joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4548a0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00453f40
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4548d4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x474170]
call dword [ebp - 8]
jmp 0x4548da
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x454930
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00453f80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x454964
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x474170]
call dword [ebp - 8]
jmp 0x45496e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x454980
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00453fa0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4549b8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x474170]
call dword [ebp - 8]
jmp 0x4549c6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x454a90
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00454040
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x454ad0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x474170]
call dword [ebp - 8]
jmp 0x454aee
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00454e50
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45d190
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.00449d30
lea ecx, [ebp - 0x34]
call fcn.00449d30
call fcn.00449fa0
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00448c30
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45d1e3
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.00449dd0
lea ecx, [ebp - 0x4c]
call fcn.00449dd0
mov eax, dword [ebp - 8]
jmp 0x45d258
call fcn.00449fa0
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00448c30
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45d21e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.00449dd0
lea ecx, [ebp - 0x4c]
call fcn.00449dd0
mov eax, dword [ebp - 0x10]
jmp 0x45d258
lea ecx, [ebp - 0x34]
call fcn.0044a290
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.0044a290
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.00449dd0
lea ecx, [ebp - 0x4c]
call fcn.00449dd0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x4677f0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401490
mov eax, dword [0x49200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4939f0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x4679c8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x467917
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x467917
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x4678f5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x467879
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x467981
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x4679e8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x4679c3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4679e8
jmp 0x467852
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402bd0
mov esp, ebp
pop ebp
ret
Function at 0x467a00
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401490
mov eax, dword [0x49200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4939f0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x467beb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x467b36
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x467b36
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x467b12
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x467a89
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x467ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x467c0b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x467be6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x467c0b
jmp 0x467a62
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402bd0
mov esp, ebp
pop ebp
ret
Function at 0x401782
Capabilities:
Terminate process

Disassembly:
mov eax, ecx
push esi
push edi
xor ecx, ecx
mov dx, word [eax]
xor edi, edi
test dx, dx
je 0x4017ca
mov esi, 0x40a020
cmp dx, 0x20
jne 0x4017a1
test edi, edi
je 0x4017ca
cmp dx, 0x22
jne 0x4017b2
xor edx, edx
test edi, edi
sete dl
mov edi, edx
jmp 0x4017c0
cmp esi, 0x40a22e
jae 0x4017d6
mov word [esi], dx
inc ecx
inc esi
inc esi
inc eax
inc eax
mov dx, word [eax]
test dx, dx
jne 0x401797
and word [ecx*2 + 0x40a020], 0
pop edi
pop esi
ret
push 1
call dword [sym.imp.MSVCRT.dll_exit]

