joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [str.073110116101114110101116082101097100070105108101]
push ecx
call fcn.00401280
add esp, 8
lea edx, [ebp - 0x104]
push edx
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x409e10], eax
call fcn.0040198f
test eax, eax
jne 0x402726
call fcn.00401de3
call fcn.00402620
call fcn.004015fa
xor eax, eax
jmp 0x40280d
mov eax, dword [ebp + 0x10]
push eax
call fcn.00402920
add esp, 4
test eax, eax
je 0x40274b
push str.start
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00402c20
add esp, 8
test eax, eax
jne 0x4027ae
push 0x44
push 0
lea edx, [ebp - 0x25c]
push edx
call fcn.00402ca0
add esp, 0xc
mov dword [ebp - 0x230], 1
mov word [ebp - 0x22c], 5
push str.__start
push 0x409d0c
call fcn.00402b10
add esp, 8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x25c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x409d0c
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
jmp 0x40280d
call fcn.0040268b
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x208]
push edx
push 0x409d0c
call fcn.004019b3
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.00402920
add esp, 4
cmp eax, 0x26
jne 0x402803
lea ecx, [ebp - 0x208]
push ecx
call fcn.00401bb1
add esp, 4
call fcn.00402620
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e004]
jne 0x40100a
repz ret
jmp fcn.00401a32

Function at 0x40947b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402662
and dword [ebp - 0x14], 0
cmp dword [0x420728], 0
mov dword [ebp - 0x18], eax
jne 0x40952e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4095d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4095d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x420728], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42072c], eax
call edi
push eax
call esi
push 0x41c8f0
push ebx
mov dword [0x420730], eax
call edi
push eax
call esi
mov dword [0x420738], eax
test eax, eax
je 0x40952e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420734], eax
mov eax, dword [0x420734]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409587
cmp dword [0x420738], ecx
je 0x409587
push eax
call esi
push dword [0x420738]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409587
test ebx, ebx
je 0x409587
call edi
test eax, eax
je 0x40957e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40957e
test byte [ebp - 8], 1
jne 0x409587
or dword [ebp + 0x10], 0x200000
jmp 0x4095ba
mov eax, dword [0x42072c]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4095ba
mov eax, dword [0x420730]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420728]
call esi
test eax, eax
je 0x4095d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4095d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x41a520
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x4220fc]
push ebx
push esi
mov esi, dword [0x421e1c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x41a542
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [str.9Mz]
call fcn.0041a400
cmp dword [0x4220fc], 0x2f
jne 0x41a55d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.0041a440
add esp, 4
cmp dword [0x4220fc], 0x568
pop esi
pop ebx
jne 0x41a58a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408944
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.0040896b
mov eax, ecx
xor dword [edx], ebx
and ecx, eax
add edx, 1
cmp edx, esi
jne fcn.00408944
mov eax, 0xbe1efe3c
mov ecx, 0xd6a23abc
ret
Function at 0x466020
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4873b0]
jne 0x46602a
repz ret
jmp fcn.004700a0
Function at 0x47f3a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
cmp dword [0x7b5ee8], 0x37
jne 0x47f470
push 0
push 0x4579b8
push 0
push 0x4579c8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x4579d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0x457a08
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [ebp - 0x528]
push ecx
push 0x457a30
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x928]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
push 0x457a54
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
push 0x457a6c
push 0
push 0x457a7c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov edx, dword [0x7ad934]
add edx, dword [ebp + 8]
mov eax, dword [0x7b5eec]
add eax, dword [ebp + 8]
mov cl, byte [eax + 0x12336]
mov byte [edx], cl
mov esp, ebp
pop ebp
ret 4
Function at 0x47f8d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14c8
call fcn.00471dd0
mov dword [ebp - 4], 0
jmp 0x47f8ef
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x47f980
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x7b5ee8], 0x9e
jne 0x47f970
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x457aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push 0x457b98
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
lea edx, [ebp - 0x4a0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
cmp dword [ebp - 4], 0x9be51dc
jle 0x47f97b
jmp 0x47f980
jmp 0x47f8e6
push 0x488400
mov eax, dword [0x7b5ee8]
push eax
mov ecx, dword [0x7ad934]
push ecx
call fcn.0047f850
mov dword [ebp - 0x4a4], 0
jmp 0x47f9b2
mov edx, dword [ebp - 0x4a4]
add edx, 1
mov dword [ebp - 0x4a4], edx
cmp dword [ebp - 0x4a4], 0x3e79e
jge 0x47f9d1
cmp dword [ebp - 0x4a4], 0x1e673
jne 0x47f9cf
call fcn.0047f380
jmp 0x47f9a3
mov dword [ebp - 0x4a8], 0
jmp 0x47f9ec
mov eax, dword [ebp - 0x4a8]
add eax, 1
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xdd9a7
jge 0x47fa22
cmp dword [0x7b5ee8], 0xc01
jne 0x47fa20
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0x457b74
push 0x457be0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
jmp 0x47f9dd
jmp dword [0x7ad934]
Function at 0x402e70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae281
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4d7a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 1
push eax
mov eax, esp
sub eax, esp
je 0x402eac
call dword [0xd04d8d58]
pop eax
lea ecx, [ebp - 0x30]
call fcn.00479710
mov byte [ebp - 4], 2
push 0x4b77c4
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040e470
add esp, 0xc
mov byte [ebp - 4], 3
push 0x4b77c8
lea ecx, [ebp - 0x14]
call fcn.0040e180
lea edx, [ebp + 0xc]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040e160
push 0
lea ecx, [ebp - 0x14]
call fcn.0040ff40
push eax
lea ecx, [ebp - 0x30]
call fcn.004797ca
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402f60
lea ecx, [ebp - 0x30]
call fcn.004794a9
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x30]
call fcn.0040fcb0
test eax, eax
jne 0x402f5e
mov byte [ebp - 4], 4
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
call fcn.00479978
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.0040ff40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x34]
call fcn.0040fec0
jmp 0x402f57
mov dword [ebp - 4], 3
jmp 0x402f01
lea ecx, [ebp - 0x30]
call fcn.004793c3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.0040fec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00479736
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040fec0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040fec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af0b2
mov eax, dword fs:[0]
push eax
mov eax, 0x595470
call fcn.0049aab0
mov eax, dword [0x4d7a50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x59547c], ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, dword [ebp - 0x59547c]
call fcn.0047c885
push 0
call fcn.0047fc44
add esp, 4
push 0x4b79ec
mov ecx, dword [ebp - 0x59547c]
call fcn.0047f04d
lea eax, [ebp - 0x595474]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x595474]
push ecx
mov ecx, dword [ebp - 0x59547c]
add ecx, 0xbc
call fcn.0040ff00
push 0x3c
push 0
lea edx, [ebp - 0x595368]
push edx
call fcn.0049a6f0
add esp, 0xc
mov dword [ebp - 0x595368], 0x10
push 0x4b7a0c
lea eax, [ebp - 0x59534c]
push eax
call fcn.0049a930
add esp, 8
mov dword [ebp - 0x595368], 0x10
lea ecx, [ebp - 0x595368]
push ecx
mov ecx, dword [ebp - 0x59547c]
add ecx, 0xcc
call fcn.004117e0
mov dword [ebp - 0xac], 0x94
lea edx, [ebp - 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 2
jne 0x410d8c
mov eax, dword [ebp - 0x59547c]
mov byte [eax + 0xd4], 1
jmp 0x410d99
mov ecx, dword [ebp - 0x59547c]
mov byte [ecx + 0xd4], 0
mov edx, dword [ebp - 0x59547c]
mov dword [edx + 0xe8], 0
push 0
lea ecx, [ebp - 0x59532c]
call fcn.00413fb0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x59532c]
call fcn.0047eda1
mov dword [ebp - 0x595478], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x59532c]
call fcn.00411160
mov eax, dword [ebp - 0x595478]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a6da
mov esp, ebp
pop ebp
ret
Function at 0x410e10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af0fa
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4d7a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0xdc
call fcn.00410530
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push 0x4b7a14
mov ecx, dword [ebp - 0x2c]
add ecx, 0xbc
push ecx
push eax
call fcn.0040e470
add esp, 0xc
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x10]
push edx
call fcn.00402300
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040e620
movzx eax, al
test eax, eax
jne 0x410f75
lea ecx, [ebp - 0x14]
call fcn.0040fe00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x10]
push edx
call fcn.0040fe20
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x20]
push eax
call fcn.004015c0
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x40]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040fee0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0040fec0
lea ecx, [ebp - 0x10]
call fcn.0040e620
movzx eax, al
test eax, eax
jne 0x410f69
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 0x10]
push edx
call fcn.0040fe20
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00402430
add esp, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040fee0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040fec0
lea ecx, [ebp - 0x10]
call fcn.0040e620
movzx eax, al
test eax, eax
jne 0x410f69
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xbc]
push eax
push 0x4b7a20
mov ecx, dword [ebp - 0x2c]
add ecx, 0xdc
push ecx
call fcn.00410a80
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0040fec0
mov ecx, dword [ebp - 0x2c]
add ecx, 0xdc
call fcn.0040e620
movzx edx, al
test edx, edx
je 0x410fab
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xbc]
push ecx
push 0x4b7a28
mov edx, dword [ebp - 0x2c]
add edx, 0xdc
push edx
call fcn.00410a80
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0xdc
call fcn.0040ff40
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040fec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41a960
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afb87
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4d7a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
call fcn.0040fd30
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x595064
call fcn.004521f0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41a9ca
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c6de0]
push ecx
push str._s_save
mov edx, dword [ebp - 0x24]
add edx, 0x4c6dd8
push edx
call fcn.00410a80
add esp, 0xc
jmp 0x41a9ee
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x4c6de0]
push edx
push str._s_save_d
mov eax, dword [ebp - 0x24]
add eax, 0x4c6dd8
push eax
call fcn.00410a80
add esp, 0x10
mov ecx, dword [ebp - 0x24]
add ecx, 0x4c6dd8
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xdc
call fcn.0040fee0
mov edx, 5
mov eax, dword [ebp - 0x24]
mov word [eax + 0x594c5c], dx
cmp dword [ebp - 0x14], 0
jne 0x41aa6c
push str._sd11x5.txt
mov ecx, dword [ebp - 0x10]
add ecx, 0xbc
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0040e470
add esp, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x4c6de4
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040fec0
jmp 0x41ab11
cmp dword [ebp - 0x14], 1
jne 0x41aac0
push str.gd11x5.txt
mov edx, dword [ebp - 0x10]
add edx, 0xbc
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e470
add esp, 0xc
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x4c6de4
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040fec0
jmp 0x41ab11
cmp dword [ebp - 0x14], 2
jne 0x41ab11
push str._sh11x5.txt
mov eax, dword [ebp - 0x10]
add eax, 0xbc
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.0040e470
add esp, 0xc
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x4c6de4
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0040fec0
mov ecx, dword [ebp - 0x24]
movsx edx, word [ecx + 0x594c5c]
sub edx, 1
mov eax, dword [ebp - 0x24]
mov word [eax + 0x594c80], dx
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xdc
call fcn.0040ff40
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x454280
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1c98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4d7a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040e620
movzx eax, al
test eax, eax
je 0x4542d6
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040fec0
mov al, byte [ebp - 0x19]
jmp 0x4543b4
lea ecx, [ebp + 8]
call fcn.0040ff70
add eax, 0x16
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x454317
mov byte [ebp - 0x1a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040fec0
mov al, byte [ebp - 0x1a]
jmp 0x4543b4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x14
lea ecx, [ebp + 8]
call fcn.0040e5c0
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x14
push ecx
call fcn.0049a930
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.0040ff90
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x454388
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp - 0x10]
push eax
push 0xf
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x454382
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 0x10], 0
je 0x454398
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x10], 0
sete dl
mov byte [ebp - 0x1b], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040fec0
mov al, byte [ebp - 0x1b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x457be0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b21c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4d7a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
call fcn.00457ce0
test eax, eax
je 0x457c98
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x28]
call fcn.0040fe00
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040e180
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x24]
call fcn.00479b1e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp - 0x28]
push edx
call fcn.0040fe20
mov dword [ebp - 0x34], eax
call fcn.0040ab70
add esp, 8
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x74
call fcn.00472350
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00479fec
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040fec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45dbc0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0047eaa2
mov ecx, dword [ebp - 0x10]
call fcn.00457ce0
test eax, eax
je 0x45dc61
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.0040ff70
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.0040e5c0
push eax
mov edx, dword [ebp - 8]
push edx
call fcn.0049a930
add esp, 8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.0040ff90
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
push edx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
mov esp, ebp
pop ebp
ret