joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c20c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040433c
mov eax, dword [ebp - 8]
call fcn.0040433c
xor eax, eax
push ebp
push 0x48c2d3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x48c249
mov eax, dword [ebp - 8]
call fcn.0040434c
mov ebx, eax
jmp 0x48c24b
xor ebx, ebx
lea eax, [ebp - 0x4c]
mov edx, 0x44
call fcn.0040813c
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov ax, word [ebp + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040434c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x48c299
xor ebx, ebx
jmp 0x48c2b8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c2da
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f1c
ret
Function at 0x48c2e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x48c459
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
call fcn.00466894
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov edx, 0x48c470
call fcn.00404298
jne 0x48c346
push 5
push 0
push 0
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
call fcn.0040434c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
test bl, bl
jne 0x48c43e
lea ecx, [ebp - 8]
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
mov edx, 0x48c47c
call fcn.00409aa0
lea eax, [ebp - 0x14]
call fcn.00466bb4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x48c48c
call fcn.004041d4
mov eax, dword [ebp - 8]
call fcn.004098c8
test al, al
je 0x48c3e9
mov eax, dword [0x76790c]
mov eax, dword [eax]
add eax, 0x40
mov edx, dword [ebp - 8]
call fcn.00403f4c
lea ecx, [ebp - 4]
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
mov edx, 0x48c4a0
call fcn.00409aa0
mov eax, dword [ebp - 4]
call fcn.004098c8
test al, al
je 0x48c3d6
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov ecx, 0x3ee
mov edx, 0xb
call fcn.00456c18
jmp 0x48c43e
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov edx, 0xa
call fcn.00456c0c
jmp 0x48c43e
mov eax, dword [ebp - 0x10]
call fcn.004098c8
test al, al
je 0x48c40f
push 5
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040434c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x48c43e
push 0x40
lea edx, [ebp - 0x18]
mov eax, dword [0x76790c]
mov eax, dword [eax]
call fcn.0045627c
mov eax, dword [ebp - 0x18]
call fcn.0040434c
push eax
push 0x48c4a8
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c460
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403f1c
ret
Function at 0x48c8f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48c9bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0048aef8
cmp dword [ebp - 4], 0
je 0x48c9a2
mov eax, dword [ebp - 4]
call fcn.004098c8
test al, al
je 0x48c956
mov eax, dword [ebp - 4]
call fcn.0040434c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x48c956
mov eax, dword [ebp + 8]
add eax, 0x70
mov edx, dword [ebp - 4]
call fcn.00403f4c
jmp 0x48c9a2
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00466314
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00403f90
mov eax, dword [ebp - 4]
call fcn.0048871c
test al, al
jne 0x48c98e
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409b68
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00403f90
mov eax, dword [ebp - 4]
call fcn.0048871c
test al, al
je 0x48c9a2
mov eax, dword [ebp - 4]
call fcn.00409e1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c9c4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403f1c
ret

Function at 0x48cb64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48cc10
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 0x48cc28
call fcn.004041d4
xor eax, eax
mov dword [ebp - 4], eax
push ebp
mov edx, 0x48cc38
mov eax, esi
call fcn.0048caa4
pop ecx
push ebp
mov edx, 0x48cc44
mov eax, edi
call fcn.0048caa4
pop ecx
push ebp
mov edx, 0x48cc50
mov eax, dword [ebp + 0xc]
call fcn.0048caa4
pop ecx
push ebp
mov edx, 0x48cc60
mov eax, dword [ebp + 8]
call fcn.0048caa4
pop ecx
push 1
push 0x48cc68
push 0x48cc68
mov eax, dword [ebp - 0x10]
call fcn.0040434c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cc17
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403f1c
ret

Function at 0x48ef14
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x48ef68
mov eax, dword [0x76790c]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x48ef40
push ebx
push 0x48f07c
call fcn.0044d7e0
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x48ef64
mov ecx, dword [0x767378]
mov dl, 1
mov eax, dword [0x408690]
call fcn.0040cb0c
call fcn.00403928
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
mov edx, 0x419
mov eax, ebx
call fcn.0048f3d4
pop ebx
ret
Function at 0x48f09c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048ef14
xor edx, edx
push ebp
push 0x48f13e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x48f111
mov edx, ebx
mov eax, dword [0x41ae30]
call fcn.0041f898
test al, al
je 0x48f101
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041f7a8
call fcn.004039c8
jmp 0x48f145
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x48f0cc
mov ecx, dword [0x76748c]
mov dl, 1
mov eax, dword [0x408690]
call fcn.0040cb0c
call fcn.00403928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f145
mov eax, dword [ebp - 4]
call fcn.0048eedc
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48f14c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048ef14
xor eax, eax
push ebp
push 0x48f1a4
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f1ab
mov eax, dword [ebp - 4]
call fcn.0048eedc
ret

Function at 0x48f1b4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048ef14
xor edx, edx
push ebp
push 0x48f209
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f210
mov eax, dword [ebp - 4]
call fcn.0048eedc
ret

Function at 0x48f280
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048ef14
xor eax, eax
push ebp
push 0x48f2f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048eec0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041f86c
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x48f2df
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f2fc
mov eax, dword [ebp - 4]
call fcn.0048eedc
ret
Function at 0x48f304
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048ef14
xor eax, eax
push ebp
push 0x48f379
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048eec0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x48f363
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f380
mov eax, dword [ebp - 4]
call fcn.0048eedc
ret

Function at 0x48f3d4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
push 4
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x48f456
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x48f445
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 4
call fcn.00402a0c
mov eax, dword [ebp - 8]
push eax
push 0x10
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f44c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x48f5cc
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x48f5e1
add esp, 0xfffffff0
call fcn.004034d0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0040433c
xor eax, eax
push ebp
push 0x48f68a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 8]
call fcn.0040434c
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
mov dword [ebx + 0x10], esi
cmp esi, 0xffffffff
je 0x48f669
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push 0
push 0
push 0
push 0x8000002
push 0
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
mov dword [ebx + 0x14], edi
push 0
push 0
push 0
push 4
push edi
call sub.kernel32.dll_MapViewOfFile
mov ecx, esi
mov edx, eax
mov eax, ebx
call fcn.00414840
jmp 0x48f674
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00414840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f691
lea eax, [ebp - 8]
call fcn.00403ef8
ret
Function at 0x48fbd0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
test ebx, ebx
js 0x48fbea
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x48fbe3
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48fc95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
xor ebx, ebx
mov eax, ebx
call fcn.00467098
test al, al
je 0x48fc79
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00467030
mov eax, dword [ebp - 0x10]
call fcn.0040434c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov esi, eax
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
mov dl, byte [ebp - 0xc]
test dl, dl
jb 0x48fc5a
inc edx
mov eax, dword [ebp - 8]
cmp esi, dword [eax]
jne 0x48fc4f
mov byte [ebp - 0x12], 1
jmp 0x48fc53
mov byte [ebp - 0x11], 1
add eax, 4
dec dl
jne 0x48fc45
mov al, byte [ebp + 8]
and al, byte [ebp - 0x12]
jne 0x48fc6e
cmp byte [ebp + 8], 0
sete al
and al, byte [ebp - 0x11]
je 0x48fc79
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc ebx
cmp bl, 0x1a
jne 0x48fc0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fc9c
lea eax, [ebp - 0x10]
call fcn.00403ef8
ret

Function at 0x490d10
Capabilities:
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [0x731954]
call fcn.00490c80
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x490deb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.0040434c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x490dd4
xor eax, eax
push ebp
push 0x490dcd
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
cmp dword [ebp - 0x10], 0
jne 0x490d7a
xor edx, edx
mov eax, ebx
call fcn.004144c4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490dd4
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490df2
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x4934c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4936a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x60]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
je 0x493525
lea edx, [ebp - 0x14]
mov eax, 0x4933b0
call fcn.0040627c
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x493354]
call fcn.0040ca50
call fcn.00403928
mov eax, dword [ebp - 4]
mov esi, eax
lea edi, [ebx + 8]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x44]
mov esi, eax
mov ecx, eax
sub ecx, 0x40
mov edx, dword [ebp - 4]
add edx, 0x40
mov eax, dword [ebx + 0x64]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [ebp - 4]
add eax, esi
cmp dword [eax], 0x4550
je 0x49357a
lea edx, [ebp - 0x18]
mov eax, 0x4933b8
call fcn.0040627c
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x493354]
call fcn.0040ca50
call fcn.00403928
add esi, 4
mov eax, dword [ebp - 4]
add eax, esi
push esi
mov esi, eax
lea edi, [ebx + 0x48]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
pop esi
add esi, 0x14
mov edi, dword [ebp - 4]
add edi, esi
cmp word [edi], 0x10b
je 0x4935c0
lea edx, [ebp - 0x1c]
mov eax, 0x4933c0
call fcn.0040627c
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x493354]
call fcn.0040ca50
call fcn.00403928
movzx edx, word [ebx + 0x58]
lea eax, [ebx + 0x5c]
call fcn.004027cc
movzx ecx, word [ebx + 0x58]
mov edx, dword [ebx + 0x5c]
mov eax, edi
call fcn.00402a0c
movzx eax, word [ebx + 0x58]
add esi, eax
mov edi, dword [ebp - 4]
add edi, esi
movzx eax, word [ebx + 0x4a]
shl eax, 3
lea eax, [eax + eax*4]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x14]
sub eax, dword [ebp - 0xc]
mov dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 0
jle 0x49361f
mov eax, dword [ebx + 0x6c]
call fcn.0040279c
mov dword [ebx + 0x68], eax
mov edx, dword [ebx + 0x68]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebx + 0x6c]
call fcn.00402a0c
movzx eax, word [ebx + 0x4a]
dec eax
test eax, eax
jl 0x49365d
inc eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 4]
add edi, esi
push edi
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4931d0]
call fcn.00493df8
mov edx, eax
mov eax, dword [ebx + 0x60]
call fcn.00423f60
add esi, 0x28
dec dword [ebp - 0x10]
jne 0x49362c
mov esi, dword [edi + 0x14]
add esi, dword [edi + 0x10]
mov edi, dword [ebp - 8]
sub edi, esi
mov dword [ebx + 0x74], edi
test edi, edi
jle 0x493689
mov eax, edi
call fcn.0040279c
mov dword [ebx + 0x70], eax
mov edx, dword [ebx + 0x70]
mov eax, dword [ebp - 4]
add eax, esi
mov ecx, dword [ebx + 0x74]
call fcn.00402a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4936ab
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f1c
ret
Function at 0x49cbc4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x49cc15
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x49cbfc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x49cbec
jmp 0x49cc15
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x49cbfd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aaa20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00412558
mov esi, eax
xor eax, eax
push ebp
push 0x4aaa9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x4aaa7e
mov edx, ebx
mov eax, esi
call fcn.004120b8
test byte [eax + 0x48], 1
je 0x4aaa78
push 0
mov edx, ebx
mov eax, esi
call fcn.004120b8
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.00411fa8
dec ebx
cmp ebx, 0xffffffff
jne 0x4aaa4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aaaa1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.004125bc
ret

Function at 0x4b5284
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x768d94], 0
je 0x4b52ca
lea edx, [ebp - 0x24]
mov ecx, 0x10
mov eax, dword [0x768d94]
call fcn.004d8618
test al, al
je 0x4b52ca
cmp dword [ebp - 0x24], 0x474e5089
jne 0x4b52ca
cmp dword [ebp - 0x20], 0xa1a0a0d
jne 0x4b52ca
mov eax, dword [0x768d94]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b5405
mov dl, 1
mov eax, dword [0x488a14]
call fcn.00403140
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b53fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.004d859c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x4b53e8
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00489020
mov ebx, eax
push ebx
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x4b53cc
call fcn.0048f470
mov edx, 4
call fcn.0048ef7c
xor eax, eax
push ebp
push 0x4b53c5
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x4b53a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalSize
cmp eax, 0x10
jbe 0x4b538f
cmp dword [esi], 0x474e5089
jne 0x4b538f
cmp dword [esi + 4], 0xa1a0a0d
jne 0x4b538f
mov dword [ebp - 4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b53ad
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
cmp dword [ebp - 4], 0
je 0x4b53dc
mov eax, dword [ebp - 4]
mov dword [0x768d94], eax
jmp 0x4b53e8
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x4b5313
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5405
mov eax, dword [ebp - 0x10]
call fcn.00403170
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b54a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x768990
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4b54c2
shr eax, 1
xor eax, 0xedb88320
jmp 0x4b54c4
shr eax, 1
dec edx
jne 0x4b54b0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4b54a9
mov byte [0x768d90], 1
pop esi
pop ebx
ret

Function at 0x4b54e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x768d90], 0
jne 0x4b54f7
call fcn.004b54a0
mov eax, edi
dec eax
test eax, eax
jl 0x4b5520
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x768990]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4b5501
mov eax, ebx
pop edi
pop esi
pop ebx
ret