joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4716c0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x598b04]
test eax, eax
je 0x4717bf
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4716f1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4717ba
mov eax, dword [0x598b04]
test eax, eax
je 0x4717e1
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4717fe
mov esi, eax
test eax, eax
jne 0x47175c
movzx eax, byte [0x599449]
push 8
push 0x20
call fcn.00421c10
add esp, 8
test eax, eax
je 0x47181a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x598b04
mov esi, eax
mov eax, dword [0x598b04]
test eax, eax
je 0x471808
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x47177b
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x4717a9
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x47179b
movaps xmm0, xmmword [esp]
jmp 0x4717a9
lea ecx, [esp + 0x10]
call fcn.0046e160
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x471800
push 0x598b04
call fcn.0051e5f0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x4716e4
jmp 0x4716f1
push 0x598b04
call fcn.0051e5f0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x47170f
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x598b04
call fcn.0051e5f0
add esp, 4
jmp 0x471754
push 0x20
push 8
call fcn.0051ec40
add esp, 8
ud2
Function at 0x481ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x481f28
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x481f20
cmp ebx, ebp
ja 0x481fa2
cmp ebp, dword [esp + 0x1c]
ja 0x481fb3
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x481f22
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x481f10
jmp 0x481f7f
ja 0x481f28
cmp edx, edi
mov ebx, ebp
jne 0x481ee5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x481f83
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x481f60
mov esi, edi
sub ecx, ebx
jns 0x481f77
jmp 0x481f85
cmp edi, edx
je 0x481f8c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x481f85
xor al, 1
cmp esi, edx
jne 0x481f40
jmp 0x481f85
xor eax, eax
jmp 0x481f85
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x580910
push 0x2b
push 0x57fced
call fcn.0051ee20
add esp, 0xc
ud2
push 0x580920
push ebp
push ebx
call fcn.0051f2a0
add esp, 0xc
ud2
push 0x580920
push dword [esp + 0x20]
push ebp
call fcn.0051f230
add esp, 0xc
ud2
Function at 0x488270
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x18]
push dword [edi + 0xb8]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x488292
mov eax, 0xfffffffa
pop edi
add esp, 0x10
ret
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_EnterCriticalSection]
push esi
lea esi, [edi + 0xd8]
push esi
call ebp
test byte [edi + 0xf0], 1
je 0x4882fa
push str.event_sources_modified__reallocating_event_data
push str.handle_events
push 4
push edi
call fcn.00486eb0
push edi
call fcn.00487ec0
push edi
call fcn.0048b180
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4882e5
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
add esp, 0x10
ret
and dword [edi + 0xf0], 0xfffffffe
jne 0x4882fa
lea eax, [edi + 0xc]
push eax
call fcn.0048b370
add esp, 4
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x28]
mov esi, 0x3e8
push edi
push dword [edi + 0xb8]
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 4]
cdq
idiv esi
imul ecx, dword [ecx], 0x3e8
add eax, ecx
test edx, edx
lea esi, [eax + 1]
cmove esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
jne 0x48834e
push 0x65
push str.C:Usersxsonic.cargo_registry_src_rsproxy.cn_0dccff568467c15blibusb1_sys_0.6.4libusblibusbos_threads_windows.h
push str.TlsSetValue_key__ptr____0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
push esi
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0048b520
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x48838a
cmp ebx, 0xfffffff9
jne 0x488406
lea esi, [edi + 0x84]
push esi
call ebp
push edi
call fcn.00488440
mov eax, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
add esp, 4
push esi
call eax
xor ebx, ebx
jmp 0x488406
mov eax, dword [esp + 0x10]
test al, 1
je 0x4883a5
push edi
call fcn.00487fa0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x488406
mov eax, dword [esp + 0x10]
test al, 2
je 0x4883cf
lea esi, [edi + 0x84]
push esi
call ebp
push edi
call fcn.00488440
push edi
call fcn.00487e30
add esp, 8
mov ebx, eax
mov eax, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push esi
call eax
test ebx, ebx
jne 0x488406
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x488406
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
call dword [0x55f604]
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x488406
push ebx
push str.backend_handle_events_failed_with_error__d
push str.handle_events
push 1
push edi
call fcn.00486eb0
add esp, 0x14
push 0
push dword [edi + 0xb8]
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
jne 0x48842d
push 0x65
push str.C:Usersxsonic.cargo_registry_src_rsproxy.cn_0dccff568467c15blibusb1_sys_0.6.4libusblibusbos_threads_windows.h
push str.TlsSetValue_key__ptr____0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x489480
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.kernel32.dll_InitializeCriticalSection]
push edi
mov edi, dword [esp + 0x14]
lea eax, [edi + 0x84]
push eax
call esi
lea eax, [edi + 0x9c]
push eax
call esi
lea eax, [edi + 0xbc]
push eax
call esi
lea eax, [edi + 0xd4]
push eax
call dword [sym.imp.kernel32.dll_InitializeConditionVariable]
lea eax, [edi + 0xd8]
push eax
call esi
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [edi + 0xb8], eax
cmp eax, 0xffffffff
jne 0x4894e5
push 0x5d
push str.C:Usersxsonic.cargo_registry_src_rsproxy.cn_0dccff568467c15blibusb1_sys_0.6.4libusblibusbos_threads_windows.h
push str.key___TLS_OUT_OF_INDEXES
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
lea eax, [edi + 0x7c]
mov dword [eax + 4], eax
lea ebp, [edi + 0xc]
mov dword [eax], eax
lea eax, [edi + 0xf8]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x100]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x110]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x118]
push ebp
mov dword [eax + 4], eax
mov dword [eax], eax
call fcn.0048b3a0
mov ebx, eax
add esp, 4
test ebx, ebx
js 0x489597
push 0
push dword [ebp]
push edi
call fcn.00489170
mov ebx, eax
add esp, 0xc
test ebx, ebx
js 0x48958e
lea esi, [edi + 0x10]
push esi
call fcn.0048b3e0
add esp, 4
test eax, eax
jne 0x4895ed
push str.using_timer_for_timeouts
push str.usbi_io_init
push 4
push edi
call fcn.00486eb0
push 0
push dword [esi]
push edi
call fcn.00489170
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jns 0x489602
push esi
call fcn.0048b450
push dword [ebp]
push edi
call fcn.00489610
add esp, 0xc
push ebp
call fcn.0048b420
add esp, 4
mov esi, dword [sym.imp.kernel32.dll_DeleteCriticalSection]
lea eax, [edi + 0x84]
push eax
call esi
lea eax, [edi + 0x9c]
push eax
call esi
lea eax, [edi + 0xbc]
push eax
call esi
lea eax, [edi + 0xd8]
push eax
call esi
push dword [edi + 0xb8]
call dword [sym.imp.kernel32.dll_TlsFree]
test eax, eax
jne 0x4895e6
push 0x69
push str.C:Usersxsonic.cargo_registry_src_rsproxy.cn_0dccff568467c15blibusb1_sys_0.6.4libusblibusbos_threads_windows.h
push str.TlsFree_key____0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
push str.timer_not_available_for_timeouts
push str.usbi_io_init
push 4
push edi
call fcn.00486eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x48a540
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov edx, 0x1505
push esi
mov esi, ebp
test ebp, ebp
jne 0x48a556
pop esi
xor eax, eax
pop ebp
ret
movsx ecx, byte [ebp]
test ecx, ecx
je 0x48a573
nop
mov eax, edx
lea esi, [esi + 1]
shl edx, 5
add edx, ecx
movsx ecx, byte [esi]
add edx, eax
test ecx, ecx
jne 0x48a560
push ebx
test edx, edx
mov ebx, 1
mov ecx, ebx
mov eax, 0xc0906d
cmovne ecx, edx
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fd
push edi
push 0x5995b4
sub ecx, eax
cmovne ebx, ecx
mov esi, ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x5995b0]
mov ecx, dword [eax + esi*8]
test ecx, ecx
je 0x48a68c
lea edi, [eax + esi*8]
cmp ecx, ebx
jne 0x48a5f4
mov ecx, dword [edi + 4]
mov eax, ebp
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x48a5e7
test dl, dl
je 0x48a5e3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x48a5e7
add eax, 2
add ecx, 2
test dl, dl
jne 0x48a5c7
xor eax, eax
jmp 0x48a5ec
sbb eax, eax
or eax, 1
test eax, eax
je 0x48a714
push dword [edi + 4]
push ebp
push str.hash_collision___s_vs__s_
push str.htab_hash
push 4
push 0
call fcn.00486eb0
mov eax, 0x14191f7
add esp, 0x18
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebx
shr eax, 9
imul eax, eax, 0x3fb
sub edx, eax
inc edx
mov dword [esp + 0x14], edx
nop
mov ecx, esi
sub ecx, edx
cmp esi, edx
lea eax, [ecx + 0x3fd]
cmova eax, ecx
mov esi, eax
cmp esi, ebx
je 0x48a68c
mov eax, dword [0x5995b0]
mov edi, dword [eax + esi*8]
cmp edi, ebx
jne 0x48a688
mov eax, dword [eax + esi*8 + 4]
mov ecx, ebp
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x48a677
test dl, dl
je 0x48a673
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x48a677
add ecx, 2
add eax, 2
test dl, dl
jne 0x48a657
xor eax, eax
jmp 0x48a67c
sbb eax, eax
or eax, 1
test eax, eax
je 0x48a714
mov edx, dword [esp + 0x14]
test edi, edi
jne 0x48a630
cmp dword [0x5995cc], 0x3fd
jb 0x48a6c7
push 0x3fd
push str.hash_table_is_full___lu_entries_
push str.htab_hash
push 1
push 0
call fcn.00486eb0
add esp, 0x14
xor esi, esi
push 0x5995b4
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov ecx, eax
add esp, 4
mov eax, dword [0x5995b0]
mov dword [eax + esi*8 + 4], ecx
lea eax, [eax + esi*8]
test ecx, ecx
jne 0x48a70c
push str.could_not_duplicate_string_for_hash_table
push str.htab_hash
push 1
push ecx
call fcn.00486eb0
add esp, 0x10
xor esi, esi
push 0x5995b4
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret
inc dword [0x5995cc]
mov dword [eax], ebx
push 0x5995b4
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret
Function at 0x48a730
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x598b80]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x118]
push 0x104
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov edx, eax
test edx, edx
je 0x48a7cc
cmp edx, 0x104
jae 0x48a7cc
mov ecx, edi
push ebx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48a778
sub ecx, ebx
lea eax, [edx + 6]
add eax, ecx
pop ebx
cmp eax, 0x104
jb 0x48a795
push str.program_assertion_failed___library_path_buffer_overflow
jmp 0x48a7d1
push edi
lea eax, [esp + 0xc]
add eax, edx
push str._s.dll
push eax
call fcn.0048a800
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00515f8b
add esp, 0x108
ret
push str.program_assertion_failed___could_not_get_system_directory
push str.load_system_library
push 1
push esi
call fcn.00486eb0
mov ecx, dword [esp + 0x11c]
add esp, 0x10
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00515f8b
add esp, 0x108
ret
Function at 0x4a1420
Capabilities:
Open clipboard

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4a1432
pop esi
ret 4
mov eax, dword [esp + 8]
mov ecx, eax
mov edx, dword [str.text_plain]
push ebx
nop
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x4a1460
test bl, bl
je 0x4a145c
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x4a1460
add ecx, 2
add edx, 2
test bl, bl
jne 0x4a1440
xor ecx, ecx
jmp 0x4a1465
sbb ecx, ecx
or ecx, 1
pop ebx
test ecx, ecx
je 0x4a14d3
cmp byte [eax], 0
je 0x4a14d3
mov ecx, dword [str.image]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a1495
test dl, dl
je 0x4a1491
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a1495
add eax, 2
add ecx, 2
test dl, dl
jne 0x4a1475
xor eax, eax
jmp 0x4a149a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4a14dd
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 8
call esi
test eax, eax
jne 0x4a14c2
push 0xe
call esi
test eax, eax
jne 0x4a14c2
xor esi, esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
ret 4
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
ret 4
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
ret 4
Function at 0x4a1560
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4a173a
test ebx, ebx
js 0x4a173a
cmp eax, 2
mov ecx, 1
push ebp
cmovl ecx, eax
mov eax, esi
push edi
xor edi, edi
mov dword [esp + 0x18], ecx
mov ecx, ebx
test ebx, ebx
jle 0x4a161b
nop dword [eax]
mov dl, byte [eax]
cmp dl, 0xd
jne 0x4a15bb
cmp byte [eax + 1], 0xa
jne 0x4a15bb
cmp ecx, 2
jb 0x4a15bb
add eax, 2
add edi, 2
dec ecx
jmp 0x4a15c7
inc eax
cmp dl, 0xa
jne 0x4a15c6
add edi, 2
jmp 0x4a15c7
inc edi
dec ecx
test ecx, ecx
jg 0x4a15a0
lea eax, [edi + 1]
push eax
mov dword [esp + 0x18], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebp, eax
add esp, 4
mov ecx, ebp
mov al, byte [esi]
cmp al, 0xd
jne 0x4a15ff
cmp byte [esi + 1], 0xa
jne 0x4a15ff
cmp ebx, 2
jb 0x4a15ff
inc esi
mov byte [ecx], al
mov al, byte [esi]
mov byte [ecx + 1], al
add ecx, 2
dec ebx
jmp 0x4a1613
cmp al, 0xa
jne 0x4a1610
mov byte [ecx], 0xd
mov al, byte [esi]
mov byte [ecx + 1], al
add ecx, 2
jmp 0x4a1613
mov byte [ecx], al
inc ecx
dec ebx
inc esi
test ebx, ebx
jg 0x4a15e0
jmp 0x4a1633
push 1
mov dword [esp + 0x18], 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebp, eax
add esp, 4
mov ecx, ebp
xor edi, edi
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov byte [ecx], 0
lea ebx, [esi*4 + 0x599968]
cmp eax, dword [esi*4 + 0x599978]
jle 0x4a1670
push dword [ebx]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea esi, [edi + 0x64]
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [ebx], eax
add esp, 8
mov eax, dword [esp + 0x18]
mov dword [eax*4 + 0x599978], esi
mov esi, eax
push edi
push ebp
push dword [ebx]
call fcn.00517140
mov eax, dword [ebx]
add esp, 0xc
mov byte [edi + eax], 0
mov dword [esi*4 + 0x599970], edi
mov byte [esi + 0x599980], 1
test esi, esi
je 0x4a172f
call fcn.004970c0
test eax, eax
je 0x4a172f
mov eax, dword [eax + 0x8c]
test eax, eax
je 0x4a16b3
mov eax, dword [eax]
jmp 0x4a16b5
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4a172f
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0
push 0
push dword [0x599974]
push dword [0x59996c]
call fcn.004d4690
mov esi, eax
add esp, 0x10
lea ecx, [esi*2 + 2]
push ecx
push 0x42
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.kernel32.dll_GlobalLock]
lea ecx, [esi + 1]
push ecx
push eax
push dword [0x599974]
push dword [0x59996c]
call fcn.004d4690
add esp, 0x10
push edi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov byte [0x599981], 1
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
Function at 0x4a2370
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0xc
mov eax, dword [0x598b80]
xor eax, esp
mov dword [esp + 8], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 6
lea ecx, [esp + 4]
movzx eax, ax
push ecx
push 0x1004
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea eax, [esp]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atol]
mov ecx, dword [esp + 0xc]
add esp, 4
xor ecx, esp
mov dword [0x59cab4], eax
call fcn.00515f8b
add esp, 0xc
ret

Function at 0x4a2430
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
call fcn.004970c0
test eax, eax
je 0x4a24cb
mov eax, dword [eax + 0x8c]
test eax, eax
je 0x4a244b
mov eax, dword [eax]
jmp 0x4a244d
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4a24cb
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0
push 0
push dword [0x599974]
push dword [0x59996c]
call fcn.004d4690
mov esi, eax
add esp, 0x10
lea ecx, [esi*2 + 2]
push ecx
push 0x42
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.kernel32.dll_GlobalLock]
lea ecx, [esi + 1]
push ecx
push eax
push dword [0x599974]
push dword [0x59996c]
call fcn.004d4690
add esp, 0x10
push edi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov byte [0x599981], 1
pop esi
ret
Function at 0x4a32e0
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
cmp byte [0x599d08], 0
jne 0x4a33fd
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryA]
push str.GetProcessDpiAwareness
push str.Shcore.DLL
mov byte [0x599d08], 1
call edi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x4a3332
lea ecx, [esp + 8]
push ecx
push 0
call eax
test eax, eax
jne 0x4a3332
mov eax, dword [esp + 8]
cmp eax, 2
je 0x4a3381
test eax, eax
jne 0x4a3388
jmp 0x4a333a
mov dword [esp + 8], 0
push str.SetProcessDpiAwarenessContext
push str.User32.DLL
call edi
push eax
call esi
test eax, eax
je 0x4a335d
push 0xfffffffffffffffc
call eax
test eax, eax
setne al
mov byte [0x5999b1], al
jmp 0x4a3362
mov al, byte [0x5999b1]
test al, al
jne 0x4a3388
push str.SetProcessDpiAwareness
push str.Shcore.DLL
call edi
push eax
call esi
test eax, eax
je 0x4a3388
push 2
call eax
test eax, eax
jne 0x4a3388
mov byte [0x5999b1], 1
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push str.IMM32.DLL
call edi
mov dword [0x5999c0], eax
test eax, eax
jne 0x4a33b3
push str.FLTK_Lib_Error:_IMM32.DLL_file_not_found__n_nPlease_check_your_input_method_manager_library_accessibility.
call dword [0x598060]
mov eax, dword [0x5999c0]
add esp, 4
push str.ImmAssociateContextEx
push eax
call esi
push str.ImmGetContext
push dword [0x5999c0]
mov dword [0x5999c4], eax
call esi
push str.ImmSetCompositionWindow
push dword [0x5999c0]
mov dword [0x5999c8], eax
call esi
push str.ImmReleaseContext
push dword [0x5999c0]
mov dword [0x5999cc], eax
call esi
mov dword [0x5999d0], eax
call fcn.0048bd90
pop edi
pop esi
pop ecx
ret
Function at 0x4a7620
Capabilities:
Terminate process

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push dword [esp + 0xc]
push 2
call esi
add esp, 4
push eax
call fcn.004a7d90
push 2
call esi
push eax
push 0xa
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
push 2
call esi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 0x20
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop esi
push dword [esp + 0x1c]
mov eax, dword [ecx]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [eax + 0x84]
ret 0x1c
Function at 0x4c4300
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x598b80]
xor eax, esp
mov dword [esp + 0x40], eax
push edi
mov edi, ecx
mov eax, dword [edi + 0x24]
test eax, eax
je 0x4c4419
push esi
push 0x56c798
push eax
call fcn.004d41c0
mov esi, eax
add esp, 8
test esi, esi
je 0x4c4418
push ebp
push esi
push 0x40
lea eax, [esp + 0x14]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push esi
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test ebp, ebp
je 0x4c4417
push ebx
cmp ebp, 7
jl 0x4c4398
lea ecx, [esp + 0x10]
cmp dword [ecx], 0x66656423
jne 0x4c4398
cmp word [ecx + 4], 0x6e69
jne 0x4c4398
cmp byte [ecx + 6], 0x65
jne 0x4c4398
push 0x38
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4c4416
push dword [edi + 0x24]
mov ecx, eax
call fcn.004c4ac0
jmp 0x4c43d4
cmp ebp, 9
jl 0x4c4429
lea eax, [esp + 0x10]
cmp dword [eax], 0x58202a2f
jne 0x4c4429
cmp dword [eax + 4], 0x2a204d50
jne 0x4c4429
cmp byte [eax + 8], 0x2f
jne 0x4c4429
push 0x38
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4c4416
push dword [edi + 0x24]
mov ecx, eax
call fcn.004c4cf0
mov ebx, eax
test ebx, ebx
je 0x4c4416
cmp dword [edi + 0x34], 0
je 0x4c43ee
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0x4c43ee
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov esi, dword [edi + 4]
mov ecx, edi
mov dword [edi + 0x30], ebx
mov ebx, dword [edi + 8]
mov dword [edi + 0x34], 1
call fcn.004c4480
test esi, esi
je 0x4c4416
mov eax, dword [edi]
mov ecx, edi
push 1
push 0
push ebx
push esi
call dword [eax + 0x2c]
pop ebx
pop ebp
pop esi
pop edi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00515f8b
add esp, 0x44
ret
xor esi, esi
cmp dword [0x59aab8], esi
jle 0x4c4416
push ebp
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x59aab4]
push dword [edi + 0x24]
mov eax, dword [eax + esi*4]
call eax
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4c43da
inc esi
cmp esi, dword [0x59aab8]
jl 0x4c4433
mov ecx, dword [esp + 0x50]
pop ebx
pop ebp
pop esi
pop edi
xor ecx, esp
call fcn.00515f8b
add esp, 0x44
ret