joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ea4f0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x101ea6d4
pushal
mov esi, 0x1013f00d
lea edi, [esi - 0x13e00d]
push edi
jmp 0x101ea51a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x101ea521
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101ea510
mov eax, 1
add ebx, ebx
jne 0x101ea533
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x101ea544
jne 0x101ea563
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101ea563
dec eax
add ebx, ebx
jne 0x101ea550
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x101ea528
add ebx, ebx
jne 0x101ea55f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x101ea5b5
xor ecx, ecx
sub eax, 3
jb 0x101ea57b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x101ea5ea
sar eax, 1
mov ebp, eax
jmp 0x101ea586
add ebx, ebx
jne 0x101ea586
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101ea554
inc ecx
add ebx, ebx
jne 0x101ea594
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101ea554
add ebx, ebx
jne 0x101ea5a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x101ea596
jne 0x101ea5b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101ea596
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x101ea5d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x101ea5c6
jmp 0x101ea516
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x101ea5d4
add edi, ecx
jmp 0x101ea516
pop esi
mov edi, esi
mov ecx, 0xc20
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x101ea5f2
cmp byte [edi], 0x4f
jne 0x101ea5f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x101ea5f7
lea edi, [esi + 0x1d1000]
mov eax, dword [edi]
or eax, eax
je 0x101ea666
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ea0e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ea10c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x101ea624
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1ea110]
or eax, eax
je 0x101ea660
mov dword [ebx], eax
add ebx, 4
jmp 0x101ea641
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x101ea697
cmp al, 0xef
ja 0x101ea68a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x101ea66c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x101ea679
mov ebp, dword [esi + 0x1ea114]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x101ea6cb
sub esp, 0xffffff80
jmp 0x10129d9b
Function at 0x4027ec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40281b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403668
jmp 0x402839
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402714
mov edi, eax
test ebx, ebx
je 0x402839
cmp dword [esi], 0
je 0x402839
dec ebx
jmp 0x402822
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402910
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x417040], 0x8088405
inc edx
mov dword [0x417040], edx
mul edx
mov eax, edx
ret

Function at 0x402ac8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b60
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b40
xor eax, eax
push ebp
push 0x402b39
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b40
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x40353c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004025a0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x417045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403504
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4047f4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4049b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404855
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4049cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4048c7
xor eax, eax
push ebp
push 0x4048c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0040464c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4048a9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4049ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4048c7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4049a8
cmp byte [ebp - 0xd], 0
jne 0x404909
cmp byte [ebp - 0x12], 0
je 0x4049a8
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404922
dec ebx
cmp byte [ebx], 0x2e
je 0x404931
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404921
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4049a8
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40495e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049a8
cmp byte [ebp - 0xd], 0
je 0x4049a8
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4049a8
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e94
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x404ef0
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x404ee2
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x404ed7
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x404ed2
mov eax, 0x64
jmp 0x404ee7
call sub.kernel32.dll_GetLastError
call fcn.00402684
xor eax, eax
jmp 0x404ed2
mov eax, 0x67
jmp 0x404ee7

Function at 0x404f68
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x404f98
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x404f8e
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.00402694
or eax, 0xffffffff
jmp 0x404f8c
mov eax, 0x67
call fcn.00402684
or eax, 0xffffffff
jmp 0x404f8c

Function at 0x407abc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407af5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403668
jmp 0x407afe
mov eax, ebx
mov edx, esi
call fcn.004035d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407b08
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407b29
mov al, byte [esp]
jmp 0x407b2b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cbd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cc42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x40cc58
mov edx, ebx
call fcn.0040384c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403800
push eax
mov eax, dword [ebp - 4]
call fcn.004039b4
push eax
mov eax, dword [0x419224]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x40cc2c
mov eax, 0x40cc5c
call fcn.0040cb0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc49
lea eax, [ebp - 4]
call fcn.00403580
ret
Function at 0x40d55c
Capabilities:
Extract resource via kernel32 functions
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov byte [esp + 4], dl
mov dword [esp], eax
call fcn.0040cdc4
push 0x10
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0
mov esi, 0xa
mov edi, 0x417656
mov ebp, 0x418cca
mov bl, byte [edi]
mov al, byte [ebp]
cmp bl, 0xff
je 0x40d5c3
cmp dword [esp + 8], 0
jl 0x40d5b2
cmp al, bl
je 0x40d5b2
test bl, bl
je 0x40d5b2
test al, al
je 0x40d5b2
cmp al, 3
jne 0x40d5be
mov edx, esi
mov eax, dword [esp]
call fcn.0040d02c
jmp 0x40d5c3
mov byte [esp + 0xc], 1
inc esi
inc ebp
inc edi
cmp esi, 0x51
jne 0x40d591
cmp byte [esp + 0xc], 0
je 0x40d6be
push 0
call sub.user32.dll_ShowCursor
cmp byte [0x4182cf], 0
je 0x40d617
push 0x40d72c
push 0x2000
mov eax, dword [0x4174d8]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x4174d8]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
push 5
push ebx
call sub.kernel32.dll_LockResource
push eax
call sub.winmm.dll_sndPlaySoundA
mov dword [esp + 8], 1
call sub.kernel32.dll_GetTickCount
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, 0xf
sub eax, dword [esp + 8]
mov edx, 0x24
call fcn.0040cd08
mov edx, 0x48
mov eax, dword [esp + 8]
call fcn.0040cd08
mov esi, 0xa
mov edi, 0x417656
mov ebp, 0x418cca
mov bl, byte [edi]
cmp bl, byte [ebp]
je 0x40d671
push 0xf
mov edx, esi
mov ecx, ebx
mov eax, dword [esp + 4]
call fcn.0040cfbc
inc esi
inc ebp
inc edi
cmp esi, 0x51
jne 0x40d65b
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call sub.user32.dll_PeekMessageA
call sub.kernel32.dll_GetTickCount
cmp eax, dword [esp + 0x10]
jbe 0x40d679
inc dword [esp + 8]
cmp dword [esp + 8], 0xf
jne 0x40d61f
cmp byte [0x4182cf], 0
je 0x40d6b7
push 0
push 0
call sub.winmm.dll_sndPlaySoundA
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
call fcn.0040ce84
mov eax, dword [0x4191e8]
push eax
mov eax, dword [esp + 4]
push eax
call sub.gdi32.dll_SelectObject
mov esi, 0xa
mov edi, 0x417656
mov ebp, 0x418cca
mov bl, byte [edi]
cmp byte [esp + 4], 0
je 0x40d6fc
test bl, bl
jne 0x40d6fc
mov eax, esi
call fcn.0040e041
test eax, eax
je 0x40d6fc
mov bl, 3
mov byte [ebp], bl
mov edx, esi
mov eax, dword [esp]
call fcn.0040d2c0
cmp esi, dword [0x419188]
jne 0x40d719
mov eax, dword [esp]
call fcn.0040d4ac
inc esi
inc ebp
inc edi
cmp esi, 0x51
jne 0x40d6e2
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40ede4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x40eed4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403580
push 0
push 0
push 0
push 0
push 0x40eee4
call sub.wininet.dll_InternetOpenA
mov esi, eax
test esi, esi
je 0x40eebb
push 0
push 0x80000000
push 0
push 0
mov eax, edi
call fcn.004039b4
push eax
push esi
call sub.wininet.dll_InternetOpenUrlA
mov edi, eax
test edi, edi
je 0x40eeb5
lea eax, [ebp - 0x404]
xor ecx, ecx
mov edx, 0x400
call fcn.004028f0
lea eax, [ebp - 0x408]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.004037b0
mov edx, dword [ebp - 0x408]
mov eax, ebx
call fcn.00403808
lea eax, [ebp - 0x404]
xor ecx, ecx
mov edx, 0x400
call fcn.004028f0
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 4], 0
jne 0x40ee5e
push edi
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eedb
lea eax, [ebp - 0x408]
call fcn.00403580
ret

Function at 0x40f93c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov edi, 1
mov esi, 0x417904
mov ebp, 0x41925c
mov ebx, 0x4191ac
push 0x14
lea eax, [esp + 8]
push eax
mov eax, edi
dec eax
inc eax
add eax, dword [0x419194]
push eax
mov eax, dword [0x4174d8]
push eax
call sub.user32.dll_LoadStringA_1
cmp byte [esi], 1
jne 0x40f982
mov dword [esp], 5
jmp 0x40f9b1
xor eax, eax
mov dword [esp], eax
push 0x14
lea eax, [esp + 0x1c]
push eax
xor eax, eax
mov al, byte [ebp]
add eax, 0x1d
push eax
mov eax, dword [0x4174d8]
push eax
call sub.user32.dll_LoadStringA_1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [esp]
push eax
push 1
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_ShowWindow
lea eax, [esp + 4]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_SetWindowTextA
push 0
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_InvalidateRect
inc edi
add ebx, 4
inc ebp
inc esi
cmp edi, 3
jne 0x40f957
mov eax, dword [0x417906]
mov dword [0x4182fa], eax
mov dword [0x419184], 0xffffffff
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40fc94
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov byte [esp], al
mov eax, dword [0x4191a4]
push eax
call sub.user32.dll_OpenClipboard
call sub.user32.dll_EmptyClipboard
push 0
call sub.gdi32.dll_CreateMetaFileA
mov esi, eax
push 8
push esi
call sub.gdi32.dll_SetMapMode
push 0
push 0x133
push 0x133
push esi
call sub.gdi32.dll_SetWindowExtEx
mov eax, dword [0x4191e8]
push eax
push esi
call sub.gdi32.dll_SelectObject
mov ebx, 0x11
push 0
push 0x11
push ebx
push esi
call sub.gdi32.dll_MoveToEx
push 0x121
push ebx
push esi
call sub.gdi32.dll_LineTo
push 0
push ebx
push 0x11
push esi
call sub.gdi32.dll_MoveToEx
push ebx
push 0x121
push esi
call sub.gdi32.dll_LineTo
add ebx, 0x22
cmp ebx, 0x121
jle 0x40fce2
mov eax, esi
call fcn.0040d734
push 0x20
push 0x4196e0
push 0x10
mov eax, dword [0x4174d8]
push eax
call sub.user32.dll_LoadStringA_1
mov dword [0x4196c4], 0x10
push 0x4196c4
call sub.gdi32.dll_CreateFontIndirectA
mov ebp, eax
push ebp
push esi
call sub.gdi32.dll_SelectObject
mov al, byte [esp]
dec al
je 0x40fd63
sub al, 2
je 0x40fd71
jmp 0x40fe15
xor edx, edx
mov eax, esi
call fcn.0040fa94
jmp 0x40fe3b
movsx eax, word [0x4178fe]
movsx edx, word [0x4178fa]
sub eax, edx
add eax, eax
add eax, 0xd8
add eax, 5
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
push eax
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GlobalLock
mov edi, eax
mov eax, edi
mov cl, 0x20
mov edx, 0xd8
call fcn.004028f0
mov ebx, 1
lea eax, [ebx + ebx*2]
lea eax, [eax + eax*8]
mov byte [edi + eax - 2], 0xd
mov byte [edi + eax - 1], 0xa
inc ebx
cmp ebx, 9
jne 0x40fdbe
mov byte [edi + 0xd8], 0xd
mov byte [edi + 0xd9], 0xa
mov edx, edi
mov eax, esi
call fcn.0040fa94
mov eax, dword [esp + 8]
mov byte [edi + eax - 3], 0xd
mov eax, dword [esp + 8]
mov byte [edi + eax - 2], 0xa
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [esp + 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
jmp 0x40fe3b
call fcn.0040cdc4
mov ebx, 0xa
mov edi, 0x418cca
mov edx, ebx
mov cl, byte [edi]
mov eax, esi
call fcn.0040fa60
inc ebx
inc edi
cmp ebx, 0x51
jne 0x40fe24
call fcn.0040ce84
push ebp
call sub.gdi32.dll_DeleteObject
push esi
call sub.gdi32.dll_CloseMetaFile
mov esi, eax
push 0x10
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov dword [eax], 8
mov edx, dword [0x419660]
mov dword [eax + 4], edx
mov edx, dword [0x419660]
mov dword [eax + 8], edx
mov dword [eax + 0xc], esi
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 3
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40ff9c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov eax, dword [0x4191a4]
push eax
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov edi, eax
test edi, edi
je 0x4100c5
push edi
call sub.kernel32.dll_GlobalLock
mov esi, eax
mov bl, 0x20
movsx ebp, word [0x4178fe]
mov byte [esp + 5], 1
jmp 0x410079
mov byte [esp + 4], bl
call fcn.00402848
mov ebx, eax
inc esi
cmp bl, 0x31
jb 0x410073
cmp bl, 0x38
ja 0x410073
cmp byte [esp + 4], 0x41
jb 0x410073
cmp byte [esp + 4], 0x48
ja 0x410073
call fcn.0040ea78
test eax, eax
jne 0x41001e
mov byte [0x419240], 0xfe
xor eax, eax
call fcn.0040e1c4
call fcn.0040ea78
xor eax, eax
mov al, bl
sub eax, 0x31
lea eax, [eax + eax*8]
xor edx, edx
mov dl, byte [esp + 4]
add eax, edx
sub eax, 0x41
add eax, 0xa
mov dword [esp], eax
mov byte [esp + 5], 0
mov eax, dword [esp]
cmp byte [eax + 0x41764c], 0
jne 0x410073
mov eax, dword [esp]
call fcn.0040e041
test eax, eax
je 0x410073
mov byte [0x419240], 0xff
mov word [0x419254], 0x8001
mov al, byte [esp]
call fcn.0040e1c4
mov byte [esp + 5], 1
cmp byte [esi], 0x2c
jne 0x410079
inc esi
mov al, byte [esi]
test al, al
setne dl
and dl, byte [esp + 5]
jne 0x40ffda
movsx eax, word [0x4178fe]
cmp ebp, eax
je 0x4100bf
mov byte [0x417904], 1
mov byte [0x417905], 1
call fcn.0040f93c
movsx eax, word [0x4178fe]
xor edx, edx
call fcn.0040f504
mov dl, 1
xor eax, eax
call fcn.0040eef4
push edi
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
call fcn.0040fe90
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41032c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x410532
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowEnabled
test eax, eax
je 0x410507
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetFocus
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextLengthA
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x14]
inc ebx
mov edx, ebx
lea eax, [ebp - 0x1c]
call fcn.00403a38
push ebx
lea eax, [ebp - 0x1c]
call fcn.004039c0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x10]
push eax
push 0
push 0xb0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov esi, 1
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp - 0x14]
test edx, edx
jle 0x4103f0
mov eax, 1
mov ecx, dword [ebp - 0x1c]
mov cl, byte [ecx + eax - 1]
sub cl, 0x2e
je 0x4103df
sub cl, 0xc
jne 0x4103ec
cmp eax, dword [ebp - 0x10]
jle 0x4103e9
mov dword [ebp - 0x18], eax
jmp 0x4103f0
lea esi, [eax + 1]
inc eax
dec edx
jne 0x4103ce
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, esi
mov edx, esi
mov eax, dword [ebp - 0x1c]
call fcn.004039f8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00402994
mov ebx, eax
cmp dword [ebp - 0xc], 0
jne 0x410507
cmp dword [ebp - 8], 0
jge 0x41042d
cmp esi, 1
je 0x41042a
cmp ebx, 0x3b
jge 0x410432
inc ebx
jmp 0x410432
test ebx, ebx
jle 0x410432
dec ebx
cmp esi, 1
je 0x41046f
cmp ebx, 0xa
jge 0x41046f
mov edx, 0x410540
lea eax, [ebp - 0x24]
call fcn.004028a4
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x30]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x24]
mov cl, 2
call fcn.00402874
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.004037a4
jmp 0x41048a
lea edx, [ebp - 0x128]
mov eax, ebx
call fcn.00402988
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x20]
call fcn.004037a4
lea eax, [ebp - 0x12c]
push eax
mov ebx, esi
dec ebx
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004039f8
push dword [ebp - 0x12c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x14]
inc ecx
sub ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.004039f8
push dword [ebp - 0x130]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004038c0
mov eax, dword [ebp - 0x1c]
call fcn.004039b4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetWindowTextA
mov eax, dword [ebp - 0x20]
call fcn.00403800
mov edx, esi
dec edx
add eax, edx
push eax
push ebx
push 0xb1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410539
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.004035a4
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004035a4
ret