joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c540
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x47c589
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x47ca00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a2060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0047c5b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0047c630
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0047c630
lea ecx, [esi + 0xc]
call fcn.0049364f
lea ecx, [esi + 0x10]
call fcn.0049364f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0047dbc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0047dbc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0047dbc0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004936c4
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004936c4
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x495a68
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x495aa0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00493b1f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00493af7
jmp 0x495aac
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x497156
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x497198
call fcn.0049cece
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x497198
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49718f
xor eax, eax
jmp 0x4971a0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004971a6
pop edi
pop esi
pop ebx
ret 4

Function at 0x49d3fe
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49d42c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49d44a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049d364
jmp 0x49d44a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49d44a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049d364
test edi, edi
mov eax, edi
jne 0x49d434
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40224b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040224b
xor esi, esi
mov ecx, 0x86
push esi
dec ecx
jne 0x402265
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
and esi, esi
je 0x402371
mov edi, dword [ebp + 0x10]
and edi, edi
je 0x402371
mov edx, dword [ebp + 0xc]
and edx, edx
je 0x402371
push esi
push edi
push edx
xor eax, eax
lea esi, [ebp - 0x198]
lea edi, [ebp - 0x298]
mov byte [esi + eax], al
mov bl, byte [edx]
cmp bl, 0
je 0x4022c1
mov byte [edi + eax], bl
inc edx
inc eax
cmp eax, 0x100
jl 0x40229e
jmp 0x4022d5
pop edx
push edx
mov bl, byte [edx]
mov byte [edi + eax], bl
inc edx
inc eax
cmp eax, 0x100
jl 0x40229e
xor ecx, ecx
xor edx, edx
mov al, byte [esi + ecx]
mov ah, byte [edi + ecx]
add al, ah
mov ah, dl
add al, ah
mov edx, eax
and edx, 0xff
mov bl, byte [esi + ecx]
mov al, byte [esi + edx]
mov byte [esi + ecx], al
mov byte [esi + edx], bl
inc ecx
cmp ecx, 0x100
jl 0x4022d9
pop edx
pop edi
pop esi
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov eax, 0x4d2
cmp edx, dword [ebp + 0x14]
jge 0x402371
mov al, byte [esi + edx]
inc ch
and ch, 0xff
push esi
lea esi, [ebp - 0x198]
push eax
push ebx
xor eax, eax
mov ah, ch
shr eax, 8
mov ebx, eax
mov al, byte [esi + ebx]
add cl, al
and cl, 0xff
pop ebx
xor eax, eax
mov al, cl
mov bl, byte [esi + eax]
mov al, ch
mov bh, byte [esi + eax]
mov byte [esi + eax], bl
mov al, cl
mov byte [esi + eax], bh
pop eax
add bl, bh
and ebx, 0xff
mov bh, byte [esi + ebx]
shr ebx, 8
xor al, bl
mov byte [edi + edx], al
pop esi
inc edx
jmp 0x402311
cmp eax, 0x4d2
je 0x402383
mov eax, 1
mov esi, eax
pop edi
pop esi
pop ebx
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x402908
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00402908
xor esi, esi
xor edi, edi
mov ecx, 0x12
push esi
dec ecx
jne 0x402924
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp + 8]
add eax, ecx
mov dword [ebp - 0x9c], eax
mov ebx, dword [ebp - 0x9c]
xor eax, eax
add ebx, eax
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xa0]
add eax, ecx
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xa0]
mov ecx, dword [ebx + 0x24]
add eax, ecx
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xa0]
mov ecx, dword [ebx + 0x20]
add eax, ecx
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xa0]
mov ecx, dword [ebx + 0x1c]
add eax, ecx
mov dword [ebp - 0xa8], eax
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
shr eax, 0x10
test eax, eax
je 0x402ac8
mov eax, 1
mov ebx, dword [ebp - 0xa0]
mov ecx, dword [ebx + 0x14]
neg eax
add eax, ecx
mov dword [ebp - 0xc4], eax
mov esi, 0
jmp 0x402ab5
mov ebx, dword [ebp - 0xa8]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x402ab3
mov eax, 1
mov ebx, dword [ebp - 0xa0]
mov ecx, dword [ebx + 0x18]
neg eax
add eax, ecx
mov dword [ebp - 0xcc], eax
mov edi, 0
jmp 0x402aa5
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
mov ebx, dword [ebp - 0xa4]
mov eax, edi
shl eax, 1
add ebx, eax
mov ax, word [ebx]
call fcn.00405f72
fcompp
fnstsw ax
sahf
jne 0x402aa3
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xac]
mov ecx, edi
shl ecx, 2
add ebx, ecx
mov ecx, dword [ebx]
add eax, ecx
mov dword [ebp - 0xb0], eax
mov ebx, dword [ebp - 0xb0]
call fcn.004066e3
mov ebx, dword [ebp + 0xc]
call fcn.004066e3
call fcn.004064c5
jne 0x402aa3
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xa8]
mov ecx, esi
shl ecx, 2
add ebx, ecx
mov ecx, dword [ebx]
add eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x402b65
inc edi
mov eax, edi
cmp eax, dword [ebp - 0xcc]
jbe 0x402a20
inc esi
mov eax, esi
cmp eax, dword [ebp - 0xc4]
jbe 0x4029e0
jmp 0x402b65
mov eax, 1
mov ebx, dword [ebp - 0xa0]
mov ecx, dword [ebx + 0x14]
neg eax
add eax, ecx
mov dword [ebp - 0xc4], eax
mov esi, 0
jmp 0x402b5b
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebx + 0x10]
call fcn.00405f7c
faddp st(1)
mov eax, dword [ebp - 0xbc]
call fcn.00405f7c
fcompp
fnstsw ax
sahf
jne 0x402b59
mov ebx, dword [ebp - 0xa8]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x402b54
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xa8]
mov ecx, esi
shl ecx, 2
add ebx, ecx
mov ecx, dword [ebx]
add eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x402b65
inc esi
mov eax, esi
cmp eax, dword [ebp - 0xc4]
jbe 0x402af0
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x404298
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..rdata__
test word [0x40427a], 4
jne 0x4042b3
jmp 0x4046e2
jmp fcn.004044e5
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.004043e1
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x404733
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00404487
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.004042b8
push 0xff
jb 0x4047b2
pop eax
movzx ecx, word [0x404278]
jecxz 0x40477d
push ecx
push 8
push esp
call dword [0x43b000]
pop eax
pop eax
call fcn.0040432d
push eax
mov ebx, section..rdata__
mov ecx, dword [ebx + 0xd8]
call fcn.004047be
mov ecx, dword [ebx + 0xb4]
jecxz 0x4047a2
push ecx
call dword [0x43b000]
mov edi, dword [ebx + 0x428]
call fcn.00404332
call fcn.00404319
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x4042b8
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x404318
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.004045c4
jb 0x404318
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.00404307
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x404321
push ebx
jb 0x40436e
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x4047c8
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00405ae3
jb 0x4047fe
jecxz 0x4047eb
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x4047e1
call fcn.004068db
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.004068d9
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.004044fc
Function at 0x4048ec
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x40490e
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x404906
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x40492b
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x4049a0
inc eax
dec ecx
je 0x404963
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x4049a0
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x404946
je 0x404963
jb 0x4049a0
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x4049a0
test byte [ebx + 4], 1
je 0x404976
mov dword [ebx + 0xc], eax
jmp 0x404993
push eax
call fcn.004044ad
pop ecx
jb 0x4049a2
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.004044fc

Function at 0x404a16
Capabilities:
Terminate process

Disassembly:
call fcn.00404a23
jb 0x404a1e
ret
jmp fcn.004044fc
Function at 0x4051bd
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov ax, word [ebp - 0x46]
call fcn.00405bb7
jb 0x405238
mov al, byte [esi + 0xc]
test al, 0x20
je 0x405234
mov ecx, edi
call fcn.00405ae3
jb 0x40523e
push ecx
push edx
push 0
lea edx, [esi + 0x3c]
push edx
push ecx
push edi
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_ReadFile]
call fcn.00406afb
mov al, dl
pop edx
pop ecx
jb 0x405227
and word [esi + 0x2c], 0xfffd
mov eax, dword [esi + 0x3c]
cmp eax, ecx
je 0x405218
or word [esi + 0x2c], 2
push esi
mov ecx, eax
mov esi, edx
call fcn.00405b65
pop esi
jb 0x40523e
add dword [esi + 0x14], eax
adc dword [esi + 0x18], 0
call fcn.004068db
pop edi
pop esi
ret
mov esi, edx
call fcn.00405b17
jmp 0x40523e
mov al, 0x36
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x3fb0
call fcn.004068d9
pop edi
pop esi
jmp fcn.004044fc
Function at 0x4055e2
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00405b3f
jecxz 0x405624
call fcn.00405ae3
jb 0x405670
cld
test eax, eax
je 0x40560f
lodsb al, byte [esi]
call fcn.0040573b
stosb byte es:[edi], al
loop 0x405602
mov esi, edx
jmp 0x40561c
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00405b17
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.004044f1

Function at 0x405843
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00405bb7
jb 0x405877
cmp word [esi + 0xa], 2
je 0x405873
push ecx
lea eax, [esi + 0x3c]
push eax
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_GetFileSize]
call fcn.00406afb
pop ecx
jb 0x405879
push dword [esi + 0x3c]
push eax
fild qword [esp]
pop edx
pop edx
pop esi
ret
pop esi
fldz
ret
mov edx, eax
pop esi
fldz
jmp fcn.004044f1

Function at 0x405881
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00405b3f
test eax, eax
jns 0x40589a
add eax, ecx
test edx, edx
je 0x4058da
jns 0x4058a5
add edx, ecx
js 0x4058da
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x4058ae
xor ecx, ecx
cmp ecx, eax
jb 0x4058b4
mov ecx, eax
call fcn.00405ae3
jb 0x4058de
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00405d11
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x4058c8
pop edi
pop esi
jmp fcn.004044fc

Function at 0x405978
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.00405ae3
jb 0x40599b
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.004068db
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.004068d9
jmp fcn.004044fc

Function at 0x405a04
Capabilities:
Terminate process

Disassembly:
push eax
push esi
push edi
xchg ecx, ebx
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x6c]
call fcn.00405b52
mov al, 0
je 0x405a1e
mov al, byte [edi]
call fcn.00405d11
call fcn.00405ae3
jb 0x405a41
mov dword [ebp + esi - 0x6c], edx
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
pop esi
pop eax
ret
mov dword [ebp + esi - 0x6c], 0
mov edx, eax
pop edi
pop esi
pop eax
jmp fcn.004044f1

Function at 0x405db7
Capabilities:
Terminate process

Disassembly:
call fcn.004069cd
jb 0x405dbf
ret
jmp fcn.004044fc
Function at 0x405ed3
Capabilities:
Terminate process

Disassembly:
push esi
mov ax, word [ebp - 0x46]
call fcn.00405bb7
jb 0x405f30
cmp word [esi + 0xa], 1
mov al, 0x36
jne 0x405f30
fisub word [esi + 0x2e]
fistp qword [esi + 0x14]
test byte [esi + 0xc], 4
je 0x405f08
fild qword [esi + 0x14]
fimul dword [esi + 0x1c]
fistp qword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0
push eax
push dword [ebp - 0x6c]
jmp 0x405f11
lea eax, [esi + 0x18]
push 0
push eax
push dword [esi + 0x14]
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
call fcn.00406afb
jb 0x405f34
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
and word [esi + 0x2c], 0xfffd
pop esi
ret
fstp st(0)
jmp 0x405f3a
mov al, dl
mov dx, 0x3fb0
pop esi
jmp fcn.004044fc

Function at 0x405faa
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x405fca
and esi, 0xfffffffe
jne 0x405fd4
xchg dword [ebx], esi
call fcn.00405b17
pop edi
pop esi
ret
call fcn.00405b3f
mov edi, dword [ebx]
or edi, edi
je 0x405fe4
cmp ecx, dword [edi - 4]
je 0x406004
call fcn.00405ae3
jb 0x406014
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00405b17
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00405b17
pop edi
pop esi
jmp fcn.004044fc

Function at 0x406273
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x406293
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.00405b3f
call fcn.00405ae3
jb 0x4062b8
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.004044fc
Function at 0x406430
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.00405b3f
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.00405b3f
jecxz 0x4064a6
test ebx, ebx
je 0x4064ae
add ebx, ecx
xchg ecx, ebx
call fcn.00405ae3
jb 0x4064bb
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.00405b17
mov esi, dword [ebp + edi - 0x6c]
call fcn.00405b17
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004044fc

Function at 0x406782
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x4067af
je 0x4067ab
shr esi, 1
jae 0x4067d0
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.00405b17
jmp 0x40678e
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x4067e1
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00404a23
pop ebx
jae 0x40678e
pop esi
pop edx
pop eax
jmp fcn.004044fc
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x40678e
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x40678e
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x40678e
Function at 0x1001d73
Capabilities:
Open clipboard

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add ebp, esp
adc byte [ebx + 0x5300f865], al
push esi
push edi
call dword [edi]
xor byte [eax + 0x15ff0100], bl
adc al, byte fs:[eax]
add dword [ebx - 0xfba7228], ecx
push eax
lea eax, [ebp - 0xc]
push eax
push 0xb0
push dword [0x1009838]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x1201260]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
sete al
push eax
push 0x300
push 1
push ebx
mov dword [ebp - 4], eax
call esi
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
push eax
call edi
push dword [ebp - 4]
push 0x301
push 1
push ebx
call esi
push eax
call edi
push dword [ebp - 0x14]
push 0x303
push 1
push ebx
call esi
push eax
call edi
push 0
push 0x19
push 1
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 1
jne 0x1001e16
cmp dword [ebp - 4], eax
jne 0x1001e16
sub al, byte [eax]
push 0x1d
push eax
push ebx
call esi
push eax
call edi
push dword [ebp + 0xa]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001e34
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
cmp dword [ebp - 8], eax
sete al
push eax
push 0x302
push 1
push ebx
call esi
push eax
call edi
push 0x6a006a00
push cs
push dword [0x1009838]
mov dword [ebp - 4], 0x100001
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1001e6b
and dword [ebp - 4], 0
push dword [ebp - 4]
push 0x15
push 1
push ebx
call esi
push eax
invalid

Function at 0x1002936
Capabilities:
Accept command line arguments

Disassembly:
and dword [0x1009854], 0
xor eax, eax
cmp dword [ebp - 0x210], 2
setne al
mov ecx, dword [ebp - 4]
cld
pop edi
pop esi
pop ebx
call fcn.01007147
leave
rol byte [eax + eax], 0x50
push 0x100a900
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [0x100a528]
mov dword [0x1009030], eax
jmp 0x10028f7
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x10013d8
push 0x29
mov edi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], eax
je 0x100296b
push 1
push 1
call eax
push dword [ebp + 0x14]
push edi
call fcn.01001be8
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01004565
test eax, eax
jne 0x100290c
mov dword [ebp - 0x18], esi
jmp 0x1002a3c
cmp dword [ebp - 4], esi
je 0x1002a47
push esi
push 1
call dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
leave
retf 0x10