joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4280fb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, ecx
mov dword [ebp - 4], edx
mov esi, 0x1697a48
mov al, byte [edi]
test al, al
je 0x428282
push ebx
lea ebx, [edi + 1]
cmp al, 0x25
jne 0x428272
cmp byte [ebx], al
jne 0x42816b
lea eax, [edi + 2]
push 0x25
push eax
call fcn.0044eac0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x428168
cmp byte [edi + 1], 0x25
jne 0x428168
push 0x81
push esi
push ebx
mov byte [edi + 1], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x428160
cmp eax, 0x80
jae 0x428160
dec esi
add esi, eax
add edi, 2
jmp 0x42826d
mov edx, dword [ebp - 4]
mov edi, ebx
mov cl, byte [edi]
cmp cl, 0x25
je 0x428263
mov edx, dword [edx + 0x10]
test edx, edx
jne 0x42818d
cmp cl, 0x30
jl 0x4281bd
cmp cl, 0x39
jle 0x428263
cmp cl, 0x30
jne 0x4281bd
mov ecx, dword [edx + 0x1c]
inc edi
add ecx, 8
cmp dword [ecx + 0x14], 0x10
jb 0x4281a1
mov ecx, dword [ecx]
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4281a5
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4281b4
jmp 0x428210
lea eax, [ecx - 0x31]
cmp al, 8
ja 0x428216
mov eax, dword [edx + 0x1c]
inc edi
movsx ecx, cl
sub ecx, 0x30
cmp ecx, dword [eax + 4]
jbe 0x4281da
mov ecx, 0x476c8d
jmp 0x4281f6
mov eax, dword [eax]
mov eax, dword [eax]
cmp ecx, 1
jbe 0x4281eb
dec ecx
mov eax, dword [eax]
sub ecx, 1
jne 0x4281e4
lea ecx, [eax + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x4281f6
mov ecx, dword [ecx]
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4281fa
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x428209
sub ecx, edx
add esi, ecx
jmp 0x42826d
push 0x25
push edi
call fcn.0044eac0
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x42822e
mov edx, dword [ebp - 4]
mov byte [esi], 0x25
jmp 0x428276
mov ecx, dword [ebp - 4]
push edi
mov byte [ebx], 0
call fcn.004267d6
mov ecx, eax
test ecx, ecx
je 0x42825e
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x428244
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x428253
sub ecx, edx
add esi, ecx
lea edi, [ebx + 1]
jmp 0x42826d
mov byte [esi], 0x25
mov byte [esi + 1], cl
add esi, 2
inc edi
mov edx, dword [ebp - 4]
jmp 0x428277
mov byte [esi], al
mov edi, ebx
inc esi
mov al, byte [edi]
test al, al
jne 0x428119
pop ebx
mov ecx, 0x1697a48
mov byte [esi], 0
call fcn.0043a9db
mov ecx, eax
call fcn.0043a9c3
pop edi
pop esi
leave
ret 4
Function at 0x42b42f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
lea edx, [ebp - 0x204]
push ebx
push edi
mov edi, ecx
sub edx, edi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x42b444
lea eax, [ebp - 0x204]
push 0x5c
push eax
call fcn.0044f1f0
pop ecx
pop ecx
test eax, eax
je 0x42b465
inc eax
jmp 0x42b46b
lea eax, [ebp - 0x204]
push 0x2e
push eax
call fcn.0044f1f0
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x42b499
lea ecx, [ebp - 0x204]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x42b482
mov eax, dword [str..ttf]
mov dword [ecx], eax
mov al, byte [0x477ad8]
mov byte [ecx + 4], al
push esi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42b53c
push 0x1ff
lea eax, [ebp - 0x204]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x204]
push 0x5c
push eax
call fcn.0044f1f0
pop ecx
pop ecx
xor ecx, ecx
inc ecx
sub ecx, edi
add ecx, eax
mov al, byte [edi]
mov byte [ecx + edi], al
inc edi
test al, al
jne 0x42b4ec
test ebx, ebx
jne 0x42b518
lea ecx, [ebp - 0x204]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x42b501
mov eax, dword [str..ttf]
mov dword [ecx], eax
mov al, byte [0x477ad8]
mov byte [ecx + 4], al
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42b597
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x42b590
push edi
call fcn.00458093
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42b590
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42b589
cmp dword [ebp - 4], edi
jne 0x42b589
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov dword [0x497430], edi
pop edi
mov dword [0x497434], ebx
pop ebx
leave
ret
push ebx
call fcn.00453504
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, str.could_not_load_font_file
mov ecx, str.FONT
call fcn.0042e9d8
int3
Function at 0x42b87e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x15d4e0c]
push ebx
mov ebx, dword [0x15d4e3c]
push esi
mov esi, dword [0x15d4e38]
push edi
mov edi, dword [0x15d4e44]
push dword [0x4a9f4c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42b9b5
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x42b9af
mov eax, dword [ebp - 8]
sub ebx, esi
sub eax, edi
inc ebx
mov dword [ebp - 0x18], eax
xor edi, edi
add eax, 3
imul ebx, eax
lea eax, [ebx*2 - 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x42b9af
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
test edx, edx
je 0x42b9af
cmp esi, dword [ebp - 4]
jg 0x42b997
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [0x499458]
imul eax, esi
add eax, ecx
lea eax, [eax*2 + 0x499470]
mov dword [ebp - 0x20], eax
mov eax, edi
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 8]
jg 0x42b974
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
inc eax
mov ebx, eax
mov cl, byte [esi]
lea esi, [esi + 2]
movzx eax, cl
mov ax, word [eax*2 + 0x48ec30]
mov word [edx + edi*2], ax
inc edi
cmp cl, 0x20
je 0x42b963
mov eax, edi
mov dword [ebp - 0xc], eax
jmp 0x42b966
mov eax, dword [ebp - 0xc]
sub ebx, 1
jne 0x42b942
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edi, eax
cmp esi, ebx
je 0x42b98c
push 0xd
pop edi
mov word [edx + eax*2], di
push 0xa
pop edi
mov word [edx + eax*2 + 2], di
lea edi, [eax + 2]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, ebx
jle 0x42b91b
mov ebx, dword [ebp - 0x24]
push ebx
xor eax, eax
push 0xd
mov word [edx + edi*2], ax
pop eax
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42de22
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
imul esi, edx
push edi
cmp dword [0x1697ee4], ecx
jne 0x42de3f
cmp dword [0x1697ee8], edx
je 0x42de7f
mov dword [0x1697ee4], ecx
mov dword [0x1697ee8], edx
cmp dword [0x16979b8], esi
jge 0x42de7f
mov eax, dword [0x1697eec]
test eax, eax
je 0x42de63
push eax
call fcn.00453504
pop ecx
push esi
call fcn.00458093
mov dword [0x1697eec], eax
pop ecx
test eax, eax
je 0x42df74
mov dword [0x16979b8], esi
jmp 0x42de84
mov eax, dword [0x1697eec]
push esi
push 0
push eax
call fcn.004500b0
mov eax, dword [0x4a18bc]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 8]
test eax, eax
jle 0x42debe
mov edx, 0x4a18c4
cmp dword [edx - 4], esi
jne 0x42deb3
cmp dword [edx], ecx
je 0x42df62
inc edi
add edx, 0x408
cmp edi, eax
jl 0x42dea6
cmp eax, 0x20
jge 0x42dec9
inc eax
mov dword [0x4a18bc], eax
xor edi, edi
imul eax, dword [0x4a99c0], 0x408
mov dword [ebp - 0x14], eax
lea eax, [eax + 0x4a18c8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
xor ecx, ecx
mov esi, eax
mov dl, byte [ebp + ecx + 0xc]
movzx eax, byte [ebp + ecx + 8]
mov byte [ebp - 1], dl
movzx edx, dl
sub eax, edx
mov dword [ebp - 0xc], 0xff
imul eax, edi
cdq
idiv dword [ebp - 0xc]
add al, byte [ebp - 1]
inc ecx
mov byte [esi], al
inc esi
cmp ecx, 3
jl 0x42dee8
mov eax, dword [ebp - 8]
inc edi
add eax, 4
mov dword [ebp - 8], eax
cmp edi, 0x100
jl 0x42dee4
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [0x1697ee0], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x4a18c0], esi
mov dword [eax + 0x4a18c4], ecx
mov eax, dword [0x4a99c0]
inc eax
and eax, 0x8000001f
jns 0x42df54
dec eax
or eax, 0xffffffe0
inc eax
mov dword [0x4a99c0], eax
pop edi
mov eax, 0x1697ee0
pop esi
leave
ret
imul eax, edi, 0x408
add eax, 0x4a18c8
mov dword [0x1697ee0], eax
jmp 0x42df59
push 0x47da3c
lea eax, [ebp - 8]
mov dword [ebp - 8], str.vCreateSurface___failed
push eax
call fcn.00450464
int3
Function at 0x42ee6a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
push 0x1ff
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.0044f1f0
pop ecx
mov edi, eax
mov esi, str.license.txt
pop ecx
xor eax, eax
push eax
movsd dword es:[edi], dword [esi]
push 0x80
push 3
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x214]
push 3
push 0x80000000
push eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x42efe2
push 0
lea ecx, [ebp - 0x14]
mov esi, 0x4a9b38
push ecx
push 0x3ff
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42efd9
mov dword [0x4a9a10], esi
mov edi, 0x4a9a14
push 0xd
push dword [edi - 4]
call fcn.0044eac0
mov dword [edi], eax
pop ecx
pop ecx
test eax, eax
je 0x42ef14
mov byte [eax], 0
add eax, 2
mov dword [edi], eax
add edi, 4
cmp edi, 0x4a9a2c
jl 0x42eefa
mov edi, 0x4a9a18
mov esi, 0x250a
mov ecx, 0x1e9f
mov dword [ebp - 8], edi
mov eax, dword [edi]
test eax, eax
je 0x42ef71
xor edx, edx
mov dword [ebp - 4], edx
cmp byte [eax], dl
je 0x42ef71
mov edi, eax
movzx eax, byte [edi + edx]
xor edx, edx
add eax, esi
mov esi, 0xfff1
div esi
mov esi, edx
xor edx, edx
lea eax, [ecx + esi]
mov ecx, 0xfff1
div ecx
mov ecx, edx
mov edx, dword [ebp - 4]
inc edx
mov dword [ebp - 4], edx
cmp byte [edi + edx], 0
jne 0x42ef42
mov edi, dword [ebp - 8]
add edi, 4
mov dword [ebp - 8], edi
cmp edi, 0x4a9a2c
jl 0x42ef31
and ecx, 0x1ffe
and esi, 0xfff
shl ecx, 0xb
or ecx, esi
mov esi, 0x4a9b38
push ecx
push str._06x
push esi
call fcn.00422a94
mov eax, dword [0x4a9a14]
add esp, 0xc
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x42efc9
test cl, cl
je 0x42efc5
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x42efc9
add esi, 2
add eax, 2
test cl, cl
jne 0x42efa9
xor eax, eax
jmp 0x42efce
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42efd9
mov byte [0x4a9a2d], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x4a9a30
mov esi, str.local
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x42efff
inc ecx
cmp ecx, 6
jne 0x42efee
jmp 0x42f012
cmp byte [0x4a9a30], 0
jne 0x42f01b
mov eax, dword [0x4a99cc]
cmp byte [eax], 0
jne 0x42f01b
mov al, 1
mov byte [0x4a9a2e], al
jmp 0x42f020
mov al, byte [0x4a9a2e]
pop edi
pop esi
test al, al
jne 0x42f0a3
cmp byte [0x4a9a2d], al
je 0x42f0a3
mov eax, dword [0x4a9a1c]
mov byte [0x4a9a2e], 1
cmp byte [eax], 0
je 0x42f054
push edx
push eax
call fcn.0045a64b
neg eax
pop ecx
sbb al, al
not al
and byte [0x4a9a2e], al
pop ecx
mov eax, dword [0x4a9a20]
cmp byte [eax], 0
je 0x42f07b
call fcn.0042ee40
push eax
push dword [0x4a9a20]
call fcn.0044f330
neg eax
pop ecx
sbb al, al
and byte [0x4a9a2e], al
pop ecx
mov eax, dword [0x4a99cc]
cmp byte [eax], 0
je 0x42f0a3
push str.BTRIEVE
push dword [0x4a9a24]
call fcn.0045a64b
neg eax
pop ecx
sbb al, al
not al
and byte [0x4a9a2e], al
pop ecx
leave
ret
Function at 0x42fa55
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [str.vDos_2020.03.01________vdos.info_]
push edi
mov edi, 0x4a99f0
push 0x65
pop ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
mov edi, dword [esi + 0x4764c0]
mov dword [esi + 0x4a9f80], edi
jmp 0x42fa93
mov eax, ebx
shl eax, 3
push 7
pop ebx
cdq
idiv ebx
movsx ebx, cl
add ebx, eax
inc edi
mov cl, byte [edi]
test cl, cl
jne 0x42fa82
add esi, 4
cmp esi, 0x28
jb 0x42fa74
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x7f00
push edi
mov esi, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, 0x47819c
mov dword [ebp - 0x18], eax
push 4
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], 0x42acaa
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x14], eax
cmp ebx, 0x1248379d
jne 0x42fb26
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x42fb26
xor ebx, ebx
mov eax, 0x80000000
push ebx
push esi
push ebx
push ebx
push ebx
push ebx
push eax
push eax
push 0x8ca0000
push edi
push edi
push 0x80000
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4a9f4c], eax
jmp 0x42fb2d
mov eax, dword [0x4a9f4c]
xor ebx, ebx
test eax, eax
je 0x42fc03
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, eax
call fcn.0043a9c3
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x42fb79
inc esi
push 0x22
push esi
call fcn.0044eac0
pop ecx
pop ecx
test eax, eax
je 0x42fb7d
push 0x22
push esi
call fcn.0044eac0
pop ecx
pop ecx
lea esi, [eax + 1]
jmp 0x42fb7d
movsx eax, al
push eax
call fcn.0045333f
pop ecx
test eax, eax
jne 0x42fb7d
inc esi
mov al, byte [esi]
test al, al
jne 0x42fb68
mov ecx, esi
call fcn.0043a9c3
push 4
mov esi, eax
push str._log
push esi
call fcn.00459f9d
add esp, 0xc
test eax, eax
jne 0x42fbcf
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push str.vDos.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x4a99f0
mov dword [0x48c4cc], eax
call fcn.0042fc19
pop ecx
lea ecx, [esi + 4]
call fcn.0043a9c3
mov esi, eax
cmp byte [esi], 0
je 0x42fbe0
push esi
push str.VDOS
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 8]
mov byte [0x4a9a30], bl
push eax
push 0x4a9a30
push 6
mov dword [ebp - 8], 0x101
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
pop edi
pop esi
pop ebx
leave
ret
push 0x47da3c
lea eax, [ebp - 4]
mov dword [ebp - 4], str.Could_not_create_vDos_window
push eax
call fcn.00450464
int3
Function at 0x42fc19
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x48c4cc]
sub esp, 0x204
cmp edx, 0xffffffff
je 0x42fd5a
push ebx
mov ebx, dword [ebp + 8]
push esi
mov byte [ebp - 0x204], 0
push edi
cmp byte [ebx], 0
je 0x42fd18
mov ecx, dword [0x1697ff8]
lea edi, [ebp - 0x204]
mov edx, dword [0x1697ffc]
mov esi, 0x4781d8
mov eax, ecx
or eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jne 0x42fc87
mov ecx, dword [0x4a9f78]
mov eax, dword [0x4a9f7c]
mov dword [0x16979c0], ecx
mov dword [0x1697ff8], ecx
mov dword [0x1697ffc], eax
jmp 0x42fcf6
mov edi, dword [0x4a9f78]
mov esi, dword [0x4a9f7c]
cmp edi, dword [0x16979c0]
jne 0x42fca3
cmp esi, dword [0x16979c4]
je 0x42fcfb
sub edi, ecx
push 0
push 0xa
sbb esi, edx
push esi
push edi
call fcn.0044e220
push 0x64
pop ecx
cdq
idiv ecx
push edx
push 0
push 0x3e8
push esi
push edi
call fcn.0044e220
cdq
mov ecx, 0xf4240
idiv ecx
lea eax, [ebp - 0x204]
push edx
push str._6d._02d
push eax
call fcn.00422a94
mov eax, dword [0x4a9f78]
add esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [0x16979c0], eax
mov eax, dword [0x4a9f7c]
mov dword [0x16979c4], eax
lea eax, [ebp + 0xc]
mov edx, 0x1f4
push eax
push ebx
lea ecx, [ebp - 0x1fa]
call fcn.0040116c
mov edx, dword [0x48c4cc]
pop ecx
pop ecx
lea edi, [ebp - 0x204]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42fd1f
mov ax, word [0x4777a8]
lea ecx, [ebp - 0x204]
mov word [edi], ax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42fd39
push 0
lea eax, [ebp - 4]
sub ecx, esi
push eax
push ecx
lea eax, [ebp - 0x204]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43a897
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
xor eax, eax
push 0xd
mov ebx, edx
mov dword [ebp - 4], edi
mov dword [0x15d5f38], eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x43a9ae
push dword [0x4a9f4c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43a9ae
push esi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x43a9a7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x43a9a4
test ebx, ebx
jne 0x43a994
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x43a900
sub ecx, edx
sar ecx, 1
mov dword [0x15d5f38], ecx
je 0x43a9a4
mov edx, dword [0x16975d0]
lea esi, [ecx + ecx]
test edx, edx
je 0x43a957
cmp dword [0x15d5f3c], esi
jae 0x43a980
push esi
push edx
call fcn.004533d5
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x43a947
mov dword [0x16975d0], edx
jmp 0x43a96a
mov ecx, dword [0x15d5f3c]
mov edx, dword [0x16975d0]
shr ecx, 1
jmp 0x43a97a
push esi
call fcn.00458093
mov edx, eax
mov dword [0x16975d0], edx
pop ecx
test edx, edx
je 0x43a978
mov ecx, dword [0x15d5f38]
mov dword [0x15d5f3c], esi
jmp 0x43a980
mov ecx, ebx
mov dword [0x15d5f38], ecx
test ecx, ecx
je 0x43a9a4
lea eax, [ecx + ecx]
push eax
push edi
push edx
call fcn.0044fb30
add esp, 0xc
jmp 0x43a9a4
mov edx, edi
mov ecx, ebx
call fcn.0043a71c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [ebp - 4]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, dword [0x15d5f38]
mov dword [edi], eax
neg eax
pop edi
sbb eax, eax
and eax, dword [0x16975d0]
pop ebx
leave
ret
Function at 0x43abab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
xor al, al
mov byte [esp + 0xd], 0
mov ebx, ecx
mov byte [esp + 0xe], al
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov esi, edx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x13], 0
mov word [edi], ax
cmp byte [ebx], al
je 0x43ac4c
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x43abf9
cmp dword [esp + 0x18], 1
jne 0x43ac54
xor al, al
jmp 0x43ad80
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
mov ecx, 0xc1
mov word [edi], ax
cmp ax, cx
jne 0x43abf2
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43ac14
sub ecx, edx
cmp ecx, 4
jbe 0x43ac54
add ebx, 0xfffffffc
add ebx, ecx
xor edi, edi
push ebx
push dword [edi + 0x476860]
call fcn.0045a64b
pop ecx
pop ecx
test eax, eax
je 0x43abf2
add edi, 4
cmp edi, 0x10
jb 0x43ac29
mov ebx, dword [esp + 0x14]
mov edi, dword [ebp + 0xc]
jmp 0x43ac54
mov byte [esp + 0x12], 1
jmp 0x43ac54
inc esi
movsx eax, byte [esi]
push eax
call fcn.0045333f
pop ecx
test eax, eax
jne 0x43ac53
push 4
push str.WAIT
push esi
call fcn.004580a0
add esp, 0xc
test eax, eax
jne 0x43ac7e
mov byte [esp + 0x11], 1
add esi, 4
push 4
push str.HIDE
push esi
call fcn.004580a0
add esp, 0xc
test eax, eax
jne 0x43ac9d
mov byte [esp + 0x13], 1
add esi, 4
jmp 0x43ac9d
inc esi
movsx eax, byte [esi]
push eax
call fcn.0045333f
pop ecx
test eax, eax
jne 0x43ac9c
xor eax, eax
mov dword [esp + 0x1c], 0x3c
cmp byte [esp + 0x11], al
mov dword [esp + 0x28], str.open
sete al
mov dword [esp + 0x2c], esi
and dword [esp + 0x24], 0
dec eax
and eax, 0xffffff40
add eax, 0x300
mov dword [esp + 0x20], eax
mov al, byte [esp + 0x12]
test al, al
jne 0x43acf3
cmp byte [esi], 0
mov dword [esp + 0x2c], ebx
je 0x43acf3
mov dword [esp + 0x30], esi
jmp 0x43acf8
and dword [esp + 0x30], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
neg ecx
sbb ecx, ecx
and ecx, eax
xor eax, eax
cmp byte [esp + 0x13], al
mov dword [esp + 0x34], ecx
sete al
dec eax
and eax, 6
inc eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x43ad37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov word [edi], ax
jmp 0x43abf2
cmp dword [esp + 0x54], 0
je 0x43ad7e
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x43ad5d
cmp dword [esp + 0x14], 0x103
jne 0x43ad6c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042cada
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x58]
call esi
test eax, eax
jne 0x43ad46
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cx, word [esp + 0x14]
mov word [edi], cx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43cb41
Capabilities:
Get common file path

Disassembly:
mov eax, 0x46ba04
call fcn.0046a908
push ecx
push esi
push 1
mov edx, 0x43cad6
mov cl, 0x20
call fcn.004300c9
push 2
mov edx, fcn.0043adaa
mov cl, 0x21
call fcn.004300c9
mov esi, 0x43cae5
mov cl, 0x25
push 0
mov edx, esi
call fcn.004300c9
push 0
mov edx, esi
mov cl, 0x26
call fcn.004300c9
push 1
mov edx, 0x43cafa
mov cl, 0x27
call fcn.004300c9
push 2
mov edx, fcn.0043cb3e
mov cl, 0x28
call fcn.004300c9
push 6
xor edx, edx
mov cl, 0x29
call fcn.004300c9
call fcn.0043e40e
call fcn.00441811
call fcn.00441587
push 2
mov edx, 0x441657
mov cl, 0x2f
call fcn.004300c9
push 1
mov edx, 0x4417b9
mov cl, 0x2a
call fcn.004300c9
add esp, 0x24
mov esi, 0x15b32d0
push esi
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x43cc13
push 0x468
call fcn.0044db30
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
push 2
push esi
call fcn.00441cf2
or dword [ebp - 4], 0xffffffff
mov dword [0x15c3348], eax
mov dl, 2
mov ecx, 0xb36
call fcn.00434910
mov cl, 2
call fcn.0043f705
mov ecx, dword [ebp - 0xc]
push 5
pop eax
mov word [0x15b3286], ax
pop esi
mov dword fs:[0], ecx
leave
ret