joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], ecx
push 2
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx + 0x548]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 1
jge 0x40680f
jmp 0x406a16
movzx eax, word [ebp - 0x128]
cmp eax, 0xff
jle 0x406822
jmp 0x406a16
mov cl, byte [ebp - 0x128]
mov byte [ebp - 0x131], cl
movzx edx, byte [ebp - 0x131]
push edx
call fcn.00412ec2
add esp, 4
mov byte [ebp - 0x13d], al
movzx eax, byte [ebp - 0x131]
push eax
call fcn.004130cb
add esp, 4
mov byte [ebp - 0x129], al
push 0
push 0
push 0x147
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx + 0x1c0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffff
jne 0x40688a
jmp 0x406a16
push 0
mov eax, dword [ebp - 0x138]
push eax
push 0x150
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx + 0x1c0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x42e48c]
mov dword [ebp - 0x13c], ecx
push 0
push 0
push 0x188
mov edx, dword [ebp - 0x148]
mov eax, dword [edx + 0x1b8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffff
jne 0x4068f6
jmp 0x406a16
cmp dword [ebp - 0x13c], 0x14
jge 0x40690b
mov cl, byte [ebp - 0x13d]
mov byte [ebp - 0x131], cl
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x148]
mov cl, byte [ebp - 0x131]
mov byte [eax + edx*8 + 0x758], cl
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x13c]
mov dword [eax + edx*8 + 0x75c], ecx
mov edx, dword [ebp - 0x130]
imul edx, edx, 0xc
mov eax, dword [edx + 0x42e490]
push eax
movzx ecx, byte [ebp - 0x131]
push ecx
push str.___c_t_s
lea edx, [ebp - 0x108]
push edx
call fcn.00412cf6
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
push 0x181
mov edx, dword [ebp - 0x148]
mov eax, dword [edx + 0x1b8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov ecx, dword [ebp - 0x138]
add ecx, 1
push ecx
push 0x182
mov edx, dword [ebp - 0x148]
mov eax, dword [edx + 0x1b8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov ecx, dword [ebp - 0x138]
push ecx
push 0x186
mov edx, dword [ebp - 0x148]
mov eax, dword [edx + 0x1b8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [ebp - 0x129]
push ecx
mov ecx, dword [ebp - 0x148]
call fcn.004063c0
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x406a16
mov edx, dword [ebp - 0x144]
cmp edx, dword [ebp - 0x138]
je 0x406a16
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x148]
call fcn.00406a30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret
Function at 0x407630
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x201
je 0x40764a
jmp 0x407667
push 1
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x80
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00407540
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4087e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x838], ecx
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x838]
mov edx, dword [ecx + 0x1b8]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10
lea eax, [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0x838]
mov edx, dword [ecx + 0x3b0]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x82c]
push ecx
mov edx, dword [ebp - 0x838]
mov eax, dword [edx + 0x1b4]
push eax
call fcn.00408da0
add esp, 0xc
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0xffffffff
je 0x4088fd
push 0
mov ecx, dword [ebp - 0x830]
push ecx
push 0x182
mov edx, dword [ebp - 0x838]
mov eax, dword [edx + 0x1b4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov ecx, dword [ebp - 0x838]
mov edx, dword [ecx + 0x214]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov ecx, dword [ebp - 0x838]
call fcn.00408710
movzx eax, word [ebp - 0x808]
neg eax
sbb eax, eax
neg eax
push eax
mov ecx, dword [ebp - 0x838]
mov edx, dword [ecx + 0x1c4]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 0x838]
mov ecx, dword [eax + 0x3b0]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
mov edx, dword [ebp - 0x838]
mov eax, dword [edx + 0x3b0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret
Function at 0x408910
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1064
call fcn.00412c20
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1064], ecx
push 0x10
lea eax, [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ecx + 0x3b0]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ecx + 0x1b8]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x82c]
push ecx
push str._s_t_s
lea edx, [ebp - 0x1060]
push edx
call fcn.00412cf6
add esp, 0x10
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x82c]
push ecx
mov edx, dword [ebp - 0x1064]
mov eax, dword [edx + 0x1b4]
push eax
call fcn.00408da0
add esp, 0xc
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0xffffffff
je 0x4089dd
push 0
mov ecx, dword [ebp - 0x834]
push ecx
push 0x182
mov edx, dword [ebp - 0x1064]
mov eax, dword [edx + 0x1b4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0x1060]
push ecx
push 0
push 0x180
mov edx, dword [ebp - 0x1064]
mov eax, dword [edx + 0x1b4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x186
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ecx + 0x1b4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov ecx, dword [ebp - 0x1064]
call fcn.00408710
push 0
mov eax, dword [ebp - 0x1064]
mov ecx, dword [eax + 0x1c4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
mov edx, dword [ebp - 0x1064]
mov eax, dword [edx + 0x214]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ecx + 0x3b0]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
mov eax, dword [ebp - 0x1064]
mov ecx, dword [eax + 0x3b0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret
Function at 0x408b40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x838], ecx
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x838]
mov edx, dword [ecx + 0x1b8]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10
lea eax, [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0x838]
mov edx, dword [ecx + 0x3b0]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x834], 0xffffffff
movzx eax, word [ebp - 0x82c]
test eax, eax
je 0x408c3d
lea ecx, [ebp - 0x830]
push ecx
lea edx, [ebp - 0x82c]
push edx
mov eax, dword [ebp - 0x838]
mov ecx, dword [eax + 0x1b4]
push ecx
call fcn.00408da0
add esp, 0xc
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0xffffffff
je 0x408bed
mov edx, dword [ebp - 0x834]
mov dword [ebp - 0x83c], edx
jmp 0x408c1a
cmp dword [ebp - 0x830], 0xffffffff
je 0x408c04
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x840], eax
jmp 0x408c0e
mov dword [ebp - 0x840], 0xffffffff
mov ecx, dword [ebp - 0x840]
mov dword [ebp - 0x83c], ecx
push 0
mov edx, dword [ebp - 0x83c]
push edx
push 0x186
mov eax, dword [ebp - 0x838]
mov ecx, dword [eax + 0x1b4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x408c59
push 0
push 0xffffffffffffffff
push 0x186
mov edx, dword [ebp - 0x838]
mov eax, dword [edx + 0x1b4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x834], 0xffffffff
je 0x408ca7
push 1
mov ecx, dword [ebp - 0x838]
call fcn.00408710
movzx ecx, word [ebp - 0x808]
neg ecx
sbb ecx, ecx
neg ecx
push ecx
mov edx, dword [ebp - 0x838]
mov eax, dword [edx + 0x1c4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
mov ecx, dword [ebp - 0x838]
mov edx, dword [ecx + 0x214]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x408d0f
push 0
mov ecx, dword [ebp - 0x838]
call fcn.00408710
movzx eax, word [ebp - 0x82c]
test eax, eax
je 0x408cd6
movzx ecx, word [ebp - 0x808]
test ecx, ecx
je 0x408cd6
mov dword [ebp - 0x844], 1
jmp 0x408ce0
mov dword [ebp - 0x844], 0
mov edx, dword [ebp - 0x844]
push edx
mov eax, dword [ebp - 0x838]
mov ecx, dword [eax + 0x1c4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov edx, dword [ebp - 0x838]
mov eax, dword [edx + 0x214]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret
Function at 0x408ed0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x439960
push str.UniKey_MainWnd
push 0x80
mov ecx, dword [ebp - 0xc]
call fcn.0040ec30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x408f21
xor eax, eax
jmp 0x4090b3
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x650], 0
push 0x425b8c
call fcn.00402e40
add esp, 4
test eax, eax
je 0x408f64
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x650], 1
jmp 0x408f7d
mov ecx, dword [ebp - 0xc]
call fcn.0040f010
test eax, eax
je 0x408f7d
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x650], 1
cmp dword [0x439a54], 0
je 0x408f9c
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x650], 0
jne 0x408f9c
mov dword [0x439a54], 0
push 0x439a38
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.0040dab0
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.0040dbf0
xor eax, eax
mov word [0x439a80], ax
push 0x103
mov ecx, dword [ebp - 0xc]
add ecx, 0x444
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
mov edx, dword [ebp - 0xc]
add edx, 0x444
push edx
call fcn.00412cca
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409003
xor eax, eax
mov ecx, dword [ebp - 4]
mov word [ecx], ax
mov edx, dword [ebp - 0xc]
add edx, 0x444
push edx
push str._sukmanual.htm
mov eax, dword [ebp - 0xc]
add eax, 0x34
push eax
call fcn.00412cf6
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 0x444
push ecx
push str._skeymap.txt
mov edx, dword [ebp - 0xc]
add edx, 0x23c
push edx
call fcn.00412cf6
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, 0x444
push eax
push str._sukmacro.txt
mov ecx, dword [ebp - 0xc]
add ecx, 0x658
push ecx
call fcn.00412cf6
add esp, 0xc
mov edx, dword [ebp - 0xc]
add edx, 0x658
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x860
push eax
call fcn.004129ce
add esp, 8
mov ecx, dword [ebp - 0xc]
add ecx, 0xa68
call dword [sym.imp.UKHook40.dll_public:_void___thiscall_CMacroTable::init_void_]
mov ecx, dword [ebp - 0xc]
add ecx, 0x658
push ecx
call fcn.0040f3d0
add esp, 4
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xa68
call dword [sym.imp.UKHook40.dll_public:_int___thiscall_CMacroTable::loadFromFile_char_const__]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x409890
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
mov eax, dword [0x439a28]
push eax
mov ecx, dword [sym.imp.UKHook40.dll_long_int___stdcall_MyKeyHook_int__unsigned_int__long_int_]
push ecx
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x439a30], eax
push 0
mov edx, dword [0x439a28]
push edx
mov eax, dword [sym.imp.UKHook40.dll_long_int___stdcall_MyMouseHook_int__unsigned_int__long_int_]
push eax
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x439a34], eax
cmp dword [0x439a30], 0
jne 0x4098ff
push 0x10
push str.Error
push str.Failed_to_set_up_keyboard_hook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x409a79
cmp dword [0x439a34], 0
jne 0x409923
push 0x10
push str.Error
push str.Failed_to_set_up_mouse_hook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x409a79
push 0x28
push 0
lea ecx, [ebp - 0x148]
push ecx
call fcn.00412c50
add esp, 0xc
call dword [sym.imp.UKHook40.dll_void___cdecl_InitUkHook_void_]
mov ecx, 0x439aa0
call fcn.0040a760
mov dword [ebp - 0x120], 0x114
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 4
ja 0x409984
cmp dword [ebp - 0x110], 2
jne 0x409978
cmp dword [ebp - 0x11c], 4
je 0x409984
mov dword [ebp - 0x14c], 0
jmp 0x40998e
mov dword [ebp - 0x14c], 1
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x124], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x13c], eax
push 0x82
mov ecx, dword [0x439a2c]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x130], eax
push 0x81
mov edx, dword [0x439a2c]
push edx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x134], eax
mov eax, dword [0x439a30]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x439a34]
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], 0x401
mov edx, dword [0x439a44]
mov dword [ebp - 0x148], edx
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.UKHook40.dll_void___cdecl_SetUnikeySysInfo_struct__UnikeySysInfo__]
add esp, 4
mov ecx, dword [0x439a3c]
push ecx
call dword [sym.imp.UKHook40.dll_void___cdecl_EnableUnikey_int_]
add esp, 4
mov edx, dword [0x439a48]
push edx
call dword [sym.imp.UKHook40.dll_int___cdecl_SetInputMethod_enum_UkInputMethod_]
add esp, 4
mov eax, dword [0x439a40]
push eax
call dword [sym.imp.UKHook40.dll_int___cdecl_SetOutputCharset_int_]
add esp, 4
push 0x439a38
call fcn.0040a650
add esp, 4
mov ecx, 0x439aa0
call fcn.0040a6c0
call dword [sym.imp.UKHook40.dll_void___cdecl_SetUnikeyReady_void_]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret
Function at 0x409a90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x409ac5
jmp 0x409b2c
push str.ChangeWindowMessageFilter
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x409b2c
push 1
push 0x466
call dword [ebp - 0x124]
push 1
push 0x467
call dword [ebp - 0x124]
push 1
push 0x468
call dword [ebp - 0x124]
push 1
push 0x469
call dword [ebp - 0x124]
push 1
push 0x46a
call dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret

Function at 0x409b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42435f
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4315b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
mov dword [eax], vtable.CVirWindow.0
mov ecx, dword [ebp - 0x60]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x60]
mov dword [edx + 4], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x60]
mov dword [eax], vtable.CMainWnd.0
mov ecx, dword [ebp - 0x60]
add ecx, 0xc
call fcn.0040dae0
mov byte [ebp - 4], 1
push 1
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x60]
add ecx, 0x22a74
call fcn.00409d80
mov byte [ebp - 4], 2
push 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x60]
add ecx, 0x2301c
call fcn.00409c90
mov byte [ebp - 4], 3
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x60]
add ecx, 0x233a8
call fcn.00409f00
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x654], edx
mov eax, dword [ebp - 0x60]
mov dword [eax + 0x30], 0
xor ecx, ecx
mov edx, dword [ebp - 0x60]
mov word [edx + 0x34], cx
mov eax, dword [ebp - 0x60]
mov dword [eax + 0x64c], 0
mov ecx, dword [ebp - 0x60]
mov dword [ecx + 0x650], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a730
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
mov eax, dword [ebp - 4]
add eax, 0x34
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x40aa00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42453c
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x4315b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x12c], 0x114
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 6
jb 0x40aaba
push 0x14
call fcn.004133e4
add esp, 4
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x134], 0
je 0x40aa8c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x134]
call fcn.0040b680
mov dword [ebp - 0x144], eax
jmp 0x40aa96
mov dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x130], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0x130]
mov dword [ecx + 4], edx
jmp 0x40ab21
push 0x70
call fcn.004133e4
add esp, 4
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x13c], 0
je 0x40aaf5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x13c]
call fcn.0040ac70
mov dword [ebp - 0x148], eax
jmp 0x40aaff
mov dword [ebp - 0x148], 0
mov edx, dword [ebp - 0x148]
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x138]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041256e
mov esp, ebp
pop ebp
ret 8
Function at 0x40d7d0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
cmp dword [0x45dca8], 0
jne 0x40d810
xor eax, eax
jmp 0x40d958
mov eax, dword [0x45dca8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40d842
jmp 0x40d925
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00411fc0
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
jne 0x40d8d3
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40d897
jmp 0x40d925
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40d8ae
jmp 0x40d925
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00411fc0
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40d8dd
jmp 0x40d925
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
and edx, 0xc
add edx, 1
push edx
call dword [sym.imp.USER32.dll_SetClipboardData]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x20], 0
je 0x40d935
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x14], 0
je 0x40d945
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x28], 0
je 0x40d955
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret