joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b756
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
call fcn.0054c1f4
add esp, 8
lea eax, [ebp - 0x140]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x41b78c
mov edi, 1
jmp 0x41b78e
xor edi, edi
push ebx
call fcn.0054c2d0
pop ecx
push eax
push dword [ebp + 0xc]
call fcn.0054c2d0
pop ecx
pop edx
sub edx, eax
mov byte [ebx + edx], 0
test edi, edi
jne 0x41b849
test byte [ebp - 0x140], 0x10
je 0x41b7cf
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41b7a6
mov edi, 1
jmp 0x41b7a6
push esi
push edi
mov esi, 0x57fe40
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [ebp - 0x114]
push eax
push 0x57fe40
call fcn.0054c1f4
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x41b82b
push 0
push 0x57fe40
mov edx, dword [ebp + 0x10]
push dword [edx]
call fcn.004c6a50
test eax, eax
je 0x41b82b
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41b841
mov edi, 1
test edi, edi
je 0x41b7ae
cmp esi, 0xffffffff
je 0x41b854
push esi
call sub.KERNEL32.dll_FindClose
push 0x55d96c
push ebx
call fcn.0054c1f4
add esp, 8
lea eax, [ebp - 0x140]
push eax
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x41b87d
mov edi, 1
jmp 0x41b87f
xor edi, edi
push ebx
call fcn.0054c2d0
pop ecx
mov byte [ebx + eax - 3], 0
test edi, edi
jne 0x41b92d
test byte [ebp - 0x140], 0x10
je 0x41b90f
xor eax, eax
mov al, byte [ebp - 0x114]
cmp eax, 0x2e
je 0x41b90f
lea edx, [ebp - 0x114]
push edx
push ebx
call fcn.0054c1f4
add esp, 8
cmp dword [ebp + 0x14], 0
je 0x41b8d5
push 0
push ebx
mov ecx, dword [ebp + 0x14]
push dword [ecx]
call fcn.004c6a50
test eax, eax
je 0x41b8d5
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
push ebx
call fcn.0042e417
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b756
push 0x5c
push ebx
call fcn.0054c3e1
add esp, 8
test eax, eax
je 0x41b90f
mov byte [eax], 0
push 0x5c
push ebx
call fcn.0054c3e1
add esp, 8
test eax, eax
je 0x41b90f
inc eax
mov byte [eax], 0
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x41b925
mov edi, 1
test edi, edi
je 0x41b893
cmp esi, 0xffffffff
je 0x41b938
push esi
call sub.KERNEL32.dll_FindClose
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ba7b
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa4
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
push edx
push 0
push dword [0x56cee8]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jl 0x41bc0a
cmp dword [ebp - 4], 0
je 0x41bc0a
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call sub.SHELL32.dll_SHGetPathFromIDListA
test eax, eax
jl 0x41bc0a
lea eax, [ebp - 0x110]
push eax
call fcn.0042e417
push dword [ebp + 8]
push str._s.lnk
lea edx, [ebp - 0x110]
push edx
call fcn.0054c2d0
pop ecx
lea ecx, [ebp - 0x110]
add eax, ecx
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x5735ec
push 1
push 0
push 0x5734fc
call sub.OLE32.dll_CoCreateInstance
test eax, eax
jl 0x41bc0a
lea edx, [ebp - 8]
push edx
push 0x573fbc
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jge 0x41bb37
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
jmp 0x41bc0a
push 0x104
lea eax, [ebp - 0x41c]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
push edx
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
push 0
lea ecx, [ebp - 0x41c]
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jge 0x41bb82
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
jmp 0x41bc0a
push 0
lea eax, [ebp - 0x55c]
push eax
push 0x104
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jge 0x41bbb8
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x41bc0a
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
push 0x578211
push 0x57fd38
push 0x55d9a2
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 0x577e2a
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x41bc0a
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.dll_DeleteFileA
mov esp, ebp
pop ebp
ret 4
Function at 0x41bc10
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff78
mov esi, 0x577e2a
push 0xa
push 0x2a
push dword [0x56cee4]
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x41bccd
push ebx
push dword [0x56cee4]
call sub.KERNEL32.dll_SizeofResource
mov ebp, eax
push ebx
push dword [0x56cee4]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x41bccd
push eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x41bccd
push esi
push 0x180
call sub.KERNEL32.dll_GetTempPathA
push str.miunst_.exe
push esi
call fcn.0054c1f4
add esp, 8
mov byte [esp], 0x88
push 0x1001
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41bccd
push ebp
push edi
push ebx
call sub.KERNEL32.dll__lwrite
push ebx
call sub.KERNEL32.dll__lclose
push 0x578211
push 0x57fd38
push str.__s_s
push esi
call fcn.0054c2d0
pop ecx
add eax, esi
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
push esi
call sub.KERNEL32.dll_WinExec
add esp, 0x88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x420083
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x147
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4200b0
push 0
call fcn.0042c4bf
jmp 0x42018e
push 0x5836b2
push esi
push 0x148
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x5836b2], 0
jne 0x4200d8
push 0
call fcn.0042c4bf
jmp 0x42018e
push esi
mov esi, 0x578211
mov edi, 0x57a634
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp byte [0x578211], 0
je 0x420139
push 1
push 0x578211
call fcn.0042c9b5
test eax, eax
je 0x420139
push 0
push 0x46d73b
push 0xa0
push ebx
call fcn.0046b0f0
dec eax
jne 0x420139
push 0x578211
call sub.KERNEL32.dll_DeleteFileA
push 0x5836b2
push 0x55dee1
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x577e2a
push 0x57a530
call fcn.004ad3e2
push 0
push esi
push 0x144
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0xffffffffffffffff
push 0x14e
push 0x7a
push ebx
call sub.USER32.dll_SendDlgItemMessageA
push 0
push ebx
call fcn.0041f9a9
push ebx
call fcn.0041f518
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42c67e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x55e75c
lea edi, [ebp - 0x104]
test ebx, ebx
je 0x42c6a1
cmp byte [ebx], 0
jne 0x42c6a8
xor eax, eax
jmp 0x42c89f
push 0x100
push edi
call fcn.0042e3f0
push 0
push edi
push 0
push 0
push ebx
call fcn.0050ca44
add esp, 0x14
or ebx, 0xffffffff
lea eax, [esi + 0x21]
push eax
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea edx, [esi + 0x26]
push edx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea ecx, [esi + 0x2c]
push ecx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea eax, [esi + 0x32]
push eax
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea edx, [esi + 0x38]
push edx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea ecx, [esi + 0x3e]
push ecx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea eax, [esi + 0x43]
push eax
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea edx, [esi + 0x48]
push edx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea ecx, [esi + 0x4d]
push ecx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea eax, [esi + 0x53]
push eax
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea edx, [esi + 0x59]
push edx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
lea ecx, [esi + 0x5f]
push ecx
push edi
call fcn.0054c494
add esp, 8
test eax, eax
je 0x42c88f
push 0
push 0
push 3
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x42c7f4
push esi
call sub.KERNEL32.dll_GetFileType
mov dword [ebp - 4], eax
push esi
call sub.KERNEL32.dll_CloseHandle
test byte [ebp - 4], 2
jne 0x42c88f
push 0xa
lea eax, [ebp - 0x138]
push eax
push edi
call sub.KERNEL32.dll_QueryDosDeviceA
test eax, eax
jne 0x42c88f
lea edx, [ebp - 0x128]
push edx
push edi
call fcn.00552870
add esp, 8
test eax, eax
jne 0x42c836
movsx ecx, word [ebp - 0x124]
sub ecx, 0x2000
je 0x42c88f
sub ecx, 0xd000
je 0x42c88f
push 0x40
push 0
push edi
call fcn.00552270
add esp, 0xc
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42c880
push ebx
call fcn.00550070
pop ecx
test eax, eax
jne 0x42c88f
lea eax, [ebp - 0x128]
push eax
push ebx
call fcn.005522a0
add esp, 8
test eax, eax
jne 0x42c880
movsx edx, word [ebp - 0x124]
sub edx, 0x2000
je 0x42c88f
sub edx, 0xd000
je 0x42c88f
test ebx, ebx
jl 0x42c88b
push ebx
call fcn.0054f720
pop ecx
xor eax, eax
jmp 0x42c89f
test ebx, ebx
jl 0x42c89a
push ebx
call fcn.0054f720
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c9b5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
je 0x42c9d0
cmp byte [esi], 0
jne 0x42c9da
xor eax, eax
jmp 0x42cae7
mov byte [ebx], 0x5c
push 0x2f
push esi
call fcn.0054c230
add esp, 8
mov ebx, eax
test eax, eax
jne 0x42c9d7
push 0x55e7d0
push esi
call fcn.0054c58c
add esp, 8
test eax, eax
je 0x42ca04
xor eax, eax
jmp 0x42cae7
push esi
push edi
mov edi, esi
lea esi, [ebp - 0x4e8]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [ebp - 0x4e8]
push eax
call fcn.0054c2d0
pop ecx
test eax, eax
jg 0x42ca45
xor eax, eax
jmp 0x42cae7
cmp byte [ebp + eax - 0x4e9], 0x5c
jne 0x42ca61
mov byte [ebp + eax - 0x4e8], 0x2e
mov byte [ebp + eax - 0x4e7], 0
jmp 0x42ca7b
cmp byte [ebp + eax - 0x4e9], 0x3a
jne 0x42ca7b
mov byte [ebp + eax - 0x4e8], 0x5c
mov byte [ebp + eax - 0x4e7], 0
push 0
lea edx, [ebp - 0x100]
push edx
push 0
push 0
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.0050ca44
add esp, 0x14
lea eax, [ebp - 0x100]
push eax
call fcn.0042c67e
test eax, eax
je 0x42caae
mov eax, 1
jmp 0x42cae7
xor ebx, ebx
lea eax, [ebp - 0x4e8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x42cac5
mov eax, ebx
jmp 0x42cae7
test al, 0x10
je 0x42cad8
test edi, 2
je 0x42cae5
mov ebx, 1
jmp 0x42cae5
test edi, 1
je 0x42cae5
mov ebx, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42cf0e
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffff830
cmp byte [0x583410], 0
jne 0x42cf3a
push str.mIRC
push dword [0x56cee8]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.0041b199
jmp 0x42cfcc
push 0x583410
push str.mIRC
push 0x55e83a
lea eax, [esp + 0xc]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0xf
lea edx, [esp + 4]
push edx
call fcn.0050cc40
push dword [0x56cee8]
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
push esp
call fcn.0054c2d0
pop ecx
cmp ebx, eax
jne 0x42cfb9
push 0x3b5
lea eax, [esp + 0x3ec]
push eax
push dword [0x56cee8]
call sub.USER32.dll_GetWindowTextA
mov eax, esp
lea edx, [esp + 0x3e8]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x42cfb9
test cl, cl
je 0x42cfb7
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x42cfb9
add eax, 2
add edx, 2
test cl, cl
jne 0x42cf9b
je 0x42cfcc
push esp
push dword [0x56cee8]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.0041b199
add esp, 0x7d0
pop ebx
ret
Function at 0x42cfd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, dword [ebp + 8]
push 5
push 0x57fd38
push 0
push ebx
push 0
push dword [0x56cee8]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x42d001
mov eax, 1
jmp 0x42d062
lea edx, [ebp - 0x24]
push edx
push ebx
call fcn.00552870
add esp, 8
test eax, eax
je 0x42d017
xor ecx, ecx
mov dword [ebp - 0x12], ecx
cmp dword [ebp - 0x12], 0xe678
jle 0x42d035
push ebx
push str.write.exe__s
push 0x57fe40
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x42d048
push ebx
push str.notepad.exe__s
push 0x57fe40
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xa
push 0x57fe40
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jae 0x42d05d
xor eax, eax
jmp 0x42d062
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42d069
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x56cee8]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x42d085
xor eax, eax
jmp 0x42d1c8
xor esi, esi
cmp dword [ebp + 0xc], 1
jne 0x42d100
push 1
call sub.USER32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x42d100
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x42d0fa
push edi
call fcn.0054c2d0
pop ecx
mov esi, eax
push dword [ebp + 8]
call fcn.0054c2d0
pop ecx
add esi, eax
add esi, 0xa
push esi
call fcn.00557db4
pop ecx
mov esi, eax
test esi, esi
je 0x42d0fa
push esi
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push dword [ebp + 8]
push esi
call fcn.0054c1f4
add esp, 8
mov dword [ebp + 8], esi
push ebx
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_EmptyClipboard
test eax, eax
jne 0x42d120
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d119
push esi
call fcn.00557ca0
pop ecx
xor eax, eax
jmp 0x42d1c8
push dword [ebp + 8]
call fcn.0054c2d0
pop ecx
add eax, 0xa
push eax
push 0x2042
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x42d151
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d14d
push esi
call fcn.00557ca0
pop ecx
xor eax, eax
jmp 0x42d1c8
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
jne 0x42d17d
push ebx
call sub.KERNEL32.dll_GlobalUnlock
push ebx
call sub.KERNEL32.dll_GlobalFree
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d179
push esi
call fcn.00557ca0
pop ecx
xor eax, eax
jmp 0x42d1c8
mov edx, dword [ebp + 8]
push esi
push edi
mov esi, edi
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call sub.KERNEL32.dll_GlobalUnlock
push ebx
push 1
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
test esi, esi
je 0x42d1c3
push esi
call fcn.00557ca0
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42d2ca
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
je 0x42d3ab
cmp dword [ebp - 0x84], 0
jne 0x42d30f
mov esi, 0x55e868
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
jmp 0x42d3b7
cmp dword [ebp - 0x84], 1
jne 0x42d366
cmp dword [ebp - 0x90], 4
jne 0x42d338
cmp dword [ebp - 0x8c], 0x5a
jb 0x42d338
mov esi, 0x55e86d
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x42d3b7
cmp dword [ebp - 0x90], 4
jne 0x42d358
cmp dword [ebp - 0x8c], 1
jb 0x42d358
mov esi, 0x55e871
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x42d3b7
mov esi, 0x55e875
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x42d3b7
cmp dword [ebp - 0x84], 2
jne 0x42d3ab
cmp dword [ebp - 0x90], 5
jb 0x42d39d
cmp dword [ebp - 0x8c], 1
jb 0x42d38f
mov esi, 0x55e879
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x42d3b7
mov esi, 0x55e87d
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x42d3b7
mov esi, 0x55e881
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x42d3b7
mov esi, 0x55e885
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42d988
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push dword [0x56cee8]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x42d9aa
xor eax, eax
jmp 0x42db01
xor edx, edx
mov dword [ebp - 4], edx
push 1
call sub.USER32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42da56
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x42da56
push 0xa
push edi
call fcn.0054c230
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x42d9e9
mov byte [ebx], 0
push 0x3e7
push 0
push esi
call fcn.0054c150
add esp, 0xc
push 0x3b5
push edi
push esi
call fcn.0054c4dc
add esp, 0xc
push 0xd
push esi
call fcn.0054c230
add esp, 8
test eax, eax
je 0x42da1a
mov byte [eax], 0
push 0
push esi
push dword [ebp - 4]
call fcn.004c6a50
test eax, eax
jne 0x42da34
lea eax, [ebp - 4]
push eax
call fcn.004c6e81
jmp 0x42da4e
mov dword [ebp - 4], eax
test ebx, ebx
je 0x42da4e
mov byte [ebx], 0xa
inc ebx
cmp byte [ebx], 0xd
jne 0x42da45
inc ebx
cmp byte [ebx], 0
je 0x42da4e
mov edi, ebx
jmp 0x42d9d5
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [ebp - 4], 0
jne 0x42da68
xor eax, eax
jmp 0x42db01
mov edx, dword [ebp + 8]
cmp byte [edx], 0
jne 0x42da9c
mov ebx, 1
push ebx
push 0x57fd38
push str._splayq_d.txt
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push dword [ebp + 8]
call fcn.0042c9b5
test eax, eax
je 0x42da9c
inc ebx
jmp 0x42da75
push 0x40
push 0x55e8d1
push dword [ebp + 8]
call fcn.00552238
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x42dac1
lea eax, [ebp - 4]
push eax
call fcn.004c6e81
xor eax, eax
jmp 0x42db01
cmp dword [ebp - 4], 0
je 0x42daf5
mov edx, dword [ebp - 4]
push dword [edx]
push 0x55e8d4
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
push esi
call fcn.0054fd04
add esp, 8
push dword [ebp - 4]
call fcn.004c6c0b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42dac7
push ebx
call fcn.0054f730
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x42f6b7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x18], 0xffffffff
je 0x42f853
cmp dword [ebp + 0x14], 0
je 0x42f741
cmp dword [ebp + 0x10], 0
jne 0x42f741
push 5
push 0x8c
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
lea eax, [ebp - 0x1c]
push eax
push 0x8c
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_GetWindowRect
push 2
lea edx, [ebp - 0x1c]
push edx
push dword [ebp + 8]
push 0
call sub.USER32.dll_MapWindowPoints
mov eax, dword [ebp - 0x1c]
mov esi, eax
add esi, 0xfffffffb
mov edx, dword [ebp - 0x18]
mov edi, edx
add edi, 0xfffffff6
mov ecx, dword [ebp - 0x14]
sub ecx, eax
add ecx, 0xa
mov dword [ebp + 0x24], ecx
mov eax, dword [ebp - 0x10]
sub eax, edx
add eax, 0x13
mov dword [ebp + 0x28], eax
push 0x10
call sub.USER32.dll_GetSysColor
push eax
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [ebp - 4], eax
push dword [ebp - 4]
push ebx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0
lea edx, [edi - 1]
push edx
lea eax, [esi - 1]
push eax
push ebx
call sub.GDI32.dll_MoveToEx
lea edx, [edi - 1]
push edx
mov ecx, dword [ebp + 0x24]
add ecx, esi
push ecx
push ebx
call sub.GDI32.dll_LineTo
mov eax, dword [ebp + 0x28]
add eax, edi
push eax
mov edx, dword [ebp + 0x24]
add edx, esi
push edx
push ebx
call sub.GDI32.dll_LineTo
mov ecx, dword [ebp + 0x28]
add ecx, edi
push ecx
lea eax, [esi - 1]
push eax
push ebx
call sub.GDI32.dll_LineTo
lea edx, [edi - 1]
push edx
lea ecx, [esi - 1]
push ecx
push ebx
call sub.GDI32.dll_LineTo
push dword [ebp - 0xc]
push ebx
call sub.GDI32.dll_SelectObject
push dword [ebp - 4]
call sub.GDI32.dll_DeleteObject
push 0x14
call sub.USER32.dll_GetSysColor
push eax
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [ebp - 8], eax
push dword [ebp - 8]
push ebx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0
lea eax, [edi - 1]
push eax
mov edx, dword [ebp + 0x24]
add edx, esi
inc edx
push edx
push ebx
call sub.GDI32.dll_MoveToEx
mov ecx, dword [ebp + 0x28]
add ecx, edi
inc ecx
push ecx
mov eax, dword [ebp + 0x24]
add eax, esi
inc eax
push eax
push ebx
call sub.GDI32.dll_LineTo
mov edx, dword [ebp + 0x28]
add edx, edi
inc edx
push edx
lea ecx, [esi - 1]
push ecx
push ebx
call sub.GDI32.dll_LineTo
cmp dword [ebp + 0x10], 0
jne 0x42f842
push 0
mov eax, dword [ebp + 0x28]
add eax, edi
push eax
push esi
push ebx
call sub.GDI32.dll_MoveToEx
push edi
push esi
push ebx
call sub.GDI32.dll_LineTo
push edi
add esi, dword [ebp + 0x24]
push esi
push ebx
call sub.GDI32.dll_LineTo
push dword [ebp - 0xc]
push ebx
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
call sub.GDI32.dll_DeleteObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24