joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4320a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
xor eax, eax
push ebp
push 0x432390
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x47ac58], 0
je 0x43211e
cmp dword [0x4beca4], 0
je 0x432112
mov edx, 0x1948
mov eax, dword [0x4beca4]
call fcn.004026a8
xor eax, eax
mov dword [0x4beca4], eax
jmp 0x432362
mov eax, dword [0x47b5d8]
cmp byte [eax], 0
je 0x432362
mov edx, 0x1948
mov eax, 0x4beca8
call fcn.00403564
call fcn.00402874
test eax, eax
jne 0x432171
mov edx, dword [0x4beca4]
mov eax, 0x4beca8
call fcn.004036b0
call fcn.00402874
test eax, eax
mov eax, 0x4beca8
call fcn.00402fb0
call fcn.00402874
test eax, eax
jmp 0x432345
mov eax, dword [0x47b1d0]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x104]
mov eax, dword [0x47b1d0]
call fcn.00409400
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
xor eax, eax
mov al, byte [ebp - 0x100]
cmp byte [ebp + eax - 0x100], 0x5c
je 0x4321f0
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x108]
mov edx, 0x4323a4
call fcn.00404ebc
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [0x47b5d8]
cmp byte [eax], 8
jbe 0x432262
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [0x47b5d8]
mov ecx, 8
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x110]
call fcn.00404e58
mov edx, dword [ebp - 0x110]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
jmp 0x4322ad
lea eax, [ebp - 0x124]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x128]
mov edx, dword [0x47b5d8]
call fcn.00404e58
mov edx, dword [ebp - 0x128]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x12c]
mov edx, 0x4323b0
call fcn.00404ebc
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x100]
call fcn.00404e58
mov edx, dword [ebp - 0x130]
mov eax, 0x4beca8
call fcn.00402e0c
mov edx, 0x1948
mov eax, 0x4beca8
call fcn.00403564
call fcn.00402874
test eax, eax
jne 0x432345
mov edx, dword [0x4beca4]
mov eax, 0x4beca8
call fcn.004036b0
call fcn.00402874
test eax, eax
mov eax, 0x4beca8
call fcn.00402fb0
call fcn.00402874
test eax, eax
mov byte [0x47ac58], 1
mov edx, 0x1948
mov eax, dword [0x4beca4]
call fcn.004026a8
xor eax, eax
mov dword [0x4beca4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432397
lea eax, [ebp - 0x130]
mov edx, 4
call fcn.00404c18
lea eax, [ebp - 0x110]
mov edx, 4
call fcn.00404c18
ret
Function at 0x435bf8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004050b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x435c50
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47b6b8]
mov dl, 1
mov eax, dword [0x4356e0]
call fcn.0040c368
call fcn.00404654
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004357e8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x441548
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x31c], edx
mov dword [ebp - 0x320], edx
mov dword [ebp - 0x310], edx
mov dword [ebp - 0x314], edx
mov dword [ebp - 0x318], edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44173e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47b1d0]
push eax
push 0x80
call sub.kernel32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x208]
mov eax, dword [0x47b1d0]
call fcn.00409400
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x104]
mov ecx, 0xff
call fcn.00404e90
mov dword [ebp - 4], 1
push 0
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 4]
lea eax, [ebx + 0x60]
mov edx, 2
call fcn.0041a41c
lea edx, [ebp - 0x30c]
lea eax, [ebp - 0x20c]
call fcn.00404e58
lea eax, [ebp - 0x20c]
mov edx, 0x441754
call fcn.00404ebc
mov edx, dword [ebp - 0x20c]
lea eax, [ebp - 0x204]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x314]
lea edx, [ebp - 0x104]
call fcn.00404e58
push dword [ebp - 0x314]
push 0x441764
lea eax, [ebp - 0x318]
lea edx, [ebp - 0x204]
call fcn.00404e58
push dword [ebp - 0x318]
lea eax, [ebp - 0x310]
mov edx, 3
call fcn.00404f74
mov eax, dword [ebp - 0x310]
call fcn.00408d38
test al, al
je 0x441710
lea eax, [ebx + 0x5c6]
mov edx, 0x441768
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403060
je 0x4416a2
lea ecx, [ebx + 0x5c6]
lea edx, [ebp - 0x204]
mov eax, dword [0x47b3dc]
mov eax, dword [eax]
call fcn.00418650
mov eax, dword [0x47b260]
lea edi, [eax + 0x100]
mov esi, 0x44176c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x320]
lea edx, [ebp - 0x204]
call fcn.00404e58
mov ecx, dword [ebp - 0x320]
lea eax, [ebp - 0x31c]
mov edx, 0x441780
call fcn.00404f00
mov edx, dword [ebp - 0x31c]
mov eax, dword [0x47b260]
mov ecx, 0xff
call fcn.00404e90
push 0
mov dx, 0x1001
xor eax, eax
call fcn.004074f8
push eax
push 0x111
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441745
lea eax, [ebp - 0x320]
mov edx, 5
call fcn.00404c18
lea eax, [ebp - 0x20c]
mov edx, 2
call fcn.00404c18
ret
Function at 0x454dbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
xor eax, eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], eax
xor eax, eax
push ebp
push 0x455077
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4bfbe4], 0
je 0x454e14
call fcn.004550a0
mov eax, 0x208
call fcn.00402688
mov dword [0x4bfbe4], eax
mov eax, dword [0x4bfbe4]
xor ecx, ecx
mov edx, 0x208
call fcn.004031f8
lea eax, [ebp - 0x100]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x204]
lea eax, [ebp - 0x100]
call fcn.00409400
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
xor eax, eax
mov al, byte [ebp - 0x200]
cmp byte [ebp + eax - 0x200], 0x5c
je 0x454eb5
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x208]
mov edx, 0x45508c
call fcn.00404ebc
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [0x47b5d8]
cmp byte [eax], 8
jbe 0x454f27
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
mov eax, dword [0x47b5d8]
mov ecx, 8
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x220]
lea eax, [ebp - 0x210]
call fcn.00404e58
mov edx, dword [ebp - 0x210]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x20c]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
jmp 0x454f72
lea eax, [ebp - 0x224]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
mov edx, dword [0x47b5d8]
call fcn.00404e58
mov edx, dword [ebp - 0x228]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x22c]
mov edx, 0x455098
call fcn.00404ebc
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x230]
lea edx, [ebp - 0x200]
call fcn.00404e58
mov edx, dword [ebp - 0x230]
mov eax, 0x4bfbe8
call fcn.00402e0c
mov edx, 0x208
mov eax, 0x4bfbe8
call fcn.00403548
call fcn.00402874
test eax, eax
jne 0x45501c
mov byte [0x47acdc], 0
mov edx, dword [0x4bfbe4]
mov eax, 0x4bfbe8
call fcn.00403234
call fcn.00402874
test eax, eax
je 0x455009
mov byte [0x47acdc], 1
mov eax, 0x4bfbe8
call fcn.00402fb0
call fcn.00402874
test eax, eax
jmp 0x455023
mov byte [0x47acdc], 1
cmp byte [0x47acdc], 0
je 0x455049
mov ebx, 1
mov eax, ebx
shl eax, 6
add eax, ebx
mov edx, dword [0x4bfbe4]
mov byte [edx + eax - 0x2a], 0
inc ebx
cmp ebx, 9
jne 0x455031
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45507e
lea eax, [ebp - 0x230]
mov edx, 4
call fcn.00404c18
lea eax, [ebp - 0x210]
mov edx, 4
call fcn.00404c18
ret
Function at 0x4550a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
xor eax, eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], eax
xor eax, eax
push ebp
push 0x45538a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x47acdc], 0
je 0x455116
cmp dword [0x4bfbe4], 0
je 0x45510a
mov edx, 0x208
mov eax, dword [0x4bfbe4]
call fcn.004026a8
xor eax, eax
mov dword [0x4bfbe4], eax
jmp 0x45535c
mov eax, dword [0x47b5d8]
cmp byte [eax], 0
je 0x45535c
mov edx, 0x208
mov eax, 0x4bfbe8
call fcn.00403564
call fcn.00402874
test eax, eax
jne 0x455169
mov edx, dword [0x4bfbe4]
mov eax, 0x4bfbe8
call fcn.004036b0
call fcn.00402874
test eax, eax
mov eax, 0x4bfbe8
call fcn.00402fb0
call fcn.00402874
test eax, eax
jmp 0x45533f
lea eax, [ebp - 0x100]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x204]
lea eax, [ebp - 0x100]
call fcn.00409400
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
xor eax, eax
mov al, byte [ebp - 0x200]
cmp byte [ebp + eax - 0x200], 0x5c
je 0x4551ea
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x208]
mov edx, 0x4553a0
call fcn.00404ebc
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
mov eax, dword [0x47b5d8]
cmp byte [eax], 8
jbe 0x45525c
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
mov eax, dword [0x47b5d8]
mov ecx, 8
mov edx, 1
call fcn.00402798
lea edx, [ebp - 0x220]
lea eax, [ebp - 0x210]
call fcn.00404e58
mov edx, dword [ebp - 0x210]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x20c]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
jmp 0x4552a7
lea eax, [ebp - 0x224]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
mov edx, dword [0x47b5d8]
call fcn.00404e58
mov edx, dword [ebp - 0x228]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x200]
call fcn.00404e58
lea eax, [ebp - 0x22c]
mov edx, 0x4553ac
call fcn.00404ebc
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x200]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x230]
lea edx, [ebp - 0x200]
call fcn.00404e58
mov edx, dword [ebp - 0x230]
mov eax, 0x4bfbe8
call fcn.00402e0c
mov edx, 0x208
mov eax, 0x4bfbe8
call fcn.00403564
call fcn.00402874
test eax, eax
jne 0x45533f
mov edx, dword [0x4bfbe4]
mov eax, 0x4bfbe8
call fcn.004036b0
call fcn.00402874
test eax, eax
mov eax, 0x4bfbe8
call fcn.00402fb0
call fcn.00402874
test eax, eax
mov edx, 0x208
mov eax, dword [0x4bfbe4]
call fcn.004026a8
mov byte [0x47acdc], 1
xor eax, eax
mov dword [0x4bfbe4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455391
lea eax, [ebp - 0x230]
mov edx, 4
call fcn.00404c18
lea eax, [ebp - 0x210]
mov edx, 4
call fcn.00404c18
ret
Function at 0x4566cc
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov dword [esp + 4], edx
mov dword [esp], eax
test ecx, ecx
jns 0x4566e1
add ecx, 0x1f
sar ecx, 5
inc ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 1
mov ebp, dword [esp]
add ebp, 0x57
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0xc]
je 0x45670b
cmp byte [ebp], 0
je 0x456894
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0xc]
jne 0x45672b
xor eax, eax
mov al, byte [ebp]
cmp eax, dword [esp + 4]
je 0x456894
mov al, byte [esp + 4]
mov byte [ebp], al
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0xc]
je 0x456739
mov byte [ebp], 0
xor eax, eax
mov al, byte [ebp]
mov eax, dword [eax*4 + 0x47ad60]
mov dword [esp + 0x20], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_GetDC
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov edi, eax
push 0x20
push 0x20
mov eax, dword [esp + 0x18]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov dword [esp + 0x18], eax
push 0xcc0020
push 0
mov eax, dword [esp + 0x14]
dec eax
shl eax, 5
push eax
mov eax, dword [esp + 0x1c]
push eax
push 0x20
push 0x20
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
push 0x10
push 0
push edi
call sub.gdi32.dll_GetPixel
mov dword [esp + 0x1c], eax
xor esi, esi
xor ebx, ebx
push ebx
push esi
push edi
call sub.gdi32.dll_GetPixel
cmp eax, dword [esp + 0x1c]
je 0x4567d6
mov eax, dword [esp + 0x20]
push eax
push ebx
push esi
push edi
call sub.gdi32.dll_SetPixel
inc ebx
cmp ebx, 0x20
jne 0x4567bb
inc esi
cmp esi, 0x20
jne 0x4567b9
push 0xcc0020
push 0
push 0
push edi
push 0x20
push 0x20
push 0
mov eax, dword [esp + 0x28]
dec eax
shl eax, 5
push eax
mov eax, dword [esp + 0x30]
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [esp + 0x18]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov eax, dword [esp + 0x14]
push eax
call sub.gdi32.dll_DeleteObject
push edi
call sub.gdi32.dll_DeleteObject
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_ReleaseDC
cmp byte [ebp], 2
jne 0x45686a
push 0
mov eax, dword [esp + 0xc]
mov ax, word [eax*2 + 0x47ad42]
mov dx, 1
call fcn.004074f8
push eax
push 0x111
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_PostMessageA
call fcn.00456238
cmp dword [0x47ad6c], 0
jne 0x456894
mov dword [0x47ad6c], 0x1c7
push 0
push 0x64
mov eax, dword [0x47ad6c]
push eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_SetTimer
inc dword [esp + 0xc]
inc ebp
cmp dword [esp + 0xc], 0xe
jne 0x4566f7
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45e83c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc9c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x364], edx
mov dword [ebp - 0x35c], edx
mov dword [ebp - 0x360], edx
mov dword [ebp - 0x34c], edx
mov dword [ebp - 0x348], edx
mov dword [ebp - 0x344], edx
mov dword [ebp - 0x340], edx
mov dword [ebp - 0x33c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45eaf9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x33c]
mov eax, dword [ebx + 0x30]
add eax, 0x1d
call fcn.00409400
lea eax, [ebp - 0x33c]
mov edx, 0x45eb10
call fcn.00404ebc
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x340]
lea edx, [ebp - 0x100]
call fcn.00404e58
mov edx, dword [ebp - 0x340]
lea eax, [ebp - 0x300]
call fcn.00409294
mov esi, dword [ebx + 0x30]
cmp dword [esi + 0x11], 0x2bc
jne 0x45e926
lea eax, [ebp - 0x344]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x344]
mov edx, 0x45eb1c
call fcn.00404ebc
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
cmp byte [esi + 0x15], 0
jbe 0x45e963
lea eax, [ebp - 0x348]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x348]
mov edx, 0x45eb28
call fcn.00404ebc
mov edx, dword [ebp - 0x348]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x34c]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x34c]
mov edx, 0x45eb10
call fcn.00404ebc
mov edx, dword [ebp - 0x34c]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
push 1
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x3d]
push eax
push 0x30
mov eax, ebx
mov edx, 0xc9
call fcn.0040e4c4
push eax
call sub.user32.dll_SendMessageA
mov eax, ebx
mov edx, 0xc9
call fcn.0040e4c4
push eax
call sub.user32.dll_GetDC
mov esi, eax
lea eax, [ebp - 0x338]
push eax
push esi
call sub.gdi32.dll_GetTextMetricsA
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebp - 0x350], eax
fild dword [ebp - 0x350]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 1]
mov edi, dword [ebp - 0x338]
imul edi
mov dword [ebp - 0x354], eax
fild dword [ebp - 0x354]
add edi, dword [ebp - 0x328]
mov dword [ebp - 0x358], edi
fild dword [ebp - 0x358]
fdivp st(1)
fmul dword [0x45eb2c]
fdivrp st(1)
call fcn.00402b10
mov edi, eax
push esi
mov eax, ebx
mov edx, 0xc9
call fcn.0040e4c4
push eax
call sub.user32.dll_ReleaseDC
lea edx, [ebp - 0x200]
mov eax, edi
call fcn.004035d0
lea eax, [ebp - 0x35c]
lea edx, [ebp - 0x100]
call fcn.00404e58
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x360]
lea edx, [ebp - 0x200]
call fcn.00404e58
mov edx, dword [ebp - 0x360]
pop eax
call fcn.00404ebc
mov edx, dword [ebp - 0x35c]
lea eax, [ebp - 0x100]
mov ecx, 0xff
call fcn.00404e90
lea eax, [ebp - 0x364]
lea edx, [ebp - 0x100]
call fcn.00404e58
mov edx, dword [ebp - 0x364]
lea eax, [ebp - 0x300]
call fcn.00409294
lea eax, [ebp - 0x300]
push eax
push 0xc9
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_SetDlgItemTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45eb00
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.00404c18
lea eax, [ebp - 0x34c]
mov edx, 5
call fcn.00404c18
ret
Function at 0x46b170
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x46b38e
push 3
push 0x47ae28
call sub.user32.dll_GetPriorityClipboardFormat
cmp eax, 0xffff
jbe 0x46b1a3
call fcn.004040a8
cmp ax, 7
sete byte [ebp - 0xd]
cmp ax, 0xd
sete byte [ebp - 5]
movzx eax, ax
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46b389
mov eax, esi
mov dl, 1
call fcn.0046aba4
mov byte [esi + 0x687], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 4], eax
lea ecx, [esi + 0x486]
mov edx, dword [esi + 0x477]
mov eax, esi
call fcn.00469fa0
mov eax, esi
call fcn.0046a418
jmp 0x46b250
call sub.user32.dll_CloseClipboard
Function at 0x46d100
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov ebx, eax
push pe_nt_image_headers32
mov eax, dword [0x47b1d0]
push eax
push 0xca
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_GetDlgItemTextA
mov eax, dword [0x47b1d0]
cmp byte [eax], 0
je 0x46d194
mov eax, dword [0x47b1d0]
cmp byte [eax], 0x3f
jne 0x46d13b
mov eax, dword [0x47b1d0]
cmp byte [eax + 1], 0
je 0x46d194
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x46d194
call sub.user32.dll_EmptyClipboard
mov eax, dword [0x47b1d0]
call fcn.004091fc
inc eax
push eax
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x46d18f
push ebx
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x47b1d0]
call fcn.00409238
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x46d18f
push ebx
call sub.kernel32.dll_GlobalFree
call sub.user32.dll_CloseClipboard
pop ebx
ret
Function at 0x4774a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, edx
mov ebx, eax
push 1
push 0x277
push esi
call sub.user32.dll_EnableMenuItem
push 1
push 0x278
push esi
call sub.user32.dll_EnableMenuItem
push 1
push 0x279
push esi
call sub.user32.dll_EnableMenuItem
push 1
push 0x281
push esi
call sub.user32.dll_EnableMenuItem
mov eax, ebx
call fcn.00477944
test eax, eax
jle 0x477638
push 0
push 0x193
mov eax, dword [ebx + 0x47]
push eax
call sub.user32.dll_EnableMenuItem
push 0
push 0x194
mov eax, dword [ebx + 0x47]
push eax
call sub.user32.dll_EnableMenuItem
mov eax, dword [0x47b1ac]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x477638
mov edx, dword [0x47b1d0]
mov eax, dword [0x47b1ac]
mov eax, dword [eax]
call fcn.0047712c
mov edx, dword [0x47b610]
mov edx, dword [edx]
mov eax, dword [0x47b1d0]
call fcn.004092d4
test eax, eax
je 0x47756b
mov edx, dword [0x47b5a4]
mov edx, dword [edx]
mov eax, dword [0x47b1d0]
call fcn.004092d4
test eax, eax
je 0x47756b
push 0
push 0x281
push esi
call sub.user32.dll_EnableMenuItem
mov eax, ebx
call fcn.0047796c
mov edi, eax
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
test eax, eax
je 0x4775a7
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xdc]
test eax, 4
jle 0x4775a7
push 0
push 0x279
push esi
call sub.user32.dll_EnableMenuItem
mov ebp, edi
mov eax, ebp
mov edx, dword [eax]
call dword [edx + 0xdc]
test eax, 1
jle 0x4775c8
push 0
push 0x277
push esi
call sub.user32.dll_EnableMenuItem
mov eax, ebp
mov edx, dword [eax]
call dword [edx + 0xdc]
test eax, 2
jle 0x4775e7
push 0
push 0x278
push esi
call sub.user32.dll_EnableMenuItem
call sub.user32.dll_CloseClipboard
mov edx, dword [0x47b344]
mov edx, dword [edx]
mov eax, dword [0x47b1d0]
call fcn.004092d4
test eax, eax
jne 0x477612
push 1
push 0x193
mov eax, dword [ebx + 0x47]
push eax
call sub.user32.dll_EnableMenuItem
mov edx, dword [0x47b344]
mov edx, dword [edx]
mov eax, dword [0x47b1d0]
call fcn.004092d4
test eax, eax
jne 0x477638
push 1
push 0x194
mov eax, dword [ebx + 0x47]
push eax
call sub.user32.dll_EnableMenuItem
mov eax, ebx
call fcn.00477944
test eax, eax
jne 0x477653
push 1
push 0x193
mov eax, dword [ebx + 0x47]
push eax
call sub.user32.dll_EnableMenuItem
mov eax, ebx
call fcn.00477944
test eax, eax
jne 0x47766e
push 1
push 0x194
mov eax, dword [ebx + 0x47]
push eax
call sub.user32.dll_EnableMenuItem
pop ebp
pop edi
pop esi
pop ebx
ret