joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41beac
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41c10c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x41bee2
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 4], eax
lea eax, [ebp - 0x38]
push eax
mov eax, fcn.0041beac
mov cl, 0x30
mov edx, 1
call fcn.0041aa98
mov eax, dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov cl, 0x30
mov edx, 1
call fcn.0041aa98
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00403f64
cmp dword [0x5b0628], 0
jne 0x41bf6e
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov edx, 0x41c124
call fcn.00403f64
mov eax, dword [ebp - 0x38]
call fcn.004040dc
push eax
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov ebx, eax
test ebx, ebx
je 0x41bf7b
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
cmp dword [0x5b0628], 0
jne 0x41bf66
mov dword [0x5b0628], ebx
jmp 0x41bf7b
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x41bf7b
push 0xffffffffffffffff
mov eax, dword [0x5b0628]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor ecx, ecx
push ebp
push 0x41bfd6
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [0x5bd664]
call fcn.004055c0
test eax, eax
jl 0x41bfbd
inc eax
xor ebx, ebx
lea edx, [ebx + ebx*2]
mov ecx, dword [0x5bd664]
mov ecx, dword [ecx + edx*4]
cmp ecx, dword [ebp - 4]
jne 0x41bfb9
mov eax, dword [0x5bd664]
mov eax, dword [eax + edx*4 + 4]
mov dword [ebp - 8], eax
jmp 0x41bfbd
inc ebx
dec eax
jne 0x41bf9a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bfdd
mov eax, dword [0x5b0628]
push eax
call sub.kernel32.dll_ReleaseMutex
ret

Function at 0x41c608
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x41c650
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x41c646
cmp word [edi], 0x5a4d
jne 0x41c646
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x41c646
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c65c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41c79c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004040cc
xor eax, eax
push ebp
push 0x41c97a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
test ebx, ebx
je 0x41c959
mov eax, ebx
call fcn.0041c608
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41c944
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, ebx
mov edi, eax
test edi, edi
je 0x41c944
mov eax, dword [edi + 0x18]
dec eax
test eax, eax
jl 0x41c944
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x12c]
mov edx, dword [edi + 0x20]
add edx, ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*4]
add edx, ebx
call fcn.00403e50
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 4]
call fcn.00404028
jne 0x41c938
mov eax, dword [edi + 0x24]
add eax, ebx
mov edx, dword [ebp - 0xc]
mov si, word [eax + edx*2]
movzx eax, si
mov edx, dword [edi + 0x1c]
add edx, ebx
mov edi, dword [edx + eax*4]
mov eax, dword [ebp - 8]
cmp edi, dword [eax + 0x50]
jbe 0x41c92b
xor edi, edi
push 0x104
lea eax, [ebp - 0x125]
push eax
push ebx
call sub.kernel32.dll_GetModuleFileNameA_2
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x41c92b
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41c922
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41c919
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0041c748
add eax, dword [ebp - 0x1c]
mov edi, eax
mov edx, dword [edi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.0041c748
add eax, dword [ebp - 0x1c]
movzx edx, si
mov edi, dword [eax + edx*4]
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push 0x104
lea eax, [ebp - 0x125]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, edi
mov eax, ebx
call fcn.0041c698
mov esi, eax
jmp 0x41c944
inc dword [ebp - 0xc]
dec dword [ebp - 0x20]
jne 0x41c818
test esi, esi
jne 0x41c959
mov eax, dword [ebp - 4]
call fcn.004040dc
push eax
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c981
lea eax, [ebp - 0x12c]
call fcn.00403c9c
lea eax, [ebp - 4]
call fcn.00403c9c
ret
Function at 0x423124
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x4231a0
cmp dword [esp + 0x10], 0x1000
jne 0x4231a0
cmp dword [esp + 4], 0
je 0x4231a0
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
test eax, eax
je 0x4231a0
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x4231a0
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x4231a0
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x423608
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x42373e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x423630
cmp dword [ebx + 4], 0
jne 0x42373e
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x423656
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x423656
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
sub edx, dword [ebx + 8]
mov eax, 0x100000
call fcn.00423600
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x42373e
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
jne 0x4236fb
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x4236a1
push 4
push 0x1000
push 0x100000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push 0
push 0
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, dword [ebx + 8]
jne 0x4236f1
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4236f1
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 4]
jne 0x4236f1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], eax
jmp 0x423716
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x18], edx
jmp 0x423716
push esi
mov eax, dword [ebx + 8]
push eax
push 0
push 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov dword [ebx], eax
cmp dword [ebx + 8], 0
jne 0x42373e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
add dword [ebx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
sub dword [ebx + 4], eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x425a2c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x425a53
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
and edx, 0xff
mov edx, dword [edx*4 + 0x5b1074]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x425a37
mov eax, esi
pop esi
ret

Function at 0x425e7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x425e9b
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00425abc
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x425efd
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00425abc
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x425f4c
add ebx, 0x400
dec edi
jne 0x425f4a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425f94
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.004040cc
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x426175
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov esi, 0x5b1474
lea edi, [ebp - 0x1048]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x5b14bc
lea edi, [ebp - 0x1000]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, dword [ebp + 0x14]
call fcn.00403f18
push eax
mov eax, dword [ebp + 0x14]
call fcn.004040dc
pop edx
call fcn.00425e7c
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x426030
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x426046
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x42615f
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x426063
cmp dword [ebp + 0xc], 0
je 0x4260df
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
mov dl, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x426089
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x42606b
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.00425a90
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.00425a90
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00425abc
pop ecx
mov eax, dword [esi]
call fcn.00425a90
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.00425a90
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x426150
cmp byte [ebp + 8], 0
jne 0x426137
mov edi, ebx
mov eax, dword [edi]
call fcn.00425a90
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.00425a90
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00425abc
pop ecx
mov eax, dword [esi]
call fcn.00425a90
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.00425a90
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x426150
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.00425abc
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x426059
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42617c
lea eax, [ebp + 0x14]
call fcn.00403c9c
ret
Function at 0x4266bc
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040cc
xor eax, eax
push ebp
push 0x4267ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004040dc
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x426795
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x426795
xor eax, eax
push ebp
push 0x42678e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, eax
mov eax, ebx
call fcn.00404248
cmp dword [ebx], 0
je 0x42676e
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00403f18
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x42676e
mov eax, dword [ebx]
call fcn.00403f18
cmp eax, dword [ebp - 0x10]
je 0x426772
xor eax, eax
jmp 0x426774
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426795
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4267b2
lea eax, [ebp - 4]
call fcn.00403c9c
ret
Function at 0x42e1d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42e1d6
ret

Function at 0x430a24
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x430a75
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x430a5c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x430a4c
jmp 0x430a75
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x430a5d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443424
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4434ae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 4], 0
jne 0x443495
mov eax, dword [0x5bbee4]
mov eax, dword [eax]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 8], eax
test eax, eax
jne 0x443463
push ebx
push 0x4434bc
call fcn.00446750
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x443491
lea edx, [ebp - 4]
mov eax, dword [0x5bb984]
call fcn.00405c9c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x407e94]
call fcn.0040bbf8
call fcn.00403710
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4434b5
lea eax, [ebp - 4]
call fcn.00403c9c
ret

Function at 0x4434e0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00443424
xor edx, edx
push ebp
push 0x4435b2
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x443584
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x443573
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.0040282c
mov eax, dword [ebp - 4]
call fcn.004433d4
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44357a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x4435e8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00443424
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44365a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x44362e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00403e50
jmp 0x443635
mov eax, ebx
call fcn.00403c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443661
cmp dword [ebp - 8], 0
je 0x443651
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.004433f4
ret
Function at 0x443694
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x443772
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00443424
xor edx, edx
push ebp
push 0x443755
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x44371e
mov edx, ebx
mov eax, dword [0x42dca4]
call fcn.0043214c
test al, al
je 0x44370e
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00432020
call fcn.004037b0
jmp 0x44375c
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4436d9
lea edx, [ebp - 8]
mov eax, dword [0x5bba7c]
call fcn.00405c9c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407e94]
call fcn.0040bbf8
call fcn.00403710
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44375c
mov eax, dword [ebp - 4]
call fcn.004433f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443779
lea eax, [ebp - 8]
call fcn.00403c9c
ret

Function at 0x443780
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00443424
xor eax, eax
push ebp
push 0x4437d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4437df
mov eax, dword [ebp - 4]
call fcn.004433f4
ret

Function at 0x4437e8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00443424
xor edx, edx
push ebp
push 0x44383d
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443844
mov eax, dword [ebp - 4]
call fcn.004433f4
ret
Function at 0x4438b8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00443424
xor eax, eax
push ebp
push 0x44392d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004433d4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00432120
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x443917
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443934
mov eax, dword [ebp - 4]
call fcn.004433f4
ret

Function at 0x44393c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00443424
xor eax, eax
push ebp
push 0x4439b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004433d4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x44399b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4439b8
mov eax, dword [ebp - 4]
call fcn.004433f4
ret

Function at 0x446694
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x5be8d0
cmp dword [edi], 0
jne 0x446710
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x5be8cc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x5b28d8
mov ecx, 2
call fcn.0040282c
mov edx, 0x44666c
lea eax, [esi + 5]
call fcn.0044668c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0044668c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4466e5
mov dword [0x5be8cc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x446834
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x446884]
test si, 4
je 0x446848
or bl, 1
test si, 8
je 0x446852
or bl, 4
test si, 1
je 0x44685c
or bl, 8
test si, 2
je 0x446866
or bl, 0x10
test si, 0x10
je 0x446870
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44687f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret