joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a090
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
mov edi, eax
movzx eax, word [esi]
cmp eax, 0x41
je 0x47a0a1
cmp eax, 0x61
jne 0x47a108
cmp word [esi + 2], 0
jne 0x47a108
mov eax, dword [esp + 0x10]
cmp word [eax], 0
jne 0x47a108
cmp word [ebx], 0
jne 0x47a108
cmp word [edi], 0
jne 0x47a108
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
test ebp, ebp
je 0x47a108
mov ecx, dword [esp + 0xc]
cmp byte [ecx + 0xea], 0
jne 0x47a0ef
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47a108
push ebp
call fcn.0047b380
add esp, 4
test al, al
jne 0x47a108
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x47a103
push 9
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebp
pop edi
pop ebp
ret
mov eax, dword [esp + 0x14]
test al, al
jne 0x47a13c
cmp word [esi], 0
jne 0x47a13c
mov edx, dword [esp + 0x10]
cmp word [edx], 0
jne 0x47a13c
cmp word [ebx], 0
jne 0x47a13c
cmp word [edi], 0
jne 0x47a13c
mov eax, dword [esp + 0xc]
call fcn.0047a930
test eax, eax
jne 0x47a161
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push 0
push eax
mov eax, dword [esp + 0x1c]
push ebx
mov ecx, edi
mov edi, dword [esp + 0x24]
push eax
mov edx, esi
call fcn.0047a720
add esp, 0x18
jmp 0x47a135
pop edi
pop ebp
jmp fcn.0047a1d0
Function at 0x47a1d0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, eax
test edi, edi
je 0x47a38e
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebp
mov dword [esp + 0x1c], eax
cmp eax, dword [0x4cb4f0]
je 0x47a207
mov esi, edi
call fcn.0047b300
test al, al
jne 0x47a38e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x47a223
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, ebx
jne 0x47a231
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp byte [0x4ca6a0], 0
jne 0x47a24b
push ebx
call fcn.0047a170
add esp, 4
test eax, eax
jne 0x47a390
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
test ebx, ebx
je 0x47a2ae
push 0
push ebx
call ebp
mov ebp, eax
mov dword [esp + 0x20], ebp
test ebp, ebp
je 0x47a2ae
cmp dword [0x4cb4f0], ebp
je 0x47a291
mov esi, ebx
call fcn.0047b300
test al, al
jne 0x47a291
mov eax, dword [0x4cb4f0]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x16]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47a2ae
cmp ebp, eax
je 0x47a2ae
push 1
push eax
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x17]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x18], 0
push edi
call esi
push 1
push 0xa
mov dword [0x4c694c], 0
call fcn.004013d0
add esp, 8
mov dword [0x4c694c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x47a2ef
mov ebp, edi
jmp 0x47a300
cmp ebp, ebx
je 0x47a304
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x47a304
test ebp, ebp
jne 0x47a345
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 5
jl 0x47a2bc
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.00410dc0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.00410dc0
push ebx
call fcn.0047a170
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x16], 0
je 0x47a360
mov ecx, dword [esp + 0x20]
mov edx, dword [0x4cb4f0]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x17], 0
je 0x47a379
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x47a38e
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x47a4a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x47a4b0
mov eax, esi
call fcn.00455f30
jmp 0x47a4bd
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 4]
test eax, eax
js 0x47a518
je 0x47a518
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.004013d0
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x47a515
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x47a515
push 1
push 0x8000012f
call fcn.004013d0
add esp, 8
push esi
call ebx
test eax, eax
jne 0x47a4f4
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x47a720
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049af30
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x47a74c
cmp ecx, 0x61
jne 0x47a7ae
cmp word [edx + 2], bx
jne 0x47a7ae
cmp word [edi], bx
jne 0x47a7ae
cmp word [eax], bx
jne 0x47a7ae
cmp word [esi], bx
jne 0x47a7ae
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x47a78f
cmp byte [ebp + 0xea], bl
jne 0x47a78f
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47a78d
push esi
call fcn.0047b380
add esp, 4
test al, al
je 0x47a78f
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x47a7a2
cmp esi, ebx
je 0x47a7a2
mov dword [ebp + 0xc4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x47a7d3
cmp word [edi], bx
jne 0x47a7d3
cmp word [eax], bx
jne 0x47a7d3
cmp word [esi], bx
jne 0x47a7d3
mov eax, ebp
call fcn.0047a930
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x4a3890
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.0047b4e0
test eax, eax
je 0x47a8e2
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov ecx, dword [esp + 0x11c88]
mov edx, dword [esp + 0x11c8c]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ecx
mov dword [esp + 0x184c], edx
je 0x47a8ee
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x47a8ba
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47a8e2
cmp byte [ebp + 0xea], bl
jne 0x47a8b3
mov esi, dword [esp + 0x102c]
call fcn.0047b3f0
cmp al, bl
jne 0x47a8b3
mov eax, dword [esp + 0x102c]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x47a8e2
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x47a8d3
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.0047b940
push ebx
lea ecx, [esp + 0x14]
push ecx
call fcn.0047ba00
test eax, eax
jne 0x47a8fe
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea edx, [esp + 0x10]
push edx
push 0x47a9b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x47a918
cmp eax, ebx
je 0x47a918
mov dword [ebp + 0xc4], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x47b940
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x47b9fe
mov eax, dword [esi]
test eax, eax
je 0x47b9fe
push edi
test al, 1
jne 0x47b96a
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x47b986
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x47b986
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x47b9a1
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x47b9df
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x47b9df
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.00451d50
add esp, 4
test eax, eax
jne 0x47b9df
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x47b9fe
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x47c240
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.0049af30
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47c2ed
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x47c9c0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x4a3890
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x47c2ed
mov ecx, dword [0x4c6a44]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x47c2ed
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x47c300
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47c31c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c6a44]
push eax
push esi
mov ecx, edi
call fcn.0047c7c0
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x47c353
test eax, eax
jne 0x47c357
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.0047c410
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x47c3d6
test esi, esi
je 0x47c3d6
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.004013d0
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x47c3b5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x47c3b5
push 1
push 0x8000012f
call fcn.004013d0
add esp, 8
push esi
call edi
test eax, eax
jne 0x47c390
mov edx, dword [0x4c6a44]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47c3ce
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x47c3f0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.0047c410
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.0047c590
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x47c590
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049af30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47c710
xor cl, cl
mov eax, edi
call fcn.0047c730
test eax, eax
jne 0x47c5c5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c6a44]
push eax
push ebp
mov ecx, edi
call fcn.0047c7c0
test eax, eax
je 0x47c5e8
xor eax, eax
mov dword [0x4cb4e8], eax
jmp 0x47c5ed
mov eax, dword [0x4cb4e8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4a3890
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x47c633
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x47c63b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4cb4e4]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x47c890
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x47c6e8
lea ecx, [esp + 0x10]
push ecx
push 0x47b250
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47c6a5
mov edx, dword [esp + 0x1848]
call fcn.0047bed0
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.0047a1d0
mov edx, dword [esp + 0x1848]
call fcn.0047bed0
mov edx, dword [0x4c6a44]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47c710
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4cb4e8]
cmp eax, ebx
je 0x47c710
cmp eax, 1
setg al
mov dword [0x4cb4e8], ebx
cmp al, bl
je 0x47c710
mov edx, ebp
call fcn.0047bed0
push ebx
mov ecx, edi
call fcn.0047c590
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x4966b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c5dd0]
jne 0x4966c0
repz ret
jmp fcn.0049ac46

Function at 0x498e50
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c5dd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00493582
and dword [ebp - 0x14], 0
cmp dword [0x4c8cd4], 0
mov dword [ebp - 0x18], eax
jne 0x498f03
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x498fab
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a3020
push ebx
call edi
test eax, eax
je 0x498fab
mov esi, dword [fcn.0048f930]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c8cd4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c8cd8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c8cdc], eax
call edi
push eax
call esi
mov dword [0x4c8ce4], eax
test eax, eax
je 0x498f03
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c8ce0], eax
mov eax, dword [0x4c8ce0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048f934]
cmp eax, ecx
je 0x498f5c
cmp dword [0x4c8ce4], ecx
je 0x498f5c
push eax
call esi
push dword [0x4c8ce4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x498f5c
test ebx, ebx
je 0x498f5c
call edi
test eax, eax
je 0x498f53
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x498f53
test byte [ebp - 8], 1
jne 0x498f5c
or dword [ebp + 0x10], 0x200000
jmp 0x498f8f
mov eax, dword [0x4c8cd8]
cmp eax, dword [ebp - 0x18]
je 0x498f8f
push eax
call esi
test eax, eax
je 0x498f8f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x498f8f
mov eax, dword [0x4c8cdc]
cmp eax, dword [ebp - 0x18]
je 0x498f8f
push eax
call esi
test eax, eax
je 0x498f8f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c8cd4]
call esi
test eax, eax
je 0x498fab
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x498fad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004966b6
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401836
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x42a15f
call fcn.00429110
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004026e1
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0040188f
lea ecx, [esi + 0x30]
call fcn.004026e1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4038b8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
and dword [ebp - 4], 0
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
mov edi, edx
lea ecx, [ebp - 4]
push 0x2002
call fcn.00405503
test al, al
jne 0x4038df
xor bl, bl
jmp 0x403915
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4038db
push dword [ebp + 8]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4038db
and dword [ebp - 4], 0
mov bl, 1
lea ecx, [ebp - 4]
call fcn.00405524
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403ac7
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x403c53
Capabilities:
Create directory

Disassembly:
mov eax, 0x42a374
call fcn.00429110
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x403c76
mov al, 1
jmp 0x403cbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403c87
xor al, al
jmp 0x403cbc
lea ecx, [ebp - 0x44]
call fcn.00403e1b
lea ecx, [ebp - 0x1c]
call fcn.004026e1
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.004040d2
test al, al
je 0x403cb1
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.004021bf
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4040c3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4040d1
or eax, eax
ret
Function at 0x404786
Capabilities:
Get disk information

Disassembly:
mov eax, 0x42a438
call fcn.00429110
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401f98
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x40485c
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4047c2
mov eax, ebx
add eax, eax
push eax
call fcn.00402198
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x404855
cmp ebx, dword [ebp - 0x18]
ja 0x404855
lea ecx, [ebp - 0x2c]
call fcn.004026e1
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x40483d
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x404832
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00402820
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.00411509
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401d9e
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x404800
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.004021bf
push esi
call fcn.004021bf
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x40485e
push esi
call fcn.004021bf
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4048e3
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40490d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40490d
xor al, al
jmp 0x40492d
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004293f0
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop edi
leave
ret 4
Function at 0x40e316
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x42ae76
call fcn.00429110
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.004026e1
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040e365
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40e3c2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42aec1
call fcn.00429110
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.00410941
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040e40d
push dword [esi + 0x24]
call fcn.004021bf
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00401b4f
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040e96f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x411c6b
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x2b4
push eax
push 0x90
push 0x42d7d8
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret

Function at 0x412c79
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x42b620
call fcn.00429110
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x42e11c
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.004026e1
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.004026e1
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.004026e1
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004026e1
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.004026e1
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42e0e0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret