joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ed70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x334]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x45eef2
mov eax, edi
mov edx, 0
call fcn.00409430
mov eax, ebx
mov edx, 0
call fcn.00409430
call sub.kernel32.dll_GetUserDefaultLCID
mov esi, eax
push 4
lea eax, [ebp - 4]
push eax
push 3
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x45ee3e
lea eax, [ebp - 0x234]
push eax
push 3
push 0
lea ecx, [ebp - 4]
lea eax, [ebp - 0x334]
mov edx, 0xff
call fcn.00404620
lea eax, [ebp - 0x334]
mov ecx, 2
mov edx, 1
call fcn.00404ce0
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x134]
call fcn.00404f20
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x34]
mov dx, 0
call fcn.00409c80
mov edx, dword [ebp - 0x34]
mov eax, ebx
call fcn.00409430
push 4
lea eax, [ebp - 4]
push eax
push 7
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x45eef2
lea eax, [ebp - 0x134]
push eax
push 3
push 0
lea ecx, [ebp - 4]
lea eax, [ebp - 0x234]
mov edx, 0xff
call fcn.00404620
lea eax, [ebp - 0x234]
mov ecx, 2
mov edx, 1
call fcn.00404ce0
lea eax, [ebp - 0x134]
lea ecx, [ebp - 8]
mov dx, 0
call fcn.00409c80
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 4]
mov cx, 0
mov edx, 3
call fcn.00409df0
mov eax, dword [ebp - 0x34]
mov edx, 0x78b55c
call fcn.0040a0a0
test eax, eax
jne 0x45eece
mov edx, 0x78b56c
lea eax, [ebp - 8]
call fcn.00409430
push 0
mov eax, dword [ebx]
mov dword [ebp - 0x40], eax
mov eax, 0x78b57c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x40]
mov eax, edi
mov ecx, 2
call fcn.004097a0
call fcn.0040ebd0
lea eax, [ebp - 0x34]
call fcn.00404190
lea eax, [ebp - 8]
call fcn.00404190
pop eax
test eax, eax
je 0x45ef11
call fcn.0040ed00
pop edi
pop esi
pop ebx
leave
ret
Function at 0x478a80
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
mov byte [ebp - 4], al
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x478bd5
cmp byte [ebp - 4], 0
je 0x478b7f
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040b460
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040b460
lea eax, [ebp - 0x44]
call fcn.0040bbc0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x48]
call fcn.0040c2c0
mov edx, dword [ebp - 0x48]
mov ecx, 0x78ff68
lea eax, [ebp - 0x44]
call fcn.0040bf00
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
call fcn.0040bdb0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x478b7f
push 0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea ecx, [ebp - 0x4c]
mov dx, 0
call fcn.00409cf0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov ecx, 0x78ff78
call fcn.00409530
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x478bd5
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040b460
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040b460
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
call fcn.0040ba10
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00409430
cmp byte [ebp - 4], 0
je 0x478bd5
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
call fcn.0040ebd0
lea eax, [ebp - 0x4c]
call fcn.00404190
lea eax, [ebp - 0x48]
call fcn.0040bbc0
lea eax, [ebp - 0x44]
call fcn.0040bbc0
lea eax, [ebp - 0xc]
call fcn.0040ad40
lea eax, [ebp - 0x10]
call fcn.0040ad40
lea eax, [ebp - 0x14]
call fcn.0040ad40
pop eax
test eax, eax
je 0x478c14
call fcn.0040ed00
leave
ret

Function at 0x478d50
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x478d9b
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0040d4b0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x478d92
mov eax, 0x8e12e0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
call fcn.0040ebd0
lea eax, [ebp - 0x34]
call fcn.0040bbc0
pop eax
test eax, eax
je 0x478db2
call fcn.0040ed00
mov eax, dword [ebp - 8]
leave
ret
Function at 0x498d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 4]
mov edi, edx
mov dword [esp], eax
lea eax, [ecx - 1]
mov esi, eax
mov ecx, 0
cmp esi, ecx
jl 0x498d58
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov al, byte [esp]
mov dl, byte [edi]
xor dl, al
movzx eax, dl
mov ebx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ebx*4 + 0x8e31b0]
xor edx, eax
mov dword [esp], edx
add edi, 1
cmp esi, ecx
jg 0x498d30
mov eax, dword [esp]
lea esp, [esp + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x4b7e00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x50]
mov dword [ebp - 4], eax
call fcn.00409400
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x50], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x4b7efb
mov byte [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4b7efb
mov eax, dword [ebp - 4]
call fcn.004b7a30
mov byte [ebp - 0x18], al
test al, al
je 0x4b7e76
mov eax, dword [ebp - 4]
call fcn.004b7aa0
test al, al
je 0x4b7e76
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.004b7b80
mov byte [ebp - 8], al
jmp 0x4b7efb
cmp byte [ebp - 0x18], 0
je 0x4b7e90
mov edx, dword [ebp - 4]
mov al, 0x20
call fcn.0040a500
test eax, eax
jle 0x4b7e90
mov byte [ebp - 0x14], 1
jmp 0x4b7e94
mov byte [ebp - 0x14], 0
cmp byte [ebp - 0x14], 0
je 0x4b7ec2
push 0
mov eax, 0x79d6fc
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov eax, 0x79d6fc
mov dword [ebp - 0x44], eax
lea edx, [ebp - 0x4c]
lea eax, [ebp - 4]
mov ecx, 2
call fcn.004097a0
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0040d4b0
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0xc]
call fcn.0040bdb0
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4b7eea
mov eax, 0x8e12e0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 8]
call fcn.0040ebd0
lea eax, [ebp - 0x50]
call fcn.0040bbc0
lea eax, [ebp - 0xc]
call fcn.0040ad40
lea eax, [ebp - 4]
call fcn.00404190
pop eax
test eax, eax
je 0x4b7f22
call fcn.0040ed00
mov al, byte [ebp - 8]
leave
ret

Function at 0x4b84b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov ecx, eax
mov eax, 0
lea ebx, [ecx + 1]
movzx edx, byte [ecx]
add edx, 1
and edx, 0xff
lea edx, [ecx + edx]
jmp 0x4b84e1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor esi, ecx
mov eax, esi
add ebx, 1
cmp ebx, edx
jb 0x4b84d0
pop esi
pop ebx
ret
Function at 0x4c3d60
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4c3d90
mov eax, esi
call fcn.004c81c0
cmp byte [esi + 0x40], 0
je 0x4c3d89
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4c3e28
mov dword [esi + 0x14], 0xcb
cmp dword [esi + 0x14], 0xcb
jne 0x4c3e0a
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4c3e02
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4c3db9
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4c3dcd
mov bl, 0
jmp 0x4c3e28
cmp edi, 2
je 0x4c3e02
cmp dword [esi + 8], 0
je 0x4c3dac
cmp edi, 3
je 0x4c3de2
cmp edi, 1
jne 0x4c3dac
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
cmp eax, dword [edx + 8]
jl 0x4c3dac
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
jmp 0x4c3dac
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4c3e1f
cmp dword [esi + 0x14], 0xcc
je 0x4c3e1f
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004c4110
mov eax, esi
call fcn.004c3e30
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret

Function at 0x4de2b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetProcessAffinityMask
test eax, eax
je 0x4de307
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
sub dword [ebp - 0x2c], 1
add dword [ebp - 0x2c], 1
mov eax, 1
mov ecx, dword [ebp - 0x2c]
shl eax, cl
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
and eax, edx
je 0x4de2ff
add dword [ebp - 4], 1
cmp dword [ebp - 0x2c], 0x1f
jl 0x4de2e0
jmp 0x4de316
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4e5050
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x28], 0
je 0x4e5098
mov eax, dword [0x7542b0]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x168]
cmp eax, dword [edx + 0x28]
jne 0x4e5098
mov eax, dword [0x7542b0]
cmp byte [eax + 0x114], 0
jne 0x4e5098
mov eax, dword [0x754680]
mov edx, dword [0x754680]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x754680]
mov edx, dword [0x754680]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x4e518e
mov eax, dword [0x7542b0]
cmp byte [eax + 0x114], 0
jne 0x4e518e
mov eax, dword [0x754680]
mov edx, dword [0x754680]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00580310
mov eax, dword [0x7542b0]
cmp dword [eax + 0x168], 0
je 0x4e5153
push 0x10
push 0
mov eax, dword [0x7542b0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x7542b0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x7542b0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x7542b0]
mov eax, dword [eax + 0x168]
call fcn.005031e0
test al, al
je 0x4e5153
push 0
mov eax, dword [0x7542b0]
call fcn.00420c30
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x7542b0]
call fcn.00423ba0
jmp 0x4e5225
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4e51e3
mov eax, dword [ebp - 4]
mov edx, dword [0x7542b0]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x168]
jne 0x4e51e3
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x7542b0]
call fcn.00423ba0
jmp 0x4e5225
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4e5225
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x488], 8
je 0x4e5225
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x754680]
mov edx, dword [0x754680]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
leave
ret
Function at 0x4ea070
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.004e8a90
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - SetWindowTextWx24], 0
call fcn.00413700
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [GetWindowTextW]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4ea0c6
push GetWindowTextLengthW
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - GetWindowLongWx10], 0
mov eax, str.Window
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je reloc.user32.dll_IsWindow
or dword [ebp - 0x30], 0x800
cmp dword [0x76ecb0], 6
jb 0x4ea118
or dword [ebp - 0x30], 0x20000
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret

Function at 0x4eb000
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4eb0ad
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle SetArcDirection
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x4eb08f
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040ebd0
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4eb0a9
call fcn.0040ed00
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
leave
ret
Function at 0x4eb710
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x78]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, 1
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x4eb87b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4eb816
lea eax, [ebp - 0x40]
call fcn.00404190
lea eax, [ebp - 0x44]
call fcn.00404190
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
call fcn.0047bb00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
call fcn.00409430
lea eax, [ebp - 0x44]
call fcn.00404190
lea eax, [ebp - 0x54]
call fcn.00404190
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x10]
call fcn.0047bab0
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x44]
call fcn.00409430
call fcn.0047c0f0
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0047d580
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4eb87b
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x4eb859
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
call fcn.0040ebd0
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4eb870
call fcn.0040ed00
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
call fcn.0040ebd0
lea eax, [ebp - 0x54]
call fcn.00404190
lea eax, [ebp - 0x44]
call fcn.00404190
lea eax, [ebp - 0x40]
call fcn.00404190
pop eax
test eax, eax
je 0x4eb8a2
call fcn.0040ed00
pop ebx
leave
ret
Function at 0x55cbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
cmp ebx, esi
jl 0x55cc3b
sub esi, 1
lea esi, [esi]
add esi, 1
push dword [ebp - 8]
push esi
mov ecx, esi
mov eax, ecx
sar eax, 0x1f
mov edx, eax
mov eax, ecx
xor eax, edx
sub eax, edx
and eax, 0x1f
mov ecx, edx
xor ecx, eax
mov eax, ecx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 4]
push dword [eax + edx*4]
push edi
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0055c170
cmp ebx, esi
jg 0x55cc00
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x5806f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
mov eax, 1
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x580781
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040b460
cmp dword [ebp - 0xc], 0
jbe 0x580760
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x580754
mov eax, 0x8e12e0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040b460
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040bde0
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
call fcn.00434d70
call fcn.0040ebd0
lea eax, [ebp - 0x3c]
call fcn.0040bbc0
lea eax, [ebp - 0x10]
call fcn.0040ad40
pop eax
test eax, eax
je 0x5807a0
call fcn.0040ed00
leave
ret
Function at 0x658ad0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x658c3d
mov byte [ebp - 0x34], 0
mov edx, dword [edi + 8]
lea eax, [ebp - 4]
call fcn.00409430
mov eax, dword [ebp - 4]
test eax, eax
jne 0x658b23
mov eax, 0x8e12e0
push eax
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateMutexA
test eax, eax
je 0x658b3d
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x658b41
mov byte [ebp - 0x34], 1
mov edx, dword [edi + 0xc]
lea eax, [ebp - 8]
call fcn.00409430
mov eax, dword [ebp - 8]
test eax, eax
jne 0x658b58
mov eax, 0x8e12e0
push eax
push 8
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x658c3d
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x658ba2
push 8
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
mov eax, dword [edi + 0x14]
mov dword [esi], eax
mov dword [esi + 4], 1
jmp 0x658c3d
mov eax, dword [ebp - 8]
test eax, eax
jne 0x658bae
mov eax, 0x8e12e0
push eax
push 0
push 0xf001f
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x658c3d
push 8
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
add dword [esi + 4], 1
mov eax, dword [esi]
mov dword [edi + 0x10], eax
cmp byte [edi + 5], 0
je 0x658c1a
cmp byte [edi + 4], 0
je 0x658c09
mov eax, 0x885a94
call fcn.005d9670
test al, al
jne 0x658c1a
mov eax, str._batch
call fcn.005d9670
test al, al
jne 0x658c1a
push 0
push 0
push 0x46e
push dword [edi + 0x10]
call sub.user32.dll_SendMessageA
cmp byte [edi + 0x28], 0
je 0x658c30
cmp dword [edi + 0x10], 0
je 0x658c30
mov edx, dword [edi + 0x10]
mov eax, edi
call fcn.00658df0
cmp byte [edi + 0x29], 0
je 0x658c3d
mov eax, edi
call fcn.00658c70
call fcn.0040ebd0
lea eax, [ebp - 4]
call fcn.00404190
lea eax, [ebp - 8]
call fcn.00404190
pop eax
test eax, eax
je 0x658c5c
call fcn.0040ed00
mov al, byte [ebp - 0x34]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x658df0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
mov al, 0
push 9
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
or eax, eax
setne al
pop ebx
leave
ret

Function at 0x664980
Capabilities:
Hash data with crc32

Disassembly:
push ebx
and edx, 0xff
mov ebx, dword [eax + 0xc]
mov ecx, ebx
xor ecx, edx
and ecx, 0xff
shr ebx, 8
and ebx, 0xffffff
mov edx, dword [ecx*4 + 0x771b70]
xor ebx, edx
mov dword [eax + 0xc], ebx
pop ebx
ret