joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40394d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x417610
cmp edx, dword [eax]
je 0x40396f
add eax, 8
inc ecx
cmp eax, 0x4176a0
jl 0x403960
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x417610]
jne 0x403a9d
mov eax, dword [0x4181e4]
cmp eax, 1
je 0x403a77
test eax, eax
jne 0x4039a0
cmp dword [0x41750c], 1
je 0x403a77
cmp edx, 0xfc
je 0x403a9d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4039d7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004046e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403c90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403a1a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403c90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4085cc
push edi
call fcn.00405d50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004046e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004046f0
lea eax, [ebp - 0xa0]
push 0x4085ac
push eax
call fcn.004046f0
push dword [esi + 0x417614]
lea eax, [ebp - 0xa0]
push eax
call fcn.004046f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405cb9
add esp, 0x2c
pop edi
jmp 0x403a9d
lea eax, [ebp + 8]
lea esi, [esi + 0x417614]
push 0
push eax
push dword [esi]
call fcn.00403c90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x401426
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x4041b0], eax
mov eax, edi
mov dword [ebp - 0x44], 0x40132e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Hall
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014f0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.moossi
push str.Hall
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4041b8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014f0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014d5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x66dbcc
Capabilities:
Encrypt data using aes

Disassembly:
lea ebp, [ecx*4]
jmp 0x66dc01

Function at 0x71bb66
Capabilities:
Parse pe header

Disassembly:
call fcn.0071b016
mov eax, dword [eax + 8]
jmp 0x71bbba
push word [esp + 3]
call 0x71bb1e
mov eax, dword [eax]
jmp 0x71bb35
push eax
jmp 0x71b011
Function at 0x4099a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, ecx
push 0xb5
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
mov ecx, esi
call fcn.004c4060
cmp eax, 0xffffffff
jne 0x4099c7
pop edi
xor ecx, ecx
pop esi
jmp fcn.0041c8e0
push 1
mov edx, eax
mov ecx, esi
call fcn.004c4110
push 0
mov edx, 2
mov ecx, esi
call fcn.004c3a20
mov ecx, esi
call fcn.004c4420
mov ecx, edi
call fcn.004092c0
pop edi
mov dword [0x58e098], 1
pop esi
ret

Function at 0x4103c0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x18]
mov ebx, edx
mov dword [esp + 8], esi
call fcn.004dc560
test eax, eax
je 0x4103e8
push 0x180
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4103f0
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
push ebp
push edi
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4103f5
mov eax, dword [str.msagentchars_]
mov dword [edi], eax
mov ecx, dword [0x5751fc]
mov dword [edi + 4], ecx
mov edx, dword [0x575200]
mov dword [edi + 8], edx
mov eax, dword [0x575204]
mov edx, 2
mov ecx, esi
mov dword [edi + 0xc], eax
call fcn.0041ef30
test eax, eax
jne 0x410438
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x20]
push ecx
xor ebp, ebp
mov byte [ebx], 0
call fcn.005326e0
push eax
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x3e7
push ebp
push ebp
push ebp
push 1
push ebx
mov edx, str..acs
mov ecx, esi
call fcn.00480ba0
cmp byte [ebx], 0
je 0x410552
test eax, eax
jle 0x410552
push 0x5902c8
push 0x5901c8
push 0x5900c8
push 0x5900c0
push ebx
inc ebp
call fcn.00563b42
mov eax, 0x5901c8
mov edx, ebx
add esp, 0x14
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4104a3
mov eax, 0x5902c8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4104b4
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4104c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x1c]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jle 0x410508
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4104ff
cmp eax, 0x270f
jne 0x4104ff
push ecx
push ebx
call fcn.00572b46
add esp, 8
test eax, eax
je 0x410561
jmp 0x410508
dec eax
test eax, eax
mov dword [esp + 0x1c], eax
jle 0x410556
mov edx, dword [esp + 0x20]
push edx
call fcn.005326e0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [esp + 0x34]
push 0
push 0
push 0
push 0
push 0
push 0x3e7
push 0
push 0
push 0
lea eax, [ebp + 1]
push eax
push ebx
mov edx, str..acs
call fcn.00480ba0
cmp byte [ebx], 0
jne 0x410474
mov eax, dword [esp + 0x1c]
cmp eax, 0x270f
je 0x41042e
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x41cfc0
Capabilities:
Get graphical window text

Disassembly:
mov al, byte [0x59bb90]
sub esp, 0x7d0
test al, al
jne 0x41cff1
mov eax, dword [0x5a1b00]
push 0x589eb8
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, 7
call fcn.0052b760
add esp, 0x7d0
ret
push 0x59bb90
push 0x589eb8
lea ecx, [esp + 8]
push 0x5755a8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, 0xf
lea ecx, [esp]
call fcn.00518d60
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d023
sub eax, edx
mov edx, dword [0x5a1b00]
push esi
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, esi
jne 0x41d098
mov ecx, dword [0x5a1b00]
push 0x3b5
lea eax, [esp + 0x3f0]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [esp + 0x3ec]
lea eax, [esp + 4]
push ebx
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41d08e
test cl, cl
je 0x41d08a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41d08e
add eax, 2
add esi, 2
test cl, cl
jne 0x41d066
xor eax, eax
jmp 0x41d093
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x41d0b4
mov ecx, dword [0x5a1b00]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, 7
call fcn.0052b760
pop esi
add esp, 0x7d0
ret

Function at 0x41d0c0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x5a1b00]
sub esp, 0x40c
push esi
push 5
push 0x598248
push 0
mov esi, ecx
push esi
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x41d0f3
mov eax, 1
pop esi
add esp, 0x40c
ret
lea ecx, [esp + 4]
push ecx
push esi
call fcn.00572efe
add esp, 8
test eax, eax
je 0x41d13c
mov dword [esp + 0x18], 0
push esi
push str.notepad.exe__s
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xa
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
sbb eax, eax
inc eax
pop esi
add esp, 0x40c
ret
cmp dword [esp + 0x18], 0xe678
jle 0x41d10d
push esi
push str.write.exe__s
lea edx, [esp + 0x30]
push edx
jmp 0x41d118
Function at 0x41d160
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ecx
mov eax, dword [0x5a1b00]
push ebp
push esi
push eax
mov esi, edx
mov ebp, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x41d17b
pop esi
pop ebp
pop ecx
ret
push ebx
xor ebx, ebx
cmp esi, 1
push edi
jne 0x41d229
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x41d229
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x41d21e
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d1b0
sub eax, edx
mov edx, eax
mov eax, ebp
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d1c0
sub eax, esi
lea ecx, [eax + edx + 0xa]
push ecx
call fcn.005635a3
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41d21a
mov edx, ebx
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41d1e2
mov eax, ebp
mov edx, ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d1f0
mov edi, ebx
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41d200
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, ebx
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
jmp 0x41d22f
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x41d273
mov eax, ebp
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d240
sub eax, edx
add eax, 0xa
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x41d273
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x41d28e
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
je 0x41d286
push ebx
call fcn.005635b5
add esp, 4
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov edx, eax
mov ecx, ebp
sub edx, ebp
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x41d294
push esi
call edi
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
je 0x41d2bd
push ebx
call fcn.005635b5
add esp, 4
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x41d3d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
mov dword [0x5903e4], 0
mov dword [0x5903e0], 0
mov dword [0x5903dc], 0
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ecx, 1
je 0x41d550
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x41d435
test esi, esi
je 0x41d56c
mov dword [esi], 0x312e33
pop esi
add esp, 0x94
ret
cmp eax, ecx
jne 0x41d4a5
cmp dword [esp + 8], 4
jne 0x41d550
mov eax, dword [esp + 0xc]
cmp eax, 0x5a
jb 0x41d475
test esi, esi
je 0x41d566
mov dx, word [0x5755f4]
mov word [esi], dx
mov al, byte [0x5755f6]
mov byte [esi + 2], al
mov dword [0x5903dc], ecx
pop esi
add esp, 0x94
ret
cmp eax, ecx
jb 0x41d550
test esi, esi
je 0x41d566
mov dx, word [0x5755f0]
mov word [esi], dx
mov al, byte [0x5755f2]
mov byte [esi + 2], al
mov dword [0x5903dc], ecx
pop esi
add esp, 0x94
ret
cmp eax, 2
jne 0x41d550
cmp dword [esp + 8], 5
jb 0x41d52c
mov eax, dword [esp + 0xc]
cmp eax, 2
jb 0x41d4e0
test esi, esi
je 0x41d4d2
mov edx, dword [str.2003]
mov dword [esi], edx
mov al, byte [0x5755ec]
mov byte [esi + 4], al
mov dword [0x5903e4], ecx
pop esi
add esp, 0x94
ret
cmp eax, ecx
jb 0x41d508
test esi, esi
je 0x41d4fa
mov dx, word [0x5755e4]
mov word [esi], dx
mov al, byte [0x5755e6]
mov byte [esi + 2], al
mov dword [0x5903e4], ecx
pop esi
add esp, 0x94
ret
test esi, esi
je 0x41d51e
mov dx, word [0x5755e0]
mov word [esi], dx
mov al, byte [0x5755e2]
mov byte [esi + 2], al
mov dword [0x5903e4], ecx
pop esi
add esp, 0x94
ret
test esi, esi
je 0x41d542
mov dx, word [0x5755dc]
mov word [esi], dx
mov al, byte [0x5755de]
mov byte [esi + 2], al
mov dword [0x5903e0], ecx
pop esi
add esp, 0x94
ret
test esi, esi
je 0x41d566
mov dx, word [0x5755d8]
mov word [esi], dx
mov al, byte [0x5755da]
mov byte [esi + 2], al
mov dword [0x5903dc], ecx
pop esi
add esp, 0x94
ret
Function at 0x41ed60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
push ebx
mov edx, ecx
test edx, edx
push esi
push edi
je 0x41eeb2
cmp byte [edx], 0
je 0x41eeb2
xor eax, eax
push eax
mov ecx, 0x40
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push edx
call fcn.00563b42
add esp, 0x14
mov esi, 0x589258
lea ecx, [esp + 0x40]
push esi
push ecx
call fcn.00572b46
add esp, 8
test eax, eax
je 0x41ee99
add esi, 0xa
cmp esi, 0x58933e
jl 0x41eda7
push 0
push 0
push 3
push 0
push 0
push 0
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41edff
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, 2
jne 0x41ee99
push 0xa
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x41ee99
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00572efe
add esp, 8
test eax, eax
jne 0x41ee42
movzx eax, word [esp + 0x12]
cmp eax, 0x2000
je 0x41ee99
cmp eax, 0xf000
je 0x41ee99
push 0x40
lea ecx, [esp + 0x44]
push 0
push ecx
call fcn.0056d6d9
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x41eea5
push esi
call fcn.00570e12
add esp, 4
test eax, eax
jne 0x41ee8c
lea edx, [esp + 0xc]
push edx
push esi
call fcn.005731d6
add esp, 8
test eax, eax
jne 0x41eea5
movzx eax, word [esp + 0x12]
cmp eax, 0x2000
je 0x41ee8c
cmp eax, 0xf000
jne 0x41eea5
test esi, esi
jl 0x41ee99
push esi
call fcn.00569e00
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jl 0x41eeb2
push esi
call fcn.00569e00
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ef30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x4ec
push esi
mov esi, ecx
test esi, esi
mov dword [esp + 4], edx
je 0x41f029
cmp byte [esi], 0
je 0x41f029
push 0x2f
push esi
call fcn.00563730
add esp, 8
test eax, eax
je 0x41ef72
lea ecx, [ecx]
push 0x2f
push esi
mov byte [eax], 0x5c
call fcn.00563730
add esp, 8
test eax, eax
jne 0x41ef60
push 0x57568c
push esi
call fcn.00564fb0
add esp, 8
test eax, eax
jne 0x41f029
lea edx, [esp + 8]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41ef90
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41efa1
sub eax, edx
test eax, eax
jle 0x41f029
mov cl, byte [esp + eax + 7]
cmp cl, 0x5c
jne 0x41efbe
mov byte [esp + eax + 8], 0x2e
jmp 0x41efc8
cmp cl, 0x3a
jne 0x41efcd
mov byte [esp + eax + 8], 0x5c
mov byte [esp + eax + 9], 0
push 0
lea eax, [esp + 0x3f4]
push eax
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.00563b42
add esp, 0x14
lea ecx, [esp + 0x3f0]
call fcn.0041ed60
test eax, eax
jne 0x41f029
lea edx, [esp + 8]
push edx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41f029
test al, 0x10
mov al, byte [esp + 4]
je 0x41f016
test al, 2
jmp 0x41f018
test al, 1
je 0x41f01f
mov esi, 1
mov eax, esi
pop esi
add esp, 0x4ec
ret
xor eax, eax
pop esi
add esp, 0x4ec
ret
Function at 0x41f040
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
mov eax, dword [0x5a1b00]
push ebx
push edi
mov edi, ecx
push eax
mov ebx, edx
mov dword [esp + 0x10], edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x41f063
pop edi
pop ebx
add esp, 0xc
ret
push ebp
push esi
push 1
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
je 0x41f11a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x41f113
push 0xa
push ebp
call fcn.00563730
mov esi, eax
add esp, 8
test esi, esi
je 0x41f0a8
mov byte [esi], 0
xor eax, eax
mov ecx, 0xf9
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x3b5
stosw word es:[edi], ax
push ebp
push ebx
stosb byte es:[edi], al
call fcn.005635f0
push 0xd
push ebx
call fcn.00563730
add esp, 0x14
test eax, eax
je 0x41f0d4
mov byte [eax], 0
mov ecx, dword [esp + 0x10]
push 0
mov edx, ebx
call fcn.004c2560
test eax, eax
je 0x41f102
test esi, esi
mov dword [esp + 0x10], eax
je 0x41f10b
mov byte [esi], 0xa
mov al, byte [esi + 1]
inc esi
cmp al, 0xd
jne 0x41f0f9
inc esi
cmp byte [esi], 0
je 0x41f10b
mov ebp, esi
jmp 0x41f094
lea ecx, [esp + 0x10]
call fcn.004c29d0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41f197
cmp byte [edi], 0
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
jne 0x41f178
mov esi, 1
push esi
push 0x598248
push str._splayq_d.txt
push edi
call ebp
add esp, 0x10
mov edx, esi
mov ecx, edi
call fcn.0041ef30
test eax, eax
je 0x41f178
inc esi
push esi
push 0x598248
push str._splayq_d.txt
push edi
call ebp
add esp, 0x10
mov edx, 1
mov ecx, edi
call fcn.0041ef30
test eax, eax
jne 0x41f156
push 0x40
push 0x575698
push edi
call fcn.00563d6a
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41f1a1
lea ecx, [esp + 0x10]
call fcn.004c29d0
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41f1d6
lea esp, [esp]
mov ecx, dword [eax]
push ecx
push 0x575690
push ebx
call ebp
push esi
push ebx
call fcn.00564ff0
mov ecx, dword [esp + 0x24]
add esp, 0x14
call fcn.004c2680
test eax, eax
mov dword [esp + 0x10], eax
jne 0x41f1b0
push esi
call fcn.00563cbd
add esp, 4
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x420320
Capabilities:
Capture screenshot

Disassembly:
mov ecx, dword [0x5918a8]
xor eax, eax
test ecx, ecx
sete al
push esi
mov esi, dword [0x5a1af8]
push edi
xor edi, edi
test esi, esi
mov dword [0x5918a8], eax
je 0x420361
mov ecx, esi
call fcn.00420240
test eax, eax
je 0x420353
mov ecx, esi
call fcn.0051c6d0
inc edi
mov esi, dword [esi + 0xd84]
test esi, esi
jne 0x420340
test edi, edi
jne 0x42038d
mov ecx, dword [0x5a1b00]
push 0x7c
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
mov dword [0x5918ac], 0
mov dword [0x5918a8], 0
xor ecx, ecx
pop esi
jmp fcn.0051c6d0
pop edi
pop esi
ret
Function at 0x420a30
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x30
push esi
push edi
mov edi, edx
mov esi, ecx
mov edx, dword [esi + 4]
test edx, edx
mov dword [esp + 8], edi
jne 0x420a4e
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 4
mov ecx, dword [esi + 8]
cmp edi, ecx
jge 0x420a5b
mov dword [esp + 8], ecx
mov edi, ecx
mov eax, dword [esi + 0xc]
push ebx
cmp dword [esp + 0x40], eax
push ebp
jge 0x420a6a
mov dword [esp + 0x44], eax
cmp esi, 0x5a1090
jne 0x420a7c
mov dword [esp + 0x10], ecx
mov dword [esp + 0x44], eax
mov edi, ecx
cmp edi, 1
jl 0x420af4
mov ebx, dword [esp + 0x44]
cmp ebx, 1
jl 0x420af4
lea eax, [esp + 0x28]
push eax
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp dword [esp + 0x2c], edi
jne 0x420aa8
cmp dword [esp + 0x30], ebx
je 0x420bf5
mov ecx, dword [0x5a1b00]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
mov dword [esp + 0x20], edi
je 0x420af4
mov ebp, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
call ebp
mov ebx, eax
test ebx, ebx
push edi
jne 0x420ad8
mov edx, dword [0x5a1b00]
push edx
jmp 0x420aee
call ebp
mov ebp, eax
test ebp, ebp
jne 0x420b20
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x5a1b00]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esi + 4]
test eax, eax
je 0x420b02
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
mov dword [esi + 4], 0
mov byte [esi + 0x10], 0
call fcn.0041c8e0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x24], eax
jne 0x420b47
push ebp
mov ebp, dword [sym.imp.GDI32.dll_DeleteDC]
call ebp
push ebx
call ebp
jmp 0x420ae7
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
call edi
mov ecx, dword [esi + 4]
push ecx
push ebp
mov dword [esp + 0x20], eax
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x14], 0
jmp 0x420b70
xor edi, edi
mov edx, dword [esi + 0xc]
push 0xcc0020
push 0
push 0
push ebp
push edx
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
add edi, eax
cmp edi, ecx
jl 0x420b72
mov ecx, dword [esp + 0x14]
mov edi, dword [esi + 0xc]
mov edx, dword [esp + 0x44]
add ecx, edi
cmp ecx, edx
mov dword [esp + 0x14], ecx
jl 0x420b70
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push ebx
call edi
mov edx, dword [esp + 0x1c]
push edx
push ebp
call edi
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebp
call edi
push ebx
call edi
mov eax, dword [esp + 0x20]
mov ecx, dword [0x5a1b00]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x24]
mov dword [esi + 4], eax
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x30
ret 4
Function at 0x4216d0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
push esi
mov dword [esp + 0xc], ebp
call fcn.005366c0
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x421836
mov ecx, dword [esi + 0xbb4]
call fcn.004dbea0
test eax, eax
je 0x421836
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
mov eax, dword [esi + 0x864]
cmp edi, eax
je 0x421721
cmp edi, dword [esi + 0x868]
jne 0x421835
cmp edi, eax
jne 0x421729
mov ecx, dword [esi + 0x6d0]
jmp 0x42172f
mov ecx, dword [esi + 0x6d4]
cmp ecx, ebx
mov eax, dword [esi + 0xbb4]
mov dword [eax + 0x1fa8], ebx
je 0x4217d1
mov eax, ecx
mov ebp, 1
lea ebx, [ebx]
cmp dword [eax + 0x1c], ebp
je 0x421782
mov eax, dword [eax + 0x40]
cmp eax, ebx
jne 0x421750
cmp eax, dword [ecx + 0x44]
jne 0x4217cd
mov eax, ecx
mov dword [eax + 0x1c], ebx
mov eax, dword [eax + 0x40]
cmp eax, ebx
jne 0x421763
push 0x574b10
push ebx
push 0xc
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [eax + 0x40]
cmp esi, ebx
je 0x42175c
cmp dword [esi], ebx
je 0x42175c
mov dword [eax + 0x1c], ebx
mov ecx, dword [esi]
push ecx
push ebx
push 0xc
push edi
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4217a7
sub eax, esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4217b3
sub ecx, esi
push eax
push ecx
mov edx, ebp
mov ecx, edi
call fcn.004742f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebp, dword [esp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x5994c8
push 0x3e6
push 0xd
push edi
call esi
push 0x574b28
push 0x5994c8
call fcn.00563db0
add esp, 8
cmp eax, ebx
je 0x4217fe
mov byte [eax], bl
cmp byte [0x5994c8], bl
je 0x421823
mov edx, 0x5994c8
mov ecx, ebp
call fcn.00421450
push 0x574b10
push ebx
push 0xc
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor ecx, ecx
call fcn.0041c8e0
push 0x574b10
push ebx
push 0xc
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret