joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ba88
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x46ba90
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x46bcc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x24]
mov edx, 0x46bce4
mov eax, dword [ebp - 0x14]
call fcn.0046df78
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov edx, dword [0x49a658]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
mov ecx, 0x46bd00
call fcn.00407610
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
mov ecx, 0x46bd1c
mov edx, 1
call fcn.00452f7c
push dword [ebp - 4]
push 0x46bd1c
mov eax, dword [0x49a658]
push dword [eax]
push 0x46bd2c
lea eax, [ebp - 8]
mov edx, 4
call fcn.004076f4
mov edi, 3
mov dl, 1
mov eax, dword [0x426c28]
call fcn.00405008
mov esi, eax
push 0
push 0x46bd44
mov eax, dword [ebp - 0x14]
push dword [eax + 0x6c]
push 0x46bd6c
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004076f4
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.0046ab88
mov eax, dword [ebp - 0x30]
mov edx, esi
pop ecx
call fcn.0046326c
test al, al
je 0x46bb75
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004543a0
test al, al
jne 0x46bb79
xor ebx, ebx
jmp 0x46bb7b
mov bl, 1
mov eax, esi
call fcn.00405038
test bl, bl
jne 0x46bb93
push 0x1f4
call sub.kernel32.dll_Sleep_1
dec edi
jne 0x46bb1d
test bl, bl
je 0x46bc9c
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00456240
test al, al
jne 0x46bbb6
mov eax, dword [ebp - 4]
call fcn.00453f44
jmp 0x46bc9c
push dword [ebp - 4]
push 0x46bd1c
lea ecx, [ebp - 0x34]
mov edx, 0x46bd7c
mov eax, dword [ebp - 0x14]
call fcn.0046df78
push dword [ebp - 0x34]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004076f4
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00456240
test al, al
je 0x46bbfa
mov eax, dword [ebp - 0xc]
call fcn.004071e0
push eax
call sub.kernel32.dll_DeleteFileW
mov edi, 3
mov eax, dword [ebp - 0xc]
call fcn.004071e0
push eax
mov eax, dword [ebp - 8]
call fcn.004071e0
push eax
call sub.kernel32.dll_MoveFileW
test eax, eax
jne 0x46bc24
push 0x64
call sub.kernel32.dll_Sleep_1
dec edi
jne 0x46bbff
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00456240
test al, al
jne 0x46bc3c
mov eax, dword [ebp - 4]
call fcn.00453f44
jmp 0x46bc9c
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.004071a8
call fcn.0040450c
mov ebx, eax
test ebx, ebx
jle 0x46bc7c
mov edi, 1
push dword [ebp - 0x10]
push 0x46bdac
lea edx, [ebp - 0x38]
mov eax, edi
call fcn.0040456c
push dword [ebp - 0x38]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004076f4
inc edi
dec ebx
jne 0x46bc56
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46bdbc
call fcn.00407610
mov edx, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.00454a38
mov byte [ebp - 0x15], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bccb
lea eax, [ebp - 0x3c]
mov edx, 7
call fcn.0040714c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040714c
ret
Function at 0x473c54
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x473c5c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.0040713c
xor eax, eax
push ebp
push 0x473e59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004071e0
push eax
call sub.kernel32.dll_DeleteFileW
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00410eb8
mov eax, dword [ebp - 0x24]
call fcn.00453ddc
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x473dfc
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x473db5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x473da4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax + 0x70]
mov eax, ebx
call fcn.0040895c
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.004743a0
mov edx, dword [ebp - 0x28]
mov ecx, ebx
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
lea eax, [ebp - 0xc]
mov ecx, 0x473e78
mov edx, dword [ebp - 4]
call fcn.00407610
push 0xff00
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4267fc]
call fcn.0042f7b8
mov dword [ebp - 0x20], eax
mov eax, dword [0x4a0800]
mov ecx, dword [eax + 0x6c]
lea eax, [ebp - 0x10]
mov edx, 0x473e90
call fcn.00407610
mov eax, dword [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00407144
mov ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00463008
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
jne 0x473d8e
cmp dword [ebp - 0x14], 0
je 0x473d81
mov eax, dword [ebp - 0x14]
push eax
mov ecx, 0x473eb8
mov edx, dword [ebp - 0x18]
mov eax, 0x473ed8
call fcn.0047b8d8
jmp 0x473d8e
mov edx, dword [ebp - 0x18]
mov eax, 0x473ed8
call fcn.0047b888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473dab
mov eax, dword [ebp - 0x20]
call fcn.00405038
ret
cmp byte [ebp - 0x19], 0
je 0x473e29
mov eax, dword [ebp - 4]
call fcn.004071e0
push eax
lea eax, [ebp - 0x34]
mov ecx, 0x473e78
mov edx, dword [ebp - 4]
call fcn.00407610
mov eax, dword [ebp - 0x34]
call fcn.004071e0
push eax
call sub.kernel32.dll_MoveFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473e60
lea eax, [ebp - 0x34]
call fcn.00407144
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040714c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040714c
ret
Function at 0x474538
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff998
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040713c
xor eax, eax
push ebp
push 0x4746ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x210]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea esi, [ebp + eax*2 - 0x210]
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x474597
mov eax, ebx
sub eax, 0xa
cmp word [eax], 2
je 0x474597
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004064a4
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00407abc
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4745be
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4745be
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004064a4
test eax, eax
je 0x4745c7
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
add ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00404350
lea eax, [ebp - 0x460]
xor ecx, ecx
mov edx, 0x250
call fcn.0040486c
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4746aa
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040733c
push esi
mov esi, 0x4746d8
lea edi, [ebp - 0x668]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x434]
lea edx, [ebp - 0x668]
mov ecx, 0x104
call fcn.00404818
jbe 0x474659
lea edx, [ebp - 0x668]
lea eax, [ebp - 0x434]
mov ecx, 0x104
call fcn.00404350
lea eax, [ebp - 0x460]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x47462b
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x210]
add eax, 0x208
sub eax, esi
sar eax, 1
jns 0x474684
adc eax, 0
mov ecx, eax
add ecx, ecx
mov edx, esi
lea eax, [ebp - 0x668]
call fcn.00404350
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040733c
jmp 0x4746b4
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00407154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4746d1
lea eax, [ebp - 4]
call fcn.00407144
ret
Function at 0x482898
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 8], edx
mov dword [esp], eax
mov eax, dword [esp + 8]
xor edx, edx
call fcn.00407154
mov esi, dword [esp]
shr esi, 4
inc esi
call sub.kernel32.dll_GetThreadLocale
and ax, 0x3ff
or ax, 0x400
movzx eax, ax
push eax
mov edi, esi
push edi
push 6
mov eax, dword [0x49dc38]
push eax
call sub.kernel32.dll_FindResourceExW_1
mov ebx, eax
test ebx, ebx
jne 0x4828f5
mov eax, 0x409
push eax
push edi
push 6
mov eax, dword [0x49dc38]
push eax
call sub.kernel32.dll_FindResourceExW_1
mov ebx, eax
test ebx, ebx
je 0x482978
push ebx
mov eax, dword [0x49dc38]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
push ebx
mov eax, dword [0x49dc38]
push eax
call sub.kernel32.dll_LoadResource
mov ebp, eax
test esi, esi
je 0x482972
test ebp, ebp
je 0x482972
push ebp
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, ebx
cdq
push edx
push eax
mov eax, esi
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esp + 0xc], eax
xor edi, edi
cmp ebx, dword [esp + 0xc]
jae 0x482972
movzx esi, word [ebx]
add ebx, 2
mov eax, dword [esp]
and eax, 0xf
cmp edi, eax
jne 0x482964
movzx ecx, si
mov eax, dword [esp + 8]
mov edx, ebx
call fcn.00407290
jmp 0x482972
inc edi
movzx eax, si
add eax, eax
add ebx, eax
cmp ebx, dword [esp + 0xc]
jb 0x482944
push ebp
call sub.kernel32.dll_FreeResource
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x489a8c
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov edi, dword [ebp + 8]
mov edi, dword [edi - 8]
call fcn.0045704c
mov ebx, eax
mov edx, 0x489b40
mov eax, ebx
call fcn.004571d4
mov dl, 5
mov eax, ebx
call fcn.004571c4
mov eax, 0xd
call fcn.00482a30
mov ecx, eax
mov edx, 4
mov eax, ebx
call fcn.00457190
mov eax, dword [edi + 0x64]
call fcn.004599e4
push 0
mov eax, dword [edi + 0xa4]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [edi + 0x9c]
push eax
call sub.user32.dll_ShowWindow
push 1
mov eax, ebx
call fcn.00457330
push eax
push 0x30
mov eax, dword [edi + 0xa0]
push eax
call sub.user32.dll_SendMessageW_1
mov eax, dword [esi + 0x50]
call fcn.004071e0
push eax
mov eax, dword [edi + 0xa0]
push eax
call sub.user32.dll_SetWindowTextW
push 5
mov eax, dword [edi + 0xa0]
push eax
call sub.user32.dll_ShowWindow
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48af10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x48af25
add esp, 0xfffffff0
call fcn.0040554c
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040713c
xor eax, eax
push ebp
push 0x48afa9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_GetModuleHandleW_3
mov esi, eax
push 0
mov eax, dword [ebp - 4]
call fcn.004071e0
push eax
mov eax, dword [ebp + 8]
push eax
push esi
call sub.kernel32.dll_FindResourceExW_1
mov edi, eax
mov dword [ebx + 0xc], edi
test edi, edi
je 0x48af93
push edi
push esi
call sub.kernel32.dll_LoadResource
mov dword [ebx + 0x10], eax
cmp dword [ebx + 0x10], 0
je 0x48af93
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0xc]
push eax
push esi
call sub.kernel32.dll_SizeofResource
mov dword [ebx + 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48afb0
lea eax, [ebp - 4]
call fcn.00407144
ret
Function at 0x403b1f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403b5e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403b5e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403b5e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403b5e
cmp dword [ecx + 0x74], 0xe
jbe 0x403b5e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40940e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412f08
push 0x412f00
push str.FlsAlloc
push 0x1f
call fcn.0040932a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409442
push dword [ebp + 8]
mov ecx, esi
call dword [0x41016c]
call esi
jmp 0x409448
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40948c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412f18
push 0x412f10
push str.FlsGetValue
push 0x21
call fcn.0040932a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4094c3
push dword [ebp + 8]
mov ecx, esi
call dword [0x41016c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4094cb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412f20
push 0x412f18
push str.FlsSetValue
push 0x22
call fcn.0040932a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409505
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41016c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40af54
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40aff1
push ebx
push esi
call fcn.0040af1d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409e3a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40af9e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aff0
push edi
push eax
call fcn.00408292
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40afbe
call fcn.00408258
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40afef
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409e3a
add esp, 0x20
test eax, eax
