joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4057c0
Capabilities:
Clear file content
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_LoadLibraryA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059f0
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405843
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4059f0
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405843
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a0c
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x4058cc
xor eax, eax
push ebp
push 0x4058c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405608
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x4058aa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405a2c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x4058aa
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058cc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_ReadFile
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4059e6
cmp byte [ebp - 0xd], 0
jne 0x405913
cmp byte [ebp - 0x12], 0
je 0x4059e6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40592c
dec ebx
cmp byte [ebx], 0x2e
je 0x40593b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40592b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4059e6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405978
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
test esi, esi
jne 0x4059e6
cmp byte [ebp - 0xd], 0
je 0x4059e6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
test esi, esi
jne 0x4059e6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c268
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c33e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040459c
lea eax, [ebp - 8]
call fcn.00404a14
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004049c4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c328
mov eax, ebx
call fcn.004026fc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c321
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004049c4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c30b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c350
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c30b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c328
mov eax, dword [ebp - 0x10]
call fcn.0040271c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c345
lea eax, [ebp - 8]
call fcn.00404504
ret
Function at 0x4198b8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.user32.dll_IntersectRect
mov edx, dword [0x45517c]
cmp eax, dword [edx]
je 0x4198fb
call sub.user32.dll_IntersectRect
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x45501c]
mov dl, 1
mov eax, dword [0x41283c]
call fcn.0040bb10
call fcn.00403f40
test ebx, ebx
jle 0x419908
mov eax, ebx
call fcn.0041989c
jmp 0x41990d
call fcn.00419890
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x456868
call sub.user32.dll_GetSysColor
xor eax, eax
push ebp
push 0x419a46
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x4543e8
call sub.user32.dll_GetWindowTextA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x419a27
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x419958
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41995c
xor eax, eax
jmp 0x41995e
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x419a11
jmp 0x419a04
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004140b8
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00413fa8
push 0x456868
call sub.user32.dll_RegisterClassA
xor eax, eax
push ebp
push 0x4199f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4199c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4199d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4199f8
push 0x456868
call sub.user32.dll_GetSysColor
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x419970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419a2e
mov eax, dword [ebp - 0xc]
call fcn.004037b4
ret

Function at 0x41c8d4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c8da
ret

Function at 0x41e02c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x41e0ac]
mov eax, ebx
call fcn.0041e564
mov dl, byte [0x41e0b0]
mov eax, dword [ebp - 4]
call fcn.0041e564
mov edx, dword [ebx + 0x20]
push edx
mov edx, dword [edi + 0xc]
sub edx, dword [edi + 4]
push edx
mov edx, dword [edi + 8]
sub edx, dword [edi]
push edx
mov edx, dword [edi + 4]
push edx
mov edx, dword [edi]
push edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
push edx
mov edx, dword [esi + 0xc]
sub edx, dword [esi + 4]
push edx
mov edx, dword [esi + 8]
mov eax, dword [esi]
sub edx, eax
push edx
mov edx, dword [esi + 4]
push edx
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x41e0b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x41e151
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x41e151
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x41e15c]
mov eax, ebx
call fcn.0041e564
mov eax, dword [ebx + 0x14]
call fcn.0041ddb4
call fcn.0041d130
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursor
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.0041d130
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
add ecx, edi
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00412c84
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41e600
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0xc]
call fcn.0041d604
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.0041d130
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
pop ebx
ret

Function at 0x41e65c
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.0041ddf0
push eax
call sub.user32.dll_GetLastActivePopup
mov eax, dword [ebx + 0x14]
call fcn.0041ddf0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebx + 0x14]
call fcn.0041ded0
test al, al
jne 0x41e6af
mov eax, dword [ebx + 0x14]
call fcn.0041ddb4
call fcn.0041d130
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursor
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.0041ddb4
call fcn.0041d130
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursor
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
pop ebx
ret
Function at 0x41e898
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
push 0
call sub.user32.dll_CharToOemA
mov dword [ebp - 0x18], eax
push 0
call sub.user32.dll_CharToOemA
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x41e9e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
push 0x18
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DrawEdge
test bl, bl
je 0x41e8fa
push 0
push 1
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyboardType
mov dword [ebp - 0x10], eax
jmp 0x41e95c
push 0
call fcn.00406ae8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41e90f
call fcn.0041e7e0
xor eax, eax
push ebp
push 0x41e955
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_AdjustWindowRectEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41e93c
call fcn.0041e7e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e95c
mov eax, dword [ebp - 0x14]
push eax
push 0
call fcn.00406d30
ret
cmp dword [ebp - 0x10], 0
je 0x41e9c6
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetClientRect
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetClientRect
mov esi, eax
push 0xcc0020
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetKeyboardState
test ebx, ebx
je 0x41e9b8
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetClientRect
test esi, esi
je 0x41e9c6
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e9ed
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_CheckMenuItem
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_CheckMenuItem
ret
Function at 0x41f738
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov edx, ebx
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.0041f5e8
xor eax, eax
mov dword [ebp - 8], eax
push 0
call sub.user32.dll_CharToOemA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41f7d5
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x41f78c
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_FrameRect
push 0
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DestroyCursor
test eax, eax
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f7dc
cmp dword [ebp - 8], 0
je 0x41f7cb
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetClipboardData
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CheckMenuItem
ret
Function at 0x420c5c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, esi
call fcn.00420af8
lea edx, [ebp - 0x22]
mov ecx, 0x16
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x22], 0x9ac6cdd7
jne 0x420c9e
lea eax, [ebp - 0x22]
call fcn.0041f5d0
cmp ax, word [ebp - 0xe]
je 0x420ca3
call fcn.0041e780
sub dword [ebp - 8], 0x16
mov eax, dword [ebp - 8]
call fcn.004026fc
mov dword [ebp - 0xc], eax
mov ebx, dword [esi + 0x28]
xor eax, eax
push ebp
push 0x420dcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x28]
mov dx, word [ebp - 0x14]
mov word [eax + 0x18], dx
cmp word [ebp - 0x14], 0
jne 0x420ce9
mov word [ebp - 0x14], 0x60
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x18]
movsx edx, word [ebp - 0x1c]
sub eax, edx
push eax
call sub.user32.dll_ReleaseDC
mov dword [ebx + 0xc], eax
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x16]
movsx edx, word [ebp - 0x1a]
sub eax, edx
push eax
call sub.user32.dll_ReleaseDC
mov dword [ebx + 0x10], eax
mov dword [ebp - 0x32], 8
xor eax, eax
mov dword [ebp - 0x2e], eax
xor eax, eax
mov dword [ebp - 0x2a], eax
xor eax, eax
mov dword [ebp - 0x26], eax
lea eax, [ebp - 0x32]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardLayout
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x420d5a
call fcn.0041e780
lea eax, [ebp - 0x96]
push eax
push 0x64
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_DestroyWindow
mov dword [ebp - 0x32], 8
mov eax, dword [ebp - 0x76]
mov dword [ebp - 0x2e], eax
mov eax, dword [ebp - 0x72]
mov dword [ebp - 0x2a], eax
xor eax, eax
mov dword [ebp - 0x26], eax
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0x32]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardLayout
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x420dae
call fcn.0041e780
mov byte [esi + 0x2c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420dd2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040271c
ret
Function at 0x42163c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4216d7
mov eax, dword [ebp - 4]
call fcn.0041e1d4
xor edx, edx
push ebp
push 0x4216d0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x42167e
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
test eax, eax
je 0x421697
push 0xffffffffffffffff
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetClipboardData
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041e510
push ebx
call sub.user32.dll_CheckMenuItem
mov edx, dword [ebp - 4]
mov eax, dword [0x4546e0]
call fcn.00414438
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4216d7
mov eax, dword [ebp - 4]
call fcn.0041e388
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4279ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427b5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404bb4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x427b74
call fcn.00404810
mov eax, ebx
call fcn.0041a07c
mov edi, eax
dec edi
test edi, edi
jl 0x427a64
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041a050
mov edx, dword [0x42afac]
call fcn.00403940
test al, al
je 0x427a60
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041a050
lea edx, [ebp - 0x14]
call fcn.004322f0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404bb4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404884
inc esi
dec edi
jne 0x427a12
mov al, byte [0x427b78]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x427b84
mov eax, dword [ebp - 0xc]
call fcn.0040ce28
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0040459c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004322f0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x427b74
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004322f0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x427b74
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x427b74
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x427b90
call fcn.00409198
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427b64
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404528
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404528
lea eax, [ebp - 0x14]
call fcn.00404504
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404528
ret
Function at 0x42cf80
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42cffd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042c9e0
call sub.user32.dll_LoadStringA
mov ebx, eax
push 0
call sub.user32.dll_SetClipboardData
call sub.user32.dll_LoadStringA
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42cfa5
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042c5e0
cmp dword [ebp - 4], 0
je 0x42cfe7
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004049c4
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call fcn.00406e60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d004
lea eax, [ebp - 4]
call fcn.00404504
ret

Function at 0x430c3c
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
push ebx
call sub.user32.dll_EnableWindow
push 0
mov eax, dword [esp + 8]
sub eax, edi
push eax
mov eax, dword [esp + 8]
sub eax, esi
push eax
push ebx
call sub.user32.dll_GetKeyboardLayoutList
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x453108
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b4
xor eax, eax
push ebp
push 0x4532ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.004049c4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x45316b
mov eax, dword [ebp - 8]
call fcn.00404504
mov eax, 0x4532c4
call fcn.004282c8
jmp 0x453289
mov eax, ebx
call fcn.0040808c
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x45322e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x20]
push eax
push ebx
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4531b0
mov ecx, 0x4532ec
mov dl, 1
mov eax, dword [0x4074b0]
call fcn.0040ba18
call fcn.00403f40
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x453314
mov eax, dword [ebp - 0x20]
push eax
call sub.version.dll_VerQueryValueA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4531ec
mov eax, 0x453320
call fcn.004282c8
mov eax, dword [ebp - 8]
call fcn.00404504
call fcn.00403fec
jmp 0x453289
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov dword [ebp - 0xc], edx
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov dword [ebp - 0x14], edx
and eax, 0xffff
mov dword [ebp - 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453235
mov eax, dword [ebp - 0x20]
call fcn.0040271c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4532b3
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404528
lea eax, [ebp - 4]
call fcn.00404504
ret