joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54dc48
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x54df03
push dword fs:[eax]
mov dword fs:[eax], esp
nop
mov eax, dword [0x55a294]
mov eax, dword [eax]
mov edx, 0x54df20
call fcn.004b9200
push 5
mov eax, dword [0x55a294]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x54deca
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0052fab0
lea eax, [ebp - 0x10]
call fcn.004bce90
mov eax, dword [ebp - 0x10]
call fcn.004134dc
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004bc9e8
mov edx, dword [ebp - 0x14]
mov eax, 0x561284
call fcn.004077c8
call fcn.0054bfd0
lea ecx, [ebp - 0x18]
mov edx, 0x54df40
mov eax, dword [0x561284]
call fcn.004bba7c
mov edx, dword [ebp - 0x18]
mov eax, 0x561288
call fcn.004077c8
lea ecx, [ebp - 0x1c]
mov edx, 0x54df58
mov eax, dword [0x561284]
call fcn.004bba7c
mov edx, dword [ebp - 0x1c]
mov eax, 0x56128c
call fcn.004077c8
push 2
push 0
push 1
mov ecx, dword [0x561284]
mov dl, 1
mov eax, dword [0x4f0d40]
call fcn.004f1660
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54dda1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004f161c
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004f15f0
cmp dword [ebp - 0xc], 0x67734d49
je 0x54dd7c
mov cl, 1
xor edx, edx
mov eax, dword [0x56128c]
call fcn.004f2e40
jmp 0x54dd8b
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x561284]
call fcn.004f2e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54dda8
mov eax, dword [ebp - 4]
call fcn.00405320
ret
Function at 0x54e0b0
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54e1f4
push dword fs:[eax]
mov dword fs:[eax], esp
nop
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x54e210
mov edx, ebx
call fcn.00407c94
mov eax, dword [ebp - 0x25c]
call fcn.00407854
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x54e1ce
xor eax, eax
push ebp
push 0x54e1c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x54e22c
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.00413774
test eax, eax
jne 0x54e198
test byte [ebp - 0x258], 0x10
jne 0x54e198
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.004079c0
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407c94
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x54e18a
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.00407854
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00407854
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x54e122
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e1ce
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e1fb
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.004077c0
lea eax, [ebp - 4]
call fcn.004077b8
ret
Function at 0x54e238
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x54e339
push dword fs:[eax]
mov dword fs:[eax], esp
nop
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004077c8
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004bbf20
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x54e354
call fcn.00413a4c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407c94
mov eax, dword [ebp - 8]
call fcn.00407854
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x54e2d9
test esi, 0x10
jne 0x54e309
test esi, 1
je 0x54e2d9
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.00407854
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.00407854
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407854
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x54e303
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004077c8
jmp 0x54e316
inc edi
cmp edi, 0xa
je 0x54e316
inc ebx
cmp ebx, 0x3e8
jne 0x54e27a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e340
lea eax, [ebp - 0x14]
call fcn.004077b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004077c0
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x57ac5020
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2fd54071
nop
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403853
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00402ee5
test eax, eax
pop ecx
je 0x4038a7
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x4035da
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402bc0
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.00403044
add esp, 0x18
call fcn.00402130
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x277c7c9d
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x225505ef
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x408943
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop ebx
call fcn.00408974
xor dword [esi], ebx
add ecx, 0x7854e7eb
sub edi, 0x6f6d73b
add esi, 1
sub edi, edi
sub ecx, ecx
cmp esi, eax
jne fcn.00408943
ret
Function at 0x10048e98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10048ea7
pop dword [ebp - 0x14]
mov eax, 0x10048ea7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x60e4a8d0
sub dword [ebp - 0x24], 0x12926385
mov dword [ebp - 0x20], 0x3764b500
sub dword [ebp - 0x20], 0x53168bb
mov dword [ebp - 0x1c], 0x44d0d4e
sub dword [ebp - 0x1c], 0xb800c920
mov dword [ebp - 0x18], 0xccc3bd72
add dword [ebp - 0x18], 0x333c428e
lea eax, [ebp - 0x24]
push eax
mov eax, 0xe7872c92
sub eax, 0xd7812c82
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf763424c
add dword [ebp - 0x24], 0x7d0f270a
mov dword [ebp - 0x20], 0x1b4e4631
sub dword [ebp - 0x20], 0xd9e1e4bc
mov dword [ebp - 0x1c], 0xc11f78e9
sub dword [ebp - 0x1c], 0x5db00c7d
mov dword [ebp - 0x18], 0x1df9c1e6
add dword [ebp - 0x18], 0xe2063e1a
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xf9051e7
sub eax, 0xff8a51d3
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x5606c
push 0
call eax
mov ecx, 0x8a8f4595
add ecx, 0x75710338
mov edx, eax
mov ebx, 0x1008bc00
add ebx, dword [ebp - 0x14]
mov edi, 0x5c964df5
sub edi, 0xbf7b28f3
mov esi, dword [ebx]
sub dword [ebp - 0x10], ecx
sub esi, edi
xor dword [ebp - 0x10], esi
mov dword [edx], esi
add dword [ebp - 0x10], eax
add edx, 4
add ebx, 4
loop 0x10048fbe
add eax, 0x11607
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1b308003
sub ecx, 0xb308003
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x32fe2dfe
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x3aa13e5a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4f90309c
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
push 0xe
mov dword [ebp - 4], ecx
and dword [edi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x4f9030c3
push 4
pop eax
jmp 0x4f9030fa
push dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.4f902f28
mov esi, eax
test esi, esi
je 0x4f9030ee
push 0
push dword [ebp - 4]
push ebx
push esi
call fcn.4f902ec0
test eax, eax
je 0x4f9030ee
push esi
call fcn.4f9029c0
xor esi, esi
mov dword [edi], esi
neg esi
sbb esi, esi
and esi, 0xfffffffc
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f9033c0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
test ecx, ecx
jne 0x4f9033d5
push 7
pop eax
jmp 0x4f9033f2
push 0
lea edx, [ebp - 4]
call fcn.4f90389e
test eax, eax
jne 0x4f9033e7
push 4
jmp 0x4f9033d2
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4f9036c7
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 2
mov edi, edx
and dword [esi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x4f9036ea
push 4
pop eax
jmp 0x4f903707
push dword [ebp + 0x10]
mov edx, ebx
push dword [ebp + 8]
push edi
push ecx
mov ecx, eax
call fcn.4f90370e
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4f9048d2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4f918464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x204]
push 0x100
push eax
xor edi, edi
movzx eax, word [esi + 0x3e]
inc edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
je 0x4f904a84
push ebx
xor ebx, ebx
mov byte [ebp - 0x104], 0x20
cmp dword [esi + 0x40], ebx
je 0x4f904942
push 2
pop edi
push 0xff
lea eax, [ebp - 0x103]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
jne 0x4f9049b1
mov byte [ebp - 0x103], bl
jmp 0x4f9049b1
push 0x4f9016c0
mov edx, 0xff
lea ecx, [ebp - 0x103]
call fcn.4f903ad2
