joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10116e9e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x10126354], 0x37a
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10116365
lea ecx, [0x101171d6]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x84], 0x127200
mov edx, dword [0x10126340]
mov dword [esp + 0x74], edx
mov edx, dword [0x10126344]
mov dword [esp + 0x58], edx
mov edx, dword [0x10126348]
mov dword [esp + 0x70], edx
mov edx, dword [0x1012634c]
mov dword [esp + 0x68], edx
mov edx, dword [0x10126350]
mov dword [esp + 0x7c], edx
mov dword [0x10126354], 0x1fc2
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10116f63
lea eax, [esp + 0x38]
mov dword [0x10126354], 0x9c2
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1011661a
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x10116f86
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x10116f9a
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10116f63
mov eax, dword [esp + 0x14]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov dword [0x10126358], 0x8ac
call fcn.1011705c
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
je 0x10116f27
jmp 0x10116f5b
Function at 0x1011705c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x2c
mov dword [ebp - 8], 0
mov eax, dword [0x10126354]
add eax, 0xffffd981
mov dword [0x10126354], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10126354], 0x20ef
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x101170eb
mov eax, dword [ebp - 0x18]
add esp, 0x2c
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, 0x215
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
je 0x10117103
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [0x10126354], eax
mov dword [ebp - 0x18], ecx
jmp 0x101170a2
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
jge 0x101170ab
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], edx
je 0x101170ab
jmp 0x101170d4
mov eax, 0x215
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x24], eax
jne 0x101170c5
mov eax, 0x215
mov dword [0x10126358], 0x7f0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x24], eax
jne 0x101170c5
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff6
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, 0x215
mov ecx, dword [ebp - 0x2c]
cmp word [ecx], 0x64
mov dword [ebp - 0x24], eax
jne 0x101170c5
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff7
mov dword [ebp - 0x30], eax
mov eax, 0x215
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x30]
cmp word [ecx + edx*2], 0x64
mov dword [ebp - 0x24], eax
jne 0x101170c5
mov eax, 0x215
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x24], eax
jne 0x101170c5
mov dword [0x10126354], 0x47ad
mov eax, 1
mov ecx, 0x28d3
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], ecx
je 0x101170a2
jmp 0x101170c5
Function at 0x405440
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6552e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0
mov eax, 8
shl eax, 5
mov ecx, dword [eax + 0x65e180]
mov dword [0x598f5c], ecx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x598f7c]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp - 0x38], 0
je 0x405527
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x30]
jle 0x405527
mov ecx, dword [ebp - 0x28]
add ecx, 0xa
cmp ecx, dword [ebp - 0x18]
jl 0x405527
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
add edx, 0xa
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
cmp edx, eax
jl 0x405527
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x30]
add ecx, 5
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x20]
jl 0x405527
push 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x598f7c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [ebp - 0x40], 1
cmp dword [ebp - 0x40], 0
jne 0x405576
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jle 0x405576
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x18]
add ecx, 5
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x20]
jl 0x405576
push 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x598f7c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [0x656088]
push eax
mov ecx, dword [0x598f7c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x598f7c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x598f58], 0
call fcn.00406a80
mov dword [0x656098], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret

Function at 0x4056f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x598f7c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004790a0
push eax
call fcn.00407060
add esp, 4
pop ebp
ret
Function at 0x426f70
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6552e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x7efc
mov dword [ebp - 0x4c], 0
push 0x30
push 0x59ceb0
push 0x6584e8
call fcn.0050e9d0
add esp, 0xc
push 0x38
push str.80_
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00427090
add esp, 0x10
mov dword [ebp - 0x44], 0
jmp 0x426fcb
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x10
jge 0x427082
mov eax, dword [ebp - 0x54]
and eax, 1
mov ecx, dword [ebp - 0x4c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x4c], edx
imul eax, dword [ebp - 0x44], 0x30
add eax, 0x6581e8
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0
jmp 0x427003
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0x30
jge 0x427075
mov edx, dword [ebp - 0x48]
movsx eax, byte [edx + 0x59ce00]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x1c
jl 0x427041
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x38
jl 0x42703f
mov eax, dword [ebp - 0x40]
sub eax, 0x1c
cdq
mov ecx, 0x1c
idiv ecx
add edx, 0x1c
mov dword [ebp - 0x40], edx
jmp 0x42705e
mov edx, dword [ebp - 0x40]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0x1c
jl 0x42705e
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 0x1c
idiv ecx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov cl, byte [ebp + eax - 0x3c]
mov byte [edx], cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
jmp 0x426ffa
mov eax, dword [ebp - 0x54]
shr eax, 1
mov dword [ebp - 0x54], eax
jmp 0x426fc2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret
Function at 0x439320
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
push str.TMPDIR
call fcn.0051fd23
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43937e
mov eax, dword [ebp - 8]
push eax
call fcn.00513540
add esp, 4
cmp eax, 0x20
jge 0x43937e
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045a0c0
add esp, 4
test eax, eax
je 0x43937e
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 8]
mov dword [eax + 0x5aa9c4], ecx
mov dword [ebp - 4], 0
jmp 0x439385
mov dword [ebp - 4], 1
jmp 0x439390
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 2
jae 0x439421
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x5aa9c4]
push ecx
call fcn.0045a0c0
add esp, 4
test eax, eax
je 0x43941c
mov dword [ebp - 0x14], 0x3f
push str.vileDXXXXXX
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x5aa9c4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00459890
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.005356f0
add esp, 4
test eax, eax
je 0x439414
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x439414
mov edx, dword [ebp + 8]
push edx
call fcn.00535710
add esp, 4
test eax, eax
jne 0x439407
mov dword [ebp - 0x10], 1
jmp 0x43940e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43941c
jmp 0x439421
jmp 0x439387
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x43b8d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 0xc], 0
je 0x43b962
cmp dword [ebp + 0xc], 0
je 0x43b953
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub edx, dword [ecx]
cmp edx, 0x7fffffff
jbe 0x43b90b
mov dword [ebp - 4], SysReAllocString
jmp 0x43b916
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [0x655f78]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
push eax
call fcn.00524b10
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x43b944
jmp 0x43b953
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
jmp 0x43b8ec
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x43b962
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x46e950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ecx + 0x65e562]
test edx, edx
jne 0x46e975
call fcn.0046e900
cmp dword [ebp + 8], 0
jne 0x46e985
mov eax, 1
jmp 0x46ea32
mov ax, word [ebp + 8]
mov word [ebp - 4], ax
mov dword [ebp - 0xc], 0
jmp 0x46e99f
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 2
jae 0x46e9c3
movzx edx, word [ebp - 4]
and edx, 0xff
xor edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov ax, word [ebp - 4]
shr ax, 8
mov word [ebp - 4], ax
jmp 0x46e996
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
movsx eax, byte [edx*4 + 0x65e562]
test eax, eax
je 0x46ea15
mov ecx, dword [ebp - 8]
movzx edx, word [ecx*4 + 0x65e560]
cmp edx, dword [ebp + 8]
jne 0x46e9ed
mov eax, dword [ebp - 8]
jmp 0x46ea32
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
jne 0x46ea03
or eax, 0xffffffff
jmp 0x46ea32
cmp dword [ebp - 8], 0x100
jl 0x46ea13
mov dword [ebp - 8], 2
jmp 0x46e9c9
mov edx, dword [ebp - 8]
mov ax, word [ebp + 8]
mov word [edx*4 + 0x65e560], ax
mov ecx, dword [ebp - 8]
mov byte [ecx*4 + 0x65e562], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x46f500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6552e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
push 0x659b40
push 0x5ad128
call fcn.00442cd0
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jne 0x46f634
push 0x659b40
lea eax, [ebp - 0x104]
push eax
call fcn.00513440
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00486260
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jne 0x46f627
call fcn.00486490
test eax, eax
jne 0x46f606
mov ecx, 8
imul edx, ecx, 0x36
cmp dword [edx + 0x65e180], 0
je 0x46f5f7
mov eax, dword [ebp - 0x10c]
push eax
push 0
push fcn.00470590
call fcn.00528ec0
add esp, 0xc
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
jne 0x46f5f5
push str._Cant_create_Win32_write_pipe_
call fcn.0041db70
add esp, 4
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.00513c70
add esp, 4
mov edx, dword [ebp - 0x110]
push edx
call fcn.00486310
add esp, 4
mov dword [ebp - 0x108], 0
jmp 0x46f606
mov eax, dword [ebp - 0x10c]
push eax
call fcn.00470590
add esp, 4
cmp dword [ebp - 0x108], 1
jne 0x46f625
mov ecx, dword [ebp - 0x110]
mov dword [0x655f78], ecx
mov dword [0x65d9f0], 0
jmp 0x46f634
push str._Couldnt_open_pipe_or_command_
call fcn.0041db70
add esp, 4
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret
Function at 0x4704e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
call fcn.0044b1b0
add esp, 4
movsx ecx, word [0x65db06]
imul edx, ecx, 0x14
mov eax, dword [edx + 0x65db24]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x470556
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x470520
mov dword [ebp - 0xc], 0x100
jmp 0x470533
movsx edx, word [0x65db06]
imul eax, edx, 0x14
mov ecx, dword [eax + 0x65db28]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call fcn.00529670
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x470509
mov ecx, dword [ebp - 8]
push ecx
call fcn.00514650
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.00513c70
add esp, 4
mov eax, 8
imul ecx, eax, 0x36
cmp dword [ecx + 0x65e180], 0
jne 0x470584
call fcn.00486340
mov esp, ebp
pop ebp
ret

Function at 0x470590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.0046b570
mov dword [ebp - 0xc], eax
mov ecx, dword [0x65e51c]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x4705eb
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00529670
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
push 0xa
call fcn.00526700
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
jmp 0x4705af
mov eax, dword [ebp - 8]
push eax
call fcn.00514650
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.00513c70
add esp, 4
mov edx, 8
imul eax, edx, 0x36
cmp dword [eax + 0x65e180], 0
jne 0x470619
call fcn.00486340
mov esp, ebp
pop ebp
ret
Function at 0x47f5c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x47f5de
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 8
jge 0x47f60c
cmp dword [ebp - 4], 0
jne 0x47f60c
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47f603
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x47f60a
mov dword [ebp - 4], 1
jmp 0x47f5d5
cmp dword [ebp - 4], 0
jne 0x47f62d
push 0x5ae2f0
call fcn.0041db70
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x47f696
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x47f64c
mov dword [ebp - 0xc], 1
jmp 0x47f653
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 4], 0
jne 0x47f67e
push str._Clipboard_copy_failed_
call fcn.0041db70
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x47f693
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
push ecx
call fcn.0047f4e0
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x481320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48135e
cmp dword [ebp + 0x10], 0
je 0x48135e
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x481370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00513540
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x483c80
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
je 0x483c95
mov dword [ebp - 8], 0x5aea04
jmp 0x483c9c
mov dword [ebp - 8], 0x5aea24
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x20006
push 0
mov edx, dword [ebp - 0x18]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x483cc7
mov eax, 1
jmp 0x483d37
cmp dword [ebp + 8], 0
je 0x483cd6
mov dword [ebp - 0xc], 0x14
jmp 0x483cdd
mov dword [ebp - 0xc], 0x14
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x483cf5
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x1c]
jge 0x483d28
mov eax, dword [ebp - 4]
push eax
call fcn.00483c40
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051f0d0
add esp, 4
jmp 0x483cec
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4849c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0xc], 0xffffffff
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0050e710
add esp, 0xc
mov dword [ebp - 0x60], 0x44
cmp dword [ebp + 0xc], 0
jne 0x484a12
mov dword [ebp - 0x34], 0x100
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x24], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403310
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x484ab0
cmp dword [ebp + 0xc], 0
jne 0x484a3a
mov dword [ebp - 8], 1
jmp 0x484a41
mov dword [ebp - 8], 0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x484a95
cmp dword [ebp + 0xc], 0
jne 0x484a7f
push 0
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.005396bd
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484aa2
push str._unable_to_create_win32_process_
call fcn.0041db70
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.0051f0d0
add esp, 4
jmp 0x484abd
push str.w32_CreateProcess
call fcn.00402610
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4851e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x65a480], 0
jne 0x48521a
mov dword [0x65a484], 0x80
mov eax, dword [0x65a484]
push eax
call fcn.0051f100
add esp, 4
mov dword [0x65a480], eax
cmp dword [0x65a480], 0
je 0x485297
mov ecx, dword [0x65a484]
push ecx
mov edx, dword [0x65a480]
push edx
call fcn.004055c0
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 8], eax
mov eax, dword [0x65a484]
sub eax, 1
cmp dword [ebp - 8], eax
jl 0x485293
mov ecx, dword [0x65a484]
shl ecx, 1
mov dword [0x65a484], ecx
mov edx, dword [0x65a484]
push edx
mov eax, dword [0x65a480]
push eax
call fcn.005202a0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x485288
mov ecx, dword [0x65a480]
push ecx
call fcn.0051f0d0
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [0x65a480], edx
jmp 0x485295
jmp 0x485297
jmp 0x48521a
cmp dword [ebp - 8], 0
je 0x4852da
cmp dword [0x65a480], 0
je 0x4852da
cmp dword [ebp - 4], 0
je 0x4852b8
mov eax, dword [ebp - 4]
push eax
call fcn.0051f0d0
add esp, 4
xor ecx, ecx
jne 0x4852a6
mov edx, dword [0x65a480]
push edx
call fcn.00403310
add esp, 4
mov dword [0x65a47c], eax
mov eax, dword [0x65a47c]
mov dword [ebp - 4], eax
jmp 0x4852e1
mov dword [ebp - 4], str.ERROR
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x485d00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6552e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x65a48c], 0
jne 0x485dd7
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
push 6
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jge 0x485d6b
push 0
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.004841b0
add esp, 8
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x485ddc
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x485d91
push 0
push 0
call fcn.004841b0
add esp, 8
jmp 0x485dca
lea edx, [ebp - 0x108]
push edx
call fcn.0045a7e0
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.00403310
add esp, 4
mov dword [0x65a48c], eax
cmp dword [0x65a48c], 0
jne 0x485dca
push 0x578da0
call fcn.00402610
add esp, 4
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x65a48c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret