joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4194b0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp - 4]
push esi
push eax
push dword [0x47659c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x419539
cmp dword [ebp + 8], eax
je 0x419502
lea eax, [ebp - 0x108]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x4765dc
push eax
call fcn.00431e60
pop ecx
pop ecx
jmp 0x419509
and byte [ebp - 0x108], 0
lea eax, [ebp - 0x108]
push eax
call fcn.00431f60
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Knight_V
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x41c9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push 0
mov edi, 0x1000
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, ecx
and dword [ebp - 4], 0
push eax
push edi
push dword [esi + 4]
push dword [ebp + 8]
call ebx
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [esi + 8]
push dword [ebp + 8]
call ebx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push edi
push 0
push eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
call fcn.00432460
push edi
push 0
push dword [esi + 8]
call fcn.00432460
add esp, 0x18
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41ca13
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x14]
jb 0x41ca76
push ebx
push edi
lea eax, [ebp - 4]
push 0
mov edi, 0x1000
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edi
push dword [esi + 4]
push dword [ebp + 8]
call ebx
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [esi + 8]
push dword [ebp + 8]
call ebx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push edi
push 0
push eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
call fcn.00432460
push edi
push 0
push dword [esi + 8]
call fcn.00432460
add esp, 0x18
pop edi
pop ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [ebp + 0xc]
push 4
mov dword [ecx], eax
push dword [esi + 0x10]
mov edx, dword [esi]
mov ecx, esi
push eax
call dword [edx + 0x24]
add dword [esi + 0xc], 4
add dword [esi + 0x10], 4
push 1
pop eax
pop esi
leave
ret 8
Function at 0x41d466
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov edi, 0x104
cmp dword [esi + 0x3c], 0
je 0x41d4bb
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0x88]
push eax
call ebx
lea eax, [esi + 0x18c]
push eax
call ebx
push edi
lea eax, [esi + 0x88]
push 0
push eax
call fcn.00432460
push edi
lea eax, [esi + 0x18c]
push 0
push eax
call fcn.00432460
add esp, 0x18
mov ecx, esi
call fcn.0041e767
mov ebx, eax
shl ebx, 1
call fcn.0041d462
cmp eax, ebx
jb 0x41d60e
lea eax, [esi + 0x88]
push 0x47676c
push edi
push eax
mov dword [ebp - 0x1c], eax
call fcn.004195bc
add esp, 0xc
test eax, eax
je 0x41d5ff
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x41d601
mov eax, dword [esi + 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], ebx
jle 0x41d5c1
mov eax, dword [esi + 0x58]
mov ecx, dword [ebp - 0xc]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 4]
push eax
mov dword [ebp - 0x10], eax
call fcn.004497f2
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
je 0x41d5b2
push dword [ebp - 0x10]
mov edx, dword [esi]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call dword [edx + 0x24]
test eax, eax
je 0x41d5b2
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x14]
push 4
push eax
push dword [ebp - 4]
call edi
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push dword [ebp - 4]
call edi
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x41d5a9
push 1
push ebx
push 0xfffffffffffffff8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x18]
call fcn.0044981b
pop ecx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jl 0x41d533
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push 4
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], ebx
call edi
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push 4
push eax
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x19750001
mov dword [esi + 0x4c], ebx
call fcn.0041953e
pop ecx
xor eax, eax
jmp 0x41d611
xor ebx, ebx
push edi
push ebx
push dword [ebp - 0x1c]
call fcn.00432460
add esp, 0xc
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d616
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00433e10
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 0xffffffffffffffff
lea edi, [esi + 0x68]
push ebx
mov ecx, edi
call fcn.004444c1
add esi, 0x18c
push esi
call fcn.00431f60
test eax, eax
pop ecx
je 0x41d6b6
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x41d6b6
lea ecx, [ebp - 8]
push ebx
push ecx
lea ecx, [ebp - 0x1008]
push 0x1000
push ecx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d6ad
xor esi, esi
lea ebx, [ebp - 0x1008]
mov eax, dword [ebx]
cmp eax, 0x10000000
ja 0x41d6ad
push eax
mov ecx, edi
push dword [edi + 8]
call fcn.00443fdb
inc esi
add ebx, 4
cmp esi, 0x400
jl 0x41d68d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d916
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2128
call fcn.00433e10
push ebx
push esi
lea eax, [ecx + 0x18c]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], ecx
call fcn.00431e50
pop ecx
xor esi, esi
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 0x80
push 3
push esi
mov ebx, 0xc0000000
push esi
lea eax, [ebp - 0x128]
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x41dade
mov eax, dword [ebp - 4]
push 0x47676c
add eax, 0x18c
push 0x104
push eax
call fcn.004195bc
add esp, 0xc
test eax, eax
je 0x41dade
mov eax, dword [ebp - 4]
push esi
push 0x80
push 2
push esi
push esi
add eax, 0x18c
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x41dac4
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push eax
mov edi, 0x1000
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], esi
call ebx
test eax, eax
je 0x41da8c
cmp dword [ebp - 8], edi
jne 0x41da8c
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x41da5a
cmp dword [ebp - 8], edi
jne 0x41da5a
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax - 0x1128]
cmp eax, 0x10000000
mov dword [ebp - 0x14], eax
ja 0x41da51
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1c]
push 4
push edx
mov eax, dword [ecx]
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
call dword [eax + 0x24]
test eax, eax
je 0x41da51
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx - 0x2128]
jbe 0x41da51
push dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
push dword [ebp - 0x24]
call fcn.0041ca13
mov eax, dword [ebp - 4]
inc dword [eax + 0x4c]
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], edi
jl 0x41da02
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0x14]
test ecx, eax
jne 0x41d9db
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
push ebx
call fcn.0041c9b0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
mov dword [ebp - 0x18], esi
call edi
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x41dae1
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41dd41
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2128
call fcn.00433e10
push ebx
push esi
lea eax, [ecx + 0x18c]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], ecx
call fcn.00431e50
pop ecx
xor esi, esi
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 0x80
push 3
push esi
mov ebx, 0xc0000000
push esi
lea eax, [ebp - 0x128]
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x41df09
mov eax, dword [ebp - 4]
push 0x47676c
add eax, 0x18c
push 0x104
push eax
call fcn.004195bc
add esp, 0xc
test eax, eax
je 0x41df09
mov eax, dword [ebp - 4]
push esi
push 0x80
push 2
push esi
push esi
add eax, 0x18c
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x41deef
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push eax
mov edi, 0x1000
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], esi
call ebx
test eax, eax
je 0x41deb7
cmp dword [ebp - 8], edi
jne 0x41deb7
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x41de85
cmp dword [ebp - 8], edi
jne 0x41de85
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax - 0x1128]
cmp eax, 0x10000000
mov dword [ebp - 0x14], eax
ja 0x41de7c
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1c]
push 4
push edx
mov eax, dword [ecx]
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
call dword [eax + 0x24]
test eax, eax
je 0x41de7c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx - 0x2128]
jae 0x41de7c
push dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
push dword [ebp - 0x24]
call fcn.0041ca13
mov eax, dword [ebp - 4]
inc dword [eax + 0x4c]
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], edi
jl 0x41de2d
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0x14]
test ecx, eax
jne 0x41de06
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
push ebx
call fcn.0041c9b0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
mov dword [ebp - 0x18], esi
call edi
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x41df0c
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e16c
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2128
call fcn.00433e10
push ebx
push esi
lea eax, [ecx + 0x18c]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], ecx
call fcn.00431e50
pop ecx
xor esi, esi
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 0x80
push 3
push esi
mov ebx, 0xc0000000
push esi
lea eax, [ebp - 0x128]
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x41e334
mov eax, dword [ebp - 4]
push 0x47676c
add eax, 0x18c
push 0x104
push eax
call fcn.004195bc
add esp, 0xc
test eax, eax
je 0x41e334
mov eax, dword [ebp - 4]
push esi
push 0x80
push 2
push esi
push esi
add eax, 0x18c
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x41e31a
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push eax
mov edi, 0x1000
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], esi
call ebx
test eax, eax
je 0x41e2e2
cmp dword [ebp - 8], edi
jne 0x41e2e2
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x41e2b0
cmp dword [ebp - 8], edi
jne 0x41e2b0
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax - 0x1128]
cmp eax, 0x10000000
mov dword [ebp - 0x14], eax
ja 0x41e2a7
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1c]
push 4
push edx
mov eax, dword [ecx]
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
call dword [eax + 0x24]
test eax, eax
je 0x41e2a7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx - 0x2128]
jne 0x41e2a7
push dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
push dword [ebp - 0x24]
call fcn.0041ca13
mov eax, dword [ebp - 4]
inc dword [eax + 0x4c]
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], edi
jl 0x41e258
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0x14]
test ecx, eax
jne 0x41e231
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
push ebx
call fcn.0041c9b0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
mov dword [ebp - 0x18], esi
call edi
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x41e337
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e597
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2128
call fcn.00433e10
push ebx
push esi
lea eax, [ecx + 0x18c]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], ecx
call fcn.00431e50
pop ecx
xor esi, esi
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 0x80
push 3
push esi
mov ebx, 0xc0000000
push esi
lea eax, [ebp - 0x128]
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x41e75f
mov eax, dword [ebp - 4]
push 0x47676c
add eax, 0x18c
push 0x104
push eax
call fcn.004195bc
add esp, 0xc
test eax, eax
je 0x41e75f
mov eax, dword [ebp - 4]
push esi
push 0x80
push 2
push esi
push esi
add eax, 0x18c
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x41e745
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push eax
mov edi, 0x1000
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], esi
call ebx
test eax, eax
je 0x41e70d
cmp dword [ebp - 8], edi
jne 0x41e70d
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x41e6db
cmp dword [ebp - 8], edi
jne 0x41e6db
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax - 0x1128]
cmp eax, 0x10000000
mov dword [ebp - 0x14], eax
ja 0x41e6d2
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x1c]
push 4
push edx
mov eax, dword [ecx]
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
call dword [eax + 0x24]
test eax, eax
je 0x41e6d2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx - 0x2128]
je 0x41e6d2
push dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
push dword [ebp - 0x24]
call fcn.0041ca13
mov eax, dword [ebp - 4]
inc dword [eax + 0x4c]
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], edi
jl 0x41e683
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x1128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x2128]
push edi
push eax
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0x14]
test ecx, eax
jne 0x41e65c
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
push ebx
call fcn.0041c9b0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
mov dword [ebp - 0x18], esi
call edi
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x41e762
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41fa8d
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x41fa9e
pop esi
ret
push ebx
xor ebx, ebx
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41fae3
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x41fadc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41fadc
push dword [esi + 0x3c]
mov ecx, esi
push eax
call fcn.0041fa07
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x420354
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.00420462
cmp dword [esi + 0x204], 0
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x420376
mov ecx, esi
call fcn.00420507
jmp 0x420394
push 0
push 1
push 0xcf
push dword [esi + 0x1d4]
call edi
push 0
lea ecx, [esi + 0xc8]
call fcn.00448ebd
mov ecx, esi
call fcn.004207c5
push dword [esi + 0x1f8]
mov ebx, 0x400
push ebx
push 0xd
push dword [esi + 0x198]
call edi
test eax, eax
je 0x4203ce
push dword [esi + 0x1f8]
push ebx
push 0xd
push dword [esi + 0x15c]
call edi
test eax, eax
je 0x4203ce
push 1
jmp 0x4203d0
push 0
lea ecx, [esi + 0x8c]
call fcn.00448ebd
pop edi
pop esi
pop ebx
ret

Function at 0x420462
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x1f4]
mov ebx, 0x400
push ebx
push 0xd
push dword [esi + 0x1d4]
call edi
test eax, eax
je 0x4204cc
push 1
lea ecx, [esi + 0x17c]
call fcn.00448ebd
push 1
lea ecx, [esi + 0x140]
call fcn.00448ebd
xor ebp, ebp
push ebp
push ebp
push 0xcf
push dword [esi + 0x120]
call edi
push dword [esi + 0x1f8]
push ebx
push 0xd
push dword [esi + 0x198]
call edi
test eax, eax
je 0x4204f6
push 1
jmp 0x4204f7
xor ebp, ebp
lea ecx, [esi + 0x17c]
push ebp
call fcn.00448ebd
push ebp
lea ecx, [esi + 0x140]
call fcn.00448ebd
push ebp
push 1
push 0xcf
push dword [esi + 0x120]
call edi
push ebp
lea ecx, [esi + 0x8c]
call fcn.00448ebd
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4211ff
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov ebp, 0x147
mov esi, ecx
push ebx
push ebp
push dword [esi + 0x198]
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x421279
push ebx
push ebx
push 0xc
push dword [esi + 0x120]
call edi
push ebx
lea ecx, [esi + 0x1b8]
call fcn.00448ebd
push ebx
lea ecx, [esi + 0x140]
call fcn.00448ebd
push ebx
push 1
push 0xcf
push dword [esi + 0xe4]
call edi
push ebx
push ebx
push 0xc
push dword [esi + 0xa8]
call edi
push ebx
lea ecx, [esi + 0x230]
call fcn.00448ebd
push ebx
jmp 0x421308
push 1
lea ecx, [esi + 0x104]
call fcn.00448ebd
push dword [esp + 0x10]
mov ecx, esi
call fcn.00421319
push ebx
push ebx
push ebp
push dword [esi + 0x120]
call edi
cmp eax, 0xffffffff
je 0x4212ca
push 1
lea ecx, [esi + 0x1b8]
call fcn.00448ebd
push 1
lea ecx, [esi + 0x140]
call fcn.00448ebd
push ebx
push ebx
push 0xcf
push dword [esi + 0xe4]
call edi
push 1
lea ecx, [esi + 0x230]
call fcn.00448ebd
push dword [esi + 0x274]
mov ebx, 0x400
push ebx
push 0xd
push dword [esi + 0x15c]
call edi
test eax, eax
je 0x421313
push dword [esi + 0x274]
push ebx
push 0xd
push dword [esi + 0x1d4]
call edi
test eax, eax
je 0x421313
push 1
lea ecx, [esi + 0x1f4]
call fcn.00448ebd
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4228b1
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x304
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov esi, ecx
push ebx
push 0x1009
push dword [esi + 0x78]
call dword [sym.imp.USER32.dll_SendMessageA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
cmp edi, ebx
je 0x422a7f
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x422a7f
push 5
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
cmp edi, ebx
je 0x422a6b
push ebp
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x422a57
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x422a57
cmp edi, dword [esi + 0x1c]
je 0x422a57
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x422a57
mov ebp, 0x200
lea eax, [esp + 0x114]
push ebp
push ebx
push eax
call fcn.00432460
add esp, 0xc
lea eax, [esp + 0x114]
push ebp
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x422a57
push edi
mov ecx, esi
call fcn.00422a89
test eax, eax
jne 0x422a57
push 0xfffffffffffffff2
push edi
call dword [sym.imp.USER32.dll_GetClassLongA]
cmp eax, ebx
jne 0x422992
push ebx
push ebx
push 0x7f
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
je 0x4229d6
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov ebp, eax
cmp ebp, ebx
je 0x422a43
push ebp
push 0xffffffffffffffff
push dword [esi + 0x9c]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push ebx
push eax
push ebx
lea eax, [esp + 0x120]
push ebx
push eax
push ebx
push 3
lea ecx, [esi + 0x5c]
call fcn.00442ad6
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x422a43
lea eax, [esp + 0x14]
push 0x100
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov byte [esp + eax + 0x14], bl
lea eax, [esp + 0x14]
push 0x4765fc
push eax
call fcn.00433720
pop ecx
test eax, eax
pop ecx
jne 0x422a43
call fcn.00454a78
call fcn.00454a78
mov eax, dword [eax + 0xc]
push 0xaf
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0xffffffffffffffff
push dword [esi + 0x9c]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push ebx
push eax
push ebx
lea eax, [esp + 0x120]
push ebx
push eax
push ebx
push 3
lea ecx, [esi + 0x5c]
call fcn.00442ad6
mov dword [esp + 0x10], eax
push edi
push ebx
push ebx
push ebx
push ebx
push 4
push ebx
lea ecx, [esi + 0x5c]
push dword [esp + 0x2c]
call fcn.00442b58
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
cmp edi, ebx
jne 0x422901
pop ebp
push 0xffff
push ebx
push 0x101e
push dword [esi + 0x78]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
add esp, 0x304
ret