joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x466d83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x466d6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46d700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49a5be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0046e020
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4c5804
call fcn.0048c0b0
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x46d793
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048c0b0
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46d78c
push 0
mov ecx, eax
call fcn.004648a0
mov dword [esi + 0xc], eax
jmp 0x46d795
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x46d795
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x48e713
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48e74b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048c7ca
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048c7a2
jmp 0x48e757
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48fe08
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48fe4a
call fcn.004958c2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48fe4a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48fe41
xor eax, eax
jmp 0x48fe52
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048fe58
pop edi
pop esi
pop ebx
ret 4
Function at 0x495df2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x495e20
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x495e3e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00495d58
jmp 0x495e3e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x495e3e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00495d58
test edi, edi
mov eax, edi
jne 0x495e28
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1001b3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push edi
test ecx, ecx
je 0x1001b42a
mov edi, dword [ebp + 0x18]
push edi
call fcn.1002ccd0
add esp, 4
cmp ecx, eax
jl 0x1001b42a
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov word [esi], ax
mov byte [ebp + 0x13], al
mov al, 0x40
add al, 0x40
mov byte [ebp + 0x13], al
nop
xor eax, eax
test edi, edi
jle 0x1001b420
mov dl, byte [ebp + 8]
push ebx
lea esp, [esp]
nop
nop
mov ecx, dword [ebp + 0x14]
mov cl, byte [eax + ecx]
xor cl, byte [ebp + 0x13]
nop
mov ebx, eax
and ebx, 3
mov bl, byte [ebx + 0x10044508]
add bl, dl
xor bl, cl
movzx ecx, bl
mov word [esi + eax*2], cx
nop
xor ecx, ecx
mov word [esi + eax*2 + 2], cx
inc eax
cmp eax, edi
jl 0x1001b3f0
pop ebx
nop
pop esi
mov eax, 1
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret
Function at 0x100203b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x100203be
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 3
jb 0x10020439
nop
cmp edx, 4
jbe 0x10020439
movzx ecx, byte [esi]
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
mov ebx, ecx
shr ebx, 0x12
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
mov ebx, ecx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], bl
mov ebx, ecx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], bl
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
sub edi, 3
mov byte [eax + 3], cl
add esi, 3
add eax, 4
sub edx, 4
cmp edi, 3
jae 0x100203d0
test edi, edi
je 0x100204af
cmp edx, 4
jbe 0x100204af
movzx ecx, byte [esi]
shl ecx, 0x10
mov edx, ecx
shr edx, 0x12
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
cmp edi, 1
jne 0x1002047f
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov byte [eax + 2], 0x3d
add eax, 3
mov byte [eax], 0x3d
pop edi
inc eax
pop esi
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
pop ebx
pop ebp
ret
movzx edx, byte [esi + 1]
shl edx, 8
or ecx, edx
mov edx, ecx
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ecx, 6
mov byte [eax + 1], dl
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
add eax, 3
mov byte [eax], 0x3d
inc eax
pop edi
pop esi
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
pop ebx
pop ebp
ret
Function at 0x10020610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x84], 0x33323156
mov dword [ebp - 0x80], 0x37363534
mov dword [ebp - 0x7c], 0x62613938
mov dword [ebp - 0x78], 0x66656463
mov dword [ebp - 0x74], 0x6a696867
mov dword [ebp - 0x70], 0x6e6d6c6b
mov dword [ebp - 0x6c], 0x7271706f
mov dword [ebp - 0x68], 0x76757473
mov dword [ebp - 0x64], 0x7a797877
mov dword [ebp - 0x60], 0x44434641
mov dword [ebp - 0x5c], 0x48474245
mov dword [ebp - 0x58], 0x4c494a4b
mov dword [ebp - 0x54], 0x504f4e4d
mov dword [ebp - 0x50], 0x54535251
mov dword [ebp - 0x4c], 0x58573055
mov word [ebp - 0x48], 0x5a59
mov byte [ebp - 0x46], 0
mov dword [ebp - 0x44], 0x6f666442
mov dword [ebp - 0x40], 0x53707773
mov dword [ebp - 0x3c], 0x4d377846
mov dword [ebp - 0x38], 0x365a304b
mov dword [ebp - 0x34], 0x3868546b
mov dword [ebp - 0x30], 0x3472474f
mov dword [ebp - 0x2c], 0x31694a48
mov dword [ebp - 0x28], 0x43744e55
mov dword [ebp - 0x24], 0x587a5035
mov dword [ebp - 0x20], 0x6a443351
mov dword [ebp - 0x1c], 0x7579626e
mov dword [ebp - 0x18], 0x71325756
mov dword [ebp - 0x14], 0x616c4c76
mov dword [ebp - 0x10], 0x63675965
mov dword [ebp - 0xc], 0x39416d52
mov word [ebp - 8], 0x4945
mov byte [ebp - 6], 0
jne 0x10020729
lea ecx, [ebp - 0x44]
lea edi, [ebp - 0x84]
mov dword [ebp - 0x88], ecx
jmp 0x10020738
lea edx, [ebp - 0x84]
lea edi, [ebp - 0x44]
mov dword [ebp - 0x88], edx
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10020745
mov esi, dword [eax]
jmp 0x10020747
mov esi, eax
test ecx, ecx
je 0x1002078c
mov ebx, ecx
lea ecx, [ecx]
mov al, byte [esi]
cmp al, 0x30
jl 0x1002075a
cmp al, 0x39
jle 0x1002076a
cmp al, 0x61
jl 0x10020762
cmp al, 0x7a
jle 0x1002076a
cmp al, 0x41
jl 0x10020788
cmp al, 0x5a
jg 0x10020788
movsx eax, al
push eax
push edi
call fcn.10034730
add esp, 8
test eax, eax
je 0x10020788
mov ecx, dword [ebp - 0x88]
sub eax, edi
mov dl, byte [eax + ecx]
mov byte [esi], dl
inc esi
dec ebx
jne 0x10020750
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ad8e
mov esp, ebp
pop ebp
ret

Function at 0x10022bd0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp eax, ecx
jne 0x10022be3
mov eax, 1
pop ebp
ret
xor edx, edx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov word [eax + 0x1c], dx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
pop ebp
ret
Function at 0x1002c0e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x1002cc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002cc50
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1002cc4f
xor eax, eax
test edi, edi
jle 0x1002cc4f
mov cl, byte [ebp + 8]
lea esp, [esp]
mov dl, byte [eax + esi]
add dl, al
xor dl, cl
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x1002cc40
pop edi
pop esi
pop ebp
ret

Function at 0x1002cc60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002cc90
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1002cc8f
xor eax, eax
test edi, edi
jle 0x1002cc8f
mov cl, byte [ebp + 8]
lea esp, [esp]
mov dl, byte [eax + esi]
xor dl, cl
sub dl, al
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x1002cc80
pop edi
pop esi
pop ebp
ret

Function at 0x1002cca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1002ccc0
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x1002ccc0
xor eax, eax
test edx, edx
jle 0x1002ccc0
xor byte [eax + ecx], 0xa5
inc eax
cmp eax, edx
jl 0x1002ccb7
pop ebp
ret

Function at 0x1002ce20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002cd80

Function at 0x1002ce30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
or eax, 0xffffffff
test ecx, ecx
je 0x1002ce5b
mov edx, dword [ebp + 8]
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1004a010]
inc edx
dec ecx
jne 0x1002ce41
pop esi
not eax
pop ebp
ret

Function at 0x1002f4e5
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x1002f526
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x1002f4ff
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1002f544
dec esi
je 0x1002f53b
dec esi
jne 0x1002f549
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x403060
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403074
inc dword [0x4c2034]
add dword [0x4be40c], 0x108
mov edx, dword [0x4be40c]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c0b10
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4030a3
push 0
mov eax, 0x4c4040
call fcn.004157c0
cmp dword [0x4c2060], 0
mov dword [0x4c4ae8], 0
mov dword [0x4c4aec], 0
je 0x4030cb
push 0x4c26d0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40314f
or ecx, 0xffffffff
cmp byte [esi + 0xea], 0
jne 0x4030fa
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xea], al
test al, al
je 0x4030fa
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4c4af4], 0
je 0x40310c
cmp dword [0x4c4af0], 0
jne 0x403115
cmp byte [esi + 0xea], 0
je 0x40314f
cmp byte [esi + 0xea], 0
mov byte [esi + 0xe8], 0
jne 0x40314f
cmp dword [0x4c4af4], 0
jge 0x403137
pop edi
mov dword [esi + 0xdc], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xd8], eax
mov edx, dword [0x4c4af4]
mov dword [esi + 0xdc], edx
pop edi
pop esi
ret
Function at 0x403d70
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x403d94
push esi
call fcn.00404080
test eax, eax
jne 0x403d94
push str.Cant_open_clipboard_for_writing.
call fcn.00403e70
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x403dcd
cmp dword [esi + 0x18], ebx
je 0x403dbf
cmp dword [esi + 8], ebx
je 0x403db4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49cbac
call fcn.00403e70
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x403e06
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x403e2d
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x403e2d
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x403e23
cmp dword [esi + 8], ebx
je 0x403e18
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x403e42
mov dword [esi + 4], ebx
jmp 0x403e06
cmp dword [esi + 0x18], ebx
je 0x403e5f
cmp dword [esi + 8], ebx
je 0x403e54
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49cbcc
call fcn.00403e70
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x403f40
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
lea eax, [esi - 0xc000]
sub esp, 0x20c
cmp eax, 0x3fff
ja 0x403fdd
push 0x104
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.00489652
add esp, 0xc
test eax, eax
je 0x403fd4
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00488e19
add esp, 8
test eax, eax
je 0x403fd4
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00488e19
add esp, 8
test eax, eax
je 0x403fd4
lea edx, [esp]
push str.Native
push edx
call fcn.00488e19
add esp, 8
test eax, eax
je 0x403fd4
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00488e19
add esp, 8
test eax, eax
jne 0x403fe3
xor eax, eax
add esp, 0x20c
ret
xor ecx, ecx
mov word [esp], cx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push edi
call ebx
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push esi
mov ebp, eax
call edi
test eax, eax
jne 0x404070
lea ecx, [ecx]
cmp esi, 0xf
je 0x40406e
lea edx, [esp + 0xc]
push str.OwnerLink
push edx
call fcn.00488e19
add esp, 8
test eax, eax
je 0x40406e
mov eax, dword [0x4be3d0]
cmp eax, 0xffffffff
je 0x40403a
test eax, eax
je 0x40406e
call ebx
mov ecx, dword [0x4be3d0]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x40406e
push 1
push 0x8000012f
mov dword [0x4be3d4], 0
call fcn.004012b0
add esp, 8
push esi
mov dword [0x4be3d4], 1
call edi
test eax, eax
je 0x404000
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x404080
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0
je 0x404092
mov eax, 1
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [0x4c1ec8]
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
push ecx
mov edi, eax
call ebx
test eax, eax
jne 0x404100
mov eax, dword [0x4be3d0]
cmp eax, 0xffffffff
je 0x4040d1
test eax, eax
je 0x404116
call esi
mov edx, dword [0x4be3d0]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x404116
push 1
push 0x8000012f
mov dword [0x4be3d4], 0
call fcn.004012b0
mov eax, dword [0x4c1ec8]
add esp, 8
push eax
mov dword [0x4be3d4], 1
call ebx
test eax, eax
je 0x4040b2
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ecx + 0x18], 1
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
Function at 0x4075e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4c0dd8], 0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x40769b
mov al, byte [0x4c0dda]
cmp al, 0xa0
je 0x407606
cmp al, 0x10
jne 0x40769b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4c0dd4]
cmp eax, 0x16
jae 0x40769b
test ebp, 0x100
jne case.0x407637.13
movzx eax, byte [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407637.13
movzx eax, byte [eax + 0x407844]
jmp dword [eax*4 + 0x40783c]
mov cl, 1
jmp 0x407644
xor cl, cl
cmp byte [0x4c0dd9], 0
jne 0x407661
xor ecx, ecx
nop
cmp byte [ecx + 0x4c0dbc], 0
jne 0x40766c
inc ecx
cmp ecx, 0x16
jl 0x407650
jmp 0x40769b
cmp byte [esp + 0x1c], 0
je 0x407675
test cl, cl
je 0x40769b
mov byte [0x4c0ddb], 1
jmp 0x407679
test cl, cl
je 0x40769b
mov cl, byte [0x4c0dd3]
mov dl, byte [0x4c0dd2]
mov al, byte [0x4c0cdf]
mov byte [0x4c1ec7], cl
mov byte [0x4c1ef8], dl
mov byte [0x4c1f88], al
mov cl, byte [0x4c1ec7]
movzx esi, byte [esp + 0x14]
mov dl, byte [0x4c1ef8]
mov al, byte [0x4c1f88]
mov byte [0x4c0dd3], cl
lea ecx, [esi + esi*8]
mov byte [0x4c0dd2], dl
mov edx, dword [0x4c2904]
shl ecx, 5
mov bl, byte [ecx + edx + 4]
mov byte [0x4c0cdf], al
test bl, bl
je case.default.0x407812
cmp dword [edi + 0x10], 0xffc3d44f
setne dl
test byte [edi + 8], 0x10
mov byte [esp + 0xf], dl
je 0x4076f2
xor al, al
jmp 0x407707
mov eax, dword [esp + 0x1c]
push eax
mov al, byte [esp + 0x18]
call fcn.004078a0
mov dl, byte [esp + 0x13]
add esp, 4
cmp byte [esp + 0x1c], 0
mov byte [esp + 0x18], al
je 0x4077de
cmp byte [esp + 0x20], 0
jne 0x407731
mov cl, bl
not cl
and byte [0x4c1ec5], cl
test dl, dl
je 0x407731
and byte [0x4c1ec6], cl
cmp byte [esp + 0x18], 0
je case.default.0x407812
not bl
and byte [0x4c1ec7], bl
lea ecx, [esi - 0xa0]
mov byte [esi + 0x4c1ee8], 0
cmp ecx, 5
ja case.default.0x407812
jmp dword [ecx*4 + 0x407868]
mov cl, byte [0x4c1f89]
mov byte [0x4c1ef8], cl
jmp case.default.0x407812
mov dl, byte [0x4c1f88]
mov byte [0x4c1ef8], dl
jmp case.default.0x407812
mov al, byte [0x4c1f8b]
mov byte [0x4c1ef9], al
jmp case.default.0x407812
mov cl, byte [0x4c1f8a]
mov byte [0x4c1ef9], cl
jmp case.default.0x407812
mov dl, byte [0x4c1f8d]
mov byte [0x4c1efa], dl
jmp case.default.0x407812
mov al, byte [0x4c1f8c]
mov byte [0x4c1efa], al
test byte [edi + 8], 0x10
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop esi
mov word [0x4c0ddc], bp
pop ebp
mov byte [0x4c0dda], al
mov byte [0x4c0dd9], cl
pop ebx
je 0x407820
xor al, al
mov byte [0x4c0dd8], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c0dd4], eax
pop ecx
ret
cmp byte [esp + 0x20], 0
jne 0x4077f5
or byte [0x4c1ec5], bl
test dl, dl
je 0x4077f5
or byte [0x4c1ec6], bl
test al, al
je case.default.0x407812
or byte [0x4c1ec7], bl
lea ecx, [esi - 0xa0]
mov al, 0x80
mov byte [esi + 0x4c1ee8], al
cmp ecx, 5
ja case.default.0x407812
jmp dword [ecx*4 + 0x407880]
mov byte [0x4c1ef8], al
jmp case.default.0x407812
push ecx
call fcn.004078a0
add esp, 4
mov byte [0x4c0dd8], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c0dd4], eax
pop ecx
ret
Function at 0x4078a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 0xa0
je 0x4078af
cmp al, 0x10
jne case.0x407906.13
cmp byte [esp + 8], 0
jne case.0x407906.13
cmp byte [0x4c0ddb], 0
je 0x4078db
xor eax, eax
cmp byte [eax + 0x4c0dbc], 0
jne 0x4078db
inc eax
cmp eax, 0x16
jl 0x4078c1
mov byte [0x4c0ddb], 0
xor al, al
pop esi
ret
cmp byte [0x4c0dd9], 0
je case.0x407906.13
test dword [0x4c0ddc], 0x100
jne case.0x407906.13
movzx eax, byte [0x4c0dda]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407906.13
movzx eax, byte [eax + 0x407930]
jmp dword [eax*4 + 0x407928]
call esi
sub eax, dword [0x4c0dd4]
cmp eax, 0x16
jb 0x4078d7
call esi
mov dword [0x4c4e78], eax
mov al, 1
pop esi
ret