joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f00
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4ddb38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x407110
mov eax, dword [0x510fe4]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x5c]
mov dword [esp + 0x10], 0
test eax, eax
jne 0x406f6f
push str.ArtCAM_Session
lea ecx, [esp + 8]
call fcn.004bb5ab
mov ecx, dword [esp + 4]
push 0xffff0002
push 0xffff0000
push 0
push 0
push 0
push 0
push 0
push ecx
push 0x23
mov ecx, esi
call fcn.004b5575
mov dword [esi + 0x5c], eax
push edi
push 0x16f
lea ecx, [esp + 0xc]
call fcn.004bcdef
mov eax, dword [esi + 0x5c]
mov edx, dword [esp + 8]
push 0xffff0002
push eax
push 0
push 0
push 0
push 0xa
push 0xa
push edx
push 0x23
mov ecx, esi
call fcn.004b5575
push 0x509408
lea ecx, [esp + 0xc]
mov dword [esi + 0x64], eax
call fcn.004bb5ab
mov eax, dword [esi + 0x64]
push 0xffff0002
push eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0xc
push 0xc
push eax
push 0x23
mov ecx, esi
call fcn.004b5575
mov ecx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0
push 0x1114
push ecx
mov dword [esi + 0x6c], eax
call edi
push 0x16e
lea ecx, [esp + 0xc]
call fcn.004bcdef
mov eax, dword [esi + 0x5c]
mov edx, dword [esp + 8]
push 0xffff0002
push eax
push 0
push 0
push 0
push 1
push 1
push edx
push 0x23
mov ecx, esi
call fcn.004b5575
push 0x176
lea ecx, [esp + 0xc]
mov dword [esi + 0x60], eax
call fcn.004bcdef
push 0x509408
lea ecx, [esp + 0xc]
call fcn.004bb5ab
mov eax, dword [esi + 0x5c]
push 0xffff0002
push eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0xb
push 0xb
push eax
push 0x23
mov ecx, esi
call fcn.004b5575
mov dword [esi + 0x68], eax
push 0x509408
lea ecx, [esp + 0xc]
call fcn.004bb5ab
mov eax, dword [esi + 0x5c]
mov ecx, dword [esp + 8]
push 0xffff0002
push eax
push 0
push 0
push 0
push 0x12
push 0x12
push ecx
push 0x23
mov ecx, esi
call fcn.004b5575
push 0x509408
lea ecx, [esp + 0xc]
mov dword [esi + 0x78], eax
call fcn.004bb5ab
mov eax, dword [esi + 0x5c]
mov edx, dword [esp + 8]
push 0xffff0002
push eax
push 0
push 0
push 0
push 0x11
push 0x11
push edx
push 0x23
mov ecx, esi
call fcn.004b5575
push 0x509408
lea ecx, [esp + 0xc]
mov dword [esi + 0x74], eax
call fcn.004bb5ab
mov eax, dword [esi + 0x5c]
push 0xffff0002
push eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0xd
push 0xd
push eax
push 0x23
mov ecx, esi
call fcn.004b5575
mov ecx, dword [esi + 0x1c]
push eax
push 0
push 0x1114
push ecx
mov dword [esi + 0x70], eax
call edi
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004bb422
pop edi
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40ccd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4de3af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x30]
push esi
push edi
mov esi, ecx
push eax
push 0x19b
mov dword [esp + 0x10], esi
call fcn.004bbeab
lea edi, [esi + 0x5c]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CStatic.0
lea edi, [esi + 0x98]
mov byte [esp + 0x14], 1
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CSpinButtonCtrl.0
lea ecx, [esi + 0xd4]
mov byte [esp + 0x14], 2
call fcn.00403d90
lea edi, [esi + 0x128]
mov byte [esp + 0x14], 3
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CButton.0
lea edi, [esi + 0x164]
mov byte [esp + 0x14], 4
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CButton.0
lea ecx, [esi + 0x1a0]
mov byte [esp + 0x14], 5
call fcn.00403d90
lea ecx, [esi + 0x1f4]
mov byte [esp + 0x14], 6
call fcn.00403d90
lea edi, [esi + 0x248]
mov byte [esp + 0x14], 7
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CStatic.0
lea edi, [esi + 0x284]
mov byte [esp + 0x14], 8
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CButton.0
lea edi, [esi + 0x2c0]
mov byte [esp + 0x14], 9
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CButton.0
lea edi, [esi + 0x2fc]
mov byte [esp + 0x14], 0xa
mov ecx, edi
call fcn.004b769d
mov dword [edi], vtable.CButton.0
lea edi, [esi + 0x338]
mov byte [esp + 0x14], 0xb
mov ecx, edi
call fcn.004b769d
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [edi], vtable.CButton.0
mov ecx, dword [0x510fe4]
mov dword [esi + 0x394], ecx
mov dword [esi], method.CDialog.virtual_0
mov dword [esi + 0x374], edx
test eax, eax
je 0x40ce35
mov dword [esi + 0x378], 0
jmp 0x40ce3f
mov dword [esi + 0x378], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x380], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x384], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x38c], eax
mov dword [esi + 0x390], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x388], edx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x40d5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4de4a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x1a0]
call fcn.00450ab0
mov eax, dword [esi + 0x378]
sub eax, 0
je 0x40d63f
dec eax
jne 0x40d66d
mov ecx, dword [esi + 0x384]
mov edx, dword [esi + 0x380]
push ecx
mov ecx, dword [esi + 0x374]
push edx
call fcn.00412070
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, dword [esi + 0x374]
call fcn.00411f90
jmp 0x40d66d
mov edx, dword [esi + 0x384]
mov eax, dword [esi + 0x380]
mov ecx, dword [esi + 0x374]
push edx
push eax
call fcn.00411e50
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x374]
push edx
call fcn.00411d80
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x380], eax
mov dword [esi + 0x384], ecx
mov edx, dword [0x510fe4]
mov dword [esp + 8], edx
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x394]
push ecx
push edx
push eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x30], 0
call fcn.004b4789
mov ecx, dword [esp + 0x18]
add esp, 0x10
push ecx
lea ecx, [esi + 0x248]
call fcn.004baa07
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.004bb422
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40fd60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4de6f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebp
push esi
push edi
mov esi, ecx
push 0x4e9d08
push 0x4e9c68
xor edi, edi
push str.0123456789__._0123456789__._ABabmipgx_
push 0x10c
lea ecx, [esi + 0x58]
mov dword [esp + 0x1c], esi
mov dword [esi], 1
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 2
mov dword [esi + 0x3c], 0x14
call fcn.00423810
lea ecx, [esi + 0x78]
mov dword [esp + 0x18], edi
call fcn.00412a00
lea ebp, [esi + 0xd8]
mov byte [esp + 0x18], 1
mov ecx, ebp
call fcn.00412a00
mov ecx, esi
mov byte [esp + 0x18], 2
call fcn.004117f0
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0x12
call edi
push eax
push 0x15
call edi
push eax
push 0x10
call edi
push eax
push 0x14
call edi
push eax
push 0xf
call edi
push eax
mov ecx, esi
call fcn.00411750
mov eax, dword [esi + 0x3c]
push 1
add eax, 0xa
mov ecx, ebp
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
call fcn.004132a0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x411440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4de868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
mov eax, dword [esi + 0x34]
push eax
call fcn.004bfd96
mov edx, dword [esi + 0x34]
lea ecx, [esi + 0x140]
push ecx
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
call fcn.00413480
mov eax, dword [esi + 0x3c]
mov ecx, dword [esp + 8]
add eax, ecx
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [esp + 0x44]
mov edi, dword [sym.imp.USER32.dll_InvertRect]
test eax, eax
je 0x4114c7
mov eax, dword [esi + 0x30]
lea edx, [esp + 8]
mov dword [esp + 0xc], eax
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call edi
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 8]
mov dword [esi + 0x30], eax
mov dword [esp + 0xc], eax
inc eax
push ecx
push edx
mov dword [esp + 0x1c], eax
call edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.004bfe08
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc
Function at 0x411bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4de8b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x18]
test eax, eax
je 0x411d5c
mov eax, dword [edi + 0x14]
test eax, eax
je 0x411d5c
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x20]
push eax
push 1
push 2
call fcn.004bfff7
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov dword [esp + 0x4c], 0
call fcn.004bf594
push 1
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004bf609
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x34]
lea edx, [esp + 0x30]
mov eax, dword [eax + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea ebx, [edi + 0x78]
push 1
mov ecx, ebx
call fcn.004130e0
test eax, eax
mov dword [esp + 0x10], eax
je 0x411ca8
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00413140
sub esp, 8
mov ecx, ebx
fstp qword [esp]
call fcn.00412f30
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], eax
cmp eax, ecx
jg 0x411ca8
mov edx, dword [esp + 0x34]
mov ecx, esi
push edx
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004bfa1e
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.004bfa6a
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x411c58
add edi, 0xd8
push 1
mov ecx, edi
call fcn.004130e0
test eax, eax
mov dword [esp + 0x10], eax
je 0x411d09
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00413140
sub esp, 8
mov ecx, edi
fstp qword [esp]
call fcn.00412f30
mov ebx, eax
mov eax, dword [esp + 0x3c]
cmp ebx, eax
jg 0x411d09
mov ecx, dword [esp + 0x30]
push ebx
lea edx, [esp + 0x2c]
push ecx
push edx
mov ecx, esi
call fcn.004bfa1e
mov eax, dword [esp + 0x38]
push ebx
push eax
mov ecx, esi
call fcn.004bfa6a
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x411cbf
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004bf609
mov edx, dword [esp + 0x1c]
mov ecx, esi
push edx
call fcn.004bf594
lea ecx, [esp + 0x20]
call fcn.004bffe1
mov dword [esp + 0x20], vtable.CGdiObject.0
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 1
call fcn.004bffe1
mov eax, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x40]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x414d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.004d3817
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 8]
and ecx, 0xffff
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call fcn.004d3817
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test esi, esi
mov edi, eax
je 0x414e2f
test ebx, ebx
je 0x414e2f
test edi, edi
je 0x414e2f
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x414e06
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x1c]
mov ecx, ebp
push edx
call fcn.00414470
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
xor esi, esi
mov si, word [edi + 0x20]
test esi, esi
jne 0x414e15
mov esi, pe_nt_image_headers32
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, ebp
call fcn.00414390
test eax, eax
jne 0x414e3b
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ebx, dword [ebp + 0x40]
mov edx, dword [edi]
imul ebx, dword [ebp + 0x3c]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [edi]
lea esi, [edx + esi*4]
add ecx, edi
add esi, edi
test ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], 0
jle 0x414efd
xor edx, edx
mov dl, byte [esi]
inc esi
mov ebp, edx
test ebp, ebp
je 0x414e9e
xor edx, edx
mov dl, byte [esi]
inc esi
mov edi, edx
mov edx, dword [esp + 0x1c]
add edx, ebp
mov dword [esp + 0x1c], edx
mov dl, byte [ecx + edi*4]
mov byte [eax], dl
mov dl, byte [ecx + edi*4 + 1]
mov byte [eax + 1], dl
mov dl, byte [ecx + edi*4 + 2]
mov byte [eax + 2], dl
add eax, 4
dec ebp
jne 0x414e83
jmp 0x414ef3
xor edx, edx
mov dl, byte [esi]
inc esi
mov edi, edx
sub edi, 0
je 0x414ef3
dec edi
je 0x414ef3
dec edi
je 0x414ef3
mov edi, dword [esp + 0x1c]
mov ebx, edx
add edi, edx
and ebx, 1
mov dword [esp + 0x1c], edi
mov edi, edx
dec edx
test edi, edi
je 0x414eea
lea ebp, [edx + 1]
xor edx, edx
add eax, 4
mov dl, byte [esi]
inc esi
mov edi, edx
dec ebp
mov dl, byte [ecx + edi*4]
mov byte [eax - 4], dl
mov dl, byte [ecx + edi*4 + 1]
mov byte [eax - 3], dl
mov dl, byte [ecx + edi*4 + 2]
mov byte [eax - 2], dl
jne 0x414ec9
test ebx, ebx
je 0x414eef
inc esi
mov ebx, dword [esp + 0x10]
cmp dword [esp + 0x1c], ebx
jl 0x414e67
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4159f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4deb70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x34]
push ebx
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0x10]
call fcn.0044dce0
push 0x4000
lea ecx, [esp + 0x10]
push 1
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], 0
call fcn.0044db50
mov ebx, dword [esp + 0x44]
push 1
lea edx, [esp + 0x44]
push 1
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 1
mov byte [esp + 0x4c], bl
call fcn.0044dbb0
cmp eax, 1
jne 0x415ad7
test ebx, ebx
jne 0x415ac7
mov eax, dword [esi + 4]
xor edi, edi
test eax, eax
jle 0x415a8b
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
push 1
push eax
mov edx, dword [ecx + edi*4]
lea ecx, [esp + 0x20]
push edx
call fcn.0044dbb0
cmp eax, 1
jne 0x415ad7
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jl 0x415a69
lea ecx, [esp + 0x18]
mov dword [esi + 0x18], 0
mov byte [esp + 0x38], 0
call fcn.0044db90
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0044dd20
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00415ca0
test eax, eax
jne 0x415a8b
lea ecx, [esp + 0x18]
mov dword [esi + 0x18], 4
mov byte [esp + 0x38], 0
call fcn.0044db90
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0044dd20
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov eax, 4
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 8
Function at 0x41bba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4df26a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
push 0
call fcn.0040abd0
test eax, eax
jne 0x41bbd8
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
mov ecx, 0x5139f8
call fcn.0042e290
mov ecx, esi
call fcn.0041d4e0
mov eax, dword [esi + 4]
test eax, eax
je 0x41bbf9
push 0
mov ecx, esi
call fcn.0041c680
mov ecx, esi
call fcn.0041dce0
test eax, eax
je 0x41bc12
mov ecx, esi
call fcn.0041dce0
mov ecx, eax
call fcn.00406f00
push 0x168
call fcn.004bb163
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x41bc45
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push esi
mov ecx, eax
call fcn.00444780
mov edi, eax
jmp 0x41bc47
xor edi, edi
mov eax, dword [edi + 0x50]
mov dword [esp + 0x14], 0xffffffff
test eax, eax
je 0x41bc9a
push 0x82
push 4
push 0x5146c0
call fcn.00460bb0
add esp, 0xc
mov ecx, esi
call fcn.0040ccb0
mov ecx, esi
call fcn.0040ccb0
test edi, edi
je 0x41bc85
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 4]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
mov ecx, dword [esp + 0x34]
push 0
push ecx
mov ecx, edi
call fcn.00449510
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 1
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, edi
call fcn.00448b50
mov dword [esi + 4], edi
mov ecx, dword [0x51325c]
call fcn.0040ccb0
push 0
mov ecx, esi
call fcn.0041db80
mov dword [esi + 0x2c], 0
call fcn.004d3817
mov ecx, dword [eax + 4]
call fcn.0041a410
mov ecx, dword [esp + 0xc]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20

Function at 0x41dad0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push edi
mov ebx, ecx
call fcn.004d3817
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41db3e
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x41db38
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x41db38
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov al, byte [esi]
test al, al
je 0x41db30
cmp al, 0xd
je 0x41db30
movsx ecx, al
push 0
push ecx
mov ecx, ebx
call fcn.0041d130
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41db17
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x42b989
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
fld qword [esp + 0x14]
push 0x4e0548
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
fstp dword [esi + 0x1d0]
fld qword [esp + 0x28]
mov eax, dword [esi + 0x318]
fstp dword [esi + 0x1d4]
fld qword [esp + 0x30]
test eax, eax
fstp dword [esi + 0x1d8]
jne 0x42b9db
mov eax, dword [esi + 0x31c]
test eax, eax
jne 0x42b9d2
push 0
push 0xa1
call fcn.004bbb9b
mov dword [esi + 0x31c], 1
jmp 0x42b9db
push 1
mov ecx, esi
call fcn.004bab4c
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x318], 1
call fcn.0042bae0
mov eax, dword [0x510fe4]
mov dword [esp + 0x20], eax
fld dword [esi + 0x1d0]
sub esp, 8
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0
fstp qword [esp]
push str._4.4f
push ecx
call fcn.004b4789
mov edx, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esi + 0x11c]
push edx
call fcn.004baa07
fld dword [esi + 0x1d4]
sub esp, 8
lea eax, [esp + 0x28]
fstp qword [esp]
push str._4.4f
push eax
call fcn.004b4789
mov ecx, dword [esp + 0x30]
add esp, 0x10
push ecx
lea ecx, [esi + 0x158]
call fcn.004baa07
fld dword [esi + 0x1d8]
sub esp, 8
lea edx, [esp + 0x28]
fstp qword [esp]
push str._4.4f
push edx
call fcn.004b4789
mov eax, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esi + 0x194]
push eax
call fcn.004baa07
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0xffffffff
call fcn.004bb422
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 0x24

Function at 0x42e710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e0993
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x10]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.004bf349
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 1
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x18], al
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x50], eax
mov eax, 0x3ff00000
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
push edi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], 0x12c
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, ebx
call fcn.004bf400
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x430100
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e0b89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004386a0
mov eax, dword [0x510fe4]
lea ebx, [esi + 0x40]
xor edi, edi
mov dword [esp + 0x38], edi
mov dword [ebx], eax
lea ecx, [esi + 0x44]
push 0xa
mov byte [esp + 0x3c], 1
call fcn.004b6207
mov dword [esi + 0x44], 0x4ece58
lea ecx, [esi + 0x60]
push 0xa
mov byte [esp + 0x3c], 2
call fcn.004b6207
mov dword [esi + 0x60], 0x4ece58
mov ecx, dword [ebp + 8]
push esi
mov byte [esp + 0x3c], 3
mov dword [esi], 0x4eedd0
mov dword [esi + 4], ecx
call fcn.00421c00
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x20]
call fcn.00467fe0
push eax
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x34]
call fcn.00467fe0
push eax
lea ecx, [esi + 0x18]
call fcn.00468f40
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, ebx
call fcn.004bb55b
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xa0], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0x7c], 4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8