joyce8/EMBER2024-capa huggingface dataset:
Function at 0x631424
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x631559
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x2a4]
cmp eax, 0xa
jb 0x63153e
mov eax, dword [esi + 0x27c]
cmp byte [eax + 0x40], 0
jne 0x63153e
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00639ddc
mov eax, dword [ebp - 4]
mov edx, 0x631570
call fcn.00405af0
jne 0x6314a5
mov eax, ebx
call fcn.00639800
test al, al
je 0x6314a5
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
call sub.user32.dll_SetWindowPos
jmp 0x63153e
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
call fcn.0048e0c0
cmp ebx, eax
je 0x6314b7
xor ebx, ebx
push 0x631588
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040ba7c
push dword [ebp - 0xc]
push 0x6315a8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00639ddc
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405a5c
mov eax, dword [ebp - 8]
call fcn.0063caf8
mov eax, dword [0x65a804]
mov eax, dword [eax]
call fcn.006397d8
mov eax, dword [0x65a970]
mov eax, dword [eax]
cmp byte [eax + 0x59], 0
jne 0x63151d
mov eax, dword [0x65a970]
mov eax, dword [eax]
cmp dword [eax + 0x3e0], 0
jle 0x631529
mov eax, dword [0x659d64]
mov eax, dword [eax]
call fcn.006397d8
test ebx, ebx
je 0x631533
push ebx
call sub.user32.dll_BringWindowToTop
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x2a4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x631560
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004056d0
ret
Function at 0x632e2c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x632f42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x632f58
call fcn.00405744
lea eax, [ebp - 4]
mov edx, 0x632f68
call fcn.00405994
lea eax, [ebp - 4]
mov edx, 0x632f78
call fcn.00405994
lea eax, [ebp - 4]
mov edx, 0x632f88
call fcn.00405994
movzx eax, byte [0x632f94]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x632fa0
mov edx, 0x632fac
mov eax, dword [ebp - 4]
call fcn.00413184
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405744
mov eax, dword [ebx + 8]
call fcn.00434070
push dword [ebp - 4]
push 0x632fb8
mov eax, dword [0x659cf8]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405a5c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 8]
call fcn.004343fc
push dword [ebp - 4]
push 0x632fb8
mov eax, dword [0x659cf8]
push dword [eax]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405a5c
mov edx, dword [ebp - 0x10]
mov cl, 1
mov eax, dword [ebx + 8]
call fcn.00434108
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x632f27
call fcn.00404748
mov eax, dword [ebx + 0x10]
call fcn.00405b58
push eax
call sub.kernel32.dll_DeleteFileA
mov ecx, dword [ebx + 0x10]
mov dl, 1
mov eax, dword [0x432934]
call fcn.004329ec
mov dword [ebx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632f49
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004056d0
ret
Function at 0x639114
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 5
push 0
push 0
mov eax, ebx
call fcn.00405b58
push eax
push 0x639134
push 0
call sub.shell32.dll_ShellExecuteA
pop ebx
ret

Function at 0x639814
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b48
mov eax, dword [ebp - 8]
call fcn.00405b48
xor eax, eax
push ebp
push 0x6399ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004056ac
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405b58
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x639986
mov eax, ebx
call fcn.00402ff4
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405b58
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, 0x6399c4
call fcn.004059e0
mov eax, dword [ebp - 0x20]
call fcn.00405b58
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x6398c6
mov edx, edi
mov eax, dword [ebp - 0x18]
call fcn.0040c978
cmp dword [edi], 0
jne 0x63997d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x6399e0
push esi
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x10], 4
jb 0x63993b
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov ecx, 2
mov edx, dword [ebp - 0x18]
call fcn.0040c75c
lea ecx, [ebp - 0xc]
mov edx, 4
mov eax, dword [ebp - 0x1c]
call fcn.0040baa4
mov edx, dword [ebp - 0x18]
add edx, 2
lea eax, [ebp - 0x1c]
mov ecx, 2
call fcn.0040c75c
lea ecx, [ebp - 0x24]
mov edx, 4
mov eax, dword [ebp - 0x1c]
call fcn.0040baa4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.00405994
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x639a04
push dword [ebp - 0xc]
push 0x639a1c
push dword [ebp - 8]
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00405a5c
mov eax, dword [ebp - 0x28]
call fcn.00405b58
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x63997d
mov edx, edi
mov eax, dword [ebp - 0x18]
call fcn.0040c978
mov edx, ebx
mov eax, esi
call fcn.00403028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6399b5
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004056d0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004056d0
ret
Function at 0x639b48
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x639b94
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x639b94
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x639c58
mov eax, 0x400
call fcn.0040300c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x639c51
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x400
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x639c3b
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [0x65a0d4]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x639c32
inc ebx
xor esi, esi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + esi*8 + 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x639c2e
mov byte [ebp - 1], 1
jmp 0x639c32
inc esi
dec ebx
jne 0x639c13
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_FreeSid
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639c58
mov eax, dword [ebp - 0xc]
call fcn.00403028
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x639c64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405b48
mov eax, dword [ebp - 8]
call fcn.00405b48
xor eax, eax
push ebp
push 0x639d3b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00639a90
test al, al
jne 0x639cc9
call fcn.00639b48
test al, al
je 0x639cc9
push 1
push 0x639d48
mov eax, dword [ebp - 8]
call fcn.00405b58
push eax
mov eax, dword [ebp - 4]
call fcn.00405b58
push eax
push 0x639d48
push ebx
call sub.shell32.dll_ShellExecuteA
jmp 0x639d20
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403c80
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x500
mov eax, 0x639d4c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00405b58
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00405b58
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x639d20
call fcn.0041367c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639d42
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056d0
ret
Function at 0x639e18
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
test eax, eax
jne 0x639e2e
mov eax, ebx
call fcn.004056ac
jmp 0x639e4c
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetWindowTextA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040591c
add esp, 0x100
pop ebx
ret

Function at 0x639f64
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x63a0a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0x3a
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetLogicalDrives
test eax, eax
jns 0x639fa1
call fcn.00404610
mov edi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x639faf
bt edi, eax
jae 0x63a07c
lea eax, [ebx + 0x41]
mov byte [ebp - 7], al
mov eax, esi
mov edx, 0x104
call fcn.00405de8
push 0x104
mov eax, dword [esi]
call fcn.00405b58
push eax
lea eax, [ebp - 7]
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jbe 0x63a07c
mov eax, dword [esi]
call fcn.00405b58
call fcn.0040c6d0
mov edx, eax
mov eax, esi
call fcn.00405de8
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x63a016
mov eax, dword [ebp - 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405bc0
mov eax, dword [ebp - 0x14]
mov edx, dword [esi]
call fcn.00405af0
jne 0x63a07c
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x63a047
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x18]
push eax
lea edx, [ebx + 1]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.00405bc0
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
lea edx, [ebp - 7]
mov ecx, 3
call fcn.0040591c
mov edx, dword [ebp - 0x1c]
mov eax, esi
pop ecx
call fcn.004059e0
jmp 0x63a086
inc ebx
cmp ebx, 0x1a
jne 0x639fa5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63a0a8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004056d0
ret

Function at 0x63a434
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x63a444
call sub.user32.dll_FindWindowA
ret

Function at 0x63af24
Capabilities:
Log keystrokes

Disassembly:
push ebx
add esp, 0xffffffe4
mov ebx, eax
mov dword [esp], 1
mov word [esp + 4], bx
test dl, dl
je 0x63af44
mov dword [esp + 8], 2
jmp 0x63af4a
xor eax, eax
mov dword [esp + 8], eax
test cl, cl
je 0x63af53
or dword [esp + 8], 1
push 0
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyA
cmp eax, 0xffff
jbe 0x63af6a
call fcn.00404610
mov word [esp + 6], ax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
push 0x1c
lea eax, [esp + 4]
push eax
push 1
call sub.user32.dll_SendInput
add esp, 0x1c
pop ebx
ret
Function at 0x63b0a0
Capabilities:
Check for time delay via gettickcount
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x40], edx
mov esi, eax
lea edi, [ebp - 0x3c]
xor eax, eax
push ebp
push 0x63b26c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004060b0
test eax, eax
je 0x63b256
mov byte [0x65990c], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 4], eax
xor ebx, ebx
jmp 0x63b227
lea eax, [ebp - 0x40]
push eax
lea edx, [ebx + 1]
mov ecx, 2
mov eax, esi
call fcn.00406258
mov eax, dword [ebp - 0x40]
mov edx, 0x63b280
call fcn.004061d4
jne 0x63b185
mov dword [edi], 1
mov word [edi + 4], 0xd
xor eax, eax
mov dword [edi + 8], eax
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
cmp eax, 0xffff
jbe 0x63b12e
call fcn.00404610
mov word [edi + 6], ax
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x1c], 1
mov word [edi + 0x20], 0xd
mov dword [edi + 0x24], 2
push 0
push 0xd
call sub.user32.dll_MapVirtualKeyA
cmp eax, 0xffff
jbe 0x63b165
call fcn.00404610
mov word [edi + 0x22], ax
xor eax, eax
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], eax
push 0x1c
push edi
push 2
call sub.user32.dll_SendInput
add ebx, 2
jmp 0x63b227
mov dword [edi], 1
mov word [edi + 4], 0
mov dword [edi + 8], 4
lea eax, [ebx + 1]
dec eax
add eax, eax
jb 0x63b1a9
test esi, esi
je 0x63b1a9
cmp eax, dword [esi - 4]
jb 0x63b1ae
call fcn.00404610
shr eax, 1
inc eax
movzx eax, word [esi + eax*2 - 2]
mov word [edi + 6], ax
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x1c], 1
mov word [edi + 0x20], 0
mov dword [edi + 0x24], 6
lea eax, [ebx + 1]
dec eax
add eax, eax
jb 0x63b1e9
test esi, esi
je 0x63b1e9
cmp eax, dword [esi - 4]
jb 0x63b1ee
call fcn.00404610
shr eax, 1
inc eax
movzx eax, word [esi + eax*2 - 2]
mov word [edi + 0x22], ax
xor eax, eax
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], eax
push 0x1c
push edi
push 2
call sub.user32.dll_SendInput
inc ebx
mov eax, ebx
mov ecx, 0x32
cdq
idiv ecx
test edx, edx
jne 0x63b227
mov eax, 0x32
call fcn.0063c044
cmp byte [0x65990c], 0
je 0x63b24f
mov eax, esi
call fcn.004060b0
dec eax
cmp ebx, eax
jg 0x63b24f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 4]
cmp eax, 0x7530
jb 0x63b0e6
mov byte [0x65990c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63b273
lea eax, [ebp - 0x40]
call fcn.00405ea8
ret
Function at 0x63b544
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63b5af
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
lea eax, [ebp - 0xa]
push eax
push 3
xor edx, edx
mov eax, ebx
call fcn.004913ec
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xa]
mov ecx, 0xa
call fcn.0040591c
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov edx, 2
call fcn.0044f298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63b5b6
lea eax, [ebp - 0x10]
call fcn.004056ac
ret

Function at 0x63b604
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov word [ebp - 2], ax
mov byte [ebp - 3], 0
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
call fcn.0048c808
movzx eax, word [ebp - 2]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x63b6dc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
je 0x63b6dc
mov byte [ebp - 3], 1
xor eax, eax
push ebp
push 0x63b6d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalSize
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x63b6ba
cmp edi, dword [ebp - 0xc]
jbe 0x63b6ba
movzx eax, word [ebp - 2]
call fcn.0063b5bc
mov word [ebp - 2], ax
lea edx, [ebp - 2]
mov ecx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jns 0x63b6af
call fcn.00404610
mov edx, ebx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
jmp 0x63b6be
mov byte [ebp - 3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63b6dc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
movzx eax, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63bbac
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
add ebx, ebx
inc ebx
test ebx, ebx
js 0x63bbc8
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x63bbc1
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
call fcn.0048c808
lea edx, [ebp - 2]
mov ecx, 2
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 2
jne 0x63bd01
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x63bd01
cmp dword [ebp - 0x10], 0
je 0x63bd01
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 0x10]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x63bcee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14], 0
je 0x63bce4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x63bce4
xor eax, eax
push ebp
push 0x63bcdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jns 0x63bc72
call fcn.00404610
mov edx, esi
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x63bcb7
movzx eax, word [ebp - 2]
call fcn.0063b5bc
mov word [ebp - 2], ax
push ebp
call fcn.0063bb3c
pop ecx
test al, al
je 0x63bcb7
movzx eax, word [ebp - 2]
call fcn.0063b5e0
mov word [ebp - 2], ax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, word [ebp - 2]
push eax
call sub.user32.dll_SetClipboardData
mov byte [ebp - 0x15], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63bce4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
cmp byte [ebp - 0x15], 0
je 0x63bcdc
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63bd01
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x63bd10
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
add ebx, ebx
inc ebx
test ebx, ebx
js 0x63bd2a
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x63bd23
mov edx, esp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 1
xor eax, eax
push ebp
push 0x63bde7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x10]
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x63bdd6
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x63bd73
mov edx, esi
mov ecx, edi
mov eax, ebx
call fcn.0063bbac
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
call fcn.004277e8
cmp edx, dword [esp + 4]
jne 0x63bd91
cmp eax, dword [esp]
pop edx
pop eax
jb 0x63bd68
jmp 0x63bd95
pop edx
pop eax
jl 0x63bd68
cmp byte [ebp + 8], 0
je 0x63bdbe
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x63bdad
cmp eax, 0
jbe 0x63bdbe
jmp 0x63bdaf
jle 0x63bdbe
push 0
movzx eax, word [0x6647ec]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63bddd
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x63bf1c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x63c030
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x63c005
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405950
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x10]
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x63bff4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 4]
test edi, edi
je 0x63bf86
sub edi, 4
mov edi, dword [edi]
push 0
mov eax, dword [ebp - 4]
call fcn.00405b58
mov edx, eax
lea ecx, [edi + 1]
mov ax, 1
call fcn.0063be08
push 0
mov eax, esi
call fcn.004060b0
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.004060a0
mov edx, eax
mov ax, 0xd
pop ecx
call fcn.0063be08
test bl, bl
je 0x63bfdc
mov eax, esi
xor edx, edx
call fcn.004061d4
je 0x63bfdc
push 0
movzx eax, word [0x6647ec]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63bffb
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x63c044
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x63c066
push 0xffffffffffffffff
push 0xa
call sub.kernel32.dll_SleepEx
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
call fcn.0048c808
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
ja 0x63c051
pop esi
pop ebx
ret
Function at 0x63c074
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp ebx, 0xa
jae 0x63c089
mov ebx, 0xa
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je 0x63c10c
mov eax, esi
call fcn.0063a1fc
fstp xword [esp]
wait
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x63c101
mov eax, ebx
call fcn.0063c044
mov eax, esi
call fcn.0063a1fc
fstp xword [esp + 0x10]
wait
fld xword [esp + 0x10]
fld xword [esp]
fsubp st(1)
fmul dword [0x63c114]
mov dword [esp + 0x1c], ebx
xor eax, eax
mov dword [esp + 0x20], eax
fild qword [esp + 0x1c]
fdivp st(1)
fld xword [0x63c118]
fcompp
wait
fnstsw ax
sahf
ja 0x63c10c
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov ax, word [esp + 0x18]
mov word [esp + 8], ax
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp ebp, eax
ja 0x63c0a8
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x63c57c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00405ea8
xor eax, eax
push ebp
push 0x63c659
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x63c648
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce68
mov dx, 0xd
call fcn.0045ce30
test al, al
je 0x63c5ed
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x63c621
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00406014
jmp 0x63c621
call fcn.0045ce68
mov dx, 1
call fcn.0045ce30
test al, al
je 0x63c621
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x63c621
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00405fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63c64f
cmp dword [ebp - 4], 0
je 0x63c63d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x63cad8
Capabilities:
Get keyboard layout

Disassembly:
add esp, 0xffffff88
push esp
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
test eax, eax
jns 0x63caec
call fcn.00404610
add esp, 0x78
ret