joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4338a4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setge dl
mov eax, dword [ebp - 4]
call fcn.00433640
cmp dword [ebp - 8], 1
jne 0x4338d8
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
pop ecx
pop ecx
pop ebp
ret

Function at 0x4359c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x74d8ac], 0
jne 0x435a71
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [0x74d8a8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x744740
mov ecx, 2
call fcn.00402ee8
mov edx, 0x435980
mov eax, dword [ebp - 8]
add eax, 5
call fcn.004359a0
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.004359a0
mov edx, dword [ebp - 0xc]
mov dword [edx + 1], eax
mov eax, dword [0x74d8ac]
mov edx, dword [ebp - 0xc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0xc]
mov dword [0x74d8ac], eax
add dword [ebp - 0xc], 0xd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x435a2b
mov eax, dword [ebp - 8]
mov dword [0x74d8a8], eax
mov eax, dword [0x74d8ac]
mov dword [ebp - 4], eax
mov eax, dword [0x74d8ac]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 5]
mov dword [0x74d8ac], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x45c898
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ca1b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x744b24], 0
jne 0x45c9f8
push 0x74d8f0
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x45c9f1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x744b24], 0
jne 0x45c9d9
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004057b0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405624
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040a1fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x45ca34
call fcn.0040c6cc
mov eax, dword [ebp - 0x10]
call fcn.00405624
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x45c95a
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004057b0
jmp 0x45c991
lea eax, [ebp - 0xc]
mov edx, 0x45ca54
call fcn.004051ec
xor eax, eax
push ebp
push 0x45c987
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0041f8d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c991
mov eax, dword [ebp - 0xc]
call fcn.00405624
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x744b24], eax
cmp dword [0x744b24], 0
jne 0x45c9c4
mov ecx, dword [0x74c60c]
mov dl, 1
mov eax, dword [0x40956c]
call fcn.0040ff20
call fcn.00404aa8
push 0x45ca60
mov eax, dword [0x744b24]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [fcn.0074d908], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c9f8
push 0x74d8f0
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ca22
lea eax, [ebp - 0x1c]
call fcn.00405154
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405178
ret
Function at 0x45ce4c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
mov eax, ebx
call fcn.00405624
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45d08a
mov eax, dword [ebp - 4]
call fcn.00402bcc
mov dword [ebp - 8], eax
xor edi, edi
push ebp
push 0x45d083
push dword fs:[edi]
mov dword fs:[edi], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45d094
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
shr edx, 0x10
mov cx, word [eax + 8]
and cx, 0xffff
mov esi, dword [eax + 0xc]
shr esi, 0x10
mov ax, word [eax + 0xc]
and ax, 0xffff
cmp dx, 7
jne 0x45cf1c
cmp cx, 1
jne 0x45cf1c
cmp si, 0x69c
jne 0x45cf1c
cmp ax, 0x29c
jne 0x45cf1c
mov dword [0x74d920], 0x28f7c
mov dword [0x74d924], 0x28fb8
mov dword [0x74d928], 0x28fe4
mov dword [0x74d92c], 0x2900c
jmp 0x45d06a
cmp dx, 7
jne 0x45cf62
cmp cx, 1
jne 0x45cf62
cmp si, 0x69c
jne 0x45cf62
cmp ax, 0x29a
jne 0x45cf62
mov dword [0x74d920], 0x28f28
mov dword [0x74d924], 0x28f64
mov dword [0x74d928], 0x28f90
mov dword [0x74d92c], 0x28fb8
jmp 0x45d06a
cmp dx, 7
jne 0x45cfa6
test cx, cx
jne 0x45cfa6
cmp si, 4
jne 0x45cfa6
cmp ax, 0x1c5
jne 0x45cfa6
mov dword [0x74d920], 0x28764
mov dword [0x74d924], 0x287a0
mov dword [0x74d928], 0x287cc
mov dword [0x74d92c], 0x287f4
jmp 0x45d06a
cmp dx, 7
jne 0x45cfea
test cx, cx
jne 0x45cfea
cmp si, 1
jne 0x45cfea
cmp ax, 0x2cc
jne 0x45cfea
mov dword [0x74d920], 0x2855c
mov dword [0x74d924], 0x28598
mov dword [0x74d928], 0x285c4
mov dword [0x74d92c], 0x285ec
jmp 0x45d06a
cmp dx, 6
jne 0x45d02b
test cx, cx
jne 0x45d02b
cmp si, 0xa
jne 0x45d02b
cmp ax, 0x9d
jne 0x45d02b
mov dword [0x74d920], 0x282d8
mov dword [0x74d924], 0x28314
mov dword [0x74d928], 0x28340
mov dword [0x74d92c], 0x28368
jmp 0x45d06a
cmp dx, 5
jne 0x45d06a
test cx, cx
jne 0x45d06a
cmp si, 6
jne 0x45d06a
cmp ax, 0x12
jne 0x45d06a
mov dword [0x74d920], 0x25f44
mov dword [0x74d924], 0x25f80
mov dword [0x74d928], 0x25fac
mov dword [0x74d92c], 0x25fd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d08a
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00402bfc
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d328
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45d4c8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045d14c
test al, al
jne 0x45d462
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004057b0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00405624
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x74c994]
call fcn.0041f6b0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x45d4e0
call fcn.0040c6cc
mov eax, dword [ebp - 0xc]
call fcn.00405624
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x45d3c4
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004057b0
jmp 0x45d3fb
lea eax, [ebp - 8]
mov edx, 0x45d500
call fcn.004051ec
xor eax, eax
push ebp
push 0x45d3f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0041f8d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45d3fb
mov edx, 0x744b34
mov eax, dword [ebp - 8]
call fcn.0045d0e8
test al, al
je 0x45d4a5
cmp dword [0x744b34], 0
je 0x45d4a5
cmp dword [0x74d920], 0
je 0x45d4a5
mov eax, dword [0x744b34]
mov edx, eax
add edx, dword [0x74d920]
mov dword [0x74d910], edx
mov edx, eax
add edx, dword [0x74d924]
mov dword [0x74d91c], edx
mov edx, eax
add edx, dword [0x74d928]
mov dword [0x74d914], edx
add eax, dword [0x74d92c]
mov dword [0x74d918], eax
jmp 0x45d4a5
cmp dword [0x74d920], 0
je 0x45d4a5
mov eax, dword [0x744b34]
mov edx, eax
add edx, dword [0x74d920]
mov dword [0x74d910], edx
mov edx, eax
add edx, dword [0x74d924]
mov dword [0x74d91c], edx
mov edx, eax
add edx, dword [0x74d928]
mov dword [0x74d914], edx
add eax, dword [0x74d92c]
mov dword [0x74d918], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d4cf
lea eax, [ebp - 0x18]
call fcn.00405154
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405178
ret
Function at 0x45e9bc
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x3fffbd8a], dl
sub al, 0x46
add ah, ch
xchg byte [esi], al
dec eax
js 0x45e8fd
add byte [esp + ebp], ch
inc esi
add byte [edi + eax*4 + 0x46], ah
add byte [ebp - 0x7847ffba], cl
inc esi
add byte [eax], dl
mov byte [esi], al
pop esp
inc esi
add byte [esi + ebp + 0x46], dh
add byte [eax + ecx*4], bh
inc esi
add byte [edi + ebp], ch
inc esi
add byte [eax], dh
mov eax, dword [esi]
test al, 0x2f
inc esi
add byte [ebx + ecx*4 + 0x46], ah
add byte [ebx + ecx*4 + 0x46], dh
add al, ch
das
inc esi
add byte [eax - 0x7a], cl
inc esi
add byte [eax + 0x4800462e], dl
das
inc esi
add al, al
mov dword [esi], eax
test al, 0x8b
inc esi
add ah, ah
mov eax, dword [esi]
add al, 0x8c
inc esi
add byte [0x6f634954], al
outsb dx, byte [esi]
mov eax, eax
sbb al, 0xe9
inc ebp
add byte [edi], al
add eax, 0x6f634954
outsb dx, byte [esi]
lodsb al, byte [esi]
call 0xe425e96e
inc ebp
add byte [eax], al
add byte [eax], cl
inc edi
jb 0x45e992
jo 0x45e99b
imul esp, dword [ebx + 0x73], 0x8b550000
in al, dx
push ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45e959
mov eax, dword [ebp - 4]
cld
cmp eax, dword [0x74d938]
je 0x45e959
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteObject
pop ecx
pop ebp
ret
inc eax
add byte [esp + eax*2 + 0x40], dh
add byte [eax + 0x44], ch
inc eax
add byte [ecx + eax*2 + 0x41b80040], bl
inc eax
add byte [edx + ebp*8], ah
inc ebp
add byte [eax], dl
push esp
push edx
jae 0x45ea1d
jne 0x45ea22
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x45e947
inc eax
add byte [ecx + 0x31c289d1], cl
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x45e9c2
ret
cld
pop ecx
pop ecx
pop ebp
ret
mov eax, eax
push ebp
mov ebp, esp
add esp, 0xfffffff8
call fcn.004045e4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 8
push eax
call sub.kernel32.dll_DeleteCriticalSection_1
cmp byte [ebp - 5], 0
jle 0x45ea4f
mov eax, dword [ebp - 4]
call fcn.004045cc
pop ecx
pop ecx
pop ebp
ret

Function at 0x461d58
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x461da9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x461d90
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x461d80
jmp 0x461da9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x461d91
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e5b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405614
xor eax, eax
push ebp
push 0x46e6e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x46e6b6
xor eax, eax
push ebp
push 0x46e6af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405424
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46e684
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46e673
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405424
inc eax
push eax
mov eax, dword [ebp - 8]
call fcn.00405624
mov edx, dword [ebp - 0x10]
pop ecx
call fcn.00402ee8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e67a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x74bed8]
mov dl, 1
mov eax, dword [0x40956c]
call fcn.0040ff20
call fcn.00404aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e6ea
lea eax, [ebp - 8]
call fcn.00405154
ret
Function at 0x46e6f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e8be
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405814
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, 0x46e8d4
call fcn.00405470
mov eax, dword [ebp - 4]
call fcn.00434300
dec eax
test eax, eax
jl 0x46e7b9
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004342c0
mov edx, dword [0x486330]
call fcn.0040439c
test al, al
je 0x46e7b1
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004342c0
lea edx, [ebp - 0x20]
call fcn.0049853c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov edx, 3
mov al, 0x20
call fcn.00405814
push dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004054e4
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x46e75f
mov al, byte [0x46e8d8]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x46e8e4
mov eax, dword [ebp - 0x10]
call fcn.00411808
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.004051ec
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
call fcn.0049853c
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, 0x46e8d4
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0049853c
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xb
mov eax, 0x46e8d4
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
mov eax, 0x46e8d4
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x78]
mov ecx, 9
mov eax, 0x46e8f0
call fcn.0040c6cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e8c5
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.00405178
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405178
lea eax, [ebp - 0x20]
call fcn.00405154
lea eax, [ebp - 0x1c]
call fcn.00405154
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405178
ret
Function at 0x473408
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4734e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4734b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4734a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
call fcn.00402ee8
mov eax, dword [ebp - 4]
call fcn.004732e4
mov eax, dword [ebp - 0x10]
push eax
movzx eax, word [ebp - 6]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4734ac
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x4734f4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x473568
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x47353b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040535c
jmp 0x473543
mov eax, dword [ebp - 8]
call fcn.00405154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47356f
cmp dword [ebp - 0xc], 0
je 0x47355f
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4735a4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x47365d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0
je 0x473630
mov dx, word [ebp - 0xe]
mov eax, dword [0x45e470]
call fcn.00463e78
test al, al
je 0x47361b
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
push 9
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0xe]
mov eax, dword [ebp - 8]
call fcn.00463d58
call fcn.00404b54
jmp 0x473664
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_EnumClipboardFormats
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0
jne 0x4735d8
mov ecx, dword [0x74c0c4]
mov dl, 1
mov eax, dword [0x40956c]
call fcn.0040ff20
call fcn.00404aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473664
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
mov esp, ebp
pop ebp
ret

Function at 0x473668
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4736c8
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
push 9
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4736cf
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4736d4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x473734
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
push 9
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov dx, 3
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47373b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4737b8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x47382e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004732e4
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 8]
call fcn.00463e40
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x14], 0
je 0x473818
mov eax, dword [ebp - 0x14]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473835
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x47383c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4738b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004732e4
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x14], 0
je 0x47389d
mov eax, dword [ebp - 0x14]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4738ba
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x478640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405624
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne byte [ebp - 5]
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret