joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ff0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov ecx, dword [esp + 0x214]
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push 1
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4020fb
mov eax, dword [esp + 0x228]
test eax, eax
jne 0x402044
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x210
ret
mov edi, 0x406178
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor ebp, ebp
rep movsb byte es:[edi], byte [esi]
mov eax, 0x100
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x120]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push ebp
push eax
mov dword [esp + 0x34], 1
call ebx
mov edi, eax
test edi, edi
jne 0x4020eb
mov ecx, dword [esp + 0x228]
lea esi, [esp + 0x20]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x4020e2
test dl, dl
je 0x4020de
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x4020e2
add ecx, 2
add esi, 2
test dl, dl
jne 0x4020be
xor ecx, ecx
jmp 0x4020e7
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x402108
inc ebp
test edi, edi
je 0x402072
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x22c]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x210
ret
Function at 0x402150
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x402fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [esp + 8], 0
lea ecx, [esp]
mov dword [esp + 0x118], 3
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x124]
mov edx, dword [esp + 0x12c]
push eax
mov eax, dword [esp + 0x12c]
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0x406178
push edx
push eax
mov byte [esp + 0x130], 4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4021f3
push 0x406178
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x11c], 5
call fcn.00402902
lea ecx, [esp + 4]
mov byte [esp + 0x118], 4
call fcn.0040289c
jmp 0x402201
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 4]
call fcn.004028ae
push esi
mov esi, dword [esp + 0x124]
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x11c], 3
call fcn.0040289c
lea ecx, [esp + 0x128]
mov byte [esp + 0x11c], 2
call fcn.0040289c
lea ecx, [esp + 0x12c]
mov byte [esp + 0x11c], 1
call fcn.0040289c
lea ecx, [esp + 0x130]
mov byte [esp + 0x11c], 0
call fcn.0040289c
mov ecx, dword [esp + 0x114]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x40916a
Capabilities:
Check for software breakpoints

Disassembly:
jne 0x409116
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4090ea
ret
cmp al, 0x22
jne 0x4090dc
cmp byte [esi], 0x22
jne 0x4090f3
inc esi
mov dword [ebp - 0x74], esi
mov word [edx + 0x74c33a06], cs
add al, 0x3c
and byte [esi - 0xe], dh
mov al, byte [esi]
cmp al, bl
je 0x4090fd
cmp al, 0x20
jbe 0x4090ef
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x409121
movzx eax, word [ebp - 0x2c]
jmp 0x409124
cmp byte [esi], 0x20
jbe 0x4090f3
inc esi
mov dword [ebp - 0x74], esi
jmp 0x409116
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call 0x409192
mov dword [ebp - 0x68], eax
push eax
call dword [0x37353fb0]
mov esp, 0x6727398d
xchg ebx, eax
pop ebp
ja 0x4090da
push ss
and eax, 0xc0633107
push es
cmp esi, esp
xchg edx, eax
inc ebp
outsb dx, byte [esi]
sbb ebp, ebp
push esp
inc esi
stosd dword es:[edi], eax
popfd
jp 0x4090e3
cmp al, 0xcc
aas
xchg dword [ebx], esi
rcl dword [ecx], 0xf6
dec edx
loopne 0x4090f2
int 0x30
cmp edx, dword [ecx + 0x2426b6de]
xchg ecx, eax
invalid
mov dh, 0x26
and al, 0xaa
mov al, 0x50
jne 0x4090fd
jns 0x4091d8
sar dword [esi + 0x2e], cl
leave
jne 0x40918e
loope 0x409193
aas
aas
aas
sbb al, 0xd6
jns 0x409194
adc dword [ebx - 0x46], 0x3f
pop edi
adc al, 0x25
lodsd eax, dword [esi]
aaa
sahf
pushal
and eax, 0x609e37ad
imul esp, esp, 0xffffff9b
mov al, 0xab
add al, 9
sahf
pushal
std
aad 0xd4
sbb dword [edi], eax
pop es
push 0x1dddb04d
salc
jle 0x4091c1
dec ecx
adc eax, 0xeebced35
je 0x409147
and byte [ecx + 0x21], cl
insb byte es:[edi], dx
wait
leave
jne 0x409172
das
iretd
mov cl, bl
jne 0x4091da
cmp cl, al
jne 0x4091de
test bh, 0x75
push 0xfe75c93f
leave
jne 0x4091ea
out dx, al
retf
Function at 0x409170
Capabilities:
Check for software breakpoints

Disassembly:
jne 0x409116
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x4090ea
ret
cmp al, 0x22
jne 0x4090dc
cmp byte [esi], 0x22
jne 0x4090f3
inc esi
mov dword [ebp - 0x74], esi
mov word [edx + 0x74c33a06], cs
add al, 0x3c
and byte [esi - 0xe], dh
mov al, byte [esi]
cmp al, bl
je 0x4090fd
cmp al, 0x20
jbe 0x4090ef
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x409121
movzx eax, word [ebp - 0x2c]
jmp 0x409124
cmp byte [esi], 0x20
jbe 0x4090f3
inc esi
mov dword [ebp - 0x74], esi
jmp 0x409116
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call 0x409192
mov dword [ebp - 0x68], eax
push eax
call dword [0x37353fb0]
mov esp, 0x6727398d
xchg ebx, eax
pop ebp
ja 0x4090da
push ss
and eax, 0xc0633107
push es
cmp esi, esp
xchg edx, eax
inc ebp
outsb dx, byte [esi]
sbb ebp, ebp
push esp
inc esi
stosd dword es:[edi], eax
popfd
jp 0x4090e3
cmp al, 0xcc
aas
xchg dword [ebx], esi
rcl dword [ecx], 0xf6
dec edx
loopne 0x4090f2
int 0x30
cmp edx, dword [ecx + 0x2426b6de]
xchg ecx, eax
invalid
mov dh, 0x26
and al, 0xaa
mov al, 0x50
jne 0x4090fd
jns 0x4091d8
sar dword [esi + 0x2e], cl
leave
jne 0x40918e
loope 0x409193
aas
aas
aas
sbb al, 0xd6
jns 0x409194
adc dword [ebx - 0x46], 0x3f
pop edi
adc al, 0x25
lodsd eax, dword [esi]
aaa
sahf
pushal
and eax, 0x609e37ad
imul esp, esp, 0xffffff9b
mov al, 0xab
add al, 9
sahf
pushal
std
aad 0xd4
sbb dword [edi], eax
pop es
push 0x1dddb04d
salc
jle 0x4091c1
dec ecx
adc eax, 0xeebced35
je 0x409147
and byte [ecx + 0x21], cl
insb byte es:[edi], dx
wait
leave
jne 0x409172
das
iretd
mov cl, bl
jne 0x4091da
cmp cl, al
jne 0x4091de
test bh, 0x75
push 0xfe75c93f
leave
jne 0x4091ea
out dx, al
retf
Function at 0x401120
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41b004]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
push 0
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x401165
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00401de7
add esp, 0x20c
ret
cmp word [esi], 0
mov ecx, dword [esp + 0x214]
je 0x40117c
add esi, 2
dec ecx
cmp word [esi], 0
jne 0x401172
cmp word [esp + 4], 0
je 0x4011a7
lea edx, [esp + 4]
sub edx, esi
nop word [eax + eax]
cmp ecx, 1
jb 0x4011c4
mov ax, word [edx + esi]
dec ecx
mov word [esi], ax
add esi, 2
cmp word [edx + esi], 0
jne 0x401190
mov ecx, dword [esp + 0x20c]
xor eax, eax
mov word [esi], ax
mov al, 1
pop esi
xor ecx, esp
call fcn.00401de7
add esp, 0x20c
ret
call fcn.00404f01
int3
Function at 0x4011d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xc90
mov eax, dword [0x41b004]
xor eax, esp
mov dword [esp + 0xc8c], eax
movzx edx, word [str._TEMP_onefile__PID___TIME_]
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, 0x1000
mov word [0x41ec40], ax
mov ebp, str._TEMP_onefile__PID___TIME_
mov esi, 0x41ec40
xor ecx, ecx
nop dword [eax + eax]
movzx eax, dx
cmp eax, 0x25
jne 0x4013ee
xor eax, eax
test ecx, ecx
jne 0x401236
lea ecx, [esp + 0x98]
mov word [esp + 0x98], ax
jmp 0x40140a
mov word [ecx], ax
lea eax, [esp + 0x98]
push str.TEMP
push eax
call fcn.004084d9
add esp, 8
test eax, eax
jne 0x40125f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x4013d8
lea eax, [esp + 0x98]
push str.PROGRAM
push eax
call fcn.004084d9
add esp, 8
test eax, eax
jne 0x4012c7
mov edi, ebx
call fcn.00405310
cmp word [esi], 0
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, esi
je 0x40129a
nop dword [eax + eax]
add eax, 2
dec edi
cmp word [eax], 0
jne 0x401290
movzx ecx, word [edx]
test cx, cx
je 0x4012bd
cmp edi, 1
jb 0x401428
add edx, 2
mov word [eax], cx
add eax, 2
dec edi
movzx ecx, word [edx]
test cx, cx
jne 0x4012a2
xor ecx, ecx
mov word [eax], cx
jmp 0x4013d8
lea eax, [esp + 0x98]
push 0x419988
push eax
call fcn.004084d9
add esp, 8
test eax, eax
jne 0x40130f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x419990
lea eax, [esp + 0x20]
push 0x80
push eax
call fcn.00401040
push ebx
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.00401080
add esp, 0x14
jmp 0x4013d8
lea eax, [esp + 0x98]
push str.HOME
push eax
call fcn.004084d9
add esp, 8
test eax, eax
jne 0x40132d
lea edx, [eax + 0x28]
jmp 0x401349
lea eax, [esp + 0x98]
push str.CACHE_DIR
push eax
call fcn.004084d9
add esp, 8
test eax, eax
jne 0x401377
lea edx, [eax + 0x1c]
push ebx
mov ecx, esi
call fcn.00401120
add esp, 4
test al, al
jne 0x4013d8
xor al, al
mov ecx, dword [esp + 0xc9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401de7
add esp, 0xc90
ret
lea eax, [esp + 0x98]
push str.TIME
push eax
call fcn.004084d9
add esp, 8
test eax, eax
jne 0x40135c
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [esp + 0x14]
lea eax, [esp + 0x89c]
push dword [esp + 0x14]
push str._lld
push 0x400
push eax
call fcn.00401040
add esp, 0x14
lea edx, [esp + 0x898]
mov ecx, esi
push ebx
call fcn.00401080
add esp, 4
cmp word [esi], 0
je 0x4013ea
nop
add esi, 2
dec ebx
cmp word [esi], 0
jne 0x4013e0
xor ecx, ecx
jmp 0x40140a
test ecx, ecx
je 0x4013fa
mov word [ecx], ax
add ecx, 2
jmp 0x40140a
cmp ebx, 1
jb 0x40135c
mov word [esi], ax
add esi, 2
dec ebx
movzx eax, word [ebp + 2]
add ebp, 2
mov edx, eax
test ax, ax
jne 0x401210
xor eax, eax
mov word [esi], ax
mov al, 1
jmp 0x40135e
call fcn.00404f01
int3

Function at 0x4014d0
Capabilities:
Terminate process

Disassembly:
push 0x41c430
push str.Error__failed_to_open__ls_for_writing._n
push 2
call fcn.0040526d
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push 2
call fcn.00404eeb
int3
Function at 0x401560
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
mov eax, dword [0x41ec30]
sub esp, 0x20
test eax, eax
je 0x401596
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40158a
push 0
push dword [0x41ec30]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x41ec30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x41ec3c], 0
je 0x40166b
push ebx
push ebp
push esi
mov eax, 0x414
mov dword [esp + 0xc], 0
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x41ec40
mov dword [esp + 0x20], 0x419af4
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0x419af4
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x41ec40
call ebp
cmp eax, 0xffffffff
je 0x401667
test al, 0x10
je 0x401667
push 0x64
call ebx
mov eax, 0x414
mov dword [esp + 0x10], 0
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x41ec40
mov dword [esp + 0x20], 0x419af4
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0x419af4
call edi
inc esi
cmp esi, 0x14
jl 0x401604
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40c940
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040c5bd
Function at 0x403af0
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403b04
inc dword [0x51b040]
add dword [0x5165ec], 0x108
mov edx, dword [0x5165ec]
push esi
push edi
mov ecx, 0x42
mov esi, 0x519af0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403b33
push 0
mov eax, 0x51c0f8
call fcn.0041d2e0
cmp dword [0x51b06c], 0
mov dword [0x51cbd8], 0
mov dword [0x51cbdc], 0
je 0x403b5b
push 0x51b6d8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x403be0
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x403b8b
xor eax, eax
cmp word [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x403b8b
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x51cbe4], 0
je 0x403b9d
cmp dword [0x51cbe0], 0
jne 0x403ba6
cmp byte [esi + 0xee], 0
je 0x403be0
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x403be0
cmp dword [0x51cbe4], 0
jge 0x403bc8
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x51cbe4]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret
Function at 0x4049a0
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x4049cc
call fcn.00404cb0
test eax, eax
jne 0x4049cc
push 0x4e6de0
call fcn.004a4b10
add esp, 4
push eax
call fcn.00404ac0
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x404a0e
cmp dword [esi + 0x18], ebx
je 0x4049f7
cmp dword [esi + 8], ebx
je 0x4049ec
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4e6e34
call fcn.004a4b10
add esp, 4
push eax
call fcn.00404ac0
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404a47
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x404a6e
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x404a6e
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404a64
cmp dword [esi + 8], ebx
je 0x404a59
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x404a83
mov dword [esi + 4], ebx
jmp 0x404a47
cmp dword [esi + 0x18], ebx
je 0x404aa0
cmp dword [esi + 8], ebx
je 0x404a95
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4e6e64
call fcn.004a4b10
add esp, 4
push eax
call fcn.00404ac0
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x404b90
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x404ba0
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x404c91
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
push 0x4e6e98
call fcn.004a4b10
add esp, 4
push eax
lea edx, [esp + 8]
push edx
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x404c88
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.004c9bad
add esp, 8
test eax, eax
je 0x404c88
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.004c9bad
add esp, 8
test eax, eax
je 0x404c88
lea edx, [esp]
push str.Native
push edx
call fcn.004c9bad
add esp, 8
test eax, eax
je 0x404c88
push 0x4e6efc
call fcn.004a4b10
push eax
lea eax, [esp + 8]
push eax
call fcn.004c9bad
add esp, 0xc
test eax, eax
je 0x404c88
push 0x4e6f28
call fcn.004a4b10
push eax
lea ecx, [esp + 8]
push ecx
call fcn.004c9bad
add esp, 0xc
test eax, eax
je 0x404c7e
push 0x4e6f5c
call fcn.004a4b10
push eax
lea edx, [esp + 8]
push edx
call fcn.004c9bad
add esp, 0xc
test eax, eax
jne 0x404c97
test esi, esi
je 0x404c88
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret

Function at 0x404cb0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ecx + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x404d3a
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
mov eax, dword [0x51aed0]
push eax
call ebx
test eax, eax
jne 0x404d2f
mov eax, dword [0x5164f0]
cmp eax, 0xffffffff
je 0x404cff
test eax, eax
je 0x404d46
call esi
mov ecx, dword [0x5164f0]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x404d46
push 1
push 0x8000012f
mov dword [0x5164f4], 0
call fcn.00401930
mov edx, dword [0x51aed0]
add esp, 8
push edx
mov dword [0x5164f4], 1
call ebx
test eax, eax
je 0x404ce0
mov eax, dword [esp + 0xc]
mov dword [eax + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407e90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x519dbd], 0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x407f3e
mov al, byte [0x519dbf]
cmp al, 0xa0
je 0x407eb6
cmp al, 0x10
jne 0x407f3e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x519dc0]
cmp eax, 0x16
jae 0x407f3e
test ebp, 0x100
jne case.0x407ee3.13
movzx eax, byte [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407ee3.13
movzx eax, byte [eax + 0x4080f4]
jmp dword [eax*4 + 0x4080ec]
mov al, 1
jmp 0x407ef0
xor al, al
cmp byte [0x519dbe], 0
jne 0x407f04
call fcn.00408210
test al, al
jne 0x407f0f
jmp 0x407f3e
cmp byte [esp + 0x1c], 0
je 0x407f18
test al, al
je 0x407f3e
mov byte [0x519dc6], 1
jmp 0x407f1c
test al, al
je 0x407f3e
mov cl, byte [0x519dbc]
mov dl, byte [0x519dbb]
mov al, byte [0x519dba]
mov byte [0x51aecf], cl
mov byte [0x51af00], dl
mov byte [0x51af90], al
movzx ecx, byte [0x51aecf]
mov dl, byte [0x51af00]
mov al, byte [0x51af90]
mov byte [0x519dbc], cl
mov cl, byte [esp + 0x14]
movzx esi, cl
mov byte [0x519dbb], dl
mov byte [0x519dba], al
mov eax, dword [0x51b90c]
lea edx, [esi + esi*4]
mov bl, byte [eax + edx*4 + 8]
test bl, bl
je case.default.0x4080b4
cmp dword [edi + 0x10], 0xffc3d44f
setne al
test byte [edi + 8], 0x10
mov byte [esp + 0xf], al
je 0x407f94
xor cl, cl
jmp 0x407fa9
mov edx, dword [esp + 0x1c]
push edx
mov al, cl
call fcn.00408150
mov cl, al
mov al, byte [esp + 0x13]
add esp, 4
cmp byte [esp + 0x1c], 0
mov byte [esp + 0x18], cl
je 0x408080
cmp byte [esp + 0x20], 0
jne 0x407fd3
mov cl, bl
not cl
and byte [0x51aecd], cl
test al, al
je 0x407fd3
and byte [0x51aece], cl
cmp byte [esp + 0x18], 0
je case.default.0x4080b4
not bl
and byte [0x51aecf], bl
lea eax, [esi - 0xa0]
mov byte [esi + 0x51aef0], 0
cmp eax, 5
ja case.default.0x4080b4
jmp dword [eax*4 + 0x408118]
mov al, byte [0x51af91]
mov byte [0x51af00], al
jmp case.default.0x4080b4
mov cl, byte [0x51af90]
mov byte [0x51af00], cl
jmp case.default.0x4080b4
mov dl, byte [0x51af93]
mov byte [0x51af01], dl
jmp case.default.0x4080b4
mov al, byte [0x51af92]
mov byte [0x51af01], al
jmp case.default.0x4080b4
mov cl, byte [0x51af95]
mov byte [0x51af02], cl
test byte [edi + 8], 0x10
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop esi
mov word [0x519dc4], bp
pop ebp
mov byte [0x519dbf], al
mov byte [0x519dbe], cl
pop ebx
je 0x4080d1
xor al, al
mov byte [0x519dbd], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x519dc0], eax
pop ecx
ret
mov dl, byte [0x51af94]
mov byte [0x51af02], dl
jmp case.default.0x4080b4
cmp byte [esp + 0x20], 0
jne 0x408097
or byte [0x51aecd], bl
test al, al
je 0x408097
or byte [0x51aece], bl
test cl, cl
je case.default.0x4080b4
or byte [0x51aecf], bl
lea eax, [esi - 0xa0]
mov cl, 0x80
mov byte [esi + 0x51aef0], cl
cmp eax, 5
ja case.default.0x4080b4
jmp dword [eax*4 + 0x408130]
mov byte [0x51af00], cl
jmp case.default.0x4080b4
mov byte [0x51af01], cl
jmp case.default.0x4080b4
push ecx
call fcn.00408150
add esp, 4
mov byte [0x519dbd], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x519dc0], eax
pop ecx
ret
Function at 0x408150
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 0xa0
je 0x40815f
cmp al, 0x10
jne case.0x4081b6.13
cmp byte [esp + 8], 0
jne case.0x4081b6.13
cmp byte [0x519dc6], 0
je 0x40818b
xor eax, eax
cmp byte [eax + 0x519da4], 0
jne 0x40818b
inc eax
cmp eax, 0x16
jl 0x408171
mov byte [0x519dc6], 0
xor al, al
pop esi
ret
cmp byte [0x519dbe], 0
je case.0x4081b6.13
test dword [0x519dc4], 0x100
jne case.0x4081b6.13
movzx eax, byte [0x519dbf]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x4081b6.13
movzx eax, byte [eax + 0x4081e4]
jmp dword [eax*4 + 0x4081dc]
call esi
sub eax, dword [0x519dc0]
cmp eax, 0x16
jb 0x408187
call esi
mov dword [0x51cda4], eax
mov dword [0x51cda0], eax
mov al, 1
pop esi
ret