joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422490
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x42258e
mov eax, dword [ebp - 0x3c]
xor edx, edx
call fcn.0040bbd0
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0041e220
jmp 0x42257d
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040bb80
mov edx, dword [ebp - 4]
mov ecx, 1
mov al, 0x3d
call fcn.0040c630
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebx - 1]
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040c580
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0041e220
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.0040c2e0
test eax, eax
jne 0x42256c
push dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
test eax, eax
je 0x422558
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea eax, [ebx + 1]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0040c580
jmp 0x422588
mov eax, esi
call fcn.00404b00
shl eax, 1
lea eax, [esi + eax]
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x422500
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
call fcn.0040ec50
lea eax, [ebp - 0x38]
call fcn.0040b910
lea eax, [ebp - 0x34]
call fcn.0040b910
lea eax, [ebp - 4]
call fcn.0040b910
lea eax, [ebp - 8]
call fcn.0040b910
pop eax
test eax, eax
je 0x4225bd
call fcn.0040ed80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x444ed0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x444eec
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452980
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x334]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x334], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x452af8
mov eax, edi
xor edx, edx
call fcn.00409190
mov eax, esi
xor edx, edx
call fcn.00409190
call sub.kernel32.dll_GetUserDefaultLCID
mov ebx, eax
push 4
lea eax, [ebp - 4]
push eax
push 3
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x452a40
lea eax, [ebp - 0x230]
push eax
push 3
push 0
lea ecx, [ebp - 4]
mov edx, 0xff
lea eax, [ebp - 0x330]
call fcn.00404a70
lea eax, [ebp - 0x330]
mov ecx, 2
mov edx, 1
call fcn.004050e0
lea eax, [ebp - 0x230]
lea edx, [ebp - 0x130]
call fcn.004051d0
lea eax, [ebp - 0x130]
mov ecx, esi
xor dx, dx
call fcn.00409a00
nop
push 4
lea eax, [ebp - 4]
push eax
push 7
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x452af8
lea eax, [ebp - 0x130]
push eax
push 3
push 0
lea ecx, [ebp - 4]
mov edx, 0xff
lea eax, [ebp - 0x230]
call fcn.00404a70
lea eax, [ebp - 0x230]
mov ecx, 2
mov edx, 1
call fcn.004050e0
lea eax, [ebp - 0x130]
lea ecx, [ebp - 8]
xor dx, dx
call fcn.00409a00
push 0
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 4]
xor cx, cx
mov edx, 3
call fcn.00409b70
mov eax, dword [ebp - 0x334]
mov edx, 0x63c340
call fcn.00409d40
test eax, eax
jne 0x452ad4
lea eax, [ebp - 8]
mov edx, 0x63c350
call fcn.00409190
push 0
mov eax, dword [esi]
mov dword [ebp - 0x3c], eax
mov eax, 0x63c360
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x3c]
mov eax, edi
mov ecx, 2
call fcn.00409500
call fcn.0040ec50
lea eax, [ebp - 0x334]
call fcn.00403ec0
lea eax, [ebp - 8]
call fcn.00403ec0
pop eax
test eax, eax
je 0x452b1a
call fcn.0040ed80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457f70
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
mov byte [ebp - 4], al
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x4580c0
cmp byte [ebp - 4], 0
je 0x45806c
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040b050
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040b050
lea eax, [ebp - 0x44]
call fcn.0040b910
movzx eax, byte [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x48]
call fcn.0040bfd0
mov edx, dword [ebp - 0x48]
mov ecx, 0x63cfb8
lea eax, [ebp - 0x44]
call fcn.0040bc10
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
call fcn.0040bb10
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x45806c
push 0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea ecx, [ebp - 0x4c]
xor dx, dx
call fcn.00409a70
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov ecx, 0x63cfc8
call fcn.00409290
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x4580c0
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040b050
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040b050
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x4c]
call fcn.0040b770
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00409190
cmp byte [ebp - 4], 0
je 0x4580c0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
call fcn.0040ec50
lea eax, [ebp - 0x4c]
call fcn.00403ec0
lea eax, [ebp - 0x48]
call fcn.0040b910
lea eax, [ebp - 0x44]
call fcn.0040b910
lea eax, [ebp - 0xc]
call fcn.0040a950
lea eax, [ebp - 0x10]
call fcn.0040a950
lea eax, [ebp - 0x14]
call fcn.0040a950
pop eax
test eax, eax
je 0x4580ff
call fcn.0040ed80
mov esp, ebp
pop ebp
ret

Function at 0x458250
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x45829b
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x34]
call fcn.0040d2a0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x458292
mov eax, 0x6c22f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
call fcn.0040ec50
lea eax, [ebp - 0x34]
call fcn.0040b910
pop eax
test eax, eax
je 0x4582b2
call fcn.0040ed80
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4594b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x45955a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x459576
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x459576
sub dx, 0x20
je 0x459550
sub dx, 0x80
je 0x459550
sub dx, 0x1f62
jb 0x459576
sub dx, 1
jbe 0x459550
sub dx, 6
je 0x459550
sub dx, 0x26
jne 0x459576
nop
jmp 0x459550
mov edx, dword [ebp - 0x20]
cmp edx, eax
jl 0x4594f8
nop
jmp 0x459576
cmp dword [ebp - 0x1c], 2
jne 0x45956a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x459576
mov al, byte [ebp - 0xc]
call fcn.0040bee0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x4595f4
sub ax, 0x21
je 0x459608
sub ax, 0x17
je 0x459614
sub ax, 0x222
je 0x459620
sub ax, 0x392
je 0x459628
sub ax, 1
je 0x459630
sub ax, 0x1996
je 0x459638
sub ax, 1
je 0x459640
sub ax, 6
je 0x459648
sub ax, 0xb
je 0x459658
sub ax, 0x1b
je 0x459650
sub ax, 0x367
je 0x459660
jmp 0x459668
mov ax, word [ebp - 0x24]
call fcn.0040bf50
mov byte [ebp - 0x10], al
jmp 0x459670
mov byte [ebp - 0x10], 0x20
jmp 0x459670
mov byte [ebp - 0x10], 0x2e
jmp 0x459670
mov byte [ebp - 0x10], 0x27
jmp 0x459670
mov byte [ebp - 0x10], 0x2c
jmp 0x459670
mov byte [ebp - 0x10], 0x27
jmp 0x459670
mov byte [ebp - 0x10], 0x20
jmp 0x459670
mov byte [ebp - 0x10], 0x20
jmp 0x459670
mov byte [ebp - 0x10], 0x20
jmp 0x459670
mov byte [ebp - 0x10], 0x20
jmp 0x459670
mov byte [ebp - 0x10], 0x2d
jmp 0x459670
mov byte [ebp - 0x10], 0x27
jmp 0x459670
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4e5cc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 4]
mov edi, edx
mov dword [esp], eax
lea eax, [ecx - 1]
mov esi, eax
test esi, esi
jl 0x4e5d0c
mov ebx, 0xffffffff
lea esi, [esi]
lea eax, [ebx + 1]
mov ebx, eax
mov al, byte [esp]
mov dl, byte [edi]
xor dl, al
movzx eax, dl
mov ecx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ecx*4 + 0x6c5090]
xor edx, eax
mov dword [esp], edx
add edi, 1
cmp ebx, esi
jl 0x4e5ce0
mov esi, esi
mov eax, dword [esp]
lea esp, [esp + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x4edf60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
lea edx, [edx + ecx]
jmp 0x4edf91
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor esi, ecx
mov eax, esi
add ebx, 1
cmp ebx, edx
jb 0x4edf80
pop esi
pop ebx
ret

Function at 0x4f6180
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4f61b4
mov eax, esi
call fcn.004fa730
cmp byte [esi + 0x40], 0
je 0x4f61ac
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4f6265
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4f6244
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4f623c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4f61e8
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4f6200
xor bl, bl
jmp 0x4f6265
cmp edi, 2
je 0x4f623a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4f61d8
cmp edi, 3
je 0x4f6218
cmp edi, 1
jne 0x4f61d8
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4f61d8
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4f61d8
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4f625c
cmp dword [esi + 0x14], 0xcc
je 0x4f625c
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004f65a0
lea esi, [esi]
mov eax, esi
call fcn.004f6270
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x51e1c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x28], 0
je 0x51e208
mov eax, dword [0x5d9b30]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x164]
cmp eax, dword [edx + 0x28]
jne 0x51e208
mov eax, dword [0x5d9b30]
cmp byte [eax + 0x110], 0
jne 0x51e208
mov eax, dword [0x5dbff0]
mov edx, dword [0x5dbff0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x5dbff0]
mov edx, dword [0x5dbff0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x51e2ff
mov eax, dword [0x5d9b30]
cmp byte [eax + 0x110], 0
jne 0x51e2ff
mov eax, dword [0x5dbff0]
mov edx, dword [0x5dbff0]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.005532f0
mov eax, dword [0x5d9b30]
cmp dword [eax + 0x164], 0
je 0x51e2c4
push 0x10
push 0
mov eax, dword [0x5d9b30]
mov eax, dword [eax + 0x164]
push dword [eax + 0x240]
mov eax, dword [0x5d9b30]
mov eax, dword [eax + 0x164]
push dword [eax + 0x234]
mov eax, dword [0x5d9b30]
mov eax, dword [eax + 0x164]
push dword [eax + 0x12c]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5d9b30]
mov eax, dword [eax + 0x164]
call fcn.004abb30
test al, al
je 0x51e2c4
push 0
mov eax, dword [0x5d9b30]
call fcn.0042ece0
push eax
call sub.user32.dll_ShowWindow
nop
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5d9b30]
call fcn.00431a90
jmp 0x51e398
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x51e354
mov eax, dword [ebp - 4]
mov edx, dword [0x5d9b30]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x164]
jne 0x51e354
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5d9b30]
call fcn.00431a90
jmp 0x51e398
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x51e398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x460], 8
je 0x51e398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5dbff0]
mov edx, dword [0x5dbff0]
mov edx, dword [edx]
call dword [edx + 0x8c]
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x523620
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.00521fc0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00413ea0
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x6c22c0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x523678
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
mov esi, esi
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, str.Window
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x5236f4
or dword [ebp - 0x30], 0x800
cmp dword [0x622f10], 6
jb 0x5236cc
or dword [ebp - 0x30], 0x20000
mov esi, esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov esi, esi
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x524650
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x524700
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x524700
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x5246df
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040ec50
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x5246f9
call fcn.0040ed80
mov byte [ebp - 0xc], 1
lea esi, [esi]
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x524d80
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x78]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x524ecd
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x524e68
lea eax, [ebp - 0x44]
call fcn.00403ec0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
call fcn.0046fdd0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x54]
call fcn.00403ec0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x54]
call fcn.0046fd20
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
call fcn.00472370
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x4c]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.00473680
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x524ecd
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x524eab
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
call fcn.0040ec50
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x524ec2
call fcn.0040ed80
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
call fcn.0040ec50
lea eax, [ebp - 0x54]
call fcn.00403ec0
lea eax, [ebp - 0x44]
call fcn.00403ec0
pop eax
test eax, eax
je 0x524eec
call fcn.0040ed80
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x553710
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
mov eax, 1
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x5537a1
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040b050
cmp dword [ebp - 0xc], 0
jbe 0x553780
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x553773
mov eax, 0x6c22f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
nop
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040b050
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x3c]
call fcn.0040bb40
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
call fcn.0045e780
call fcn.0040ec50
lea eax, [ebp - 0x3c]
call fcn.0040b910
lea eax, [ebp - 0x10]
call fcn.0040a950
pop eax
test eax, eax
je 0x5537c0
call fcn.0040ed80
mov esp, ebp
pop ebp
ret
Function at 0x573100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 8]
test edx, edx
jne 0x573117
mov edx, 0x6c22f0
lea eax, [ebp + 0xc]
push eax
push ecx
lea eax, [ebp - 4]
push eax
push 0
push edx
push dword [ebx + 0x14]
call sub.advapi32.dll_RegQueryValueExA
mov dword [ebx + 4], eax
test eax, eax
je 0x573139
mov eax, 0xffffffff
jmp 0x57317a
cmp dword [ebp - 4], 1
jne 0x573147
mov dword [esi], 1
jmp 0x573177
cmp dword [ebp - 4], 2
jne 0x573155
mov dword [esi], 2
jmp 0x573177
cmp dword [ebp - 4], 4
jne 0x573163
mov dword [esi], 4
jmp 0x573177
cmp dword [ebp - 4], 3
jne 0x573171
mov dword [esi], 3
jmp 0x573177
mov dword [esi], 0
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5733f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x573418
sub eax, 1
je 0x57341c
sub eax, 1
je 0x573424
sub eax, 1
je 0x573434
sub eax, 1
je 0x57342c
jmp 0x57343c
xor eax, eax
jmp 0x57343c
mov eax, 1
jmp 0x57343c
mov eax, 2
jmp 0x57343c
mov eax, 4
jmp 0x57343c
mov eax, 3
lea esi, [esi]
test edx, edx
jne 0x573445
mov edx, 0x6c22f0
push esi
push ecx
push eax
push 0
push edx
push dword [ebx + 0x14]
call sub.advapi32.dll_RegSetValueExA
mov dword [ebx + 4], eax
test eax, eax
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x57a160
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x84]
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov eax, 1
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57a214
push 0x80000000
mov eax, str.ServicesActive
push eax
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
push 0x24
mov eax, str.Dnscache
push eax
push dword [ebp - 0x10]
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
push 0x1c
lea eax, [ebp - 0x30]
push eax
call fcn.0045ec70
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x14]
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x57a214
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
cmp eax, 1
je 0x57a208
cmp eax, 7
je 0x57a208
mov eax, dword [ebp - 4]
mov byte [eax], 1
cmp byte [ebp - 8], 0
je 0x57a208
lea eax, [ebp - 0x30]
push eax
push 1
push dword [ebp - 0x14]
call sub.advapi32.dll_ControlService
lea esi, [esi]
mov byte [ebp - 0xc], 1
push dword [ebp - 0x14]
call sub.advapi32.dll_CloseServiceHandle
call fcn.0040ec50
pop eax
test eax, eax
je 0x57a250
mov eax, 1
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x68]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57a23c
mov byte [ebp - 0xc], 0
call fcn.0040ec50
pop eax
test eax, eax
je 0x57a24b
call fcn.0040ee80
call fcn.0040ee70
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret