joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b8dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp byte [0x419f90], bl
je 0x40b958
cmp byte [0x418ed0], bl
je 0x40b958
push esi
push 0x418ed0
lea esi, [ebp - 0x408]
call fcn.0040b8ae
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
test eax, eax
jne 0x40b958
push dword [ebp + 8]
call fcn.0040a331
inc eax
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40b95d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
cmp byte [0x419f90], 0
je 0x40b9df
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x40c]
call fcn.0040b8ae
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x40b9df
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b9d6
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call fcn.0040a424
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4

Function at 0x40bb37
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp byte [0x419ede], 0
mov eax, dword [ebp + 0x10]
mov dword [0x419ee0], eax
mov eax, dword [ebp + 0x14]
mov dword [0x419ee4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x419ed8], eax
je 0x40bb67
xor eax, eax
inc eax
jmp 0x40bb90
cmp byte [0x419edf], 0
je 0x40bb75
push 2
pop eax
jmp 0x40bb90
push dword [ebp + 0xc]
push 0x40ae44
push dword [0x419f80]
push str.REPLACEFILEDLG
push dword [0x414c74]
call esi
dec eax
je 0x40bbf1
dec eax
je 0x40bbd0
dec eax
je 0x40bbea
dec eax
jne 0x40bbc3
push dword [ebp + 0xc]
push 0x40b140
push dword [0x419f80]
push str.RENAMEDLG
push dword [0x414c74]
call esi
test eax, eax
je 0x40bb41
mov eax, dword [ebp + 8]
mov byte [eax], 0x52
jmp 0x40bc02
dec eax
je 0x40bbd8
dec eax
jne 0x40bc02
mov byte [0x419edf], 1
mov eax, dword [ebp + 8]
mov byte [eax], 0x4e
jmp 0x40bc02
mov eax, dword [ebp + 8]
mov dword [0x419f78], 1
mov byte [eax], 0x43
jmp 0x40bc02
mov byte [0x419ede], 1
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
mov byte [eax], 0x59
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
pop ebp
ret 0x18
Function at 0x40bd2d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push esi
mov esi, eax
push esi
call fcn.0040a331
cmp eax, 0x3f6
jae 0x40bf41
push ebx
push edi
push 0x3c
pop edi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x44]
push eax
call fcn.0040a236
mov cl, byte [esi]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x5c0
cmp cl, 0x22
jne 0x40bd75
lea eax, [esi + 1]
mov dword [ebp - 0x34], eax
jmp 0x40bd78
mov dword [ebp - 0x34], esi
xor eax, eax
cmp cl, bl
je 0x40bdbd
mov ecx, esi
cmp byte [ecx], 0x22
jne 0x40bd99
jmp 0x40bd8d
cmp byte [eax + esi], 0x22
je 0x40bd95
inc eax
cmp byte [eax + esi], bl
jne 0x40bd87
jmp 0x40bd99
mov byte [eax + esi], 0x20
cmp byte [eax + esi], 0x20
je 0x40bdb0
cmp byte [eax + esi + 1], 0x2f
je 0x40bdb0
inc eax
lea ecx, [eax + esi]
cmp byte [ecx], bl
jne 0x40bd80
jmp 0x40bdbd
add eax, esi
cmp byte [eax], 0x20
jne 0x40bdb9
mov byte [eax], bl
inc eax
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], bl
jne 0x40bdd1
cmp byte [0x41a392], bl
je 0x40bdd1
mov dword [ebp - 0x30], 0x41a392
push dword [ebp - 0x34]
mov dword [ebp - 0x28], 1
call fcn.0040763d
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40bdfd
push str..inf
push eax
call fcn.0040a547
test eax, eax
jne 0x40bdfd
mov dword [ebp - 0x38], 0x412658
push ebx
push dword [ebp - 0x34]
call fcn.00405728
mov byte [ebp - 1], al
cmp al, bl
je 0x40be25
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x34]
call fcn.004057de
lea eax, [ebp - 0x844]
mov dword [ebp - 0x34], eax
cmp byte [ebp + 8], bl
je 0x40be64
cmp byte [ebp - 1], bl
jne 0x40be64
push dword [ebp - 0x34]
lea eax, [ebp - 0x444]
push eax
call fcn.0040a424
push str..exe
lea eax, [ebp - 0x444]
push eax
call fcn.0040a58f
push ebx
lea eax, [ebp - 0x444]
push eax
call fcn.00405728
test al, al
je 0x40bf3f
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
setne al
cmp al, bl
jne 0x40be96
and dword [ebp - 0x40], 0xfffffbff
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x34], esi
call edi
test eax, eax
setne al
cmp al, bl
je 0x40bf3f
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
cmp byte [0x419f88], bl
jne 0x40beac
cmp byte [ebp + 8], bl
je 0x40bee3
mov eax, dword [0x419f80]
cmp eax, ebx
je 0x40becd
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40becd
push ebx
push dword [0x419f80]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc]
call fcn.0040b697
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40bf02
push str..exe
push dword [ebp - 8]
call fcn.0040a547
test eax, eax
je 0x40bf30
cmp byte [0x419f88], bl
je 0x40bf16
cmp byte [ebp + 8], bl
jne 0x40bf16
push 0x1b58
jmp 0x40bf2a
xor eax, eax
cmp byte [ebp + 8], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 1], bl
je 0x40bf3f
push 1
push dword [0x419f80]
call esi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x40d353
Capabilities:
Accept command line arguments
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x41fdc0
call fcn.0040e4d0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp esi, ebx
je 0x40d3db
push esi
call fcn.0040b432
cmp byte [0x419f91], bl
je 0x40d3cf
push str.winrarsfxmappingfile.tmp
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x40d3c6
push 0x10000
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x40d3bf
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d3db
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edi, 0x400
push edi
mov esi, 0x419ad8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push str.sfxname
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call fcn.00406e61
test eax, eax
je 0x40d412
push edi
push 0x4192d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x40d41a
xor eax, eax
mov word [0x4192d8], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x64
push edi
mov dword [0x414c78], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x65
push dword [0x414c78]
mov dword [0x4192d4], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
lea ecx, [ebp - 8]
mov dword [0x4192d0], eax
call fcn.0041164b
push esi
mov ecx, 0x414c88
call fcn.0040988d
lea ecx, [ebp - 0x40]
call fcn.00406435
lea ecx, [ebp - 0x24]
call fcn.00406435
push 0x64
call fcn.0040ac4e
push 0x64
mov dword [ebp - 0x28], eax
call fcn.0040ac4e
push ebx
push 0x40cbd9
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x40]
mov dword [0x418ecc], eax
push str.STARTDLG
lea eax, [ebp - 0x24]
push edi
mov dword [0x418ec8], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
lea ecx, [ebp - 0x24]
mov dword [0x419f80], ebx
mov dword [0x418ec8], ebx
mov dword [0x418ecc], ebx
call fcn.0040644b
lea ecx, [ebp - 0x40]
call fcn.0040644b
lea ecx, [ebp - 8]
call fcn.004116c3
cmp byte [0x419f88], bl
je 0x40d4db
call fcn.0040b6d6
push 0x80
push ebx
push 0x419ee8
call fcn.0040a236
cmp dword [0x41a824], ebx
jbe 0x40d4fe
push dword [0x41a818]
call fcn.0040a1b2
push dword [0x4192d4]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x4192d0]
cmp eax, ebx
je 0x40d518
push eax
call esi
cmp dword [0x414c7c], ebx
jne 0x40d537
cmp dword [0x419f78], ebx
je 0x40d537
push 0xff
mov ecx, 0x414c7c
call fcn.0040321d
mov eax, dword [0x41a828]
mov dword [0x419f78], 2
cmp eax, ebx
je 0x40d550
push eax
call fcn.0040b697
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x414c7c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d8c2
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x40c6a0
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x413fb8
call fcn.0040e408
mov edi, 0x94
mov eax, edi
call fcn.0040b7d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x413078]
mov ecx, dword [esi + 0x10]
mov dword [0x41a4ac], ecx
mov eax, dword [esi + 4]
mov dword [0x41a4b8], eax
mov edx, dword [esi + 8]
mov dword [0x41a4bc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x41a4b0], esi
cmp ecx, 2
je 0x40c700
or esi, 0x8000
mov dword [0x41a4b0], esi
shl eax, 8
add eax, edx
mov dword [0x41a4b4], eax
xor esi, esi
push esi
mov edi, dword [0x41311c]
call edi
cmp word [eax], 0x5a4d
jne 0x40c73b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c73b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40c753
cmp eax, 0x20b
je 0x40c740
mov dword [ebp - 0x1c], esi
jmp 0x40c767
cmp dword [ecx + 0x84], 0xe
jbe 0x40c73b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40c761
cmp dword [ecx + 0x74], 0xe
jbe 0x40c73b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0040c896
pop ecx
test eax, eax
jne 0x40c793
cmp dword [0x41a5f0], 1
jne 0x40c780
call fcn.0040fefd
push 0x1c
call fcn.0040fd86
push 0xff
call fcn.0040b49d
pop ecx
pop ecx
call fcn.0040dede
mov dword [ebp - 4], esi
call fcn.004104fb
test eax, eax
jge 0x40c7ac
push 0x1b
call fcn.0040c67b
pop ecx
call dword [0x41305c]
mov dword [0x41bb68], eax
call fcn.004103d9
mov dword [0x41a5e8], eax
call fcn.00410337
test eax, eax
jge 0x40c7d2
push 8
call fcn.0040c67b
pop ecx
call fcn.00410104
test eax, eax
jge 0x40c7e3
push 9
call fcn.0040c67b
pop ecx
push 1
call fcn.0040b4cd
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40c7f9
push eax
call fcn.0040c67b
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x413138]
call fcn.004100a7
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40c81a
movzx eax, word [ebp - 0x40]
jmp 0x40c81d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call section..text
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40c83b
push edi
call fcn.0040b5f8
call fcn.0040b61a
jmp 0x40c86d
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040e443
ret
Function at 0x412df1
Capabilities:
Encode data using xor

Disassembly:
push eax
cdq
mov dword [edi + 0x31], eax
or dword [eax], esi
add byte [esi], dh
mov al, byte [eax]
mov dword [0x4789a350], eax
xor ebx, ecx
push esp
sbb al, 0x36
add dword [eax], eax
mov dword [0x47899a50], eax
xor dword [0x1361c55], ebp
add byte [edx + 0x41488f26], al
invalid
Function at 0x10001af0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10001159
test eax, eax
jne 0x10001b5b
push str.___Failed_to_change_mapping_protection_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
xor eax, eax
jmp 0x10001bd5
push str.___Fixing_Image_Base_address_in_PEB_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 8
mov eax, dword fs:[0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
add eax, dword [ecx + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push str.___Executing_Entry_Point:_0x_08x_n
mov esi, esp
push 2
call dword [sym.imp.ucrtbased.dll___acrt_iob_func]
add esp, 4
cmp esi, esp
call fcn.10001159
push eax
call fcn.1000114f
add esp, 0xc
mov eax, dword [ebp - 0x14]
call eax
int3
push edx
mov ecx, ebp
push eax
lea edx, [0x10001bfc]
call fcn.1000110e
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.10001159
mov esp, ebp
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5fb008], 0x8088405
inc edx
mov dword [ebx + 0x5fb008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e5a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e2a63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e655
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e63e
test esi, esi
jbe 0x41e655
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e630
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e655
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e60d
jmp 0x41e655
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e655
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e2a6a
ret
Function at 0x41eec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x5e3473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eeff
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ef18
lea eax, [ebp - 0x10]
mov edx, dword [0x5fd2a4]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ef2b
lea eax, [ebp - 0x10]
mov edx, dword [0x5fd2a4]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ef37
adc edx, 0
mov edx, dword [edx*4 + 0x5fc10c]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41f045
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f038
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f038
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f038
cmp dx, 0x150
ja 0x41f038
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f038
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f038
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f05d
inc ebx
cmp ebx, 0x19
jne 0x41eef1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e347a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x47c255
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4be38f
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4fc504]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
push esi
push edi
mov eax, dword [0x4fc504]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x14]
push eax
call fcn.0045eafd
push ecx
push ecx
lea ecx, [esp + 0x24]
call fcn.0042c0ac
and dword [esp + 0xe0], 0
lea eax, [esp + 0x1c]
push dword [esp + 0x18]
mov ecx, esi
push dword [esp + 0x18]
push eax
call fcn.004285c2
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x20]
call fcn.0042c176
mov ebx, dword [esp + 0xc8]
lea eax, [ebx + 1]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x47c358
push dword [esi + 0x73c]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x47c338
cmp dword [esp + 0xcc], 0x10
mov eax, dword [esp + 0xb8]
jae 0x47c329
lea eax, [esp + 0xb8]
push ebx
push eax
push esi
call fcn.00490850
add esp, 0xc
mov byte [esi + ebx], 0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push str.Rich_Text_Format
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 1
lea ecx, [esp + 0xc0]
call fcn.0040177c
or dword [esp + 0xe0], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.0042c133
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], vtable.std::ios_base.0
push eax
call fcn.004b6556
pop ecx
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.004906a0
mov esp, ebp
pop ebp
ret

Function at 0x47c3b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4fc504]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x254]
mov ecx, esi
call fcn.0042e86a
test al, al
jne 0x47c45f
cmp dword [esi + 0x14], 8
jb 0x47c3e1
mov esi, dword [esi]
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.0042f8f2
mov eax, dword [ebp - 0xc]
push dword [ebx + 0x73c]
lea edi, [eax*2 + 2]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x47c452
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x47c44c
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x47c43c
cmp dword [ebp - 8], 8
mov ecx, dword [ebp - 0x1c]
jae 0x47c431
lea ecx, [ebp - 0x1c]
push edi
push ecx
push eax
call fcn.00490850
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040f05a
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b65d5
mov esp, ebp
pop ebp
ret