joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ba0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404ab8

Function at 0x404bd8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404c15
cmp al, 0xb
je 0x404c24
cmp al, 0xc
je 0x404c33
cmp al, 0xd
je 0x404c42
cmp al, 0xe
je 0x404c60
cmp al, 0xf
je 0x404c76
cmp al, 0x11
je 0x404c85
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040289c
mov eax, dword [ebx]
add ebx, 4
call fcn.004042f8
dec edi
jg 0x404c15
jmp 0x404c92
mov eax, ebx
add ebx, 4
call fcn.004049a0
dec edi
jg 0x404c24
jmp 0x404c92
mov eax, ebx
add ebx, 0x10
call fcn.00405b14
dec edi
jg 0x404c33
jmp 0x404c92
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404bd8
dec edi
jg 0x404c45
pop ebp
jmp 0x404c92
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404bac
dec edi
jg 0x404c63
pop ebp
jmp 0x404c92
mov eax, dword [ebx]
add ebx, 4
call fcn.00406a8c
dec edi
jg 0x404c76
jmp 0x404c92
mov eax, dword [ebx]
add ebx, 4
call fcn.00406420
dec edi
jg 0x404c85
pop edi
pop esi
pop ebx
ret

Function at 0x404c98
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404bd8

Function at 0x404ca4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404cd0
mov edx, eax
add eax, esi
add edx, ebx
call fcn.0040296c
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404d0f
cmp cl, 0xb
je 0x404d20
cmp cl, 0xc
je 0x404d31
cmp cl, 0xd
je 0x404d42
cmp cl, 0xe
je 0x404d62
cmp cl, 0xf
je 0x404d7b
cmp cl, 0x11
je 0x404d8c
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040289c
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403f18
mov eax, 4
jmp 0x404d9d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004045f0
mov eax, 4
jmp 0x404d9d
lea edx, [esi + eax]
add eax, ebx
call fcn.004050c0
mov eax, 0x10
jmp 0x404d9d
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404dc0
pop eax
jmp 0x404d9d
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404ca4
pop eax
jmp 0x404d9d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00406a44
mov eax, 4
jmp 0x404d9d
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004063f8
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x404cbe
pop ecx
sub ecx, eax
jle 0x404db9
lea edx, [ebx + eax]
add eax, esi
call fcn.0040296c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404dc0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404e06
cmp cl, 0xb
je 0x404e1d
cmp cl, 0xc
je 0x404e31
cmp cl, 0xd
je 0x404e45
cmp cl, 0xe
je 0x404e66
cmp cl, 0xf
je 0x404e83
cmp cl, 0x11
je 0x404e97
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040289c
mov eax, ebx
mov edx, dword [esi]
call fcn.00403f18
add ebx, 4
add esi, 4
dec ebp
jne 0x404e06
jmp 0x404eab
mov eax, ebx
mov edx, dword [esi]
call fcn.004045f0
add ebx, 4
add esi, 4
dec ebp
jne 0x404e1d
jmp 0x404eab
mov eax, ebx
mov edx, esi
call fcn.004050c0
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404e31
jmp 0x404eab
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404dc0
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404e4e
jmp 0x404eab
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404ca4
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x404e66
jmp 0x404eab
mov eax, ebx
mov edx, dword [esi]
call fcn.00406a44
add ebx, 4
add esi, 4
dec ebp
jne 0x404e83
jmp 0x404eab
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.004063f8
add ebx, 4
add esi, 4
dec ebp
jne 0x404e97
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4050c0
Capabilities:
Terminate process

Disassembly:
cmp eax, edx
je 0x405158
cmp word [eax], 8
jb 0x4050f8
push eax
push edx
cmp word [eax], 0x100
je 0x4050ee
cmp word [eax], 0x101
je 0x4050e6
push eax
call fcn.00401424
jmp 0x4050f6
call dword [0x7323e8]
jmp 0x4050f6
add eax, 8
call fcn.00403ec4
pop edx
pop eax
cmp word [edx], 8
jae 0x40510f
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40512a
cmp word [edx], 0x101
jne 0x405144
push eax
call 0x4050fe
pop eax
jmp dword [0x7323f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x40513b
mov ecx, dword [edx - 8]
inc ecx
jle 0x40513b
lock inc dword [edx - 8]
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call fcn.0040142c
or eax, eax
jne fcn.00405074
ret

Function at 0x40555c
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x40556a
mov edx, dword [edx + 8]
jmp fcn.004045f0
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.004052d4
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.004045a4
add esp, 0x10
pop ebx
ret

Function at 0x405604
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.00406a2c
cmp word [edx], 0xd
je 0x40564f
cmp word [edx], 9
je 0x40564f
cmp word [edx], 0x400d
je 0x405645
cmp word [edx], 0x4009
je 0x405645
cmp word [edx], 0x101
jne fcn.0040506c
jmp fcn.00405594
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.00406a44
mov edx, dword [edx + 8]
jmp fcn.00406a44
Function at 0x405718
Capabilities:
Terminate process

Disassembly:
push eax
cmp word [eax], 8
jb 0x405726
push edx
call fcn.0040507c
pop edx
xor eax, eax
test edx, edx
je 0x405742
mov eax, dword [edx - 4]
shr eax, 1
je 0x405742
push eax
push edx
call fcn.00401404
test eax, eax
je 0x40459c
pop edx
mov word [edx], 8
mov dword [edx + 8], eax
ret

Function at 0x4057f8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00405b14
xor eax, eax
push ebp
push 0x4057ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x7323ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.004057f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4057f1
lea eax, [ebp - 0x10]
call fcn.00405b0c
ret
cmp word [edx], 0x101
je 0x405794
cmp word [edx], 0x100
jne fcn.004050c0
cmp word [eax], 8
jb 0x40581d
push eax
push edx
call fcn.0040507c
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.00404750

Function at 0x405968
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x40598e
cmp eax, 0x100
jne 0x4059bd
mov eax, 8
cmp edx, 0x11
jbe 0x4059a0
cmp edx, 0x100
jne case.default.0x4059b4
mov edx, 8
mov al, byte [eax + 0x70006c]
mov dl, byte [edx + 0x70006c]
movzx ecx, byte [edx + eax*8 + 0x700080]
jmp dword [ecx*4 + 0x4059cf]
mov eax, edx
cmp eax, 0x101
jne case.0x4059b4.0
pop edi
pop esi
call fcn.004058cc
push eax
popf
ret
pop edi
pop esi
jmp fcn.00405074
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.004053c8
xchg edi, eax
call fcn.004053c8
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00405468
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00405468
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.004054c4
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.004054c4
fld xword [esp]
add esp, 0xc
jmp 0x405a27
mov eax, edi
mov edx, esi
call fcn.00405864
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00405434
xchg edi, eax
call fcn.00405434
mov edx, edi
cmp al, dl
pop edi
pop esi
ret

Function at 0x405a78
Capabilities:
Terminate process

Disassembly:
mov edx, dword [eax]
and edx, 0xfff
cmp edx, 0x11
jbe 0x405a92
cmp edx, 0x100
jne case.0x405a98.0
mov edx, 8
mov dl, byte [edx + 0x70006c]
jmp dword [edx*4 + 0x405ab3]
jmp fcn.00405074
ret
push eax
call fcn.004053c8
neg eax
mov edx, eax
pop eax
jmp fcn.00405658
push eax
call fcn.00405468
fchs
pop eax
jmp fcn.00405690
fild qword [eax + 8]
fchs
fistp qword [eax + 8]
wait
ret
fld qword [eax + 8]
fchs
fstp qword [eax + 8]
wait
ret
Function at 0x40663c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.00401384
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4067f8
push 0x80000001
call fcn.004013e4
test eax, eax
je 0x40669d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406814
push 0x80000001
call fcn.004013e4
test eax, eax
jne 0x40670f
xor eax, eax
push ebp
push 0x406708
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00406494
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004013ec
test eax, eax
je 0x4066f1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406834
mov eax, dword [ebp - 8]
push eax
call fcn.004013ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40670f
mov eax, dword [ebp - 8]
push eax
call fcn.004013dc
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.004013bc
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.004013a4
push eax
call fcn.0040137c
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4067f0
cmp byte [ebp - 0xd], 0
jne 0x406751
cmp byte [ebp - 0x12], 0
je 0x4067f0
lea eax, [ebp - 0x11d]
push eax
call fcn.004013cc
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40676a
dec ebx
cmp byte [ebx], 0x2e
je 0x406779
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406769
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4067f0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4067a6
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.004013bc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004013ac
mov esi, eax
test esi, esi
jne 0x4067f0
cmp byte [ebp - 0xd], 0
je 0x4067f0
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.004013bc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004013ac
mov esi, eax
test esi, esi
jne 0x4067f0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.004013bc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.004013ac
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406a60
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00406a2c
push eax
push ecx
push edx
mov ecx, dword [eax]
test ecx, ecx
je 0x406a7a
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp]
mov eax, dword [edx]
call dword [eax]
test eax, eax
je 0x406a89
mov al, 0x17
jmp fcn.0040289c
ret

Function at 0x406b28
Capabilities:
Terminate process

Disassembly:
test eax, eax
jns 0x406b42
mov ecx, dword [0x732014]
test ecx, ecx
je 0x406b3b
mov edx, dword [esp]
call ecx
mov al, 0x18
jmp fcn.0040289c
ret

Function at 0x40a74c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404308
push eax
call fcn.00407ebc
pop ebx
ret
Function at 0x40a760
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404308
push eax
call fcn.00408074
test eax, eax
jne 0x40a782
call fcn.00407ecc
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40ac54
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call fcn.00407e84
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403fac
add esp, 0x104
pop ebx
ret

Function at 0x40d470
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call fcn.00407edc
test eax, eax
jle 0x40d4a9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403fac
jmp 0x40d4b2
mov eax, ebx
mov edx, esi
call fcn.00403f18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d4bc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call fcn.00407edc
test eax, eax
jle 0x40d4dd
mov al, byte [esp]
jmp 0x40d4df
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41af80
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call fcn.004080a4
ret

Function at 0x41af90
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call fcn.0040804c
cmp eax, 1
jne 0x41afa5
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x41d094
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41d09a
ret

Function at 0x41fadc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00407f2c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41fb2d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41fb14
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41fb04
jmp 0x41fb2d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41fb15
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4331d8
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x43322c
mov eax, dword [0x730ea4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x433204
push ebx
push 0x433234
call fcn.0044fc80
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call fcn.0040896c
test eax, eax
jne 0x433228
mov ecx, dword [0x7300bc]
mov dl, 1
mov eax, dword [0x409140]
call fcn.0040dd2c
call fcn.004038bc
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret

Function at 0x433254
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004331d8
xor edx, edx
push ebp
push 0x433326
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call fcn.00407f9c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4332f8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call fcn.00407fb4
xor edx, edx
push ebp
push 0x4332e7
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.0040296c
mov eax, dword [ebp - 4]
call fcn.00433190
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call fcn.00408a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4332ee
mov eax, dword [ebp - 8]
push eax
call fcn.00407fdc
ret

Function at 0x433358
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004331d8
push 1
call fcn.004086d4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4333ca
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x43339e
mov eax, dword [ebp - 8]
push eax
call fcn.00407fb4
mov edx, eax
mov eax, ebx
call fcn.0040407c
jmp 0x4333a5
mov eax, ebx
call fcn.00403ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4333d1
cmp dword [ebp - 8], 0
je 0x4333c1
mov eax, dword [ebp - 8]
push eax
call fcn.00407fdc
mov eax, dword [ebp - 4]
call fcn.004331ac
ret

Function at 0x4333d8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004331d8
xor edx, edx
push ebp
push 0x43347a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call fcn.0040865c
mov ebx, eax
test bx, bx
je 0x43344d
mov edx, ebx
mov eax, dword [0x41cac8]
call fcn.00421740
test al, al
je 0x43343d
movzx eax, bx
push eax
call fcn.004086d4
mov esi, eax
push 9
call fcn.004086d4
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00421650
call fcn.0040395c
jmp 0x433481
movzx eax, bx
push eax
call fcn.0040865c
mov ebx, eax
test bx, bx
jne 0x433408
mov ecx, dword [0x7303bc]
mov dl, 1
mov eax, dword [0x409140]
call fcn.0040dd2c
call fcn.004038bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433481
mov eax, dword [ebp - 4]
call fcn.004331ac
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x433488
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004331d8
xor eax, eax
push ebp
push 0x4334e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call fcn.004086d4
mov ebx, eax
push 9
call fcn.004086d4
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4334e7
mov eax, dword [ebp - 4]
call fcn.004331ac
ret

Function at 0x4334f0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004331d8
xor edx, edx
push ebp
push 0x433545
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call fcn.004086d4
mov ebx, eax
push 9
call fcn.004086d4
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43354c
mov eax, dword [ebp - 4]
call fcn.004331ac
ret

Function at 0x4335bc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004331d8
xor eax, eax
push ebp
push 0x433631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00433190
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00421714
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call fcn.00408a2c
cmp dword [ebp - 0x10], 0
je 0x43361b
mov eax, dword [ebp - 0x10]
push eax
push 9
call fcn.00408a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433638
mov eax, dword [ebp - 4]
call fcn.004331ac
ret

Function at 0x433640
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004331d8
xor eax, eax
push ebp
push 0x4336b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00433190
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call fcn.00408a2c
cmp dword [ebp - 0x10], 0
je 0x43369f
mov eax, dword [ebp - 0x10]
push eax
push 9
call fcn.00408a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4336bc
mov eax, dword [ebp - 4]
call fcn.004331ac
ret

Function at 0x433710
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004331d8
xor eax, eax
push ebp
push 0x433754
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call fcn.004086d4
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43375b
mov eax, dword [ebp - 4]
call fcn.004331ac
ret
Function at 0x436dc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call fcn.0040873c
test ax, 0x8000
setne al
cmp dword [0x732788], 0
sete dl
or al, dl
jne 0x436f00
mov eax, dword [0x73278c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x732788]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x436ecf
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x732788]
call fcn.00413be4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x436ec7
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x436ec7
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x436ec7
mov eax, dword [ebp - 0x14]
call fcn.0043f298
push eax
call fcn.004088d4
test eax, eax
je 0x436ec7
push ebp
call fcn.00436d7c
pop ecx
test al, al
jne 0x436ec7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x436e83
mov eax, dword [ebp - 0x14]
call fcn.0043dbec
dec eax
jle 0x436ec7
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00403300
cmp byte [ebp - 1], 0
je 0x436ec7
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.0040898c
test eax, eax
je 0x436ec7
mov edx, dword [ebp - 0x14]
mov eax, dword [0x73278c]
call fcn.004365c8
inc edi
dec esi
jne 0x436e16
mov eax, dword [0x73278c]
cmp dword [eax + 8], 0
jle 0x436ee7
mov eax, dword [0x73278c]
call fcn.00436658
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x436f00
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00436be4
pop ecx
test al, al
jne 0x436f00
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret