joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4517a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f3179
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ZModemTransfer.0
mov dword [esi + 0xc], vtable.ZModemTransfer.1.0
mov dword [esp + 0x14], 4
mov eax, 0x4d
call fcn.00475ea0
mov ecx, esi
call fcn.00475e10
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45180e
mov dword [esi + 0x14], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x45181d
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov byte [esp + 0x14], 3
lea ecx, [esi + 0xdb4]
call fcn.004740c0
mov byte [esp + 0x14], 2
lea eax, [esi + 0x960]
call fcn.00404350
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x30]
call fcn.0047bbf0
mov byte [esp + 0x14], 0
mov dword [esi + 0xc], vtable.VUnknown_class_FileTransfer_.0
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.00475d50
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x451d60
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x17]
call fcn.00452be0
test eax, eax
je 0x452000
lea ebx, [ebx]
mov bl, byte [esp + 0x13]
mov al, bl
mov ecx, esi
call fcn.004546f0
test al, al
jne 0x452000
cmp bl, 0x2a
je 0x451fee
cmp bl, 0x18
je 0x451db1
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 8]
mov dword [esi + 0x24], ecx
jmp 0x451fee
mov ebx, 1
cmp ebx, 5
jge 0x452009
push esi
lea edi, [esp + 0x17]
call fcn.00452be0
test eax, eax
je 0x452000
mov al, byte [esp + 0x13]
inc ebx
cmp al, 0x18
je 0x451db6
cmp ebx, 5
jge 0x452009
movzx eax, al
sub eax, 0x41
je 0x451e0a
sub eax, 1
je 0x451e02
sub eax, 1
jne 0x451fee
mov edi, esi
call fcn.00452140
jmp 0x451e11
push esi
call fcn.004520b0
jmp 0x451e11
mov edi, esi
call fcn.00452030
test al, al
je 0x452000
cmp byte [esi + 0x97c], 0
jne 0x451f19
movzx edx, byte [esi + 0x973]
xor dx, word [0x7333c8]
movzx eax, dx
movzx edx, byte [esi + 0x974]
movzx ecx, ax
shr ecx, 8
xor dx, word [ecx*2 + 0x7333c8]
shl eax, 8
xor dx, ax
movzx eax, dx
movzx edx, byte [esi + 0x975]
movzx ecx, ax
shr ecx, 8
xor dx, word [ecx*2 + 0x7333c8]
shl eax, 8
xor dx, ax
movzx eax, dx
movzx edx, byte [esi + 0x976]
movzx ecx, ax
shr ecx, 8
xor dx, word [ecx*2 + 0x7333c8]
shl eax, 8
xor dx, ax
movzx eax, dx
movzx edx, byte [esi + 0x977]
movzx ecx, ax
shr ecx, 8
xor dx, word [ecx*2 + 0x7333c8]
shl eax, 8
xor dx, ax
movzx eax, dx
movzx edx, byte [esi + 0x978]
movzx ecx, ax
shr ecx, 8
xor dx, word [ecx*2 + 0x7333c8]
shl eax, 8
xor dx, ax
movzx eax, dx
movzx edx, byte [esi + 0x979]
movzx ecx, ax
shr ecx, 8
xor dx, word [ecx*2 + 0x7333c8]
shl eax, 8
xor dx, ax
movzx edi, dx
test di, di
sete al
test al, al
jne 0x452017
movzx eax, word [esi + 0x978]
push eax
push str.__packet_crc___1_04x__n
call fcn.004078f0
movzx ecx, di
push ecx
push str.__crc__________1_04x__n
jmp 0x451fc2
mov dl, byte [esi + 0x973]
movzx ecx, byte [esi + 0x974]
not dl
movzx eax, dl
mov eax, dword [eax*4 + 0x7335c8]
xor eax, 0xffffff
mov edx, eax
and edx, 0xff
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x7335c8]
movzx ecx, byte [esi + 0x975]
mov edx, eax
and edx, 0xff
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x7335c8]
movzx ecx, byte [esi + 0x976]
mov edx, eax
and edx, 0xff
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x7335c8]
movzx ecx, byte [esi + 0x977]
mov edx, eax
and edx, 0xff
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x7335c8]
mov edi, eax
mov eax, dword [esi + 0x978]
mov ecx, edi
not ecx
cmp ecx, eax
sete cl
test cl, cl
jne 0x452017
push eax
push str.__packet_crc___1_08x__n
call fcn.004078f0
push edi
push str.__crc__________1_08x__n
call fcn.004078f0
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
add esp, 0x10
mov dword [0x734450], 1
call eax
mov eax, esi
call fcn.00453e40
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 8]
mov dword [esi + 0x24], edx
push esi
lea edi, [esp + 0x17]
call fcn.00452be0
test eax, eax
jne 0x451d80
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
call fcn.004547b0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x452300
Capabilities:
Hash data with crc32

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x17]
mov ecx, ebx
or esi, 0xffffffff
mov byte [esp + 0x1c], 0
xor ebp, ebp
call fcn.00452d40
test eax, eax
je 0x452373
mov cl, byte [esp + 0x18]
test cl, cl
jne 0x45233b
cmp ebp, 0x900
jae 0x4523ce
mov al, byte [esp + 0x13]
mov edx, esi
movzx edi, al
and edx, 0xff
xor edx, edi
shr esi, 8
xor esi, dword [edx*4 + 0x7335c8]
test cl, cl
jne 0x45237e
mov byte [ebx + ebp + 0x5c], al
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x17]
mov ecx, ebx
inc ebp
call fcn.00452d40
test eax, eax
jne 0x452327
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov byte [ecx], al
xor edi, edi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + edi + 0x20]
mov ecx, ebx
call fcn.00452d40
test eax, eax
je 0x452373
inc edi
cmp edi, 4
jl 0x452386
mov edi, dword [esp + 0x1c]
not esi
cmp edi, esi
je 0x4523df
push ebp
push str._n_n_BAD_SUBPACKET_CRC_32__
call fcn.004078f0
push edi
push str.__packet_crc___1_08x__n
call fcn.004078f0
push esi
push str.__crc__________1_08x__n
call fcn.004078f0
add esp, 0x18
push ebx
call fcn.00454720
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x453420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
push edi
xor edi, edi
xor eax, eax
cmp ebp, edi
mov dword [esi + 0x95c], edi
mov word [esi + 0x988], ax
jle 0x453481
push ebx
nop
mov ecx, dword [esp + 0x14]
mov bl, byte [edi + ecx]
mov byte [esp + 0x18], bl
mov edx, dword [esp + 0x18]
push edx
call fcn.00453630
movzx eax, word [esi + 0x988]
movzx ecx, ax
shl eax, 8
shr ecx, 8
xor ax, word [ecx*2 + 0x7333c8]
movzx dx, bl
xor ax, dx
inc edi
cmp edi, ebp
mov word [esi + 0x988], ax
jl 0x453440
pop ebx
mov cl, 0x6b
mov eax, esi
call fcn.00453400
pop edi
pop esi
pop ebp
ret 8

Function at 0x453530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
xor edi, edi
cmp ebp, edi
mov esi, eax
mov dword [esi + 0x95c], edi
mov dword [esi + 0x988], 0xffffffff
jle 0x453587
movzx eax, byte [edi + ebx]
push eax
call fcn.00453630
mov eax, dword [esi + 0x988]
movzx edx, byte [edi + ebx]
mov ecx, eax
and ecx, 0xff
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x7335c8]
inc edi
cmp edi, ebp
mov dword [esi + 0x988], eax
jl 0x453554
push 0x6b
mov eax, esi
call fcn.004535a0
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4535a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
push edi
mov dl, 0x18
mov esi, eax
call fcn.00453610
mov dl, bl
call fcn.00453610
mov eax, dword [esi + 0x988]
mov ecx, eax
movzx edx, bl
and ecx, 0xff
shr eax, 8
xor ecx, edx
xor eax, dword [ecx*4 + 0x7335c8]
xor edi, edi
not eax
mov dword [esi + 0x988], eax
mov edi, edi
movzx eax, byte [esi + edi + 0x988]
push eax
call fcn.00453630
inc edi
cmp edi, 4
jb 0x4535e0
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x95c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
push eax
add esi, 0x5c
push esi
call edx
pop edi
pop esi
pop ebx
ret 4
Function at 0x4540f0
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 8
push edi
mov edi, ecx
cmp dword [edi + 0xda4], 2
jne 0x454289
mov ecx, dword [edi + 0xc]
push ebp
xor ebp, ebp
mov dword [edi + 0x950], ebp
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
add eax, 0x8978
call fcn.00407bf0
mov byte [esp + 0xb], al
mov eax, dword [edi + 0xc]
call fcn.004496e0
test eax, eax
je 0x454288
push ebx
push esi
mov eax, dword [edi + 0xc]
call fcn.004496e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x6c]
call eax
test eax, eax
je 0x454286
cmp byte [edi + 0x980], 0
mov dword [edi + 0x950], ebp
je 0x45416a
mov dword [edi + 0x97c], 0xffffffff
jmp 0x454173
xor ecx, ecx
mov word [edi + 0x97c], cx
cmp byte [esp + 0x13], 0
jne 0x454186
cmp dword [edi + 0x950], 0x3ff
jmp 0x45418c
cmp ebp, 0x400
jge 0x454206
lea edx, [esp + 0x14]
lea esi, [edi - 0xc]
push edx
mov ecx, esi
call fcn.00453f00
test eax, eax
je 0x454206
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00453630
cmp byte [edi + 0x980], 0
je 0x4541da
mov eax, dword [edi + 0x97c]
mov ecx, eax
movzx edx, bl
and ecx, 0xff
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x7335c8]
inc ebp
mov dword [edi + 0x97c], eax
jmp 0x454173
movzx eax, word [edi + 0x97c]
movzx ecx, ax
shl eax, 8
shr ecx, 8
xor ax, word [ecx*2 + 0x7333c8]
movzx dx, bl
xor ax, dx
mov word [edi + 0x97c], ax
inc ebp
jmp 0x454173
add dword [edi + 0xd98], ebp
mov eax, dword [edi + 0xd98]
cmp eax, dword [edi + 0xd88]
lea eax, [edi - 0xc]
setne cl
add cl, 0x68
call fcn.00453400
mov edx, dword [edi + 0xd88]
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
mov edx, dword [edi + 0xd98]
push edx
xor ebp, ebp
push ebp
call eax
mov ecx, dword [edi + 0xd98]
cmp ecx, dword [edi + 0xd88]
jae 0x454267
mov eax, dword [edi + 0xc]
call fcn.004496e0
test eax, eax
jne 0x454136
pop esi
pop ebx
pop ebp
pop edi
add esp, 8
ret
mov edx, ecx
lea esi, [edi - 0xc]
mov byte [edi + 0x977], 0xb
mov dword [edi + 0x978], edx
call fcn.00453140
push 5
push esi
call fcn.00454630
pop esi
pop ebx
pop ebp
pop edi
add esp, 8
ret

Function at 0x454b00
Capabilities:
Read clipboard data

Disassembly:
push 0xe1000018
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0xc]
cmp eax, 0x13
jne 0x454b18
mov eax, 1
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 8], eax
test eax, eax
jne 0x454b2f
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
ret
mov al, 1
ret
Function at 0x4608a0
Capabilities:
Resume thread

Disassembly:
push ebx
push edi
push 0
push 4
push 0
push 0
call fcn.0044c9c0
push eax
call sub.mfc90u.dll_AfxBeginThread
push 0
push 0x739800
push 0x73905c
push 0
push eax
call sub.MSVCR90.dll___RTDynamicCast
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
add esp, 0x14
mov ecx, esi
call edx
movzx eax, al
push eax
mov eax, esi
call fcn.004496e0
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x5c]
mov ecx, esi
call eax
push eax
push ebx
call fcn.0044d260
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
mov ecx, esi
call eax
mov edi, eax
mov eax, dword [esp + 0xc]
push ebx
call fcn.00460f50
mov ecx, dword [ebx + 0x2c]
pop edi
pop ebx
mov dword [esp + 4], ecx
jmp dword [sym.imp.KERNEL32.dll_ResumeThread]

Function at 0x460920
Capabilities:
Resume thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 4
push 0
push 0
call fcn.0044c9c0
push eax
call sub.mfc90u.dll_AfxBeginThread
push 0
push 0x739800
push 0x73905c
push 0
push eax
call sub.MSVCR90.dll___RTDynamicCast
add esp, 0x14
mov esi, eax
call fcn.0044d300
mov eax, dword [esp + 0x18]
mov ecx, ebp
call fcn.00460850
mov ebx, eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x5c]
mov ecx, ebx
call edx
mov edi, eax
push esi
mov eax, ebp
call fcn.00460f50
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
mov edi, ebx
mov eax, ebp
mov byte [esp + 0x1c], 0
call fcn.00460050
push esi
call fcn.0044d160
mov edx, dword [esi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x465780
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 1
push 0
push 0
call fcn.004221b0
push eax
push 0x6bf954
lea esi, [ecx - 0x54]
call fcn.00460690
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb eax, eax
neg eax
pop esi
ret 4

Function at 0x46c5d0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x60c97b
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x72d630]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov eax, dword [esp + 0x13c]
mov ebp, dword [esp + 0x138]
mov ebx, dword [esp + 0x140]
xor esi, esi
mov edi, ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], esi
test ax, ax
je 0x46c673
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
mov ebx, eax
sar ax, 8
and ebx, 0xff
test al, 1
je 0x46c657
mov dword [esp + 0x14], 0x400
mov esi, dword [esp + 0x14]
test al, 2
je 0x46c665
or esi, 0x200
mov dword [esp + 0x14], esi
test al, 4
je 0x46c673
or esi, 0x800
mov dword [esp + 0x14], esi
push 0x100
lea eax, [esp + 0x28]
push 0
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [edi]
add esp, 0xc
mov byte [esp + ebx + 0x24], 0x80
mov cl, 0x81
test eax, 0x400
jne 0x46c69f
test esi, 0x400
je 0x46c6a3
or byte [esp + 0x34], cl
test eax, 0x200
jne 0x46c6b2
test esi, 0x200
je 0x46c6b6
mov byte [esp + 0x35], cl
test eax, 0x800
jne 0x46c6c5
test esi, 0x800
je 0x46c6c9
mov byte [esp + 0x36], cl
lea ecx, [esp + 0x18]
call fcn.00472830
mov dword [esp + 0x130], 0
push 0
push 5
mov eax, 5
lea ecx, [esp + 0x20]
call fcn.004729d0
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
mov edi, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], edi
call fcn.00473130
test edi, edi
jle 0x46c72e
xor esi, esi
lea edi, [esp + 0x18]
call fcn.00473200
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
movzx edx, ax
mov dword [esp + 0x13c], edx
mov eax, dword [esp + 0x148]
test eax, eax
jle 0x46c792
mov dword [esp + 0x1c], eax
jmp 0x46c744
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
push 1
or eax, esi
mov esi, dword [esp + 0x148]
push esi
push 1
push ebx
mov ecx, ebp
call fcn.004467c0
test edi, edi
jle 0x46c77f
mov ecx, dword [esp + 0x20]
test dword [ecx], 0x800
jne 0x46c77f
movzx ecx, word [esp + 0x13c]
mov edx, ebp
call fcn.00446c70
push 0
push esi
mov eax, ebx
mov esi, ebp
call fcn.00446f20
sub dword [esp + 0x1c], 1
jne 0x46c740
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x20]
mov dword [eax], edx
mov dword [esp + 0x130], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004740c0
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.005e038a
add esp, 0x120
ret 0x18
Function at 0x46ce90
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ed561
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xe1000017
call ebx
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46cef6
mov al, 1
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe1000017
jne 0x46cf20
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xe1000017
call ebx
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x46cede
call dword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
cmp eax, 0xe1000017
jne 0x46d02a
test esi, esi
je 0x46d02a
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 2
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetAncestor]
push str._Unknown_Application_
lea ecx, [esp + 0x18]
mov esi, eax
call dword [0x612678]
mov dword [esp + 0x88], 0
test esi, esi
je 0x46cf94
push esi
call sub.mfc90u.dll_CWnd::FromHandle
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call sub.mfc90u.dll_CWnd::GetWindowTextW
mov edx, dword [0x741af8]
push edx
push 0xe1000013
lea eax, [esp + 0x24]
push eax
call fcn.00475440
mov byte [esp + 0x88], 1
lea ecx, [esp + 0x1c]
push ecx
call fcn.00475790
mov byte [esp + 0x88], 0
lea ecx, [esp + 0x1c]
call fcn.00475600
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 0x20]
push eax
mov ecx, edi
call edx
mov ecx, dword [esp + 0x18]
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ecx
push str._1_d_
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ebx
push str._1_d_
mov ecx, edi
call edx
mov dword [esp + 0x88], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor al, al
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x741af8]
push eax
call ebx
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00475440
mov ebx, 2
mov dword [esp + 0x88], ebx
mov edx, dword [0x741af8]
push edx
push 0xe1000012
lea eax, [esp + 0x24]
push eax
call fcn.00475440
mov byte [esp + 0x88], 3
lea ecx, [esp + 0x1c]
push ecx
call fcn.00475790
mov byte [esp + 0x88], bl
lea ecx, [esp + 0x1c]
call fcn.00475600
mov esi, dword [edi]
lea ecx, [esp + 0x4c]
call fcn.00475a00
mov edx, dword [esi + 0x20]
push eax
mov ecx, edi
call edx
mov dword [esp + 0x88], 0xffffffff
lea ecx, [esp + 0x4c]
call fcn.00475600
xor al, al
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471610
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5eff60
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0046ce90
test al, al
jne 0x471661
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xe1000018
call ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x471718
mov eax, dword [0x741af8]
push eax
push 0xe1000015
lea ecx, [esp + 0x14]
push ecx
call fcn.00475440
mov dword [esp + 0x78], 0
lea edx, [esp + 0xc]
push edx
call fcn.00475790
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00475600
mov eax, dword [0x741af8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00475440
mov dword [esp + 0x78], 1
mov ebx, dword [edi]
lea ecx, [esp + 0x3c]
call fcn.00475a00
mov edx, dword [ebx + 0x20]
push eax
mov ecx, edi
call edx
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.00475600
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xe1000018
call ebx
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4717b6
mov ecx, dword [0x741af8]
push ecx
push 0xe1000014
lea edx, [esp + 0x44]
push edx
call fcn.00475440
mov dword [esp + 0x78], 2
lea eax, [esp + 0x3c]
push eax
call fcn.00475790
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.00475600
mov ecx, dword [0x741af8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00475440
mov dword [esp + 0x78], 3
mov ebx, dword [edi]
lea ecx, [esp + 0xc]
call fcn.00475a00
push eax
mov eax, dword [ebx + 0x20]
mov ecx, edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00475600
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4717d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f2ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edi, eax
and eax, 2
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
push ecx
mov ecx, esi
and edi, 1
call edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
push ecx
mov ecx, esi
call edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x28]
call sub.mfc90u.dll_CBrush::CBrush
mov dword [esp + 0x48], 0
mov eax, dword [ebp + 0x1c]
imul eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
add eax, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x34], eax
lea eax, [ecx + edx]
mov edx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], ecx
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x38], ebx
call dword [sym.imp.USER32.dll_FillRect]
push 1
mov ecx, esi
call sub.mfc90u.dll_CDC::SetBkMode
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push eax
mov eax, dword [ebp + 0x28]
push ebx
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.0046ca40
add esp, 0xc
test edi, edi
je 0x4718b8
mov edx, dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push edx
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp + 0x28]
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.0046ca40
add esp, 0xc
cmp dword [esp + 0xc], 0
je 0x471935
lea ecx, [esp + 0x1c]
call fcn.00411fb0
mov byte [esp + 0x48], 1
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x20]
call sub.mfc90u.dll_CGdiObject::Attach
test eax, eax
je 0x471927
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call sub.mfc90u.dll_CDC::SelectObject_2
mov edi, dword [esp + 0x10]
add edi, 0xfffffffe
push edi
push ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esp + 0x18], eax
call sub.mfc90u.dll_CDC::MoveTo
mov edx, dword [esp + 0x18]
push edi
push edx
mov ecx, esi
call sub.mfc90u.dll_CDC::LineTo
mov eax, dword [esp + 0xc]
push eax
mov ecx, esi
call sub.mfc90u.dll_CDC::SelectObject_2
mov byte [esp + 0x48], 0
lea ecx, [esp + 0x1c]
call fcn.00411f00
or eax, 0xffffffff
mov dword [esp + 0x48], eax
mov dword [esp + 0x24], vtable.CBrush.0
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x24]
call fcn.00401a60
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret