joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a5b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461ae9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov edx, dword [esp + 0x28]
push ebx
xor ebx, ebx
push esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
cmp ecx, eax
push edi
mov dword [esp + 0xc], ebx
jle 0x43a622
mov esi, dword [esp + 0x30]
mov al, byte [esp + 0x30]
mov edi, 0x476804
or ecx, 0xffffffff
mov byte [esi], al
xor eax, eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x476804
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov esi, dword [edx + 0xc]
sub eax, ecx
inc eax
add esi, ecx
mov cl, byte [esp + 0x30]
push ebp
mov ebp, eax
mov byte [esp + 0x14], cl
push 1
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x43a671
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov esi, dword [esp + 0x34]
mov al, byte [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
mov ecx, esi
push edx
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x18]
pop ebp
cmp ecx, ebx
je 0x43a6d6
mov al, byte [ecx - 1]
cmp al, bl
je 0x43a6cc
cmp al, 0xff
je 0x43a6cc
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x43d760
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x4404f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461e6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x464f78
mov al, byte [esp + 0x20]
xor edi, edi
mov dword [esp + 0x18], edi
mov byte [esi + 0x1c], al
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dl, byte [esp + 0x20]
lea ecx, [esi + 0x38]
push edi
mov byte [esp + 0x1c], 1
mov byte [ecx], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [esp + 0x20]
lea ecx, [esi + 0x48]
push edi
mov byte [esp + 0x1c], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esi + 0x58]
mov byte [esp + 0x18], 3
call fcn.00444b40
mov cl, byte [esp + 0x20]
mov dl, byte [esp + 0x20]
mov al, byte [esp + 0x20]
mov byte [esi + 0xb4], cl
mov cl, byte [esp + 0x20]
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov byte [esi + 0x108], dl
mov dl, byte [esp + 0x20]
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov byte [esi + 0x118], al
mov eax, dword [esp + 0x20]
mov dword [esi + 0x11c], edi
mov dword [esi + 0x120], edi
mov dword [esi + 0x124], edi
push 0x4404a0
mov byte [esi + 0x128], cl
mov dword [esi + 0x12c], edi
mov dword [esi + 0x130], edi
mov dword [esi + 0x134], edi
push 0xfffffffffffffffc
mov byte [esi + 0x138], dl
mov dword [esi + 0x13c], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0x144], edi
push eax
mov dword [esi], 0x464edc
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov ebx, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
mov dword [esi + 0x10], eax
call ebx
push edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edi
call ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x94], edi
mov ecx, dword [esi + 4]
push edi
push 0x14
push 1
push ecx
mov dword [esi + 0x98], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0x148], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0xb0], 0xd8e9ec
mov dword [esi + 0x14c], edi
mov dword [esi + 0x2c], edi
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x441a40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
mov al, 1
push esi
mov esi, ecx
mov cl, byte [0x476d28]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, cl
jne 0x441a68
or cl, al
mov byte [0x476d28], cl
call edi
mov dword [0x476d2c], eax
call edi
mov edi, dword [0x476d2c]
mov ecx, eax
sub ecx, edi
mov dword [0x476d24], eax
cmp ecx, 0x1f4
jb 0x441aab
mov dword [0x476d2c], eax
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov ecx, esi
call fcn.00442350
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_EndPaint]
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret 8
Function at 0x447da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46225e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x14], ebp
mov dword [ebp], 0x4651f0
xor ebx, ebx
mov dword [esp + 0x30], 1
xor edi, edi
lea esi, [ebp + 0xc]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x447dfd
mov ecx, dword [esi + 8]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x447dfd
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + edi*4]
cmp ecx, ebx
je 0x447dfa
mov eax, dword [ecx]
call dword [eax + 4]
inc edi
jmp 0x447dd8
mov cl, byte [esp + 0x13]
mov byte [esp + 0x18], cl
mov eax, dword [esi + 4]
mov dword [esi + 4], ebx
mov edx, dword [esi + 8]
mov dword [esi + 8], ebx
mov ecx, dword [esi + 0xc]
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov dword [esi + 0xc], ebx
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esi + 8]
mov edi, dword [esi + 4]
mov eax, ecx
add esp, 4
cmp eax, ecx
je 0x447e4b
mov edx, dword [eax]
add eax, 4
mov dword [edi], edx
add edi, 4
cmp eax, ecx
jne 0x447e3d
mov eax, dword [esi + 8]
mov ecx, esi
push eax
push edi
call fcn.00417b30
mov dword [esi + 8], edi
mov eax, dword [ebp + 0x20]
push eax
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_operatordelete
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x1c], eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x30]
add esp, 8
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4572e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebp
xor ebp, ebp
push esi
push ebp
push 2
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x45730c
pop esi
xor eax, eax
pop ebp
add esp, 0x128
ret
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x45732d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x128
ret
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
push edi
mov edi, dword [esp + 0x13c]
lea ecx, [esp + 0x34]
push edi
push ecx
call ebx
add esp, 8
test eax, eax
je 0x457369
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x45736d
lea eax, [esp + 0x34]
push edi
push eax
call ebx
add esp, 8
test eax, eax
jne 0x45734b
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret
Function at 0x458120
Capabilities:
Enumerate processes

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
push edi
push ebp
push 2
mov dword [esi], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x458144
pop edi
pop esi
xor eax, eax
pop ebp
ret
push esi
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x45815c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [esi + 8]
push ebx
mov ebx, dword [esp + 0x14]
cmp eax, ebx
je 0x458178
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x45817d
cmp dword [esi + 8], ebx
jne 0x458168
mov ebp, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, ebp
pop esi
pop ebp
ret
Function at 0x459130
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46323c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov al, byte [esp + 3]
push esi
xor esi, esi
push edi
mov edi, ecx
mov byte [esp + 0x14], al
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], esi
push ecx
mov ecx, edi
call fcn.004592a0
test eax, eax
je 0x459255
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], esi
cmp eax, esi
jne 0x459191
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push ebx
lea edx, [esp + 0x10]
push ebp
push edx
push 0xf003f
push esi
push eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x459223
lea ecx, [esp + 0x18]
lea edx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x30]
push edx
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x459223
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x148]
push 1
not ecx
dec ecx
mov ebp, ecx
mov ecx, ebx
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x459223
mov edi, dword [ebx + 4]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], ebp
xor esi, esi
mov byte [ecx + ebp], 0
mov ecx, dword [esp + 0x20]
pop ebp
cmp ecx, esi
pop ebx
je 0x45924e
mov al, byte [ecx - 1]
test al, al
je 0x459244
cmp al, 0xff
je 0x459244
dec al
mov byte [ecx - 1], al
mov eax, 1
jmp 0x45927b
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
jmp 0x45927b
mov ecx, dword [esp + 0x18]
cmp ecx, esi
je 0x459279
mov al, byte [ecx - 1]
test al, al
je 0x45926f
cmp al, 0xff
je 0x45926f
dec al
mov byte [ecx - 1], al
jmp 0x459279
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x130
ret 8
Function at 0x45bea0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4635f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
lea edi, [ebp + ebp + 2]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
push 0xffffffffffffffff
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x30]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea edi, [ebx + 1]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
push 0
and ecx, 3
push ebx
push ebp
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x40]
push 0xffffffffffffffff
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_2
push ebp
mov byte [esp + 0x20], 2
push 0x46f478
lea ecx, [esp + 0x34]
push ecx
call sub.MFC42.DLL_CString::Format
push esi
call sub.MFC42.DLL_operatordelete
push ebp
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x38]
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x403088
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4030cb
xor eax, eax
mov al, byte [ebp - 1]
add eax, 0x41
dec eax
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x214]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x110]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
cmp byte [ebp - 1], 0
je 0x4030ee
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.00404aec
mov esp, ebp
pop ebp
ret

Function at 0x4032a8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x403305
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 0xc]
call fcn.004031dc
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004031dc
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x4032ef
inc dword [ebp - 4]
jmp 0x4032d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40330c
lea eax, [ebp - 0xc]
call fcn.00404894
ret

Function at 0x403314
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40334e
push 0x105
lea eax, [ebp - 0x111]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, dword [ebp - 8]
call fcn.0040497c
jmp 0x403377
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004031dc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x403377
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x403377
dec dword [ebp - 4]
jmp 0x403356
mov esp, ebp
pop ebp
ret

Function at 0x4035dc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x579044], 0x8088405
inc edx
mov dword [0x579044], edx
mul edx
mov eax, edx
ret
Function at 0x403844
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038bc
xor eax, eax
push ebp
push 0x4038b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x404820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 8
call fcn.00402f14
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov byte [0x579049], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, 0x4047e8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x438424
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x438496
mov eax, dword [0x578828]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x438468
mov eax, dword [ebp - 4]
push eax
push 0x4384a0
call fcn.004598ac
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x43848f
mov ecx, dword [0x5784bc]
mov dl, 1
mov eax, dword [0x409380]
call fcn.0040e488
call fcn.004041fc
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 4]
inc dword [eax + 4]
pop ecx
pop ebp
ret

Function at 0x4384d8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00438424
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43854c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x43851f
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00404a74
jmp 0x438527
mov eax, dword [ebp - 8]
call fcn.00404894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438553
cmp dword [ebp - 0xc], 0
je 0x438543
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.004383e0
ret

Function at 0x438558
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00438424
xor eax, eax
push ebp
push 0x438611
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0
je 0x4385e4
mov dx, word [ebp - 0xe]
mov eax, dword [0x4210cc]
call fcn.00426644
test al, al
je 0x4385cf
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
push 9
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0xe]
mov eax, dword [ebp - 8]
call fcn.00426524
call fcn.0040429c
jmp 0x438618
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_EnumClipboardFormats
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0
jne 0x43858c
mov ecx, dword [0x57856c]
mov dl, 1
mov eax, dword [0x409380]
call fcn.0040e488
call fcn.004041fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438618
mov eax, dword [ebp - 4]
call fcn.004383e0
ret
mov esp, ebp
pop ebp
ret