joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ec30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ecde
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x104]
mov eax, edi
call fcn.00403a40
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00405484
push 0x40ecf8
push ebx
push 0x40ed1c
push 0x40ed28
push esi
push 0x40ed34
push dword [ebp - 4]
push 0x40ed48
lea eax, [ebp - 4]
mov edx, 8
call fcn.00405580
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x502a6c]
call fcn.0040e6ac
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004056c0
mov ebx, eax
push ebx
call fcn.004093b8
push 0x10
push 0
push ebx
push 0
call fcn.00409778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ece5
lea eax, [ebp - 4]
call fcn.0040525c
ret

Function at 0x40fb88
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040fbb4
test al, al
je 0x40fbaf
push 0
mov eax, dword [ebx + 0xc]
push eax
call fcn.00409438
push 0
call fcn.00409770
mov eax, ebx
call fcn.0040fde8
pop ebx
ret

Function at 0x415760
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415818
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x108]
mov eax, edi
call fcn.00403a40
lea edx, [ebp - 0x108]
lea eax, [ebp - 4]
call fcn.00405484
push 0x415834
push ebx
push 0x415858
push 0x415864
push esi
push 0x415870
push dword [ebp - 4]
push 0x415884
lea eax, [ebp - 4]
mov edx, 8
call fcn.00405580
mov eax, dword [0x4fcfd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dl, 1
call fcn.0040e6ac
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004056c0
push eax
call fcn.004093b8
cmp dword [0x4f3100], 0
je 0x415802
mov ecx, edi
mov edx, esi
mov eax, ebx
call dword [0x4f3100]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41581f
lea eax, [ebp - 4]
call fcn.0040525c
ret
Function at 0x434d24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x434d37
add esp, 0xfffffff0
call fcn.004046cc
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
test esi, 0xfff
je 0x434d4c
add esi, 0x1000
and esi, 0xfffff000
test esi, esi
jne 0x434d6a
mov ecx, 0x37
mov edx, 0x434de4
mov eax, 0x434e24
call fcn.004051a4
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
push 0x40
push 0x1000
push esi
push 0
call fcn.00409440
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x434d9c
mov ecx, 0x3b
mov edx, 0x434de4
mov eax, 0x434e24
call fcn.004051a4
mov dl, 1
mov eax, dword [0x434b88]
call fcn.00404438
mov edi, eax
mov dword [ebx + 0x14], edi
mov byte [edi + 0x10], 1
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov dword [edi + 0xc], esi
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x434dd1
call fcn.00404724
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x437c20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x437c8c]
push 0x5b
call fcn.004096b8
test ax, ax
jl 0x437c43
push 0x5c
call fcn.004096b8
test ax, ax
jge 0x437c46
or bl, 1
test si, 4
je 0x437c50
or bl, 2
test si, 8
je 0x437c5a
or bl, 8
test si, 1
je 0x437c64
or bl, 0x10
test si, 2
je 0x437c6e
or bl, 0x20
test si, 0x10
je 0x437c78
or bl, 0x40
push 0x12
call fcn.004096b8
test ax, ax
jge 0x437c87
or bl, 4
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x437c90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x437ce4]
push 0x5b
call fcn.004096b8
test ax, ax
jl 0x437cb3
push 0x5c
call fcn.004096b8
test ax, ax
jge 0x437cb6
or bl, 1
push 0x10
call fcn.004096b8
test ax, ax
jge 0x437cc5
or bl, 2
push 0x11
call fcn.004096b8
test ax, ax
jge 0x437cd4
or bl, 8
test esi, 0x20000000
je 0x437cdf
or bl, 4
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44d440
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x44d4a6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call fcn.004090d0
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00405490
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403a4c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x44d490
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d4ad
lea eax, [ebp - 0x10]
call fcn.0040525c
ret
Function at 0x467cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x467d0a
add esp, 0xfffffff0
call fcn.004046cc
mov esi, ecx
mov byte [ebp - 5], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x467e0e
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x467d37
mov ecx, 0xc2
mov edx, 0x467e40
mov eax, 0x467e80
call fcn.004051a4
xor edx, edx
mov eax, ebx
call fcn.00404438
mov dword [ebx + 8], esi
movzx eax, byte [ebp + 8]
mov byte [ebx + 0xc], al
mov byte [ebx + 0x54], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x467e98
mov edx, 0x467eb8
mov eax, dword [esi + 8]
call fcn.0041ff60
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
push 0x469014
push ebx
push 0x468e90
push ebx
push 0x468ee4
mov ecx, dword [esi + 0x10]
mov dl, 1
mov eax, dword [0x45be20]
call fcn.0045d69c
mov dword [ebx + 0x4c], eax
push 0
mov ecx, 0x467ec8
mov edx, 0x467eb8
mov eax, dword [esi + 8]
call fcn.00420058
mov edi, eax
push 0
mov ecx, 0x467ee8
mov edx, 0x467eb8
mov eax, dword [esi + 8]
call fcn.00420058
mov dword [ebp - 0xd], edi
mov dword [ebp - 9], eax
mov eax, dword [ebp - 0xd]
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp - 9]
mov dword [ebx + 0x40], eax
push 0
mov ecx, 0x467f0c
mov edx, 0x467eb8
mov eax, dword [esi + 8]
call fcn.004202a0
mov byte [ebx + 0x44], al
mov eax, dword [ebx + 0x4c]
mov edx, dword [esi + 0x20]
mov dword [eax + 0x24], edx
mov edx, dword [ebx + 0x3c]
mov dword [eax + 0x30], edx
mov edx, dword [ebx + 0x40]
mov dword [eax + 0x34], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467e15
lea eax, [ebp - 4]
call fcn.00405a30
ret
Function at 0x47448c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x47449f
add esp, 0xfffffff0
call fcn.004046cc
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004056b0
xor eax, eax
push ebp
push 0x474581
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [edi + 8], 0
mov eax, dword [ebp - 4]
call fcn.004056c0
push eax
call fcn.00409270
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
je 0x47456b
push 0x4745a8
push esi
call fcn.004090f0
mov dword [edi + 0xc], eax
push 0x4745b8
mov eax, dword [edi + 4]
push eax
call fcn.004090f0
mov dword [edi + 0x10], eax
push 0x4745c8
mov eax, dword [edi + 4]
push eax
call fcn.004090f0
mov dword [edi + 0x14], eax
push 0x4745d8
mov eax, dword [edi + 4]
push eax
call fcn.004090f0
mov dword [edi + 0x18], eax
push 0x4745e0
mov eax, dword [edi + 4]
push eax
call fcn.004090f0
mov dword [edi + 0x1c], eax
xor eax, eax
mov dword [edi + 0x20], eax
cmp dword [edi + 0xc], 0
je 0x474550
cmp dword [edi + 0x10], 0
je 0x474550
cmp dword [edi + 0x14], 0
je 0x474550
cmp dword [edi + 0x18], 0
je 0x474550
cmp dword [edi + 0x1c], 0
jne 0x474554
xor eax, eax
jmp 0x474556
mov al, 1
mov byte [edi + 8], al
test al, al
jne 0x47456b
mov eax, dword [edi + 4]
push eax
call fcn.00409060
xor eax, eax
mov dword [edi + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474588
lea eax, [ebp - 4]
call fcn.0040525c
ret
Function at 0x477330
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4774a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x30]
mov ebx, eax
mov byte [ebp - 5], 0
test ebx, ebx
je 0x477471
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0041f79c
mov eax, dword [ebp - 0xc]
mov edx, 0x4774b8
call fcn.00405d34
jne 0x4773a8
mov eax, dword [esi + 0x10]
mov edx, ebx
call fcn.00416080
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00477330
jmp 0x47745e
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0041f79c
mov eax, dword [ebp - 0x10]
mov edx, 0x4774d4
call fcn.00405d34
jne 0x4773d0
mov eax, dword [esi + 0x10]
mov edx, ebx
call fcn.00416080
jmp 0x47745e
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0041f79c
mov eax, dword [ebp - 0x14]
mov edx, 0x4774f0
call fcn.00405d34
jne 0x477430
xor ecx, ecx
mov edx, 0x477510
mov eax, ebx
call fcn.004238c4
test eax, eax
setg al
mov byte [esi + 0x14], al
xor ecx, ecx
mov edx, 0x477528
mov eax, ebx
call fcn.004238c4
test eax, eax
jle 0x477427
mov ecx, 0x64
mov edx, 0x47753c
mov eax, ebx
call fcn.004238c4
mov dword [esi + 0x18], eax
jmp 0x47745e
mov dword [esi + 0x18], 0x64
jmp 0x47745e
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0041f79c
mov eax, dword [ebp - 0x18]
mov edx, 0x477558
call fcn.00405d34
jne 0x47745e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00477618
mov byte [ebp - 5], 1
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov ebx, eax
test ebx, ebx
jne 0x47736c
cmp byte [ebp - 5], 0
jne 0x477488
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00477618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4774aa
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405a48
ret
Function at 0x47c50c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x47c51f
add esp, 0xfffffff0
call fcn.004046cc
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
test esi, esi
jne 0x47c53e
mov ecx, 0x22f
mov edx, 0x47c674
mov eax, 0x47c6b4
call fcn.004051a4
xor edx, edx
mov eax, ebx
call fcn.00442d8c
mov dword [ebx + 0x70], 0xffc00000
mov dword [ebx + 0x74], 0x41dfffff
mov dl, 1
mov eax, dword [0x40f614]
call fcn.0040fe80
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x20], esi
movzx eax, byte [ebp + 8]
mov byte [ebx + 0x24], al
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0x10]
mov edx, dword [eax]
call dword [edx + 4]
mov dword [ebx + 0x28], eax
mov ecx, esi
mov dl, 1
mov eax, dword [0x4788b0]
call fcn.0047903c
mov edi, eax
mov dword [ebx + 0x2c], edi
movzx eax, byte [edi + 0x11]
mov byte [ebx + 0x78], al
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x28]
call fcn.0047a91c
xor esi, esi
mov eax, dword [0x4fcfe4]
cmp dword [eax], 0
je 0x47c5b9
mov esi, dword [0x4fcfe4]
mov esi, dword [esi]
call esi
mov esi, eax
test esi, esi
je 0x47c5cd
mov eax, esi
mov edx, dword [eax]
call dword [edx + 4]
test al, al
je 0x47c5cd
mov dword [ebx + 0x30], esi
jmp 0x47c5d4
mov eax, esi
call fcn.00404468
mov eax, dword [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x18]
push eax
mov ecx, dword [ebx + 0x28]
mov dl, 1
mov eax, dword [0x47a774]
call fcn.0047b04c
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x47a638]
call fcn.00404438
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415b40]
call fcn.00404438
mov dword [ebx + 0x40], eax
mov esi, dword [ebx + 0x2c]
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x47c63d
push edi
movzx eax, byte [esi + 0x11]
push eax
movzx eax, byte [esi + 0x13]
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x47b4a0]
call fcn.0047baac
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x44]
xor edx, edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.0047cf3c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47c661
call fcn.00404724
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x488c24
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x488ce2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, dword [esi + 0x30]
movzx eax, byte [eax + 8]
push eax
lea edx, [ebp - 4]
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, dword [ebp - 4]
mov edx, 0x488cf8
mov eax, esi
call fcn.00488430
test bl, bl
je 0x488cc4
push esi
add esi, 0x70
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
push 0
push 1
push esi
add esi, 0x70
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, dword [esi + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [esi + 0x30]
movzx eax, byte [eax + 8]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, dword [ebp - 0x28]
mov edx, 0x488d0c
mov eax, esi
call fcn.00488430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488ce9
lea eax, [ebp - 0x28]
call fcn.0040525c
lea eax, [ebp - 4]
call fcn.0040525c
ret
Function at 0x4b9db4
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x38], 0
je 0x4b9e11
mov eax, dword [ebx + 0x40]
push eax
call fcn.00409400
push 0x3e8
mov eax, dword [ebx + 0x38]
push eax
call fcn.00409460
cmp eax, 0x102
jne 0x4b9dfa
mov ecx, 0x159
mov edx, 0x4b9e1c
mov eax, 0x4b9e54
call fcn.004051a4
push 0
mov eax, dword [ebx + 0x38]
push eax
call fcn.00409438
mov eax, dword [ebx + 0x40]
push eax
call fcn.00408f90
mov eax, dword [ebx + 0x38]
push eax
call fcn.00408f90
xor eax, eax
mov dword [ebx + 0x38], eax
pop ebx
ret

Function at 0x4cb868
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4cb896
mov eax, ebx
call fcn.004cc30c
cmp dword [ebx + 0x3c], 0
je 0x4cb88f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4cb907
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4cb8f9
cmp dword [ebx + 8], 0
je 0x4cb8b8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4cb8ca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4cb8f9
cmp dword [ebx + 8], 0
je 0x4cb8ab
cmp eax, 3
je 0x4cb8dd
dec eax
jne 0x4cb8ab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4cb8ab
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4cb8ab
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4cb925
cmp dword [ebx + 0x10], 0xcc
je 0x4cb925
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004cb930
pop ebx
ret

Function at 0x4dcd0c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
xor eax, eax
push ebp
push 0x4dcdec
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, ebx
add edi, edi
mov eax, edi
add eax, 2
push eax
push 0x2002
call fcn.00409140
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4dcdbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call fcn.00409150
mov esi, eax
xor eax, eax
push ebp
push 0x4dcdad
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.004030d4
mov word [esi + ebx*2], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, dword [ebp - 0xc]
push eax
push 0xd
call fcn.00409808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcdb4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00409160
ret
Function at 0x4dce20
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
xor edx, edx
push ebp
push 0x4dcf10
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004dcbe4
movzx eax, word [ebx + 0x46]
cmp ax, 8
ja 0x4dce68
mov ecx, eax
mov esi, 1
shl esi, cl
add esi, esi
add esi, esi
add esi, 0x28
jmp 0x4dce8a
movzx eax, word [ebx + 0x46]
