joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4241c8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebx
push esi
test dl, dl
je 0x424182
add esp, 0xfffffff0
call fcn.004042c8
mov ebx, edx
mov esi, eax
xor eax, eax
mov dword [0x5185f8], eax
mov edx, 0x5185f8
mov eax, dword [0x51ba7c]
call fcn.004236f8
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], 0x80000008
mov eax, dword [0x51ba38]
mov dword [esi + 0x1c], eax
mov eax, esi
test bl, bl
je 0x4241c3
call fcn.00404320
pop dword fs:[0]
inc edx
shr ebx, 0x1f
pop ds
neg esi
test ebx, esi
ja 0x4241cc
neg ecx
test dword [0x51a23d], esp
jno 0x4241d6
and esi, ebx
sub dword [0x51a733], 0xb3f014eb
and edi, 0xc4fe4ce4
shr eax, 0xf
ror eax, 9
call fcn.0047a7bb
sub ecx, dword [0x518688]
or edx, 0xb9b6b893
sub ecx, ebp
dec ebx
rol ecx, 8
ror ebx, 0xd
xor ecx, edi
mov ecx, 0x5f80a022
and dword [0x51a8a1], esi
inc eax
call fcn.00451cba
xchg ebx, edx
inc esi
sub eax, edx
add ebx, 0x643299ee
dec eax
add ebx, 0x8c00b70c
mov eax, edx
dec ecx
jne 0x42420d
cmp esp, ecx
jg 0x42423b
xor ebx, 0x633f13b
xor eax, 0x924d4302
mov edi, dword [0x518a04]
mov dword [0x51a6c7], edi
mov eax, dword [0x51a31c]
add edx, 0xc59e078f
shl ecx, 5
or esi, ebx
cmp dword [0x51a223], 0xe4ffd7f5
jle 0x42426f
mov eax, 0xd209efde
test dword [0x518603], edi
jl 0x424279
cmp esp, eax
je 0x42427e
shl ebx, 7
xor edx, edx
test dword [0x5185ee], edi
js 0x42428a
neg edi
add esi, 0xe8f38a97
mov ecx, 0x43103be3
shl edi, 0x18
mov edx, eax
xor eax, 0x8eea4a71
ror ebx, 0x13
mov edx, 0xaea1fb75
rol edx, 0x10
test eax, ecx
jns 0x4242b1
and eax, eax
add ebx, dword [0x518e47]
mov edi, 0xfa927bb4
xchg esi, eax
cmp eax, ebx
jp 0x4242c5
shr ebx, 0x17
call fcn.004e2ac0
add ebx, 0x9b805d29
mov edi, 0x1aa68a3c
dec eax
shr edi, 0x11
dec ecx
jne 0x424295
shl eax, 0x10
mov ecx, 0x589cd7af
sub edi, edi
sub ebx, dword [0x5187a5]
call fcn.00492f5c
cmp ebp, 0xae8d3792
jg 0x424300
and edi, 0x2aa50640
ror ebx, 0x18
sub esi, eax
call fcn.0047eb0a
add ebx, dword [0x519a4f]
inc ebx
xor eax, dword [0x519a84]
shr eax, 0x1c
not esi
test edx, 0x50e578e9
jne 0x424326
not esi
xchg esi, edx
rol edx, 0x1e
dec ecx
jne 0x4242e5
inc edi
or eax, ecx
xor ebx, ecx
shl ebx, 3
neg ebx
ror ebx, 2
cmp dword [0x519827], 0xe63becba
jne 0x42434e

Function at 0x424348
Capabilities:
Hash data using murmur3

Disassembly:
add edx, 0x454f1dc3
call fcn.0046cc90
dec eax
add edx, edx
xor esi, 0x9dccd510
Function at 0x42435c
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, 0xe0de515c
call fcn.004b89bc
sub edx, esi
add ecx, eax
rol ecx, 0x1a
xor eax, 0x2dd1377e
ror eax, 0x11
add eax, dword [0x51ab54]
rol esi, 0x18
sub ecx, edi
inc ebx
ror ecx, 0xd
sub ecx, dword [0x51aeb7]
call fcn.004f41e7
dec edx
xor edi, 0x4bdf5ca
rol edx, 9
neg esi
sub edi, ebx
add dword [0x51a896], edx
xor dword [0x51aa52], esi
mov dword [0x51a9d0], ecx
add edi, ebx
neg esi
ror edx, 9
xor edi, 0x4bdf5ca
inc edx
call fcn.00429490
rol ecx, 0xd
dec ebx
add ecx, edi
ror esi, 0x18
rol eax, 0x11
xor eax, 0x2dd1377e
ror ecx, 0x1a
sub ecx, eax
add edx, esi
sub eax, 0x6964610f
xchg edi, eax
call fcn.00490670
add dword [0x51a889], esi
dec eax
neg edx
inc ebx
sub edi, dword [0x51ac39]
or ebx, dword [0x51ac3e]
not esi
and dword [0x51a77a], eax
inc ebx
xchg edi, esi
call fcn.004f511d
call fcn.004a8724
call fcn.004f3b04
call fcn.0049cb8e
xchg edi, esi
dec ebx
and dword [0x51a774], ebx
not esi
dec ebx
neg edx
inc eax
sub dword [0x51a79c], ecx
xchg edi, eax
xor eax, 0x7779f04d
ror edi, 0x14
xor edx, dword [0x51ac67]
add dword [0x51a8ac], eax
not esi
dec esi
xchg ebx, esi
or ecx, dword [0x51acc7]
call fcn.00468e0a
xor esi, dword [0x51aeb8]
call fcn.0045d85d
dec ecx
not ebx
xchg edi, edx
sub dword [0x51a99d], edx
sub dword [0x51a95d], ebx
sub dword [0x51a96d], esi
sub ecx, dword [0x51aca0]
xor esi, ecx
call fcn.00445062
call fcn.0048fcec
call fcn.004fa248
xor esi, ecx
mov dword [0x51a628], edi
mov dword [0x51a8dc], ecx
xchg edi, edx
not ebx
inc ecx
call fcn.0049d9c8
xchg ebx, esi
inc esi
not esi
and dword [0x51a81c], ecx
rol edi, 0x14
push eax
add esi, 0x41475077
call fcn.0043fcf7
xor dword [0x51aa72], ecx
xor edx, 0x883b21e2
sub esi, edi
sub eax, dword [0x51abb0]
add eax, dword [0x51ada5]
call fcn.00403754
xchg eax, edx
or edi, dword [0x51ae70]
call fcn.00489306
inc ecx
and dword [0x51a7e1], edx
add ebx, dword [0x51aef3]
not ebx
add ebx, 0x2c63cb3b
arpl word [eax + ebp*8], bp
xor byte [ecx + 8], bl
add byte [ecx + 0x63cb3beb], al
sub al, 0xf7
shl dword [ecx], cl
adc eax, 0x51a927
dec ecx
call fcn.00408438
xchg eax, edx
call fcn.004476ce
add esi, edi
Function at 0x424504
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, 0xe0de515c
call fcn.004b89bc
sub edx, esi
add ecx, eax
rol ecx, 0x1a
xor eax, 0x2dd1377e
ror eax, 0x11
add eax, dword [0x51ab54]
rol esi, 0x18
sub ecx, edi
inc ebx
ror ecx, 0xd
sub ecx, dword [0x51aeb7]
call fcn.004f41e7
dec edx
xor edi, 0x4bdf5ca
rol edx, 9
neg esi
sub edi, ebx
add dword [0x51a896], edx
xor dword [0x51aa52], esi
mov dword [0x51a9d0], ecx
add edi, ebx
neg esi
ror edx, 9
xor edi, 0x4bdf5ca
inc edx
call fcn.00429490
rol ecx, 0xd
dec ebx
add ecx, edi
ror esi, 0x18
rol eax, 0x11
xor eax, 0x2dd1377e
ror ecx, 0x1a
sub ecx, eax
add edx, esi
sub eax, 0x6964610f
xchg edi, eax
call fcn.00490670
add dword [0x51a889], esi
dec eax
neg edx
inc ebx
sub edi, dword [0x51ac39]
or ebx, dword [0x51ac3e]
not esi
and dword [0x51a77a], eax
inc ebx
xchg edi, esi
call fcn.004f511d
call fcn.004a8724
call fcn.004f3b04
call fcn.0049cb8e
xchg edi, esi
dec ebx
and dword [0x51a774], ebx
not esi
dec ebx
neg edx
inc eax
sub dword [0x51a79c], ecx
xchg edi, eax
xor eax, 0x7779f04d
ror edi, 0x14
xor edx, dword [0x51ac67]
add dword [0x51a8ac], eax
not esi
dec esi
xchg ebx, esi
or ecx, dword [0x51acc7]
call fcn.00468e0a
xor esi, dword [0x51aeb8]
call fcn.0045d85d
dec ecx
not ebx
xchg edi, edx
sub dword [0x51a99d], edx
sub dword [0x51a95d], ebx
sub dword [0x51a96d], esi
sub ecx, dword [0x51aca0]
xor esi, ecx
call fcn.00445062
call fcn.0048fcec
call fcn.004fa248
xor esi, ecx
mov dword [0x51a628], edi
mov dword [0x51a8dc], ecx
xchg edi, edx
not ebx
inc ecx
call fcn.0049d9c8
xchg ebx, esi
inc esi
not esi
and dword [0x51a81c], ecx
rol edi, 0x14
push eax
add esi, 0x41475077
call fcn.0043fcf7
xor dword [0x51aa72], ecx
xor edx, 0x883b21e2
sub esi, edi
sub eax, dword [0x51abb0]
add eax, dword [0x51ada5]
call fcn.00403754
xchg eax, edx
or edi, dword [0x51ae70]
call fcn.00489306
inc ecx
and dword [0x51a7e1], edx
add ebx, dword [0x51aef3]
not ebx
add ebx, 0x2c63cb3b
arpl word [eax + ebp*8], bp
xor byte [ecx + 8], bl
add byte [ecx + 0x63cb3beb], al
sub al, 0xf7
shl dword [ecx], cl
adc eax, 0x51a927
dec ecx
call fcn.00408438
xchg eax, edx
call fcn.004476ce
add esi, edi

Function at 0x424528
Capabilities:
Hash data using murmur3

Disassembly:
xor edx, 0x883b21e2
call fcn.004b62e5
sbb eax, 0xee810009
ja 0x424587
inc edi
inc ecx
mov eax, 0x13d294a7
add eax, edx
xor ecx, dword [0x51ab14]
xor edx, 0x7b025b03
sub eax, esp
inc eax
not esi
call fcn.00473520
neg ecx

Function at 0x424530
Capabilities:
Hash data using murmur3

Disassembly:
sbb eax, 0xee810009
ja 0x424587
inc edi
inc ecx
adc eax, 0xd2b204e
pop edx
scasd eax, dword es:[edi]
push ecx
add cl, al
ret

Function at 0x424558
Capabilities:
Hash data using murmur3

Disassembly:
xor edi, ecx
sub dword [0x51a820], 0xfdf6d6e9
sub dword [0x51a896], 0x5a8e4564
xor edi, ecx
Function at 0x424570
Capabilities:
Hash data using murmur3

Disassembly:
neg ecx
call fcn.0042d039
not esi
dec eax
add eax, esp
xor edx, 0x7b025b03
sub eax, edx
and eax, 0x204e15aa
sub ecx, dword [0x51af5a]
rol ebx, 0x18
xor eax, ebx
xchg edi, esi
mov dword [0x51a9af], ebx
neg ebx
call fcn.004f0613
sub eax, dword [0x51ae83]
rol esi, 2
xor eax, 0xb14baa80
add esi, dword [0x51adf3]
dec ebx
xor ecx, dword [0x51af72]
sub edx, 0x2e7b02e2
or dword [0x51a974], ecx

Function at 0x4245cc
Capabilities:
Hash data using murmur3

Disassembly:
sub ebx, 0xfb677361
xchg esi, eax
ror ebx, 0xd
call fcn.00419e16
call fcn.004c8a20
rol ebx, 0xd
xchg esi, eax
add ebx, 0xfb677361
popal
jae 0x424652
sti
add dword [0x51a85c], edi
add edx, 0x2e7b02e2
inc ebx
xor eax, 0xb14baa80
ror esi, 2
neg ebx
invalid
invalid
invalid
invalid

Function at 0x424614
Capabilities:
Hash data using murmur3

Disassembly:
js 0x424687
xor al, cl
rcl byte [ebx], 3
fild word [ecx]
adc eax, 0x51a700
std

Function at 0x424834
Capabilities:
Hash data using murmur3

Disassembly:
ljmp 0xd687:0xac8d6ae5
je 0x424818
or byte [eax], al

Function at 0x4248f4
Capabilities:
Hash data using murmur3

Disassembly:
dec edi
xor ebx, dword [0x51aeab]
sub esi, dword [0x51aaf1]
inc edi
xor ebx, ecx
rol ebx, 9
inc ebx
call fcn.0040a083
rol ecx, 0xa
add dword [0x51a75a], edx
push ecx
add byte [ecx - 0x36a1e709], al
add al, byte [ecx + 0x51aa0735]
add al, dl
sub eax, 0xd333379b

Function at 0x424914
Capabilities:
Hash data using murmur3

Disassembly:
push ecx
add byte [ecx - 0x36a1e709], al
add al, byte [ecx + 0x51aa0735]
add al, dl
sub eax, 0xd333379b

Function at 0x424930
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [0x51aa5f], edi
ror esi, 0xd
add edx, dword [0x51acc7]
add dword [0x51a715], ecx
not ebx
add esi, dword [0x51ad0f]
xchg ecx, esi
add dword [0x51a7e0], eax
add ecx, eax
and dword [0x51a8c0], edi
cmp eax, 0x51a8c0
xor dword [0x51aaa1], edx
sub ecx, eax
add dword [0x51a7d5], edi
xchg ecx, esi
not ebx
or dword [0x51aad0], esi
rol esi, 0xd
and esi, 0x91081a90
xchg ecx, edx
add dword [0x51a72b], ebx
mov dword [0x51a6ca], edi
Function at 0x42498c
Capabilities:
Hash data using murmur3

Disassembly:
add edi, dword [0x51ad2a]
or edx, dword [0x51ace0]
xor esi, eax
xchg esi, eax
sub dword [0x51aa5d], eax
neg esi
add dword [0x51a77d], ebx
mov dword [0x51a61f], ecx
xchg esi, eax
not esi
add edi, 0x7a71013d
or esi, dword [0x51af55]
not edi
mov dword [0x51a982], ebx
and dword [0x51a825], 0x1979838e
sub esi, 0x5efcceaf
dec esi
sub eax, dword [0x51ad8c]
sub eax, 0x92ecc53e
add eax, 0x92ecc53e
inc esi
add esi, 0x5efcceaf
sub dword [0x51a72b], 0xb1326fb5
not edi
sub edi, 0x7a71013d
not esi
xchg esi, eax
add dword [0x51aa59], edi
neg esi
or dword [0x51aa03], edx
xchg esi, eax
xor esi, eax
and dword [0x51a81f], ecx
xchg ecx, edx
add esi, 0xeefff770
call fcn.004e85ac
mov dword [0x51a703], edi
not edx
inc edx
call fcn.004a3b08
sub ebx, dword [0x51ada2]
xor eax, edi
dec ebx
and dword [0x51a72a], edi
sub esi, dword [0x51abd7]
call fcn.00457928
sub ecx, 0xf6888ad
call fcn.0041e07e
inc esi
ror eax, 0x17
inc esi
or dword [0x51a911], 0x9e44d2a9
sub esi, edi
not esi
call fcn.004f3925
call fcn.004db075
not esi
add esi, edi
dec esi
rol eax, 0x17
dec esi
add ecx, 0xf6888ad
call fcn.00454bfc
or dword [0x51a945], ebx
inc ebx
xor eax, edi
call fcn.00462f1d
dec edx
not edx
call fcn.004f4cd9
push esi
sub ebx, edx
call fcn.0046da40
xor esi, dword [0x51ab24]
rol eax, 0x1d
xor ecx, 0xe914822d
dec esi
add eax, 0x2e1587ca
ror esi, 5
xchg ebx, edx
mov dword [0x51a83f], eax
call fcn.0046db61
add dword [0x51a69a], eax
xor edx, dword [0x51ae8b]
xchg ebx, esi
xchg edx, esi
xchg edx, esi
xchg ebx, esi
add dword [0x51a64c], edi
call fcn.00406461
and dword [0x51a65e], edx
xchg ebx, edx
rol esi, 5
sub eax, 0x2e1587ca
inc esi
xor ecx, 0xe914822d
sub eax, 0xc1e91482
enter 0xffffffffffffe81d, 0xffffffffffffffc9
cmc
add dword [eax], eax
add ebx, edx
mov edx, 0x8b41171a
inc esi
sub ecx, 0xbac94c09
xor esi, edx
xor ebx, dword [0x51aaf1]
ror edx, 0x16
push ss
and dword [0x51a992], edi
xor eax, dword [0x51ae92]
add eax, 0x51ae92
inc edi
ror edx, 0xe
xchg ecx, edx
xchg ecx, edx
rol edx, 0xe
dec edi
and dword [0x51a6b4], eax
rol edx, 0x16
xor esi, edx
add ecx, 0xbac94c09
dec esi
or edx, 0x4a8231b1
xor edi, dword [0x51ad80]
xor ecx, 0xf8bb21c9
clc
xchg ecx, eax
add ebx, dword [0x51ab0f]
or edx, dword [0x51ae04]
xor dword [0x51a78b], ecx
call fcn.0045c79d
dec edx
not esi
sub eax, esp
call fcn.00425b95
neg edi
sub edi, 0x63d53828
xchg edx, eax
dec esi
not ebx
xor eax, dword [0x51ae9d]
neg eax
and dword [0x51a8cb], eax
xor ecx, 0x72b15bbf
call fcn.004b09ba
xor ecx, 0x72b15bbf
neg eax
not ebx
inc esi
xchg edx, eax
add edi, 0x63d53828
neg edi
call fcn.004d61bc
add eax, esp
not esi
inc edx
xchg ecx, eax
xor ecx, 0xf8bb21c9
sub edx, 0x6853cb4f
xor edx, dword [0x51af70]
rol eax, 0x17
dec edi
not esi
xor edx, ecx
add eax, dword [0x51ad9b]
xor ecx, dword [0x51ada6]
mov dword [0x51a615], ecx
sub dword [0x51a976], esi
xor ebx, dword [0x51af52]
call fcn.0048fbfb
or ebx, dword [0x51abbf]
call fcn.00443068
add dword [0x51aa2f], edx
not esi
inc esi
xor eax, edi
mov dword [0x51aa5d], edi
xor edi, dword [0x51ad18]
call fcn.004c9c24
sub dword [0x51a7fe], edx
xor eax, edi
dec esi
not esi
mov dword [0x51a6ee], esi
Function at 0x424d48
Capabilities:
Hash data using murmur3

Disassembly:
add ebx, 0x106c8625
neg esi
or ecx, 0x34eeb61e
rol ebx, 6
not eax
sub dword [0x51a6ff], eax
call fcn.004f1759
inc ecx
or edi, dword [0x51aefe]
add dword [0x51aa94], 0x7902e394
ror ecx, 0x1d
dec eax
add edi, dword [0x51ab66]
neg edi
xor ebx, 0xf888ffa0
sub dword [0x51a8d9], ecx
not esi
add dword [0x51a968], ecx
dec eax
xor dword [0x51aa7f], ebx
call fcn.0043abb9
inc eax

Function at 0x426070
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4260c1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4260a8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426098
jmp 0x4260c1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4260a9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442eb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x443069
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004053f4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x443080
call fcn.00405058
mov eax, ebx
call fcn.00421514
mov edi, eax
dec edi
test edi, edi
jl 0x442f70
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004214e8
mov edx, dword [0x433b6c]
call fcn.004040f0
test al, al
je 0x442f6c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004214e8
lea edx, [ebp - 0x14]
call fcn.0044b6e0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004053f4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004050cc
inc esi
dec edi
jne 0x442f1e
mov al, byte [0x443084]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x443090
mov eax, dword [ebp - 0xc]
call fcn.0040e9d0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404dec
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044b6e0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x443080
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.0044b6e0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x443080
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x443080
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x44309c
call fcn.0040a8a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443070
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404d78
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404d78
lea eax, [ebp - 0x14]
call fcn.00404d54
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404d78
Function at 0x443eb0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x443f82
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x443f54
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x443f43
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004029b0
mov eax, dword [ebp - 4]
call fcn.00443dec
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443f4a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x443f94
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x444006
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x443fda
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404f44
jmp 0x443fe1
mov eax, ebx
call fcn.00404d54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44400d
cmp dword [ebp - 8], 0
je 0x443ffd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x44403c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4440de
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4440b1
mov edx, ebx
mov eax, dword [0x423090]
call fcn.00427cbc
test al, al
je 0x4440a1
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00427bcc
call fcn.004047dc
jmp 0x4440e5
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x44406c
mov ecx, dword [0x519f9c]
mov dl, 1
mov eax, dword [0x40879c]
call fcn.0040d6f4
call fcn.00404730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4440e5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44c960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x44c9ac
mov eax, esi
call fcn.004633d4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44c9ac
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x44c9ac
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x44caf0
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x44c9ec
cmp eax, 0x108
ja 0x44c9ec
mov eax, esi
call fcn.004633d4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44cae7
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x44caf0
jmp 0x44cae7
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x44cace
cmp eax, 0x20a
ja 0x44cace
test byte [esi + 0x50], 0x80
jne 0x44ca1e
sub eax, 0x203
je 0x44ca1b
sub eax, 3
je 0x44ca1b
sub eax, 3
jne 0x44ca1e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x44ca32
dec eax
je 0x44ca47
dec eax
je 0x44ca67
dec eax
je 0x44ca47
jmp 0x44ca6e
mov ecx, ebx
mov eax, dword [0x51a1fc]
mov eax, dword [eax]
mov edx, esi
call fcn.0046ccbc
jmp 0x44cae7
cmp byte [esi + 0x5d], 1
jne 0x44ca5d
mov eax, esi
mov si, 0xffed
call fcn.00404160
jmp 0x44caf0
or word [esi + 0x54], 1
jmp 0x44cae7
and word [esi + 0x54], 0xfffe
jmp 0x44cae7
mov eax, dword [0x51bba4]
cmp byte [eax + 0x20], 0
je 0x44cae7
mov eax, dword [0x51bba4]
cmp dword [eax + 0x1c], 0
je 0x44cae7
mov eax, dword [ebx]
mov edx, dword [0x51bba4]
cmp eax, dword [edx + 0x1c]
jne 0x44cae7
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00463318
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00404160
jmp 0x44caf0
mov eax, dword [ebx]
cmp eax, 0xb00b
jne 0x44cae7
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0044b280
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
Function at 0x46abf8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46ac0f
add esp, 0xfffffff0
call fcn.004042c8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
ret
call fcn.00420ef0
mov eax, dword [0x51a140]
cmp word [eax + 2], 0
jne 0x46ac37
mov eax, dword [0x51a140]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046c2d4
mov eax, dword [0x51a21c]
cmp word [eax + 2], 0
jne 0x46ac51
mov eax, dword [0x51a21c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046c4cc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415bdc]
call fcn.00403f34
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415bdc]
call fcn.00403f34
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423520]
call fcn.0042bd88
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46add8
mov eax, dword [0x51a034]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042c158
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46ca4c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x51a034]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e390
test eax, eax
je 0x46ad46
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a140
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e3b8
test eax, eax
je 0x46ad5a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404fbc
mov eax, dword [0x519e94]
cmp byte [eax], 0
jne 0x46ad8e
mov eax, ebx
call fcn.0046af00
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0046cc28
mov eax, ebx
call fcn.0046d568
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46adce
call fcn.00404320
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret