joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cf19
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff78
mov esi, 0x57c4a0
push 0xa
push 0x2a
push dword [0x55b3c4]
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x40cfd6
push ebx
push dword [0x55b3c4]
call sub.KERNEL32.dll_SizeofResource
mov ebp, eax
push ebx
push dword [0x55b3c4]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x40cfd6
push eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x40cfd6
push esi
push 0x180
call sub.KERNEL32.dll_GetTempPathA
push str.miunst_.exe
push esi
call fcn.005394dc
add esp, 8
mov byte [esp], 0x88
push 0x1001
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40cfd6
push ebp
push edi
push ebx
call sub.KERNEL32.dll__lwrite
push ebx
call sub.KERNEL32.dll__lclose
push 0x57c887
push 0x553318
push str.__s_s
push esi
call fcn.005395b8
pop ecx
add eax, esi
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
push esi
call sub.KERNEL32.dll_WinExec
add esp, 0x88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40e784
Capabilities:
Read .ini file

Disassembly:
push str.mirc.ini
push 0x3e7
push 0x569f83
push 0x54b395
push 0x54b38f
push 0x54b388
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x54b3a0
push 0x569f83
call fcn.0053977c
add esp, 8
test eax, eax
je 0x40e7df
mov dword [0x54b37c], 1
push 0
push 0x85
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
ret
call fcn.004bce55
ret

Function at 0x416944
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x569f83
mov esi, 0x5696dc
mov edi, 0x54b9c8
mov ebp, 0x5696f0
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x5696e0], eax
push str.mirc.ini
push 0x3e7
push ebx
lea eax, [edi + 0x36]
push eax
lea edx, [edi + 0x2d]
push edx
lea ecx, [edi + 0x26]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebx], 0
je 0x4169bb
push str.mirc.ini
push ebx
lea eax, [edi + 0x42]
push eax
lea edx, [edi + 0x3a]
push edx
call fcn.00498684
push str.mirc.ini
push 0
lea ecx, [edi + 0x4d]
push ecx
lea eax, [edi + 0x46]
push eax
call fcn.00498684
call fcn.0041646a
xor edx, edx
mov dword [ebp], edx
mov ecx, dword [ebp]
inc dword [ebp]
push ecx
lea eax, [edi + 0x56]
push eax
push 0x5696e4
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push ebx
lea edx, [edi + 0x63]
push edx
push 0x5696e4
lea ecx, [edi + 0x5b]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebx], 0
je 0x416a19
push ebx
call fcn.0041cb6c
push 1
push ebx
call fcn.0041c947
test eax, eax
je 0x4169c5
push ebx
call fcn.00416724
jmp 0x4169c5
cmp dword [0x54b9c0], 0
jne 0x416a41
push 0x553318
lea eax, [edi + 0x67]
push eax
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
call fcn.00416724
push 0
call fcn.00416b02
xor edx, edx
mov dword [ebp], edx
mov ecx, dword [0x54b9c0]
mov dword [esi], ecx
jmp 0x416a7e
mov edx, dword [ebp]
cmp edx, dword [0x54b9c4]
jne 0x416a67
mov dword [eax + 0x134], 1
jmp 0x416a71
mov eax, dword [esi]
xor ecx, ecx
mov dword [eax + 0x134], ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x15c]
mov dword [esi], edx
inc dword [ebp]
mov eax, dword [esi]
test eax, eax
jne 0x416a50
push dword [0x5696e0]
call sub.USER32.dll_SetCursor
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x417e78
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push str.mirc.ini
push 0x3e7
push 0x569f83
push str.Courier_New_12
push dword [ebp + 0xc]
push 0x54badc
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 1
push 0x2c
push 0x569f83
call fcn.00539518
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x417f1c
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x417f0d
push 0x2c
push ebx
call fcn.00539518
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x417f03
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
cmp byte [edx], 0
je 0x417f03
push dword [ebp - 0x1c]
call fcn.00542dbc
pop ecx
mov dword [ebp - 0xc], eax
push ebx
call fcn.00542dbc
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x417f3d
mov dword [ebp - 4], 0x19c
jmp 0x417f3d
push esi
push edi
mov esi, str.Courier_New
mov edi, 0x569f83
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebp - 4], 0x19c
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0x64
jle 0x417f56
sub dword [ebp - 4], 0x64
add dword [ebp - 8], 0x64
cmp dword [ebp - 4], 0x64
jg 0x417f48
cmp dword [ebp + 0x14], 0
je 0x417f80
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
push edx
push 0x569f83
push esi
call fcn.00478226
test eax, eax
jne 0x417f80
mov eax, edi
jmp 0x418046
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push 0x569f83
push 0
push 0
push 0
push 0
push dword [ebp - 0xc]
push 0
push 0
push 0
push dword [ebp - 8]
push 0
push 0
push 0
mov edx, dword [ebp - 4]
neg edx
push edx
call sub.GDI32.dll_CreateFontA
mov ebx, eax
test ebx, ebx
je 0x417fde
test edi, edi
je 0x417fcc
push edi
call sub.GDI32.dll_DeleteObject
push 0
push ebx
push 0x30
push 0x12c
push esi
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x417fe0
mov ebx, edi
cmp dword [ebp + 0x14], 0
je 0x41801e
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
push eax
push 0x569f83
push 0x54bb00
push 0x569b9c
call sub.USER32.dll_wsprintfA
add esp, 0x14
push str.mirc.ini
push 0x569b9c
push dword [ebp + 0xc]
push 0x54bb0a
call fcn.00498684
push 1
push 0
push 0x12c
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_InvalidateRect
push 0x12c
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418a0c
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x54bb2c
push 0
call fcn.00513ae4
mov esi, eax
mov dword [ebx], esi
test esi, esi
je 0x418b61
mov esi, str._mdi
mov edi, 0x54bb30
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
add edx, 4
mov esi, edx
mov edi, 0x54bb30
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov edx, dword [0x55b3cc]
mov dword [eax], edx
mov byte [eax + 0x64c], 9
mov dword [eax + 0x794], 2
mov byte [eax + 0x668], 1
xor ecx, ecx
mov dword [eax + 0x79c], ecx
xor edx, edx
mov dword [eax + 0x780], edx
xor ecx, ecx
mov dword [eax + 0x77c], ecx
xor edx, edx
mov dword [eax + 0x798], edx
push str.mirc.ini
push 0x3e7
push 0x579058
push 0x54bb52
add eax, 4
push eax
push 0x54bb46
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x579058], 0
je 0x418b3f
push 0x2c
push 0x579058
call fcn.005398a0
add esp, 8
mov esi, eax
test esi, esi
je 0x418b11
mov byte [esi], 0
inc esi
cmp byte [esi], 0
je 0x418b11
push esi
call fcn.00542dbc
pop ecx
mov edx, dword [ebx]
mov dword [edx + 0x794], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x794]
test eax, eax
jl 0x418b09
cmp eax, 4
jle 0x418b11
xor ecx, ecx
mov dword [edx + 0x794], ecx
push 0x579058
call fcn.0041cb6c
push 0x579058
mov eax, dword [ebx]
push dword [eax]
call fcn.00419bed
test eax, eax
je 0x418b3f
push dword [ebx]
call fcn.0046051c
mov edx, dword [ebx]
push dword [edx]
call sub.USER32.dll_UpdateWindow
jmp 0x418b61
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x79c], edx
xor ecx, ecx
mov dword [eax + 0x780], ecx
xor edx, edx
mov dword [eax + 0x77c], edx
xor ecx, ecx
mov dword [eax + 0x798], ecx
pop edi
pop esi
pop ebx
ret
Function at 0x418b65
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x56a3b4
mov eax, dword [0x54bb2c]
test eax, eax
je 0x418b84
cmp eax, ebx
je 0x418d8d
push ebx
call fcn.00514157
test eax, eax
je 0x418d8d
cmp byte [ebx + 0x64c], 1
jne 0x418bc3
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x54bb6c
push 0x54bb62
push 0x54bb56
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x418c4f
cmp byte [ebx + 0x64c], 2
jne 0x418d8d
cmp byte [ebx + 0x64d], 3
jne 0x418bfe
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x54bb83
push 0x54bb7c
push 0x54bb70
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x418c4f
cmp byte [ebx + 0x64d], 4
jne 0x418c2c
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x54bb9a
push 0x54bb93
push 0x54bb87
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x418c4f
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x54bbb2
push 0x54bbaa
push 0x54bb9e
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor edx, edx
mov dword [0x56a3b8], edx
push 0x2c
push 0x57c4a0
call fcn.005398a0
add esp, 8
mov ebx, eax
mov dword [0x56a3b0], ebx
test ebx, ebx
je 0x418ca8
mov byte [ebx], 0
inc dword [0x56a3b0]
mov ebx, dword [0x56a3b0]
cmp byte [ebx], 0
je 0x418ca8
push ebx
call fcn.00542dbc
pop ecx
mov dword [0x56a3b8], eax
mov eax, dword [0x56a3b8]
test eax, eax
jl 0x418ca0
cmp eax, 5
jle 0x418ca8
xor edx, edx
mov dword [0x56a3b8], edx
mov ebx, dword [0x55b3c0]
test ebx, ebx
je 0x418d8d
push 0
push dword [ebx]
call sub.USER32.dll_GetSystemMenu
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x418d7f
push 0
push 0x64
push 0x57c887
push 0xb0
push esi
call sub.USER32.dll_GetMenuStringA
test eax, eax
jle 0x418d7f
cmp byte [0x57c4a0], 0
je 0x418d58
cmp dword [ebx + 0x798], 0
jne 0x418d09
push 0
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x418d7f
push 0x57c4a0
call fcn.0041cb6c
push dword [ebx + 0x798]
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x418d48
mov eax, dword [ebx + 0x794]
cmp eax, dword [0x56a3b8]
jne 0x418d48
push 8
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x418d7f
push 0
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x418d7f
cmp dword [ebx + 0x798], 0
jne 0x418d71
push 8
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x418d7f
push 0
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
mov ebx, dword [ebx + 0x9d8]
test ebx, ebx
jne 0x418cb6
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41c667
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41c678
cmp byte [ebx], 0
jne 0x41c67f
xor eax, eax
jmp 0x41c82e
mov dword [0x56a5e4], 0xffffffff
push 0x2e
push ebx
call fcn.00539518
add esp, 8
mov esi, eax
mov dword [0x56a5e0], esi
test esi, esi
je 0x41c6a3
mov byte [esi], 0
push 0x54be10
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
je 0x41c80d
push 0x54be15
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
je 0x41c80d
push 0x54be1a
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
je 0x41c80d
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 0
push 0
push 3
push 0
push 0
push 0
push ebx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
mov dword [0x56a5f8], esi
cmp esi, 0xffffffff
je 0x41c731
push esi
call sub.KERNEL32.dll_GetFileType
mov dword [0x56a5fc], eax
push dword [0x56a5f8]
call sub.KERNEL32.dll_CloseHandle
test byte [0x56a5fc], 2
jne 0x41c80d
push 0
call sub.KERNEL32.dll_SetErrorMode
push 0xa
push 0x56a5e8
push ebx
call sub.KERNEL32.dll_QueryDosDeviceA
test eax, eax
jne 0x41c80d
push 0x56a5bc
push ebx
call fcn.0054051c
add esp, 8
test eax, eax
jne 0x41c78e
movsx eax, word [0x56a5c0]
sub eax, 0x1000
je 0x41c80d
sub eax, 0x1000
je 0x41c80d
sub eax, 0x1000
je 0x41c80d
sub eax, 0xc000
je 0x41c80d
push 0
push 0
push ebx
call fcn.0053fb14
add esp, 0xc
mov esi, eax
mov dword [0x56a5e4], esi
cmp esi, 0xffffffff
je 0x41c7ed
push esi
call fcn.0053d63c
pop ecx
test eax, eax
jne 0x41c80d
push 0x56a5bc
push dword [0x56a5e4]
call fcn.0053fd04
add esp, 8
test eax, eax
jne 0x41c7ed
movsx eax, word [0x56a5c0]
sub eax, 0x1000
je 0x41c80d
sub eax, 0x1000
je 0x41c80d
sub eax, 0x1000
je 0x41c80d
sub eax, 0xc000
je 0x41c80d
mov eax, dword [0x56a5e4]
test eax, eax
jl 0x41c7fd
push eax
call fcn.0053ca08
pop ecx
mov eax, dword [0x56a5e0]
test eax, eax
je 0x41c809
mov byte [eax], 0x2e
xor eax, eax
jmp 0x41c82e
mov eax, dword [0x56a5e4]
test eax, eax
jl 0x41c81d
push eax
call fcn.0053ca08
pop ecx
mov eax, dword [0x56a5e0]
test eax, eax
je 0x41c829
mov byte [eax], 0x2e
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41c947
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41c95c
cmp byte [ebx], 0
jne 0x41c966
xor eax, eax
jmp 0x41cafe
mov byte [esi], 0x5c
push 0x2f
push ebx
call fcn.00539518
add esp, 8
mov esi, eax
mov dword [0x56a628], esi
test esi, esi
jne 0x41c963
push 0x54be2e
push ebx
call fcn.00539874
add esp, 8
test eax, eax
je 0x41c996
xor eax, eax
jmp 0x41cafe
push edi
mov esi, 0x56b7c8
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push 0x56b7c8
call fcn.005395b8
pop ecx
mov ebx, eax
mov dword [0x56a630], ebx
test ebx, ebx
jg 0x41c9da
xor eax, eax
jmp 0x41cafe
mov edx, dword [0x56a630]
cmp byte [edx + 0x56b7c7], 0x5c
jne 0x41ca04
mov ecx, dword [0x56a630]
mov byte [ecx + 0x56b7c8], 0x2e
mov eax, dword [0x56a630]
mov byte [eax + 0x56b7c9], 0
jmp 0x41ca2c
mov edx, dword [0x56a630]
cmp byte [edx + 0x56b7c7], 0x3a
jne 0x41ca2c
mov ecx, dword [0x56a630]
mov byte [ecx + 0x56b7c8], 0x5c
mov eax, dword [0x56a630]
mov byte [eax + 0x56b7c9], 0
cmp dword [0x556164], 0
je 0x41ca65
push 0
push 0x56a634
push 0
push 0
push 0x56b7c8
call fcn.0053e8e0
add esp, 0x14
push 0x56a634
call fcn.0041c667
test eax, eax
je 0x41ca65
mov eax, 1
jmp 0x41cafe
xor edx, edx
mov dword [0x56a62c], edx
cmp dword [0x556164], 0
je 0x41caa4
test edi, 2
je 0x41caa4
push 0x56b7c8
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
mov dword [0x56a734], ebx
cmp ebx, 0xffffffff
je 0x41caa4
test bl, 0x10
je 0x41caa4
mov dword [0x56a62c], 1
cmp dword [0x56a62c], 0
jne 0x41caf9
push 0x56a604
push 0x56b7c8
call fcn.0054051c
add esp, 8
test eax, eax
jne 0x41caf9
test edi, 1
je 0x41cade
test byte [0x56a609], 0x80
je 0x41cade
mov dword [0x56a62c], 1
test edi, 2
je 0x41caf9
test byte [0x56a609], 0x40
je 0x41caf9
mov dword [0x56a62c], 1
mov eax, dword [0x56a62c]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41cf41
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [0x57f650], 0
jne 0x41cf6f
push str.mIRC32
push dword [0x55b3c8]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.0050d634
jmp 0x41cfed
push 0x57f650
push str.mIRC32
push 0x54be8e
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0xf
push ebx
call fcn.004fec28
push dword [0x55b3c8]
call sub.USER32.dll_GetWindowTextLengthA
mov edi, eax
push ebx
call fcn.005395b8
pop ecx
cmp edi, eax
jne 0x41cfda
push 0x3b5
push esi
push dword [0x55b3c8]
call sub.USER32.dll_GetWindowTextA
mov eax, ebx
mov edx, esi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x41cfda
test cl, cl
je 0x41cfd8
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x41cfda
add eax, 2
add edx, 2
test cl, cl
jne 0x41cfbc
je 0x41cfed
push ebx
push dword [0x55b3c8]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.0050d634
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41d138
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x553318
push 0
push ebx
push 0
push dword [0x55b3c8]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x41d173
push 0
call sub.KERNEL32.dll_SetErrorMode
mov eax, 1
jmp 0x41d1e2
push 0
call sub.KERNEL32.dll_SetErrorMode
push 0x56a748
push ebx
call fcn.0054051c
add esp, 8
test eax, eax
je 0x41d194
xor edx, edx
mov dword [0x56a75a], edx
cmp dword [0x56a75a], 0xe678
jle 0x41d1b5
push ebx
push str.write.exe__s
push 0x579058
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x41d1c8
push ebx
push str.notepad.exe__s
push 0x579058
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xa
push 0x579058
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jae 0x41d1dd
xor eax, eax
jmp 0x41d1e2
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x41d1e7
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x56a76c
push dword [0x55b3c8]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x41d20b
xor eax, eax
jmp 0x41d3a8
xor edx, edx
mov dword [0x56a770], edx
cmp dword [ebp + 0xc], 1
jne 0x41d2bd
push 1
call sub.USER32.dll_GetClipboardData
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x41d2bd
push esi
call sub.KERNEL32.dll_GlobalLock
mov dword [0x56a774], eax
cmp dword [0x56a774], 0
je 0x41d2b6
push dword [0x56a774]
call fcn.005395b8
pop ecx
mov esi, eax
push ebx
call fcn.005395b8
pop ecx
add esi, eax
add esi, 0xa
push esi
call fcn.00545a4c
pop ecx
mov dword [0x56a770], eax
cmp dword [0x56a770], 0
je 0x41d2b6
mov eax, dword [0x56a770]
mov edx, dword [0x56a774]
push edi
mov esi, eax
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
push dword [0x56a770]
call fcn.005394dc
add esp, 8
mov ebx, dword [0x56a770]
push dword [edi]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_EmptyClipboard
test eax, eax
jne 0x41d2e2
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x56a770]
test eax, eax
je 0x41d2db
push eax
call fcn.00545938
pop ecx
xor eax, eax
jmp 0x41d3a8
push ebx
call fcn.005395b8
pop ecx
add eax, 0xa
push eax
push 0x2042
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
mov dword [edi], esi
test esi, esi
jne 0x41d31b
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x56a770]
test eax, eax
je 0x41d314
push eax
call fcn.00545938
pop ecx
xor eax, eax
jmp 0x41d3a8
push dword [edi]
call sub.KERNEL32.dll_GlobalLock
mov esi, eax
mov dword [0x56a774], esi
test esi, esi
jne 0x41d355
push dword [edi]
call sub.KERNEL32.dll_GlobalUnlock
push dword [edi]
call sub.KERNEL32.dll_GlobalFree
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x56a770]
test eax, eax
je 0x41d351
push eax
call fcn.00545938
pop ecx
xor eax, eax
jmp 0x41d3a8
mov edx, dword [0x56a774]
push edi
mov esi, edx
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push dword [edi]
push 1
call sub.USER32.dll_SetClipboardData
push dword [edi]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x56a770]
test eax, eax
je 0x41d3a3
push eax
call fcn.00545938
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41d4dd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
je 0x41d5c0
cmp dword [ebp - 0x84], 0
jne 0x41d522
mov esi, 0x54bee6
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
jmp 0x41d5e1
cmp dword [ebp - 0x84], 1
jne 0x41d57c
cmp dword [ebp - 0x90], 4
jne 0x41d54e
cmp dword [ebp - 0x8c], 0x5a
jb 0x41d54e
mov esi, 0x54beeb
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d5e1
cmp dword [ebp - 0x90], 4
jne 0x41d56e
cmp dword [ebp - 0x8c], 1
jb 0x41d56e
mov esi, 0x54beef
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d5e1
mov esi, 0x54bef3
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d5e1
cmp dword [ebp - 0x84], 2
jne 0x41d5c0
cmp dword [ebp - 0x90], 5
jb 0x41d5b2
cmp dword [ebp - 0x8c], 1
jb 0x41d5a5
mov esi, 0x54bef7
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d5e1
mov esi, str.2000
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d5e1
mov esi, 0x54bf01
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d5e1
cmp dword [0x556164], 0
je 0x41d5d7
mov esi, 0x54bf05
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d5e1
mov esi, 0x54bf09
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41da84
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, 0x56a7b0
mov edi, 0x56a7ac
push dword [0x55b3c8]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x41daad
xor eax, eax
jmp 0x41dc56
xor edx, edx
mov dword [edi], edx
push 1
call sub.USER32.dll_GetClipboardData
mov dword [0x56a7b8], eax
cmp dword [0x56a7b8], 0
je 0x41db9a
push dword [0x56a7b8]
call sub.KERNEL32.dll_GlobalLock
mov dword [0x56a7bc], eax
cmp dword [0x56a7bc], 0
je 0x41db9a
push 0xa
push dword [0x56a7bc]
call fcn.00539518
add esp, 8
mov dword [esi], eax
cmp dword [esi], 0
je 0x41db03
mov ecx, dword [esi]
mov byte [ecx], 0
push 0x3b5
push dword [0x56a7bc]
push ebx
call fcn.005397c4
add esp, 0xc
mov byte [ebx + 0x3b5], 0
push 0xd
push ebx
call fcn.00539518
add esp, 8
mov dword [0x56a7b4], eax
cmp dword [0x56a7b4], 0
je 0x41db3f
mov eax, dword [0x56a7b4]
mov byte [eax], 0
push 0
push 0
push ebx
push dword [edi]
call fcn.004b0c4c
mov dword [0x56a7a8], eax
cmp dword [0x56a7a8], 0
jne 0x41db62
push dword [edi]
call fcn.004b12ac
jmp 0x41db8f
mov edx, dword [0x56a7a8]
mov dword [edi], edx
mov eax, dword [esi]
test eax, eax
je 0x41db8f
mov byte [eax], 0xa
inc dword [esi]
mov edx, dword [esi]
cmp byte [edx], 0xd
jne 0x41db7e
inc dword [esi]
mov eax, dword [esi]
cmp byte [eax], 0
je 0x41db8f
mov dword [0x56a7bc], eax
jmp 0x41dae7
push dword [0x56a7b8]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [edi], 0
jne 0x41dbab
xor eax, eax
jmp 0x41dc56
mov edx, dword [ebp + 8]
cmp byte [edx], 0
jne 0x41dbee
mov dword [0x56a7c4], 1
push dword [0x56a7c4]
push 0x553318
push str._splayq_d.txt
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push dword [ebp + 8]
call fcn.0041c947
test eax, eax
je 0x41dbee
inc dword [0x56a7c4]
jmp 0x41dbbd
push 0
push 0x54bf56
push dword [ebp + 8]
call fcn.0053fadc
add esp, 0xc
mov esi, eax
mov dword [0x56a7c0], esi
test esi, esi
jne 0x41dc3f
push dword [edi]
call fcn.004b12ac
xor eax, eax
jmp 0x41dc56
push dword [eax]
push 0x54bf59
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x56a7c0]
push ebx
call fcn.0053d2b8
add esp, 8
push dword [edi]
call fcn.004b0f30
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
jne 0x41dc17
push dword [0x56a7c0]
call fcn.0053ca10
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8