joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x716a4bf7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x38b10cef
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1002a1e1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test dx, di
stc
repne scasb al, byte es:[edi]
pushfd
lea esp, [esp + 4]
jne 0x100256ee
jae 0x1002424c
mov byte [edi - 1], 0
movzx ax, bl
lea eax, [esi + 0x38a2180c]
push 0xbf6905bd
mov dword [esp], ebx
pushfd
pushal
pushal
lea eax, [0x100285a5]
push dword [esp]
mov dword [esp + 0x44], 0x10021ca6
mov byte [esp + 8], 0x57
call fcn.1002a254
cmpsd dword [esi], dword es:[edi]
push cs
sal byte [edx + 0x1f], cl
mov al, byte [0xc8fdb3c4]
cdq
and ecx, ebp
sti
retf
test bh, cl
stc
lea esi, [esp + 0x24]
cmp dh, dl
pushfd
push eax
sub edi, 4
pushfd
push dword [edi]
pop dword [esp + 0x2c]
cmc
test ax, bp
clc
cmp edi, ebx
mov dword [esp + 8], 0xa8dff166
lea esp, [esp + 0x2c]
ja 0x10028b2e
sar al, cl
sub ebx, edi
test di, bp
add ebx, esp
not di
stc
mov edi, ebx
adc al, 0x74
sar al, 7
mov al, 0x2e
bt eax, edi
jmp 0x100202e6
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x26ad5016
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1d835cb0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x40315d
cmp dword [esi + 0x20], 0
je 0x40315d
cmp dword [esi + 0x24], 0
je 0x40315d
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x40315d
cmp dword [ecx], esi
jne 0x40315d
mov eax, dword [ecx + 4]
cmp eax, 0x2a
je 0x402ff3
cmp eax, 0x39
je 0x402ff3
cmp eax, 0x45
je 0x402ff3
cmp eax, 0x49
je 0x402ff3
cmp eax, 0x5b
je 0x402ff3
cmp eax, 0x67
je 0x402ff3
cmp eax, 0x71
je 0x402ff3
cmp eax, 0x29a
jne 0x40315d
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 8]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], eax
test edx, edx
jns 0x403028
neg edx
mov dword [ecx + 0x18], edx
cmp edx, 2
jne 0x403038
mov dword [ecx + 4], 0x39
xor eax, eax
jmp 0x403051
push edi
mov edi, 0x2a
test edx, edx
mov eax, 0x71
cmovne eax, edi
mov dword [ecx + 4], eax
mov eax, 1
pop edi
mov dword [esi + 0x30], eax
lea eax, [ecx + 0x94]
mov dword [ecx + 0xb18], eax
lea eax, [ecx + 0x988]
mov dword [ecx + 0xb24], eax
lea eax, [ecx + 0xa7c]
mov dword [ecx + 0xb30], eax
xor eax, eax
mov dword [ecx + 0x28], 0
mov dword [ecx + 0xb20], 0x4f6a34
mov dword [ecx + 0xb2c], 0x4f6a5c
mov dword [ecx + 0xb38], 0x4f6a48
mov word [ecx + 0x16b8], ax
mov dword [ecx + 0x16bc], eax
call fcn.004057b0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004ad7b0
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x4f65fa]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x4f65f8]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x4f65fc]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x4f65fe]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x40af20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0x400000
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [0x52a178]
mov esi, eax
test ecx, ecx
je 0x40af71
push ecx
call fcn.00493b10
add esp, 4
mov dword [0x52a178], 0
push dword [ebp + 0x10]
push esi
push edi
call fcn.004947a0
add esp, 0xc
mov dword [0x52a178], eax
xor ecx, ecx
mov edx, 4
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x40d1b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40d1de
push 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 8]
push 0x10
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebp
ret 4
Function at 0x416930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x5203c4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
push edi
test edx, edx
je 0x416a85
mov ecx, edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 7
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416980
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.00408d10
cmp dword [esp + 0x30], 8
lea ebx, [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov edi, 0x811c9dc5
mov eax, dword [esp + 0x2c]
cmovae ebx, edx
xor ecx, ecx
add eax, eax
je 0x4169d5
mov esi, eax
nop dword [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x4169c0
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], edi
cmp eax, 8
jb 0x416a15
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416a07
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416aa6
push ecx
push edx
call fcn.004a8c37
mov edi, dword [esp + 0x18]
add esp, 8
lea eax, [esp + 0x10]
mov ecx, 0x52a140
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00412950
mov eax, dword [esp + 0x24]
cmp byte [eax + 0xd], 0
jne 0x416a85
cmp edi, dword [eax + 0x10]
jb 0x416a85
cmp eax, dword [0x52a140]
je 0x416a85
lea eax, [esp + 0x10]
mov ecx, 0x52a140
push eax
call fcn.00417840
mov dword [esi], 0
mov dword [esi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x416a67
lock inc dword [ecx + 4]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov eax, esi
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
mov dword [esi], 0
mov dword [esi + 4], 0
pop esi
pop ebx
xor ecx, esp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
call fcn.004b040f
int3
Function at 0x417bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5203c4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov edx, ecx
push esi
push edi
test edx, edx
je 0x417ce1
mov dword [esp + 0x14], 0
lea esi, [ecx + 2]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 7
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417c10
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00408d10
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x14]
cmp dword [esp + 0x28], 8
mov esi, 0x811c9dc5
mov edx, dword [esp + 0x14]
cmovae edi, edx
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x417c61
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x417c50
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], esi
cmp eax, 8
jb 0x417c9d
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x417c8f
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417cf5
push ecx
push edx
call fcn.004a8c37
mov esi, dword [esp + 0x18]
add esp, 8
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00418620
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xd], 0
jne 0x417ce1
cmp esi, dword [eax + 0x10]
jb 0x417ce1
cmp eax, dword [0x52a150]
je 0x417ce1
lea eax, [esp + 0x10]
push eax
call fcn.004183c0
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
call fcn.004b040f
int3
Function at 0x4189c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5203c4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov edx, ecx
push esi
push edi
test edx, edx
je 0x418ad7
mov dword [esp + 0x14], 0
lea esi, [ecx + 2]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 7
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418a00
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00408d10
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x14]
cmp dword [esp + 0x28], 8
mov esi, 0x811c9dc5
mov edx, dword [esp + 0x14]
cmovae edi, edx
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x418a51
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x418a40
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], esi
cmp eax, 8
jb 0x418a8d
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x418a7f
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418aee
push ecx
push edx
call fcn.004a8c37
mov esi, dword [esp + 0x18]
add esp, 8
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00419220
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xd], 0
jne 0x418ad7
cmp esi, dword [eax + 0x10]
jb 0x418ad7
cmp eax, dword [0x52a158]
je 0x418ad7
lea eax, [esp + 0x10]
push eax
call fcn.004190b0
cmp dword [eax + 0x14], 8
jb 0x418adc
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
mov eax, 0x4f9904
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
call fcn.004b040f
int3
Function at 0x4250d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd140
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebx + 0xc]
lea ecx, [ebp - 0xb0]
mov esi, dword [ebx + 8]
call fcn.004180b0
mov edi, eax
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], 0
add ecx, 0x368
push eax
mov dword [ebp - 0xb8], esi
call fcn.004184c0
mov esi, eax
push edi
mov ecx, esi
call fcn.0040b440
lea ecx, [edi + 0x18]
push ecx
lea ecx, [esi + 0x18]
call fcn.0040b440
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esi + 0x30]
call fcn.0040b440
lea eax, [edi + 0x48]
push eax
lea ecx, [esi + 0x48]
call fcn.0040b440
mov eax, dword [edi + 0x60]
lea ecx, [ebp - 0xb0]
mov dword [esi + 0x60], eax
movups xmm0, xmmword [edi + 0x64]
movups xmmword [esi + 0x64], xmm0
movups xmm0, xmmword [edi + 0x74]
movups xmmword [esi + 0x74], xmm0
movups xmm0, xmmword [edi + 0x84]
mov dword [ebp - 4], 0xffffffff
movups xmmword [esi + 0x84], xmm0
call fcn.00413000
mov ecx, dword [ebp - 0xb4]
push 0
lea ecx, [ecx + 4]
call fcn.00437020
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8

Function at 0x4282e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd140
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebx + 0xc]
lea ecx, [ebp - 0xb0]
mov esi, dword [ebx + 8]
call fcn.004180b0
mov edi, eax
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], 0
add ecx, 0x38c
push eax
mov dword [ebp - 0xb8], esi
call fcn.004184c0
mov esi, eax
push edi
mov ecx, esi
call fcn.0040b440
lea ecx, [edi + 0x18]
push ecx
lea ecx, [esi + 0x18]
call fcn.0040b440
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esi + 0x30]
call fcn.0040b440
lea eax, [edi + 0x48]
push eax
lea ecx, [esi + 0x48]
call fcn.0040b440
mov eax, dword [edi + 0x60]
lea ecx, [ebp - 0xb0]
mov dword [esi + 0x60], eax
movups xmm0, xmmword [edi + 0x64]
movups xmmword [esi + 0x64], xmm0
movups xmm0, xmmword [edi + 0x74]
movups xmmword [esi + 0x74], xmm0
movups xmm0, xmmword [edi + 0x84]
mov dword [ebp - 4], 0xffffffff
movups xmmword [esi + 0x84], xmm0
call fcn.00413000
mov ecx, dword [ebp - 0xb4]
push 0
lea ecx, [ecx + 4]
call fcn.00437020
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x4362b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd320
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5203c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0x34
call fcn.004a8c07
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi], vtable.tinyui::RenderGdiplus.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x18], vtable.tinyui::GdiClip.0
push 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
push 0
mov dword [edi + 0xc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebx], edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438d50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
xor eax, eax
mov esi, ecx
push eax
push 0x5219a4
push 0x521980
push eax
push esi
mov word [ebp - 0x1e], ax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call fcn.004ae9dc
mov dword [ebp - 0x30], eax
add esp, 0x14
cmp dword [esi + 0x284], 8
lea eax, [esi + 0x270]
jb 0x438d8f
mov eax, dword [eax]
mov ecx, dword [esi + 0x288]
mov edx, dword [ebp + 0x1c]
movss xmm0, dword [ebp + 0x18]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
test edx, edx
movss dword [ebp - 0x14], xmm0
sete al
cmp eax, edi
jne 0x438de7
mov eax, dword [ecx + 0xc0]
mov ecx, dword [ecx + 0xc4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x438ded
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x442d80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ddd45
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5203c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x442dbe
mov eax, dword [esi]
xor ecx, ecx
push ecx
mov word [eax], cx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x442efe
mov edi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0xd
call edi
test eax, eax
je 0x442e9e
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0xffffffff
je 0x442ef8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x442ef8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 0x28], 0
push eax
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x28]
push ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
call fcn.00408d10
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
cmp esi, eax
je 0x442e57
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00408d10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x442ef8
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442e92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x442f1a
push edx
push ecx
call fcn.004a8c37
add esp, 8
jmp 0x442ef8
push 1
call edi
test eax, eax
je 0x442ef8
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0xffffffff
je 0x442ef8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x442ef8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.004163e0
push 0
mov edx, esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004133f0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x40]
call fcn.00413f00
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8e4e
mov esp, ebp
pop ebp
ret
call fcn.004b040f
int3