joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x42a66d
mov eax, dword [ebp - 4]
call fcn.0042a75c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
cmp byte [ebp - 5], 0
je 0x42a6a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp word [eax], 0x25ff
jne 0x42a6a3
mov eax, dword [ebp - 4]
add dword [eax + 0x18], 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x18]
sub eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0xe9
mov al, byte [ebp - 0xc]
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0xd], al
mov eax, dword [ebp - 0xc]
shr eax, 8
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0xe], al
mov eax, dword [ebp - 0xc]
shr eax, 0x10
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0xf], al
mov eax, dword [ebp - 0xc]
shr eax, 0x18
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0x10], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov al, byte [eax]
mov edx, dword [ebp - 4]
mov byte [edx + 0x11], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov al, byte [eax + 1]
mov edx, dword [ebp - 4]
mov byte [edx + 0x12], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov al, byte [eax + 2]
mov edx, dword [ebp - 4]
mov byte [edx + 0x13], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov al, byte [eax + 3]
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov al, byte [eax + 4]
mov edx, dword [ebp - 4]
mov byte [edx + 0x15], al
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x42a758
call fcn.0040f80c
mov esp, ebp
pop ebp
ret
Function at 0x42bce0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4185b4]
call fcn.00405568
xor eax, eax
push ebp
push 0x42be24
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x51d4e8], 0
jne 0x42bd33
mov ecx, dword [0x521800]
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040e244
call fcn.00404118
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403140
mov eax, ebx
call fcn.00405190
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x42be34
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406620
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004051a0
test eax, eax
jle 0x42bdcb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x42bdc4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a34
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a1c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409408
test eax, eax
jne 0x42bdc4
mov ebx, 0x15
jmp 0x42bdd0
mov ebx, 0x10
jmp 0x42bdd0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x51d4e8]
call fcn.0042bc38
mov eax, dword [ebp - 8]
call fcn.0042bc38
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42be2b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004047c0
lea eax, [ebp - 0x10]
mov edx, dword [0x4185b4]
call fcn.00405638
ret

Function at 0x42d948
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403140
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x521edc]
cmp byte [edx + 0xc], 0
je 0x42d9ac
mov edx, dword [0x521ecc]
cmp dword [edx], 2
jne 0x42d9ac
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x42d9b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42da68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0042d948
test al, al
je 0x42da4a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.0040488c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x42da4a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c6c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404c6c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004049a4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x42da03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42da6f
lea eax, [ebp - 0x2c]
call fcn.0040479c
lea eax, [ebp - 0xc]
call fcn.0040479c
ret

Function at 0x42dbd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0042d68c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404c6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42dc32
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x521bac]
mov dl, 1
mov eax, dword [0x42d584]
call fcn.0040e280
call fcn.00404118
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42dc3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42dc94
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x521ee8]
mov dl, 1
mov eax, dword [0x42d584]
call fcn.0040e280
call fcn.00404118
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042d6bc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42ef20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00407dc4
cmp ax, 0xffff
jne 0x42ef4a
mov eax, dword [ebp - 8]
neg eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
shr eax, 4
and eax, 0xffff
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
and eax, 0xf
mov dword [ebp - 0x20], eax
push 6
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42f01a
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42f01a
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
dec eax
test eax, eax
jl 0x42efd0
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
add eax, eax
add eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x42efb7
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov dword [ebp - 0x10], eax
add dword [ebp - 0x1c], 2
cmp dword [ebp - 0xc], 0
je 0x42f01a
cmp dword [ebp + 8], 0
jle 0x42f01a
mov eax, dword [ebp + 8]
dec eax
mov edx, dword [ebp - 0x10]
call fcn.0042b788
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x42f00e
mov ecx, dword [ebp - 0x10]
add ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00407dd8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov word [eax + edx*2], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x42f3e8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42f406
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0042e430
jmp 0x42f435
call sub.kernel32.dll_GetCommandLineW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0042f254
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x42f435
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor edx, edx
call fcn.004052b8
je 0x42f435
dec dword [ebp - 4]
jmp 0x42f40e
mov esp, ebp
pop ebp
ret

Function at 0x42ff58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42ffc2
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.00404a1c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409e04
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ffc9
lea eax, [ebp - 0x14]
call fcn.0040479c
ret
Function at 0x430074
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
je 0x4300d3
lea eax, [ebp - 4]
push eax
push 0x40
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4300a7
call fcn.0040f80c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 6
call fcn.004029b0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4300d3
call fcn.0040f80c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x432c5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceW
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x432c92
push ebp
call fcn.00432bec
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x432cb8
push ebp
call fcn.00432bec
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.0041e66c
mov esp, ebp
pop ebp
ret 4

Function at 0x436380
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x436386
ret

Function at 0x438a60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x438ab1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x438a98
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x438a88
jmp 0x438ab1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x438a99
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442744
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c5c
xor eax, eax
push ebp
push 0x442872
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x442845
xor eax, eax
push ebp
push 0x44283e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a6c
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x442813
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x442802
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a6c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404c6c
mov edx, ebx
pop ecx
call fcn.004029b0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442809
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x521878]
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040e244
call fcn.00404118
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442879
lea eax, [ebp - 4]
call fcn.0040479c
ret
Function at 0x442880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x442a31
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404e5c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x442a48
call fcn.00404ab8
mov eax, ebx
call fcn.00424a54
mov edi, eax
dec edi
test edi, edi
jl 0x442938
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00424a28
mov edx, dword [0x45b110]
call fcn.00403ad8
test al, al
je 0x442934
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00424a28
lea edx, [ebp - 0x14]
call fcn.0047d3f8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404e5c
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b2c
inc esi
dec edi
jne 0x4428e6
mov al, byte [0x442a4c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x442a58
mov eax, dword [ebp - 0xc]
call fcn.0040f6d0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404834
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0047d3f8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x442a48
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0047d3f8
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x442a48
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x442a48
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x442a64
call fcn.0040af48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442a38
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004047c0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004047c0
lea eax, [ebp - 0x14]
call fcn.0040479c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004047c0
ret
Function at 0x445f20
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x445ff2
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x445fc4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x445fb3
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004029b0
mov eax, dword [ebp - 4]
call fcn.00445e5c
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445fba
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x44602c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4460ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4460a1
mov edx, ebx
mov eax, dword [0x435da4]
call fcn.0043a2f0
test al, al
je 0x446091
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0043a200
call fcn.004041c4
jmp 0x4460d5
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x44605c
mov ecx, dword [0x521920]
mov dl, 1
mov eax, dword [0x40846c]
call fcn.0040e244
call fcn.00404118
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4460d5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4460dc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x446134
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44613b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x446144
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x446199
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4461a0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x446210
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x446285
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00445e5c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0043a2c4
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x44626f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44628c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x446294
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x446309
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00445e5c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4462f3
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446310
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret