joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4969c4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x496a4d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5d4dac
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x496a37
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c3c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x496a64
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x5d3c34]
mov dl, 1
mov eax, dword [0x4959f0]
call fcn.0040cce4
call fcn.00403db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496a54
lea eax, [ebp - 0x1c]
call fcn.00404414
ret

Function at 0x497118
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0049703c
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004037e0
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x49717c
call fcn.0049690c
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x49716e
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004037e0
pop esi
pop ebx
ret

Function at 0x4971a0
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.004048d4
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402e10
test ebx, ebx
je 0x4971eb
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x4972c8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4972f9
mov ecx, dword [0x5d3f4c]
mov dl, 1
mov eax, dword [0x4959f0]
call fcn.0040cca8
call fcn.00403db0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x497326
mov ecx, dword [0x5d3850]
mov dl, 1
mov eax, dword [0x4959f0]
call fcn.0040cca8
call fcn.00403db0
xor eax, eax
push ebp
push 0x4973a7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004037e0
cmp byte [ebp + 8], 0
je 0x497381
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00497230
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00497098
jmp 0x49739d
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00496bf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4973c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4973d0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x497401
mov ecx, dword [0x5d39a8]
mov dl, 1
mov eax, dword [0x4959f0]
call fcn.0040cca8
call fcn.00403db0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x49742e
mov ecx, dword [0x5d3850]
mov dl, 1
mov eax, dword [0x4959f0]
call fcn.0040cca8
call fcn.00403db0
xor eax, eax
push ebp
push 0x4974aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004037e0
cmp byte [ebp + 8], 0
je 0x497486
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00497230
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.00497118
jmp 0x4974a0
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00496bf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4974c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4976a8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00496ec0
xor eax, eax
push ebp
push 0x497819
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x497803
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4976f3
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4976fd
call fcn.00403e5c
jmp 0x497820
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c360
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4977f8
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4977ab
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
jmp 0x497798
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c380
jmp 0x4977ff
cmp ecx, ebx
jge 0x4977c7
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c380
jmp 0x4976fd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041c360
cmp edx, dword [esp + 4]
jne 0x4977e7
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4976fd
push ebp
call fcn.00497660
pop ecx
jmp 0x4977ff
push ebp
call fcn.00497660
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497820
mov eax, dword [ebp - 4]
call fcn.00496ecc
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x497830
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497952
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00496ec0
xor eax, eax
push ebp
push 0x497935
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x497880
call fcn.00403e5c
jmp 0x49793c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49791f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
jmp 0x49791f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49793c
mov eax, dword [ebp - 4]
call fcn.00496ecc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497959
lea eax, [ebp - 0x28]
call fcn.00404414
ret
Function at 0x4979b8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497b02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00496ec0
xor eax, eax
push ebp
push 0x497ae5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x497a1d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x497a1d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x497acf
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x497a30
call fcn.00403e5c
jmp 0x497aec
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x497acf
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
jmp 0x497acf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497aec
mov eax, dword [ebp - 4]
call fcn.00496ecc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497b09
lea eax, [ebp - 0x28]
call fcn.00404414
ret

Function at 0x4abc20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4abc35
add esp, 0xfffffff0
call fcn.00403948
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004048c4
xor eax, eax
push ebp
push 0x4abcf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004a7d9c
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00418498
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00418498
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00418498
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00418498
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004184c0
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abcff
lea eax, [ebp - 4]
call fcn.00404414
ret
Function at 0x4b0030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b012c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4b0144
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.00404468
push 0xffffffffffffffff
mov ecx, 0x4b0154
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
mov ecx, 0x4b0170
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049c884
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b018c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049c770
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b01a0
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049c770
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b01b8
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049c770
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x4b01d4
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049c884
mov byte [ebx + 0x44], al
mov ecx, 0x4b01e8
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004a7a78
mov byte [ebx + 0x45], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0133
lea eax, [ebp - 4]
call fcn.00404414
ret
Function at 0x4e6f6c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
call fcn.004048c4
xor eax, eax
push ebp
push 0x4e70a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004184c0
push 0x400
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
call fcn.004046d4
push eax
mov eax, dword [ebp + 0x14]
call fcn.004048d4
push eax
mov eax, ebx
call fcn.00427194
push eax
call sub.user32.dll_DrawTextA
lea eax, [ebp - 0x24]
call fcn.0049c494
add eax, 2
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
call fcn.0049c4b0
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov dword [ebp - 0xc], edx
sar edi, 1
jns 0x4e6ff7
adc edi, 0
mov edx, dword [ebp - 0x10]
add edx, eax
add edx, 2
sar edx, 1
jns 0x4e7006
adc edx, 0
sub edi, edx
mov edx, dword [ebp - 4]
sar edx, 1
jns 0x4e7012
adc edx, 0
mov ecx, dword [ebp - 0xc]
sar ecx, 1
jns 0x4e701c
adc ecx, 0
sub edx, ecx
mov dword [ebp - 8], edx
lea eax, [eax + edi + 2]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
sar eax, 1
jns 0x4e7032
adc eax, 0
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x4e703c
adc edx, 0
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
push 1
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp + 0x14]
call fcn.004046d4
push eax
mov eax, dword [ebp + 0x14]
call fcn.004048d4
push eax
mov eax, ebx
call fcn.00427194
push eax
call sub.user32.dll_DrawTextA
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov al, byte [ebp + 8]
push eax
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00473008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e70ac
lea eax, [ebp + 0x14]
call fcn.00404414
ret
Function at 0x519540
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x5196c0
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 8]
call fcn.004046d4
mov dword [ebp - 0x10], eax
call fcn.00439ea8
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x5196b9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
mov esi, dword [ebp - 0x10]
inc esi
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5195f9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x5195f2
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x5195db
mov eax, dword [ebp - 8]
call fcn.004048d4
mov ecx, esi
mov edx, ebx
call fcn.00402910
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5195f9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
cmp byte [ebp - 0x11], 0
jne 0x519685
mov esi, dword [ebp - 0x10]
inc esi
mov eax, esi
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x51967e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x519667
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30c]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp - 8]
call fcn.004048d4
mov ecx, esi
mov edx, ebx
call fcn.00402910
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x5d6164]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519685
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5196c0
call fcn.00439ea8
mov edx, dword [eax]
call dword [edx + 0x14]
cmp byte [ebp - 0x11], 0
je 0x5196b8
mov ecx, 0x5196d0
mov dl, 1
mov eax, dword [0x5175d0]
call fcn.0040cbec
call fcn.00403db0
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53398c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x533bb3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d88a4]
cmp eax, dword [0x5d88a0]
jb 0x533b9d
mov eax, 0x5d6cb4
mov edx, 0x533bcc
call fcn.00404468
cmp ebx, 0xbc3
je 0x5339e4
cmp ebx, 0xbc5
jne 0x533a0c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x7a4]
cmp eax, 0xbb8
jbe 0x533a05
mov eax, 0x5d6cb4
mov edx, 0x533bdc
call fcn.00404468
mov byte [0x5d69a4], 0
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6cd8], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6cdc], eax
xor eax, eax
mov dword [0x5d6b9c], eax
mov eax, dword [0x5d70ac]
cmp dword [eax + 0x54], 0
jl 0x533a59
inc dword [esi + 0x7b0]
cmp dword [esi + 0x7b0], 4
jle 0x533a59
mov eax, dword [0x5d70ac]
mov dword [eax + 0x54], 0xffffffff
mov eax, dword [0x5d70ac]
mov dword [eax + 0x58], 0xffffffff
mov eax, 0x5d6c80
call fcn.00404414
cmp ebx, 0xbd1
jne 0x533a7c
mov eax, 0x5d6c80
mov edx, 0x533bec
call fcn.00404468
jmp 0x533ade
cmp ebx, 0xbc6
jne 0x533a95
mov eax, 0x5d6c80
mov edx, 0x533bfc
call fcn.00404468
jmp 0x533ade
cmp ebx, 0xbca
jne 0x533aae
mov eax, 0x5d6c80
mov edx, 0x533c10
call fcn.00404468
jmp 0x533ade
cmp ebx, 0xbd0
jne 0x533ac7
mov eax, 0x5d6c80
mov edx, 0x533c20
call fcn.00404468
jmp 0x533ade
cmp ebx, 0xbcb
jne 0x533ade
mov eax, 0x5d6c80
mov edx, 0x533c30
call fcn.00404468
cmp dword [0x5d6c80], 0
je 0x533b31
mov byte [0x5d68e1], 0
push 0x533c40
push dword [0x5d6c80]
push 0x533c54
mov eax, 0x5d6ef0
mov edx, 3
call fcn.00404794
cmp byte [0x5d6b50], 0
jne 0x533b27
mov byte [0x5d6b50], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6b54], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6ef4], eax
mov ax, word [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
mov dx, word [ebp + 0x10]
mov eax, edi
call fcn.0040749c
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00492a30
mov eax, dword [ebp - 0xc]
mov dword [0x5d6a20], eax
mov eax, dword [ebp - 8]
mov dword [0x5d6a24], eax
mov eax, dword [ebp - 4]
mov dword [0x5d6a28], eax
push 1
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004996a4
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, esi
call fcn.00532914
mov byte [0x5d70dc], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d70e0], eax
inc dword [0x5d70e8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533bba
lea eax, [ebp - 0x10]
call fcn.00404414
ret
Function at 0x533c58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x533dfb
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x5d88a4]
cmp eax, dword [0x5d88a0]
jb 0x533de0
mov eax, 0x5d6cb4
mov edx, 0x533e14
call fcn.00404468
push ebx
mov eax, edi
call fcn.004074a8
push eax
lea eax, [ebp - 0x14]
push eax
mov dx, word [ebp + 0x10]
mov ax, word [ebp - 8]
call fcn.0040749c
mov edx, eax
mov ecx, edi
mov ax, word [ebp - 4]
call fcn.00492a30
push 1
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.004996a4
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, esi
call fcn.00532914
mov eax, dword [ebp - 0x14]
mov dword [0x5d6a20], eax
mov eax, dword [ebp - 0x10]
mov dword [0x5d6a24], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5d6a28], eax
mov eax, dword [0x5d6fc8]
mov eax, dword [eax + 0x87c]
mov edx, 0x533e24
call fcn.00404820
jne 0x533d51
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00408cf0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x5d6fc8]
mov eax, dword [eax + 0x880]
call fcn.00404820
jne 0x533d51
mov eax, dword [0x5d6fc8]
mov dword [eax + 0x870], 1
mov eax, dword [0x5d6fc8]
mov eax, dword [eax + 0x888]
mov edx, 0x533e24
call fcn.00404820
jne 0x533d96
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00408cf0
mov edx, dword [ebp - 0x20]
mov eax, dword [0x5d6fc8]
mov eax, dword [eax + 0x88c]
call fcn.00404820
jne 0x533d96
mov eax, dword [0x5d6fc8]
mov dword [eax + 0x874], 1
push 0x533e38
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, esi
call fcn.00545698
push dword [ebp - 0x24]
push 0x533e4c
mov eax, 0x5d6ef0
mov edx, 3
call fcn.00404794
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d6ef4], eax
mov byte [0x5d70dc], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [0x5d70e0], eax
mov byte [0x5d68e1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533e02
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404438
ret