joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006a40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov word [ebp - 0x28], 0x100
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 1
lea eax, [ebp - 0x2c]
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x44], ebx
push eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10006b1a
mov eax, dword [ebp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x14], xmm0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esi
movdqu xmmword [ebp - 0x24], xmm0
push eax
push 1
mov dword [ebp - 0x24], 0x1f01ff
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0xc], 5
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x10006b1a
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10006b1a
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10006b1a
push edi
push dword [ebp - 0x34]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x10006b1a
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xc
push eax
push ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x10006b28
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x10006b38
push eax
call ebx
test esi, esi
je 0x10006b3f
push esi
call ebx
test edi, edi
jne 0x10006b5e
push edi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056351
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10056351
mov esp, ebp
pop ebp
ret

Function at 0x10006d70
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi + 4]
test esi, esi
je 0x10006da9
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10006da9
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x10006da9
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [0x1017b0fc], 1
pop esi
ret 0xc
Function at 0x10007580
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 0x10]
push 0
call esi
push 1
mov dword [ebp - 0x18], eax
call esi
mov esi, dword [ebp - 0x18]
sub eax, dword [ebp + 0xc]
sub esi, dword [ebp + 8]
push 0x100e3908
mov dword [edi], esi
push 0x100e3a68
mov dword [ebp - 0x18], eax
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x10007630
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
jge 0x100075fb
sub dword [ebx], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056351
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cmp eax, 0xc8
jge 0x1000761d
sub dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056351
mov esp, ebp
pop ebp
ret 0x10
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10056351
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10007b20
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], edi
call esi
push 1
mov dword [ebx], eax
call esi
push 0x100e3908
push 0x100e3a68
mov dword [edi], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x10007b86
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
jge 0x10007b7e
sub dword [edi], eax
jmp 0x10007b86
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
add dword [ebx], eax
cmp dword [ebx], 0
je 0x10007bed
cmp dword [edi], 0
je 0x10007bed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [ebx]
cdq
and edx, 3
lea ecx, [edx + eax]
xor edx, edx
sar ecx, 2
mov eax, edi
div ecx
mov eax, dword [ebp - 0x18]
mov esi, edx
mov eax, dword [eax]
cdq
and edx, 3
lea ecx, [edx + eax]
xor edx, edx
sar ecx, 2
mov eax, edi
div ecx
mov ecx, dword [ebx]
mov eax, ecx
sub eax, esi
cmp eax, 0x3c0
jle 0x10007be8
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
sub dword [eax], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056351
mov esp, ebp
pop ebp
ret 8
lea eax, [ecx - 0x11]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10056351
mov esp, ebp
pop ebp
ret 8
Function at 0x10007ca0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x415c
call fcn.100567b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x4158], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.ATL:
push 0x1017b150
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100577d1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
mov esi, 0xa
mov edi, 0xff
call fcn.100577b0
cdq
idiv edi
lea eax, [esp + 0x3110]
inc edx
push edx
push str._02X
push eax
call fcn.10006bc0
add esp, 0xc
lea eax, [esp + 0x3110]
push eax
push 0x1017b150
call ebx
dec esi
jne 0x10007cf7
push 0x1017b150
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0xc]
cmp eax, 0xb7
jne 0x10007d88
push esi
push 0x1017b150
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x10007d88
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4158]
xor ecx, esp
call fcn.10056351
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x10007d6f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007d91
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jb 0x10007d6f
lea ecx, [esp + 0x10]
call fcn.10006be0
push 0x1048
call fcn.10055db0
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
test esi, esi
je 0x10007de4
push 0x1048
push 0
push esi
call fcn.100567e0
add esp, 0xc
push edi
push 0x824
push esi
call fcn.10055fa4
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.1000a110
xor eax, eax
push 0x1046
push eax
mov word [esp + 0x3120], ax
lea eax, [esp + 0x3122]
push eax
call fcn.100567e0
add esp, 0xc
call fcn.10006750
mov esi, eax
cmp esi, 0xffffffff
jne 0x10007e22
xor esi, esi
jmp 0x10007e23
inc esi
push esi
push 1
lea eax, [esp + 0x2a]
push eax
lea eax, [esp + 0x3124]
push 0x824
push eax
call fcn.10057794
add esp, 0x14
push esi
call fcn.10006820
push dword [esp + 0x1c]
lea eax, [esp + 0x311c]
mov byte [0x1017b120], 1
push dword [esp + 0x1c]
push eax
call fcn.10007c00
lea eax, [esp + 0x1078]
push eax
push 0x824
push dword [0x1017b124]
call fcn.10055fa4
movsd xmm0, qword [esp + 0x107c]
add esp, 0xc
mulsd xmm0, qword [0x100e9130]
push 0
mulsd xmm0, qword [0x100e9128]
call fcn.100c4ae1
push eax
push 0x7ed
push dword [0x1017b118]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0xc]
mov esi, dword [0x1017b118]
test ecx, ecx
je 0x10007ec6
push ecx
call fcn.10055d78
add esp, 4
mov ecx, dword [esp + 0x4164]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056351
mov esp, ebp
pop ebp
ret 4
Function at 0x10008ea0
Capabilities:
Check mutex on windows
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.ATL:
push 0x1017b360
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100577d1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
mov esi, 0xa
mov edi, 0xff
lea ecx, [ecx]
call fcn.100577b0
cdq
idiv edi
lea eax, [esp + 0x14]
inc edx
push edx
push str._02X
push eax
call fcn.10006bc0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x1017b360
call ebx
dec esi
jne 0x10008ef0
push 0x1017b360
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x10]
cmp eax, 0xb7
jne 0x10008f67
push esi
push 0x1017b360
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x10008f67
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x10009054
test edi, edi
je 0x10009054
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008f74
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jb 0x10009054
sub esp, 0xc
call fcn.10008bc0
test al, al
je 0x1000904a
push 0x1017b358
push 0xffffffffffffffeb
push dword [0x1017b358]
call dword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.10008d00
test al, al
je 0x10009054
push str.hwnd_ms
push dword [0x1017b358]
call fcn.10080400
mov esi, eax
push esi
call fcn.10081a50
test eax, eax
je 0x10009054
push dword [0x1017b35c]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x198]
push 0
push edi
push dword [0x1017b35c]
call fcn.10002680
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0xc
push 5
push dword [0x1017b35c]
call esi
push 5
push dword [0x1017b358]
call esi
push dword [0x1017b358]
push 0
push 0x10008dc0
call fcn.100578d3
mov eax, dword [0x1017b358]
add esp, 0xc
mov dword [0x1017b0f8], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10056351
mov esp, ebp
pop ebp
ret 4
mov dword [0x1017b0f8], 1
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056351
mov esp, ebp
pop ebp
ret 4

Function at 0x100091d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi + 4]
test esi, esi
je 0x10009209
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10009209
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x10009209
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [0x1017b100], 1
pop esi
ret 0xc
Function at 0x10009ca0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1078
call fcn.100567b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1074], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1017b598
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10009d21
push 0
push 0x1017b598
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x10009d21
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1074]
xor ecx, esp
call fcn.10056351
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x10009d09
mov ecx, edi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009d30
sub ecx, edx
sar ecx, 1
cmp ecx, 7
jb 0x10009d09
push 0x1048
mov byte [esp + 0x24], al
xorps xmm0, xmm0
lea eax, [esp + 0x34]
movsd qword [esp + 0x2c], xmm0
push 0
push eax
movdqu xmmword [esp + 0x1c], xmm0
call fcn.100567e0
add esp, 0xc
push 0x1048
call fcn.10055db0
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
test esi, esi
je 0x10009da1
push 0x1048
push 0
push esi
call fcn.100567e0
add esp, 0xc
push edi
push 0x824
push esi
call fcn.10055fa4
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.1000a2f0
push dword [esp + 0x1c]
lea eax, [esp + 0x34]
mov byte [0x1017b570], 1
push dword [esp + 0x1c]
push eax
call fcn.10009be0
movsd xmm0, qword [esp + 0x28]
mulsd xmm0, qword [0x100e9130]
push 0
mulsd xmm0, qword [0x100e9128]
call fcn.100c4ae1
push eax
push 0x7ed
push dword [0x1017b568]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0xc]
mov esi, dword [0x1017b568]
test ecx, ecx
je 0x10009e0e
push ecx
call fcn.10055d78
add esp, 4
mov ecx, dword [esp + 0x107c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.10056351
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c9f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100c5000
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
push 0x24
push str.AlgorithmParametersBase:_parameter__
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.10006290
push dword [ebp + 8]
lea edx, [esp + 0x18]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x48]
call fcn.10014960
push str.__not_used
mov edx, eax
mov byte [esp + 0x70], 1
lea ecx, [esp + 0x34]
call fcn.10014960
add esp, 8
mov esi, eax
mov ecx, edi
mov byte [esp + 0x68], 2
call fcn.10057d1f
mov byte [esp + 0x68], 3
lea ecx, [edi + 0x10]
push 0xffffffffffffffff
mov dword [edi], vtable.CryptoPP::Exception.0
mov dword [edi + 0xc], 6
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.10006160
cmp dword [esp + 0x40], 0x10
jb 0x1000cac7
push dword [esp + 0x2c]
call fcn.100559ce
add esp, 4
cmp dword [esp + 0x58], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x1000caef
push dword [esp + 0x44]
call fcn.100559ce
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x1000cb17
push dword [esp + 0x14]
call fcn.100559ce
add esp, 4
mov eax, edi
mov dword [edi], vtable.CryptoPP::AlgorithmParametersBase::ParameterNotUsed.0
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000d3c0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], edi
call esi
push 1
mov dword [ebx], eax
call esi
push 0x100e3908
push 0x100e3a68
mov dword [edi], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x1000d426
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
jge 0x1000d41e
sub dword [edi], eax
jmp 0x1000d426
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
add dword [ebx], eax
push 0
call fcn.10058541
push eax
call fcn.100577d1
add esp, 8
call fcn.100577b0
mov ecx, dword [ebx]
mov edi, eax
shr ecx, 2
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x18]
mov eax, edi
mov esi, edx
xor edx, edx
mov ecx, dword [ecx]
shr ecx, 2
div ecx
mov ecx, dword [ebx]
mov eax, ecx
sub eax, esi
cmp eax, 0x3c0
jbe 0x1000d47d
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
sub dword [eax], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056351
mov esp, ebp
pop ebp
ret 8
lea eax, [ecx - 0x11]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [ebx], eax
xor ecx, ebp
pop ebx
call fcn.10056351
mov esp, ebp
pop ebp
ret 8
Function at 0x1000e790
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0xd
xor edi, edi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x1000e7f3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x1000e7eb
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
inc eax
xor ecx, ecx
mov dword [ebp - 4], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10055db0
mov edi, eax
add esp, 4
test edi, edi
je 0x1000e7eb
push ebx
push dword [ebp - 4]
push edi
call fcn.10055fa4
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000e810
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1000e8d9
mov edx, esi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1000e830
sub edx, ecx
sar edx, 1
push edi
lea eax, [edx*2 + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x1000e8d8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, esi
mov edx, eax
mov dword [ebp - 8], edx
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e870
sub ecx, dword [ebp - 4]
sar ecx, 1
push esi
lea eax, [ecx + 1]
push eax
push edx
call fcn.10055fa4
add esp, 0xc
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1000e891
mov eax, dword [ebp - 8]
sub esi, ecx
sar esi, 1
xor ecx, ecx
push edi
mov word [eax + esi*2], cx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x1000e8d1
pop edi
mov ebx, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e8f0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
mov dword [ebp - 8], ecx
call fcn.10002d20
mov ecx, dword [esi]
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], 0x100e3908
mov eax, 8
mov word [ebp - 0x18], ax
movdqu xmm0, xmmword [ebp - 0x18]
push 0
sub esp, 0x10
mov eax, esp
push str.value
push esi
movdqu xmmword [eax], xmm0
call dword [ecx + 0x1c]
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000e959
call fcn.1000e790
mov ebx, eax
jmp 0x1000e95b
xor ebx, ebx
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000ea4b
mov ecx, dword [ebp - 8]
call fcn.1000e810
test eax, eax
je 0x1000ea4b
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push 0x100d3ba4
push esi
call dword [eax]
test eax, eax
js 0x1000e9a5
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1000e9a5
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc8]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x1d0001
push 0x11
push 0x100
push edi
call esi
push 0x2f0001
push 0x56
push 0x100
push edi
call esi
push 0
push 0x1001a
push 0x111
push edi
call esi
push 0xc02f0001
push 0x56
push 0x101
push edi
call esi
push 0xc01d0001
push 0x11
push 0x101
push edi
call esi
test ebx, ebx
je 0x1000ea2d
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000ea0c
mov ecx, ebx
call fcn.1000e810
push ebx
call fcn.10055d78
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056351
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056351
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10056351
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ebe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.100567e0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000ec3c
cmp dword [ebp - 0x11c], 6
jb 0x1000ec3c
push 0
push 0
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
call fcn.1000eb10
cmp dword [0x1017a228], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jne 0x1000ec88
push str.Winmm.dll
call edi
test eax, eax
jne 0x1000ec77
push str.Winmm.dll
call esi
test eax, eax
jne 0x1000ec77
mov eax, dword [0x1017a228]
jmp 0x1000ec84
push str.waveOutWrite
push eax
call ebx
mov dword [0x1017a228], eax
test eax, eax
je 0x1000ec97
mov edx, method.duScrollView.virtual_456
mov ecx, 0x1017a228
call fcn.100186b0
cmp dword [0x1017b7e4], 0
jne 0x1000ecce
push str.Winmm.dll
call edi
test eax, eax
jne 0x1000ecbd
push str.Winmm.dll
call esi
test eax, eax
jne 0x1000ecbd
mov eax, dword [0x1017b7e4]
jmp 0x1000ecca
push str.midiStreamOut
push eax
call ebx
mov dword [0x1017b7e4], eax
test eax, eax
je 0x1000ecdd
mov edx, method.duScrollView.virtual_456
mov ecx, 0x1017b7e4
call fcn.100186b0
cmp dword [0x1017b7e8], 0
jne 0x1000ed14
push str.DSound.dll
call edi
test eax, eax
jne 0x1000ed03
push str.DSound.dll
call esi
test eax, eax
jne 0x1000ed03
mov eax, dword [0x1017b7e8]
jmp 0x1000ed10
push str.DirectSoundCreate
push eax
call ebx
mov dword [0x1017b7e8], eax
test eax, eax
je 0x1000ed23
mov edx, method.duScrollView.virtual_456
mov ecx, 0x1017b7e8
call fcn.100186b0
cmp dword [0x1017b7f8], 0
jne 0x1000ed5a
push str.DSound.dll
call edi
test eax, eax
jne 0x1000ed49
push str.DSound.dll
call esi
test eax, eax
jne 0x1000ed49
mov eax, dword [0x1017b7f8]
jmp 0x1000ed56
push str.DirectSoundCreate8
push eax
call ebx
mov dword [0x1017b7f8], eax
test eax, eax
je 0x1000ed69
mov edx, method.duScrollView.virtual_456
mov ecx, 0x1017b7f8
call fcn.100186b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10056351
mov esp, ebp
pop ebp
ret