joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cc50
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x1c]
push edi
mov dword [esp + 8], closesocket
movzx eax, byte [esi + 4]
add eax, 0xfffffff7
cmp eax, 8
ja case.0x46cc71.12
jmp dword [eax*4 + 0x46cd6c]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x19f
push dword [esi]
call edi
cmp eax, 0xffffffff
je 0x46cd17
lea ecx, [esp + 8]
push ecx
push eax
push 0x198
push dword [esi]
call edi
jmp 0x46cd17
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [esi]
call edi
cmp eax, 0xffffffff
je 0x46cd17
lea ecx, [esp + 8]
mov dword [esp + 8], 2
push ecx
push eax
push 0x100e
push dword [esi]
call edi
jmp 0x46cd17
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push dword [esi]
call edi
test eax, eax
je 0x46cd17
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 1
push 0x1104
push dword [esi]
call edi
jmp 0x46cd17
lea eax, [esp + 8]
push eax
push 0
push 0x419
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 8], 0x80000000
je case.0x46cc71.12
push 2
lea eax, [esp + 0xc]
push eax
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x46cd41
lea eax, [esp + 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 8]
pop edi
mov dword [esi], eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
cdq
sub eax, edx
sar eax, 1
add eax, 2
add eax, dword [esp + 8]
mov dword [esi + 4], eax
pop esi
add esp, 0x14
ret 8
Function at 0x46d2f0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 8
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0xc], edi
nop dword [eax]
movzx eax, word [esi]
cmp eax, 0x20
je 0x46d30d
cmp eax, 9
jne 0x46d312
add esi, 2
jmp 0x46d300
movzx eax, word [esi]
test ax, ax
jne 0x46d322
pop edi
xor al, al
pop esi
add esp, 8
ret
cmp word [esi + 2], 0
lea ecx, [esi + 2]
jne 0x46d33b
mov word [edi + 2], ax
mov al, 1
mov byte [edi], 0
pop edi
pop esi
add esp, 8
ret
push ebx
push ebp
push 0x2b
xor bl, bl
mov byte [edi], 1
push ecx
mov byte [esp + 0x1b], bl
call fcn.00492ca4
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46d404
nop dword [eax + eax]
lea edi, [ebp - 2]
cmp edi, esi
jbe 0x46d37b
movzx eax, word [edi]
cmp eax, 0x20
je 0x46d374
cmp eax, 9
jne 0x46d37b
sub edi, 2
cmp edi, esi
ja 0x46d367
sub edi, esi
sar edi, 1
inc edi
push edi
push str.Ctrl
push esi
call fcn.00495d63
add esp, 0xc
test eax, eax
jne 0x46d398
or bl, 1
jmp 0x46d3c6
push edi
push 0x4c77fc
push esi
call fcn.00495d63
add esp, 0xc
test eax, eax
jne 0x46d3b0
or bl, 4
jmp 0x46d3c6
push edi
push str.Shift
push esi
call fcn.00495d63
add esp, 0xc
test eax, eax
jne 0x46d434
or bl, 0x10
mov byte [esp + 0x13], bl
lea esi, [ebp + 2]
nop dword [eax]
movzx eax, word [esi]
cmp eax, 0x20
je 0x46d3dd
cmp eax, 9
jne 0x46d3e2
add esi, 2
jmp 0x46d3d0
cmp word [esi], 0
je 0x46d434
lea eax, [esi + 2]
push 0x2b
push eax
call fcn.00492ca4
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x46d360
mov edi, dword [esp + 0x14]
cmp word [esi + 2], 0
jne 0x46d43e
push 1
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea edx, [esp + 0x1b]
mov ecx, eax
call fcn.00416e40
mov bl, byte [esp + 0x1b]
add esp, 8
jmp 0x46d456
pop ebp
pop ebx
pop edi
xor al, al
pop esi
add esp, 8
ret
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00416d70
add esp, 0xc
movzx eax, al
mov word [edi + 2], ax
test bl, 1
je 0x46d465
or byte [edi], 8
test bl, 4
je 0x46d46d
or byte [edi], 0x10
test bl, 0x10
je 0x46d475
or byte [edi], 4
cmp word [edi + 2], 0
pop ebp
pop ebx
pop edi
setne al
pop esi
add esp, 8
ret

Function at 0x46d4f0
Capabilities:
Print debug messages

Disassembly:
cmp byte [ecx + 0x275], 0
je 0x46d512
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
ret 8
jmp fcn.004354a0
Function at 0x473150
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4acfe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], 0
push esi
xor edx, edx
mov dword [ebp - 0x24], ebx
lea esi, [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 8]
push edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
mov dword [ebx + 4], esi
mov dword [ebp - 4], edx
test eax, eax
jle 0x473264
nop dword [eax]
cmp edx, dword [ebp + 0x10]
jl 0x4731e1
cmp dword [0x4db77c], 0
mov ecx, 0x42
mov eax, dword [0x4d89c0]
mov esi, 0x4db448
mov edi, eax
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x2c], 0
movlpd qword [0x4debb8], xmm0
je 0x4731de
push 0x4db558
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx]
lea ecx, [edx + edx*2]
push 0
mov ecx, dword [eax + ecx*4]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov edx, ecx
push dword [ebp + 8]
push str.call
call fcn.0046fe70
add esp, 0x14
test eax, eax
je 0x473246
cmp dword [ebp - 0x14], 0
jne 0x473225
mov edx, dword [ebp - 0x1c]
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, dword [ebp - 0x18]
jl 0x4731a0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
jmp 0x473267
mov ecx, dword [ebp - 0x24]
mov eax, 3
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4746e0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20214
call fcn.004ab360
push esi
mov esi, dword [esp + 0x20228]
test esi, esi
je 0x4746fc
cmp word [esi], 0
jne 0x474701
mov esi, str.ERROR
xor eax, eax
mov word [esp + 0x218], ax
mov word [esp + 4], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push 0x104
push dword [esp + 0x20228]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 0x20224]
cmp word [eax], 0
je 0x474789
lea ecx, [esp + 0xc]
push ecx
push 0xffff
lea ecx, [esp + 0x220]
push ecx
push esi
push eax
mov eax, dword [esp + 0x20234]
lea ecx, [esp + 0x18]
cmp word [eax], 0
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [0x4ddf18]
lea eax, [esp + 0x218]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.0047b2f0
pop esi
add esp, 0x20214
ret 0x10
mov eax, dword [esp + 0x20220]
cmp word [eax], 0
je 0x4747b1
lea ecx, [esp + 0xc]
push ecx
push 0xffff
lea ecx, [esp + 0x220]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x4747c9
lea eax, [esp + 0xc]
push eax
push 0xffff
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x474766
lea eax, [esp + 0x218]
mov ecx, 0xa
nop dword [eax]
cmp word [eax], 0
jne 0x4747f4
cmp word [eax + 2], 0
je 0x474766
mov word [eax], cx
add eax, 2
jmp 0x4747e0

Function at 0x474800
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
mov ebx, edx
mov esi, 1
push edi
xor edx, edx
mov edi, ecx
call fcn.004790c0
test al, al
jne 0x4748c3
push 0
push 0
push esi
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4748c3
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474843
sub ecx, edx
sar ecx, 1
push ebp
lea eax, [ebx + ecx*2]
push 0
lea ebp, [ecx*2 + 2]
mov dword [esp + 0x18], eax
mov ecx, 0x5d
mov word [eax], cx
lea eax, [esp + 0x14]
push eax
push 4
push 0x4d2848
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4748a3
cmp dword [esp + 0x10], 4
jne 0x4748a3
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4748a3
cmp dword [esp + 0x10], ebp
je 0x4748a5
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
neg eax
pop ebp
sbb eax, eax
pop edi
and eax, esi
xor edx, edx
pop esi
mov word [ecx], dx
pop ebx
add esp, 8
ret
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x475150
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff
push eax
lea eax, [esp + 0x34]
mov edi, ecx
push eax
push 0
push edi
call ebx
cmp eax, 0x103
je 0x475216
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [eax + eax]
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x4d89c0]
mov eax, dword [eax + 0xd0]
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x475220
mov ecx, dword [esp + 0x14]
call fcn.00475150
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x475220
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x475220
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xff
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push edi
call ebx
cmp eax, 0x103
jne 0x4751a0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475230
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], ecx
push esi
push edi
test ebp, ebp
je 0x47534a
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x475257
cmp word [edi], 0
jne 0x47525f
test ebx, ebx
je 0x47534a
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x4d89c0]
mov eax, dword [eax + 0xd0]
or eax, 0x2001f
push eax
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x47534f
test ebx, ebx
jne 0x475331
mov ecx, dword [esp + 0x18]
call fcn.00475150
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x47534f
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4e0428]
cmp eax, dword [ecx + 4]
jle 0x475302
push 0x4e0428
call fcn.00490bb6
add esp, 4
cmp dword [0x4e0428], 0xffffffff
jne 0x475302
push str.RegDeleteKeyExW
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e0428
mov dword [0x4e042c], eax
call fcn.00490b77
add esp, 4
mov eax, dword [0x4d89c0]
mov ecx, dword [eax + 0xd0]
test ecx, ecx
je 0x475325
mov eax, dword [0x4e042c]
test eax, eax
je 0x475325
push 0
push ecx
push edi
push ebp
call eax
mov esi, eax
jmp 0x47534f
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x47534f
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47534f
mov esi, 0x57
mov ecx, dword [esp + 0x10]
test esi, esi
push esi
setne al
movzx eax, al
push eax
call fcn.00435120
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x475fd0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x476003
sub eax, dword [edi + 0x30]
sub eax, dword [edi + 8]
mov esi, dword [edi]
push 1
cdq
push edx
push eax
call dword [esi + 0x14]
mov dword [edi + 0x2c], 0
mov dword [edi + 8], 0
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x476022
cmp dword [edi + 0x2c], 0
jne 0x476022
mov eax, dword [edi]
push ecx
push dword [edi + 0x30]
mov ecx, edi
call dword [eax + 0x10]
mov dword [edi + 8], 0
xor eax, eax
mov ecx, edi
mov word [edi + 0x28], ax
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [ebp + 0xc]
mov ecx, edi
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
push 0
push esi
push ebx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x20], edx
call eax
test al, al
je 0x476096
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x476096
mov ecx, dword [esp + 0x14]
cmp esi, ecx
jg 0x476071
jl 0x476079
mov eax, dword [esp + 0x10]
cmp ebx, eax
jae 0x476075
jmp 0x476079
mov eax, dword [esp + 0x10]
mov ebx, eax
mov esi, ecx
mov eax, dword [edi]
mov ecx, edi
push 0
push esi
push ebx
call dword [eax + 0x14]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x1c]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4790c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x47914a
cmp word [esi], 0
je 0x47914a
push 4
push str.__
push esi
call fcn.0049e48d
add esp, 0xc
mov ecx, esi
test eax, eax
jne 0x4790f5
lea ecx, [esi + 8]
mov edx, 0x4d0b90
call fcn.004053e1
test eax, eax
je 0x47912d
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x47914a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x479125
mov eax, dword [esp + 8]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
test edi, edi
je 0x47913c
mov dword [edi], ecx
xor eax, eax
cmp ecx, 0xffffffff
setne al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x479700
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004ab360
push esi
push edi
push 0x7fff
lea eax, [esp + 0xc]
mov edi, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x479746
lea ecx, [esi*2 + 2]
push ecx
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004ab450
add esp, 0xc
mov eax, esi
pop edi
pop esi
add esp, 0x10000
ret
xor eax, eax
mov word [edi], ax
mov eax, esi
pop edi
pop esi
add esp, 0x10000
ret
Function at 0x479760
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0x18]
or eax, 1
push eax
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47978c
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov word [eax], cx
xor eax, eax
pop ecx
ret
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push edi
push 0
push 0
push dword [esp + 0x20]
mov dword [esp + 0x30], 0x208
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x47980f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47980f
shr eax, 1
dec eax
mov dword [esp + 0x1c], eax
cmp word [edi + eax*2], si
jne 0x4797f5
test eax, eax
je 0x479814
nop dword [eax + eax]
cmp word [edi + eax*2 - 2], 0
jne 0x479814
sub eax, 1
mov dword [esp + 0x1c], eax
jne 0x4797e0
pop edi
pop esi
pop ecx
ret
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 0x104
jae 0x47980f
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ecx
ret
xor eax, eax
mov word [edi], ax
pop edi
pop esi
pop ecx
ret
Function at 0x47a0b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebp
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ebp, ebp
je 0x47a0d7
push 2
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
jmp 0x47a0dd
mov esi, dword [0x4db7c4]
test esi, esi
je 0x47a244
test edi, edi
jns 0x47a0f2
mov eax, edi
neg eax
movzx eax, ax
jmp 0x47a123
test edi, edi
mov dword [esp + 0x1c], ebx
mov eax, 1
mov dword [esp + 0x20], 0x4ddfd4
cmovne eax, edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x47a080
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov eax, dword [esp + 0x20]
cmp eax, 0x4ddfd4
je 0x47a21b
push 0xe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47a21b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47a21b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x47a211
cmp dword [esp + 0x28], 0xffffffff
mov ebp, dword [esp + 0x2c]
cmovne ebp, dword [esp + 0x28]
test ebp, ebp
jne 0x47a17d
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
movzx eax, word [ebx + 4]
lea edx, [ebx + 6]
cmp eax, 1
jbe 0x47a1bf
lea ebx, [edx + 0xe]
lea edi, [eax - 1]
nop
mov al, byte [ebx]
mov cl, byte [edx]
cmp al, cl
jbe 0x47a1a4
movzx eax, cl
xor ecx, ecx
cmp eax, ebp
setl cl
jmp 0x47a1ae
movzx eax, al
xor ecx, ecx
cmp eax, ebp
setge cl
test ecx, ecx
cmovne edx, ebx
add ebx, 0xe
sub edi, 1
jne 0x47a190
mov edi, dword [esp + 0x14]
movzx eax, word [edx + 0xc]
push 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x47a215
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47a20d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x47a215
push 0
push 0
push 0
push 0x30000
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov ebx, eax
jmp 0x47a217
mov ebp, dword [esp + 0x10]
xor ebx, ebx
jmp 0x47a21b
xor ebx, ebx
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x47a22b
test ebx, ebx
je 0x47a22b
mov dword [ecx], esi
jmp 0x47a236
test ebp, ebp
je 0x47a236
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x47a244
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
test edi, edi
jle 0x47a25d
lea eax, [edi - 1]
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor eax, eax
cmp edi, 0xffffffff
cmovl eax, edi
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x47b120
Capabilities:
Write clipboard data

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, 0x4dec10
push esi
mov esi, edx
call fcn.004051d0
test eax, eax
jne 0x47b151
push 0x4c602c
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4de0d0
call fcn.004354a0
pop esi
pop ebx
add esp, 8
ret
push ebp
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebx + esi]
lea esi, [ebx + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
ja 0x47b1d9
mov ecx, dword [ebx]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x47b1d9
mov edi, esi
add esi, 4
cmp esi, eax
ja 0x47b1d9
mov edi, dword [edi]
mov ebx, esi
add esi, edi
cmp esi, eax
ja 0x47b1d9
xor eax, eax
test edi, edi
sete al
add eax, edi
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x47b28d
test edi, edi
je 0x47b1c3
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x47b228
push edi
push ebx
push eax
call fcn.004ab450
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, esi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [esp + 0x14]
lea esi, [ebx + 4]
cmp esi, eax
jbe 0x47b167
cmp dword [0x4dec28], 0
je 0x47b21b
cmp dword [0x4dec18], 0
je 0x47b201
push dword [0x4dec10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4dec18], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4dec28], 0
mov dword [0x4dec10], 0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4dec28], 0
je 0x47b271
cmp dword [0x4dec18], 0
je 0x47b257
push dword [0x4dec10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4dec18], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4dec28], 0
mov dword [0x4dec10], 0
push 0x4c602c
push 0x4b4464
mov ecx, 0x4de0d0
call fcn.004354a0
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
cmp dword [0x4dec28], 0
je 0x47b2cf
cmp dword [0x4dec18], 0
je 0x47b2b5
push dword [0x4dec10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4dec18], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4dec28], 0
mov dword [0x4dec10], 0
push 0x4c602c
push str.Out_of_memory.
mov ecx, 0x4de0d0
call fcn.004354a0
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
Function at 0x47b6b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
movzx eax, byte [esi + 0x17]
cmp eax, 3
ja case.default.0x47b6c9
jmp dword [eax*4 + 0x47b888]
call fcn.004013b0
cmp dword [0x4dc0e8], 0
jne 0x47b799
cmp dword [esi + 0xc], 0
jne 0x47b799
mov edi, dword [ebp + 8]
cmp dword [0x4e0084], esi
jne 0x47b6fb
test edi, edi
jne 0x47b75c
push 0
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x47b758
mov dword [0x4e0084], 0
test edi, edi
je 0x47b74e
mov eax, dword [0x4dc0f8]
test eax, eax
je 0x47b73b
push 0
push dword [esi + 0x18]
mov ecx, 0x4de0d0
push str.An_environment_variable_is_being_accessed__see_NoEnv.
push eax
call fcn.004359b0
mov ecx, dword [esi + 0x18]
mov edx, edi
call fcn.00479700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
dec eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x47b788
cmp byte [esi + 0x17], 0
jne 0x47b767
mov eax, dword [esi + 0xc]
jmp 0x47b769
mov eax, esi
test byte [eax + 0x15], 4
je 0x47b775
push esi
call fcn.00435af0
xor eax, eax
mov word [edi], ax
mov dword [0x4e0084], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x4e0084], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0xc]
mov ebx, ecx
mov edi, dword [ebp + 8]
shr ebx, 1
test edi, edi
je 0x47b816
test ecx, ecx
jne 0x47b7cd
cmp byte [esi + 0x17], cl
mov eax, esi
cmove eax, ecx
test byte [eax + 0x15], 4
je 0x47b7bf
push esi
call fcn.00435af0
xor eax, eax
mov word [edi], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
cmp edi, eax
je 0x47b816
cmp ecx, 0x186a0
jae 0x47b805
movzx ecx, word [eax]
test cx, cx
je 0x47b7f5
mov word [edi], cx
lea eax, [eax + 2]
movzx ecx, word [eax]
add edi, 2
test cx, cx
jne 0x47b7e4
xor eax, eax
mov word [edi], ax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ecx
push eax
push edi
call fcn.004ab450
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
mov ecx, dword [esi + 0xc]
call fcn.0047b6b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
push esi
call fcn.00404b60
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
test esi, esi
je 0x47b87c
mov word [esi + eax*2], cx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x47b863
xor ecx, ecx
mov word [eax], cx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [esi + 0x18]
mov eax, dword [esi + 0x10]
push dword [ebp + 8]
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4