joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417790
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
lea ecx, [ebp - 0x1c]
push ecx
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x50
lea edx, [ebp - 0x6c]
push 0
push edx
mov dword [ebp - 4], eax
call fcn.004c9b50
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0x10
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov esi, eax
call fcn.004c9edf
push esi
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x1fc]
push str.Layout_s__HKL0x_08X__Count_u_n
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
push esi
lea eax, [ebp - 0x6c]
push eax
push 0xc8
lea ecx, [ebp - 0x1fc]
push ecx
mov ecx, edi
call fcn.0040bab0
or esi, 0xffffffff
test ebx, ebx
je 0x4178d9
xor eax, eax
lea ecx, [edi + 0x556c]
cmp dword [ecx - 4], 0
jne 0x41784f
cmp esi, 0xffffffff
jne 0x417857
mov esi, eax
jmp 0x417857
cmp dword [ecx], ebx
je 0x41790a
inc eax
add ecx, 0xc
cmp eax, 0x14
jl 0x417840
test esi, esi
jl 0x4178d4
mov dl, bl
xor dl, byte [ebp - 4]
je 0x4178c0
push str._nLOWORD_hkl_LOWORD_dwLayout_____Warning__strange_layout_ID
push 0xc8
lea eax, [ebp - 0x1fc]
push eax
call fcn.004017b0
lea eax, [ebp - 0x1fc]
push 0xa
push eax
call fcn.004c9bca
add esp, 8
test eax, eax
je 0x4178a0
mov ecx, 0x20
mov word [eax], cx
jmp 0x417887
test edi, edi
je 0x4178c0
mov ecx, dword [edi + 0x40b0]
test ecx, ecx
je 0x4178c0
push 1
push 0
push 1
lea edx, [ebp - 0x1fc]
push edx
call fcn.004c77f0
mov eax, dword [ebp - 4]
push eax
push ebx
push esi
mov ecx, edi
call fcn.0040bbc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
jne 0x41790a
push str._niUnused_1
push 0xc8
lea ecx, [ebp - 0x1fc]
push ecx
call fcn.004017b0
push 0
push 0x388e
lea edx, [ebp - 0x1fc]
push str.ConEmu.cpp
push edx
call fcn.00428c10
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417e00
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x417e43
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x417e1f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x417e2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x417e73
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.00412a30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x417e7f
mov eax, 0x15ae
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x417e92
cmp dword [ebp + 0xc], ebx
jne 0x417e92
xor ecx, ecx
jmp 0x417e97
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x417eb3
push eax
push ebx
push 4
call fcn.0044cf40
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x417ebc
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x417ee9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x417edf
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x417f2d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x417f41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x417f25
mov ecx, 0x4e93f8
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.0044cff0
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4195e0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9306
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea eax, [esi + 0x3be]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x52fe30]
mov eax, dword [ecx + 0x11630]
test eax, eax
je 0x419627
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
call fcn.00401040
mov ecx, esi
call fcn.00415a30
push 0x78
call fcn.0044c4d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x419654
mov ecx, eax
call fcn.004c6d00
jmp 0x419656
xor eax, eax
push 0xaa8
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x40ac], eax
call fcn.0044c4d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x419687
mov ecx, eax
call fcn.004a6e70
jmp 0x419689
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x40a0], eax
call fcn.004c6070
test al, al
jne 0x4196c2
push 0
push 0
push 0
push 0x40a570
push 0
push 0x4007
push 0x4006
call dword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [esi + 0x54f0], eax
lea ecx, [esi + 0xb0]
call fcn.004380d0
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41c8a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x78b8], eax
je 0x41c917
mov eax, dword [0x52fe34]
cmp byte [eax + 0x125fa], 0
je 0x41c8e4
mov ecx, dword [esi + 0x40b0]
test ecx, ecx
je 0x41c8e4
push 0
push 1
push 0
push 1
push str.OnConsoleResize_abPostedfalse_
call fcn.004c87c0
cmp byte [0x52fdf4], 0
jne 0x41ca8a
mov ecx, dword [esi + 0x7908]
mov edx, dword [0x52fe14]
push 0
push 0
push ecx
push edx
mov byte [0x52fdf4], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x52fe14]
push eax
mov byte [0x52fdf4], 0
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
setne al
test al, al
jne 0x41c963
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1220], al
je 0x41c949
cmp byte [esi + 0x40ee], al
jne 0x41c963
cmp byte [esi + 0x4090], 0
jne 0x41c99e
mov edx, dword [0x52fe14]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41c99e
mov eax, dword [0x52fe34]
cmp byte [eax + 0x125fa], 0
je 0x41ca8a
mov esi, dword [esi + 0x40b0]
test esi, esi
je 0x41ca8a
push 0
push 1
push 0
push 1
push str.OnConsoleResize_ignored__because_of_iconic
mov ecx, esi
call fcn.004c87c0
pop esi
mov esp, ebp
pop ebp
ret 4
movzx eax, word [esi + 0x4148]
mov ecx, eax
xor edx, edx
and ecx, 0x100
cmp ecx, 0x100
sete dl
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp - 4], edx
test al, al
js 0x41c9cb
xor bl, bl
jmp 0x41c9ed
push 1
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x41c9eb
push 0
mov ecx, esi
call fcn.00416b10
xor bl, bl
jmp 0x41c9ed
mov bl, 1
push 1
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
sete al
test bl, bl
je 0x41ca15
test al, al
jne 0x41ca15
mov ecx, 0xfe7f
and word [esi + 0x4148], cx
mov edx, dword [0x52fe34]
cmp byte [edx + 0x125fa], 0
je 0x41ca75
movzx ecx, byte [esi + 0x47cd]
push ecx
mov ecx, dword [ebp - 4]
movzx edx, al
push edx
movzx edx, word [esi + 0x4148]
movzx eax, bl
push eax
push ecx
push edx
lea eax, [ebp - 0xa4]
push str.OnConsoleResize:_mouse.state0x_08X__SizingToDo_i__IsSizing_i__LBtnPressed_i__gbPostUpdateWindowSize_i
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [esi + 0x40b0]
add esp, 0x1c
test esi, esi
je 0x41ca75
push 0
push 1
push 0
push 1
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, esi
call fcn.004c87c0
cmp dword [ebp - 4], 0
setne dl
movzx eax, dl
push eax
call fcn.004ba780
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41ce20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
mov ecx, dword [esi + 0x40a8]
call fcn.004a2590
test al, al
je 0x41ce41
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x5510], 0
push edi
je 0x41ce93
test byte [esi + 0x4148], 0x80
je 0x41ce93
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x41ce8a
push 1
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x41ce8a
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
mov ecx, esi
call fcn.00416b10
push ebx
xor bl, bl
cmp byte [ebp + 8], bl
je 0x41cf5e
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x52fe14]
lea ecx, [ebp - 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x52fe30]
mov eax, 2
sub dword [ebp - 0x18], eax
add dword [ebp - 0x10], eax
add dword [ebp - 0xc], eax
cmp byte [ecx + 0x1220], bl
je 0x41cedb
inc dword [ebp - 0x14]
jmp 0x41cede
sub dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.USER32.dll_PtInRect]
push edx
push eax
lea ecx, [ebp - 0x18]
push ecx
call edi
test eax, eax
je 0x41cf68
push 0
push 1
lea edx, [ebp - 0x28]
push edx
mov ecx, esi
call fcn.00415030
mov ecx, dword [0x52fe30]
mov eax, 1
add dword [ebp - 0x28], eax
sub dword [ebp - 0x20], eax
sub dword [ebp - 0x1c], eax
cmp byte [ecx + 0x1220], 0
je 0x41cf28
sub dword [ebp - 0x14], 2
jmp 0x41cf2b
add dword [ebp - 0x24], eax
mov eax, dword [0x52fe14]
push 2
lea edx, [ebp - 0x28]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
push ecx
push edx
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x41cf68
mov bl, 1
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x5510], 2
sete bl
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x425130
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
test ax, ax
je 0x42514f
mov ecx, dword [ebp + 8]
movzx eax, ax
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp + 0xc], eax
jmp 0x425157
mov edx, dword [ebp + 8]
mov dword [ebp + 0xc], edx
mov eax, edx
test eax, eax
jne 0x42515d
pop ebp
ret
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jle 0x4251c1
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x42518c
cmp edi, dword [ebx]
jb 0x42519e
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi], 0
lea eax, [edi + 0x20]
push 2
push eax
mov dword [ebx], eax
call fcn.0044c490
add esp, 8
mov dword [esi], eax
mov eax, dword [esi]
pop ebx
test eax, eax
je 0x4251d1
xor ecx, ecx
mov word [eax], cx
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
lea edx, [edi + 1]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
xor edi, edi
test eax, eax
je 0x4251d1
xor ecx, ecx
mov word [eax], cx
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x425c50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
xor ebx, ebx
push 0x2000b
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x425d65
push 1
push 0x14
call fcn.0044c490
add esp, 8
lea ecx, [ebp - 4]
push ecx
push edi
push edi
push edi
mov esi, eax
push edi
lea edx, [ebp - 0x14]
push edx
mov byte [esi], 1
mov byte [esi + 1], 2
mov byte [esi + 7], 5
mov dword [esi + 8], 0x20
mov dword [esi + 0xc], 0x220
mov eax, dword [ebp - 8]
push 1
push 1
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
test eax, eax
je 0x425d39
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp - 4]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x425d1b
mov eax, dword [ebp - 4]
push eax
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], edi
jmp 0x425d48
mov ebx, dword [ebp + 0x30]
cmp ebx, edi
je 0x425d2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], edi
jmp 0x425d48
mov ebx, dword [ebp + 0x30]
cmp ebx, edi
je 0x425d48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
push esi
call fcn.0044c4f0
mov ecx, dword [ebp - 8]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x30]
cmp esi, edi
je 0x425d74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426620
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x52ff78], 0
jle 0x42663b
push 0x52ff78
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov al, 1
pop ebp
ret
mov eax, dword [0x52fe14]
push ebx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4266a4
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0x4ebf54
push ebx
push str.OpenClipboard_failed__
mov edi, eax
call fcn.0044c5d0
push 0
push 0
push 0x15
mov esi, eax
push edi
push esi
call fcn.004263e0
add esp, 0x28
mov edi, eax
test esi, esi
je 0x42668e
push esi
call fcn.0044c4f0
add esp, 4
cmp edi, 4
jne 0x4266b6
mov ecx, dword [0x52fe14]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x426651
push 0x52ff78
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x426750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [edi], 0
cmp word [eax], 0x20
mov edx, eax
jne 0x426779
lea esp, [esp]
add eax, 2
cmp word [eax], 0x20
je 0x426770
movzx ecx, word [eax]
mov esi, 0x20
test cx, cx
je 0x4267eb
cmp cx, 0x22
jne 0x426792
xor esi, 2
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x4267bc
lea ebx, [ebx]
cmp cx, 0x22
je 0x4267e3
cmp cx, si
je 0x4267bc
add eax, 2
mov word [edx], cx
movzx ecx, word [eax]
add edx, 2
test cx, cx
jne 0x4267a0
movzx ecx, word [eax]
cmp cx, 0x22
je 0x4267e3
cmp cx, 0x20
jne 0x4267d9
jmp 0x4267d0
add eax, 2
cmp word [eax], 0x20
je 0x4267d0
xor ecx, ecx
mov word [edx], cx
add edx, 2
inc dword [edi]
movzx ecx, word [eax]
test cx, cx
jne 0x426786
pop edi
pop esi
pop ebp
ret
Function at 0x426ac0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareHoopoePG_2x
push SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426b18
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push str.CreateInNewEnvironment
push edx
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4274c0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4274d0
xor al, al
pop ebx
pop ebp
ret
push str.CopyToClipboard
mov byte [ebp + 0xb], 0
call fcn.00426620
add esp, 4
test al, al
je 0x42754a
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [edi + edi + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x427533
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x427533
push ebx
inc edi
push edi
push eax
call fcn.00401730
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne byte [ebp + 0xb]
push 0x52ff78
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
test eax, eax
jg 0x42754a
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [ebp + 0xb]
pop ebx
pop ebp
ret
Function at 0x42b980
Capabilities:
Read file on windows
Read pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebp - 0x678], ax
mov dword [ebp - 4], eax
test esi, esi
je 0x42bb0a
mov eax, dword [ebp + 8]
test eax, eax
je 0x42bb0a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
push 0
push 0
push ecx
push edx
push 0
lea ecx, [ebp - 0x678]
push ecx
push eax
mov dword [esi + 8], ebx
call fcn.0042b7c0
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x42bb0a
cmp edi, 0xffffffff
je 0x42bb0a
mov eax, dword [esi]
push 0
test ebx, ebx
je 0x42ba05
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
xor ebx, ebx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push 0x258
lea edx, [ebp - 0x268]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov esi, eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x42ba46
cmp eax, 0xea
je 0x42ba46
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor ebx, ebx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
cmp eax, 0x30
jb 0x42ba34
mov esi, dword [ebp - 0x268]
cmp esi, eax
jb 0x42ba34
cmp dword [ebp - 0x264], 0x8b
jne 0x42ba34
push esi
call fcn.0044c4d0
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x42ba86
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x268]
push edx
push ebx
call fcn.004c9f70
mov eax, dword [ebp - 4]
sub esi, eax
add esp, 0xc
lea ecx, [eax + ebx]
mov dword [ebp - 8], ecx
test esi, esi
jle 0x42bae8
lea esp, [esp]
cmp dword [ebp - 0xc], 0
jne 0x42bae8
mov eax, dword [ebp - 8]
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x42badc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x42bae8
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub esi, eax
test esi, esi
jg 0x42bab0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ecx + 0xc]
je 0x42bb0c
test eax, eax
jne 0x42bb0c
lea edx, [ebp - 0x10]
push edx
call fcn.0042b550
add esp, 4
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bcc0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x42bd03
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x42bcdf
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x42bcee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x42bd33
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.00412a30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x42bd3f
mov eax, 0x12c2
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x42bd52
cmp dword [ebp + 0xc], ebx
jne 0x42bd52
xor ecx, ecx
jmp 0x42bd57
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x42bd73
push eax
push ebx
push 4
call fcn.0044cf40
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x42bd7c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x42bda9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x42bd9f
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x42bded
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x42be01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x42bde5
mov ecx, 0x4e93f8
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.0044cff0
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc