joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428216
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x1c], 0
jne 0x428270
push 0
push 0
push 0
push 0x57d4f0
call sub.gdi32.dll_CreateDCW
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x20]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp + 0xc], eax
add dword [ebp + 0x10], 0xa
add eax, 0xa
mov dword [ebp + 0xc], eax
sub dword [ebp - 0x24], 5
sub dword [ebp - 0x20], 5
jmp 0x42827b
push dword [ebp + 0x20]
call sub.user32.dll_GetDC
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.gdi32.dll_CreateCompatibleBitmap
mov esi, eax
test eax, eax
jne 0x4282c2
push dword [ebp - 4]
push dword [ebp + 0x20]
call sub.user32.dll_ReleaseDC
push dword [ebp - 8]
call sub.gdi32.dll_DeleteDC
push dword [0x5cbb00]
push 0x2331
call fcn.00418038
jmp 0x428404
push esi
push dword [ebp - 8]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x1c], 0
jne 0x4282f6
push 0xcc0020
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push 0
push dword [ebp - 8]
call sub.gdi32.dll_BitBlt
jmp 0x42830a
mov eax, dword [ebp + 0x10]
push dword [ebp + 0x20]
push dword [ebp - 8]
inc eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp + 0x1c]
cmp word [ebx], 0
jne 0x428335
push dword [0x5cbb00]
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4283cd
push esi
push 2
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
jmp 0x4283cd
movzx edx, byte [ebp + 0x24]
jmp dword [edx*4 + 0x428340]
push 2
jmp 0x4283c5
push esi
push edi
push ebx
call fcn.00414f02
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.gdi32.dll_SelectObject
cmp dword [ebp + 0x1c], 0
push dword [ebp - 4]
jne 0x4283e8
call sub.gdi32.dll_DeleteDC
jmp 0x4283f0
push dword [ebp + 0x20]
call sub.user32.dll_ReleaseDC
push dword [ebp - 8]
call sub.gdi32.dll_DeleteDC
cmp word [ebx], 0
je 0x428404
push esi
call sub.gdi32.dll_DeleteObject
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x428475
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
push ebx
mov ebx, dword [ebp + 8]
cmp byte [0x5cb5d4], 0
je 0x42860a
push 0xa0e
push 0
call fcn.00410616
push 2
call fcn.00446768
push ebx
call sub.user32.dll_BringWindowToTop
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x103
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x103
call sub.kernel32.dll_GetTempPathW
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
je 0x4284da
push 3
push 0x57d50a
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0042840b
push 3
push 0x57d512
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0042840b
push 0
push ebx
push 0
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0
push 0
push 1
call fcn.00428216
push 5
push ebx
push 0
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0
push 0
push 1
call fcn.00428216
mov eax, dword [0x5cd4dc]
mov dword [ebp - 4], eax
mov word [ebp - 0x418], 0
mov ecx, dword [0x5cd030]
push dword [0x5cbb00]
push 0xa
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
lea eax, [ebp - 4]
push eax
call fcn.004885ae
test al, al
je 0x4285cc
push 2
call fcn.00446768
mov ebx, dword [ebp - 4]
mov dword [0x5cd4dc], ebx
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
cmp ebx, 1
push 0x104
jne 0x4285b4
lea eax, reloc.gdi32.dll_AbortDoc
jmp 0x4285ba
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00411684
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00410e61
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00410e61
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
push 0
push 0
call fcn.00410616
push 0
call fcn.00446768
pop ebx
leave
ret 4

Function at 0x42d7a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x28]
push eax
push 0x5cc054
push dword [0x5e9db0]
call sub.user32.dll_GetClassInfoW
xor edx, edx
test eax, eax
jne 0x42d7f7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x5cc054
mov dword [ebp - 0xc], eax
mov eax, dword [0x5e9db0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0x42d67f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassW
mov dword [ebp - 0x2c], 0x57d630
push 0
push dword [0x5e9db0]
push 0
push dword [ebp + 8]
push 0
push 0
push 1
push 1
push 0x40000000
push dword [ebp - 0x2c]
push 0x5cc054
push 0
call sub.user32.dll_CreateWindowExW
push 0
push eax
call sub.user32.dll_ShowWindow
leave
ret 4
Function at 0x438f41
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov dword [0x5cc7a8], 0
mov dword [0x5cc7ac], 0x40f51800
mov word [0x5cc7a0], 0x200
push 2
push 0x5cc7a4
push 0x57f86c
push 0x57f870
push 0x57f87c
call sub.kernel32.dll_GetProfileStringW
mov word [0x5cc7a4], 0x2e
push 4
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x1e
push 0x400
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 0
jle 0x438fb7
mov ax, word [ebp - 0x212]
mov word [0x5cc7a6], ax
jmp 0x438fc0
mov word [0x5cc7a6], 0
cmp word [0x5cc7a6], 0
jne 0x438fe5
push 2
push 0x5cc7a6
push 0x57f886
push 0x57f88a
push 0x57f87c
call sub.kernel32.dll_GetProfileStringW
cmp word [0x5cc7a4], 0
jne 0x438ff8
mov word [0x5cc7a4], 0x2e
cmp word [0x5cc7a6], 0
jne 0x43900b
mov word [0x5cc7a6], 0x3a
push 2
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x21
push 0x400
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 0
jle 0x43903c
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
lea eax, [ebp - 1]
push eax
call fcn.00416f09
jmp 0x43904d
push 0
push 0x57f896
push 0x57f87c
call sub.kernel32.dll_GetProfileIntW
test eax, eax
je 0x439062
cmp eax, 1
je 0x43905b
cmp eax, 2
jne 0x439062
mov byte [0x5cc7a0], al
jmp 0x439069
mov byte [0x5cc7a0], 0
push 0x50
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x1f
push 0x400
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 0
jg 0x4390bd
push 0x210
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x57f7f8
push 0x57f8a2
push 0x57f87c
call sub.kernel32.dll_GetProfileStringW
cmp eax, 0
ja 0x4390bd
mov esi, 0x57f8b8
lea edi, reloc.gdi32.dll_AbortDoc
cld
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edx, edx
mov ebx, edx
mov dword [0x5cc7b0], edx
mov dword [0x5cc7b4], edx
mov dword [0x5cc7b8], edx
mov ax, word [ebp + ebx*2 - 0x212]
push eax
call fcn.0056d69a
test ax, ax
je 0x439113
cmp ax, 0x44
je 0x4390fa
cmp ax, 0x59
je 0x439102
cmp ax, 0x4d
je 0x43910a
jmp 0x439110
inc dword [0x5cc7b0]
jmp 0x439110
inc dword [0x5cc7b8]
jmp 0x439110
inc dword [0x5cc7b4]
inc ebx
jmp 0x4390d3
cmp dword [0x5cc7b0], 0
jne 0x439126
mov dword [0x5cc7b0], 1
cmp dword [0x5cc7b0], 2
jle 0x439139
mov dword [0x5cc7b0], 2
cmp dword [0x5cc7b4], 0
jne 0x43914c
mov dword [0x5cc7b4], 1
cmp dword [0x5cc7b4], 2
jle 0x43915f
mov dword [0x5cc7b4], 2
mov eax, dword [0x5cc7b8]
cmp eax, 2
je 0x439178
cmp eax, 4
je 0x439178
mov dword [0x5cc7b8], 4
mov dword [0x5cc7b8], 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447ff6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], 5
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [0x578140]
call sub.kernel32.dll_FindResourceW
mov edi, eax
test eax, eax
je 0x4480dd
push edi
push dword [0x578140]
call sub.kernel32.dll_LoadResource
mov dword [ebx], eax
test eax, eax
je 0x4480dd
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
test eax, eax
je 0x4480dd
push edi
push dword [0x578140]
call sub.kernel32.dll_SizeofResource
cmp byte [0x578130], 0
je 0x448063
or byte [esi + 9], 0x20
xor eax, eax
mov edx, eax
lea ecx, [esi + 0x1e]
jmp 0x448070
add eax, 2
inc edx
cmp word [ecx + eax], 0
jne 0x44806c
lea eax, [edx + edx]
jmp 0x448080
add eax, 2
inc edx
cmp word [ecx + eax], 0
je 0x44807c
lea edx, [edx + edx + 0x1e]
mov ax, word [esi + edx]
cmp ax, 8
jb 0x4480b8
cmp ax, 9
ja 0x4480b8
cmp byte [0x5cd904], 0
je 0x4480b2
cmp ax, 9
je 0x4480b8
mov word [esi + edx], 9
jmp 0x4480cf
cmp ax, 8
jne 0x4480c9
push dword [ebx]
call sub.kernel32.dll_GlobalUnlock
mov dword [ebx], 0
mov al, 0
jmp 0x4480dd
mov word [esi + edx], 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
push dword [ebx]
call sub.kernel32.dll_GlobalUnlock
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4484f6
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
call fcn.00446768
mov dword [ebp - 0xc], eax
call sub.user32.dll_GetFocus
mov ebx, eax
call sub.KernelBase.dll_GetCurrentThreadId
push eax
push dword [0x5e9db0]
push 0x44832b
push 5
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5ccb8c], eax
push 0
push 2
call fcn.00410616
mov dword [ebp - 8], eax
push dword [ebp + 8]
push 0x5cbb34
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call sub.user32.dll_MessageBoxW
mov dword [ebp - 4], eax
push 0
push dword [ebp - 8]
call fcn.00410616
push dword [0x5ccb8c]
call sub.user32.dll_UnhookWindowsHookEx
cmp dword [ebp - 0xc], 2
jne 0x44856f
push 2
call fcn.00446768
test ebx, ebx
je 0x448579
push ebx
call sub.user32.dll_SetFocus
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x10
Function at 0x451288
Capabilities:
Open clipboard

Disassembly:
push ebp
push dword [ebp - 4]
mov ebp, esp
add ebp, 4
sub esp, 0xc
push ebx
push esi
mov ebx, dword [ebp - 4]
push 0
push 0
push 0x188
push 0x1bfe
push dword [ebx + 8]
call sub.user32.dll_SendDlgItemMessageW
mov dword [ebx - reloc.gdi32.dll_AbortDoc], eax
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push dword [ebx - 0x220]
push 0x189
push 0x1bfe
push dword [ebx + 8]
call sub.user32.dll_SendDlgItemMessageW
lea eax, [ebp - 0x10]
push eax
add eax, 4
push eax
push 0xb0
push 0x1c10
push dword [ebx + 8]
call sub.user32.dll_SendDlgItemMessageW
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
setne al
mov byte [ebp - 5], al
test al, al
je 0x451314
push 0
push 0
push 0x300
push 0x1c10
push dword [ebx + 8]
call sub.user32.dll_SendDlgItemMessageW
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 1
push 0x58e1a8
call fcn.00415c87
mov ecx, ebx
mov ebx, eax
mov dword [ecx - reloc.gdi32.dll_AbortDoc], 1
cmp eax, reloc.gdi32.dll_AbortDoc
jne 0x45134b
mov dword [ecx - reloc.gdi32.dll_AbortDoc], 0
jmp 0x451389
inc ebx
mov ecx, dword [ebp - 4]
mov dx, word [ecx + ebx*2 - 0x218]
test dx, dx
je 0x451389
cmp dx, 0x29
je 0x451389
cmp dx, word [0x5cbaf0]
je 0x451381
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push ebx
push 1
call fcn.00415c6f
jmp 0x45134c
inc dword [ecx - reloc.gdi32.dll_AbortDoc]
jmp 0x45134b
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0045123c
mov eax, dword [ebp - 4]
mov esi, dword [eax - reloc.gdi32.dll_AbortDoc]
cmp esi, 0
jbe 0x4513bd
mov ebx, 1
jmp 0x4513b9
push 0x25
call fcn.004511fc
inc ebx
je 0x4513bd
cmp ebx, esi
jbe 0x4513af
cmp byte [ebp - 5], 0
je 0x451403
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x451403
mov ecx, dword [ebp - 4]
push 0
push 0
push 0x302
push 0x1c10
push dword [ecx + 8]
call sub.user32.dll_SendDlgItemMessageW
push 0x27
call fcn.004511fc
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x451403
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
pop esi
pop ebx
leave
ret
Function at 0x451f25
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push edi
lea eax, [ebp - 8]
push eax
add eax, 4
push eax
push 0xb0
push ebx
call sub.user32.dll_SendMessageW
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push ebx
call sub.user32.dll_GetClassNameW
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 4
push 0x58e1c0
call fcn.00415c87
cmp eax, reloc.gdi32.dll_AbortDoc
setne dl
cmp esi, 8
jne 0x451f93
cmp byte [0x5ccde0], 0
je 0x451ff3
mov eax, dword [ebp - 4]
inc eax
cmp dword [ebp - 8], eax
jne 0x451ff3
jmp 0x451fe2
cmp esi, 0x25
je 0x451fa1
cmp esi, 0x27
jne 0x452048
cmp byte [0x5ccde0], 0
je 0x451ff3
cmp esi, 0x27
jne 0x451ffa
mov edi, dword [ebp - 8]
test dl, dl
je 0x45203a
push 0x108
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push ebx
call sub.user32.dll_GetWindowTextW
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0056e571
cmp dword [ebp - 4], eax
jl 0x45203a
push dword [ebp - 4]
push dword [ebp - 4]
push 0xb1
push ebx
call sub.user32.dll_SendMessageW
mov al, 0
jmp 0x4520c0
cmp esi, 0x25
jne 0x45203a
push 0x108
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push ebx
call sub.user32.dll_GetWindowTextW
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0056e571
cmp dword [ebp - 8], eax
jne 0x452034
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x452034
lea edi, [eax - 1]
jmp 0x45203a
mov edi, dword [ebp - 8]
sub edi, 2
cmp edi, 0
jge 0x452041
xor edi, edi
lea eax, [edi + 1]
push eax
push edi
jmp 0x4520b3
cmp esi, 0x2d
jne 0x452061
cmp byte [0x5ccde0], 0
jne 0x452061
mov eax, dword [ebp - 4]
inc eax
cmp dword [ebp - 8], eax
jne 0x4520be
jmp 0x4520a6
cmp byte [0x5ccde0], 0
je 0x4520be
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x4520be
test dl, dl
je 0x4520ab
push 0x7fffffff
push 0x7fffffff
push 0xb1
push ebx
call sub.user32.dll_SendMessageW
lea eax, [ebp - 0x10]
push eax
add eax, 4
push eax
push 0xb0
push ebx
call sub.user32.dll_SendMessageW
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jne 0x4520ab
push dword [ebp - 4]
jmp 0x4520b0
mov eax, dword [ebp - 4]
inc eax
push eax
push dword [ebp - 4]
push 0xb1
push ebx
call sub.user32.dll_SendMessageW
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x452239
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0
push 0xb0
push ebx
call sub.user32.dll_SendMessageW
mov edx, eax
shr eax, 0x10
and edx, 0xffff
cmp ax, dx
jne 0x452342
push 0x108
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push ebx
call sub.user32.dll_GetWindowTextW
cmp word [ebp - 0x21c], 0
je 0x452342
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00415e67
mov byte [ebp - 5], 1
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0056e571
mov dword [ebp - 0xc], eax
push 1
lea eax, [ebp - 5]
push eax
inc eax
push eax
call fcn.004802de
test al, al
je 0x452342
mov edi, dword [ebp - 4]
test edi, edi
je 0x452342
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push dword [edi - 4]
push edi
call fcn.00415c57
xor esi, esi
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00415e67
lea edx, [esi + esi]
mov cx, word [ebp + edx - 0x21c]
test cx, cx
jne 0x452308
mov al, 1
jmp 0x45231f
cmp word [ebp + edx - 0x42c], cx
jne 0x45231d
inc esi
cmp esi, 0x107
ja 0x45231d
jbe 0x4522f4
mov al, 0
test al, al
je 0x4522b4
push edi
push ebx
call sub.user32.dll_SetWindowTextW
push dword [edi - 4]
push edi
call fcn.0056e571
push eax
push dword [ebp - 0xc]
push 0xb1
push ebx
call sub.user32.dll_SendMessageW
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x457c75
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push dword [ebp + 0x14]
push 0xc3c
push dword [ebp + 0x10]
call fcn.0041ab20
mov dword [0x5cce58], eax
mov ebx, eax
push eax
push 0xb
push 0x79e
push 1
call fcn.0041a7b7
push ebx
push 0xc
push 0x79f
push 1
call fcn.0041a7b7
push ebx
push 0xd
push 0x7a0
push 1
call fcn.0041a7b7
push ebx
push 0xe
push 0x7bf
push 1
call fcn.0041a7b7
push ebx
push 0x7bf
push 0x7a1
call fcn.0041a828
push ebx
push 0xf
push 0x7a1
push 1
call fcn.0041a7b7
push ebx
push 0x10
push 0x7a2
push 1
call fcn.0041a7b7
push ebx
push 0x7a2
push 0x7a3
call fcn.0041a828
push ebx
push 0x11
push 0x7a3
push 1
call fcn.0041a7b7
push ebx
push 0x12
push 0x7a4
push 1
call fcn.0041a7b7
push ebx
push 0x13
push 0x7a5
push 1
call fcn.0041a7b7
push ebx
push 0x7a5
push 0x7a7
call fcn.0041a828
push ebx
push 0x14
push 0x7a7
push 1
call fcn.0041a7b7
push ebx
push 0x7a7
push 0x796
call fcn.0041a828
push ebx
push 0x15
push 0x796
push 2
call fcn.0041a7b7
push ebx
push 0x16
push 0x797
push 2
call fcn.0041a7b7
push ebx
push 0x797
push 0x71a
call fcn.0041a828
push ebx
push 0x17
push 0x71a
push 2
call fcn.0041a7b7
push ebx
push 0x71a
push 0x7aa
call fcn.0041a828
push ebx
push 0x18
push 0x7aa
push 2
call fcn.0041a7b7
push ebx
push 0x7a8
call fcn.0041580e
push ebx
push 0x7a9
call fcn.0041580e
push ebx
push 0x19
push 0x745
push 2
call fcn.0041a7b7
lea eax, [ebp - 0x10]
push eax
push dword [0x5cce58]
call sub.user32.dll_GetWindowRect
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov ebx, dword [0x5cce58]
push 0x7a8
push ebx
call sub.user32.dll_GetDlgItem
mov dword [0x5cce48], eax
push 0x7a9
push ebx
call sub.user32.dll_GetDlgItem
mov dword [0x5cce4c], eax
push 8
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.004271be
lea eax, [ebp - 0x6c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov dword [0x5cce50], eax
push 0
push eax
push 0x30
push dword [0x5cce48]
call sub.user32.dll_SendMessageW
push 0
push dword [0x5cce50]
push 0x30
push dword [0x5cce4c]
call sub.user32.dll_SendMessageW
push dword [0x5cce48]
push 0
call fcn.00414b92
push dword [0x5cce4c]
call fcn.00414c15
push dword [0x5cce58]
push dword [0x5cce48]
push dword [0x5cce4c]
call fcn.0040c48d
push dword [0x5cce58]
push dword [0x5cce48]
push dword [0x5cce4c]
call fcn.00462831
pop ebx
leave
ret 0x10
Function at 0x4580a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [0x5cd038]
cmp byte [0x5cd904], 0
je 0x4580ce
mov ecx, 0x64
imul eax, ebx, 0x7d
cdq
idiv ecx
mov ebx, eax
cmp ebx, 0x7d
jge 0x4580df
mov ebx, 0x10
mov esi, 0x1f4a
jmp 0x45814d
cmp ebx, 0x96
jge 0x4580f3
mov ebx, 0x14
mov esi, 0x1f4b
jmp 0x45814d
cmp ebx, 0xc8
jge 0x458107
mov ebx, 0x18
mov esi, 0x1f4c
jmp 0x45814d
cmp ebx, 0xfa
jge 0x45811b
mov ebx, 0x20
mov esi, 0x1f4d
jmp 0x45814d
cmp ebx, 0x12c
jge 0x45812f
mov ebx, 0x28
mov esi, 0x1f4e
jmp 0x45814d
cmp ebx, 0x190
jge 0x458143
mov ebx, 0x30
mov esi, 0x1f4f
jmp 0x45814d
mov ebx, 0x40
mov esi, 0x1f50
cmp dword [0x5cbee0], 0
je 0x458160
push 0x5cbee0
call sub.mclib32.dll__MDEALLOCATE_4
mov dword [ebp - 0xc], reloc.gdi32.dll_AbortDoc
push dword [ebp - 0xc]
push esi
push dword [0x578134]
call sub.kernel32.dll_FindResourceW
mov edi, eax
push eax
push dword [0x578134]
call sub.kernel32.dll_LoadResource
mov esi, eax
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 4], eax
push edi
push dword [0x578134]
call sub.kernel32.dll_SizeofResource
mov edi, eax
push eax
push 0x5cbee0
call sub.mclib32.dll__ALLOCATE_8
push dword [ebp - 4]
push dword [0x5cbee0]
push edi
call fcn.00405e12
push esi
call sub.kernel32.dll_GlobalUnlock
push esi
call sub.kernel32.dll_FreeResource
push ebx
push ebx
call fcn.0041ab07
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4585ce
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_GetClientRect
cmp ebx, reloc.gdi32.dll_AbortDoc
jle 0x458603
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 6
push eax
push ebx
push 0
push 0
push 0
push esi
call sub.user32.dll_SetWindowPos
jmp 0x458609
mov ebx, dword [ebp - 8]
sub ebx, dword [ebp - 0x10]
cmp dword [ebp + 0x10], 2
jne 0x458644
push 0
push 0x745
push dword [0x5cce54]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_ShowWindow
push 5
push 0x745
push dword [0x5cce58]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_ShowWindow
jmp 0x4586c7
cmp dword [0x5cce20], 0
je 0x458669
push 5
push 0x745
push dword [0x5cce54]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_ShowWindow
push 0
jmp 0x458674
cmp dword [0x5cce2c], 0
je 0x45868a
push 5
push 0x745
push dword [0x5cce58]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_ShowWindow
push 0x745
push esi
call sub.user32.dll_GetDlgItem
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
sub edx, dword [ebp - 0xc]
push edx
push eax
push 1
sub ebx, eax
sar eax, 1
mov edx, ebx
jns 0x4586be
adc eax, 0
sub edx, eax
push edx
push esi
call sub.user32.dll_MoveWindow
pop esi
pop ebx
leave
ret 0xc
Function at 0x45874e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push esi
push 4
push 0x58e32a
push ebx
call fcn.00412d70
imul esi, ebx, 0xc
mov edx, dword [esi + reloc.gdi32.dll_AbortDoc]
test edx, edx
je 0x458781
push edx
call sub.user32.dll_BringWindowToTop
jmp 0x45887d
push 4
push 0x58e334
push ebx
call fcn.00412d70
push 0x26
push 0x57a932
push dword [0x5e9db0]
push 0
push 0
push 0
push 0x45838f
push dword [0x5cb628]
push 0
call fcn.00414a4d
test al, al
jne 0x4587c9
push dword [0x5cbb00]
push 4
call fcn.00418038
jmp 0x45887d
mov dword [0x5cce44], ebx
test ebx, ebx
je 0x4587e2
cmp ebx, 1
je 0x4587e9
cmp ebx, 2
je 0x4587f0
jmp 0x45887d
push 0xa3c
jmp 0x4587f5
push 0xa3a
jmp 0x4587f5
push 0xb4c
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00417dff
push 4
push 0x58e33e
push ebx
call fcn.00412d70
mov dword [esi + 0x5cce24], 0
push 4
push 0x58e348
push ebx
call fcn.00412d70
push 0
push dword [0x5e9db0]
push 0
push dword [0x5cbb00]
push 0
push 0
push 0
push 0
push 0x56000000
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x57a932
push 0
call sub.user32.dll_CreateWindowExW
push 4
push 0x58e352
push ebx
mov esi, eax
call fcn.00412d70
push 1
push esi
call sub.user32.dll_ShowWindow
push esi
call sub.user32.dll_UpdateWindow
push esi
call sub.user32.dll_SetFocus
pop esi
pop ebx
leave
ret 4

Function at 0x458e25
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x458eaf
push dword [0x5cbb00]
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x458eaf
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test eax, eax
je 0x458eaf
push ebx
call sub.kernel32.dll_GlobalWire
mov dword [ebp - 4], eax
push ebx
call sub.kernel32.dll_GlobalSize
mov edi, eax
push eax
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
test eax, eax
jne 0x458e81
push ebx
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_EmptyClipboard
jmp 0x458eaa
push esi
call sub.kernel32.dll_GlobalWire
push dword [ebp - 4]
push eax
push edi
call fcn.00405e12
push ebx
call sub.kernel32.dll_GlobalUnlock
push esi
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_EmptyClipboard
push esi
push 1
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
leave
ret