joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b6b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x45b6d8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x45b786
mov esi, esi
xor eax, eax
push 0x45b767
push ebp
push 0x415680
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
je 0x45b73c
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.0042d280
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x45b75c
cmp dword [ebp - 8], 0
je 0x45b75c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x45b786
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x492dc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x492de8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x492e9e
mov esi, esi
xor eax, eax
push 0x492e7f
push ebp
push 0x415680
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040d6d0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x492e74
cmp dword [ebp - 8], 0
je 0x492e74
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x492e9e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49bb70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x218]
push ebx
push esi
push edi
mov dword [ebp - 0x20c], 0
xor eax, eax
push fcn.0049bb60
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x69bfd0], 0
push 0x208
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov dword [ebp - 0x210], eax
mov word [ebp + eax*2 - 0x208], 0
mov ecx, dword [ebp - 0x210]
xor edx, edx
mov eax, ebp
call fcn.0049be30
mov ecx, dword [ebp - 0x210]
shl ecx, 1
mov eax, dword [0x69bfc0]
mov edx, dword [eax]
lea eax, [ebp - 0x208]
call fcn.00403710
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
call fcn.004048f0
mov dword [ebp - 0x214], eax
mov edx, eax
lea eax, [ebp - 0x20c]
call fcn.0040acd0
mov ecx, dword [ebp - 0x214]
shl ecx, 1
mov eax, ebx
mov edx, dword [ebp - 0x20c]
call fcn.00403710
mov ebx, 1
jmp 0x49bdef
add ebx, 1
cmp dword [ebp - 0x214], ebx
jl 0x49bc52
mov eax, dword [ebp - 0x20c]
cmp word [eax + ebx*2 - 2], 0x20
jbe 0x49bc38
cmp dword [ebp - 0x214], ebx
jl 0x49bdfb
mov esi, esi
mov byte [ebp - 0x218], 0
mov edi, ebx
mov dword [ebp - 0x210], 0
jmp 0x49bceb
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x49bce0
sub ax, 0x20
jbe 0x49bc9c
sub ax, 2
je 0x49bcb0
jmp 0x49bce0
mov al, byte [ebp - 0x218]
test al, al
je 0x49bcf3
add dword [ebp - 0x210], 1
jmp 0x49bce8
cmp dword [ebp - 0x214], ebx
jle 0x49bcdb
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 1]
cmp word [edx + eax*2 - 2], 0x22
je 0x49bcdb
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x49bce8
add ebx, 1
jmp 0x49bce8
add dword [ebp - 0x210], 1
nop
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x49bc78
cmp dword [0x69bfd0], 0
jle 0x49bde8
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x69bfd0]
mov eax, ebp
call fcn.0049be30
mov byte [ebp - 0x218], 0
mov ebx, edi
mov esi, 1
jmp 0x49bddb
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x49bdb4
sub ax, 0x20
jbe 0x49bd50
sub ax, 2
je 0x49bd84
jmp 0x49bdb4
mov al, byte [ebp - 0x218]
test al, al
je 0x49bde7
mov edx, dword [0x69bfc0]
mov eax, dword [0x69bfd0]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
jmp 0x49bdd8
cmp dword [ebp - 0x214], ebx
jle 0x49bdaf
mov eax, dword [ebp - 0x20c]
lea edx, [ebx + 1]
cmp word [eax + edx*2 - 2], 0x22
je 0x49bdaf
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x49bdd8
add ebx, 1
jmp 0x49bdd8
mov eax, dword [0x69bfc0]
mov edx, dword [0x69bfd0]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
lea esi, [esi]
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x49bd28
nop
add dword [0x69bfd0], 1
cmp dword [ebp - 0x214], ebx
jge 0x49bc3b
sub dword [0x69bfd0], 1
cmp word [0x699040], 0xfde9
jne 0x49be14
call fcn.0049ba70
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0049bb60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c240
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov bl, cl
push 4
lea ecx, [ebp - 8]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 2
jle 0x49c2ca
lea edx, [eax - 2]
test edx, edx
jl 0x49c2df
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov si, word [ebp + ecx*2 - 8]
mov di, word [ebp + ecx*2 - 8]
cmp di, 0x20
jb 0x49c2df
sub di, 0x20
je 0x49c2c4
sub di, 0x80
je 0x49c2c4
sub di, 0x1f62
jb 0x49c2df
sub di, 1
jbe 0x49c2c4
sub di, 6
je 0x49c2c4
sub di, 0x26
jne 0x49c2df
mov esi, esi
jmp 0x49c2c4
cmp edx, ecx
jg 0x49c278
jmp 0x49c2df
cmp eax, 2
jne 0x49c2d5
mov si, word [ebp - 8]
jmp 0x49c2df
mov al, bl
call fcn.0040b850
mov si, ax
mov ax, si
sub ax, 0x7f
jbe 0x49c358
sub ax, 0x21
je 0x49c368
sub ax, 0x17
je 0x49c36c
sub ax, 0x222
je 0x49c370
sub ax, 0x392
je 0x49c374
sub ax, 1
je 0x49c378
sub ax, 0x1996
je 0x49c37c
sub ax, 1
je 0x49c380
sub ax, 6
je 0x49c384
sub ax, 0xb
je 0x49c38c
sub ax, 0x1b
je 0x49c388
sub ax, 0x367
je 0x49c390
jmp 0x49c394
mov ax, si
call fcn.0040b8f0
jmp 0x49c398
mov al, 0x20
jmp 0x49c398
mov al, 0x2e
jmp 0x49c398
mov al, 0x27
jmp 0x49c398
mov al, 0x2c
jmp 0x49c398
mov al, 0x27
jmp 0x49c398
mov al, 0x20
jmp 0x49c398
mov al, 0x20
jmp 0x49c398
mov al, 0x20
jmp 0x49c398
mov al, 0x20
jmp 0x49c398
mov al, 0x2d
jmp 0x49c398
mov al, 0x27
jmp 0x49c398
mov al, bl
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d5130
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x4d5164
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x69cfe0]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x4d5140
pop edi
pop esi
pop ebx
ret

Function at 0x4dd130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4dd161
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4dd150
pop esi
pop ebx
ret

Function at 0x4de940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4de964
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4dea2a
mov esi, esi
xor eax, eax
push 0x4dea0b
push ebp
push 0x415680
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040d6d0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x603eac
call fcn.0042f290
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004debc0
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004dec30
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004deca0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4dea00
cmp dword [ebp - 4], 0
je 0x4dea00
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4dea2a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e63d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4e6404
mov eax, esi
call fcn.004ea950
cmp byte [esi + 0x40], 0
je 0x4e63fc
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4e64b5
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4e6494
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4e648c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4e6438
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4e6450
xor bl, bl
jmp 0x4e64b5
cmp edi, 2
je 0x4e648a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4e6428
cmp edi, 3
je 0x4e6468
cmp edi, 1
jne 0x4e6428
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4e6428
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4e6428
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4e64ac
cmp dword [esi + 0x14], 0xcc
je 0x4e64ac
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004e67f0
lea esi, [esi]
mov eax, esi
call fcn.004e64c0
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x5082d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x508308
mov edx, dword [0x5d6150]
cmp eax, dword [edx + 0x168]
jne 0x508308
cmp byte [edx + 0x114], 0
jne 0x508308
mov eax, dword [0x5d95f0]
mov edx, dword [0x5d95f0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov dword [ebx + 4], eax
nop
mov eax, dword [0x5d95f0]
mov edx, dword [0x5d95f0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x5083ec
mov eax, dword [0x5d6150]
cmp byte [eax + 0x114], 0
jne 0x5083ec
mov eax, dword [0x5d95f0]
mov edx, dword [0x5d95f0]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.0053b460
mov eax, dword [0x5d6150]
cmp dword [eax + 0x168], 0
je 0x5083c0
push 0x10
push 0
mov eax, dword [0x5d6150]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x5d6150]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x5d6150]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
push dword [ebx + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5d6150]
mov eax, dword [eax + 0x168]
call fcn.00484c50
test al, al
je 0x5083c0
push 0
mov eax, dword [0x5d6150]
call fcn.0041fa20
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push 0x112
push dword [ebx + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebx + 0x24]
mov dword [edx + 0xc], eax
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5d6150]
call fcn.00422a30
jmp 0x508460
mov edx, dword [ebx + 0x28]
test edx, edx
je 0x508429
mov eax, dword [0x5d6150]
cmp edx, dword [eax + 0x168]
jne 0x508429
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push 0x112
push dword [ebx + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebx + 0x24]
mov dword [edx + 0xc], eax
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5d6150]
call fcn.00422a30
jmp 0x508460
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x508460
test dword [eax + 0x488], 8
je 0x508460
mov eax, dword [ebx + 0x24]
mov dword [eax + 0xc], 1
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5d95f0]
mov edx, dword [0x5d95f0]
mov edx, dword [edx]
call dword [edx + 0x8c]
lea esi, [esi]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x508470
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [0x5d95f0]
mov edx, dword [0x5d95f0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x50852c
mov eax, dword [0x5d6150]
cmp byte [eax + 0x114], 0
jne 0x50852c
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push 0x112
push dword [ebx + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebx + 0x24]
mov dword [edx + 0xc], eax
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5d6150]
cmp dword [eax + 0x168], 0
je 0x508520
mov eax, dword [0x5d6150]
mov eax, dword [eax + 0x168]
call fcn.00484c50
test al, al
je 0x508520
mov eax, dword [0x5d6150]
mov eax, dword [eax + 0x168]
mov edx, dword [0x5d6150]
mov edx, dword [edx + 0x168]
mov edx, dword [edx]
call dword [edx + 0x344]
test al, al
je 0x508518
push 8
mov eax, dword [0x5d6150]
call fcn.0041fa20
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
call fcn.0053b530
lea esi, [esi]
mov eax, dword [0x5d6150]
call fcn.00422a60
jmp 0x508580
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x50854d
mov edx, dword [0x5d6150]
cmp eax, dword [edx + 0x168]
jne 0x50854d
mov eax, dword [0x5d6150]
call fcn.00422a60
jmp 0x508580
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x508580
test dword [eax + 0x488], 8
je 0x508580
mov eax, dword [ebx + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [0x5d95f0]
mov edx, dword [0x5d95f0]
mov edx, dword [edx]
call dword [edx + 0x90]
lea esi, [esi]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50cb80
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x28]
push ebx
mov dword [ebp - 0x28], 8
mov eax, fcn.0050b790
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00414200
mov dword [ebp - 0x18], eax
mov eax, str.MAINICON
push eax
push dword [0x69a2d0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x50cbd4
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x14], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, str.Window
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne bl
je 0x50cc4c
or dword [ebp - 0x28], 0x800
cmp dword [0x5f1850], 6
jb 0x50cc24
or dword [ebp - 0x28], 0x20000
lea esi, [esi]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov eax, str.HintWindow
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne bl
lea esi, [esi]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50db40
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x50dbd8
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x50dbd8
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.0050db20
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0050db20
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50e260
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.0050e240
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x50e320
lea eax, [ebp - 0x18]
call fcn.00403be0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.004a2470
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.00403be0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x1c]
call fcn.004a23d0
mov esi, dword [ebp - 0x1c]
call fcn.004a2b40
mov edx, str._DataSize
push edx
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
call fcn.004a3d10
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x50e377
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.0050e220
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0050e220
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0050e240
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53b830
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor eax, eax
push fcn.0053b810
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthW
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 4]
call fcn.0040acd0
test ebx, ebx
jle 0x53b890
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x53b885
mov eax, 0x69a300
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov ebx, eax
mov esi, esi
mov edx, ebx
lea eax, [ebp - 4]
call fcn.0040acd0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
call fcn.0040b4c0
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.004a0bf0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0053b810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53cc90
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
mov eax, esi
mov edx, 0x656560
call fcn.0040ef90
mov dword [ebp - 4], 0
xor eax, eax
push fcn.0053cc80
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 8], 0
mov dword [esi], 0
lea eax, [esi + 0x34]
xor edx, edx
call fcn.00408f00
mov eax, fcn.0050b790
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [edi]
lea ecx, [ebp - 4]
xor dx, dx
call fcn.00409850
mov edx, dword [ebp - 4]
lea eax, [esi + 0x30]
call fcn.00408f00
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x14]
push eax
lea ecx, [esi + 0x10]
lea edx, [esi + 0xc]
mov eax, ebx
call fcn.0053b070
mov edx, esi
mov eax, ebx
call fcn.0053d230
test dword [ebx + 0x28], 0x10
jne 0x53cd60
mov eax, ebx
call fcn.00488d20
test al, al
jne 0x53cd60
or dword [esi + 0x24], 0x8000000
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0053cc80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x588af0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408ed0
mov eax, dword [ebp + 0xc]
call fcn.00408ed0
mov dword [ebp - 8], 0
xor eax, eax
push fcn.00588ad0
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jb 0x588bc0
sub ebx, 1
je 0x588b54
sub ebx, 2
je 0x588b90
sub ebx, 1
je 0x588b68
sub ebx, 4
je 0x588ba0
sub ebx, 1
je 0x588bb0
jmp 0x588bc0
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.TABLES_WHERE_TABLE_TYPEBASE_TABLE
call fcn.00408f00
jmp 0x588bcc
push 0
lea eax, [ebp - 8]
call fcn.00403be0
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
mov dl, 0x27
call fcn.004409f0
mov ecx, dword [ebp - 8]
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.COLUMNS_WHERE_TABLE_NAME
call fcn.00409000
jmp 0x588bcc
mov eax, esi
mov edx, str.SELECT___ROUTINE_NAME_AS_PROCEDURE_NAME_FROM_INFORMATION_SCHEMA.ROUTINES
call fcn.00408f00
jmp 0x588bcc
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.SCHEMATA
call fcn.00408f00
jmp 0x588bcc
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.SEQUENCES
call fcn.00408f00
jmp 0x588bcc
mov eax, dword [str.The_metadata_is_not_available_for_this_type_of_database.]
call fcn.0058f2f0
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00588ad0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d3120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, edx
call fcn.00408ed0
xor eax, eax
push fcn.005d3110
push ebp
push 0x415300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0x58], 0
je 0x5d3180
mov eax, dword [ebp - 4]
test eax, eax
je 0x5d315a
mov eax, dword [eax - 4]
test eax, eax
jle 0x5d3180
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x5d316e
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x58]
call sub.kernel32.dll_WriteFile
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005d3110
mov esp, ebp
pop ebp
ret