joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046da
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4046e5
push edi
mov dword [ebp - 4], 0
push 0
call sub.USER32.DLL_OpenClipboard
cmp eax, 0
je 0x40475c
call sub.USER32.DLL_EmptyClipboard
mov edi, dword [ebp + 8]
push dword [edi + 4]
push 0x2000
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x404757
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
push dword [edi + 4]
push dword [edi]
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
push dword [ebp - 8]
push 8
call sub.USER32.DLL_SetClipboardData
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
mov dword [ebp - 4], 1
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x404762
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 6
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40476d
push esi
push edi
mov word [ebp - 0xe], 0x4d42
mov edi, dword [ebp + 8]
mov edi, dword [edi + 4]
add edi, 0xe
mov dword [ebp - 0xc], edi
mov word [ebp - 8], 0
mov word [ebp - 6], 0
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov eax, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
mul dword [edi + 8]
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x18]
mov dword [ebp - 4], esi
push 0x43e974
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x14], eax
cmp eax, 0
jne 0x4047d1
mov eax, 0
jmp 0x404809
push dword [ebp - 0x14]
push 0xe
push 1
lea edi, [ebp - 0xe]
push edi
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
push dword [ebp - 0x14]
mov edi, dword [ebp + 8]
push dword [edi + 4]
push 1
push dword [edi]
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
leave
ret

Function at 0x404e32
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 5
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x404e3d
push edi
cmp dword [0x421db8], 0
je 0x404e8d
lea edi, [ebp - 0x14]
push edi
lea edi, [ebp - 8]
push edi
push dword [0x421db8]
call sub.KERNEL32.dll_ClearCommError
cmp eax, 0
jne 0x404e73
mov eax, 0xffffffff
jmp 0x404f0b
cmp dword [ebp - 8], 0
je 0x404e88
mov edi, 0
mov eax, edi
sub eax, dword [ebp - 8]
jmp 0x404f0b
mov eax, dword [ebp - 0x10]
jmp 0x404f0b
cmp dword [0x421454], 0
je 0x404edf
lea edi, [ebp - 4]
push edi
push dword [0x421454]
call dword [0x421460]
mov dword [0x4214b4], eax
cmp dword [0x4214b4], 0
jne 0x404eb9
mov eax, dword [ebp - 4]
jmp 0x404f0b
call fcn.00404c55
push 0x32
call sub.KERNEL32.dll_Sleep
push dword [0x421da0]
push 0x2634
call fcn.004049ad
add esp, 8
mov eax, 0
jmp 0x404f0b
cmp dword [0x421de4], 0
je 0x404f06
lea edi, [ebp - 4]
push edi
push 0x4004667f
push dword [0x421de4]
call sub.WS2_32.DLL_ioctlsocket
cmp eax, 0
jne 0x404f06
mov eax, dword [ebp - 4]
jmp 0x404f0b
mov eax, 0xffffffff
pop edi
leave
ret
Function at 0x404f54
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x404f5f
push edi
cmp dword [0x421db8], 0
jne 0x404f8f
cmp dword [0x421454], 0
jne 0x404f8f
cmp dword [0x421de4], 0
jne 0x404f8f
mov eax, 0xffffffff
jmp 0x405069
call fcn.00404931
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [0x421db8], 0
je 0x404fc3
push 0
lea edi, [ebp - 4]
push edi
push 1
lea edi, [ebp - 0xd]
push edi
push dword [0x421db8]
call sub.KERNEL32.dll_ReadFile
jmp 0x405022
cmp dword [0x421454], 0
je 0x404fee
call fcn.00404e32
cmp eax, 1
jl 0x405022
lea edi, [ebp - 4]
push edi
push 1
lea edi, [ebp - 0xd]
push edi
push dword [0x421454]
call dword [0x42141c]
jmp 0x405022
cmp dword [0x421de4], 0
je 0x405022
call fcn.00404e32
cmp eax, 1
jl 0x405022
lea edi, [ebp - 0xd]
push edi
push 1
push 0x421ddc
call fcn.00412633
add esp, 0xc
cmp eax, 0
jne 0x405022
mov edi, dword [0x421de8]
mov dword [ebp - 4], edi
cmp dword [ebp - 4], 1
je 0x405048
call fcn.00404931
mov dword [ebp - 8], eax
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], edi
je 0x405048
dec dword [ebp + 8]
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
push 0xa
call sub.KERNEL32.dll_Sleep
cmp dword [ebp - 4], 1
je 0x405058
cmp dword [ebp + 8], 0
jg 0x404f9a
cmp dword [ebp - 4], 1
je 0x405065
mov eax, 0xffffffff
jmp 0x405069
movzx eax, byte [ebp - 0xd]
pop edi
leave
ret

Function at 0x40506c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x405077
push edi
mov dword [ebp - 0x10], 0
cmp dword [0x421db8], 0
jne 0x4050ae
cmp dword [0x421454], 0
jne 0x4050ae
cmp dword [0x421de4], 0
jne 0x4050ae
mov eax, 0xffffffff
jmp 0x40517e
call fcn.00404931
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call fcn.00404e32
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 4], edi
jge 0x4050e9
call fcn.00404931
mov dword [ebp - 8], eax
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], edi
je 0x4050e9
dec dword [ebp + 0x10]
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
push 0xa
call sub.KERNEL32.dll_Sleep
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 4], edi
jge 0x4050f7
cmp dword [ebp + 0x10], 0
jg 0x4050b9
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 4], edi
jl 0x40516c
cmp dword [0x421db8], 0
je 0x405121
push 0
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x421db8]
call sub.KERNEL32.dll_ReadFile
jmp 0x40516c
cmp dword [0x421454], 0
je 0x405142
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x421454]
call dword [0x42141c]
jmp 0x40516c
cmp dword [0x421de4], 0
je 0x40516c
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x421ddc
call fcn.00412633
add esp, 0xc
cmp eax, 0
jne 0x40516c
mov edi, dword [0x421de8]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x10], edi
je 0x40517b
mov eax, 0
jmp 0x40517e
mov eax, dword [ebp - 0x10]
pop edi
leave
ret
Function at 0x4051e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4051f0
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call fcn.00404931
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
jmp 0x405236
call fcn.00404931
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
je 0x405236
inc dword [ebp - 8]
mov edi, dword [ebp - 4]
mov dword [ebp - 0xc], edi
push 0
call sub.KERNEL32.dll_Sleep
call fcn.00405181
cmp eax, 0
je 0x40524b
mov edi, dword [0x43e9bc]
cmp dword [ebp - 8], edi
jle 0x405216
mov edi, dword [0x43e9bc]
cmp dword [ebp - 8], edi
jle 0x40525d
mov eax, 0
jmp 0x4052dc
cmp dword [0x421db8], 0
je 0x40527f
push 0
lea edi, [ebp - 0x10]
push edi
push 1
lea edi, [ebp + 8]
push edi
push dword [0x421db8]
call sub.KERNEL32.dll_WriteFile
jmp 0x4052ca
cmp dword [0x421454], 0
je 0x4052a0
lea edi, [ebp - 0x10]
push edi
push 1
lea edi, [ebp + 8]
push edi
push dword [0x421454]
call dword [0x421494]
jmp 0x4052ca
cmp dword [0x421de4], 0
je 0x4052ca
lea edi, [ebp + 8]
push edi
push 1
push 0x421ddc
call fcn.004125bd
add esp, 0xc
cmp eax, 0
jne 0x4052ca
mov edi, dword [0x421dec]
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], 1
je 0x4052d7
mov eax, 0
jmp 0x4052dc
mov eax, 1
pop edi
leave
ret

Function at 0x4052df
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4052ea
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call fcn.00404931
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
jmp 0x405330
call fcn.00404931
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
je 0x405330
inc dword [ebp - 8]
mov edi, dword [ebp - 4]
mov dword [ebp - 0xc], edi
push 0
call sub.KERNEL32.dll_Sleep
call fcn.00405181
cmp eax, 0
je 0x405345
mov edi, dword [0x43e9bc]
cmp dword [ebp - 8], edi
jle 0x405310
mov edi, dword [0x43e9bc]
cmp dword [ebp - 8], edi
jle 0x40535a
mov eax, 0
jmp 0x4053db
cmp dword [0x421db8], 0
je 0x40537c
push 0
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x421db8]
call sub.KERNEL32.dll_WriteFile
jmp 0x4053c7
cmp dword [0x421454], 0
je 0x40539d
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x421454]
call dword [0x421494]
jmp 0x4053c7
cmp dword [0x421de4], 0
je 0x4053c7
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x421ddc
call fcn.004125bd
add esp, 0xc
cmp eax, 0
jne 0x4053c7
mov edi, dword [0x421dec]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x10], edi
je 0x4053d6
mov eax, 0
jmp 0x4053db
mov eax, 1
pop edi
leave
ret

Function at 0x4068d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 1
push 0
push 0
push dword [ebp + 8]
push 0x406825
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop edi
leave
ret
Function at 0x4069d1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 1
push 0
push 0
push dword [ebp + 8]
push 0x4068f8
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop edi
leave
ret

Function at 0x406ac9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 1
push 0
push 0
push dword [ebp + 8]
push 0x4069f6
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop edi
leave
ret
Function at 0x408091
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 6
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40809c
push edi
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 4]
push edi
push 0xb0
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
mov edi, dword [ebp - 4]
cmp dword [ebp - 8], edi
je 0x408179
lea edi, [ebp - 0xc]
push edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00407898
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, 0
je 0x408179
push dword [ebp - 0xc]
push 0x42a018
call fcn.00407e70
add esp, 8
mov dword [ebp - 0x14], eax
cmp eax, 0
je 0x408171
cmp dword [ebp - 0x14], 5
jae 0x40811e
movzx edi, word [ebp - 0x14]
push edi
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0x10]
push edi
call fcn.004079b1
add esp, 0xc
jmp 0x408139
cmp dword [ebp - 0x14], 5
jbe 0x408139
movzx edi, word [ebp - 0x14]
push edi
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0x10]
push edi
call fcn.00407bb9
add esp, 0xc
push 0x43eff6
push 0x42a018
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x18], eax
cmp eax, 0
je 0x408171
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
push dword [ebp - 0x18]
call sub.CRTDLL.DLL_fclose
add esp, 4
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalFree
pop edi
leave
ret
Function at 0x40822e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov ecx, 0x82
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40823c
push ebx
push esi
push edi
mov dword [ebp - 0x104], 2
cmp dword [0x4264ac], 0
jl 0x40827a
push 0
mov edi, dword [0x4264ac]
shl edi, 7
lea edi, [edi + 0x42a128]
push edi
call sub.USER32.DLL_FindWindowA
mov edi, eax
mov ebx, edi
jmp 0x40827f
mov ebx, 0
mov dword [0x421f18], ebx
cmp dword [0x4684fc], 0
jne 0x40829c
cmp dword [0x421f18], 0
jne 0x40829c
jmp 0x40843b
mov dword [0x425c84], 0
call fcn.00402028
cmp eax, 0
je 0x408413
push str.The_hardcopy_is_put_into_Clipboard
push 0
call fcn.00406e00
add esp, 8
push 0x43cf18
lea edi, [ebp - 0x204]
push edi
call fcn.0041b031
add esp, 8
push 0x2e
lea edi, [ebp - 0x204]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x4082fc
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
lea edi, [ebp - 0x204]
push edi
push str._s.bmp
lea edi, [ebp - 0x100]
push edi
call fcn.0041afb5
add esp, 0xc
jmp 0x408346
mov edi, dword [ebp - 0x104]
mov esi, edi
add esi, 1
mov dword [ebp - 0x104], esi
push edi
lea edi, [ebp - 0x204]
push edi
push str._s__d_.bmp
lea edi, [ebp - 0x100]
push edi
call fcn.0041afb5
add esp, 0x10
lea edi, [ebp - 0x100]
push edi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x408319
lea edi, [ebp - 0x100]
push edi
call fcn.0040817c
add esp, 4
cmp eax, 0
je 0x408413
lea edi, [ebp - 0x100]
push edi
push 0x42153c
call fcn.00404762
add esp, 8
push 0x2e
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x4083a8
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
lea edi, [ebp - 0x100]
push edi
call fcn.0041b0a8
add esp, 4
mov edi, eax
sub edi, 1
cmp byte [ebp + edi - 0x100], 0x29
jne 0x4083eb
push 0x28
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x4083eb
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
push str..bmp
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
lea edi, [ebp - 0x100]
push edi
push 0x43cf18
call fcn.0041b031
add esp, 8
cmp dword [0x42153c], 0
je 0x408431
push dword [0x42153c]
call sub.KERNEL32.dll_GlobalFree
mov dword [0x42153c], 0
mov dword [0x425c84], 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408a9c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov ecx, 0x45
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x408aaa
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x10c], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x108], 0
je 0x408aeb
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x108], 0
mov edi, dword [ebp + 8]
cmp byte [edi], 0
je 0x408cd9
push 0x43d018
push dword [ebp + 8]
lea edi, [ebp - 0x104]
push edi
call fcn.00411d1a
add esp, 0xc
push 0x43eec8
lea edi, [ebp - 0x104]
push edi
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x408cc7
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0x108], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
cmp dword [ebp - 0x108], 0
je 0x408cbc
mov edi, dword [ebp - 0x108]
add edi, 1
push edi
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov esi, dword [ebp + 8]
mov dword [esi + 0x108], eax
cmp eax, 0
je 0x408cbc
push dword [ebp - 4]
push dword [ebp - 0x108]
push 1
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp eax, dword [ebp - 0x108]
je 0x408bcd
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x108], 0
jmp 0x408cbc
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x108]
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x108]
mov esi, dword [ebp - 0x10c]
mov byte [esi + edi], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x10c], 0
mov edi, dword [ebp + 8]
add edi, 0x100
push edi
lea edi, [ebp - 0x104]
push edi
call fcn.00408a33
add esp, 8
jmp 0x408cad
mov edi, dword [ebp - 0x10c]
mov dword [ebp - 0x110], edi
jmp 0x408c2c
add dword [ebp - 0x10c], 1
mov edi, dword [ebp - 0x10c]
movsx ebx, byte [edi]
cmp ebx, 0
je 0x408c3f
cmp ebx, 0xa
jne 0x408c25
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0xa
jne 0x408c5e
mov edi, dword [ebp - 0x10c]
mov esi, edi
add esi, 1
mov dword [ebp - 0x10c], esi
mov byte [edi], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10c], 0x1f3
jge 0x408cad
mov edi, dword [ebp + 8]
mov eax, 0xc
mul dword [edi + 0x10c]
mov dword [ebp - 0x114], eax
mov esi, dword [ebp - 0x114]
lea edi, [esi + edi + 0x110]
push edi
push dword [ebp - 0x110]
call fcn.00408789
add esp, 8
cmp eax, 0
je 0x408cad
mov edi, dword [ebp + 8]
add edi, 0x10c
inc dword [edi]
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0
jne 0x408c17
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10c], 0
jne 0x408cd9
mov edi, dword [ebp + 8]
mov byte [edi], 0
push 0
mov edi, dword [ebp + 8]
push dword [edi + 0x10c]
push 0x445
push dword [0x421f28]
call sub.USER32.DLL_SetDlgItemInt
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d4ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov ecx, 0x85
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40d4c8
push edi
lea edi, [ebp - 0x10c]
push edi
push 1
push 0
push dword [ebp + 8]
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x40d5ad
mov dword [ebp - 8], 0x100
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 0x20c]
push edi
lea edi, [ebp - 0x210]
push edi
push 0
push str.Count
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x40d5a2
mov edi, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edi
mov dword [ebp - 4], 0
jmp 0x40d597
push dword [ebp - 4]
push 0x43f833
lea edi, [ebp - 0x108]
push edi
call fcn.0041afb5
add esp, 0xc
mov dword [ebp - 8], 0x100
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 0x20c]
push edi
lea edi, [ebp - 0x210]
push edi
push 0
lea edi, [ebp - 0x108]
push edi
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x40d594
push dword [ebp + 0xc]
lea edi, [ebp - 0x20c]
push edi
call fcn.0040d1d5
add esp, 8
inc dword [ebp - 4]
mov edi, dword [ebp - 0x214]
cmp dword [ebp - 4], edi
jb 0x40d539
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
leave
ret
Function at 0x40db62
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov ecx, 0x40
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40db70
push ebx
push edi
cmp dword [ebp + 0xc], 0
jne 0x40db8b
lea edi, [ebp - 0x100]
mov dword [ebp + 0xc], edi
push 0x43d018
push dword [ebp + 0xc]
call fcn.0041b031
add esp, 8
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str..exe
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp + 0xc]
call sub.KERNEL32.dll_GetFileAttributesA
mov edi, eax
cmp edi, 0xffffffff
je 0x40dbcf
mov ebx, 1
jmp 0x40dbd4
mov ebx, 0
mov eax, ebx
pop edi
pop ebx
leave
ret

Function at 0x40e0b3
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 5
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40e0be
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40e112
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40e112
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0xffffffff
je 0x40e1f5
cmp dword [ebp - 4], 0
je 0x40e1f5
push dword [ebp - 4]
push dword [0x421238]
push str.send__s_with__ld_bytes_r_n
push dword [0x421228]
call fcn.0040f8ba
add esp, 0x10
cmp dword [0x4264ac], 0
jl 0x40e197
push 0
mov edi, dword [0x4264ac]
shl edi, 7
lea edi, [edi + 0x42a128]
push edi
call sub.USER32.DLL_FindWindowA
mov dword [0x421f18], eax
cmp eax, 0
je 0x40e1f5
push dword [ebp + 8]
push dword [0x421f18]
call fcn.004117de
add esp, 8
mov edi, dword [0x42122c]
mov dword [0x421230], edi
mov dword [ebp - 8], 1
jmp 0x40e1f5
push dword [ebp - 4]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp eax, 0
jne 0x40e1b3
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
jmp 0x40e1f5
push 0
lea edi, [ebp - 0x14]
push edi
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
je 0x40e1e5
mov edi, dword [ebp - 4]
cmp dword [ebp - 0x14], edi
jne 0x40e1e5
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.0040dec3
add esp, 8
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalFree
cmp dword [ebp - 8], 0
jne 0x40e205
mov dword [0x421230], 0xffffffff
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x40f48e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40f499
push edi
push 0x43f691
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x40f535
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
push dword [ebp - 0xc]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x40f51e
push dword [ebp - 4]
push dword [ebp - 0xc]
push 1
push dword [ebp - 8]
call sub.CRTDLL.DLL_fread
add esp, 0x10
push dword [ebp - 8]
call fcn.0040f292
add esp, 4
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalFree
jmp 0x40f528
mov dword [0x421230], 0xffffffff
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
jmp 0x40f53f
mov dword [0x421230], 0xffffffff
pop edi
leave
ret
Function at 0x411464
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x41146e
push edi
mov dword [ebp - 4], 3
jmp 0x411489
push 0x32
call sub.KERNEL32.dll_Sleep
push 0
call sub.USER32.DLL_OpenClipboard
mov dword [ebp - 8], eax
cmp eax, 0
jne 0x4114a6
mov edi, dword [ebp - 4]
sub edi, 1
mov dword [ebp - 4], edi
cmp edi, 0
jg 0x411482
mov eax, dword [ebp - 8]
pop edi
leave
ret

Function at 0x4114ac
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4114b7
push edi
mov dword [ebp - 4], 0
call fcn.00411464
cmp eax, 0
je 0x411532
push dword [ebp + 8]
call fcn.0041b0a8
add esp, 4
mov edi, eax
add edi, 1
push edi
push 0x2000
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x41152d
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0041b031
add esp, 8
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.DLL_EmptyClipboard
push dword [ebp - 8]
push 1
call sub.USER32.DLL_SetClipboardData
mov dword [ebp - 4], 1
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x411538
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x411543
push edi
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_RtlZeroMemory
call fcn.00411464
cmp eax, 0
je 0x4115aa
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4115a5
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
mov dword [ebp - 4], 1
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
leave
ret