joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028431
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100283ad
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100285a0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100285a0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10028555
jg 0x1002848d
test eax, eax
je 0x1002854b
push 1
push 0x1000
call fcn.10019a22
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100284b0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10028542
push 0x8000
push ebx
call fcn.100282de
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100284d9
jg 0x100284d4
cmp ecx, 0x1000
jb 0x100284d9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001fc3c
add esp, 0x10
cmp eax, 0xffffffff
je 0x1002851e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100284d4
jl 0x10028505
test ecx, ecx
jne 0x100284c6
push dword [ebp - 0xc]
push ebx
call fcn.100282de
push esi
call fcn.10019a7f
add esp, 0xc
xor ebx, ebx
jmp 0x100285ae
cmp byte [edi + 0x24], 0
je 0x10028535
cmp dword [edi + 0x20], 5
jne 0x10028535
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10028540
mov ebx, dword [edi + 0x18]
jmp 0x10028542
xor ebx, ebx
push esi
call fcn.10019a7f
pop ecx
jmp 0x100285ae
test ecx, ecx
jg 0x10028517
jl 0x10028555
test eax, eax
jae 0x10028517
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001ff37
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10028575
cmp byte [edi + 0x1c], 0
je 0x10028517
jmp 0x100285a6
push ebx
call fcn.10025870
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10028517
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100285ae
cmp byte [edi + 0x1c], 0
je 0x100285ab
mov ebx, dword [edi + 0x18]
jmp 0x100285ae
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001ff37
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002a1c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002a1ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002a1ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100344f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x1003450b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10034516
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10034521
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1003452c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10034537
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10034542
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1003454d
bts eax, 1
shr ecx, 1
test cl, 1
je 0x10034558
bts eax, 0
test cl, 2
je 0x10034561
bts eax, 0xff
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x100345ff
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x22
jl 0x100345f0
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10034500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065050
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
pushf
push 0xa
jae 0x10065066
jmp 0x10065061
call 0x10065068
jae 0x10065061
add esp, 4
jmp 0x1006506d
dec dword [esp]
jno 0x10065072
jns 0x1006505d
jp 0x10065076
add esp, 4
popf
jmp 0x1006507d
clc
jae 0x10065082
int1
outsb dx, byte [esi]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1006509b
jne 0x1006509b
outsb dx, byte [esi]
jl 0x100650a0
jmp 0x100650a2
je 0x1006509d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100650bc
jne 0x100650bb
call 0x930a4143
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100650ca
jne 0x100650ca
call 0x10fe9695
add byte [eax], al
add bh, al
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x100650e3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x10065115
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp ecx, eax
jne 0x10065113
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x100650da
mov edx, dword [ebp - 8]
xor eax, eax
cmp edx, dword [ebp - 4]
sete al
jmp 0x10065193
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10065068
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
pushf
push 0xa
jae 0x10065066
jmp 0x10065061
call 0x10065068
jae 0x10065061
add esp, 4
jmp 0x1006506d
dec dword [esp]
jno 0x10065072
jns 0x1006505d
jp 0x10065076
add esp, 4
popf
jmp 0x1006507d
clc
jae 0x10065082
int1
outsb dx, byte [esi]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1006509b
jne 0x1006509b
outsb dx, byte [esi]
jl 0x100650a0
jmp 0x100650a2
je 0x1006509d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100650bc
jne 0x100650bb
call 0x930a4143
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100650ca
jne 0x100650ca
call 0x10fe9695
add byte [eax], al
add bh, al
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x100650e3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x10065115
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp ecx, eax
jne 0x10065113
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x100650da
mov edx, dword [ebp - 8]
xor eax, eax
cmp edx, dword [ebp - 4]
sete al
jmp 0x10065193
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418210
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [eax]
pop es
pop edi
xchg edx, eax
xchg esp, eax
mov bh, 0xec
push es
push es
nop
xchg esp, eax
mov bl, 0xec
push es
push es
xchg esp, eax
pushfd
inc ebx
test byte [esi], 6
pop ecx
push es
pushfd
mov bl, 0xec
push es
push es
mov edi, es
jl 0x418279
pop edx
mov dl, dl
xor ebp, dword [edi]
or byte [edi], al
bound ebx, qword [ecx - 0xe]
or edx, dword [ebp + 0x4e]
dec ebx
popal
pop eax
mov al, ch
inc ecx
push ecx
pop es
pop es
mov al, cl
hlt
push esp
and dword [edi], eax
pop es
mov dl, dh
cmpsd dword [esi], dword es:[edi]
or byte [edi], al
pop es
or cl, byte [ebp + 0x54]
push edx
bound ebx, qword [ebp - 0x11]
adc al, byte [edi]
pop es
pop es
pop es
cmp al, 0x3c
dec ecx
dec ebp
inc edi
cmp cl, byte ds:[ebp + 0x4f]
dec edx
mov cl, bl
or ecx, dword [eax + 0x7da9bfd]
pop es
imul ebp, dword gs:[eax + 0x707071f], 0xffffff90
mov word [edi - 0x6df9f914], gs
xchg esp, eax
scasd eax, dword es:[edi]
in al, dx
push es
push es
xchg edx, eax
pop eax
aaa
nop
pushfd
stosd dword es:[edi], eax
in al, dx
push es
push es
xchg edx, eax
mov word [ebx - 0x6ff9f914], gs
invalid
Function at 0x422ad0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x45dd90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [esp + 0x54]
push ebx
mov ebx, dword [ecx + 0x4e0]
push ebp
lea edx, [eax + eax*4]
push esi
shl edx, 3
sub edx, eax
push edi
mov edi, dword [esp + 0x68]
lea edx, [edx + edx*8]
lea esi, [edi + eax*8]
lea eax, [eax + eax*4]
lea edx, [ebx + edx*4]
lea esi, [esi + esi*8]
mov ebx, dword [edx + 0x52c]
lea ebx, [ebx + edi*8]
mov edi, dword [ecx + 0x558]
mov ecx, dword [ecx + 0x4e4]
lea esi, [edi + esi*4]
lea edi, [eax + eax*8]
movsx eax, word [ebx]
lea ebp, [eax*8]
sub ebp, eax
mov eax, dword [ecx + edi*4 + 0x48]
xor ecx, ecx
lea edi, [eax + ebp*2]
mov ebp, dword [edx + 0x54]
movsx edx, byte [esi + 0x1a]
movsx eax, byte [esi + 0x19]
mov dword [esp + 0x68], edx
mov cl, byte [ebx + 2]
fild dword [esp + 0x68]
mov dword [esp + 0x68], eax
mov ebx, ecx
movsx ecx, byte [esi + 0x18]
fmul dword [0x464098]
fst dword [esp + 0x10]
fild dword [esp + 0x68]
mov dword [esp + 0x68], ecx
fmul dword [0x464098]
fst dword [esp + 0x64]
fild dword [esp + 0x68]
fmul dword [0x464098]
fst dword [esp + 0x14]
fstp dword [esp + 0x30]
fstp dword [esp + 0x34]
fstp dword [esp + 0x38]
xor eax, eax
cmp ebx, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x68], eax
jle 0x422c62
fild dword [esi + 8]
fmul dword [0x461020]
fild dword [esi + 4]
fmul dword [0x461020]
fild dword [esi]
fmul dword [0x461020]
fstp dword [esp + 0x18]
fstp dword [esp + 0x1c]
fstp dword [esp + 0x20]
movsx eax, word [edi + 2]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x5c], 1
lea edx, [eax + eax*2]
lea eax, [ebp + edx*4]
push eax
push ecx
movsx eax, word [edi]
lea edx, [eax + eax*2]
lea ecx, [ebp + edx*4]
call fcn.00433a80
lea ecx, [esp + 0x48]
push 0x3f000000
push ecx
mov ecx, eax
mov byte [esp + 0x64], 2
call fcn.00433ae0
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
push ecx
mov ecx, eax
mov byte [esp + 0x64], 3
call fcn.00433ab0
fld dword [esp + 0x28]
fmul dword [esp + 0x64]
fld dword [esp + 0x2c]
fmul dword [esp + 0x10]
mov byte [esp + 0x5c], 0
faddp st(1)
fld dword [esp + 0x14]
fmul dword [esp + 0x24]
faddp st(1)
fcomp dword [0x461018]
fnstsw ax
test ah, 0x41
je 0x422c79
mov eax, dword [esp + 0x68]
add edi, 0xe
inc eax
cmp eax, ebx
mov dword [esp + 0x68], eax
jl 0x422ba9
mov eax, ebx
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 8
mov edx, dword [esp + 0x68]
lea eax, [edx - 1]
jmp 0x422c64
Function at 0x4254c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
push str.T3ED_FLOATPT
xor esi, esi
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42552b
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0xc
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
push esi
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ecx + 8]
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, 1
pop esi
ret 4
mov eax, esi
pop edi
pop esi
ret 4

Function at 0x425540
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
push str.T3ED_FLOATPT
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
xor ebx, ebx
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4255e7
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4255e7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x1c]
push ecx
fld dword [eax + 4]
fsub dword [esp + 0x14]
fmul dword [0x464020]
fstp dword [esp]
fld dword [eax + 8]
fsub dword [esp + 0x18]
push ecx
fmul dword [0x464020]
fstp dword [esp]
fld dword [eax]
fsub dword [esp + 0x14]
push ecx
mov ecx, edi
fmul dword [0x464020]
fstp dword [esp]
push eax
call fcn.00418210
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret 4
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x425600
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push str.T3ED_TRACKBLOCK
xor esi, esi
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov edi, dword [esp + 0x10]
mov ebx, eax
or eax, 0xffffffff
push esi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x425655
push ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x42564f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0xe
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
Function at 0x42e3a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x58
mov eax, dword [esp + 0x5c]
push ebx
mov edx, ecx
push ebp
push esi
lea ecx, [eax + eax*8]
mov esi, dword [edx + 0x558]
mov ebx, dword [edx + 0x494]
push edi
xor ebp, ebp
lea esi, [esi + ecx*4]
mov ecx, 9
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
test ebx, ebx
rep movsd dword es:[edi], dword [esi]
je 0x42e3f1
mov esi, dword [edx + 0x55c]
lea ecx, [eax*8]
sub ecx, eax
lea edi, [esp + 0x4c]
lea esi, [esi + ecx*4]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x768]
test eax, eax
mov ecx, dword [ecx + eax*4]
mov dword [esp + 0x38], ecx
mov ecx, dword [edx + 0x76c]
mov edx, dword [edx + 0x770]
mov esi, dword [ecx + eax*8]
mov dword [esp + 0x3c], esi
mov ecx, dword [ecx + eax*8 + 4]
mov dword [esp + 0x40], ecx
mov ecx, dword [edx + eax*8]
mov dword [esp + 0x44], ecx
mov edx, dword [edx + eax*8 + 4]
mov dword [esp + 0x48], edx
jge 0x42e438
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 4
push str.T3ED_VRoad
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0
mov dword [esp + 0x70], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42e49a
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x58
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0x16
lea esi, [esp + 0x10]
mov edi, eax
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x6c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ebp, 1
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 4
Function at 0x42e4b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
push ebp
push esi
push edi
mov ebp, ecx
push str.T3ED_VRoad
xor edi, edi
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42e5d0
push ebx
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x42e5be
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0x16
mov esi, eax
lea edi, [esp + 0x14]
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], 1
test eax, eax
mov eax, dword [esp + 0x70]
je 0x42e52e
mov edx, dword [ebp + 0x558]
lea ecx, [eax + eax*8]
lea esi, [esp + 0x18]
lea edi, [edx + ecx*4]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x494]
test ecx, ecx
je 0x42e568
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x42e568
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x42e568
mov edx, dword [ebp + 0x55c]
lea ecx, [eax*8]
sub ecx, eax
lea esi, [esp + 0x50]
lea edi, [edx + ecx*4]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x78]
test ecx, ecx
je 0x42e57d
mov ecx, dword [ebp + 0x768]
mov edx, dword [esp + 0x3c]
mov dword [ecx + eax*4], edx
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x42e59a
mov ecx, dword [ebp + 0x76c]
mov edx, dword [esp + 0x40]
mov dword [ecx + eax*8], edx
mov edx, dword [esp + 0x44]
mov dword [ecx + eax*8 + 4], edx
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x42e5ba
mov ecx, dword [ebp + 0x770]
mov edx, dword [esp + 0x48]
mov dword [ecx + eax*8], edx
mov edx, dword [esp + 0x4c]
mov dword [ecx + eax*8 + 4], edx
mov edi, dword [esp + 0x10]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x5c
ret 0x18
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x5c
ret 0x18

Function at 0x42e5e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
push str.T3ED_VRoad
xor esi, esi
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42e612
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x42e60c
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
ret
Function at 0x42ea90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
xor ebx, ebx
xor eax, eax
cmp esi, dword [edi + 0x774]
setge al
xor ecx, ecx
test esi, esi
setl cl
or eax, ecx
je 0x42eab9
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
push ebp
push 0x44
call dword [0x460774]
mov edx, esi
mov ebp, eax
mov eax, dword [edi + 0x778]
add esp, 4
shl edx, 4
add edx, esi
mov ecx, 0x11
mov edi, ebp
push str.T3ED_Camera
lea esi, [eax + edx*4]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42eb40
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x44
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0x11
mov esi, ebp
mov edi, eax
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x14]
push ebx
push ecx
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ebx, 1
push ebp
call dword [0x46076c]
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x42eb60
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
push str.T3ED_Camera
xor esi, esi
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42eb92
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x42eb8c
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
ret

Function at 0x42eba0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push str.T3ED_Camera
xor ebx, ebx
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42ec33
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x42ec2d
push 0x44
call dword [0x460774]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, dword [edi + 0x774]
mov esi, eax
inc ebx
mov edx, dword [edi + 0x778]
mov eax, ebx
mov dword [edi + 0x774], ebx
mov ecx, eax
shl ecx, 4
add ecx, eax
shl ecx, 2
push ecx
push edx
call dword [0x460770]
mov dword [edi + 0x778], eax
mov edi, dword [edi + 0x774]
mov ecx, edi
add esp, 8
shl ecx, 4
add ecx, edi
mov ebx, 1
lea edi, [eax + ecx*4 - 0x44]
mov ecx, 0x11
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x42efe0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x45e09f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.0045bc96
mov esi, dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push str.T3ED_TRACKBLOCK
mov dword [esp + 0x60], 1
call esi
push str.T3ED_FLOATPT
mov edi, eax
call esi
push str.T3ED_VRoad
mov ebx, eax
call esi
push str.T3ED_Camera
mov dword [esp + 0x14], eax
call esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42f0de
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
call ebp
test eax, eax
je 0x42f090
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0xe
mov esi, eax
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x24], 0xffffffff
jne 0x42f082
push str.Block
jmp 0x42f087
push str.Object
lea ecx, [esp + 0x14]
call fcn.0045bc90
push ebx
call ebp
test eax, eax
je 0x42f0a5
push str.FloatPt
lea ecx, [esp + 0x14]
call fcn.0045bc90
mov eax, dword [esp + 0x14]
push eax
call ebp
test eax, eax
je 0x42f0be
push str.VRoad
lea ecx, [esp + 0x14]
call fcn.0045bc90
mov ecx, dword [esp + 0x18]
push ecx
call ebp
test eax, eax
pop ebp
je 0x42f0d8
push str.Camera
lea ecx, [esp + 0x10]
call fcn.0045bc90
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [esp + 0x64]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0045be88
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 0
call fcn.0045bc84
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 4

Function at 0x42f230
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push esi
push edi
push str.T3ED_FLOATPT
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
xor edi, edi
mov esi, eax
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42f2a9
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x42f2a9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
fld dword [esp + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
pop edi
fstp dword [eax]
mov dword [eax + 8], ecx
mov dword [eax + 4], edx
mov eax, 1
pop esi
add esp, 0xc
ret 4
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret 4