joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451db0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x63
jb 0x451dbc
xor eax, eax
ret
push esi
mov esi, dword [eax*4 + reloc.USER32.dll_AdjustWindowRectEx]
test esi, esi
je 0x451f7a
cmp dword [esi], 0
push ebx
push ebp
push edi
je 0x451e8a
xor edi, edi
xor ebx, ebx
lea esp, [esp]
mov eax, dword [edi*4 + reloc.USER32.dll_AdjustWindowRectEx]
test eax, eax
je 0x451e04
mov eax, dword [eax + 0x40]
cmp eax, dword [esi]
jne 0x451dfb
push edi
call fcn.00451db0
add esp, 4
inc ebx
cmp dword [0x4a2b64], ebx
je 0x451e0a
inc edi
cmp edi, 0x63
jb 0x451de0
mov eax, dword [esi + 4]
test eax, eax
je 0x451e4e
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x406
push eax
call ebx
mov ebp, eax
xor edi, edi
test ebp, ebp
jle 0x451e4e
jmp 0x451e30
mov ecx, dword [esi + 4]
push 0
push edi
push 0x414
push ecx
call ebx
test eax, eax
je 0x451e49
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
inc edi
cmp edi, ebp
jl 0x451e30
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x451e8a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetMenu]
cmp byte [esi + 0xbb], 0
jne 0x451e8a
mov edx, dword [esi]
push edx
mov byte [esi + 0xbb], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x60]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x451e9a
push eax
call ebp
mov eax, dword [esi + 0x68]
test eax, eax
je 0x451ea4
push eax
call ebp
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x451eb2
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
xor ebx, ebx
cmp dword [esi + 0xc], ebx
jbe 0x451f02
xor edi, edi
jmp 0x451ec0
mov eax, dword [esi + 0x14]
mov cl, byte [eax + edi + 4]
add eax, edi
cmp cl, 2
jne 0x451ee8
mov edx, dword [eax + 0x10]
test edx, edx
je 0x451ee8
test byte [eax + 5], 0x80
push edx
je 0x451ee4
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x451ef9
call ebp
jmp 0x451ef9
cmp cl, 0xa
jne 0x451ef9
mov eax, dword [eax + 0x10]
push eax
call fcn.004785bf
add esp, 4
inc ebx
add edi, 0x14
cmp ebx, dword [esi + 0xc]
jb 0x451ec0
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x70]
mov ebx, dword [esi + 0x74]
push ecx
call fcn.004785bf
mov esi, dword [esp + 0x18]
mov edx, dword [esi*4 + reloc.USER32.dll_AdjustWindowRectEx]
push edx
call fcn.00479b23
mov dword [esi*4 + 0x4a11b8], 0
mov esi, dword [0x4a2b64]
dec esi
add esp, 8
mov dword [0x4a2b64], esi
test edi, edi
je 0x451f77
cmp edi, dword [0x4a312c]
je 0x451f77
xor edx, edx
mov ecx, 0x4a11b8
cmp edx, esi
jge 0x451f6b
mov eax, dword [ecx]
test eax, eax
je 0x451f60
cmp dword [eax + 0x70], edi
je 0x451f77
inc edx
add ecx, 4
cmp ecx, 0x4a1344
jl 0x451f50
mov esi, dword [sym.imp.USER32.dll_DestroyIcon]
push edi
call esi
push ebx
call esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret

Function at 0x458280
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax]
test eax, eax
je 0x45828f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
Function at 0x4582a0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [eax + 0x1c], 0
mov eax, dword [eax]
jne 0x4582bb
test eax, eax
je 0x4582ce
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
push 0
push 0x2af80006
push 0x414
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
ret

Function at 0x458310
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
cmp dword [edi], 0
push ebx
push esi
je 0x458475
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jbe 0x458359
xor esi, esi
mov eax, dword [edi + 0x14]
cmp dword [eax + esi + 8], 0
je 0x458350
cmp byte [eax + esi + 4], 6
je 0x458350
mov edx, dword [esi + eax + 8]
lea ecx, [esi + eax]
push edi
mov eax, 0x49593c
call fcn.00458520
inc ebx
add esi, 0x14
cmp ebx, dword [edi + 0xc]
jb 0x45832d
xor esi, esi
xor ebx, ebx
cmp esi, dword [edi + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
je 0x458390
mov edx, dword [edi + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [edx + eax]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000
je 0x4583df
mov eax, 1
cmp dword [esp + 0x10], eax
jne 0x4583cc
cmp dword [esp + 0xc], eax
jle 0x4583cc
cmp ebx, reloc.USER32.dll_AdjustWindowRectEx
jne 0x4583a8
xor ebx, ebx
push 0xa
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.00476952
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
call fcn.004668b0
cmp esi, dword [edi + 0xc]
je 0x458464
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 0x14]
mov edx, dword [esp + 0x14]
cmp byte [eax + edx + 4], 6
jne 0x45844d
mov esi, dword [eax + edx + 8]
inc dword [esp + 0xc]
test esi, esi
je 0x458401
inc dword [esp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax + edx]
push 0
push 0
push pe_nt_image_headers32
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x458437
test ebx, ebx
je 0x458422
or ebx, reloc.USER32.dll_AdjustWindowRectEx
jmp 0x458426
mov ebx, dword [esp + 0xc]
test esi, esi
je 0x45844d
push 1
push 0
push 0xffffffffffffffff
push 0x4916f4
jmp 0x458446
test esi, esi
je 0x45844d
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
mov ecx, esi
call fcn.004668b0
mov esi, dword [esp + 0x1c]
add dword [esp + 0x14], 0x14
inc esi
mov dword [esp + 0x1c], esi
cmp esi, dword [edi + 0xc]
jbe 0x458374
cmp byte [ebp + 8], 0
je 0x458475
mov ecx, dword [edi]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x458490
Capabilities:
Get graphical window text

Disassembly:
cmp eax, 0x2af8
jae 0x45850f
mov ecx, dword [ecx*4 + reloc.USER32.dll_AdjustWindowRectEx]
test ecx, ecx
je 0x45850f
cmp eax, dword [ecx + 0xc]
jae 0x45850f
lea edx, [eax + eax*4]
mov eax, dword [ecx + 0x14]
mov ecx, dword [eax + edx*4 + 8]
lea eax, [eax + edx*4]
test esi, esi
je 0x4584e7
test ecx, ecx
je 0x4584da
mov ecx, dword [ecx + 0x18]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4584c1
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4584d0
sub eax, edx
ret
mov ecx, dword [eax]
push 0x40
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
ret
test ecx, ecx
je 0x4584fb
mov eax, dword [ecx + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4584f1
sub eax, edx
ret
mov edx, dword [eax]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, 0x3f
jbe 0x458518
mov eax, 0x3f
ret
test esi, esi
je 0x458516
mov byte [esi], 0
xor eax, eax
ret

Function at 0x45aaf0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, eax
mov al, byte [edi]
xor bl, bl
mov byte [esp + 0xf], bl
test al, al
je 0x45ab29
cmp al, 0x21
je 0x45ab1a
cmp al, 0x2b
je 0x45ab15
cmp al, 0x5e
jne 0x45ab25
or bl, 2
jmp 0x45ab1d
or bl, 1
jmp 0x45ab1d
or bl, 4
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45ab04
mov byte [esp + 0xf], bl
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov cl, byte [edi]
test cl, cl
je 0x45ac17
cmp byte [edi + 1], 0
jne 0x45ab7d
mov byte [esp + 0x10], cl
cmp cl, 0xa
jne 0x45ab51
mov al, 0xd
jmp 0x45ac0f
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx eax, ax
mov ecx, eax
shr ecx, 8
cmp cl, 0xff
jne 0x45ac0f
cmp al, 0xff
jne 0x45ac0f
xor al, al
jmp 0x45ac0f
movzx esi, cl
test esi, 0xffffff80
jne 0x45ab9a
push 2
push esi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x45ab9a
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x56
jne 0x45abd6
movzx esi, byte [edi + 1]
test esi, 0xffffff80
jne 0x45abbe
push 2
push esi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x45abbe
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x4b
jne 0x45abd6
push 0x10
lea edx, [edi + 2]
push 0
push edx
call fcn.00478594
add esp, 0xc
jmp 0x45ac0f
xor esi, esi
jmp 0x45abe0
mov eax, dword [esi*8 + reloc.USER32.dll_AdjustWindowRectEx]
push edi
push eax
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x45ac20
inc esi
cmp esi, 0x6d
jl 0x45abe0
mov eax, edi
call fcn.00410e90
movzx ecx, ax
test cx, cx
je 0x45ac17
call fcn.004115c0
mov byte [esp + 0x10], al
test al, al
jne 0x45ac29
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov al, byte [esi*8 + 0x49e10c]
jmp 0x45ac0f
mov eax, edi
call fcn.00410e90
movzx eax, ax
test ax, ax
jne 0x45ac4e
mov ecx, dword [esp + 0x10]
push ecx
xor bl, bl
call fcn.00411340
mov bl, byte [esp + 0x13]
add esp, 4
movzx eax, ax
test eax, 0x100
je 0x45ac58
or bl, 8
movzx edx, byte [esp + 0x10]
movzx eax, bl
pop edi
shl eax, 8
pop esi
or eax, edx
pop ebx
add esp, 8
ret
Function at 0x45ac70
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebx
push esi
shr eax, 8
push edi
mov esi, ebp
test al, 1
je 0x45ac8e
mov byte [ebp], 0x2b
lea esi, [ebp + 1]
test al, 2
je 0x45ac96
mov byte [esi], 0x5e
inc esi
test al, 4
je 0x45ac9e
mov byte [esi], 0x21
inc esi
test al, 8
je 0x45acee
push ebx
xor bl, bl
call fcn.00411340
mov ecx, dword [esp + 0x18]
push ecx
mov bl, 1
movzx edi, ax
call fcn.00411340
movzx eax, ax
add esp, 8
mov ecx, eax
test eax, 0x100
jne 0x45acca
mov ecx, edi
test ecx, 0x100
je 0x45acea
cmp di, ax
je 0x45acea
mov eax, 0x64
mov edx, esi
call fcn.00410e30
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov ebx, dword [esp + 0x14]
xor eax, eax
cmp byte [eax*8 + 0x49e10c], bl
je 0x45ad4c
inc eax
cmp eax, 0x6d
jl 0x45acf0
push 0x64
push ebx
xor eax, eax
call fcn.00411260
add esp, 8
cmp byte [esi], 0
je 0x45ad74
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 1
mov ecx, eax
push 0
xor edx, edx
mov eax, esi
call fcn.00410f30
add esp, 8
test al, al
jne 0x45ad74
movzx edi, bl
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [esi], al
test al, al
je 0x45ad65
pop edi
mov byte [esi + 1], 0
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov edx, dword [eax*8 + reloc.USER32.dll_AdjustWindowRectEx]
push 0x63
push edx
push esi
call fcn.0047a8e0
add esp, 0xc
mov byte [esi + 0x63], 0
jmp 0x45ad0c
push edi
push 0x496110
push esi
call fcn.00477162
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x45b9d0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x10
movzx eax, byte [esi + 4]
push ebp
mov ebp, dword [esp + 0x18]
add eax, 0xfffffff7
push edi
mov dword [esp + 8], 0x80000000
cmp eax, 8
ja case.0x45b9f1.12
jmp dword [eax*4 + 0x45baf0]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x19f
push eax
call edi
cmp eax, reloc.USER32.dll_AdjustWindowRectEx
je 0x45ba9e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x198
push edx
call edi
jmp 0x45ba9e
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push eax
call edi
cmp eax, reloc.USER32.dll_AdjustWindowRectEx
je 0x45ba9e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x100e
push edx
mov dword [esp + 0x18], 2
call edi
jmp 0x45ba9e
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 9
push 0x110a
push eax
call edi
test eax, eax
je 0x45ba9e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push 1
push 0x1104
push edx
mov dword [esp + 0x18], eax
call edi
jmp 0x45ba9e
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push 0
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 8], reloc.USER32.dll_AdjustWindowRectEx
jne 0x45bab8
mov eax, dword [esi]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x45baca
mov edx, dword [esi]
push 2
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + ecx + 2]
pop edi
mov dword [ebp + 4], ecx
pop ebp
add esp, 0x10
ret 4

Function at 0x4613f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov esi, dword [esp + reloc.USER32.dll_AdjustWindowRectEx]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
je 0x4614a2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebp
test eax, eax
jne 0x4614af
mov edx, dword [esp + 0x14]
push edx
call fcn.004613f0
mov bl, al
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4614af
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4614af
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
jne 0x461436
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret
Function at 0x461e40
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esi + 0x20]
push ebx
push ebp
xor ebp, ebp
push edi
cmp eax, ebp
je 0x461e6f
sub eax, dword [esi + 0x24]
mov edi, dword [esi]
sub eax, dword [esi + 8]
push 1
cdq
xor ecx, ecx
push edx
mov edx, dword [edi + 0x14]
mov word [esi + 0x1a], cx
push eax
mov ecx, esi
mov dword [esi + 0x1c], ebp
call edx
mov dword [esi + 0x20], ebp
mov dword [esi + 8], ebp
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov ecx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esi]
push ebp
mov ebx, edx
mov edx, dword [eax + 0x14]
push ecx
mov ecx, esi
call edx
test al, al
je 0x461ed6
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x461ed6
cmp ebp, ebx
jg 0x461eb6
jl 0x461eae
cmp dword [esp + 0x10], edi
jae 0x461eb6
mov eax, dword [esp + 0x10]
mov ecx, ebp
jmp 0x461eba
mov eax, edi
mov ecx, ebx
mov edx, dword [esi]
push 0
push ecx
push eax
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
pop edi
pop ebp
pop ebx
ret 8
pop edi
or eax, reloc.USER32.dll_AdjustWindowRectEx
pop ebp
or edx, eax
pop ebx
ret 8

Function at 0x464f70
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp], eax
cmp eax, reloc.USER32.dll_AdjustWindowRectEx
jne 0x464fa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x464fa4
or eax, reloc.USER32.dll_AdjustWindowRectEx
or edx, reloc.USER32.dll_AdjustWindowRectEx
add esp, 0xc
ret
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
Function at 0x465b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebp
push esi
push 2
push 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebp, dword [esp + 0x20]
mov esi, eax
test esi, esi
je 0x465c99
mov eax, ebp
test ebp, ebp
jns 0x465bb4
neg eax
jmp 0x465be6
jne 0x465bbb
mov eax, 1
lea ecx, [esp + 0xc]
push ecx
push 0x465b50
push 0xe
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], reloc.USER32.dll_AdjustWindowRectEx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
movzx edx, ax
push 0xe
push edx
push esi
call edi
test eax, eax
je 0x465c89
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
push esi
call ebx
test eax, eax
je 0x465c88
mov ebp, dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call ebp
test eax, eax
je 0x465c84
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
cmp edx, reloc.USER32.dll_AdjustWindowRectEx
jne 0x465c29
mov edx, ecx
cmp ecx, reloc.USER32.dll_AdjustWindowRectEx
jne 0x465c32
mov ecx, dword [esp + 0x30]
push 0
push edx
push ecx
push 1
push eax
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
test eax, eax
je 0x465c84
movzx eax, ax
push 3
push eax
push esi
call edi
mov edi, eax
test edi, edi
je 0x465c84
push edi
push esi
call ebx
test eax, eax
je 0x465c84
push eax
call ebp
mov ebx, eax
test ebx, ebx
je 0x465c84
push 0
push 0
push 0
push 0x30000
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x28]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
pop edi
test eax, eax
jne 0x465ccd
test ebp, ebp
jle 0x465cb4
mov ecx, dword [esp + 0x1c]
lea eax, [ebp - 1]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconA]
pop esi
pop ebp
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ebp, reloc.USER32.dll_AdjustWindowRectEx
setge al
dec eax
and eax, ebp
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconA]
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x466190
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
cmp byte [esi + 0x17], 0
push edi
mov edi, ecx
jne 0x4661a2
mov esi, dword [esi + 0xc]
cmp byte [edi + 0x17], 0
jne 0x4661ab
mov edi, dword [edi + 0xc]
mov al, byte [esi + 0x15]
test al, 0x10
je 0x46622d
test al, 8
jne 0x466212
mov ecx, dword [esi + 8]
movsx edx, byte [ecx]
mov eax, dword [esi + 0xc]
movsx ecx, byte [eax + ecx - 1]
cmp edx, 0x20
je 0x4661e2
cmp edx, 9
je 0x4661e2
cmp ecx, 0x20
je 0x4661e2
cmp ecx, 9
je 0x4661e2
cmp edx, 0x30
je 0x4661e2
cmp edx, 0x2b
jne 0x466212
mov ecx, dword [esi + 8]
push edi
call fcn.004011f0
test eax, eax
jne 0x4661f7
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x10
push eax
push ecx
mov eax, edi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0x18
push edx
push eax
mov eax, edi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
test al, 0x20
je 0x46628d
test al, 8
jne 0x466269
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push edi
call fcn.004011f0
test eax, eax
je 0x4661ef
fld qword [esi]
push 0x20
fstp qword [esp + 0xc]
mov eax, edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
fld qword [esi]
push 0x28
fstp qword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov eax, edi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
test al, 1
je 0x46629f
mov ecx, esi
mov edx, edi
pop edi
pop esi
add esp, 0xc
jmp fcn.00466670
test al, 2
je 0x4662bb
mov esi, dword [esi]
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
push esi
mov eax, edi
call fcn.0044a870
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push edi
call fcn.004011f0
pop edi
pop esi
add esp, 0xc
ret

Function at 0x4662d0
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
dec eax
cmp eax, 4
ja case.default.0x4662e0
jmp dword [eax*4 + 0x466378]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
push edi
call fcn.00411d40
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je case.default.0x4662e0
mov ecx, dword [esi]
cmp byte [ecx], 0x30
je 0x466313
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
push edi
call fcn.00411d40
pop esi
ret
push edi
or eax, reloc.USER32.dll_AdjustWindowRectEx
call fcn.004011f0
test eax, eax
jne 0x466322
pop esi
ret
mov esi, dword [esi + 4]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0x10
push ecx
push edx
mov eax, edi
call fcn.004010d0
mov eax, 1
pop esi
ret
mov eax, dword [esi]
mov ecx, edi
pop esi
jmp fcn.00466190
fld qword [esi]
sub esp, 8
fstp qword [esp]
push edi
call fcn.00411d70
pop esi
ret
mov esi, dword [esi]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
push esi
mov eax, edi
call fcn.0044a870
pop esi
ret
mov ecx, dword [esi]
push edi
or eax, reloc.USER32.dll_AdjustWindowRectEx
call fcn.004011f0
pop esi
ret
Function at 0x466670
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
cmp byte [esi + 0x17], 0
push edi
mov ebx, ecx
jne 0x46668a
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 0
je 0x466681
cmp byte [ebx + 0x17], 0
jne 0x466693
mov ebx, dword [ebx + 0xc]
mov eax, ebx
call fcn.00401150
cmp byte [esi + 0x17], 1
jne 0x4666f5
push 1
mov ecx, esi
call fcn.00401230
cmp dword [ebx + 8], eax
je 0x46676e
mov eax, dword [ebx + 0xc]
push 0
push 1
push eax
push 0
mov ecx, esi
call fcn.004668b0
test eax, eax
jne 0x4666cf
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [esi + 8]
inc eax
push eax
push ecx
push edx
call fcn.0047b470
add esp, 0xc
or byte [esi + 0x15], 1
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, 0x4a2bfc
call fcn.00403f70
test eax, eax
jne 0x46671f
push 0x49588a
push 0x49020c
mov ecx, 0x4a2c18
call fcn.00429900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, edi
lea esi, [edi + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
jbe 0x466784
xor esi, esi
cmp dword [0x4a2c14], esi
je 0x46676e
cmp dword [0x4a2c04], esi
je 0x46675c
mov eax, dword [0x4a2bfc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4a2c04], esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4a2c14], esi
mov dword [0x4a2bfc], esi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov edi, dword [edi]
mov dword [esp + 0x18], edi
test edi, edi
je 0x466738
mov ecx, esi
add esi, 4
cmp esi, eax
ja 0x466738
mov ebx, dword [ecx]
mov edi, esi
add esi, ebx
cmp esi, eax
ja 0x466738
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4667f1
test ebx, ebx
je 0x4667d7
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x466848
push ebx
push edi
push eax
call fcn.0047b470
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, esi
mov eax, dword [esp + 0x18]
push ebp
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
lea esi, [edi + 4]
cmp esi, dword [esp + 0x14]
jbe 0x466780
jmp 0x466738
cmp dword [0x4a2c14], 0
je 0x46682c
cmp dword [0x4a2c04], 0
je 0x46681a
mov ecx, dword [0x4a2bfc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4a2c04], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
mov dword [0x4a2c14], eax
mov dword [0x4a2bfc], eax
push 0x49588a
push 0x4918cc
mov ecx, 0x4a2c18
call fcn.00429900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
cmp dword [0x4a2c14], esi
je 0x466886
cmp dword [0x4a2c04], esi
je 0x466874
mov edx, dword [0x4a2bfc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4a2c04], esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4a2c14], esi
mov dword [0x4a2bfc], esi
push 0x49588a
push 0x4901f4
mov ecx, 0x4a2c18
call fcn.00429900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret