joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5a08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x34], al
mov edi, dword [ecx + 0x64]
lea esi, [ecx + 0x60]
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4c]
push eax
push ecx
push edi
mov ecx, esi
call fcn.0040eba0
push 1
mov ecx, esi
mov ebx, eax
call fcn.0040b6a0
mov dword [edi + 4], ebx
mov eax, dword [ebx + 4]
mov dword [eax], ebx
cmp dword [ebp - 0x20], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x4156f5
mov edx, dword [ebp - 0x34]
push edx
call fcn.004e11d0
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x64]
mov esi, dword [ecx + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
add esi, 8
push 0xffffffffffffffff
neg ecx
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esi], edx
mov edx, dword [ebp + 0x10]
push 0
mov dword [esi + 8], ecx
push eax
lea ecx, [esi + 0x14]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
mov dword [esi + 0xc], edx
call fcn.00408e40
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x10], ecx
mov cl, byte [ebp + 0x28]
mov byte [esi + 0x38], cl
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], eax
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x424630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f677b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esi], vtable.Sexy::LevelParser.0
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], ebx
push edi
mov dword [ebp - 0x14], esi
mov byte [esi + 0xc], bl
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov al, byte [ebp - 0xd]
lea edi, [esi + 0x54]
mov ecx, edi
mov byte [ebp - 4], 2
mov byte [edi], al
call fcn.00406150
mov dword [edi + 4], eax
mov byte [eax + 0x249], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov cl, byte [ebp - 0xd]
lea edi, [esi + 0x60]
mov byte [edi], cl
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00406150
mov dword [edi + 4], eax
mov byte [eax + 0x249], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dl, byte [ebp - 0xd]
lea edi, [esi + 0x6c]
mov ecx, edi
mov byte [ebp - 4], 4
mov byte [edi], dl
call fcn.004664f0
mov dword [edi + 4], eax
mov byte [eax + 0x39], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov al, byte [ebp - 0xd]
lea edi, [esi + 0x98]
mov byte [ebp - 4], 7
mov byte [edi], al
mov ecx, edi
call fcn.00482400
mov ecx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov byte [eax + 0x29], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], 0xf
mov byte [esi + 0xa8], bl
mov byte [esi + 0x24], bl
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4298a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x5480e4]
je 0x4298b8
mov ecx, 0x548ac0
jmp 0x481310
mov ecx, 0x5480f0
jmp 0x481b90
Function at 0x4298d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, 0x5480f0
jmp 0x481b90
cmp dword [ecx + 0x9c0], 0x270
jl 0x4813d3
xor eax, eax
push esi
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x5301ec]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 + 0x634]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0xe3
jl 0x481323
cmp eax, 0x26f
jge 0x481393
lea ecx, [ecx]
mov esi, dword [ecx + eax*4]
mov edx, dword [ecx + eax*4 + 4]
xor edx, esi
and edx, 0x7fffffff
xor edx, esi
mov esi, edx
and esi, 1
mov esi, dword [esi*4 + 0x5301ec]
shr edx, 1
xor esi, edx
xor esi, dword [ecx + eax*4 - 0x38c]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, 0x26f
jl 0x481360
mov eax, dword [ecx + 0x9bc]
mov edx, dword [ecx]
mov esi, dword [ecx + 0x630]
xor eax, edx
mov edx, dword [ecx + 0x9bc]
and eax, 0x7fffffff
xor eax, edx
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x5301ec]
xor edx, esi
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9bc], edx
mov dword [ecx + 0x9c0], 0
pop esi
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, 0x7fffffff
ret
jmp 0x481310
Function at 0x450650
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x45071a
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.Version
push eax
mov dword [ebp - 4], 2
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x78]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.MinVidMemory
push ecx
mov dword [ebp - 8], edx
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x7c]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0xc], edx
call edi
mov eax, dword [esi + 0x1c]
push 0x10
lea edx, [esi + 0x20]
push edx
push 3
push 0
push str.DisplayGUID
push eax
call edi
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x58]
inc eax
cmp ecx, 0x10
jb 0x4506e0
mov ecx, dword [esi + 0x44]
jmp 0x4506e3
lea ecx, [esi + 0x44]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
push 1
push 0
push str.FailureReason
push ecx
call edi
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
inc eax
cmp ecx, 0x10
jb 0x450705
mov ecx, dword [esi + 0x60]
jmp 0x450708
lea ecx, [esi + 0x60]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push 1
push 0
push str.Warning
push edx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x456b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.004e2130
mov eax, dword [0x532ae0]
xor eax, dword [ebp + 4]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
mov byte [ebx + 0x82], 1
jne 0x456bab
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004e19df
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.Version
mov edi, 4
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
test eax, eax
je 0x456bf3
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004e19df
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], 2
jne 0x456bdf
lea edx, [ebp - 8]
push edx
mov edx, dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.MinVidMemory
push edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x456bdf
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x78]
jne 0x456bdf
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebx + 0x1c]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x456bdf
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebx + 0x7c]
jne 0x456bdf
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push str.DisplayGUID
push eax
mov dword [ebp - 8], 0x10
mov dword [ebp - 0xc], 3
call esi
test eax, eax
jne 0x456bdf
cmp dword [ebp - 8], 0x10
jne 0x456bdf
mov ecx, edi
lea edi, [ebx + 0x20]
lea esi, [ebp - 0x28]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x456bdf
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x1028]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push str.FailureReason
mov edi, 1
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0x1000
call esi
test eax, eax
jne 0x456bdf
lea ecx, [ebp - 0x1028]
push ecx
lea ecx, [ebx + 0x40]
call fcn.00409b00
lea edx, [ebp - 8]
push edx
mov edx, dword [ebx + 0x1c]
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.Warning
push edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0x1000
call esi
test eax, eax
jne 0x456bdf
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebx + 0x5c]
call fcn.00409b00
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
mov byte [ebx + 0x82], 0
mov al, 1
pop ebx
call fcn.004e19df
mov esp, ebp
pop ebp
ret
Function at 0x45a110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
call dword [ecx + 0x14]
push 0x4feee9
push eax
call fcn.00456d90
mov eax, dword [esi + 0x18]
mov edx, dword [eax]
add esp, 8
push ebx
push 0x3f800000
push 0xff000000
push 1
push ebx
push ebx
push eax
call dword [edx + 0x28]
push str.Clear
push eax
call fcn.00456d90
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
add esp, 8
push 1
push 0x1b
push eax
call dword [ecx + 0x50]
push str.D3DRENDERSTATE_ALPHABLENDENABLE__TRUE
push eax
call fcn.00456d90
mov eax, dword [esi + 0x18]
mov edx, dword [eax]
add esp, 8
push 5
push 0x13
push eax
call dword [edx + 0x50]
push str.D3DRENDERSTATE_SRCBLEND__D3DBLEND_SRCALPHA
push eax
call fcn.00456d90
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
add esp, 8
push 6
push 0x14
push eax
call dword [ecx + 0x50]
push str.D3DRENDERSTATE_DESTBLEND__D3DBLEND_INVSRCALPHA
push eax
call fcn.00456d90
mov eax, dword [esi + 0x18]
mov edx, dword [eax]
add esp, 8
push 1
push 0x16
push eax
call dword [edx + 0x50]
push str.D3DRENDERSTATE_CULLMODE__D3DCULL_NONE
push eax
call fcn.00456d90
add esp, 8
push 0x40
push 0x40
lea ecx, [ebp - 0x2c]
call fcn.00450620
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004416b0
push 0xffffffffffffffff
push 0xfffffffffffffffe
push 0xfffffffffffffffe
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00458ff0
mov eax, dword [esi + 0x18]
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov ecx, esi
call fcn.00456f10
lea ecx, [ebp - 0x2c]
call fcn.0044cc50
push ebx
push ebx
push 0x3e
push 0x3e
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004417e0
cmp eax, ebx
jne 0x45a256
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, str.Clip_problem_detected.
