joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ea4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x15c]
mov esi, 0x405064
push ebx
sub esp, 0x17c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x11c], 0
mov eax, dword [0x407040]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov eax, 0x10
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x118]
mov eax, ecx
mov ecx, 0x3f
rep stosd dword es:[edi], eax
movzx edx, byte [ebp + eax - 0x15c]
mov byte [ebp + edx - 0x11c], al
inc eax
cmp eax, 0x40
jne 0x402eea
xor edx, edx
test byte [ebp + 0xc], 3
jne 0x403082
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
shr edx, 2
cmp byte [ebx + eax - 1], 0x3d
lea edx, [edx + edx*2]
jne 0x402f1f
dec edx
mov eax, dword [ebp + 0xc]
cmp byte [ebx + eax - 2], 0x3d
jne 0x402f2a
dec edx
lea eax, [edx + 0xf]
shr eax, 4
shl eax, 4
call fcn.00402944
mov ecx, 0
mov dword [ebp - 0x170], 0
sub esp, eax
test edx, edx
cmovns ecx, edx
mov edi, esp
xor eax, eax
mov dword [ebp - 0x174], esp
xor esi, esi
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp + 0xc]
jb 0x402f78
mov esi, dword [ebp - 0x174]
mov edi, ebx
mov ecx, edx
rep movsb byte es:[edi], byte [esi]
jmp 0x403082
mov eax, dword [ebp - 0x170]
xor edi, edi
movzx eax, byte [ebx + eax]
cmp al, 0x3d
je 0x402f90
movzx edi, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x170]
movzx eax, byte [ebx + eax + 1]
cmp al, 0x3d
je 0x402fb7
movzx eax, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x170]
movzx eax, byte [ebx + eax + 2]
cmp al, 0x3d
je 0x402fde
movzx eax, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x170]
xor ecx, ecx
add dword [ebp - 0x170], 4
movzx eax, byte [ebx + eax + 3]
cmp al, 0x3d
je 0x403000
movzx eax, byte [ebp + eax - 0x11c]
mov ecx, eax
mov dword [ebp - 0x16c], esi
cmp edx, esi
ja 0x403015
mov esi, dword [ebp - 0x16c]
jmp 0x402f5c
mov eax, dword [ebp - 0x178]
shl edi, 0x12
inc dword [ebp - 0x16c]
shl eax, 0xc
add eax, edi
mov edi, dword [ebp - 0x17c]
shl edi, 6
add eax, edi
mov edi, dword [ebp - 0x174]
add eax, ecx
mov ecx, eax
shr eax, 0x10
mov byte [edi + esi], al
cmp edx, dword [ebp - 0x16c]
jbe 0x40300a
lea eax, [esi + 2]
mov dword [ebp - 0x178], eax
mov eax, edi
mov edi, dword [ebp - 0x16c]
mov byte [eax + edi], ch
lea eax, [esi + 2]
mov dword [ebp - 0x16c], eax
cmp edx, eax
jbe 0x40300a
lea eax, [esi + 3]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x174]
mov byte [eax + esi + 2], cl
jmp 0x40300a
mov eax, dword [ebp - 0x1c]
sub eax, dword [0x407040]
je 0x403092
call fcn.00401760
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4017a4
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4017b6
mov eax, dword [0x53108b]
shl eax, 2
mov dword [0x53108f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00523ed8
pop edx
call fcn.00523e3c
call fcn.00523f18
push 0
call fcn.0052533c
pop ecx
push 0x531034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x531093], eax
push 0
jmp fcn.0052ad9c

Function at 0x402054
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x34]
mov eax, 0x531350
call fcn.00524684
mov word [esi + 0x10], 8
xor edx, edx
mov dword [ebp - 4], edx
inc dword [esi + 0x1c]
mov word [esi + 0x10], 0x14
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
movzx ebx, ax
push 4
lea eax, [ebp - 0x38]
push eax
push 0x20000001
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x104
lea edx, [ebp - 0x13c]
push edx
push 4
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
cmp dword [ebp - 0x38], 0x419
jne 0x4020cc
mov ecx, dword [0x55ad0c]
mov byte [ecx], 1
mov eax, dword [0x55ad20]
mov byte [eax], 0
jmp 0x4020de
mov edx, dword [0x55ad0c]
mov byte [edx], 0
mov ecx, dword [0x55ad20]
mov byte [ecx], 1
mov word [esi + 0x10], 0x20
lea edx, [ebp - 0x13c]
lea eax, [ebp - 8]
call fcn.0052f020
inc dword [esi + 0x1c]
lea ecx, [ebp - 0xc]
mov edx, dword [eax]
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x3e8
inc dword [esi + 0x1c]
call fcn.0041cce8
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [esi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0052f334
dec dword [esi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0052f334
mov word [esi + 0x10], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0052f364
mov eax, dword [ebp - 0x10]
mov edx, 2
mov word [esi + 0x10], 0x38
push eax
lea eax, [ebp - 4]
dec dword [esi + 0x1c]
call fcn.0052f334
pop eax
mov word [esi + 0x10], 0x2c
inc dword [esi + 0x1c]
mov edx, dword [esi]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414250
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, 0x536934
call fcn.00524684
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.0052f058
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 8
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
cmp dword [ebp - 4], 0
je 0x41429c
mov edx, dword [ebp - 4]
jmp 0x4142a1
mov edx, 0x53691e
push edx
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x41430d
push eax
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 4], 0
je 0x4142bd
mov eax, dword [ebp - 4]
jmp 0x4142c2
mov eax, 0x53691f
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
test al, 1
je 0x4142e6
and eax, 0xfffffffe
push eax
cmp dword [ebp - 4], 0
je 0x4142db
mov edx, dword [ebp - 4]
jmp 0x4142e0
mov edx, 0x536920
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
cmp dword [ebp - 4], 0
je 0x4142f1
mov eax, dword [ebp - 4]
jmp 0x4142f6
mov eax, 0x536921
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
setne bl
and ebx, 1
call sub.KERNEL32.DLL_GetLastError
mov dword [esi], eax
jmp 0x414326
call sub.KERNEL32.DLL_GetLastError
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, 2
je 0x414320
cmp eax, 0x7b
jne 0x414324
mov bl, 1
jmp 0x414326
xor ebx, ebx
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.0052f334
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415678
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov edi, eax
mov eax, 0x5371e4
call fcn.00524684
mov word [ebp - 0x24], 8
xor edx, edx
mov dword [ebp - 4], edx
inc dword [ebp - 0x18]
mov word [ebp - 0x24], 0x14
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov ebx, eax
push 0
lea eax, [ebp - 0x3c]
push 0
push eax
mov esi, edi
push esi
call sub.KERNEL32.DLL_GetDiskFreeSpaceExA
test eax, eax
je 0x4156fa
mov word [ebp - 0x24], 0x20
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
xor ecx, ecx
mov dword [ebp - 8], ecx
lea eax, [ebp - 8]
inc dword [ebp - 0x18]
call fcn.00415200
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0052f334
jmp 0x41572f
mov word [ebp - 0x24], 0x2c
push 0
push 0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
inc dword [ebp - 0x18]
call fcn.00415200
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0052f334
push ebx
call sub.KERNEL32.DLL_SetErrorMode
mov word [ebp - 0x24], 0x38
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0052f364
mov eax, dword [ebp - 0x10]
mov edx, 2
mov word [ebp - 0x24], 0x44
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x18]
call fcn.0052f334
pop eax
mov word [ebp - 0x24], 0x38
inc dword [ebp - 0x18]
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41577c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov ebx, eax
mov eax, 0x537254
call fcn.00524684
mov word [ebp - 0x18], 8
xor edx, edx
mov dword [ebp - 4], edx
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x14
mov cx, word [0x536efe]
mov word [ebp - 0x30], cx
mov cl, byte [0x536f00]
mov byte [ebp - 0x2e], cl
mov byte [0x55b294], 0
mov byte [ebp - 0x30], bl
push pe_nt_image_headers32
push 0x55b294
lea eax, [ebp - 0x30]
push eax
call sub.KERNEL32.DLL_QueryDosDeviceA
movsx edx, byte [0x55b295]
cmp edx, 0x3f
jne 0x415800
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.0052f334
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x41581e
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.0052f334
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417060
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
mov eax, dword [0x536f20]
push ecx
mov dword [esp], eax
mov eax, ebp
call fcn.00416fc4
call sub.KERNEL32.DLL_GetLogicalDrives
mov esi, eax
xor edi, edi
mov ecx, edi
mov eax, esi
shr eax, cl
test al, 1
je 0x4170a5
mov ebx, edi
add bl, 0x41
mov byte [esp], bl
mov eax, ebx
call fcn.0041577c
test al, al
jne 0x4170a5
mov edx, esp
mov eax, ebp
call fcn.00416a20
inc edi
cmp edi, 0x19
jle 0x41707f
mov eax, ebp
call fcn.00417924
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41ab98
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, 0x538bf0
mov esi, 0x538d00
lea edi, [ebp - 0x24]
mov eax, 0x538ce4
call fcn.00524684
mov word [edi + 0x10], 8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 8]
lea eax, [ebx + 4]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0xc]
lea eax, [ebx + 8]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x10]
lea eax, [ebx + 0xc]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x1d]
lea eax, [ebx + 0x10]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x26]
lea eax, [ebx + 0x14]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x2e]
lea eax, [ebx + 0x18]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x37]
lea eax, [ebx + 0x1c]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x42]
lea eax, [ebx + 0x20]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x4e]
lea eax, [ebx + 0x24]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x5b]
lea eax, [ebx + 0x28]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x64]
lea eax, [ebx + 0x2c]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x6c]
lea eax, [ebx + 0x30]
call fcn.0052f020
inc dword [edi + 0x1c]
lea edx, [esi + 0x78]
lea eax, [ebx + 0x34]
call fcn.0052f020
inc dword [edi + 0x1c]
mov edx, dword [edi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f124
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x53aea8
push ebx
call fcn.00524684
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.0052f058
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
cmp dword [ebp + 8], 0
je 0x41f15e
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 4]
jmp 0x41f160
xor ecx, ecx
test ecx, ecx
je 0x41f18e
cmp dword [ebp + 8], 0
je 0x41f16f
mov eax, dword [ebp + 8]
jmp 0x41f174
mov eax, 0x53adb4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x41f183
test al, 0x10
jne 0x41f187
xor ebx, ebx
jmp 0x41f190
mov ebx, 1
jmp 0x41f190
xor ebx, ebx
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.0052f334
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f1b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
push ebx
push esi
mov dword [ebp - 0x18], edx
mov ebx, eax
lea esi, [ebp - 0x3c]
mov eax, 0x53af3c
call fcn.00524684
mov word [esi + 0x10], 8
xor edx, edx
mov dword [ebp - 4], edx
inc dword [esi + 0x1c]
mov word [esi + 0x10], 0x14
push 0
call sub.OLE32.DLL_CoInitialize
test eax, eax
jge 0x41f1fb
mov word [esi + 0x10], 0x14
jmp 0x41f334
lea ecx, [ebp - 0x40]
push ecx
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x41f263
lea eax, [ebp - 0x450]
push eax
mov edx, dword [ebp - 0x40]
push edx
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov word [esi + 0x10], 0x20
lea edx, [ebp - 0x450]
lea eax, [ebp - 8]
call fcn.0052f020
mov edx, eax
inc dword [esi + 0x1c]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [esi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0052f334
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041f124
pop ecx
test al, al
je 0x41f263
mov word [esi + 0x10], 0x14
jmp 0x41f2cd
lea eax, [ebp - 0x40]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x41f334
lea edx, [ebp - 0x450]
push edx
mov ecx, dword [ebp - 0x40]
push ecx
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov word [esi + 0x10], 0x2c
lea edx, [ebp - 0x450]
lea eax, [ebp - 0xc]
call fcn.0052f020
mov edx, eax
inc dword [esi + 0x1c]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [esi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0052f334
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041f124
pop ecx
test al, al
je 0x41f334
mov word [esi + 0x10], 0x14
mov byte [ebx], 0
cmp dword [ebp - 4], 0
je 0x41f2de
mov eax, dword [ebp - 4]
mov ebx, dword [eax - 4]
jmp 0x41f2e0
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
call fcn.0052ef9c
add esp, 8
lea eax, [ebp - 4]
call fcn.0052f52c
add ebx, dword [ebp - 4]
dec ebx
movsx edx, byte [ebx]
cmp edx, 0x5c
je 0x41f368
mov word [esi + 0x10], 0x38
mov edx, 0x53adb5
lea eax, [ebp - 0x10]
call fcn.0052f020
inc dword [esi + 0x1c]
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0052f378
dec dword [esi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0052f334
jmp 0x41f368
mov byte [ebx], 1
mov edx, 0x53adb7
mov word [esi + 0x10], 0x44
lea eax, [ebp - 0x14]
call fcn.0052f020
inc dword [esi + 0x1c]
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [esi + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0052f334
call sub.OLE32.DLL_CoUninitialize
mov word [esi + 0x10], 0x50
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x18]
call fcn.0052f364
mov eax, dword [ebp - 0x18]
mov edx, 2
mov word [esi + 0x10], 0x5c
push eax
lea eax, [ebp - 4]
dec dword [esi + 0x1c]
call fcn.0052f334
pop eax
mov word [esi + 0x10], 0x50
inc dword [esi + 0x1c]
mov edx, dword [esi]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fcc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x40]
mov eax, 0x53b4d4
call fcn.00524684
mov dword [edi + 0x1c], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.0052f058
inc dword [edi + 0x1c]
xor edx, edx
mov word [edi + 0x10], 8
mov word [edi + 0x10], 0x14
mov dword [ebp - 8], edx
xor ecx, ecx
inc dword [edi + 0x1c]
mov edx, 0x53ae36
mov word [edi + 0x10], 8
mov byte [ebp - 0x41], 1
mov word [edi + 0x10], 0x20
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0x10]
inc dword [edi + 0x1c]
mov word [edi + 0x10], 8
mov word [edi + 0x10], 0x2c
call fcn.0052f020
inc dword [edi + 0x1c]
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
inc dword [edi + 0x1c]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.0052f38c
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.0052f364
dec dword [edi + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0052f334
dec dword [edi + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0052f334
mov word [edi + 0x10], 0x38
xor ecx, ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x41]
inc dword [edi + 0x1c]
call fcn.0041f770
lea edx, [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.0052f364
dec dword [edi + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0052f334
mov word [edi + 0x10], 0x44
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
inc dword [edi + 0x1c]
lea edx, [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0052f38c
lea edx, [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0052f364
dec dword [edi + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0052f334
lea ecx, [ebp - 0x184]
push ecx
cmp dword [ebp - 8], 0
je 0x41fdfb
mov eax, dword [ebp - 8]
jmp 0x41fe00
mov eax, 0x53ae3b
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x41fe11
mov bl, 1
jmp 0x41fe35
cmp dword [ebp - 8], 0
je 0x41fe1c
mov eax, dword [ebp - 8]
jmp 0x41fe21
mov eax, 0x53ae3c
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
push esi
setne bl
and ebx, 1
call sub.KERNEL32.DLL_FindClose
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 0xc]
dec dword [edi + 0x1c]
call fcn.0052f334
dec dword [edi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0052f334
dec dword [edi + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0052f334
pop eax
mov edx, dword [edi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42becc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0x18], eax
mov eax, 0x53d5e4
call fcn.00524684
mov word [ebp - 0x2c], 8
lea eax, [ebp - 4]
call fcn.00420234
inc dword [ebp - 0x20]
mov word [ebp - 0x2c], 0x14
xor edx, edx
mov dword [ebp - 0x40], edx
mov word [ebp - 0x2c], 0x20
mov edx, 0x53c780
lea eax, [ebp - 8]
call fcn.0052f020
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0052f334
mov ecx, dword [0x55af7c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x44]
call fcn.00501c84
push eax
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x42c010
push dword [ebp - 0x40]
call sub.USER32.DLL_EnumClipboardFormats
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x42bf67
cmp dword [ebp - 0x40], 1
je 0x42bf67
cmp dword [ebp - 0x40], 0xd
jne 0x42bf4a
cmp dword [ebp - 0x40], 1
jne 0x42bfba
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x2c], 0x2c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x4c]
call fcn.0052f020
mov edx, eax
inc dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0052f334
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_GlobalUnlock
jmp 0x42c00b
cmp dword [ebp - 0x40], 0xd
jne 0x42c00b
push 0xd
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x50], eax
mov word [ebp - 0x2c], 0x38
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x50]
call fcn.0052f0f0
mov edx, eax
inc dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0052f334
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
lea eax, [ebp - 4]
call fcn.00426f0c
test al, al
jne 0x42c052
mov word [ebp - 0x2c], 0x44
lea eax, [ebp - 0x14]
call fcn.00420234
mov edx, eax
inc dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0043e27c
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0052f364
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0052f334
mov word [ebp - 0x2c], 0x50
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x18]
call fcn.0052f364
mov eax, dword [ebp - 0x18]
mov word [ebp - 0x2c], 0x5c
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0052f334
pop eax
mov word [ebp - 0x2c], 0x50
inc dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x42c098
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 4], eax
mov eax, 0x53d65c
call fcn.00524684
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.0052f058
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 8
mov byte [ebp - 0x29], 0
lea eax, [ebp - 4]
call fcn.004213e4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x42c1b7
mov edx, dword [0x55af7c]
mov ecx, dword [edx]
mov eax, dword [ecx + 0x44]
call fcn.00501c84
push eax
call sub.USER32.DLL_OpenClipboard
test eax, eax
jne 0x42c103
call sub.USER32.DLL_EmptyClipboard
jmp 0x42c1b7
call sub.USER32.DLL_EmptyClipboard
mov edx, dword [ebp - 0x30]
inc edx
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push 0x2000
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x34], eax
lea eax, [ebp - 4]
call fcn.004213c4
push eax
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_lstrcpyA
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_GlobalUnlock
push dword [ebp - 0x38]
push 1
call sub.USER32.DLL_SetClipboardData
test eax, eax
jne 0x42c165
call sub.USER32.DLL_EmptyClipboard
call sub.USER32.DLL_CloseClipboard
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_GlobalFree
jmp 0x42c1b7
push 4
push 0x2000
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [edx], 0x19
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_GlobalUnlock
push dword [ebp - 0x38]
push 0x10
call sub.USER32.DLL_SetClipboardData
test eax, eax
jne 0x42c1b2
call sub.USER32.DLL_EmptyClipboard
call sub.USER32.DLL_CloseClipboard
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_GlobalFree
jmp 0x42c1b7
call sub.USER32.DLL_CloseClipboard
mov al, byte [ebp - 0x29]
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0052f334
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret