joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462c50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
mov eax, dword [0x4dd070]
xor eax, esp
mov dword [esp + 0x838], eax
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x462d2f
push 0x2c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0047e9a0
push 0x800
lea eax, [esp + 0x48]
mov dword [esp + 0x18], 0x30
push 0
push eax
mov dword [esp + 0x34], 0x400000
call fcn.0047e9a0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.Q360SoftMgrMsgDelegateWnd_d
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.0045e7a0
add esp, 0x10
mov dword [esp + 0x10], 0x462df0
lea eax, [esp + 0x38]
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x462d47
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.00465daf
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x83c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00465daf
mov esp, ebp
pop ebp
ret

Function at 0x4635c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x4635f0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00465daf
mov esp, ebp
pop ebp
ret 0x14
push 0x800
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.0047e9a0
push str._ElevPri
push esi
lea eax, [ebp - 0x80c]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x40
lea eax, [ebp - 0x860]
push 0
push eax
call fcn.0047e9a0
add esp, 0x28
mov dword [ebp - 0x864], 0x44
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x838], 1
xorps xmm0, xmm0
mov edi, 1
movups xmmword [ebp - 0x81c], xmm0
push eax
lea eax, [ebp - 0x864]
mov word [ebp - 0x834], di
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x80c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4635dc
push dword [ebp - 0x81c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x818]
call esi
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00465daf
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4636c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4dd070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46376c
mov eax, dword [0x4c9f18]
xorps xmm0, xmm0
movups xmmword [ebp - 0x22], xmm0
push 0x38
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
movq qword [ebp - 0x12], xmm0
movq xmm0, qword [str.runas]
push 0
push eax
mov dword [ebp - 0xa], 0
mov word [ebp - 6], 0
movq qword [ebp - 0x24], xmm0
call fcn.0047e9a0
add esp, 0xc
mov dword [ebp - 0x60], 0x3c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], str._ElevPri
push eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x46376c
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00465daf
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00465daf
mov esp, ebp
pop ebp
ret 0x10

Function at 0x463780
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4d7d10
push 0x481040
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4dd070]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x4637ee
push 1
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x4637e9
mov ebx, 1
push eax
call edi
push esi
call edi
jmp 0x4637f4
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x4637fd
lea eax, [ebx + 1]
jmp 0x463860
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
xor esi, esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 4], ebx
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x463852
push 0x10020
push dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x463852
lea eax, [ebp - 0x38]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00463888
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00465daf
mov esp, ebp
pop ebp
ret

Function at 0x468d8b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x49ad32
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049abb1

Function at 0x4a1354
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a1014
Function at 0x10001e80
Capabilities:
Check for time delay via queryperformancecounter
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [esi + 0x2f0]
push ecx
call edi
lea eax, [esi + 0xcc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ebx, [esi + 0xb8]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp + 0x10]
push edx
lea edi, [esi + 0xd4]
push 0xff
push edi
call fcn.1000ce1c
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push edi
mov dword [esi + 0x2d4], eax
call fcn.1000dca0
mov eax, dword [esi + 0x2d4]
lea ecx, [eax + 4]
push eax
mov dword [esi + 0x2d8], ecx
call fcn.1000cc37
add esp, 0x10
mov dword [esi + 0x2ec], eax
test eax, eax
je 0x10001f77
mov ecx, dword [esi + 0x2e8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov edx, dword [edx]
push 0
push 0
push 1
add ecx, 4
push eax
mov eax, dword [ebp + 8]
push eax
call edx
mov eax, dword [esi + 0x2f0]
push 0x1770
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001f82
cmp eax, 0x102
je 0x10001f6a
cmp eax, 0xffffffff
jne 0x10001f77
mov ecx, dword [esi + 0x2f0]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi + 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edi, [esi + 0xc0]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
sub eax, dword [ebx]
mov ecx, dword [edi + 4]
sbb ecx, dword [ebx + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
fild qword [ebp - 8]
push 1
fild qword [esi + 0xb0]
lea eax, [esi + 0xcc]
push eax
fdiv qword [0x10063c20]
fdivp st(1)
fstp qword [esi + 0xa8]
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [esi + 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push 0x10002000
push 0
push 0
call fcn.1000cd7c
add esp, 0x18
pop edi
mov dword [esi + 0x2f4], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100027f0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10067168]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x208
lea ecx, [ebp - 0x220]
push ecx
mov word [ebp - 0x14], ax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov dword [ebp - 0x234], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1000283e
mov edx, 0x43
mov word [ebp - 0x220], dx
mov ax, word [ebp - 0x220]
mov word [ebp - 0x14], ax
xor eax, eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x234]
push ecx
push eax
push eax
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x12], 0x5c003a
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 0x234]
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov ecx, eax
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov dx, ax
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [ebp - 0x226], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [ebp - 0x225], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [ebp - 0x224], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [ebp - 0x223], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x226]
push eax
movzx edx, dx
push edx
push ecx
push str._08lX_04lX_lu
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x14
call fcn.1000c6af
mov esp, ebp
pop ebp
ret
Function at 0x10002940
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x10067168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61e]
push edx
mov dword [ebp - 0x874], eax
mov word [ebp - 0x620], cx
call fcn.100027b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
push ebx
lea eax, [ebp - 0x620]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100633bc
lea ecx, [ebp - 0x620]
push ecx
call esi
mov edx, dword [ebp - 0x874]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100029c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10002b79
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x620]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x878], eax
cmp eax, 0xffffffff
je 0x10002b79
jmp 0x100029f0
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.100027b0
add esp, 0xc
push ebx
lea ecx, [ebp - 0x418]
push ecx
call edi
push 0x100633c4
lea edx, [ebp - 0x418]
push edx
call esi
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x418]
push ecx
call esi
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.100027b0
mov ecx, dword [ebp - 0x874]
add esp, 0xc
push ecx
lea edx, [ebp - 0x210]
push edx
call edi
push 0x100633c4
lea eax, [ebp - 0x210]
push eax
call esi
lea ecx, [ebp - 0x844]
push ecx
lea edx, [ebp - 0x210]
push edx
call esi
test byte [ebp - 0x870], 0x10
je 0x10002b47
mov ecx, 0x100633c8
lea eax, [ebp - 0x844]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10002ac6
test dx, dx
je 0x10002ac2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10002ac6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10002aa0
xor eax, eax
jmp 0x10002acb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002b47
mov ecx, 0x100633cc
lea eax, [ebp - 0x844]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10002b06
test dx, dx
je 0x10002b02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10002b06
add eax, 4
add ecx, 4
test dx, dx
jne 0x10002ae0
xor eax, eax
jmp 0x10002b0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002b47
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10002b2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10002b5d
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.10002940
add esp, 8
jmp 0x10002b5d
push 0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [ebp - 0x878]
lea edx, [ebp - 0x870]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100029f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c6af
mov esp, ebp
pop ebp
ret
Function at 0x10002b90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10067168]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10002c67
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x10002bf0
mov ecx, str.brave.exe
lea eax, [ebp - 0x20c]
jmp 0x10002c00
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10002c26
test dx, dx
je 0x10002c22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10002c26
add eax, 4
add ecx, 4
test dx, dx
jne 0x10002c00
xor eax, eax
jmp 0x10002c2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10002c4d
mov ecx, dword [ebp - 0x228]
push ecx
push eax
push 1
call edi
mov esi, eax
test esi, esi
je 0x10002c4d
push 9
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10002bf0
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000c6af
mov esp, ebp
pop ebp
ret

Function at 0x10002c80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038cc6
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10067168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CManager.0
mov dword [esi + 4], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push esi
call edx
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
lea eax, [esi + 0x130]
mov dword [ebp - 4], ebx
push eax
mov dword [esi], vtable.CScreenHideManager.0
call fcn.10002660
mov byte [ebp - 4], 1
mov dword [esi + 0x124], 0x20
mov byte [esi + 0x114], 1
mov word [esi + 0x115], bx
mov byte [esi + 0x121], bl
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4e
mov dword [esi + 0x1b8], eax
call edi
push 0x4f
mov dword [esi + 0x118], eax
call edi
push 0x18
mov dword [esi + 0x11c], eax
call fcn.1000cc37
push ebx
push ebx
push esi
push 0x10004630
push ebx
push ebx
mov dword [esi + 0x1dc], eax
mov dword [esi + 0x1e0], 0x18
mov byte [esi + 0x1e8], bl
mov dword [esi + 0x1e4], 0x3e8
mov dword [esi + 0x1d8], ebx
call fcn.1000cd7c
push ebx
push ebx
push esi
push 0x10004880
push ebx
push ebx
mov dword [esi + 0x128], eax
call fcn.1000cd7c
mov dword [esi + 0x12c], eax
add esp, 0x34
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002ee0
Capabilities:
Create thread

Disassembly:
push 0
lea eax, [esi + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esi + 0x128]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x1b4]
test ecx, ecx
je 0x10002f27
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x1b4], 0
push 0
push 0
push esi
push 0x10004630
push 0
push 0
mov dword [esi + 0x124], 0x20
call fcn.1000cd7c
add esp, 0x18
mov dword [esi + 0x128], eax
ret
Function at 0x10005000
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10005045
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
push edi
push ecx
push eax
call fcn.1000dca0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 4

Function at 0x10005050
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100050d9
push ebx
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x1000507c
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ebx
lea esi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [ebp - 4], eax
call fcn.1000ceb4
mov ecx, dword [ebp - 4]
mov edi, eax
lea eax, [esi - 1]
push eax
push ecx
lea edx, [edi + 1]
push edx
mov byte [edi], 2
call fcn.1000dca0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push esi
push edi
call eax
push edi
call fcn.1000cea9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10005180
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038b60
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x10067168]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov esi, ecx
mov byte [ebp - 0x425], bl
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10005350
mov eax, esi
lea edx, [eax + 2]
jmp 0x100051d0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100051d0
sub eax, edx
sar eax, 1
je 0x10005350
mov eax, 0x100698b8
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100051f0
sub eax, edx
sar eax, 1
cmp eax, ebx
je 0x10005350
push 0x40e
lea ecx, [ebp - 0x422]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x424], ax
call fcn.100027b0
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10005230
sub eax, edx
sar eax, 1
push esi
inc eax
push eax
lea edx, [ebp - 0x424]
push edx
call fcn.1000ce1c
add esp, 0xc
push esi
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
jne 0x10005277
push 0x10064ea8
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 0x434], str.Invalid_File_Extension
call fcn.1000d27f
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x40
lea edx, [ebp - 0x484]
push ebx
push edx
call fcn.100027b0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x488]
push ecx
lea edx, [ebp - 0x424]
push edx
push ebx
push 0x20
push 1
push ebx
push ebx
push ebx
push esi
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x488], 0x44
mov dword [ebp - 0x480], 0x100698b8
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push ebx
mov esi, eax
push ebx
lea eax, [ebp - 0x42c]
push eax
push ebx
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10063b1c
call edi
mov ecx, dword [ebp - 0x42c]
push ecx
call edi
cmp esi, ebx
je 0x1000532e
mov byte [ebp - 0x425], 1
mov al, byte [ebp - 0x425]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000c6af
mov esp, ebp
pop ebp
ret
push 0x10064ea8
lea edx, [ebp - 0x430]
push edx
mov dword [ebp - 0x430], str.Invalid_Argument.
call fcn.1000d27f
push str._nCDesktopManager::LaunchApplication_tCustom_Exception_caught_in_CDesktopManager::IsCurrentDesktop.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 0x425], 0
mov eax, 0x10005383
ret

Function at 0x100054b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100053b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
ret
Function at 0x100054e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0xff
push 0x100686b0
call fcn.1000ce1c
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
push edx
push 0xff
push str.123456
mov dword [0x100688b0], ecx
call fcn.1000ce1c
mov eax, dword [ebp + 0x10]
add esp, 0x18
push 0
push 0
push 0
push 0x100053b0
push 0
push 0
mov dword [0x10068b18], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
pop ebp
ret

Function at 0x10005670
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x10067168]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100056e6
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
push eax
mov ecx, esi
call fcn.10005560
add esp, 4
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x2000000
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 6
jae 0x100056e6
mov eax, esi
call fcn.10005630
mov ecx, dword [esp + 0xa4]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1000c6af
mov esp, ebp
pop ebp
ret 8