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
lea edx, [eax + 1]
jmp 0x45a270
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45a270
sub eax, edx
push eax
push str.Clip_problem_detected.
lea ecx, [ebp - 0x48]
call fcn.00408ff0
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.00456d70
mov bl, al
cmp dword [ebp - 0x30], 0x10
jb 0x45a2ad
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004e11d0
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464550
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 0
push 0
call dword [eax + 0xb4]
mov ecx, dword [esi + 0x2fc]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
mov byte [esi + 0x2f0], 1
mov ecx, esi
pop esi
jmp dword [edx + 0x20]

Function at 0x464580
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x2f1]
test al, al
jne 0x464665
mov al, byte [esi + 0x51d]
test al, al
mov byte [esi + 0x2f1], 1
je 0x4645cc
mov ecx, dword [esi + 0x7c]
mov edx, dword [esi + 0x78]
mov eax, dword [esi]
push ecx
push edx
mov ecx, esi
call dword [eax + 0xb4]
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x80]
mov eax, dword [esi]
push ecx
push edx
mov ecx, esi
call dword [eax + 0xb8]
mov al, byte [esi + 0x504]
test al, al
je 0x4645ef
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0xa
call edi
mov al, byte [esi + 0x504]
test al, al
jne 0x4645e0
pop edi
mov ecx, dword [esi + 0x324]
test ecx, ecx
je 0x4645fe
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [esi + 0x314]
call fcn.00481540
mov ecx, dword [esi + 0x314]
call fcn.00490410
test eax, eax
jne 0x46461f
mov byte [esi + 0x318], 1
mov al, byte [esi + 0x2f2]
test al, al
jne 0x464640
mov eax, dword [esi + 0x31c]
test eax, eax
je 0x464640
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x464640
mov ecx, dword [eax]
push eax
call dword [ecx + 0x4c]
mov eax, dword [esi + 0x2fc]
test eax, eax
je 0x464653
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [esi + 0x380]
test al, al
je 0x464665
mov edx, dword [esi]
mov ecx, esi
pop esi
jmp dword [edx + 0x44]
pop esi
ret
Function at 0x465bc0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x57ef14]
test al, al
push esi
mov esi, ecx
jne 0x465ce6
mov al, byte [esi + 0x51d]
test al, al
mov al, byte [esi + 0x501]
je 0x465c50
test al, al
je 0x465c15
mov al, byte [esi + 0x502]
test al, al
jne 0x465c15
mov al, byte [esi + 0x57c]
test al, al
je 0x465c15
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0x502], 1
call dword [eax + 0x30]
mov cl, byte [esi + 0x502]
cmp cl, byte [esi + 0x57c]
jne 0x465ce6
mov eax, dword [esi + 0x49c]
cmp eax, dword [esi + 0x568]
je 0x465ce6
mov cl, byte [esi + 0x4dd]
test cl, cl
jne 0x465ccf
inc eax
mov dword [esi + 0x49c], eax
jmp 0x465cba
test al, al
je 0x465caa
mov al, byte [esi + 0x502]
test al, al
jne 0x465caa
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0x502], 1
call dword [eax + 0x30]
mov al, byte [esi + 0x51c]
test al, al
je 0x465caa
push edi
mov ecx, esi
call fcn.004648d0
push 1
lea edi, [esi + 0x53c]
push 0
mov ecx, edi
call fcn.0048e7d0
push 5
push 9
mov ecx, edi
call fcn.0048e7d0
pop edi
mov al, byte [esi + 0x4dd]
test al, al
jne 0x465ccf
inc dword [esi + 0x49c]
mov ecx, dword [esi + 0x2dc]
call fcn.00479f70
test al, al
je 0x465ccf
inc dword [esi + 0x4ec]
mov ecx, dword [esi + 0x324]
mov edx, dword [ecx]
call dword [edx + 0x34]
mov ecx, dword [esi + 0xd0]
pop esi
jmp fcn.00496a50
pop esi
ret

Function at 0x466130
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ecx + 0x51d]
test al, al
je 0x466143
mov al, 1
pop ebp
ret 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x466160
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
pop ebp
ret 4
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
pop ebp
ret 4
Function at 0x4661c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0x2fc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4662ac
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
push edi
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x18], 0x10
lea ecx, [esi + 4]
mov dword [ebp + 8], ecx
jb 0x466206
mov ecx, dword [ecx]
mov edx, eax
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x466208
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
push edi
push 1
call ebx
push edi
push 7
call ebx
push edi
push 0x10
call ebx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
cmp ecx, 0x10
mov ecx, dword [ebp + 8]
jb 0x46623e
mov ecx, dword [ecx]
push 0
push 0
push eax
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea edx, [edi + edi + 2]
push edx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
cmp edx, 0x10
mov edx, dword [ebp + 8]
mov dword [ebp - 4], eax
jb 0x46627c
mov edx, dword [edx]
push edi
push eax
push ecx
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 4]
push ebx
mov word [eax + edi*2], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x466f10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9d28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov ecx, dword [esi + 0x5d8]
lea eax, [ebp - 0x28]
push eax
call fcn.00485310
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call dword [edx + 0x50]
cmp dword [ebp - 0x10], 0x10
pop esi
jb 0x466f5f
mov eax, dword [ebp - 0x24]
push eax
call fcn.004e11d0
add esp, 4
mov al, byte [ebp + 8]
test al, al
je 0x466f6d
push 0
call fcn.004e28bf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x468680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0x503]
test al, al
push edi
je 0x46869b
mov eax, dword [esi]
call dword [eax + 0x80]
mov ecx, dword [esi + 0x49c]
cmp ecx, dword [esi + 0x4ac]
jl 0x4686b3
mov al, byte [esi + 0x4b0]
test al, al
je 0x46872b
mov cl, byte [0x57ef58]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, 1
test al, cl
jne 0x4686e0
or dword [0x57ef58], eax
call ebx
mov dword [0x57ef54], eax
jmp 0x4686e0
mov edi, dword [esi + 0x49c]
cmp edi, dword [esi + 0x4ac]
jl 0x4686f8
mov al, byte [esi + 0x4b0]
test al, al
je 0x46872b
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
cmp edi, dword [esi + 0x49c]
je 0x468724
call ebx
sub eax, dword [0x57ef54]
cmp eax, 0x3e8
jb 0x4686e0
call ebx
mov edx, dword [esi]
mov ecx, esi
mov dword [0x57ef54], eax
call dword [edx + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x4a8]
test al, al
jne 0x468849
fld qword [esi + 0x4a0]
fcomp qword [0x4ff9c8]
fnstsw ax
test ah, 0x41
jne 0x468849
fild dword [esi + 0x488]
fdiv qword [esi + 0x4a0]
call fcn.004e11d8
mov edi, eax
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [esi + 0x48c]
mov ebx, eax
mov ecx, ebx
xor eax, eax
sub ecx, edx
cmp ecx, edi
mov dword [ebp - 4], eax
jl 0x468809
mov edx, dword [esi + 0x484]
inc edx
mov ecx, edx
cmp ecx, 0xa
mov dword [esi + 0x484], edx
jl 0x4687a0
mov cl, byte [esi + 0x502]
test cl, cl
jne 0x468809
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
mov eax, dword [esi + 0x48c]
add eax, edi
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x3e8
mov dword [esi + 0x48c], eax
jle 0x4687cd
lea edx, [ebx - 0x3e8]
mov dword [esi + 0x48c], edx
mov edi, dword [ebp - 4]
mov al, byte [esi + 0x502]
test al, al
jne 0x468849
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, edi
sub eax, ebx
add eax, eax
sub eax, edi
cmp eax, 0xfa
jle 0x46883e
mov eax, 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.004685e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x484], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [esi + 0x48c]
cmp eax, edi
jge 0x4687cd
mov edx, dword [esi + 0x494]
sub edi, eax
inc edx
push edi
mov dword [esi + 0x494], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4687d0
test eax, eax
jl 0x468849
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.004685e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ad90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov al, byte [esi + 0x3d4]
test al, al
push edi
mov edi, dword [ebp + 8]
je 0x46addc
cmp dword [esi + 0x3f0], 0x10
mov ecx, dword [esi + 0x3ec]
jb 0x46adbb
mov eax, dword [esi + 0x3dc]
jmp 0x46adc1
lea eax, [esi + 0x3dc]
push ecx
push eax
mov eax, dword [edi + 0x14]
push eax
push 0
mov ecx, edi
call fcn.00403530
test eax, eax
jne 0x46addc
pop edi
mov al, 1
pop esi
pop ebp
ret 8
mov cl, byte [ebp + 0xc]
push 0xffffffffffffffff
push 0
mov byte [esi + 0x3d5], cl
push edi
lea ecx, [esi + 0x3d8]
mov byte [esi + 0x3d4], 1
call fcn.00408e40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x3f4], eax
cmp dword [edi + 0x18], 0x10
jb 0x46ae13
mov eax, dword [edi + 4]
jmp 0x46ae16
lea eax, [edi + 4]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x46add4
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x5c]
pop edi
xor al, al
pop esi
pop ebp
ret 8