cmp dword [esi + 0x44], ebx
je 0x4f90498c
mov eax, dword [esi + 0x4c]
and eax, 0xf000
cmp eax, 0x3000
jne 0x4f90498c
push 0xf2
lea eax, [ebp - 0xf7]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
neg eax
sbb al, al
and byte [ebp - 0xf7], al
mov eax, dword [esi + 0x4c]
test eax, 0x400
je 0x4f90499b
push 2
pop edi
jmp 0x4f9049b1
test al, 5
jne 0x4f9049b1
and eax, 0xf000
sub eax, 0x1000
neg eax
sbb eax, eax
not eax
and edi, eax
push ecx
lea eax, [ebp - 0x204]
mov ebx, 0x200
push eax
push ecx
mov edx, ebx
lea ecx, [ebp - 0x404]
call fcn.4f903b70
test eax, eax
js 0x4f904a66
lea eax, [ebp - 0x104]
mov edx, ebx
push eax
lea ecx, [ebp - 0x404]
call fcn.4f903b05
test eax, eax
js 0x4f904a66
movzx esi, di
lea eax, [ebp - 0x404]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
sbb ecx, ecx
not ecx
and ecx, eax
jne 0x4f904a81
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f904a11
sub ecx, edx
lea eax, [ebp - 0x204]
add eax, ecx
jmp 0x4f904a34
cmp cl, 0x3a
je 0x4f904a3b
lea ecx, [ebp - 0x204]
cmp eax, ecx
je 0x4f904a66
dec eax
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x4f904a24
inc eax
lea ecx, [ebp - 0x404]
push eax
mov edx, ebx
call fcn.4f903ad2
test eax, eax
js 0x4f904a66
lea eax, [ebp - 0x104]
mov edx, ebx
push eax
lea ecx, [ebp - 0x404]
call fcn.4f903b05
test eax, eax
jns 0x4f904a6a
xor eax, eax
jmp 0x4f904a83
push esi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
sbb ecx, ecx
not ecx
and ecx, eax
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.4f915630
mov esp, ebp
pop ebp
ret

Function at 0x4f9050f0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
test ecx, ecx
jne 0x4f905104
push 7
pop eax
jmp 0x4f90511f
push 2
pop edx
call fcn.4f90fa2b
test eax, eax
jne 0x4f905114
push 4
jmp 0x4f905101
push eax
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop ebp
ret 4
Function at 0x4f90542c
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 8
mov esi, edx
mov edi, ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x4f905448
push 4
pop eax
jmp 0x4f905460
push dword [ebp + 0x10]
mov edx, edi
push dword [ebp + 8]
push esi
push ecx
mov ecx, eax
call fcn.4f90517a
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4f906890
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x40]
test ecx, ecx
jne 0x4f9068a5
push 7
pop eax
jmp 0x4f9068c3
push 2
pop edx
call fcn.4f90fa2b
test eax, eax
jne 0x4f9068b5
push 4
jmp 0x4f9068a2
push eax
movzx eax, word [esi + 0x38]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4f906b97
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov si, word [ebp + 0x14]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
and dword [edi], 0
test si, si
jne 0x4f906bb9
push 0xc
pop eax
jmp 0x4f906bf8
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x4f906bcb
push 4
jmp 0x4f906bb6
push dword [ebp + 0x18]
mov edx, dword [ebp - 4]
push dword [ebp + 8]
push ebx
push ecx
mov ecx, eax
call fcn.4f906a43
mov dword [edi], eax
test eax, eax
je 0x4f906bc7
push dword [ebp + 0x10]
mov word [eax + 0x38], si
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [edi]
mov word [ecx + 0x3a], ax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4f9073c0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4f918464]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x4f9073e4
push 0xd
pop eax
jmp 0x4f907494
mov ecx, dword [esi + 0x94]
push edi
sub ecx, 0x10
push 2
pop edi
cmp ecx, 5
ja 0x4f907408
mov ecx, esi
call fcn.4f90af64
cmp eax, edi
jne 0x4f907408
mov eax, edi
jmp 0x4f907493
cmp dword [esi + 0x10], edi
jne 0x4f90742a
mov ecx, dword [esi + 0x70]
mov edx, edi
call fcn.4f90fa2b
test eax, eax
je 0x4f90743e
push eax
movzx eax, word [0x4f9187ec]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, esi
call fcn.4f908456
mov edx, edi
mov ecx, eax
call fcn.4f90fa2b
test eax, eax
jne 0x4f907443
push 4
pop eax
jmp 0x4f907493
push eax
movzx eax, word [0x4f9187f8]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp dword [esi + 0x10], 1
jne 0x4f907478
cmp word [esi + 0x5c], bx
je 0x4f907478
mov ecx, esi
call fcn.4f908910
test eax, eax
je 0x4f907478
push eax
movzx eax, word [0x4f918804]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x4f907491
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4f91a330]
call esi
jmp 0x4f907493
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.4f915630
mov esp, ebp
pop ebp
ret 4
Function at 0x4f908151
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
mov eax, edx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
push 4
mov ebx, ecx
mov dword [ebp - 0xc], eax
pop edi
push 1
mov ecx, eax
mov dword [ebp - 0x10], ebx
call fcn.4f907aad
mov esi, eax
test esi, esi
je 0x4f908288
cmp dword [0x4f918814], 0
mov dword [esi + 0xc], ebx
je 0x4f908282
movzx eax, word [ebp + 0x18]
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4f9081a9
mov dword [esi + 0x40], 1
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.4f90836b
test eax, eax
je 0x4f908282
push esi
call sym.OLECLI32.dll_SetNetName
mov edi, eax
test edi, edi
je 0x4f908224
movzx ecx, word [0x4f918804]
push ecx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4f908282
movzx eax, word [0x4f918804]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x4f908282
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
test eax, eax
je 0x4f908282
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [esi + 0x5c], ax
test ax, ax
je 0x4f908282
mov ecx, esi
call fcn.4f9088ad
mov edx, dword [ebp - 0xc]
lea ebx, [esi + 0x64]
mov ecx, dword [ebp - 0x10]
push 5
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.4f90bb2a
mov edi, eax
test edi, edi
jne 0x4f908282
mov ecx, esi
call fcn.4f907b44
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebx]
test eax, eax
je 0x4f90825c
mov dword [eax + 0x34], esi
xor edx, edx
mov ecx, esi
call fcn.4f904621
test eax, eax
je 0x4f90828a
push 2
pop edx
push edx
mov ecx, esi
mov dword [esi + 0x4c], 0x18
call fcn.4f908702
call fcn.4f9093f3
jmp 0x4f90828a
push esi
call sym.OLECLI32.dll_OleDelete
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4f908293
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, word [0x4f9187f8]
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 4
pop edi
mov esi, edx
mov ebx, ecx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4f9082c9
push 0xb
pop eax
jmp 0x4f908362
mov edx, dword [ebp + 8]
mov ecx, esi
push 2
call fcn.4f907aad
mov esi, eax
test esi, esi
je 0x4f908360
cmp dword [0x4f918814], 0
mov dword [esi + 0xc], ebx
je 0x4f90835a
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.4f90836b
test eax, eax
je 0x4f90835a
mov ecx, esi
call fcn.4f908532
movzx eax, word [0x4f9187ec]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
push 2
pop edx
mov ecx, eax
call fcn.4f90fa2b
mov dword [esi + 0x70], eax
test eax, eax
je 0x4f90835a
mov edx, dword [ebp - 8]
lea ebx, [esi + 0x64]
mov ecx, dword [ebp - 0xc]
push 5
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.4f90bb2a
mov edi, eax
test edi, edi
jne 0x4f90835a
mov ecx, esi
call fcn.4f907b44
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
mov ecx, dword [ebx]
test ecx, ecx
je 0x4f908360
mov dword [ecx + 0x34], esi
jmp 0x4f908360
push esi
call sym.OLECLI32.dll_OleDelete
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4f9087e5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], edi
cmp eax, 0xf
je 0x4f908858
cmp eax, 0xd
jne 0x4f90880b
cmp dword [esi + 0xa0], edi
je 0x4f908858
mov eax, dword [esi + 0xa0]
dec eax
cmp eax, 7
ja case.default.0x4f908817
jmp dword [eax*4 + 0x4f90888d]
pop edi
pop esi
jmp fcn.4f906e10
pop edi
pop esi
jmp fcn.4f9093f3
pop edi
pop esi
jmp fcn.4f908bb7
pop edi
pop esi
jmp fcn.4f908f4e
pop edi
pop esi
jmp fcn.4f9097e7
pop edi
pop esi
jmp fcn.4f909dfe
pop edi
pop esi
jmp fcn.4f90accc
pop edi
xor edx, edx
pop esi
jmp fcn.4f9076e5
mov eax, dword [esi + 0xac]
mov dword [esi + 0x98], 1
mov dword [esi + 0xa8], eax
call fcn.4f908740
cmp dword [esi + 0xb8], edi
je case.default.0x4f908817
mov dword [esi + 0xb8], edi
mov ecx, esi
pop edi
pop esi
jmp fcn.4f904c1b
pop edi
pop esi
ret