joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c0b4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov ebx, 0x650c64
xor eax, eax
call fcn.0046c070
xor eax, eax
mov dword [ebp - 9], eax
xor eax, eax
mov dword [ebp - 5], eax
call fcn.0046be34
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c
call fcn.00403234
mov dword [ebx], esi
mov dword [ebx + 4], edi
cmp byte [ebp - 1], 0
je 0x46c101
cmp dword [0x650cb8], 0
jne 0x46c105
xor eax, eax
jmp 0x46c107
mov al, 1
mov byte [ebx + 8], al
mov al, byte [ebp + 8]
mov byte [ebx + 0x3c], al
lea eax, [ebx + 0x34]
push eax
call sub.USER32.dll_GetCursorPos
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx]
push eax
call sub.USER32.dll_GetClientRect
push 2
lea eax, [ebx + 0x1c]
push eax
push 0
mov eax, dword [ebx]
push eax
call sub.USER32.dll_MapWindowPoints
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx]
push eax
call sub.USER32.dll_GetWindowRect
push 3
push 0
mov eax, dword [ebx]
push eax
call sub.USER32.dll_GetDCEx
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x20]
mov dword [ebx + 0x30], esi
push esi
mov eax, dword [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x10]
push eax
call sub.GDI32.dll_CreateCompatibleDC
mov esi, eax
mov dword [ebx + 0x14], esi
mov eax, dword [ebx + 0x18]
push eax
push esi
call sub.GDI32.dll_SelectObject
push 0x1e
mov eax, dword [ebx + 0x14]
push eax
push 0x317
mov eax, dword [ebx]
push eax
call sub.USER32.dll_SendMessageA
cmp byte [ebx + 8], 0
je 0x46c1f7
push 0xffffffffffffffec
mov esi, dword [ebx]
push esi
call sub.USER32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call sub.USER32.dll_SetWindowLongA
mov dword [ebx + 0xc], 0x20
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x14], 0
mov al, byte [ebx + 0xc]
mov byte [ebp - 0x12], al
push 2
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 9]
push eax
mov eax, dword [ebx + 0x14]
push eax
lea eax, [ebx + 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebx]
push eax
call dword [0x650cb8]
jmp 0x46c220
xor eax, eax
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 0
call sub.GDI32.dll_CreateRectRgn
mov esi, eax
push 0
push esi
mov eax, dword [ebx]
push eax
call sub.USER32.dll_SetWindowRgn
test eax, eax
jne 0x46c220
push esi
call sub.GDI32.dll_DeleteObject
push 0x425f
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebx]
push eax
call sub.USER32.dll_SetWindowPos
push 0
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x46be80
xor edx, edx
xor eax, eax
call fcn.00404810
mov dword [0x650c60], eax
cmp dword [0x650c60], 0
jne 0x46c262
call fcn.0046bfe8
jmp 0x46c273
inc dword [0x650cb0]
mov eax, dword [0x650c60]
push eax
call sub.KERNEL32.dll_ResumeThread
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46c6ec
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x46c713
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x46c89c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x46c895
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x46c762
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x46c758
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.USER32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x46c87a
mov edx, dword [ebp - 4]
test al, 8
je 0x46c7de
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x46c7c3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00447db4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.USER32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x46c800
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00447db4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.USER32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00447db4
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 0x10
je 0x46c858
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x28], 0x1e
lea eax, [ebp - 0x34]
push eax
push 0x46c628
push ebx
call sub.USER32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x46c87a
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x46c628
call sub.USER32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c89c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46cc88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x46cd3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x46cd50
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46cd29
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x46cd68
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
cmp esi, 2
je 0x46cd29
test esi, esi
jne 0x46cd00
cmp dword [ebp - 8], 1
je 0x46cd04
xor ebx, ebx
jmp 0x46cd29
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, 0x20
call fcn.00404ac4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.00403298
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x46cd29
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cd46
lea eax, [ebp - 0x34]
call fcn.0040485c
ret

Function at 0x46d914
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46d9d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x64ed4c]
cmp dword [eax], 5
jl 0x46d945
mov eax, dword [0x64f1e8]
cmp dword [eax], 2
je 0x46d949
mov bl, 1
jmp 0x46d9bd
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x46d9ec
push esi
push 0x46da18
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404bd4
mov eax, dword [ebp - 0x14]
call fcn.00404d0c
push eax
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46d9bd
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExW
test eax, eax
jne 0x46d9ab
cmp word [ebp - 0xc], 0
jne 0x46d9b2
cmp eax, 0xea
jne 0x46d9b4
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d9da
lea eax, [ebp - 0x14]
call fcn.0040485c
ret
Function at 0x46da88
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x46db10
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x1004
push 0
call sub.USER32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.KERNEL32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x46daf8
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00404ac4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00405c0c
mov ebx, eax
cmp dword [ebp - 4], 0
jne 0x46daf4
push ebx
call sub.KERNEL32.dll_IsValidCodePage
test eax, eax
jne 0x46dafa
xor ebx, ebx
jmp 0x46dafa
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46db17
lea eax, [ebp - 0x18]
call fcn.0040485c
ret

Function at 0x46e2a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
push 0
push 0x12
call sub.USER32.dll_MapVirtualKeyA
mov ebx, eax
shl ebx, 0x10
test ebx, ebx
je 0x46e2e0
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.dll_GetKeyNameTextA
test eax, eax
jle 0x46e2e0
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00404ac4
jmp 0x46e2ec
mov eax, esi
mov edx, 0x46e300
call fcn.004048b0
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x47c02c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
lea edi, [ebp - 0x1d]
xor edx, edx
push ebp
push 0x47c26e
push dword fs:[edx]
mov dword fs:[edx], esp
mov bl, 1
jmp 0x47c233
test bl, bl
jne 0x47c056
call sub.USER32.dll_WaitMessage
xor ebx, ebx
jmp 0x47c212
mov eax, dword [edi + 4]
cmp eax, 0x105
jg 0x47c08c
je 0x47c11a
sub eax, 0xa0
je 0x47c15d
dec eax
sub eax, 9
jb 0x47c13d
sub eax, 0x5a
je 0x47c0a6
jmp 0x47c1d9
sub eax, 0x200
je 0x47c15d
dec eax
sub eax, 9
jb 0x47c13d
jmp 0x47c1d9
mov eax, dword [edi + 8]
cmp eax, 0x12
je 0x47c1d9
cmp eax, 0x10
je 0x47c1d9
cmp eax, 0x19
je 0x47c1d9
mov byte [ebp - 1], 0
test byte [edi + 0xe], 0xff
je 0x47c0f7
mov esi, 0x60
push 0
push esi
call sub.USER32.dll_MapVirtualKeyA
mov dx, word [edi + 0xe]
and dx, 0xff
movzx edx, dx
cmp eax, edx
jne 0x47c0f1
mov byte [ebp - 1], 1
jmp 0x47c0f7
inc esi
cmp esi, 0x6a
jne 0x47c0d3
cmp byte [ebp - 1], 0
jne 0x47c1d9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x47c27c]
mov byte [eax + 0x34], dl
call fcn.004042e4
jmp 0x47c275
cmp dword [edi + 8], 0x12
jne 0x47c1d9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x47c27c]
mov byte [eax + 0x34], dl
call fcn.004042e4
jmp 0x47c275
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.0044fc28
cmp eax, dword [edi]
je 0x47c1d9
call fcn.004042e4
jmp 0x47c275
call sub.USER32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne 0x47c18b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.0044fc28
lea edx, [edi + 0x14]
call fcn.0047bfb0
test al, al
je 0x47c1ba
call sub.USER32.dll_ReleaseCapture
jmp 0x47c1ba
call sub.USER32.dll_GetCapture
test eax, eax
jne 0x47c1ba
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.0044fc28
lea edx, [edi + 0x14]
call fcn.0047bfb0
test al, al
jne 0x47c1ba
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.USER32.dll_SetCapture
call sub.USER32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne 0x47c1d9
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
push 3
push 0
push 0
push 0
push edi
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x47c212
mov eax, dword [edi + 4]
cmp eax, 0x200
jb 0x47c206
cmp eax, 0x20a
ja 0x47c206
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp eax, dword [edi]
je 0x47c212
push edi
call sub.USER32.dll_TranslateMessage
push edi
call sub.USER32.dll_DispatchMessageA
push ebp
call fcn.0047bfe4
pop ecx
test al, al
je 0x47c233
push 0
push 0
push 0
push 0
push edi
call sub.USER32.dll_PeekMessageA
test eax, eax
jne 0x47c05d
push ebp
call fcn.0047bfe4
pop ecx
test al, al
jne 0x47c04d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c275
mov edx, 0x103
mov eax, 0x102
call fcn.0046cb60
mov edx, 0x107
mov eax, 0x106
call fcn.0046cb60
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47d38c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0047cf8c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404d0c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
je 0x47d3ea
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x64eea4]
mov dl, 1
mov eax, dword [0x47ce84]
call fcn.0040ced4
call fcn.00404238
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47d3f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404d0c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
je 0x47d44c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x64f1fc]
mov dl, 1
mov eax, dword [0x47ce84]
call fcn.0040ced4
call fcn.00404238
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047cfbc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4816c0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044ff2c
test al, al
je 0x481815
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044fc28
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.dll_GetUpdateRect
test eax, eax
je 0x48172c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_EqualRect
test eax, eax
je 0x48172c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047ea34
jmp 0x481815
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x481803
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0x14]
push edi
mov esi, dword [ebp - 0x18]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.USER32.dll_SendMessageA
push 0
mov ebx, dword [ebp - 0xc]
push ebx
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.USER32.dll_SendMessageA
push 0
push ebx
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.USER32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48180a
cmp dword [ebp - 0xc], 0
je 0x4817e6
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x4817f5
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.dll_ReleaseDC
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f288
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49f360
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x65321c], 0
jne 0x49f344
lea eax, [ebp - 4]
mov edx, 0x49f378
call fcn.004048f4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d0c
mov esi, eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x49f344
mov eax, ebx
call fcn.004027ac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49f33d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x49f327
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x49f388
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x49f327
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x65321c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f344
mov eax, dword [ebp - 0xc]
call fcn.004027cc
ret
mov ebx, dword [0x65321c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f367
lea eax, [ebp - 4]
call fcn.0040485c
ret

Function at 0x4d5a7c
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x64ef58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4d5aa2
push 0
mov eax, dword [0x64ef58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.USER32.dll_ShowWindow
ret

Function at 0x4d8a04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d0c
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x4df770
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov edi, dword [ebx + 0x24c]
sub edi, dword [ebx + 0x248]
test edi, edi
jle 0x4df8b8
push 0
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x4df8b8
call sub.USER32.dll_EmptyClipboard
mov eax, edi
add eax, eax
push eax
push 0x2002
call sub.KERNEL32.dll_GlobalAlloc
mov dword [esp], eax
mov eax, dword [esp]
push eax
call sub.KERNEL32.dll_GlobalLock
mov edx, eax
mov esi, dword [ebx + 0x248]
xor eax, eax
jmp 0x4df7e6
mov ecx, dword [ebx + 0x210]
mov cl, byte [ecx + esi]
mov byte [edx + eax], cl
cmp byte [edx + eax], 0xa
jne 0x4df7e4
mov byte [edx + eax], 0xd
mov byte [edx + eax + 1], 0xa
inc eax
inc eax
inc esi
cmp esi, dword [ebx + 0x24c]
jl 0x4df7c8
mov byte [edx + eax], 0
mov eax, dword [esp]
push eax
call sub.KERNEL32.dll_GlobalUnlock
mov eax, dword [esp]
push eax
push 1
call sub.USER32.dll_SetClipboardData
lea eax, [edi + 1]
imul edx, edi, 0x118
add eax, edx
push eax
push 0x2002
call sub.KERNEL32.dll_GlobalAlloc
mov dword [esp], eax
mov eax, dword [esp]
push eax
call sub.KERNEL32.dll_GlobalLock
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x210]
mov edx, dword [ebx + 0x248]
add eax, edx
mov edx, dword [esp + 4]
mov ecx, edi
call fcn.00402a20
mov eax, dword [esp + 4]
mov byte [eax + edi], 0
mov esi, dword [ebx + 0x248]
mov ebp, dword [ebx + 0x24c]
dec ebp
sub ebp, esi
jl 0x4df89b
inc ebp
mov eax, dword [ebx + 0x280]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx + 0x27c]
call fcn.0041bd64
lea edx, [edi + 1]
mov ecx, esi
sub ecx, dword [ebx + 0x248]
imul ecx, ecx, 0x118
add edx, ecx
mov ecx, dword [esp + 4]
lea edx, [ecx + edx]
mov ecx, 0x118
call fcn.00402a20
inc esi
dec ebp
jne 0x4df85f
mov eax, dword [esp]
push eax
call sub.KERNEL32.dll_GlobalUnlock
mov eax, dword [esp]
push eax
mov eax, dword [0x6533b8]
push eax
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4df8c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, eax
push 0
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x4df989
mov eax, dword [0x6533b8]
push eax
call sub.USER32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x4df948
mov eax, dword [0x6533b8]
push eax
call sub.USER32.dll_GetClipboardData
mov ebp, eax
test ebp, ebp
je 0x4df984
push ebp
call sub.KERNEL32.dll_GlobalLock
mov ebx, eax
mov eax, ebx
call fcn.00409e00
mov dword [esp], eax
xor esi, esi
jmp 0x4df93a
mov eax, dword [esp]
inc eax
imul edx, esi, 0x118
add eax, edx
lea eax, [ebx + eax]
mov edx, dword [edi + 0x258]
mov ecx, 0x118
call fcn.00402a20
mov dl, byte [ebx + esi]
mov eax, edi
call fcn.004dc414
inc esi
cmp byte [ebx + esi], 0
jne 0x4df910
push ebp
call sub.KERNEL32.dll_GlobalUnlock
jmp 0x4df984
push 1
call sub.USER32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x4df984
push 1
call sub.USER32.dll_GetClipboardData
mov ebp, eax
test ebp, ebp
je 0x4df984
push ebp
call sub.KERNEL32.dll_GlobalLock
mov ebx, eax
jmp 0x4df978
cmp al, 0xd
je 0x4df977
mov edx, eax
mov eax, edi
call fcn.004dc414
inc ebx
mov al, byte [ebx]
test al, al
jne 0x4df96a
push ebp
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e68ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x6409fc
test edx, edx
jne 0x4e68fc
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x4e69c4
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ecx, 8
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
cmp ecx, 8
mov eax, esi
jae 0x4e6908
test ecx, ecx
je 0x4e69e1
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
dec ecx
mov eax, esi
jne 0x4e69c8
xor eax, 0xffffffff
pop esi
pop ebx
ret