joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00419120
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esp, ebp
pop ebp
ret

Function at 0x4127c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0x810], ax
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push 0x448504
call fcn.004349b0
add esp, 0xc
movzx edx, word [ebp - 0x810]
test edx, edx
je 0x412847
lea eax, [ebp - 0x810]
push eax
push str.products.txt
call fcn.00406a40
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412847
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x810]
push edx
call fcn.0040ae60
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041919a
mov esp, ebp
pop ebp
ret

Function at 0x412b30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0x810], ax
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push 0x448504
call fcn.004349b0
add esp, 0xc
movzx edx, word [ebp - 0x810]
test edx, edx
je 0x412bb7
lea eax, [ebp - 0x810]
push eax
push str.dw_cls.txt
call fcn.00406a40
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412bb7
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x810]
push edx
call fcn.0040ae60
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041919a
mov esp, ebp
pop ebp
ret

Function at 0x412ed0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0x810], ax
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push 0x448504
call fcn.004349b0
add esp, 0xc
movzx edx, word [ebp - 0x810]
test edx, edx
je 0x412f57
lea eax, [ebp - 0x810]
push eax
push str.dw_edi.txt
call fcn.00406a40
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412f57
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x810]
push edx
call fcn.0040ae60
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041919a
mov esp, ebp
pop ebp
ret
Function at 0x413c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x413d22
mov dword [ebp - 0x814], 0x400
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x810]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x413d22
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x820], ecx
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0x810]
push eax
call fcn.00413590
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041919a
mov esp, ebp
pop ebp
ret
Function at 0x413f90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.004196a0
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0x15f8f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x413fc1
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1028], ecx
jmp 0x413fca
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1028], edx
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0xc], eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x1020], 0x78ef8fef
push 0x1000
push 0
lea eax, [ebp - 0x1018]
push eax
call fcn.00419120
add esp, 0xc
mov ecx, dword [ebp + 0xc]
sub ecx, 4
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x414114
mov dword [ebp - 0x101c], 0xffc
mov edx, dword [ebp - 0x101c]
cmp edx, dword [ebp - 4]
jbe 0x414036
mov eax, dword [ebp - 4]
mov dword [ebp - 0x101c], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x101c]
push edx
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x414063
mov edx, dword [ebp - 0x101c]
cmp edx, dword [ebp - 0x10]
je 0x414068
jmp 0x414114
mov eax, dword [ebp - 0x10]
sub eax, 4
mov dword [ebp - 0x101c], eax
mov dword [ebp - 8], 0
jmp 0x414086
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x101c]
jae 0x4140e1
mov eax, dword [ebp - 8]
movsx ecx, byte [ebp + eax - 0x1018]
movsx edx, byte [ebp - 0x1020]
cmp ecx, edx
jne 0x4140df
mov eax, dword [ebp - 8]
lea ecx, [ebp + eax - 0x1018]
mov dword [ebp - 0x1024], ecx
push 4
lea edx, [ebp - 0x1020]
push edx
mov eax, dword [ebp - 8]
lea ecx, [ebp + eax - 0x1018]
push ecx
call fcn.0041a621
add esp, 0xc
test eax, eax
jne 0x4140df
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
jmp 0x414116
jmp 0x41407d
push 4
mov edx, dword [ebp - 0x10]
lea eax, [ebp + edx - 0x1018]
push eax
lea ecx, [ebp - 0x1018]
push ecx
call fcn.00419260
add esp, 0xc
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x41400e
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041919a
mov esp, ebp
pop ebp
ret
Function at 0x4157c0
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1080
call fcn.004196a0
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x20
lea eax, [ebp - 0x48]
push eax
push str.ProxyServer
call fcn.00428710
add esp, 0x10
mov ecx, dword [0x446fac]
mov edx, dword [ecx + 0x874]
and edx, 0x10
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004156f0
add esp, 8
mov ecx, dword [0x446fac]
mov edx, dword [ecx + 0x874]
and edx, 0x10
je 0x41582a
push 0x1519
mov eax, dword [ebp + 8]
push eax
call fcn.0042a8f0
add esp, 8
push 0x400
lea ecx, [ebp - 0x848]
push ecx
push 0x448504
push 0x444250
push str.ProxyServer
mov ecx, 0x446fc0
call fcn.004339f0
push 0
push str.Port
push str.ProxyServer
mov ecx, 0x446fc0
call fcn.00432470
mov dword [ebp - 0x86c], eax
movzx edx, word [ebp - 0x848]
test edx, edx
jne 0x4159e8
lea eax, [ebp - 0x874]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 0
jne 0x4159e8
mov dword [ebp - 0x87c], 0x400
lea ecx, [ebp - 0x87c]
push ecx
lea edx, [ebp - 0x1080]
push edx
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x874]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x870], eax
mov edx, dword [ebp - 0x874]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x870], 0
jne 0x4159e8
push 0x3d
lea eax, [ebp - 0x1080]
push eax
call fcn.00418a40
add esp, 8
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 0
je 0x41593d
mov ecx, dword [ebp - 0x878]
add ecx, 2
mov dword [ebp - 0x878], ecx
mov edx, dword [ebp - 0x878]
push edx
lea eax, [ebp - 0x1080]
push eax
call fcn.00419e18
add esp, 8
push 0x3b
lea ecx, [ebp - 0x1080]
push ecx
call fcn.00418a40
add esp, 8
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 0
je 0x415968
xor edx, edx
mov eax, dword [ebp - 0x878]
mov word [eax], dx
push 0x3a
lea ecx, [ebp - 0x1080]
push ecx
call fcn.00418a40
add esp, 8
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 0
je 0x4159e8
xor edx, edx
mov eax, dword [ebp - 0x878]
mov word [eax], dx
mov ecx, dword [ebp - 0x878]
add ecx, 2
mov dword [ebp - 0x878], ecx
mov edx, dword [ebp - 0x878]
push edx
call fcn.0041bca1
add esp, 4
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 0xffff
jbe 0x4159cd
mov dword [ebp - 0x86c], 0
push 0x400
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x1080]
push ecx
call fcn.00428990
add esp, 0xc
cmp dword [ebp - 0x86c], 0
jne 0x4159fb
mov dword [ebp - 0x86c], 0x1f40
push 0xa
lea edx, [ebp - 0x868]
push edx
mov eax, dword [ebp - 0x86c]
push eax
call fcn.0041a463
add esp, 0xc
lea ecx, [ebp - 0x848]
push ecx
push 0x151c
mov edx, dword [ebp + 8]
push edx
call fcn.00426ee0
add esp, 0xc
lea eax, [ebp - 0x868]
push eax
push 0x151e
mov ecx, dword [ebp + 8]
push ecx
call fcn.00426f10
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041919a
mov esp, ebp
pop ebp
ret
Function at 0x416420
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax + 4]
test ecx, ecx
jne 0x4164f2
push 0x100
push 0
mov edx, dword [ebp - 0x1c]
add edx, 4
push edx
call fcn.00419120
add esp, 0xc
push 4
push 0
lea eax, [ebp - 4]
push eax
call fcn.00419120
add esp, 0xc
push 8
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00419120
add esp, 0xc
mov dword [ebp - 8], 1
jmp 0x41648a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x100
jae 0x4164e3
mov al, byte [ebp - 8]
mov byte [ebp - 4], al
push 0
push 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00428710
add esp, 0x10
movzx eax, word [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x100
jae 0x4164e1
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
movzx eax, byte [edx + 4]
test eax, eax
jne 0x4164e1
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov dl, byte [ebp - 4]
mov byte [ecx + 4], dl
jmp 0x416481
mov eax, dword [ebp - 0x1c]
mov cl, byte [eax + 4]
add cl, 1
mov edx, dword [ebp - 0x1c]
mov byte [edx + 4], cl
movzx eax, byte [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov al, byte [ecx + eax + 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041919a
mov esp, ebp
pop ebp
ret 4

Function at 0x41919a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444fe0]
jne 0x4191a4
repz ret
jmp fcn.0041c499
Function at 0x42477a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e460
and dword [ebp - 4], 0
cmp dword [0x4483f8], 0
mov ebx, eax
jne 0x42482b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4248dc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43f5dc
push edi
call esi
test eax, eax
je 0x4248dc
push eax
call fcn.0041e3ee
mov dword [esp], 0x43f5cc
push edi
mov dword [0x4483f8], eax
call esi
push eax
call fcn.0041e3ee
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4483fc], eax
call esi
push eax
call fcn.0041e3ee
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x448400], eax
call esi
push eax
call fcn.0041e3ee
pop ecx
mov dword [0x448408], eax
test eax, eax
je 0x42482b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e3ee
pop ecx
mov dword [0x448404], eax
mov eax, dword [0x448404]
cmp eax, ebx
je 0x424883
cmp dword [0x448408], ebx
je 0x424883
push eax
call fcn.0041e469
push dword [0x448408]
mov esi, eax
call fcn.0041e469
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424883
test edi, edi
je 0x424883
call esi
test eax, eax
je 0x42487a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42487a
test byte [ebp - 0xc], 1
jne 0x424883
or dword [ebp + 0x10], 0x200000
jmp 0x4248bc
mov eax, dword [0x4483fc]
cmp eax, ebx
je 0x4248bc
push eax
call fcn.0041e469
pop ecx
test eax, eax
je 0x4248bc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4248bc
mov eax, dword [0x448400]
cmp eax, ebx
je 0x4248bc
push eax
call fcn.0041e469
pop ecx
test eax, eax
je 0x4248bc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4483f8]
call fcn.0041e469
pop ecx
test eax, eax
je 0x4248dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4248de
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x426901
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x444fe0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4269d6
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4269c5
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x4269af
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x4269c5
push eax
push edi
push dword [ebp - 0x110]
call fcn.0042689e
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x4269d8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041919a
leave
ret 4

Function at 0x426f40
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x426f6b
movzx ecx, word [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x426f6b
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x426f78
xor edx, edx
mov word [eax], dx
xor eax, eax
ret

Function at 0x427830
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push 0x2b4
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret

Function at 0x427a20
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x444fe0]
xor eax, esp
mov dword [esp + 0x2b4], eax
push ebx
push esi
mov esi, dword [esp + 0x2c4]
push edi
push 0x2b4
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00419120
mov ebx, dword [esp + 0x2d8]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0xc
mov ecx, ebx
or ecx, 0x4000
push ecx
push 0x2b4
lea edx, [esp + 0x14]
push edx
push 0
push esi
call edi
test eax, eax
jne 0x427ab5
test bl, 0x10
je 0x427a9b
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.0041919a
add esp, 0x2b8
ret
or ebx, 0x4010
push ebx
push 0x2b4
lea eax, [esp + 0x14]
push eax
push 0
push esi
call edi
test eax, eax
je 0x427a80
mov ecx, dword [esp + 0x2c0]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041919a
add esp, 0x2b8
ret
Function at 0x42a0d0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x42a240
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a247
sub eax, edx
push ebp
mov ebp, eax
je 0x42a2c5
push ebx
push edi
lea edi, [ebp + 1]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x42a2c3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x42a294
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x42a290
push edi
push esi
push eax
mov byte [esi], 0
call fcn.00428890
add esp, 0xc
mov byte [esi + ebp], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
pop esi
test eax, eax
je 0x42a2c3
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
pop ebp
ret
Function at 0x42a410
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x444fe0]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x11c
lea eax, [esp + 8]
push 0
push eax
call fcn.00419120
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call esi
test eax, eax
jne 0x42a461
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call esi
mov eax, dword [esp + 0x14]
pop esi
cmp eax, 2
jne 0x42a686
mov ecx, dword [esp + 4]
lea eax, [ecx - 4]
cmp eax, 6
ja case.0x42a47f.7
jmp dword [eax*4 + 0x42a6fc]
mov eax, 6
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
mov eax, dword [esp + 8]
sub eax, 0
je 0x42a53e
sub eax, 2
je 0x42a4cc
mov eax, 8
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x42a4f2
mov eax, 0xc
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
test dword [esp + 0x118], 0x8000
je 0x42a519
mov eax, 0xb
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
xor eax, eax
cmp byte [esp + 0x11a], 1
sete al
add eax, 9
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
mov eax, 7
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
mov eax, dword [esp + 8]
cmp eax, 3
ja case.default.0x42a565
jmp dword [eax*4 + 0x42a718]
xor eax, eax
cmp byte [esp + 0x11a], 1
sete al
add eax, 0xd
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
xor eax, eax
cmp byte [esp + 0x11a], 1
sete al
add eax, 0xf
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
xor eax, eax
cmp byte [esp + 0x11a], 1
sete al
add eax, 0x11
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
xor eax, eax
cmp byte [esp + 0x11a], 1
setne al
add eax, 0x13
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
cmp dword [esp + 8], 0
jne case.default.0x42a565
cmp byte [esp + 0x11a], 1
jne 0x42a633
cmp dword [esp + 0xc], 0x4e20
sbb eax, eax
add eax, 0x17
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
mov eax, 0x15
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
cmp ecx, 4
jae case.default.0x42a565
mov eax, 5
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
mov eax, 0x18
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
test eax, eax
jne 0x42a6a4
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
cmp dword [esp + 4], 4
jne 0x42a6e2
mov eax, dword [esp + 8]
cmp eax, 0xa
jne 0x42a6d8
cmp dword [esp + 0xc], 0x7ce
jne 0x42a6e2
mov eax, 3
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
cmp eax, 0x5a
mov eax, 4
je 0x42a6e7
mov eax, 2
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0041919a
add esp, 0x120
ret
Function at 0x42a810
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xc
mov eax, dword [0x444fe0]
xor eax, esp
mov dword [esp + 8], eax
cmp dword [esp + 0x10], 0
je 0x42a82f
xor eax, eax
mov word [0x448654], ax
jmp 0x42a83a
mov ax, word [0x448654]
test ax, ax
jne 0x42a862
push 4
lea ecx, [esp + 4]
push ecx
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
mov ax, word [esp]
jne 0x42a85c
mov ax, word [0x446230]
mov word [0x448654], ax
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0041919a
add esp, 0xc
ret

Function at 0x42a880
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xc
mov eax, dword [0x444fe0]
xor eax, esp
mov dword [esp + 8], eax
cmp dword [esp + 0x10], 0
je 0x42a89f
xor eax, eax
mov word [0x448658], ax
jmp 0x42a8aa
mov ax, word [0x448658]
test ax, ax
jne 0x42a8d2
push 4
lea ecx, [esp + 4]
push ecx
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
mov ax, word [esp]
jne 0x42a8cc
mov ax, word [0x4461f8]
mov word [0x448658], ax
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0041919a
add esp, 0xc
ret

Function at 0x42ad20
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x42ad3d
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42ad3d
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x42ad40
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x42ad71
movzx ecx, word [esp + 8]
push esi
push ecx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x42ad70
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42ad70
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x42ad80
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x42add7
movzx eax, word [ebx]
test ax, ax
je 0x42add7
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
mov edi, dword [esp + 0x14]
mov edi, edi
movzx eax, ax
test edi, edi
je 0x42adc8
movzx eax, ax
push eax
push edi
call ebp
mov esi, eax
test esi, esi
je 0x42adc8
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42adc8
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x42ada0
pop edi
pop esi
pop ebp
pop ebx
ret