joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426ce8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0043e630
call fcn.004a4ba8
test eax, eax
je 0x426d63
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x28]
push edx
call fcn.004b5704
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x1c], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x28]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00425fc4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00428588
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x426dfa
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push 0
push edx
push ebx
push esi
call fcn.00425fc4
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x426dc7
cmp dword [ebp - 0xc], 0xffffffff
jne 0x426dc7
push 0
push 0
call fcn.00428588
add esp, 8
xor ebx, ebx
jmp 0x426dfa
xor eax, eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00425fc4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00428588
add esp, 8
mov ebx, dword [ebp - 0x14]
call fcn.0043e62c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426e08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0043e630
call fcn.004a4ba8
test eax, eax
je 0x426e83
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x28]
push edx
call fcn.004b5704
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x1c], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x28]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00425fc4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00428588
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x426f1a
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push 0
push edx
push ebx
push esi
call fcn.00425fc4
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x426ee7
cmp dword [ebp - 0xc], 0xffffffff
jne 0x426ee7
push 0
push 0
call fcn.00428588
add esp, 8
xor ebx, ebx
jmp 0x426f1a
xor eax, eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00425fc4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00428588
add esp, 8
mov ebx, dword [ebp - 0x14]
call fcn.0043e62c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4274a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00427fb8
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0043e630
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00428588
add esp, 8
call fcn.0043e62c
test esi, esi
je 0x4274e3
push esi
call fcn.0045c528
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4274ec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00427fb8
pop ecx
mov esi, eax
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00427fb8
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
call fcn.0043e630
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne cl
and ecx, 1
mov ebx, ecx
push 0
push ebx
call fcn.00428588
add esp, 8
call fcn.0043e62c
test esi, esi
je 0x427544
push esi
call fcn.0045c528
pop ecx
test edi, edi
je 0x42754f
push edi
call fcn.0045c528
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x427558
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00427fb8
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0043e630
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00428588
add esp, 8
call fcn.0043e62c
test esi, esi
je 0x42759d
push esi
call fcn.0045c528
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4275a4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00427fb8
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0043e630
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push edi
setne al
and eax, 1
mov ebx, eax
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00428588
add esp, 8
call fcn.0043e62c
test esi, esi
je 0x4275f7
push esi
call fcn.0045c528
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x427600
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00427fb8
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0043e630
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00428588
add esp, 8
call fcn.0043e62c
test esi, esi
je 0x427643
push esi
call fcn.0045c528
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x427670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov byte [ebx], 0
cmp dword [ebp + 8], 0
jle 0x4276a7
call fcn.00427914
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
je 0x4276a7
mov ecx, dword [ebp + 8]
dec ecx
push ecx
call fcn.004278c4
pop ecx
call fcn.0043e630
mov edi, dword [ebp + 0x10]
mov eax, edi
add eax, eax
push eax
call fcn.0045c458
pop ecx
mov esi, eax
mov word [esi], 0
push 0
push esi
push edi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
push eax
call fcn.00428588
mov word [esi + edi*2 - 2], 0
add esp, 8
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
push esi
call fcn.00469818
add esp, 0xc
push esi
call fcn.0045c528
pop ecx
call fcn.0043e62c
call fcn.0042854c
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x42771e
mov edx, dword [ebp - 4]
dec edx
push edx
call fcn.004278c4
pop ecx
push edi
call fcn.00428574
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ebx + ecx - 1], 0
test edi, edi
jne 0x4277a3
cmp byte [ebx], 0
je 0x4277a3
push ebx
call fcn.004b583c
pop ecx
mov dword [ebp - 8], ebx
mov esi, eax
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x42774b
add dword [ebp - 8], 2
sub esi, 2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx]
push ecx
push 0x544aab
call fcn.004b57e8
add esp, 8
test eax, eax
je 0x427768
inc dword [ebp - 8]
dec esi
test esi, esi
je 0x427788
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + esi - 1]
push edx
push 0x544aab
call fcn.004b57e8
add esp, 8
test eax, eax
je 0x427788
dec esi
test esi, esi
je 0x42779f
cmp ebx, dword [ebp - 8]
je 0x42779f
push esi
mov ecx, dword [ebp - 8]
push ecx
push ebx
call fcn.004b56b8
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4277ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [esi], 0
call fcn.0043e630
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edx
push edx
call fcn.0045c458
pop ecx
mov ebx, eax
mov word [ebx], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne dl
and edx, 1
mov edi, edx
push 0
push edi
call fcn.00428588
add esp, 8
mov eax, dword [ebp - 4]
mov word [ebx + eax*2 - 2], 0
mov edx, dword [ebp + 0xc]
dec edx
push edx
push esi
push ebx
call fcn.00469818
add esp, 0xc
push ebx
call fcn.0045c528
pop ecx
call fcn.0043e62c
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx - 1], 0
test edi, edi
je 0x42785e
cmp byte [esi], 0
je 0x42785e
push esi
call fcn.004b583c
pop ecx
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x42785e
xor edx, edx
mov dl, byte [esi + ebx - 1]
push edx
push 0x544aab
call fcn.004b57e8
add esp, 8
test eax, eax
jne 0x42785e
mov byte [esi + ebx], 0x5c
inc ebx
mov byte [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x427868
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00427fb8
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0043e630
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00428588
add esp, 8
push edi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.0043e62c
test esi, esi
je 0x4278bb
push esi
call fcn.0045c528
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x428684
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x428765
test edi, edi
je 0x428765
call fcn.0043e630
cmp dword [0x544ab4], 0
jne 0x4286d1
push 0x544abc
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x4286d1
push str.CreateSymbolicLinkW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x544ab4], eax
cmp dword [0x544ab4], 0
je 0x428754
push edi
call fcn.00427fb8
pop ecx
mov esi, eax
mov dword [ebp - 4], eax
push ebx
call fcn.00427fb8
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x428700
test al, 0x10
jne 0x428704
xor edx, edx
jmp 0x428709
mov edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x428719
mov ecx, 1
jmp 0x42871b
xor ecx, ecx
push ecx
push ebx
mov eax, dword [ebp - 4]
push eax
call dword [0x544ab4]
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00428588
add esp, 8
test esi, esi
je 0x428747
push esi
call fcn.0045c528
pop ecx
test edi, edi
je 0x42875e
push edi
call fcn.0045c528
pop ecx
jmp 0x42875e
push 1
call fcn.00428574
pop ecx
xor ebx, ebx
call fcn.0043e62c
jmp 0x42876f
push 2
call fcn.00428574
pop ecx
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x428778
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
je 0x428893
call fcn.0043e630
cmp dword [0x544ab8], 0
jne 0x4287bf
push 0x544abc
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x4287bf
push str.GetFinalPathNameByHandleW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x544ab8], eax
cmp dword [0x544ab8], 0
je 0x428884
push ebx
call fcn.00427fb8
pop ecx
mov esi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4287e6
test al, 0x10
jne 0x4287ea
xor edx, edx
jmp 0x4287ef
mov edx, 1
mov eax, edx
push 0
test eax, eax
je 0x4287fe
mov ecx, 0x2000010
jmp 0x428803
mov ecx, 0x80
push ecx
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
jne 0x428828
push 0
push 0
call fcn.00428588
add esp, 8
jmp 0x428877
push 0
push 0x108
lea edx, [ebp - 0x210]
push edx
push eax
call dword [0x544ab8]
cmp eax, 0x108
jae 0x42886f
test eax, eax
jbe 0x428861
mov word [ebp + eax*2 - 0x210], 0
lea eax, [ebp - 0x210]
push eax
call fcn.004697a8
pop ecx
mov edi, eax
push 0
push 1
call fcn.00428588
add esp, 8
jmp 0x428877
push 9
call fcn.00428574
pop ecx
test esi, esi
je 0x42888c
push esi
call fcn.0045c528
pop ecx
jmp 0x42888c
push 1
call fcn.00428574
pop ecx
call fcn.0043e62c
jmp 0x42889b
push 2
call fcn.00428574
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428c7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [eax], 0
call fcn.0043e630
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x428ca9
push ebx
call fcn.00427fb8
pop ecx
mov esi, eax
jmp 0x428cab
xor eax, eax
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x428ccc
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x428ccc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00427fb8
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x428d03
lea edx, [ebp - 0x424]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
jne 0x428cf1
push 0
push 0
call fcn.00428588
add esp, 8
xor eax, eax
jmp 0x428d65
mov word [ebp - 0x216], 0
lea edx, [ebp - 0x424]
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x214]
push ecx
push 0
test ebx, ebx
jne 0x428d15
mov ebx, 0x544b48
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov ebx, eax
test ebx, ebx
je 0x428d3d
push 0x107
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.00469818
add esp, 0xc
test esi, esi
je 0x428d48
push esi
call fcn.0045c528
pop ecx
test edi, edi
je 0x428d53
push edi
call fcn.0045c528
pop ecx
push 0
push ebx
call fcn.00428588
add esp, 8
call fcn.0043e62c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428db4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebx], 0
lea eax, [ebp - 0x210]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
je 0x428dfa
mov word [ebp - 2], 0
push 0x107
push ebx
lea eax, [ebp - 0x210]
xor esi, esi
push eax
call fcn.00469818
add esp, 0xc
test esi, esi
jne 0x428e23
cmp byte [ebx], 0
je 0x428e23
push ebx
call fcn.004b583c
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x428e2e
cmp eax, 0x107
jge 0x428e2e
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x428e2e
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a32c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x42a41d
call sub.USER32.DLL_EmptyClipboard
cmp dword [ebp + 8], 0xd
jne 0x42a365
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00461b68
add esp, 0x10
mov esi, eax
jmp 0x42a37d
push 0
push 0
call fcn.004693f8
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00461a94
add esp, 0x10
mov esi, eax
test esi, esi
je 0x42a413
cmp dword [ebp + 8], 0xd
lea eax, [esi + 1]
jne 0x42a395
mov edx, 2
jmp 0x42a39a
mov edx, 1
imul edx
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x42a418
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a407
cmp dword [ebp + 8], 0xd
jne 0x42a3d5
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00461b68
add esp, 0x10
jmp 0x42a3ed
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.004693f8
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00461a94
add esp, 0x10
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_SetClipboardData
test eax, eax
setne al
and eax, 1
mov edi, eax
test edi, edi
jne 0x42a418
push ebx
call sub.KERNEL32.DLL_GlobalFree
jmp 0x42a418
mov edi, 1
call sub.USER32.DLL_CloseClipboard
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42a428
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
call sub.USER32.DLL_IsClipboardFormatAvailable
test eax, eax
je 0x42a4ef
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x42a4ef
push edi
call sub.USER32.DLL_GetClipboardData
mov esi, eax
test esi, esi
je 0x42a4ea
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42a4ea
push esi
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov eax, edi
dec eax
je 0x42a4b1
sub eax, 6
je 0x42a4b1
sub eax, 6
jne 0x42a4c0
shr ebx, 1
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004615b4
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x42a4e4
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00461c94
add esp, 0x10
jmp 0x42a4e4
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004a3614
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x42a4e4
push ebx
cmp edi, 1
mov ecx, dword [ebp - 4]
push ecx
jne 0x42a4d5
call fcn.004693f8
jmp 0x42a4d7
xor eax, eax
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00461bd8
add esp, 0x10
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
test ebx, ebx
jne 0x42a501
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0045ea44
add esp, 8
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42a890
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
xor ebx, ebx
push esp
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x42a97d
test byte [esp + 0x10], 0x80
je 0x42a8b1
or ebx, 1
test byte [esp + 0x11], 0x80
je 0x42a8bb
or ebx, 2
test byte [esp + 0x12], 0x80
je 0x42a8c5
or ebx, 4
test byte [esp + 0x5b], 0x80
je 0x42a8cf
or ebx, 8
test byte [esp + 0x5c], 0x80
je 0x42a8d9
or ebx, 0x10
test byte [esp + 0x5d], 0x80
je 0x42a8e3
or ebx, 0x20
test byte [esp + 0x91], 1
je 0x42a8f3
or ebx, 0x100
test byte [esp + 0x90], 1
je 0x42a903
or ebx, 0x200
test byte [esp + 0x14], 1
je 0x42a910
or ebx, 0x400
test byte [esp + 0x2d], 1
je 0x42a91d
or ebx, 0x80
test byte [esp + 0xa0], 0x80
je 0x42a92d
or ebx, 0x10000
test byte [esp + 0xa1], 0x80
je 0x42a93d
or ebx, 0x20000
test byte [esp + 0xa2], 0x80
je 0x42a94d
or ebx, 0x40000
test byte [esp + 0xa3], 0x80
je 0x42a95d
or ebx, 0x80000
test byte [esp + 0xa4], 0x80
je 0x42a96d
or ebx, 0x100000
test byte [esp + 0xa5], 0x80
je 0x42a97d
or ebx, 0x200000
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x42a988
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x42aabf
test bl, 1
je 0x42a9b2
mov dl, 0x80
jmp 0x42a9b4
xor edx, edx
test bl, 2
mov byte [ebp - 0xf0], dl
je 0x42a9c3
mov al, 0x80
jmp 0x42a9c5
xor eax, eax
test bl, 4
mov byte [ebp - 0xef], al
je 0x42a9d4
mov dl, 0x80
jmp 0x42a9d6
xor edx, edx
test bl, 8
mov byte [ebp - 0xee], dl
je 0x42a9e5
mov al, 0x80
jmp 0x42a9e7
xor eax, eax
test bl, 0x10
mov byte [ebp - 0xa5], al
je 0x42a9f6
mov dl, 0x80
jmp 0x42a9f8
xor edx, edx
test bl, 0x20
mov byte [ebp - 0xa4], dl
je 0x42aa07
mov al, 0x80
jmp 0x42aa09
xor eax, eax
test bh, 1
mov byte [ebp - 0xa3], al
je 0x42aa18
mov dl, 1
jmp 0x42aa1a
xor edx, edx
test bh, 2
mov byte [ebp - 0x6f], dl
je 0x42aa26
mov al, 1
jmp 0x42aa28
xor eax, eax
test bh, 4
mov byte [ebp - 0x70], al
je 0x42aa34
mov dl, 1
jmp 0x42aa36
xor edx, edx
test bl, 0x80
mov byte [ebp - 0xec], dl
je 0x42aa45
mov al, 1
jmp 0x42aa47
xor eax, eax
test ebx, 0x10000
mov byte [ebp - 0xd3], al
je 0x42aa59
mov dl, 0x80
jmp 0x42aa5b
xor edx, edx
test ebx, 0x20000
mov byte [ebp - 0x60], dl
je 0x42aa6a
mov al, 0x80
jmp 0x42aa6c
xor eax, eax
test ebx, 0x40000
mov byte [ebp - 0x5f], al
je 0x42aa7b
mov dl, 0x80
jmp 0x42aa7d
xor edx, edx
test ebx, 0x80000
mov byte [ebp - 0x5e], dl
je 0x42aa8c
mov al, 0x80
jmp 0x42aa8e
xor eax, eax
test ebx, 0x100000
mov byte [ebp - 0x5d], al
je 0x42aa9d
mov dl, 0x80
jmp 0x42aa9f
xor edx, edx
test ebx, 0x200000
mov byte [ebp - 0x5c], dl
je 0x42aaae
mov al, 0x80
jmp 0x42aab0
xor eax, eax
mov byte [ebp - 0x5b], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.DLL_SetKeyboardState
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b214
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, 0xffffffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x42b24a
test ecx, ecx
je 0x42b24a
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x544b70]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x42b22c
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x42b250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ax, 0xffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x42b28f
test ecx, ecx
je 0x42b28f
movzx ebx, ax
movzx edi, byte [edx]
mov esi, ebx
inc edx
xor esi, edi
and esi, 0xff
sar ebx, 8
mov si, word [esi*2 + 0x544f70]
xor si, bx
dec ecx
mov eax, esi
jne 0x42b26b
xor ax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4394f4
Capabilities:
Get hostname

Disassembly:
add esp, 0xffffffdc
mov dword [esp], 0x10
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov word [esp + 0x22], 0
cmp word [esp + 4], 0
je 0x43952c
lea edx, [esp + 4]
push edx
call fcn.004697a8
pop ecx
jmp 0x439537
push str.HOSTNAME
call fcn.004a1680
pop ecx
add esp, 0x24
ret
Function at 0x439554
Capabilities:
Get session user name

Disassembly:
add esp, 0xfffffdfc
mov dword [esp], 0x100
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.ADVAPI32.DLL_GetUserNameW
mov word [esp + 0x202], 0
cmp word [esp + 4], 0
je 0x439592
lea edx, [esp + 4]
push edx
call fcn.004697a8
pop ecx
jmp 0x43959d
push str.USER
call fcn.004a1680
pop ecx
add esp, 0x204
ret