jne 0x40afdd
push edi
call fcn.00408258
jmp 0x40afe5
push ebx
call fcn.00408258
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40f2e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f30d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f30d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401130
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578af1
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6db3f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CAmkProgDlg.0
mov dword [ebp - 4], 2
mov ecx, dword [0x6dd3d0]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0x6dd3d0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xe4
call fcn.005237f5
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xd0
call fcn.00425a30
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00523676
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
call fcn.00522c27
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4018c0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578be8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x6db3f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp + 8]
mov dword [0x6dd3e8], eax
cmp dword [0x6dd3d8], 0
je 0x401921
cmp dword [0x6dd5d4], 0
je 0x401921
cmp dword [0x6dd3e8], 0
je 0x401917
push 8
mov ecx, dword [ebp - 0x64]
call fcn.00529a03
jmp 0x401921
push 0
mov ecx, dword [ebp - 0x64]
call fcn.00529a03
cmp dword [0x6dd3e8], 0
je 0x401a24
mov ecx, dword [0x6dd3d0]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call fcn.0042c3f0
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], edx
mov edx, dword [ebp - 0x64]
add edx, 0xd4
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x64]
add eax, 0xd0
push eax
mov ecx, dword [0x6dd068]
add ecx, 0x7c
call fcn.005273e7
lea ecx, [ebp - 0x18]
call fcn.00425070
mov dword [ebp - 4], 0
push 2
push 0x50
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push str.HK_PauseRun
call fcn.0041cf20
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0041bfd0
add esp, 0xc
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00425a30
lea ecx, [ebp - 0x10]
call fcn.00425070
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x18]
push edx
push str.Paused__Press__s_to_Continue
lea eax, [ebp - 0x10]
push eax
call fcn.00402b00
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.00529961
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00425a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00425a30
jmp 0x401a85
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd0]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.00529961
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd8]
push eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0xd4]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.0042c3f0
mov ecx, dword [ebp - 0x64]
sub eax, dword [ecx + 0xdc]
sbb edx, dword [ecx + 0xe0]
mov dword [0x6dd6a0], eax
mov dword [0x6dd6a4], edx
mov edx, dword [0x6dd3d0]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x401ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov dword [0x6dd068], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x401f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6dd060], eax
cmp dword [0x6dd068], 0
jne 0x401f25
push 0x6dd3c8
push 0x32
push 0xa
call fcn.00405a20
add esp, 0xc
jmp 0x401f09
pop ebp
ret
Function at 0x401fc0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov dword [0x6dd068], 0
push 0
mov eax, dword [0x6dd060]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x6dd060]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6dd060], 0
pop ebp
ret

Function at 0x403250
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4032bc
lea ecx, [ebp - 0x1c]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4032bc
xor eax, eax
jmp 0x4032d4
push 0x80020003
mov eax, dword [ebp + 8]
or eax, 0x10
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x404250
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578f48
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6db3f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
call fcn.00425070
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4042f3
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4042ed
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4042c4
mov dword [ebp - 0x2c], 0
jmp 0x4042d3
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00542109
add esp, 4
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402630
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp - 0x10]
sub edx, 0x10
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
push eax
call fcn.004028d0
add esp, 4
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x10
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00425a30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4047e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578f48
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6db3f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x10]
call fcn.00425070
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4048b0
mov eax, dword [0x6dd43c]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4048aa
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
movsx eax, byte [edx]
test eax, eax
je 0x4048a0
xor ecx, ecx
mov word [ebp - 0x20], cx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00404420
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x40487e
movzx ecx, word [ebp - 0x20]
test ecx, ecx
jne 0x404880
jmp 0x4048a0
mov dx, word [ebp - 0x20]
mov word [ebp - 0x4e], dx
movzx eax, word [ebp - 0x4e]
push eax
lea ecx, [ebp - 0x10]
call fcn.00425ca0
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
jmp 0x40484d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x10]
sub eax, 0x10
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.004028d0
add esp, 4
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
add edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00425a30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret