joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4874
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d49da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00407c28
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040895c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4d49b7
mov eax, dword [ebp - 8]
call fcn.00404930
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4d49b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4d4997
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4d49e8
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4d4997
push 0x4d4a28
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.00441da0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00441da0
push dword [ebp - 0x20]
push 0x4d4a5c
lea eax, [ebp - 4]
mov edx, 4
call fcn.00408c48
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0040895c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4d4997
cmp dword [ebp - 0x10], 1
jbe 0x4d4997
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00442bfc
mov ecx, eax
mov eax, esi
mov edx, ebx
call fcn.00407db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d49b7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0040494c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d49e1
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407c88
lea eax, [ebp - 4]
call fcn.00407c28
ret
Function at 0x4d4ab4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00407d0c
xor eax, eax
push ebp
push 0x4d4bc3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c28
cmp dword [ebp - 4], 0
je 0x4d4b1c
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4d4afc
cmp eax, dword [edx - 4]
jb 0x4d4b01
call fcn.00405fc0
inc eax
cmp word [edx + eax*2 - 2], 0x5c
jne 0x4d4b1c
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408dd8
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040895c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4d4bad
mov eax, ebx
mov edx, 0x400
call fcn.00408ae8
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4d4b57
sub eax, 4
mov eax, dword [eax]
test eax, eax
jns 0x4d4b60
call fcn.00405fc0
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.0040895c
push eax
mov eax, dword [ebp - 8]
test eax, eax
jns 0x4d4b83
call fcn.00405fc0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4d4b9d
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00408ae8
jmp 0x4d4ba4
mov eax, ebx
call fcn.00407c28
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4bca
lea eax, [ebp - 4]
call fcn.00407c28
ret

Function at 0x4d4bd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407d0c
mov eax, dword [ebp - 8]
call fcn.00407d0c
xor eax, eax
push ebp
push 0x4d4cc2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4d4c3e
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4d4c1e
cmp eax, dword [edx - 4]
jb 0x4d4c23
call fcn.00405fc0
inc eax
cmp word [edx + eax*2 - 2], 0x5c
jne 0x4d4c3e
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408dd8
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040895c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4d4ca7
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040895c
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4d4c9e
cmp dword [ebp - 0x14], 4
jne 0x4d4c9e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4cc9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c88
ret
Function at 0x4d5778
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0x4d580c
call sub.kernel32.dll_GetModuleHandleW_2
test eax, eax
je 0x4d579b
mov eax, ebx
mov edx, 0x4d5830
call fcn.00408008
pop ebx
pop ebp
ret
push 0
push ebx
mov ecx, 0x4d5850
mov edx, 0x4d5870
mov eax, 0x80000002
call fcn.004dc598
mov eax, dword [ebx]
mov edx, 0x4d58d0
call fcn.00408d58
jne 0x4d57cc
mov eax, ebx
mov edx, 0x4d590c
call fcn.00408008
mov eax, dword [ebx]
mov edx, 0x4d5928
call fcn.00408d58
jne 0x4d57e6
mov eax, ebx
mov edx, 0x4d5964
call fcn.00408008
mov eax, dword [ebx]
mov edx, 0x4d5988
call fcn.00408d58
jne 0x4d5802
mov eax, ebx
mov edx, 0x4d59c4
call fcn.00408008
jmp 0x4d5809
mov eax, ebx
call fcn.00407c28
pop ebx
pop ebp
ret

Function at 0x4d5d7c
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.004d5a14
test al, al
jne 0x4d5d8f
xor eax, eax
jmp 0x4d5dc9
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004d59d4
cmp dword [ebp - 8], 0x61774d56
jne 0x4d5dc3
cmp dword [ebp - 0xc], 0x4d566572
jne 0x4d5dc3
cmp dword [ebp - 0x10], 0x65726177
je 0x4d5dc7
xor eax, eax
jmp 0x4d5dc9
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4d6040
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004d59d4
cmp dword [ebp - 8], 0x7263694d
jne 0x4d607a
cmp dword [ebp - 0xc], 0x666f736f
jne 0x4d607a
cmp dword [ebp - 0x10], 0x76482074
je 0x4d607e
xor eax, eax
jmp 0x4d6080
mov al, 1
test al, al
je 0x4d60a7
mov dword [ebp - 4], 0x40000001
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004d59d4
cmp dword [ebp - 4], 0x31237648
sete al
mov esp, ebp
pop ebp
ret
Function at 0x4d640c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4d6530
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5908b0], 0xff
je 0x4d643a
movzx ebx, byte [0x5908b0]
jmp 0x4d6515
xor ebx, ebx
call fcn.00412734
test al, al
jne 0x4d6515
mov eax, dword [0x5957d8]
cmp dword [eax], 0
je 0x4d6515
push 2
lea eax, [ebp - 4]
push eax
push 0x4d6540
call sub.kernel32.dll_GetEnvironmentVariableW
test eax, eax
ja 0x4d6515
push 2
lea eax, [ebp - 4]
push eax
push 0x4d6570
call sub.kernel32.dll_GetEnvironmentVariableW
test eax, eax
ja 0x4d6515
call fcn.00404d88
mov esi, eax
test esi, esi
jle 0x4d64c4
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404de8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00441234
mov eax, dword [ebp - 8]
mov edx, 0x4d65a0
call fcn.00408d58
je 0x4d6515
inc dword [ebp - 4]
dec esi
jne 0x4d6499
xor eax, eax
call fcn.004b1ab0
test al, al
je 0x4d6509
xor edx, edx
xor eax, eax
call fcn.004b1abc
xor eax, eax
push ebp
push 0x4d6502
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004d62e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d650e
mov dl, 1
xor eax, eax
call fcn.004b1abc
ret
call fcn.004d62e8
movzx ebx, byte [0x5908b0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6537
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00407c88
ret
Function at 0x4d67c0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d6994
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00407c28
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d6971
xor eax, eax
push ebp
push 0x4d696a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
call fcn.00404930
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4d694c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4d6936
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
dec edi
test edi, edi
jns 0x4d686c
call fcn.00405fc0
test edi, edi
jl 0x4d6936
inc edi
xor ebx, ebx
cmp ebx, 0x400
jbe 0x4d6884
call fcn.00405fc0
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x400
jbe 0x4d68a7
call fcn.00405fc0
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov eax, dword [edx + eax*4 + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameW
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00408ae8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040895c
push eax
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameW
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00408ae8
push dword [esi]
lea ecx, [ebp - 0x24]
mov edx, 0x1f
mov eax, dword [ebp - 8]
call fcn.004d6774
push dword [ebp - 0x24]
push ebp
lea eax, [ebp - 0x28]
call fcn.004d6690
pop ecx
push dword [ebp - 0x28]
push 0x4d69b0
mov eax, esi
mov edx, 4
call fcn.00408c48
inc ebx
dec edi
jne 0x4d6877
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6953
mov eax, dword [ebp - 0x14]
call fcn.0040494c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d699b
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407c88
lea eax, [ebp - 8]
call fcn.00407c28
ret
Function at 0x4d705c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d70e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00408ae8
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x4d7096
sub esi, 4
mov esi, dword [esi]
test esi, esi
jns 0x4d709f
call fcn.00405fc0
push esi
mov eax, dword [ebx]
call fcn.0040895c
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, eax
mov eax, ebx
call fcn.00408ae8
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.004481b8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00408008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d70e7
lea eax, [ebp - 8]
call fcn.00407c28
ret

Function at 0x4d7b20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x14], eax
push 0x80000001
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00460db0
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
test eax, eax
jns 0x4d7b61
call fcn.00405fc0
push eax
push 0x4d7aa0
call sub.user32.dll_EnumWindows
test eax, eax
je 0x4d7b79
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x4d7b8f
push 0
push ebx
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00460db0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db2ec
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, 0x4db31c
call fcn.004db2d4
test al, al
je 0x4db309
mov dword [ebx], 1
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx], eax
pop ebx
pop ebp
ret

Function at 0x4db340
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
cmp dword [eax], 0
je 0x4db356
xor edx, edx
mov dword [eax], edx
mov eax, 0x4db364
call fcn.004db2e0
pop ebp
ret
Function at 0x4dc9e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4dcb0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, edi
call fcn.00408050
cmp dword [ebp - 4], 0
je 0x4dca48
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4dca28
cmp eax, dword [edx - 4]
jb 0x4dca2d
call fcn.00405fc0
inc eax
cmp word [edx + eax*2 - 2], 0x5c
jne 0x4dca48
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00408dd8
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040895c
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExW
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x4dcaf0
xor eax, eax
push ebp
push 0x4dcae9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, esi
test ebx, ebx
je 0x4dca92
sub ebx, 4
mov ebx, dword [ebx]
mov eax, ebx
add eax, eax
test eax, eax
jns 0x4dca9f
call fcn.00405fc0
push eax
mov eax, esi
call fcn.0040895c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040895c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4dcad2
call fcn.004488fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcaf5
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
call fcn.004488fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcb12
lea eax, [ebp - 4]
call fcn.00407c28
ret
Function at 0x4dcc1c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4dcd8d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4dcc5e
mov ecx, 0x40b
mov edx, 0x4dcdac
mov eax, 0x4dcdf8
call fcn.00407a60
cmp dword [ebp - 4], 0
jne 0x4dcc78
mov ecx, 0x40c
mov edx, 0x4dcdac
mov eax, 0x4dcdf8
call fcn.00407a60
mov edx, ebx
mov eax, 0x4dce28
call fcn.00408efc
test eax, eax
je 0x4dcc9c
mov ecx, 0x40d
mov edx, 0x4dcdac
mov eax, 0x4dcdf8
call fcn.00407a60
mov edx, ebx
mov eax, 0x4dce38
call fcn.00408efc
test eax, eax
je 0x4dccc0
mov ecx, 0x40e
mov edx, 0x4dcdac
mov eax, 0x4dcdf8
call fcn.00407a60
cmp byte [0x69bf6c], 0
je 0x4dccf9
mov eax, dword [ebp - 8]
push eax
push esi
push dword [0x69bf70]
push 0x4dce28
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00408c48
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov eax, 0x80000001
call fcn.004dc598
jmp 0x4dcd6f
mov eax, esi
mov edx, 0x2800
call fcn.00408ae8
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x4dcd16
sub edi, 4
mov edi, dword [edi]
mov eax, dword [0x69bf70]
call fcn.0040895c
push eax
test edi, edi
jns 0x4dcd2a
call fcn.00405fc0
push edi
mov eax, dword [esi]
call fcn.0040895c
push eax
mov eax, dword [ebp - 8]
call fcn.0040895c
push eax
mov eax, dword [ebp - 4]
call fcn.0040895c
push eax
mov eax, ebx
call fcn.0040895c
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov edx, eax
mov eax, esi
call fcn.00408ae8
lea edx, [ebp - 0x14]
mov eax, dword [esi]
call fcn.004dc334
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00408008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcd94
lea eax, [ebp - 0x14]
call fcn.00407c28
lea eax, [ebp - 0xc]
call fcn.00407c28
ret
Function at 0x4dfd4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4dfd54
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4dfeab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c28
lea eax, [ebp - 4]
call fcn.004dfcd4
cmp dword [ebp - 4], 0
jne 0x4dfd99
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00404de8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.0044279c
test esi, esi
jne 0x4dfe3f
lea eax, [ebp - 0x18]
call fcn.00441080
lea edx, [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.004a90c4
movzx eax, byte [0x4dfeb8]
push eax
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x4dfec8
mov eax, dword [ebp - 8]
call fcn.004b393c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.00408050
movzx eax, byte [0x4dfecc]
push eax
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 0x4dfedc
mov eax, dword [ebp - 8]
call fcn.004b393c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.00408050
movzx eax, byte [0x4dfecc]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x4dfeec
mov eax, dword [ebp - 8]
call fcn.004b393c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.00408050
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4dfefc
mov eax, ebx
mov edx, 3
call fcn.00408c48
jmp 0x4dfe83
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00408ae8
mov eax, dword [ebp - 8]
call fcn.0040895c
push eax
push 0
mov eax, esi
call fcn.0040895c
push eax
mov eax, dword [ebp - 4]
call fcn.0040895c
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x4dfe83
lea eax, [ebp - 8]
call fcn.004dd870
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00408008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfeb2
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00407c88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c88
ret
Function at 0x4e3178
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e3365
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.004086e4
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00408050
call sub.kernel32.dll_GetUserDefaultLCID
mov dword [ebp - 0x10], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4e3342
xor ecx, ecx
push ebp
push 0x4e333b
push dword fs:[ecx]
mov dword fs:[ecx], esp
call sub.user32.dll_EmptyClipboard
test ebx, ebx
je 0x4e3234
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x4e3206
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e31f4
sub eax, 4
mov eax, dword [eax]
inc eax
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, 0xd
call fcn.004e30b8
mov eax, dword [ebp - 4]
test eax, eax
je 0x4e3212
sub eax, 4
mov eax, dword [eax]
inc eax
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 1
call fcn.004e30b8
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, 0x10
call fcn.004e30b8
test esi, esi
je 0x4e3328
lea eax, [ebp - 0xc]
mov ecx, 0x4e3380
mov edx, esi
call fcn.00408bc0
mov ebx, dword [ebp - 0xc]
mov eax, ebx
test eax, eax
je 0x4e3259
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 0x14
test eax, eax
jns 0x4e3267
call fcn.00405fc0
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e3328
xor ecx, ecx
push ebp
push 0x4e3321
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
test eax, eax
je 0x4e3304
xor ecx, ecx
push ebp
push 0x4e32fd
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, eax
mov dword [edx], 0x14
mov dword [edx + 0x10], 0xffffffff
mov edx, ebx
test edx, edx
je 0x4e32c2
sub edx, 4
mov edx, dword [edx]
mov ecx, edx
add ecx, ecx
mov edx, dword [ebp - 0xc]
add eax, 0x14
xchg edx, eax
call fcn.00404bcc
mov eax, dword [ebp - 0x14]
push eax
push 0xf
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x4e32e6
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3304
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3328
cmp dword [ebp - 0x14], 0
je 0x4e3320
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3342
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e336c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00407c88
lea eax, [ebp - 4]
call fcn.00407c4c
ret