joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ef0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x401fe7
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x401fe7
push ebx
call fcn.004087b0
add esp, 4
test eax, eax
je 0x401f4a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x401f51
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x401f30
jmp 0x401f53
mov esi, 0x1505
jmp 0x401f53
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x401fe7
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x401f84
inc ebp
dec ebx
je 0x401fe5
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401fe5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401f80
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.004087b0
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x401f80
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.004087d0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401f80
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x401fe7
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402000
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x4020e7
test edx, edx
je 0x4020e7
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40204a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402051
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402030
jmp 0x402053
mov esi, 0x1505
jmp 0x402053
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x4020e7
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402084
inc ebx
dec ebp
je 0x4020e5
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4020e5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402080
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.004087b0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402080
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004087d0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402080
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4020e7
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4024e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4025e8
mov esi, edx
test edx, edx
je 0x4025e8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x4025e8
push esi
call fcn.004087b0
add esp, 4
test eax, eax
je 0x40253a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402541
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402520
jmp 0x402543
mov ebp, 0x1505
jmp 0x402543
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4025f0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4025aa
call fcn.004026e0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x4025e8
push ecx
call fcn.004087b0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x40265f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402608
inc ebx
dec esi
je 0x40255f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402564
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402600
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.004087b0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402600
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.004087d0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402600
mov eax, 0xffffffff
jmp 0x4025e8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402678
inc ebx
dec esi
je 0x4025a5
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x4025aa
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402670
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.004087b0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402670
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.004087d0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402670
jmp 0x4025aa
Function at 0x402de0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x30]
test esi, esi
je 0x402fb2
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x402fab
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x402e75
mov esi, dword [esp + 0xc]
add esi, dword [esp + 8]
mov ebp, dword [esp + 0x10]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub ebp, dword [esp + 4]
mov edx, 0x15b0
je 0x402fab
xor ebx, ebx
cmp edx, 8
mov dword [esp + 4], edx
mov dword [esp + 0x10], ebp
jb 0x402f1c
and edx, 0x1ff8
mov dword [esp], edx
mov eax, 7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0xc], eax
movzx eax, byte [esi]
add eax, edi
add ecx, eax
mov ebx, esi
movzx esi, byte [esi + 1]
add esi, eax
mov eax, ecx
and eax, esi
mov dword [esp + 8], eax
xor ecx, esi
movzx edi, byte [ebx + 2]
add edi, esi
movzx eax, byte [ebx + 3]
add eax, edi
mov dword [esp + 0x14], eax
movzx esi, byte [ebx + 4]
add esi, eax
movzx eax, byte [ebx + 5]
add eax, esi
movzx edx, byte [ebx + 6]
mov ebp, eax
and ebp, edx
xor edx, eax
lea edx, [edx + ebp*2]
add edi, ecx
mov ecx, dword [esp + 8]
lea ecx, [edi + ecx*2]
add ecx, dword [esp + 0x14]
add ecx, esi
mov esi, ebx
add ecx, eax
mov eax, dword [esp + 0xc]
movzx edi, byte [ebx + 7]
add edi, edx
add ecx, edx
mov edx, dword [esp + 4]
add ecx, edi
add esi, 8
add eax, 8
cmp eax, edx
jb 0x402ea0
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp]
mov eax, edx
sub eax, ebx
jbe 0x402e3c
mov dword [esp + 8], eax
mov eax, ebx
or eax, 1
test dl, 1
mov dword [esp + 0xc], esi
jne 0x402f50
mov dword [esp], ebx
mov ebx, esi
cmp edx, eax
je 0x402e30
jmp 0x402f6c
lea ebx, [esi + 1]
movzx esi, byte [esi]
mov ebp, edi
and ebp, esi
xor edi, esi
lea edi, [edi + ebp*2]
add ecx, edi
mov dword [esp], eax
cmp edx, eax
je 0x402e30
mov eax, dword [esp + 4]
sub eax, dword [esp]
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [ebx + esi]
mov edx, edi
and edx, ebp
xor edi, ebp
lea edx, [edi + edx*2]
add ecx, edx
movzx edi, byte [ebx + esi + 1]
mov ebp, edx
and ebp, edi
xor edx, edi
lea edi, [edx + ebp*2]
add ecx, edi
add esi, 2
cmp eax, esi
jne 0x402f80
jmp 0x402e30
shl ecx, 0x10
or ecx, edi
jmp 0x402fb7
mov ecx, 1
mov eax, ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40302c
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40302e
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43c928]
mov eax, ebx
shr eax, 4
mov ebp, ebx
xor ebp, 0x3ffffff0
or ebx, 0xf
and ebx, ebp
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43c928]
inc esi
cmp edx, esi
jne 0x402ff0
not eax
jmp 0x40302e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x40865c
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x40865c
test ebx, ebx
je 0x4086fd
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x4086a4
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
dec esi
cmp edi, esi
jne 0x408640
add ecx, esi
add edx, esi
add esi, ebx
cmp ebx, 8
jae 0x4086ab
jmp 0x4086fd
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ebp, ebx
and ebp, 0xfffffffc
add eax, ebp
add ebp, esi
mov esi, ebx
and esi, 3
mov ecx, esi
shr ecx, 1
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
test bl, 1
je 0x4086fd
mov ecx, ebx
and ecx, 2
xor esi, 1
or ebx, 2
and ebx, esi
movzx ecx, byte [ebp + ecx]
mov byte [eax + ebx], cl
jmp 0x4086fd
mov esi, ebx
cmp ebx, 8
jb 0x4086fd
neg esi
xor edi, edi
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
movzx eax, byte [ecx + edi - 1]
mov byte [edx + edi - 1], al
movzx eax, byte [ecx + edi - 2]
mov byte [edx + edi - 2], al
movzx eax, byte [ecx + edi - 3]
mov byte [edx + edi - 3], al
movzx eax, byte [ecx + edi - 4]
mov byte [edx + edi - 4], al
movzx eax, byte [ecx + edi - 5]
mov byte [edx + edi - 5], al
movzx eax, byte [ecx + edi - 6]
mov byte [edx + edi - 6], al
movzx eax, byte [ecx + edi - 7]
mov byte [edx + edi - 7], al
add edi, 0xfffffff8
cmp esi, edi
jne 0x4086b0
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
call fcn.00408cd0
push eax
mov esi, esp
push eax
mov edi, esp
sub esp, 0x100
mov ebx, esp
call fcn.00436e70
test al, 1
jne 0x408c44
jmp 0x408c9c
call fcn.00431c80
test al, 1
jne 0x408c4f
jmp 0x408c93
sub esp, 4
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [edi], eax
lea eax, str.of_system_that_leetspeak__reflection_primarily_the_of_other_modified_on_glyphs_resemblance_is_replacements_similarity_or_eleet_the_ways_used_character_a_often_spellings_on_play_uses_their_via_internet._or_it_in
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00408cb0
add esp, 8
call fcn.0040a040
test al, 1
jne 0x408c8c
jmp 0x408c91
call fcn.0040f730
jmp 0x408c93
call fcn.00437720
jmp 0x408c9a
jmp 0x408c9c
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x408e5a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x408d6d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x408d91
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x408d60
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x408d60
lea esi, [ebx + 1]
push esi
call fcn.00435870
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x408e68
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x408dd8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x408e6a
movzx edx, word [edi]
test dx, dx
je 0x408e6a
cmp dx, 0x7f
jbe 0x408dc0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x408e20
cmp esi, 0x7ff
ja 0x408e20
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x408dc7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x408dc7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x408dc7
push 1
call fcn.00435870
add esp, 4
mov ebp, eax
jmp 0x408e6a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x408e87
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x408e82
test eax, eax
jne 0x408e80
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004051e0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x41a0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, esp
mov ebx, dword [ebp + 8]
push eax
mov dword [esi + 4], esp
push eax
mov dword [esi + 8], esp
push eax
mov dword [esi + 0xc], esp
mov dword [esi + 0x10], 0x8b3d8d28
mov dword [esi + 0x14], 0x972f8925
mov dword [esi + 0x18], 0x93609568
mov dword [esi + 0x1c], 0x9f30913c
lea eax, [esi + 0x20]
mov word [esi + 0x20], 0x9d9c
mov dword [esi + 0x22], 0
mov dword [esi + 0x26], 0
mov dword [esi + 0x2a], 0
mov word [esi + 0x2e], 0
mov dword [esi], 0
mov ecx, dword [esi]
cmp ecx, 0x1f
ja 0x41a146
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi]
mov edx, dword [esi]
movzx edx, byte [esi + edx + 0x10]
lea edi, [ecx + 0x6a]
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
add cl, 0x84
mov edx, dword [esi]
mov byte [esi + edx + 0x10], cl
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, 0x20
jb 0x41a120
lea edi, [esi + 0x3a]
lea edx, [esi + 0x10]
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esi + 0x4a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41a170
cmp eax, 0xffffffed
jge 0x41a187
mov eax, 0xffffffff
jmp 0x41a18a
add eax, 0x12
push eax
call fcn.00435870
add esp, 4
mov ecx, dword [esi + 4]
mov dword [ecx], eax
movzx edx, word [ebx]
mov ecx, eax
test dx, dx
je 0x41a1c1
add ebx, 2
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x41a1b0
mov word [ecx], 0
movzx edx, word [esi + 0x3a]
test dx, dx
je 0x41a1f1
lea edi, [esi + 0x3c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x41a1e0
mov word [ecx], 0
mov edi, dword [esi + 8]
push edi
push eax
call fcn.0043a580
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x441b98]
mov ecx, 0x66154c16
xor ecx, dword [0x441ba0]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x42e680
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov byte [esp + 0x17], 0
jmp 0x42e699
xor eax, eax
lea eax, [esp + 0x5c]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
sub esp, 8
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
jmp 0x42e6c7
jmp 0x42e6c9
jmp 0x42e6cb
jmp 0x42e6cd
cmp eax, 0
je 0x42e858
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
jmp 0x42e6f0
cmp eax, 0
setne al
test al, 1
jne 0x42e6ff
jmp 0x42e84e
mov eax, dword [esp + 0x20]
jmp 0x42e705
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
jmp 0x42e713
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
jmp 0x42e71d
jmp 0x42e71f
jmp 0x42e721
jmp 0x42e723
mov dword [esp], eax
call fcn.004087b0
mov dword [esp + 0x28], eax
jmp 0x42e731
cmp dword [esp + 0x28], 0
setne al
jmp 0x42e73b
test al, 1
jne 0x42e744
jmp 0x42e83c
mov esi, dword [ebp + 8]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov al, byte [esp + 0x1c]
mov byte [esp + 0x24], al
mov byte [esp + 0x30], 0x73
mov byte [esp + 0x31], 0x95
mov byte [esp + 0x32], 0x93
mov byte [esp + 0x33], 0xab
mov byte [esp + 0x34], 0x98
mov byte [esp + 0x35], 0xac
mov byte [esp + 0x36], 0x9f
mov byte [esp + 0x37], 0xad
mov byte [esp + 0x38], 0x9a
mov byte [esp + 0x39], 0x4f
mov byte [esp + 0x3a], 0xb4
mov byte [esp + 0x3b], 0xbb
mov byte [esp + 0x3c], 0xb6
mov byte [esp + 0x3d], 0x25
lea eax, [esp + 0x30]
add eax, 0xe
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 6
call fcn.00408710
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 0x14
jae 0x42e811
jmp 0x42e7d1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
movzx ecx, byte [esp + ecx + 0x30]
mov edx, eax
add edx, 0x93c1b887
lea eax, [eax + ecx - 0x6c3e4779]
and edx, ecx
add edx, edx
sub eax, edx
add al, 0x4f
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0x30], al
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x14
jb 0x42e7d1
jmp 0x42e811
lea eax, [esp + 0x30]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
call fcn.00408ee0
sub esp, 0xc
jmp 0x42e82c
jmp 0x42e82e
jmp 0x42e830
and al, 1
jmp 0x42e834
mov byte [esp + 0x17], al
jmp 0x42e83a
jmp 0x42e83c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42e84e
jmp 0x42e850
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42e858
mov al, byte [esp + 0x17]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e681
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [ebp + 8]
mov byte [esp + 0x17], 0
jmp 0x42e699
xor eax, eax
lea eax, [esp + 0x5c]
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
sub esp, 8
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
jmp 0x42e6c7
jmp 0x42e6c9
jmp 0x42e6cb
jmp 0x42e6cd
cmp eax, 0
je 0x42e858
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
jmp 0x42e6f0
cmp eax, 0
setne al
test al, 1
jne 0x42e6ff
jmp 0x42e84e
mov eax, dword [esp + 0x20]
jmp 0x42e705
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
jmp 0x42e713
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
jmp 0x42e71d
jmp 0x42e71f
jmp 0x42e721
jmp 0x42e723
mov dword [esp], eax
call fcn.004087b0
mov dword [esp + 0x28], eax
jmp 0x42e731
cmp dword [esp + 0x28], 0
setne al
jmp 0x42e73b
test al, 1
jne 0x42e744
jmp 0x42e83c
mov esi, dword [ebp + 8]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov al, byte [esp + 0x1c]
mov byte [esp + 0x24], al
mov byte [esp + 0x30], 0x73
mov byte [esp + 0x31], 0x95
mov byte [esp + 0x32], 0x93
mov byte [esp + 0x33], 0xab
mov byte [esp + 0x34], 0x98
mov byte [esp + 0x35], 0xac
mov byte [esp + 0x36], 0x9f
mov byte [esp + 0x37], 0xad
mov byte [esp + 0x38], 0x9a
mov byte [esp + 0x39], 0x4f
mov byte [esp + 0x3a], 0xb4
mov byte [esp + 0x3b], 0xbb
mov byte [esp + 0x3c], 0xb6
mov byte [esp + 0x3d], 0x25
lea eax, [esp + 0x30]
add eax, 0xe
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 6
call fcn.00408710
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 0x14
jae 0x42e811
jmp 0x42e7d1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
movzx ecx, byte [esp + ecx + 0x30]
mov edx, eax
add edx, 0x93c1b887
lea eax, [eax + ecx - 0x6c3e4779]
and edx, ecx
add edx, edx
sub eax, edx
add al, 0x4f
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0x30], al
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x14
jb 0x42e7d1
jmp 0x42e811
lea eax, [esp + 0x30]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
call fcn.00408ee0
sub esp, 0xc
jmp 0x42e82c
jmp 0x42e82e
jmp 0x42e830
and al, 1
jmp 0x42e834
mov byte [esp + 0x17], al
jmp 0x42e83a
jmp 0x42e83c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42e84e
jmp 0x42e850
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42e858
mov al, byte [esp + 0x17]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret