joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4823b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push esi
mov ebp, ecx
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
cmp esi, edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], edi
je 0x4824c7
push ebx
mov edi, edi
mov ebx, dword [esi + 0xc]
mov ecx, esi
mov dword [esp + 0x10], ebx
call fcn.004822f0
or edi, eax
mov ecx, esi
mov dword [esp + 0x18], edi
call fcn.00442f50
test eax, eax
je 0x482346
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x1c]
add ecx, 0x380
push 1
push ecx
mov ecx, dword [esi + 0x24]
call fcn.00464460
test byte [esi + 0x4c], 8
je 0x48235a
mov ecx, dword [esi + 0x24]
push 1
lea edx, [esi + 0x70]
push edx
call fcn.00464460
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax + 4]
push esi
call fcn.00463cf0
mov ecx, dword [esi + 0x18]
mov al, byte [ecx + 0x6e]
cmp al, 6
je 0x482374
cmp al, 0x61
jne 0x4823ba
mov eax, dword [esi + 0x20]
xor edi, edi
mov di, word [eax + 0x28]
shr edi, 9
and edi, 1
jne 0x4823b6
push 0
push 0
push 0
push 0
push 4
lea ecx, [eax + 0x58]
call fcn.00401860
mov edx, dword [esi + 0x20]
mov edi, eax
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 0x3cc]
push edi
push edx
call fcn.00467260
mov eax, dword [esi + 0x20]
or byte [eax + 0x29], 2
or dword [esp + 0x18], edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4823d9
mov edx, dword [esi + 0x18]
mov al, byte [edx + 0x6e]
cmp al, 6
je 0x4823d0
cmp al, 0x61
jne 0x4823d9
mov dword [esp + 0x1c], esi
jmp 0x4824bc
mov ecx, dword [ebp + 0x10]
cmp esi, ecx
lea eax, [ebp + 0x10]
jne 0x48243c
test ebx, ebx
je 0x482439
and eax, 0xfffff000
mov ebp, dword [eax]
mov al, byte [ebp + 0x2d]
test al, al
je 0x482431
mov eax, dword [esp + 0x14]
add eax, 0x10
push eax
mov ecx, ebp
call fcn.004225f0
mov edi, dword [esp + 0x10]
and edi, 0xfffffff8
mov ebx, eax
je 0x482431
push ebx
call fcn.00422590
add esp, 4
test al, al
je 0x482431
push edi
mov ecx, ebp
call fcn.0052a060
test al, al
je 0x482431
push edi
push ebx
mov ecx, ebp
call fcn.0052a750
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov dword [ebp + 0x10], ebx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4824a6
lea ebx, [eax + 0xc]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x48249e
mov eax, ebx
and eax, 0xfffff000
mov ebp, dword [eax]
mov al, byte [ebp + 0x2d]
test al, al
je 0x48249a
push ebx
mov ecx, ebp
call fcn.004225f0
mov edi, dword [esp + 0x10]
and edi, 0xfffffff8
mov dword [esp + 0x20], eax
je 0x48249a
push eax
call fcn.00422590
add esp, 4
test al, al
je 0x48249a
push edi
mov ecx, ebp
call fcn.0052a060
test al, al
je 0x48249a
mov ecx, dword [esp + 0x20]
push edi
push ecx
mov ecx, ebp
call fcn.0052a750
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [ebx], edx
mov ebx, edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, ebp
call fcn.0047f1c0
mov ecx, esi
call fcn.004818c0
mov edi, dword [esp + 0x18]
test ebx, ebx
mov esi, ebx
jne 0x482310
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x48b9c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, ebp
and ecx, 7
cmp cl, 7
push edi
mov eax, ebp
jne 0x48b9de
mov edx, ebp
and edx, 0xfffffff8
mov eax, dword [edx + 4]
and eax, 0xfffffff8
mov edi, eax
mov eax, esi
and eax, 0xfffff000
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
test ecx, ecx
je 0x48ba27
mov edx, dword [ecx + 0x628]
test edx, edx
je 0x48ba14
test esi, esi
je 0x48ba14
mov eax, dword [esi + 0x2c]
cmp edx, eax
je 0x48ba27
test eax, eax
je 0x48ba14
mov edx, dword [edx + 0x50]
cmp edx, dword [eax + 0x50]
je 0x48ba27
push 1
push esi
call fcn.0049b9c0
test eax, eax
jne 0x48ba27
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
test cl, 4
jne 0x48ba37
and ecx, 0xfffffff8
jmp 0x48ba3c
and ecx, 0xfffffff8
mov ecx, dword [ecx]
cmp edi, ecx
je 0x48bb37
mov ecx, dword [esi + 0x14]
test ecx, ecx
mov dword [esp + 0x14], 0
je 0x48ba88
mov edi, dword [esp + 0x18]
mov esi, dword [esi + 0x18]
test edi, edi
setne al
lea edx, [esp + 0x18]
push eax
push edx
push ebp
push esi
call fcn.00489d20
test eax, eax
je 0x48bb33
mov eax, dword [esp + 0x18]
pop edi
lea ecx, [esi + eax*8]
pop esi
pop ebp
mov dword [esp + 8], ecx
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x48bac8
mov edx, dword [esi + 0x1c]
xor ecx, ecx
test edx, edx
jbe 0x48bb33
mov esi, dword [esi + 0x18]
mov eax, dword [esi + 4]
test al, 4
jne 0x48baac
and eax, 0xfffffff8
jmp 0x48bab1
and eax, 0xfffffff8
mov eax, dword [eax]
cmp eax, edi
je 0x48bb2f
inc ecx
add esi, 8
cmp ecx, edx
jb 0x48baa0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ebx, dword [esi + 0x1c]
xor edi, edi
test ebx, ebx
jbe 0x48bb33
mov esi, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.004872f0
mov edx, dword [esp + 0x18]
mov eax, edx
and eax, 7
cmp eax, 7
mov ecx, edx
jne 0x48bafd
mov eax, edx
and eax, 0xfffffff8
mov ecx, dword [eax + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x48bb07
and ecx, 0x1f
mov eax, ecx
cmp eax, 5
jne 0x48bb1c
push 0
push ebp
push edx
call fcn.004236a0
add esp, 0xc
test al, al
jne 0x48bb2f
inc edi
add esi, 8
cmp edi, ebx
jb 0x48bad4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x490400
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
call fcn.004630d0
test al, al
jne 0x4903d6
xor eax, eax
pop ebp
ret 0x10
mov edx, dword [esp + 0xc]
push ebx
mov ebx, ebp
and ebx, 0xfffff000
mov eax, dword [ebx]
mov ecx, dword [eax + 0x3c]
push edx
call fcn.004a1fa0
test eax, eax
je 0x490400
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
movzx eax, al
test eax, eax
jne 0x490407
pop ebx
xor eax, eax
pop ebp
ret 0x10
mov eax, dword [ebp + 0x34]
push esi
push edi
mov edi, dword [eax + 8]
test edi, edi
jne 0x490442
push edi
push ebp
push 0x14
call fcn.0052b400
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4904ec
push 0x10
mov ecx, esi
call fcn.0048d390
push esi
mov ecx, ebp
mov dword [esi], 0x541730
mov edi, esi
call fcn.0048d6b0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, edi
call fcn.004898c0
mov ecx, dword [edi + 4]
lea eax, [ecx + eax*8]
cmp dword [eax], 0
je 0x490465
mov esi, dword [eax + 4]
test esi, esi
jne 0x4904a1
mov ecx, dword [ebx]
push 4
push 3
push 0x14
call fcn.005299d0
test eax, eax
je 0x49048b
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ecx
mov ecx, eax
call fcn.0048c450
mov esi, eax
jmp 0x49048d
xor esi, esi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push edx
push esi
push eax
mov ecx, edi
call fcn.0048e4c0
jmp 0x4904e8
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004634b0
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00463580
lea ecx, [esp + 0x18]
call fcn.00430970
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004634b0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 4]
call fcn.00463580
lea ecx, [esp + 0x18]
call fcn.00430970
test esi, esi
jne 0x4904f5
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret 0x10
mov edx, dword [esp + 0x14]
push edx
mov ecx, ebp
call fcn.0048bb40
test eax, eax
je 0x490511
push 0x800
mov ecx, eax
call fcn.0048ecd0
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
ret 0x10
Function at 0x4992c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4992f6
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x4992f6
mov edx, dword [esp + 0xc]
test edx, edx
jl 0x4992f6
cmp edx, 0x7efffffe
jge 0x4992f6
push esi
cmp eax, dword [eax + 0x2c]
jne 0x4992db
xor eax, eax
pop esi
ret 0x10
mov esi, dword [esp + 0x14]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx + 0x20]
push esi
push edx
mov edx, dword [esp + 0x14]
push edx
push eax
call fcn.0048ee20
pop esi
ret 0x10
xor eax, eax
ret 0x10
Function at 0x4bc6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi]
push edi
xor eax, eax
mov ecx, 0x6c
mov edi, esi
rep stosd dword es:[edi], eax
push esi
mov dword [esi], edx
mov byte [esi + 0xc], 1
call fcn.004c3c20
xor edi, edi
add esp, 4
cmp eax, edi
jl 0x4bc6d9
mov dword [esi + 8], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
push esi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xc4], edi
call fcn.004c0e70
add esp, 4
cmp eax, edi
jl 0x4bc6d9
push esi
call fcn.004bedc0
add esp, 4
cmp eax, edi
jl 0x4bc6d9
mov dword [esi + 0x18], 0xc8
xor eax, eax
pop edi
pop esi
ret

Function at 0x4ca670
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
mov esi, dword [esp + 0xc0]
push edi
xor edi, edi
xor ebp, ebp
cmp esi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
je 0x4ca63d
mov eax, dword [esp + 0xc0]
push eax
lea ecx, [esp + 0x20]
call fcn.00435140
push 0x3f
lea ecx, [esp + 0x20]
call fcn.00434e00
push esi
lea ecx, [esp + 0x20]
call fcn.00435140
mov ebx, dword [esp + 0x1c]
jmp 0x4ca644
mov ebx, dword [esp + 0xc0]
cmp ebx, edi
je 0x4ca720
mov eax, dword [str.mailto]
test eax, eax
je 0x4ca686
mov eax, 0x55910c
mov esi, eax
lea esp, [esp]
mov ecx, dword [eax]
push ecx
push ebx
call fcn.00435350
add esp, 8
test eax, eax
je 0x4ca679
cmp byte [eax], 0x3a
je 0x4ca758
mov ecx, dword [esi + 4]
add esi, 4
inc edi
test ecx, ecx
mov eax, esi
jne 0x4ca660
push 0
push str..htm
push 0x80000000
call fcn.004ca240
add esp, 0xc
test eax, eax
mov dword [esp + 0x10], eax
je 0x4ca720
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x94
call dword [0x53d2b4]
test eax, eax
je 0x4ca710
cmp dword [esp + 0x38], 1
jne 0x4ca6ce
cmp dword [esp + 0x2c], 4
jne 0x4ca6ce
cmp dword [esp + 0x30], 0x5a
jae 0x4ca710
mov ecx, dword [esp + 0x10]
push str._shellopenddeexecApplication
push ecx
call fcn.00435600
add esp, 8
test eax, eax
mov dword [esp + 0x18], eax
je 0x4ca710
push 0
push eax
push 0x80000000
call fcn.004ca240
add esp, 0xc
test eax, eax
mov dword [esp + 0x14], eax
je 0x4ca710
push ebx
push eax
call fcn.004ca450
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4ca720
mov edx, dword [esp + 0x10]
push ebx
push edx
call fcn.004ca390
add esp, 8
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00439d00
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00439d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00439d00
mov eax, dword [esp + 0x28]
push eax
call fcn.00439d00
add esp, 0x10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xac
ret
mov edx, dword [edi*4 + 0x55910c]
jmp 0x4ca714
Function at 0x4d8b30
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x13bc]
push eax
mov dword [esp + 0x14], edi
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov ebx, dword [edi + 0x13c0]
xor esi, esi
cmp ebx, esi
je 0x4d8b8c
push 1
mov dword [edi + 0x13c0], esi
call dword [0x53d2c0]
push ebx
call dword [sym.imp.WINMM.dll_waveOutReset]
cmp dword [edi + 0x10], esi
mov dword [esp + 0xc], esi
jle 0x4d8b85
push ebp
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
add edi, 0x13c4
mov esi, 0x32
push 0x20
push edi
push ebx
dec esi
call ebp
cmp eax, 0x21
jne 0x4d8b6d
push 1
call dword [0x53d2c0]
test esi, esi
jne 0x4d8b55
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x10]
inc eax
add edi, 0x20
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x4d8b50
pop ebp
push ebx
call dword [sym.imp.WINMM.dll_waveOutClose]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret

Function at 0x4d8b88
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x13bc]
push eax
mov dword [esp + 0x14], edi
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov ebx, dword [edi + 0x13c0]
xor esi, esi
cmp ebx, esi
je 0x4d8b8c
push 1
mov dword [edi + 0x13c0], esi
call dword [0x53d2c0]
push ebx
call dword [sym.imp.WINMM.dll_waveOutReset]
cmp dword [edi + 0x10], esi
mov dword [esp + 0xc], esi
jle 0x4d8b85
push ebp
mov ebp, dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
add edi, 0x13c4
mov esi, 0x32
push 0x20
push edi
push ebx
dec esi
call ebp
cmp eax, 0x21
jne 0x4d8b6d
push 1
call dword [0x53d2c0]
test esi, esi
jne 0x4d8b55
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x10]
inc eax
add edi, 0x20
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x4d8b50
pop ebp
push ebx
call dword [sym.imp.WINMM.dll_waveOutClose]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret
Function at 0x4d9dd7
Capabilities:
Check http status code

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4d9e3a
cmp byte [esi], 0
je 0x4d9e3a
mov eax, esi
lea edx, [eax + 1]
jmp 0x4d9d90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d9d90
push ebx
sub eax, edx
push esi
mov ebx, eax
call fcn.004b82f0
add esp, 4
test eax, eax
je 0x4d9db5
push esi
call fcn.00435680
add esp, 4
pop ebx
pop esi
ret
lea eax, [ebx + ebx + 2]
push edi
push eax
call fcn.0052b380
mov edi, eax
add esp, 4
test edi, edi
je 0x4d9e29
push ebp
push ebx
push edi
push ebx
push esi
call fcn.004b7f00
mov ebp, eax
mov eax, esi
add esp, 0x10
mov word [edi + ebp*2], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d9de3
sub eax, edx
lea ebx, [eax + eax*2 + 1]
push ebx
call fcn.0052b380
mov esi, eax
add esp, 4
test esi, esi
je 0x4d9e15
push 0
push 0
push ebx
push esi
push ebp
push edi
push 0
push 0
call dword [0x53d1f8]
mov byte [eax + esi], 0
push edi
call fcn.00439d00
add esp, 4
test esi, esi
pop ebp
je 0x4d9e29
pop edi
pop ebx
mov eax, esi
pop esi
ret
push 0x53dc2b
call fcn.00435680
add esp, 4
pop edi
pop ebx
pop esi
ret
push 0x53dc2b
call fcn.00435680
add esp, 4
pop esi
ret
Function at 0x4daab0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x700
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov esi, ecx
mov dword [esp + 0x5c], 0x94
call dword [0x53d2b4]
cmp dword [esp + 0x68], 2
lea edi, [esp + 8]
mov ecx, 0x13
jb 0x4daaa0
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x500]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x2f8]
rep stosd dword es:[edi], eax
mov eax, 0xff
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
cmp dword [esp + 0x5c], 3
lea ecx, [esp + 0x500]
lea edx, [esp + 0xf0]
mov dword [esp + 8], 0x4c
mov dword [esp + 0x24], ecx
mov dword [esp + 0x44], 0x5490d8
mov dword [esp + 0x2c], edx
mov dword [esp + 0x3c], 0x1820
jbe 0x4da9ff
mov dword [esp + 0x3c], 0x81820
mov edx, dword [esi + 0xcd8]
mov eax, dword [ebp + 8]
push 0x104
lea ecx, [esp + 0x2fc]
push ecx
push 3
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x5c], 0x4da380
call dword [0x53d3a8]
lea esi, [esp + 0x2f8]
mov eax, esi
push eax
call fcn.00421380
add esp, 4
test eax, eax
jle 0x4daa61
cmp word [esi], 0x7c
jne 0x4daa5b
mov word [esi], 0
add esi, 2
dec eax
jne 0x4daa50
lea edx, [esp + 8]
lea ecx, [esp + 0x2f8]
push edx
mov dword [esp + 0x18], ecx
call dword [0x53d568]
test eax, eax
je 0x4dabb5
mov eax, dword [esp + 0x24]
push 0
push eax
call fcn.004b8350
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x500]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x2f8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xf0]
rep stosd dword es:[edi], eax
mov eax, 0xff
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
cmp dword [esp + 0x5c], 3
lea edx, [esp + 0x500]
lea ecx, [esp + 0x2f8]
mov dword [esp + 8], 0x4c
mov dword [esp + 0x24], edx
mov dword [esp + 0x44], 0x5490d4
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x3c], 0x1820
jbe 0x4dab18
mov dword [esp + 0x3c], 0x81820
mov ecx, dword [esi + 0xcd8]
mov edx, dword [ebp + 8]
push 0x104
lea eax, [esp + 0xf4]
push eax
push 3
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x5c], 0x4da380
call dword [0x53d48c]
lea ecx, [esp + 0xf0]
mov eax, ecx
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4dab60
sub eax, esi
test eax, eax
jle 0x4dab7c
lea ecx, [ecx]
cmp byte [ecx], 0x7c
jne 0x4dab78
mov byte [ecx], 0
inc ecx
dec eax
jne 0x4dab70
lea eax, [esp + 8]
lea edx, [esp + 0xf0]
push eax
mov dword [esp + 0x18], edx
call dword [0x53d560]
test eax, eax
je 0x4dabb5
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00435680
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
add esp, 4
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4dac20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0xcac]
test eax, eax
push edi
je 0x4dac3f
mov eax, dword [esi + 0xcc0]
mov edx, dword [esi + 0xcc8]
mov ebx, dword [esi + 0xcb8]
mov edi, dword [esi + 0xccc]
mov ebp, dword [esi + 0xcbc]
mov ecx, eax
sub ecx, edx
mov edx, dword [esp + 0x38]
add ecx, edx
add ebx, ecx
mov ecx, dword [esi + 0xcc4]
mov dword [esi + 0xcb8], ebx
mov ebx, ecx
sub ebx, edi
mov edi, dword [esp + 0x3c]
add ebx, edi
add ebp, ebx
add eax, edx
add ecx, edi
pop edi
mov dword [esi + 0xcbc], ebp
mov dword [esi + 0xcc8], eax
mov dword [esi + 0xccc], ecx
mov dword [esi + 0xcd0], 1
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esi + 0xc98]
mov edi, dword [0x53d42c]
lea edx, [esp + 0x10]
push edx
push eax
call edi
mov edx, dword [esi + 0xc98]
mov ebx, dword [0x53d320]
lea ecx, [esp + 0x20]
push ecx
push edx
call ebx
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
sub ecx, edx
mov edx, dword [esp + 0x24]
add ecx, ebp
add eax, ecx
sub edx, dword [esp + 0x2c]
add edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
add ecx, edx
mov edx, dword [esp + 0x14]
push 1
mov dword [esp + 0x20], ecx
sub ecx, edx
push ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esi + 0xc98]
push edx
push ecx
push eax
call dword [0x53d3ac]
mov edx, dword [esi + 0xc98]
lea ecx, [esp + 0x10]
push ecx
push edx
call edi
mov ecx, dword [esi + 0xc98]
lea eax, [esp + 0x20]
push eax
push ecx
call ebx
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
sub edx, ebx
mov ebx, dword [esp + 0x3c]
add edx, ebp
mov ebp, dword [esp + 0x2c]
add eax, edx
mov edx, dword [esp + 0x24]
sub edx, ebp
add edx, ebx
add ecx, edx
mov edx, dword [esp + 0x14]
push 1
mov dword [esp + 0x20], ecx
sub ecx, edx
push ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esi + 0xc98]
push edx
push ecx
push eax
call dword [0x53d3ac]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x4df2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov ecx, eax
and ecx, 7
sub esp, 0x14
cmp cl, 7
jne 0x4df269
and eax, 0xfffffff8
mov eax, dword [eax + 4]
push esi
push 0
and eax, 0xfffffff8
push eax
lea ecx, [esp + 0x10]
call fcn.00486d40
lea ecx, [esp + 8]
call fcn.00489860
mov esi, eax
test esi, esi
je 0x4df33b
lea esp, [esp]
mov ecx, esi
call fcn.00485280
test al, 1
jne 0x4df328
mov edx, dword [esi]
mov ecx, edx
mov eax, ecx
and eax, 7
cmp eax, 7
jne 0x4df2b8
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4df2c2
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4df2e5
mov eax, edx
and edx, 7
cmp dl, 7
jne 0x4df2d7
and eax, 0xfffffff8
mov eax, dword [eax + 4]
and eax, 0xfffffff8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
test al, al
jne 0x4df328
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004872f0
mov ecx, eax
call fcn.004630b0
mov ecx, dword [eax]
call fcn.004360f0
mov cx, word [eax]
test cx, cx
je 0x4df328
lea esp, [esp]
cmp cx, 0x30
jb 0x4df342
cmp cx, 0x39
ja 0x4df342
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4df310
lea ecx, [esp + 8]
call fcn.00489860
mov esi, eax
test esi, esi
jne 0x4df290
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x4eab30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x4eac2a
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4eac29
mov eax, dword [ebx + 0x34]
cmp dword [eax], 0
jg 0x4eac29
push esi
push edi
push 1
mov ecx, ebp
call fcn.0048d5a0
mov ecx, dword [ebx + 0x34]
mov eax, dword [ecx + 0x28]
xor esi, esi
xor edi, edi
test eax, eax
je 0x4eac2f
push edi
push ebp
lea ecx, [esp + 0x18]
call fcn.00486d40
lea ecx, [esp + 0x10]
call fcn.00489860
test eax, eax
je 0x4eaafd
mov edi, edi
mov edx, dword [eax]
mov ecx, edx
mov eax, ecx
and eax, 7
cmp eax, 7
jne 0x4eaac9
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4eaad3
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4eaaf0
mov eax, edx
and edx, 7
cmp dl, 7
jne 0x4eaae8
and eax, 0xfffffff8
mov eax, dword [eax + 4]
and eax, 0xfffffff8
cmp eax, ebx
jne 0x4eaaf0
inc esi
lea ecx, [esp + 0x10]
call fcn.00489860
test eax, eax
jne 0x4eaab0
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4eab13
cmp dword [eax], ebp
jne 0x4eab0c
inc edi
mov eax, dword [eax + 4]
test eax, eax
jne 0x4eab07
cmp edi, esi
je 0x4eac1e
sub esi, edi
mov eax, esi
test eax, eax
jle 0x4eab52
mov edi, eax
mov ecx, ebx
call fcn.0048e0f0
push 0xc
mov esi, eax
call fcn.0052b380
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x4eab4f
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax], ebp
mov ecx, dword [esi]
mov dword [eax + 4], ecx
mov dword [esi], eax
dec edi
jne 0x4eab25
push 0
push ebx
lea ecx, [esp + 0x18]
call fcn.00486d40
lea ecx, [esp + 0x10]
call fcn.00489860
mov esi, eax
test esi, esi
je 0x4eac1e
mov ecx, esi
call fcn.00485280
test al, 1
jne 0x4eac0b
mov edx, dword [esi]
mov ecx, edx
mov eax, ecx
and eax, 7
cmp eax, 7
jne 0x4eab99
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4eaba3
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4eac0b
mov ecx, edx
mov eax, ecx
and eax, 7
cmp eax, 7
jne 0x4eabbf
and ecx, 0xfffffff8
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 7
cmp eax, 2
jne 0x4eabc9
and ecx, 0x1f
mov eax, ecx
cmp eax, 6
jne 0x4eabec
mov eax, edx
and edx, 7
cmp dl, 7
jne 0x4eabde
and eax, 0xfffffff8
mov eax, dword [eax + 4]
and eax, 0xfffffff8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
test al, al
jne 0x4eac0b
mov eax, dword [esi]
mov ecx, eax
and ecx, 7
cmp cl, 7
jne 0x4eabfe
and eax, 0xfffffff8
mov eax, dword [eax + 4]
and eax, 0xfffffff8
push eax
push ebx
call fcn.004eaa50
add esp, 8
lea ecx, [esp + 0x10]
call fcn.00489860
mov esi, eax
test esi, esi
jne 0x4eab71
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0048d5a0
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x10
ret
mov esi, 1
jmp 0x4eab1b