cmp ax, 0x10
je 0x4dce78
cmp ax, 0x20
jne 0x4dce85
cmp dword [ebx + 0x48], 3
jne 0x4dce85
mov esi, 0x34
jmp 0x4dce8a
mov esi, 0x28
mov eax, dword [ebx + 0x4c]
add eax, esi
push eax
push 0x2002
call fcn.00409140
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00409150
mov edi, eax
xor eax, eax
push ebp
push 0x4dcef3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, edi
lea eax, [ebx + 0x38]
mov ecx, esi
call fcn.004030d4
mov ecx, dword [ebx + 0x4c]
mov edx, edi
add edx, esi
mov eax, dword [ebx + 0x30]
call fcn.004030d4
mov eax, dword [ebp - 8]
push eax
push 8
call fcn.00409808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcefa
mov eax, dword [ebp - 8]
push eax
call fcn.00409160
ret
Function at 0x4dcf20
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
xor edx, edx
push ebp
push 0x4dd073
push dword fs:[edx]
mov dword fs:[edx], esp
push 8
call fcn.00409680
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4dd05d
mov eax, dword [ebp - 8]
push eax
call fcn.00409150
mov ebx, eax
xor edx, edx
push ebp
push 0x4dd056
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, ebx
mov eax, esi
call fcn.00473614
movzx eax, word [ebx + 0xe]
cmp ax, 8
ja 0x4dcf96
mov ecx, eax
mov edi, 1
shl edi, cl
add edi, edi
add edi, edi
add edi, 0x28
jmp 0x4dcfb8
movzx eax, word [ebx + 0xe]
cmp ax, 0x10
je 0x4dcfa6
cmp ax, 0x20
jne 0x4dcfb3
cmp dword [ebx + 0x10], 3
jne 0x4dcfb3
mov edi, 0x34
jmp 0x4dcfb8
mov edi, 0x28
movzx eax, word [esi + 0x46]
cmp ax, 8
ja 0x4dcfdc
mov ecx, eax
mov eax, 1
shl eax, cl
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, dword [esi + 0x34]
lea eax, [ebx + 0x28]
call fcn.004030d4
mov eax, dword [ebx + 0x10]
cmp eax, 1
jne 0x4dcff1
mov edx, ebx
add edx, edi
mov eax, esi
call fcn.00473ef8
jmp 0x4dd03f
cmp eax, 2
jne 0x4dd003
mov edx, ebx
add edx, edi
mov eax, esi
call fcn.00473dbc
jmp 0x4dd03f
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x4dd032
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4dd016
imul dword [esi + 0x40]
jmp 0x4dd032
mov eax, ebx
mov edx, dword [eax + 4]
movzx ecx, word [eax + 0xe]
imul edx, ecx
add edx, 0x1f
shr edx, 5
add edx, edx
add edx, edx
imul edx, dword [eax + 8]
mov eax, edx
mov edx, dword [esi + 0x30]
add ebx, edi
mov ecx, ebx
xchg ecx, eax
call fcn.004030d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd05d
mov eax, dword [ebp - 8]
push eax
call fcn.00409160
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd07a
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1c]
ret

Function at 0x4eaf98
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4eb037
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403944
mov dword [ebp - 0x4c], 0x44
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004eaf68
test al, al
je 0x4eafe8
mov dword [ebp - 0x20], 1
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405a94
push esi
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040cad0
push eax
push 0
call fcn.00408ff0
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb03e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a48
ret
Function at 0x4eb048
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffbc
mov ebx, ecx
mov esi, edx
mov edi, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.00403944
mov dword [esp], 0x44
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.004eaf68
test al, al
je 0x4eb080
mov dword [esp + 0x2c], 1
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.004056c0
push eax
push 0
call fcn.00408fe8
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x44
pop edi
pop esi
pop ebx
ret

Function at 0x4eb9b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00405fc4
lea eax, [ebp - 8]
call fcn.00405fc4
lea eax, [ebp + 0x10]
call fcn.00405fc4
lea eax, [ebp + 0xc]
call fcn.00405fc4
xor eax, eax
push ebp
push 0x4eba99
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x4eba22
mov eax, dword [0x4fd0cc]
mov eax, dword [eax]
mov cl, 0xec
mov edx, esi
call dword [eax + 0x54]
test al, 8
setne bl
test bl, bl
je 0x4eba22
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call fcn.00409848
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00405c00
push eax
mov eax, dword [ebp + 0x10]
call fcn.00405c00
push eax
mov eax, dword [ebp - 8]
call fcn.00405c00
push eax
mov eax, dword [ebp - 4]
call fcn.00405c00
push eax
push esi
call fcn.00479dd8
mov edi, eax
cmp edi, 0x20
ja 0x4eba71
test esi, esi
je 0x4eba71
test bl, bl
je 0x4eba71
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call fcn.00409848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebaa0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a48
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00405a48
ret