joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bb33
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
nop
push 0
push 0
push 0xe
push edi
call sub.USER32.DLL_SendMessageA
mov esi, eax
push 1
mov eax, esi
inc eax
push eax
call fcn.0045bd81
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x41bb66
mov eax, 0
jmp 0x41bb75
push ebx
mov eax, esi
inc eax
push eax
push 0xd
push edi
call sub.USER32.DLL_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41bbc3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
lea edi, [ebp - 0x34]
nop
push dword [ebp + 8]
lea eax, [ebp - 0x33c]
push eax
call fcn.0045f361
add esp, 8
push 0x2e
lea eax, [ebp - 0x33c]
push eax
call fcn.00460545
add esp, 8
mov dword [ebp - 0x3c], eax
push str..bak
lea eax, [ebp - 0x33c]
push eax
call fcn.0045f2e4
add esp, 8
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41bcf5
push edi
push ebx
call sub.KERNEL32.DLL_GetFileInformationByHandle
test eax, eax
jne 0x41bc45
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x41bcf5
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x33c]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x41bc86
push str.Backup_file_is_not_writeable
push 0x11000
push str.File_Error
call fcn.00401735
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x41bcf5
jmp 0x41bccf
push 0
lea eax, [ebp - 0x348]
push eax
push 0x200
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x41bcb1
mov eax, dword [ebp - 0x348]
test eax, eax
jne 0x41bcb3
jmp 0x41bcd1
push 0
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x348]
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.DLL_WriteFile
jmp 0x41bc88
mov eax, edi
add eax, 0x14
push eax
mov eax, edi
add eax, 0xc
push eax
mov eax, edi
add eax, 4
push eax
push esi
call sub.KERNEL32.DLL_SetFileTime
push esi
call sub.KERNEL32.DLL_CloseHandle
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bded
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
nop
push 0x4728eb
mov eax, esi
add eax, 0x110
push eax
call fcn.0045cdd9
add esp, 8
mov ebx, eax
and dword [esi + 0x238], 0xffffffef
test ebx, ebx
jne 0x41be3a
or dword [esi + 0x238], 0x10
push 5
push dword [esi + 0x214]
call sub.USER32.DLL_ShowWindow
mov eax, 0
jmp 0x41bf79
push 2
push 0
push ebx
call fcn.0045d58a
add esp, 0xc
push ebx
call fcn.0045d63b
pop ecx
mov dword [ebp - 0xc], eax
push 1
mov eax, dword [ebp - 0xc]
inc eax
push eax
call fcn.0045bd81
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41be8f
or dword [esi + 0x238], 0x10
push ebx
call fcn.0045c39e
pop ecx
push 5
push dword [esi + 0x214]
call sub.USER32.DLL_ShowWindow
mov eax, 0
jmp 0x41bf79
push 0
push 0
push ebx
call fcn.0045d58a
add esp, 0xc
push ebx
push dword [ebp - 0xc]
push 1
push dword [ebp - 8]
call fcn.0045d3af
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x41bebe
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov byte [eax + ecx], 0
push ebx
call fcn.0045c39e
pop ecx
mov eax, dword [ebp - 8]
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x41befd
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0xd
je 0x41bef3
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
mov al, byte [eax]
mov ecx, edi
inc edi
mov byte [ecx], al
jmp 0x41befd
or dword [esi + 0x238], 0x10
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov al, byte [eax]
test al, al
jne 0x41bed9
mov byte [edi], 0
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0041bb8f
add esp, 0xc
push 0
push 0
push 0xb9
push dword [esi + 0x214]
call sub.USER32.DLL_SendMessageA
push esi
call fcn.0041c999
pop ecx
mov eax, esi
add eax, 0x110
push eax
call fcn.0041adf3
pop ecx
and eax, 1
je 0x41bf5c
push 0
push 1
push 0xcf
push dword [esi + 0x214]
call sub.USER32.DLL_SendMessageA
mov eax, esi
add eax, 0x110
push eax
mov eax, esi
add eax, 0x21c
push eax
call fcn.0043557b
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bf80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
lea ebx, [ebp - 0x10c]
lea edi, [ebp - 0x214]
nop
push 0
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowLongA
mov esi, eax
push 0
push 0
push 0x2797
push dword [esi + 0x214]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 8], eax
push 0
push 0
push 0xb8
push dword [esi + 0x214]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 4], eax
mov eax, esi
add eax, 0x110
push eax
push ebx
call fcn.0045f361
add esp, 8
movsx eax, byte [ebx]
test eax, eax
jne 0x41bffa
mov eax, esi
add eax, 0xc
push eax
push ebx
call fcn.0045f361
add esp, 8
mov eax, dword [0x4949a4]
test eax, eax
je 0x41c023
mov eax, dword [0x4949a4]
add eax, 0x11c
push eax
push ebx
call fcn.004439d7
add esp, 8
push eax
push ebx
call fcn.0045f361
add esp, 8
jmp 0x41c053
mov byte [edi], 0
push edi
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push str.hithere
push edi
call fcn.0045f2e4
add esp, 8
push edi
push ebx
call fcn.004439d7
add esp, 8
push eax
push ebx
call fcn.0045f361
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x41c07c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
inc eax
push eax
push str.___d_
push ebx
call fcn.0046038e
pop ecx
add eax, ebx
push eax
call fcn.0045eeda
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x41c091
push 0x4728d9
push ebx
call fcn.0045f2e4
add esp, 8
push ebx
push 0
push 0xc
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
push dword [ebp + 8]
push dword [ebp - 4]
push 0x406
push dword [0x478678]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e2c1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea esi, [ebp - 0x28]
nop
push 0x28
push 0
push esi
call fcn.0045e1bd
add esp, 0xc
mov dword [esi], 8
mov dword [esi + 4], 0x41ce50
mov dword [esi + 8], 0
mov dword [esi + 0xc], 8
mov eax, dword [0x478670]
mov dword [esi + 0x10], eax
push 0x7f00
push 0
call sub.USER32.DLL_LoadIconA
mov dword [esi + 0x14], eax
push 0x7f00
push 0
call sub.USER32.DLL_LoadCursorA
mov dword [esi + 0x18], eax
push 0
call sub.GDI32.DLL_GetStockObject
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], str.xccDrawClass
push esi
call sub.USER32.DLL_RegisterClassA
push str.ID_TAG
push dword [0x478670]
call sub.USER32.DLL_LoadBitmapA
mov ebx, eax
push 0xf
call fcn.0041e7cf
pop ecx
push eax
push 0xc0c0c0
push ebx
call fcn.0041e7fd
add esp, 0xc
push 0
push 9
push 0x18
push 0x10
push 0x10
call sub.comctl32.DLL_ImageList_Create
mov dword [0x48e790], eax
push 0
push ebx
push dword [0x48e790]
call sub.comctl32.DLL_ImageList_Add
push ebx
call sub.GDI32.DLL_DeleteObject
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x48e79c], eax
push 0x48e774
call sub.KERNEL32.DLL_InitializeCriticalSection
push 0
push 1
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x48e770], eax
push 0x48e798
push 0
push 0
push 0x41cdcb
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41eb51
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
nop
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
call sub.KERNEL32.DLL_GetVersion
cmp eax, 6
jbe 0x41ece5
lea eax, [ebp - 0x4c]
push eax
push 0x18
push dword [ebp + 8]
call sub.GDI32.DLL_GetObjectA
push 0
call sub.USER32.DLL_GetDC
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x41ecdd
push dword [ebp - 0x5c]
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0x58], eax
test eax, eax
je 0x41ecd3
push dword [ebp - 0x5c]
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0x54], eax
test eax, eax
je 0x41eccb
push 0x2c
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.0045e1bd
add esp, 0xc
mov dword [ebp - 0x30], 0x28
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], 1
mov word [ebp - 0x22], 0x20
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x44]
shl eax, 2
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x54]
call sub.GDI32.DLL_CreateDIBSection
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push dword [ebp - 0x54]
call sub.GDI32.DLL_SelectObject
push dword [ebp + 8]
push dword [ebp - 0x58]
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x64], eax
mov edi, 0
jmp 0x41ecb0
mov esi, 0
jmp 0x41ecaa
mov eax, dword [ebp - 0x44]
sub eax, esi
dec eax
push eax
push edi
push dword [ebp - 0x58]
call sub.GDI32.DLL_GetPixel
mov ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x41ec6f
mov eax, dword [ebp - 0x48]
imul eax, esi
add eax, edi
lea eax, [eax*4]
mov ecx, dword [ebp - 0x64]
mov dword [eax + ecx], 0
jmp 0x41eca9
mov eax, ebx
movzx eax, al
shl eax, 0x10
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
add eax, ecx
mov ecx, ebx
and ecx, 0xff00
add eax, ecx
mov ebx, eax
mov eax, ebx
or eax, 0xff000000
mov ecx, dword [ebp - 0x48]
imul ecx, esi
add ecx, edi
lea ecx, [ecx*4]
mov edx, dword [ebp - 0x64]
mov dword [ecx + edx], eax
inc esi
cmp esi, dword [ebp - 0x44]
jl 0x41ec3d
inc edi
cmp edi, dword [ebp - 0x48]
jl 0x41ec36
push dword [ebp - 0x50]
push dword [ebp - 0x58]
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x50], eax
push dword [ebp - 0x54]
call sub.GDI32.DLL_DeleteDC
push dword [ebp - 0x58]
call sub.GDI32.DLL_DeleteDC
push dword [ebp - 0x5c]
push 0
call sub.USER32.DLL_ReleaseDC
push dword [ebp + 8]
call sub.GDI32.DLL_DeleteObject
mov eax, dword [ebp - 0x34]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422fad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
nop
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 8]
push 0x422e0d
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4235cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
nop
mov edi, 0x48ef80
push 0x24
push 1
call fcn.0045bd81
add esp, 8
mov esi, eax
mov dword [ebp - 0x108], 0
jmp 0x423609
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x423607
inc dword [ebp - 0x108]
mov edi, dword [edi]
mov eax, dword [edi]
test eax, eax
jne 0x4235f8
mov eax, dword [ebp - 0x108]
cmp eax, 0x14
jl 0x423628
push dword [ebp + 8]
call fcn.00423572
pop ecx
jmp 0x42370a
mov eax, dword [0x4949a8]
test eax, eax
je 0x423680
mov eax, dword [0x4949a8]
mov eax, dword [eax + 8]
test eax, eax
je 0x423680
push str.Default.cwa
lea eax, [ebp - 0x104]
push eax
call fcn.0045f361
add esp, 8
push 0x5c
lea eax, [ebp - 0x104]
push eax
call fcn.00460545
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x42366d
mov byte [ebx], 0
jmp 0x42367e
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x423691
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [esi + 0x20], 1
push 0x472ce0
call fcn.0045f379
pop ecx
mov dword [esi + 4], eax
push 0x472ce0
call fcn.0045f379
pop ecx
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x104]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 8], eax
mov eax, dword [0x46a974]
inc dword [0x46a974]
push eax
push str.New_Tool__d
lea eax, [ebp - 0x104]
push eax
call fcn.0045eeda
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.0045f379
pop ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 1
mov dword [esi + 0x14], 0
mov dword [edi], esi
mov eax, dword [ebp - 0x108]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425e68
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
nop
push dword [ebp + 0x14]
call fcn.0041ac22
pop ecx
mov esi, eax
test esi, esi
jne 0x425ef3
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x425ef1
push 1
push 0x239
call fcn.0045bd81
add esp, 8
mov esi, eax
push dword [ebp + 0x14]
mov eax, esi
add eax, 0x110
push eax
call fcn.0045f361
add esp, 8
or dword [esi + 0x238], 8
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [esi + 0x234], eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x425f0a
push 0
push 0
push 0xe
push dword [esi + 0x214]
call sub.USER32.DLL_SendMessageA
mov dword [esi + 0x234], eax
test esi, esi
je 0x425f52
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jl 0x425f39
mov eax, dword [edi]
test eax, eax
jne 0x425f25
mov dword [edi], 0x64
jmp 0x425f27
shl dword [edi], 1
mov eax, dword [edi]
shl eax, 2
push eax
push dword [ebx]
call fcn.0045e72a
add esp, 8
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
je 0x425f52
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
inc dword [ecx]
lea eax, [eax*4]
mov ecx, dword [ebx]
mov dword [eax + ecx], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426039
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
lea esi, [ebp - 0x140]
mov edi, dword [ebp + 0xc]
nop
push dword [ebp + 8]
lea eax, [ebp - 0x244]
push eax
call fcn.0045f361
add esp, 8
push str..
lea eax, [ebp - 0x244]
push eax
call fcn.0045f2e4
add esp, 8
push esi
lea eax, [ebp - 0x244]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42614d
mov eax, esi
add eax, 0x2c
push eax
push dword [ebp + 8]
push 0x472f05
lea eax, [ebp - 0x34c]
push eax
call fcn.0045eeda
add esp, 0x10
mov eax, dword [esi]
and eax, 0x10
je 0x4260f6
mov eax, dword [ebp + 0x10]
and eax, 0x200
je 0x4260f4
movsx eax, byte [esi + 0x2c]
cmp eax, 0x2e
jne 0x4260dd
movsx eax, byte [esi + 0x2d]
test eax, eax
je 0x4260f4
movsx eax, byte [esi + 0x2d]
cmp eax, 0x2e
jne 0x4260dd
movsx eax, byte [esi + 0x2e]
test eax, eax
je 0x4260f4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
lea eax, [ebp - 0x34c]
push eax
call fcn.00426039
add esp, 0x10
jmp 0x42612f
push dword [ebp + 0x14]
mov eax, esi
add eax, 0x2c
push eax
call fcn.00425d0c
add esp, 8
test eax, eax
je 0x42612f
lea eax, [ebp - 0x34c]
push eax
lea eax, [0x4922b0]
push eax
lea eax, [0x4922b4]
push eax
lea eax, [0x4922b8]
push eax
call fcn.00425e68
add esp, 0x10
push esi
push ebx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
je 0x426147
mov eax, dword [0x46abf8]
test eax, eax
je 0x42608d
push ebx
call sub.KERNEL32.DLL_FindClose
test edi, edi
je 0x426190
push edi
push dword [0x4922b4]
push dword [0x4922b8]
call fcn.00425ded
add esp, 0xc
push dword [0x4922b8]
call fcn.0045d549
pop ecx
mov dword [0x4922b0], 0
mov dword [0x4922b4], 0
mov dword [0x4922b8], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x426227
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
nop
mov eax, dword [ebp + 8]
push dword [eax + 0x218]
call sub.USER32.DLL_IsWindow
test eax, eax
je 0x42628e
push 0
push 0
push 0xe
mov eax, dword [ebp + 8]
push dword [eax + 0x214]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42628c
mov eax, dword [ebp - 4]
inc eax
push eax
push 1
call fcn.0045bd81
add esp, 8
mov esi, eax
test esi, esi
je 0x42628c
push esi
mov eax, dword [ebp - 4]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
push dword [eax + 0x214]
call sub.USER32.DLL_SendMessageA
jmp 0x4262f8
push 0x472f03
mov eax, dword [ebp + 8]
add eax, 0x110
push eax
call fcn.0045cdd9
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4262f8
push 2
push 0
push ebx
call fcn.0045d58a
add esp, 0xc
push ebx
call fcn.0045d63b
pop ecx
mov edi, eax
push 0
push 0
push ebx
call fcn.0045d58a
add esp, 0xc
mov eax, edi
inc eax
push eax
push 1
call fcn.0045bd81
add esp, 8
mov esi, eax
test esi, esi
je 0x4262f1
push ebx
mov eax, edi
inc eax
push eax
push 1
push esi
call fcn.0045d3af
add esp, 0x10
push ebx
call fcn.0045c39e
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42929d
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
nop
push dword [ebp + 8]
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x429349
mov dword [ebp - 8], 0
mov esi, dword [ebp + 0xc]
push dword [ebp + 0xc]
call fcn.0046038e
pop ecx
mov dword [ebp - 4], eax
jmp 0x4292d3
inc dword [ebp - 8]
inc esi
push 0xa
push esi
call fcn.0045f327
add esp, 8
mov esi, eax
test eax, eax
jne 0x4292cf
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
inc eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x429344
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
jmp 0x429323
movsx eax, byte [esi]
cmp eax, 0xa
jne 0x42931b
mov eax, edi
inc edi
mov byte [eax], 0xd
mov al, byte [esi]
mov ecx, edi
inc edi
mov byte [ecx], al
inc esi
mov al, byte [esi]
test al, al
jne 0x42930d
mov eax, edi
inc edi
mov byte [eax], 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_EmptyClipboard
push ebx
push 1
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x429553
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
nop
push 0
push 0
push 0xe
push esi
call sub.USER32.DLL_SendMessageA
mov edi, eax
mov eax, edi
inc eax
push eax
call fcn.0045dfee
pop ecx
mov ebx, eax
test ebx, ebx
je 0x429599
push ebx
mov eax, edi
inc eax
push eax
push 0xd
push esi
call sub.USER32.DLL_SendMessageA
push ebx
push esi
call fcn.0042929d
add esp, 8
push ebx
call fcn.0045d549
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x42a35c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
nop
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push dword [0x46ad00]
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42a394
mov eax, 0
jmp 0x42a3b5
push 0
lea eax, [ebp - 4]
push eax
push esi
call fcn.0046038e
pop ecx
inc eax
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a63b
Capabilities:
Create mailslot
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
nop
push 0
push 0xffffffffffffffff
push 0
push dword [0x46ad00]
call sub.KERNEL32.DLL_CreateMailslotA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42a664
mov eax, 0
jmp 0x42a68a
mov dword [0x492934], ebx
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x42a549
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433e5c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
nop
mov dword [0x492c64], 0
call fcn.0041b9fc
push 0
push dword [0x4949a8]
call fcn.0043c90a
add esp, 8
mov eax, dword [ebp + 0xc]
or dword [esi + 0x45c], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push fcn.00433d5e
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433f6b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
nop
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x433eb3
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434bcc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
nop
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov dword [ebp - 4], eax
mov ebx, eax
test ebx, ebx
je 0x434c2d
jmp 0x434c1f
mov edi, ebx
push 0x3d
mov eax, ebx
inc eax
push eax
call fcn.0045f327
add esp, 8
mov esi, eax
mov al, byte [esi]
test al, al
je 0x434c15
mov byte [esi], 0
push 0
push 1
mov eax, esi
inc eax
push eax
push edi
call fcn.00434943
add esp, 0x10
mov byte [esi], 0x3d
push ebx
call fcn.0046038e
pop ecx
inc eax
add ebx, eax
mov al, byte [ebx]
test al, al
jne 0x434be6
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434fc2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x104]
nop
push ebx
push edi
call fcn.0045f361
add esp, 8
push 0x5c
push edi
call fcn.00460545
add esp, 8
mov esi, eax
test esi, esi
je 0x434fff
mov byte [esi], 0
push edi
call fcn.00434fc2
pop ecx
jmp 0x435006
mov eax, 0
jmp 0x435013
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryA
mov eax, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43501a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
nop
push 0
push dword [ebp + 8]
push str.OUTPUTDIR
call fcn.00434843
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x435058
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x435058
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0x435058
push ebx
call fcn.00434fc2
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4351de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x492c78
nop
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
push ebx
call fcn.0046038e
pop ecx
dec eax
movsx eax, byte [eax + ebx]
cmp eax, 0x5c
je 0x435214
push 0x473626
push ebx
call fcn.0045f2e4
add esp, 8
push str.___CC386.TMP
push ebx
call fcn.0045f2e4
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret