joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40701a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404d6c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403688
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x407004
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407021
lea eax, [ebp - 0x10]
call fcn.00404afc
ret

Function at 0x40e940
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e979
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404bec
jmp 0x40e982
mov eax, ebx
mov edx, esi
call fcn.00404b50
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e98c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e9ad
mov al, byte [esp]
jmp 0x40e9af
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40f9dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40fab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404b94
lea eax, [ebp - 8]
call fcn.0040500c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404fbc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40fa9c
mov eax, ebx
call fcn.00402e3c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40fa95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404fbc
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40fa7f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40fac4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40fa7f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fa9c
mov eax, dword [ebp - 0x10]
call fcn.00402e6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fab9
lea eax, [ebp - 8]
call fcn.00404afc
ret
Function at 0x410064
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4100c8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404d6c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040b298
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4100cf
lea eax, [ebp - 0xc]
call fcn.00404afc
ret

Function at 0x4109f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov eax, dword [0x535d6c]
cmp dword [eax], 0
je 0x410a26
push 0xa
push 0x410a7c
mov eax, dword [0x535d6c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x535d6c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
jmp 0x410a72
xor eax, eax
mov dword [esp], eax
mov eax, dword [0x5363d8]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x410a72
mov ebx, dword [esp + 4]
push 0xa
push 0x410a7c
mov esi, dword [ebx + 4]
push esi
call sub.kernel32.dll_FindResourceA
push eax
push esi
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
cmp dword [esp], 0
jne 0x410a72
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x410a3d
mov eax, dword [esp]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x41af04
Capabilities:
Read file via mapping

Disassembly:
mov edi, 0x31005369
adc eax, 0x536b6c
invalid
invalid

Function at 0x41b034
Capabilities:
Read file via mapping

Disassembly:
or ecx, dword [0x536e6b]
call fcn.004283c5
add edi, dword [0x536e0e]
xchg edi, esi
add ebx, 0x81a7655e
xchg ebx, esi
call fcn.0042a8cc
rol ecx, 0x1e
sub dword [0x5369a9], eax
xor edi, 0x841ff06b
xor edi, 0x13f01488
xor eax, ebp
call fcn.004e606f
xor ebx, 0x33b0d292
not esi
add dword [0x536b5f], edx
neg edx
call fcn.0042d144
add dword [0x536932], ebx
neg ecx
sub dword [0x536922], edx
inc edx
and dword [0x536a2f], ebx
push ebx
add bh, dh
fmul dword [ebx]
adc eax, 0x536cd2
or dword [0x536bd8], esi
call fcn.0044f39f
call fcn.0041bcd3
neg eax
dec edx
add dword [0x536b3e], edx
neg ecx
add dword [0x536b9e], ebx
neg edx
and dword [0x536882], edi
not esi
xor ebx, 0x33b0d292
xor eax, ebp
xor edi, 0x13f01488
push edi
add ebx, dword [0x536c6f]
add ecx, 0xcbbf159c
xor ebx, esp
xor dword [0x536a32], edx
ror ebx, 0x1e
add ebx, 0x704f847b
inc esi
sub esi, dword [0x536eb8]
neg esi
mov dword [0x536b8d], ecx
neg ecx
xchg ebx, eax
ror ebx, 0x12
call fcn.0041ddee
call fcn.0042ef62
rol ebx, 0x12
xchg ebx, eax
neg ecx
neg esi
dec esi
sub ebx, 0x704f847b
rol ebx, 0x1e
xor ebx, esp
sub ecx, 0xcbbf159c
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
or esi, dword [0x536e13]
Function at 0x41b098
Capabilities:
Read file via mapping

Disassembly:
or ecx, dword [0x536e6b]
call fcn.004283c5
add edi, dword [0x536e0e]
xchg edi, esi
add ebx, 0x81a7655e
xchg ebx, esi
call fcn.0042a8cc
rol ecx, 0x1e
sub dword [0x5369a9], eax
xor edi, 0x841ff06b
xor edi, 0x13f01488
xor eax, ebp
call fcn.004e606f
xor ebx, 0x33b0d292
not esi
add dword [0x536b5f], edx
neg edx
call fcn.0042d144
add dword [0x536932], ebx
neg ecx
sub dword [0x536922], edx
inc edx
and dword [0x536a2f], ebx
push ebx
add bh, dh
fmul dword [ebx]
adc eax, 0x536cd2
or dword [0x536bd8], esi
call fcn.0044f39f
call fcn.0041bcd3
neg eax
dec edx
add dword [0x536b3e], edx
neg ecx
add dword [0x536b9e], ebx
neg edx
and dword [0x536882], edi
not esi
xor ebx, 0x33b0d292
xor eax, ebp
xor edi, 0x13f01488
push edi
add ebx, dword [0x536c6f]
add ecx, 0xcbbf159c
xor ebx, esp
xor dword [0x536a32], edx
ror ebx, 0x1e
add ebx, 0x704f847b
inc esi
sub esi, dword [0x536eb8]
neg esi
mov dword [0x536b8d], ecx
neg ecx
xchg ebx, eax
ror ebx, 0x12
call fcn.0041ddee
call fcn.0042ef62
rol ebx, 0x12
xchg ebx, eax
neg ecx
neg esi
dec esi
sub ebx, 0x704f847b
rol ebx, 0x1e
xor ebx, esp
sub ecx, 0xcbbf159c
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
or esi, dword [0x536e13]

Function at 0x41b140
Capabilities:
Read file via mapping

Disassembly:
dec edx
add dword [0x536932], edx
xor dword [0x53691b], esi
or dword [0x5369ec], 0xabf274b4
inc ecx
sub edx, esi
not edi
or ecx, dword [0x536d7c]
xor esi, dword [0x536d08]
add edi, 0xeeea25c6
xor eax, esi
neg ebx
call fcn.00407071
call fcn.004cc868
neg ebx
xor eax, esi
sub edi, 0xeeea25c6
not edi
add edx, esi
dec ecx
invalid
sub eax, 0x536a35
retf 0x5917
Function at 0x429160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x539aac
cmp dword [edi], 0
jne 0x4291dc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x539aa8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x52ece4
mov ecx, 2
call fcn.004030c4
mov edx, 0x429138
lea eax, [esi + 5]
call fcn.00429158
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00429158
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4291b1
mov dword [0x539aa8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4294b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
jne 0x4294c8
xor eax, eax
mov dword [esi], eax
jmp 0x42951b
cmp dword [esi + 4], 0
jne 0x429518
mov eax, ebx
call fcn.00429450
mov ebx, eax
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x429518
mov dword [esi], ebx
mov eax, dword [ebx]
mov dword [esi + 8], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
mov byte [ebx], 0xe9
sub edi, ebx
sub edi, 5
mov dword [ebx + 1], edi
push esp
mov eax, dword [esp + 4]
push eax
push 6
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_VirtualProtectEx
inc dword [esi + 4]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42efc4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42efca
ret

Function at 0x43179c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4317ed
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4317d4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4317c4
jmp 0x4317ed
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4317d5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b038
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404fac
xor eax, eax
push ebp
push 0x43b166
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x43b139
xor eax, eax
push ebp
push 0x43b132
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404dbc
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43b107
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x43b0f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404dbc
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404fbc
mov edx, ebx
pop ecx
call fcn.004030c4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b0fd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x535aa8]
mov dl, 1
mov eax, dword [0x409ee8]
call fcn.0040f1f8
call fcn.004044d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b16d
lea eax, [ebp - 4]
call fcn.00404afc
ret
Function at 0x43b174
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43b325
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004051ac
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43b33c
call fcn.00404e08
mov eax, ebx
call fcn.004286e0
mov edi, eax
dec edi
test edi, edi
jl 0x43b22c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004286b4
mov edx, dword [0x44bd0c]
call fcn.00403e78
test al, al
je 0x43b228
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004286b4
lea edx, [ebp - 0x14]
call fcn.00457cb4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004051ac
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e7c
inc esi
dec edi
jne 0x43b1da
mov al, byte [0x43b340]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43b34c
mov eax, dword [ebp - 0xc]
call fcn.00410640
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404b94
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00457cb4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43b33c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00457cb4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43b33c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43b33c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43b358
call fcn.0040c1f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b32c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404b20
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404b20
lea eax, [ebp - 0x14]
call fcn.00404afc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404b20
ret
Function at 0x43fa84
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43faf6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x43faca
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404cf4
jmp 0x43fad1
mov eax, ebx
call fcn.00404afc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fafd
cmp dword [ebp - 8], 0
je 0x43faed
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x43fb04
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x43fba6
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x43fb79
mov edx, ebx
mov eax, dword [0x42e9e8]
call fcn.00433054
test al, al
je 0x43fb69
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00432f64
call fcn.00404580
jmp 0x43fbad
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x43fb34
mov ecx, dword [0x535c14]
mov dl, 1
mov eax, dword [0x409ee8]
call fcn.0040f1f8
call fcn.004044d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fbad
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x43fbb4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x43fc0c
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fc13
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x43fc1c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x43fc71
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fc78
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x43fce8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x43fd5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0043f9c0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00433028
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x43fd47
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fd64
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x43fd6c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x43fde1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0043f9c0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x43fdcb
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fde8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x442cbc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0044285c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404fbc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x442d1a
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x536024]
mov dl, 1
mov eax, dword [0x442754]
call fcn.0040f234
call fcn.004044d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x442d24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404fbc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x442d7c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5365e8]
mov dl, 1
mov eax, dword [0x442754]
call fcn.0040f234
call fcn.004044d4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044288c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x451138
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 4]
xor eax, eax
push ebp
push 0x4512f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
call fcn.0045d658
mov eax, dword [ebx]
cmp byte [eax + 0x210], 0
je 0x4512dd
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebx]
sub eax, dword [edx + 0x220]
cmp eax, 0x1f4
jb 0x45119b
mov eax, dword [ebx]
add eax, 0x21c
call fcn.00404afc
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebx]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 8
je 0x45126c
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [0x5365a8]
and eax, 0xff
bt dword [edx], eax
jae 0x45122e
push 1
push 0x102
push 0x102
mov eax, dword [ebx]
call fcn.0045e6ac
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4512ac
mov eax, dword [ebx]
push dword [eax + 0x21c]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00404ce4
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.00404ce4
push dword [ebp - 0x2c]
mov eax, dword [ebx]
add eax, 0x21c
mov edx, 3
call fcn.00404e7c
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x4512ac
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00404ce4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx]
add eax, 0x21c
call fcn.00404dc4
jmp 0x4512ac
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404dbc
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.0040505c
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404dbc
mov edx, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.0040fb48
cmp al, 2
je 0x45124c
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404dbc
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.0040505c
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.00404dbc
test eax, eax
jle 0x4512c6
push ebp
call fcn.00451054
pop ecx
jmp 0x4512dd
xor edx, edx
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov eax, dword [ebx]
mov si, 0xffeb
call fcn.00403ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4512ff
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404b20
ret

Function at 0x452024
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x451f70
call sub.user32.dll_EnumWindows
ret