Function at 0x401fb1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x40a8b0]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ebx
jne 0x402043
lea eax, [ebp - 0x2e0]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x4020d9
cmp eax, 0x104
ja 0x4020d9
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x2e2], 0x5c
je 0x402016
mov word [ebp + eax*2 - 0x2e0], 0x5c
inc eax
lea eax, [ebp + eax*2 - 0x2e0]
push str.version.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [0x40a8b0], eax
je 0x4020d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeW
push eax
call esi
mov edi, eax
push str.GetFileVersionInfoW
push dword [0x40a8b0]
call esi
mov dword [ebp - 4], eax
push str.VerQueryValueW
push dword [0x40a8b0]
call esi
cmp edi, ebx
mov dword [ebp - 0xc], eax
je 0x4020d9
cmp dword [ebp - 4], ebx
je 0x4020d9
cmp eax, ebx
je 0x4020d9
push ebx
push dword [ebp - 8]
call edi
mov esi, eax
cmp esi, ebx
je 0x4020d9
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4020d9
push edi
push esi
push ebx
push dword [ebp - 8]
call dword [ebp - 4]
test eax, eax
je 0x4020ca
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 4]
push eax
push 0x4087f4
push edi
mov dword [ebp - 8], ebx
call dword [ebp - 0xc]
test eax, eax
je 0x4020ca
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
jmp 0x4020cd
mov esi, dword [ebp - 0x10]
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, esi
jmp 0x4020db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024a0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x264]
mov dword [ebp - 8], 1
push eax
mov eax, dword [ebp - 4]
dec eax
push ebx
neg eax
sbb eax, eax
push ebx
and al, 0xeb
mov word [ebp - 0x264], bx
add eax, 0x17
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4025b3
lea ecx, [ebp - 0x264]
call fcn.00401448
mov edx, dword [0x408150]
lea ecx, [ebp - 0x264]
call fcn.004013af
cmp dword [ebp - 4], ebx
je 0x402516
lea ecx, [ebp - 0x264]
call fcn.004020e0
lea ecx, [ebp - 0x264]
call fcn.00401448
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
lea esi, [ebp + eax*2 - 0x264]
cmp edi, ebx
mov edx, str.7_Zip_File_Manager.lnk
je 0x402545
mov edx, str.7_Zip_Help.lnk
mov ecx, esi
call fcn.00401312
lea eax, [ebp - 0x4bc]
push 0x40a44c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp edi, ebx
mov edx, str.7zFM.exe
je 0x40256c
mov edx, str.7_zip.chm
lea ecx, [ebp - 0x4bc]
call fcn.004013af
cmp dword [ebp - 4], ebx
jne 0x40258b
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4025a3
lea edx, [ebp - 0x4bc]
lea ecx, [ebp - 0x264]
call fcn.004025c5
test eax, eax
je 0x4025a3
mov dword [ebp - 8], ebx
inc edi
cmp edi, 2
jb 0x402537
cmp dword [ebp - 4], ebx
je 0x4025b3
cmp dword [ebp - 8], ebx
jne 0x4025c0
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jb 0x4024b4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ac3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401ad2
pop dword [ebp - 0x38]
mov eax, 0x401ad2
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x51fe7
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x75c1fb9b
sub ecx, 0x75c1ab26
mov ebx, eax
mov esi, 0x12d42a6
sub esi, 0xe4c4a6
add esi, dword [ebp - 0x38]
mov edi, 0xbe657506
sub edi, 0x566d3a3e
add dword [ebp - 0x20], 0x6e116805
mov edx, dword [esi]
xor dword [ebp - 0x18], ebx
xor edx, edi
xor dword [ebp - 0x34], eax
mov dword [ebx], edx
mov dword [ebp - 8], 0x945f2f8f
add ebx, 0x5aaac51b
sub ebx, 0x5aaac517
add esi, 0x5e6d969b
sub esi, 0x5e6d9697
loop 0x401b27
add eax, 0x8dec4b99
sub eax, 0x8deb16f2
mov ebx, eax
add eax, 0x301daf33
add eax, 0xcfe250d2
mov ecx, 0xb23d0b77
sub ecx, 0xb1fd0b77
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4011ab
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x435a24]
mov esi, dword [ebp - 8]
mov ax, 0x66
or esi, dword [ebp - 8]
mov ecx, dword [0x435b2c]
mov di, 0xac
mov eax, dword [0x435cc4]
mov ecx, dword [ebp - 0xc]
sub ecx, edx
sub eax, esi
mov eax, dword [ebp - 0xc]
mov eax, dword [0x435b88]
mov ax, 0x50
mov dword [ebp - 0xc], eax
mov dword [0x435c9c], eax
push dword [ebp - 8]
mov dword [ebp - 8], eax
push dword [0x435afc]
call sub.user32.dll_GetClipboardData
invalid
invalid
invalid

Function at 0x4012b5
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
sbb edx, dword [0x435d70]
mov ecx, dword [ebp - 0xc]
add esi, edi
mov edi, dword [0x435d80]
mov edi, dword [0x435cc4]
mov eax, dword [0x435b60]
mov eax, dword [ebp - 8]

Function at 0x4012da
Capabilities:
Read clipboard data

Disassembly:
mov ax, 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [0x435d94]
call sub.user32.dll_GetClipboardData
mov esi, dword [0x435d2c]
mov edx, dword [ebp - 8]
add ecx, edi
mov eax, dword [ebp - 0xc]
mov eax, dword [0x435a7c]
leave
ret 8

Function at 0x40158e
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x435b5c]
sub eax, eax
mov esi, 0x8f
and eax, dword [0x435a24]
mov esi, 0x10
mov esi, dword [0x435c28]
sub edx, edi
mov eax, dword [0x435a3c]
mov ecx, dword [0x435e1c]
push 0xaa
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435e14]
add edx, eax
mov esi, dword [0x435c80]
mov eax, 0x96
mov dword [0x435d38], eax
push 0xbb
mov dword [0x435c1c], edx
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435a7c]
add ecx, eax
mov edi, dword [0x435ae4]
mov esi, 0xc2
mov esi, dword [0x435bf0]
sub eax, esi
push 0xbc
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435a34]
mov eax, 1
mov edi, dword [0x435cf8]
mov ax, 8
push 0x1140
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435ca8]
add edi, esi
mov eax, 0x40
mov eax, dword [0x435b40]
sub eax, ecx
push 0x64

Function at 0x40164e
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435dd0]
mov ax, 0xb2
sub ecx, ecx
push 0xf8c
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435bf4]
sub eax, eax
sub esi, eax
mov ecx, dword [0x435c68]
push 0x81
push 0
add al, ch
out dx, eax
and byte [ebx], al
add byte [ecx + 0x435c68], ah
Function at 0x4019bd
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435e18]
sub edi, ecx
mov eax, dword [0x435d1c]
push 0x99
add dword [0x435dac], 0x2c
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435b00]
mov ax, 0x48
mov edx, 4
mov dword [0x435ccc], edx
push 0xc1
mov dword [0x435cc4], eax
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435cc8]
mov esi, 0xce
mov edi, dword [0x435e0c]
add eax, eax
mov esi, dword [0x435ba8]
mov eax, 0x80
push 0x66
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435df8]
mov si, 0x59
mov eax, dword [0x435e10]
mov ecx, 0x80
add edx, eax
mov dword [0x435ab8], esi
push 0xc6
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435b7c]
add ecx, ecx
mov edx, dword [0x435e18]
mov di, 0x80
push 0x67
mov dword [0x435b18], eax
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435bc8]
mov edx, 0x20
mov eax, dword [0x435ad0]
mov dword [0x435dac], eax
push 0x6f
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a24]
mov eax, 0xac
mov eax, dword [0x435bd0]
sub esi, eax
mov dword [0x435b3c], ecx
push 0x8f
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435b38]
mov ecx, 6
mov eax, dword [0x435a24]
sub ecx, eax
mov cx, 4
push 0x78
push 0
call sub.user32.dll_LoadIconA
adc esi, dword [0x435b98]
mov eax, 0x96
mov ax, 0xe4
mov dword [0x435a24], edi
push 0xa81
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435a58]
mov esi, 0x10
mov eax, dword [0x435cf0]
mov edx, dword [0x435d84]
push 0x98
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435a38]
sub esi, eax
push 0xab
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b60]
mov eax, 0x4a
invalid

Function at 0x401b79
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov eax, dword [0x435c0c]
mov eax, 0x25
mov edi, dword [0x435a24]
mov eax, dword [0x435a48]
push 0x1ebb
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435b9c]
mov si, 0x20
mov ecx, dword [0x435ca4]
mov esi, dword [0x435a24]
push 0x221
mov dword [0x435c54], edx
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d98]
or esi, eax
mov eax, dword [0x435c0c]
mov ax, 0xda
mov esi, dword [0x435b60]
push 0x4e1
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435d58]
mov eax, 0xcd
mov eax, dword [0x435bb8]
mov dword [0x435a44], edi
push 0x77
mov dword [0x435c50], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d94]
add eax, eax
mov eax, dword [0x435bd4]
mov ecx, 0x13
mov edi, dword [0x435a24]
add eax, esi
push 0xc1
mov dword [0x435e1c], eax
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435dc8]
add eax, eax
mov edx, dword [0x435ab4]
mov cx, 0xf9
push 0x72
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c78]
add esi, eax
mov esi, dword [0x435c80]
mov edx, dword [0x435c84]
push 0xc7
mov dword [0x435c04], ecx
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435c84]
add edi, ecx
mov ax, 1
Function at 0x401c7e
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov dword [0x435df4], eax
push 0x92
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d08]
xor eax, eax
mov ecx, 8
mov cx, 0x29
push 0xa7
mov dword [0x435cbc], edx
add byte [edx], ch

Function at 0x40202c
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
add byte [ecx + 0x435a6c15], cl
add byte [edx], ch
call sub.user32.dll_LoadIconA

Function at 0x40203a
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov eax, dword [0x435c70]
add ecx, eax
and eax, edx
mov eax, dword [0x435cc4]
push 0xf51
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b48]
sub edi, edi
mov edi, dword [0x435cbc]
mov ax, 0xb5
push 0x6a
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b94]
mov cx, 0xa2
mov eax, dword [0x435a70]
mov dword [0x435d2c], eax
push 0x7c
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435b28]
add esi, eax
sub eax, edi
invalid
invalid
loopne 0x4020f5

Function at 0x402098
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
inc ebx
add byte [eax - 0x5d], ch
add byte [eax], al
add byte [edx], ch