joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43464a
Capabilities:
Create directory

Disassembly:
push 0x30
mov eax, 0x436f22
call fcn.00435075
xor ebx, ebx
xorps xmm0, xmm0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
movups xmmword [ebp - 0x1c], xmm0
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042fe52
cmp dword [edi + 4], ebx
je 0x434701
mov ecx, edi
call fcn.0042fe52
mov esi, eax
mov ecx, edi
movzx eax, word [0x442f94]
push eax
call fcn.0042fbf4
test eax, eax
je 0x4346ec
mov ecx, edi
call fcn.0042fe52
mov eax, dword [edi + 4]
mov ecx, edi
dec eax
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
call fcn.004301b6
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.0042f89b
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0042f2ae
lea ecx, [ebp - 0x34]
call fcn.0042f28c
lea ecx, [ebp - 0x24]
call fcn.0042fe52
cmp dword [ebp - 0x20], ebx
je 0x4346ea
lea ecx, [ebp - 0x24]
call fcn.0042fe52
mov esi, eax
jmp 0x4346ec
mov esi, ebx
test esi, esi
je 0x434701
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x434704
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x43471a
push ecx
call fcn.004347cc
mov eax, dword [ebp - 0x14]
pop ecx
push 2
push eax
call fcn.00434791
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
pop ecx
pop ecx
test eax, eax
je 0x434738
push eax
call fcn.004347cc
mov ebx, dword [ebp - 0x1c]
pop ecx
push 1
push ebx
call fcn.00434791
pop ecx
pop ecx
mov eax, esi
call fcn.0043504f
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x438c99
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
or ebx, ecx
call fcn.00438cd3
mov ecx, 0xa9e1cf8d
sub ebx, 1
and ecx, ebx
xor dword [edi], eax
inc ecx
inc edi
mov ecx, ecx
and ecx, ebx
or ebx, ebx
cmp edi, esi
jne fcn.00438c99
add ebx, ebx
add ebx, 0x72d642e1
mov ecx, ecx
ret
Function at 0x4069a1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0x24
je 0x4069b7
xor eax, eax
jmp 0x406a81
cmp dword [0x4443a0], 0
jne 0x4069de
push 0x38
push 0x405baa
push str.ColorChooserClass
call fcn.004258de
add esp, 0xc
mov dword [0x4443a0], 1
push esi
push edi
xor edi, edi
mov dword [ebp - 8], 0x15f
push edi
mov esi, 0xc80000
mov dword [ebp - 0xc], edi
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
mov dword [ebp - 4], 0xd1
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push edi
push edi
push edi
push dword [ebx + 4]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov eax, 0x80000000
push eax
push eax
push esi
push str.Choose_Color
push str.ColorChooserClass
push 1
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
push 5
push esi
mov dword [edi], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0xc]
push esi
call fcn.00406e08
pop ecx
pop ecx
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.0043c167
mov esi, dword [edi + 0x44]
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408ab9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
xor edi, edi
add eax, 0x14
mov ebx, edi
mov edx, edi
mov ecx, dword [eax]
lea esi, [eax - 8]
cmp ecx, eax
je 0x408af8
mov edi, dword [ebp + 8]
cmp dword [esi + 0x18], ebx
jbe 0x408aed
cmp dword [esi + 0x18], edi
jae 0x408aed
mov ebx, dword [esi + 0x18]
mov edx, dword [esi + 0x28]
lea esi, [ecx - 8]
mov ecx, dword [ecx]
cmp ecx, eax
jne 0x408add
xor edi, edi
movzx ecx, word [edx]
or eax, 0xffffffff
mov esi, edx
jmp 0x408b10
cmp cx, 0x5c
lea esi, [esi + 2]
movzx ecx, word [esi]
cmove eax, edi
inc edi
test cx, cx
jne 0x408b02
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x408b1e
mov dword [ecx], ebx
inc eax
pop edi
pop esi
pop ebx
lea eax, [edx + eax*2]
pop ebp
ret
Function at 0x408d51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0xcc010000
mov dword [ebp - 0x1c], 0x1400d801
mov dword [ebp - 0x18], 0x3c00f001
mov dword [ebp - 0x14], 0xe4012800
mov dword [ebp - 0x10], 0x6c00a001
mov dword [ebp - 0xc], 0xb4017800
mov dword [ebp - 8], 0x9c015000
mov dword [ebp - 4], 0x44008801
push esi
movzx esi, ax
test ebx, ebx
jle 0x408de4
push edi
mov edi, dword [ebp + 8]
movzx edx, byte [edi]
mov ecx, esi
and ecx, 0xf
shr si, 4
mov eax, edx
shr edx, 4
and eax, 0xf
mov cx, word [ebp + ecx*2 - 0x20]
xor cx, word [ebp + eax*2 - 0x20]
xor cx, si
movzx ecx, cx
mov eax, ecx
shr cx, 4
and eax, 0xf
mov ax, word [ebp + eax*2 - 0x20]
xor ax, word [ebp + edx*2 - 0x20]
xor ax, cx
inc edi
movzx esi, ax
dec ebx
jne 0x408da2
pop edi
mov ax, si
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409397
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0xc], ebx
cmp edi, 0xffffffff
jne 0x4093cd
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
jmp 0x40944b
push esi
push str..pipe_
push dword [ebp + 8]
call fcn.0040996b
pop ecx
pop ecx
test eax, eax
je 0x409410
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push ebx
push eax
push 4
lea eax, [ebp - 4]
push eax
push edi
call esi
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push edi
call esi
jmp 0x409439
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
pop esi
mov dword [ecx], eax
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40953a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push eax
call fcn.00403e15
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push esi
call dword [ebp + 0x10]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x4095b8
cmp dword [esi + 0xc], ebx
je 0x40957a
push ebx
push ebx
push dword [esi + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.00403d56
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40959f
push 4
pop edi
jmp 0x4095b8
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
push eax
call fcn.00403e5b
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40aca5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40acd5
xor eax, eax
jmp 0x40ad5f
push ebx
push edi
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push 1
push ebx
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
call fcn.0040abcc
pop ecx
pop ecx
test eax, eax
je 0x40ad31
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push edi
call fcn.0040b40d
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x14
mov eax, esi
jmp 0x40ad5d
push edi
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp + 0x1c]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.0040afa2
mov eax, dword [ebp - 4]
add esp, 0x20
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412b21
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x4443bc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4443b0]
xor ebx, ebx
mov esi, dword [0x4443ac]
or edx, 0xffffffff
mov ecx, ebx
test eax, eax
jle 0x412b5a
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + ecx*4], edi
je 0x412b57
inc ecx
cmp ecx, eax
jl 0x412b4b
jmp 0x412b59
mov edx, ecx
pop edi
sub eax, edx
lea ecx, [esi + edx*4]
dec eax
push eax
lea eax, [ecx + 4]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
dec dword [0x4443b0]
jne 0x412ba3
push dword [0x4443ac]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push ebx
push dword [0x4443b8]
mov dword [0x4443ac], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x4443b8], ebx
mov dword [0x4443a8], ebx
push 0x4443bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
pop ebp
ret
Function at 0x413ddd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov ebx, 0x4443bc
inc esi
cmp dword [0x4443b4], 0
push edi
jne 0x413e02
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4443b4], esi
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4443a8], 0
mov edi, dword [ebp + 8]
jne 0x413e35
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push edi
push 0x413e86
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4443b8], eax
mov dword [0x4443a8], esi
mov ecx, dword [0x4443ac]
test ecx, ecx
jne 0x413e52
push 4
push esi
call dword [sym.imp.msvcrt.dll_calloc]
inc dword [0x4443b0]
mov dword [eax], edi
jmp 0x413e71
mov esi, dword [0x4443b0]
lea eax, [esi*4 + 4]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_realloc]
mov dword [eax + esi*4], edi
inc esi
mov dword [0x4443b0], esi
pop ecx
pop ecx
push ebx
mov dword [0x4443ac], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41deed
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
lea eax, [esi + 0x254]
push eax
lea eax, [esi + 0x250]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0040ac8a
add esp, 0xc
mov dword [esi + 0x24c], eax
xor eax, eax
push eax
push eax
push edi
push 0x41dd04
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
ret
Function at 0x41f7b5
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x41f7c7
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push dword [0x4443d4]
call esi
push dword [0x4443d8]
mov edi, eax
call esi
push dword [0x4443dc]
mov ebx, eax
call esi
test edi, edi
jne 0x41f7fc
test ebx, ebx
jne 0x41f7fc
test eax, eax
jne 0x41f7fc
xor esi, esi
jmp 0x41f7ff
xor esi, esi
inc esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x420a72
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0x9c77
cmp dword [ebp + 0x10], ebx
je 0x420aa2
cmp dword [ebp + 0x10], 0x9c78
je 0x420aa2
lea eax, [ebp + 0x10]
push eax
xor eax, eax
push eax
push dword [ebp + 0xc]
push 0x42085b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x420af3
push esi
push edi
push dword [ebp + 0xc]
call fcn.0041f739
mov edi, eax
push 2
push edi
call dword [sym.imp.msvcrt.dll_calloc]
mov esi, eax
push esi
push dword [ebp + 0xc]
call fcn.00420aff
cmp dword [ebp + 0x10], ebx
mov eax, 0x420834
mov ecx, 0x4207dd
cmove ecx, eax
push ecx
push 2
push edi
push esi
call dword [sym.imp.msvcrt.dll_qsort]
push edi
push esi
push dword [ebp + 0xc]
call fcn.00421ff3
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x34
pop edi
pop esi
push dword [ebp + 8]
call fcn.00420b40
pop ecx
pop ebx
pop ebp
ret

Function at 0x422582
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.0041f229
push dword [0x4443d4]
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
call esi
push dword [0x4443d8]
mov dword [ebp - 8], eax
call esi
push dword [0x4443dc]
mov ebx, eax
mov dword [ebp - 0x10], ebx
call esi
mov edi, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edi
test eax, eax
je 0x4225d4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [eax + 4]
imul esi, dword [eax]
add eax, 8
jmp 0x4225fd
test ebx, ebx
je 0x4225eb
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [eax + 0x1c]
imul esi, dword [eax + 0x18]
add eax, 0x20
jmp 0x4225fd
test edi, edi
je 0x422648
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
movzx esi, word [eax + 2]
add eax, 4
cmp esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmovg esi, dword [ebp + 0xc]
test esi, esi
jle 0x42262a
xor ebx, ebx
mov edi, eax
push dword [edi + ebx*4]
call fcn.00405a43
pop ecx
mov ecx, dword [ebp + 8]
mov word [ecx + ebx*2], ax
inc ebx
cmp ebx, esi
jl 0x42260f
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x42263a
push eax
call esi
test ebx, ebx
je 0x422641
push ebx
call esi
test edi, edi
je 0x422648
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425352
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 4]
mov edi, eax
cmp ecx, 1
jle 0x4253b1
dec ecx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
test ecx, ecx
jle 0x4253b0
mov eax, dword [edi + esi*4 + 4]
cmp word [eax], 0x2f
je 0x4253a0
cmp dword [ebp + 0xc], 0
push eax
push dword [ebp + 8]
jne 0x425399
call fcn.00424b45
pop ecx
jmp 0x4253a9
call fcn.00425301
jmp 0x425396
add eax, 2
push eax
call fcn.00423c72
inc esi
pop ecx
cmp esi, dword [ebp - 4]
jl 0x42537d
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x425634
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, 0x43fddc
cmp eax, 0xffffffff
jne 0x4256f6
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
push 0x43d6e8
push str.UseDSColorPicker
push str.NclrViewer
call esi
test eax, eax
je 0x4256f6
push edi
push 0x43e0f4
push 0x440788
push str.NcgrViewer
call esi
test eax, eax
je 0x4256f6
push edi
push 0x43d6e8
push 0x440788
push str.NscrViewer
call esi
test eax, eax
je 0x4256f6
push edi
push 0x43e0f4
push str.FullPaths
push ebx
call esi
test eax, eax
je 0x4256f6
push edi
push 0x43d6e8
push str.PaletteAlgorithm
push ebx
call esi
test eax, eax
je 0x4256f6
push edi
push 0x43e0f4
push str.RenderTransparent
push ebx
call esi
test eax, eax
je 0x4256f6
push edi
push 0x43e0f4
push str.DPIAware
push ebx
call esi
test eax, eax
je 0x4256f6
push edi
push 0x43d6e8
push str.AllowMultiple
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ebx, ebx
push edi
push ebx
push str.UseDSColorPicker
push str.NclrViewer
call esi
push edi
push 1
push 0x440788
push str.NcgrViewer
mov dword [0x44447c], eax
call esi
push edi
push ebx
push 0x440788
push str.NscrViewer
mov dword [0x444480], eax
call esi
push edi
push 1
push str.FullPaths
push 0x43fddc
mov dword [0x444484], eax
call esi
push edi
push 1
push str.RenderTransparent
push 0x43fddc
mov dword [0x444464], eax
call esi
push 2
push 0x104
mov dword [0x444468], eax
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
push edi
push 1
push str.DPIAware
push 0x43fddc
mov dword [0x444478], eax
call esi
push edi
push ebx
push str.AllowMultiple
push 0x43fddc
mov dword [0x44446c], eax
call esi
push edi
push 0x104
push dword [0x444478]
mov dword [0x444470], eax
push 0x43d848
push str.Background
push 0x43fddc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [0x444478]
cmp word [eax], bx
je 0x42583e
lea ecx, [ebp - 4]
mov dword [ebp - 8], ebx
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], ebx
push ecx
push eax
call fcn.0040ac8a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x42583e
mov edx, dword [ebp - 4]
mov ecx, edx
mov edi, dword [ebp - 8]
imul ecx, edi
test ecx, ecx
jle 0x42581d
mov edx, dword [esi + ebx*4]
movzx ecx, byte [esi + ebx*4 + 2]
movzx eax, dl
and edx, 0xff00ff00
shl eax, 0x10
or ecx, eax
or ecx, edx
mov dword [esi + ebx*4], ecx
inc ebx
mov edx, dword [ebp - 4]
mov eax, edx
mov edi, dword [ebp - 8]
imul eax, edi
cmp ebx, eax
jl 0x4257f2
push esi
push 0x20
push 1
push edx
push edi
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push esi
mov dword [0x444474], eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427109
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x20
pop eax
push eax
xor eax, eax
inc eax
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, edi
imul eax, ebx
lea eax, [eax*4 + 0x7c]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
inc ecx
push 0x20
mov word [eax + 0xc], cx
pop ecx
mov dword [eax], 0x7c
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov word [eax + 0xe], cx
mov dword [eax + 0x10], 3
mov dword [eax + 0x28], 0xff0000
mov dword [eax + 0x2c], 0xff00
mov dword [eax + 0x30], 0xff
mov dword [eax + 0x34], 0xff000000
mov dword [eax + 0x38], 0x73524742
mov dword [eax + 0x6c], 8
add eax, 0x7c
test ebx, ebx
jle 0x427222
lea esi, [ebx*4 - 4]
imul edx, edi, 0xfffffffc
imul esi, edi
mov ecx, edi
shl ecx, 2
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
add esi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
test edi, edi
jle 0x42720f
mov dword [ebp - 8], esi
mov ebx, eax
mov esi, edi
mov edi, dword [ebp - 8]
mov ecx, dword [ebx]
mov edx, ecx
shr edx, 0x10
lea ebx, [ebx + 4]
movzx eax, cl
and edx, 0xff
shl eax, 0x10
and ecx, 0xff00ff00
or edx, eax
or edx, ecx
mov dword [edi], edx
lea edi, [edi + 4]
dec esi
jne 0x4271d5
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add esi, edx
add eax, ecx
dec ebx
mov dword [ebp - 4], esi
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], ebx
jne 0x4271c7
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0x11
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427938
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x58
push 1
call dword [sym.imp.msvcrt.dll_calloc]
mov esi, dword [ebp + 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
lea edi, [eax + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0x18]
push 0x11
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
push ecx
push ecx
push eax
push 0x427987
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
ret
Function at 0x427df9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 4
mov esi, 0x20000
push esi
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
mov edi, eax
xor edx, edx
mov ecx, edx
sar ecx, 9
xor ecx, edx
sar ecx, 2
and ecx, 1
neg ecx
and ecx, 0x3f3f3f
add ecx, 0xc0c0c0
mov dword [edi + edx*4], ecx
inc edx
cmp edx, esi
jl 0x427e12
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x427e9b
cmp dword [ebp + 0xc], 0
je 0x427e9b
cmp dword [ebp + 0x10], 0
je 0x427e9b
cmp dword [ebp + 0x14], 0
je 0x427e9b
cmp dword [ebp + 0x18], 0
je 0x427e9b
mov ecx, dword [ecx + 0x30]
mov eax, dword [ebp + 0x1c]
movzx esi, word [ecx + eax*8]
dec esi
mov edx, dword [ecx + eax*8 + 4]
js 0x427e9b
push ebx
lea ebx, [edx + 2]
lea ebx, [ebx + esi*8]
movsx eax, word [ebx + 2]
push eax
movsx eax, word [ebx]
push eax
movzx eax, word [ebx - 2]
push 0
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0041457c
add esp, 0x28
lea ebx, [ebx - 8]
dec esi
jns 0x427e6c
pop ebx
push edi
push 0x20
push 1
push 0x100
push 0x200
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x42819f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
cmp ebx, 0x3c
jb 0x42830e
test bl, 3
jne 0x42830e
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0x20
jge 0x42830e
cmp dword [ecx + 8], 0x3c
mov esi, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov edi, dword [ecx + 0xc]
mov dword [ebp + 0xc], esi
mov esi, dword [ecx + 0x24]
jb 0x42830e
cmp eax, 0x3c
jb 0x42830e
cmp edx, 0x3c
jb 0x42830e
cmp dword [ecx + 0x20], 0x3c
jb 0x42830e
cmp dword [ecx + 0x28], 0x3c
jb 0x42830e
cmp dword [ecx + 8], ebx
ja 0x42830e
cmp eax, ebx
ja 0x42830e
cmp edx, ebx
ja 0x42830e
cmp dword [ecx + 0x20], ebx
ja 0x42830e
cmp dword [ecx + 0x28], ebx
ja 0x42830e
test byte [ecx + 8], 3
jne 0x42830e
test al, 3
jne 0x42830e
test dl, 3
jne 0x42830e
test byte [ecx + 0x20], 3
jne 0x42830e
test byte [ecx + 0x28], 3
jne 0x42830e
lea eax, [eax + edi*8]
cmp eax, ebx
ja 0x42830e
imul eax, dword [ecx + 0x14], 0x14
add eax, edx
cmp eax, ebx
ja 0x42830e
mov eax, dword [ecx + 0x1c]
shl eax, 4
add eax, dword [ecx + 0x20]
cmp eax, ebx
ja 0x42830e
imul eax, esi, 0x30
add eax, dword [ecx + 0x28]
cmp eax, ebx
ja 0x42830e
test edi, edi
jne 0x42829e
test esi, esi
je 0x42830e
mov eax, dword [ecx + 0x14]
xor edi, edi
test eax, eax
je 0x428309
lea esi, [ecx + 8]
add esi, edx
cmp dword [esi - 8], 0x3c
jb 0x42830e
cmp dword [esi - 4], 0x3c
jb 0x42830e
cmp dword [esi - 8], ebx
jae 0x42830e
cmp dword [esi - 4], ebx
jae 0x42830e
mov ecx, dword [esi + 8]
movzx eax, word [esi + 4]
shr ecx, 0x14
push 8
and ecx, 7
pop edx
shl edx, cl
cmp eax, edx
jne 0x42830e
mov ecx, dword [esi + 8]
movzx eax, word [esi + 6]
shr ecx, 0x17
push 8
and ecx, 7
pop edx
shl edx, cl
cmp eax, edx
jne 0x42830e
test dword [esi + 8], 0x1c000000
je 0x42830e
mov ecx, dword [esi]
lea eax, [ecx - 1]
test ecx, eax
jne 0x42830e
inc edi
add esi, 0x14
cmp edi, dword [ebp + 0xc]
jb 0x4282ac
xor eax, eax
inc eax
jmp 0x428310
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret