 0x4dd6e957
mov dword [ebp - 0x38], 0x4f3670d4
add dword [ebp - 0x38], 0x1438fb98
mov dword [ebp - 0x34], 0x917d25f5
add dword [ebp - 0x34], 0x6e82da0b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x8d4b5ef3
sub eax, 0x8d0aedf3
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6ef
push 0
call eax
mov ecx, 0xc4cb2bd4
add ecx, 0x3b352b0a
mov ebx, eax
mov edx, 0x410000
add edx, dword [ebp - 0x30]
mov edi, 0x345f024
sub edi, 0xfe2690e3
add dword [ebp - 0xc], 0x5717d4e6
mov esi, dword [edx]
xor dword [ebp - 0x28], edi
sub esi, edi
mov dword [ebp - 0x24], 0x3b661667
mov dword [ebx], esi
xor dword [ebp - 0x20], 0x62b04cf3
add ebx, 4
add edx, 0xf0137e3c
add edx, 0xfec81c8
loop 0x405a84
add eax, 0x553c1b0
add eax, 0xfaad8c9b
mov ebx, eax
add eax, 0xdc1e89b3
add eax, 0x23e17652
mov ecx, 0x47b9335b
sub ecx, 0x4779335b
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x403060
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403074
inc dword [0x4c1fb4]
add dword [0x4be40c], 0x108
mov edx, dword [0x4be40c]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c0a90
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4030a3
push 0
mov eax, 0x4c3fc0
call fcn.00415710
cmp dword [0x4c1fe0], 0
mov dword [0x4c4a68], 0
mov dword [0x4c4a6c], 0
je 0x4030cb
push 0x4c2650
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40314f
or ecx, 0xffffffff
cmp byte [esi + 0xea], 0
jne 0x4030fa
xor eax, eax
cmp byte [esp + 0x14], 0x64
sete al
mov byte [esi + 0xea], al
test al, al
je 0x4030fa
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4c4a74], 0
je 0x40310c
cmp dword [0x4c4a70], 0
jne 0x403115
cmp byte [esi + 0xea], 0
je 0x40314f
cmp byte [esi + 0xea], 0
mov byte [esi + 0xe8], 0
jne 0x40314f
cmp dword [0x4c4a74], 0
jge 0x403137
pop edi
mov dword [esi + 0xdc], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0xd8], eax
mov edx, dword [0x4c4a74]
mov dword [esi + 0xdc], edx
pop edi
pop esi
ret
Function at 0x403d70
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x403d94
push esi
call fcn.00404080
test eax, eax
jne 0x403d94
push str.Cant_open_clipboard_for_writing.
call fcn.00403e70
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x403dcd
cmp dword [esi + 0x18], ebx
je 0x403dbf
cmp dword [esi + 8], ebx
je 0x403db4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49cbac
call fcn.00403e70
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp eax, ebx
je 0x403e06
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x403e2d
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x403e2d
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x403e23
cmp dword [esi + 8], ebx
je 0x403e18
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x403e42
mov dword [esi + 4], ebx
jmp 0x403e06
cmp dword [esi + 0x18], ebx
je 0x403e5f
cmp dword [esi + 8], ebx
je 0x403e54
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49cbcc
call fcn.00403e70
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x403f40
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
lea eax, [esi - 0xc000]
sub esp, 0x20c
cmp eax, 0x3fff
ja 0x403fdd
push 0x104
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.00489302
add esp, 0xc
test eax, eax
je 0x403fd4
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00488ac9
add esp, 8
test eax, eax
je 0x403fd4
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00488ac9
add esp, 8
test eax, eax
je 0x403fd4
lea edx, [esp]
push str.Native
push edx
call fcn.00488ac9
add esp, 8
test eax, eax
je 0x403fd4
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00488ac9
add esp, 8
test eax, eax
jne 0x403fe3
xor eax, eax
add esp, 0x20c
ret
xor ecx, ecx
mov word [esp], cx
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ebp
push edi
call ebx
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push esi
mov ebp, eax
call edi
test eax, eax
jne 0x404070
lea ecx, [ecx]
cmp esi, 0xf
je 0x40406e
lea edx, [esp + 0xc]
push str.OwnerLink
push edx
call fcn.00488ac9
add esp, 8
test eax, eax
je 0x40406e
mov eax, dword [0x4be3d0]
cmp eax, 0xffffffff
je 0x40403a
test eax, eax
je 0x40406e
call ebx
mov ecx, dword [0x4be3d0]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x40406e
push 1
push 0x8000012f
mov dword [0x4be3d4], 0
call fcn.004012b0
add esp, 8
push esi
mov dword [0x4be3d4], 1
call edi
test eax, eax
je 0x404000
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x404080
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0
je 0x404092
mov eax, 1
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov ecx, dword [0x4c1e48]
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
push ecx
mov edi, eax
call ebx
test eax, eax
jne 0x404100
mov eax, dword [0x4be3d0]
cmp eax, 0xffffffff
je 0x4040d1
test eax, eax
je 0x404116
call esi
mov edx, dword [0x4be3d0]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x404116
push 1
push 0x8000012f
mov dword [0x4be3d4], 0
call fcn.004012b0
mov eax, dword [0x4c1e48]
add esp, 8
push eax
mov dword [0x4be3d4], 1
call ebx
test eax, eax
je 0x4040b2
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ecx + 0x18], 1
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
Function at 0x4075e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4c0d58], 0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x40769b
mov al, byte [0x4c0d5a]
cmp al, 0xa0
je 0x407606
cmp al, 0x10
jne 0x40769b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4c0d54]
cmp eax, 0x16
jae 0x40769b
test ebp, 0x100
jne case.0x407637.13
movzx eax, byte [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407637.13
movzx eax, byte [eax + 0x407844]
jmp dword [eax*4 + 0x40783c]
mov cl, 1
jmp 0x407644
xor cl, cl
cmp byte [0x4c0d59], 0
jne 0x407661
xor ecx, ecx
nop
cmp byte [ecx + 0x4c0d3c], 0
jne 0x40766c
inc ecx
cmp ecx, 0x16
jl 0x407650
jmp 0x40769b
cmp byte [esp + 0x1c], 0
je 0x407675
test cl, cl
je 0x40769b
mov byte [0x4c0d5b], 1
jmp 0x407679
test cl, cl
je 0x40769b
mov cl, byte [0x4c0d53]
mov dl, byte [0x4c0d52]
mov al, byte [0x4c0c5f]
mov byte [0x4c1e47], cl
mov byte [0x4c1e78], dl
mov byte [0x4c1f08], al
mov cl, byte [0x4c1e47]
movzx esi, byte [esp + 0x14]
mov dl, byte [0x4c1e78]
mov al, byte [0x4c1f08]
mov byte [0x4c0d53], cl
lea ecx, [esi + esi*8]
mov byte [0x4c0d52], dl
mov edx, dword [0x4c2884]
shl ecx, 5
mov bl, byte [ecx + edx + 4]
mov byte [0x4c0c5f], al
test bl, bl
je case.default.0x407812
cmp dword [edi + 0x10], 0xffc3d44f
setne dl
test byte [edi + 8], 0x10
mov byte [esp + 0xf], dl
je 0x4076f2
xor al, al
jmp 0x407707
mov eax, dword [esp + 0x1c]
push eax
mov al, byte [esp + 0x18]
call fcn.004078a0
mov dl, byte [esp + 0x13]
add esp, 4
cmp byte [esp + 0x1c], 0
mov byte [esp + 0x18], al
je 0x4077de
cmp byte [esp + 0x20], 0
jne 0x407731
mov cl, bl
not cl
and byte [0x4c1e45], cl
test dl, dl
je 0x407731
and byte [0x4c1e46], cl
cmp byte [esp + 0x18], 0
je case.default.0x407812
not bl
and byte [0x4c1e47], bl
lea ecx, [esi - 0xa0]
mov byte [esi + 0x4c1e68], 0
cmp ecx, 5
ja case.default.0x407812
jmp dword [ecx*4 + 0x407868]
mov cl, byte [0x4c1f09]
mov byte [0x4c1e78], cl
jmp case.default.0x407812
mov dl, byte [0x4c1f08]
mov byte [0x4c1e78], dl
jmp case.default.0x407812
mov al, byte [0x4c1f0b]
mov byte [0x4c1e79], al
jmp case.default.0x407812
mov cl, byte [0x4c1f0a]
mov byte [0x4c1e79], cl
jmp case.default.0x407812
mov dl, byte [0x4c1f0d]
mov byte [0x4c1e7a], dl
jmp case.default.0x407812
mov al, byte [0x4c1f0c]
mov byte [0x4c1e7a], al
test byte [edi + 8], 0x10
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop esi
mov word [0x4c0d5c], bp
pop ebp
mov byte [0x4c0d5a], al
mov byte [0x4c0d59], cl
pop ebx
je 0x407820
xor al, al
mov byte [0x4c0d58], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4c0d54], eax
pop ecx
ret
cmp byte [esp + 0x20], 0
jne 0x4077f5
or byte [0x4c1e45], bl
test dl, dl
je 0x4077f5
or byte [0x4c1e46], bl
test al, al
je case.default.0x407812
or byte [0x4c1e47], bl
lea ecx, [esi - 0xa0]
mov al, 0x80
mov byte [esi + 0x4c1e68], al
cmp ecx, 5
ja case.default.0x407812
jmp dword [ecx*4 + 0x407880]
mov byte [0x4c1e78], al
jmp case.default.0x407812
push ecx
call fcn.004078a0
add esp, 4
mov byte [0x4c0d58], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4c0d54], eax
pop ecx
ret