joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c2c8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov bl, 1
jmp 0x46c3b4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x78], edx
xor eax, eax
push ebp
push 0x46c3a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x198], 0
je 0x46c30e
mov eax, dword [ebp - 4]
call fcn.0046bc68
jmp 0x46c362
mov dx, word [ebp - 6]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
test al, al
jne 0x46c362
push 0
push 0x400
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
call sub.WSOCK32.DLL_recv
inc eax
jne 0x46c362
call sub.WSOCK32.DLL_WSAGetLastError
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x78], esi
cmp esi, 0x2733
jne 0x46c362
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x78], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c3bc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x78], 0
je 0x46c36f
xor ebx, ebx
jmp 0x46c39e
lea eax, [ebp - 0xc]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
call sub.WSOCK32.DLL_ioctlsocket
inc eax
jne 0x46c396
call sub.WSOCK32.DLL_WSAGetLastError
mov edx, dword [ebp - 4]
mov dword [edx + 0x78], eax
xor ebx, ebx
jmp 0x46c39e
cmp dword [ebp - 0xc], 0
jne 0x46c39e
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c3b4
test bl, bl
jne 0x46c2e2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46cba8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f2c
xor eax, eax
push ebp
push 0x46cc9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.004074d0
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.00407f60
cmp byte [0x48511c], 0
jne 0x46cc04
mov eax, 0x46cca8
call fcn.0046b478
lea eax, [ebp - 0x109]
push eax
call sub.WSOCK32.DLL_inet_addr
cmp eax, 0xffffffff
jne 0x46cc76
mov edx, 0x46ccb4
lea eax, [ebp - 0x109]
call fcn.00407fbc
test eax, eax
jne 0x46cc2e
or eax, 0xffffffff
jmp 0x46cc76
lea eax, [ebp - 0x109]
push eax
call sub.WSOCK32.DLL_gethostbyname
test eax, eax
jne 0x46cc6f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x114], 0xb
lea eax, [ebp - 0x118]
push eax
push 0
mov ecx, 0x46cccc
mov dl, 1
mov eax, dword [0x46aa0c]
call fcn.0040a818
call fcn.00403554
jmp 0x46cc76
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cca1
lea eax, [ebp - 0x110]
call fcn.00403afc
lea eax, [ebp - 4]
call fcn.00403afc
ret
Function at 0x46dc9c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffc0
mov ebx, eax
cmp byte [0x48511c], 0
jne 0x46dcb5
mov eax, 0x46dcec
call fcn.0046b478
push 0x40
lea eax, [esp + 4]
push eax
call sub.WSOCK32.DLL_gethostname
test eax, eax
je 0x46dcdb
mov ecx, 0x46dd00
mov dl, 1
mov eax, dword [0x46aa0c]
call fcn.0040a7e4
call fcn.00403554
mov edx, ebx
mov eax, esp
call fcn.004080c0
add esp, 0x40
pop ebx
ret
Function at 0x47276c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
dec edi
test edi, edi
jl 0x4727c1
inc edi
xor esi, esi
lea ecx, [ebp - 0x10]
lea edx, [ebx + 8]
mov eax, ebx
call fcn.004721ac
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
xor al, byte [ebp - 0x10]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
lea edx, [ebx + 8]
lea eax, [ebx + 9]
mov ecx, 7
call fcn.004028b8
mov eax, dword [ebp - 8]
mov al, byte [eax + esi]
mov byte [ebx + 0xf], al
inc esi
dec edi
jne 0x472788
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4727cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
dec edi
test edi, edi
jl 0x472827
inc edi
xor esi, esi
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x10]
lea edx, [ebx + 8]
mov eax, ebx
call fcn.004721ac
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
xor al, byte [ebp - 0x10]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
lea edx, [ebx + 8]
lea eax, [ebx + 9]
mov ecx, 7
call fcn.004028b8
mov al, byte [ebp - 0x11]
mov byte [ebx + 0xf], al
inc esi
dec edi
jne 0x4727e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x472eec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403f3c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x472f05
test al, 0x10
jne 0x472f09
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x47401c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4741db
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4741bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.USER32.DLL_IsWindow
test eax, eax
je 0x474067
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x30], eax
jmp 0x47409e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [0x41f738]
call fcn.00403034
test al, al
je 0x47408c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00425400
mov dword [ebp - 0x30], eax
jmp 0x47409e
mov eax, dword [0x4865b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2c]
call fcn.00425400
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x46], 1
jne 0x4740ae
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x4740d1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x46]
mov eax, dword [eax*4 + 0x4862a4]
push eax
mov eax, dword [0x4865b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403f3c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.00403f3c
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 0x10]
mov edx, dword [ebp - 4]
cmp al, 7
ja 0x474108
and eax, 0x7f
bt dword [edx + 0x44], eax
jae 0x474119
xor eax, eax
mov al, byte [ebp - 0x10]
mov eax, dword [eax*4 + 0x48628c]
or dword [ebp - 0x20], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jne 0x4740f7
mov eax, 0x473c4c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.SHELL32.DLL_SHBrowseForFolder
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x47419b
lea eax, [ebp - 0x135]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.SHELL32.DLL_SHGetPathFromIDList
lea edx, [ebp - 0x13c]
lea eax, [ebp - 0x135]
call fcn.004080c0
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 4]
add eax, 0x3c
call fcn.00403b50
mov eax, dword [ebp - 4]
add eax, 0x40
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3c]
call fcn.00403b50
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x38], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4741c2
mov eax, dword [ebp - 0xc]
push eax
call sub.OLE32.DLL_CoTaskMemFree
mov eax, dword [ebp - 0x2c]
push eax
call sub.OLE32.DLL_CoTaskMemFree
ret
Function at 0x474bcc
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x474c05
mov eax, dword [0x4865b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x474bf8
push ebx
push 0x474c0c
call fcn.0042b5ec
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.USER32.DLL_OpenClipboard
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret

Function at 0x474c2c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00474bcc
xor edx, edx
push ebp
push 0x474cfb
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 2
call sub.KERNEL32.DLL_GlobalAlloc_2
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x474ccd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x474cbc
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004028b8
mov eax, dword [ebp - 4]
call fcn.00474b84
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474cc3
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret

Function at 0x474d2c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x474e0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00474bcc
xor edx, edx
push ebp
push 0x474ded
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x474db6
mov edx, ebx
mov eax, dword [0x4163f4]
call fcn.0041a6ec
test al, al
je 0x474da6
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041a5c0
call fcn.004035f4
jmp 0x474df4
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x474d71
lea edx, [ebp - 8]
mov eax, dword [0x48643c]
call fcn.00404e68
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4067b0]
call fcn.0040a7e4
call fcn.00403554
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474df4
mov eax, dword [ebp - 4]
call fcn.00474ba0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e11
lea eax, [ebp - 8]
call fcn.00403afc
ret
Function at 0x474e18
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00474bcc
xor eax, eax
push ebp
push 0x474e70
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e77
mov eax, dword [ebp - 4]
call fcn.00474ba0
ret

Function at 0x474e80
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00474bcc
xor edx, edx
push ebp
push 0x474ed5
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474edc
mov eax, dword [ebp - 4]
call fcn.00474ba0
ret

Function at 0x474f4c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00474bcc
xor eax, eax
push ebp
push 0x474fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00474b84
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041a6c0
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x474fab
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474fc8
mov eax, dword [ebp - 4]
call fcn.00474ba0
ret

Function at 0x474fd0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00474bcc
xor eax, eax
push ebp
push 0x475045
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00474b84
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x47502f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47504c
mov eax, dword [ebp - 4]
call fcn.00474ba0
ret
Function at 0x47b128
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b29b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
cmp dword [ebp - 4], 0
je 0x47b282
mov dl, 1
mov eax, dword [0x40db58]
call fcn.00402f3c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x40e]
push eax
push 0x201
call sub.KERNEL32.DLL_GetTempPathA
xor eax, eax
push ebp
push 0x47b27b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20d]
push eax
push 0
push 0x47b2ac
lea eax, [ebp - 0x40e]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.00410f40
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00410e04
push 0xffff
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x20d]
mov ecx, 0x201
call fcn.00403d28
mov ecx, dword [ebp - 0x414]
mov dl, 1
mov eax, dword [0x40da98]
call fcn.00411104
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x240]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0045de5c
mov eax, dword [ebp - 0xc]
call fcn.00402f64
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x20d]
mov ecx, 0x201
call fcn.00403d28
mov edx, dword [ebp - 0x414]
mov eax, ebx
call fcn.0047aad4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b282
mov eax, dword [ebp - 8]
call fcn.00402f64
mov eax, dword [ebp - 0xc]
call fcn.00402f64
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x20d]
mov ecx, 0x201
call fcn.00403d28
mov eax, dword [ebp - 0x414]
call fcn.00407978
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b2a2
lea eax, [ebp - 0x414]
call fcn.00403afc
ret
Function at 0x4822c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403f2c
xor eax, eax
push ebp
push 0x48230f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f3c
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482316
lea eax, [ebp - 4]
call fcn.00403afc
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4034e0
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x4034f4
inc dword [0x4aa38c]
add dword [0x4a6920], 0xe8
mov edx, dword [0x4a6920]
push esi
push edi
mov ecx, 0x3a
mov esi, 0x4a8ed0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403523
push 0
mov eax, 0x4ac280
call fcn.00415720
cmp dword [0x4aa3bc], 0
mov dword [0x4ac888], 0
mov dword [0x4ac88c], 0
je 0x40354b
push 0x4aaa20
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 0x10], 0
jne 0x4035cf
or ecx, 0xffffffff
cmp byte [esi + 0xca], 0
jne 0x40357a
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xca], al
test al, al
je 0x40357a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4ac894], 0
je 0x40358c
cmp dword [0x4ac890], 0
jne 0x403595
cmp byte [esi + 0xca], 0
je 0x4035cf
cmp byte [esi + 0xca], 0
mov byte [esi + 0xc8], 0
jne 0x4035cf
cmp dword [0x4ac894], 0
jge 0x4035b7
pop edi
mov dword [esi + 0xbc], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb8], eax
mov edx, dword [0x4ac894]
mov dword [esi + 0xbc], edx
pop edi
pop esi
ret
Function at 0x404250
Capabilities:
Write clipboard data

Disassembly:
cmp dword [0x4ac8ec], 0
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
je 0x404268
pop ebp
xor eax, eax
pop ebx
ret 4
push esi
test ebp, ebp
je 0x4042b5
cmp ebx, 0xffffffff
jne 0x404282
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404277
sub eax, edx
mov ebx, eax
test ebx, ebx
je 0x4042b5
push edi
lea edi, [ebx + 1]
mov esi, 0x4ac8e0
call fcn.004042d0
pop edi
test eax, eax
jne 0x40429f
pop esi
pop ebp
pop ebx
ret 4
mov eax, dword [0x4ac8ec]
push ebx
push ebp
push eax
mov esi, eax
call fcn.00487610
add esp, 0xc
mov byte [esi + ebx], 0
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4ac8e0
jmp fcn.00404340

Function at 0x404340
Capabilities:
Write clipboard data

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x18], edi
jne 0x404364
push esi
call fcn.00404620
test eax, eax
jne 0x404364
push str.Cant_open_clipboard_for_writing.
call fcn.00404450
pop edi
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x40439e
cmp dword [esi + 0x18], edi
je 0x40438f
cmp dword [esi + 8], edi
je 0x404384
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
push 0x4989e4
call fcn.00404450
pop edi
pop esi
ret 4
mov ecx, dword [esi + 4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp ecx, edi
je 0x4043e1
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x404409
cmp dword [esp + 0x10], 0xd
push ebx
jne 0x4043c0
cmp word [eax], di
jmp 0x4043c3
cmp byte [eax], 0
push ecx
sete bl
call ebp
test bl, bl
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
pop ebx
je 0x404409
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], edi
je 0x4043fe
cmp dword [esi + 8], edi
je 0x4043f3
mov edx, dword [esi]
push edx
call ebp
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
pop ebp
pop edi
mov eax, 1
pop esi
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x404421
mov dword [esi + 4], edi
jmp 0x4043e1
cmp dword [esi + 0x18], edi
je 0x40443e
cmp dword [esi + 8], edi
je 0x404433
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
push 0x4989f4
call fcn.00404450
pop ebp
pop edi
pop esi
ret 4
Function at 0x404520
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x108
test esi, esi
je 0x404530
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x4045ff
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.004850f0
add esp, 0xc
test eax, eax
je 0x4045f6
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00484671
add esp, 8
test eax, eax
je 0x4045f6
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00484671
add esp, 8
test eax, eax
je 0x4045f6
lea edx, [esp]
push str.Native
push edx
call fcn.00484671
add esp, 8
test eax, eax
je 0x4045f6
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00484671
add esp, 8
test eax, eax
je 0x4045f6
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.00484671
add esp, 8
test eax, eax
je 0x4045ec
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.00484671
add esp, 8
test eax, eax
jne 0x404603
test esi, esi
je 0x4045f6
mov dword [esi], 1
xor eax, eax
add esp, 0x108
ret
mov byte [esp], 0
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x108
ret

Function at 0x404620
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0
je 0x404632
mov eax, 1
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [0x4aa220]
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
push ecx
mov edi, eax
call ebx
test eax, eax
jne 0x4046a0
mov eax, dword [0x4a6880]
cmp eax, 0xffffffff
je 0x404671
test eax, eax
je 0x4046b6
call esi
mov edx, dword [0x4a6880]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x4046b6
push 1
push 0x8000012f
mov dword [0x4a6884], 0
call fcn.00401330
mov eax, dword [0x4aa220]
add esp, 8
push eax
mov dword [0x4a6884], 1
call ebx
test eax, eax
je 0x404652
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ecx + 0x18], 1
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 4