joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9726
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
push edi
push 0
call fcn.0049c470
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 5
mov dword [ebp - 0x14c], 3
mov dword [ebp - 0x148], 0x5e
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
lea esi, [ebp - 0x15c]
lea edi, [ebp - 0x24]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0x17
lea eax, [ebp - 0x15c]
push eax
call fcn.00523221
add esp, 4
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00523221
add esp, 4
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x138], 0
jmp 0x4a97f1
inc dword [ebp - 0x138]
cmp dword [ebp - 0x138], 0x18
jge 0x4a9879
cmp dword [ebp - 0x138], 4
jl 0x4a983a
cmp dword [ebp - 0x138], 0x10
jge 0x4a983a
mov eax, dword [ebp - 0x134]
push eax
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x138]
push eax
call fcn.0047c526
add esp, 0xc
jmp 0x4a9857
mov eax, dword [ebp - 0x130]
push eax
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x138]
push eax
call fcn.0047c526
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x180
push 0x3e8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x4a97eb
push 0
mov eax, dword [0x531bec]
push eax
push 0x186
push 0x3e8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [0x531be4]
add eax, 0x65
push eax
push 0x67
push 0x65
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [0x531be4]
add eax, 0x65
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a96e7
add esp, 8
mov eax, dword [0x533644]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004e3c5c
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x4a98e6
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a9cbe
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call fcn.0049c470
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
mov eax, dword [0x533644]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004e3c5c
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x4a9cfb
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4aead0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0052344e
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 3
jne 0x4aeb2e
mov eax, 1
jmp 0x4aeb30
xor eax, eax
jmp 0x4aeb35
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4af2bc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push ebx
push esi
push edi
push 0x105
lea eax, [ebp - 0x210]
push eax
mov eax, dword [0x533640]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0052344e
add esp, 0x14
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [0x52d00a], 0x40
je 0x4af35e
push str.Template.MSO
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
jmp 0x4af386
push 0x531d04
push 0x105
mov eax, dword [ebp + 8]
push eax
push 0x531d10
push str.Template
push 0x531d20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x4af386
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b39fe
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0x5c
je 0x4b3a1d
mov dword [ebp - 0x10], 1
jmp 0x4b3a24
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], 0xffffffa5
je 0x4b3a44
cmp dword [ebp + 0x10], 0x5a
je 0x4b3a44
mov dword [ebp - 0x24], 1
jmp 0x4b3a4b
mov dword [ebp - 0x24], 0
cmp dword [ebp + 0x10], 0x5b
jne 0x4b3a61
mov dword [ebp - 0x20], 1
jmp 0x4b3a68
mov dword [ebp - 0x20], 0
cmp dword [ebp + 0x10], 0x5a
je 0x4b3a86
cmp dword [ebp + 0x10], 0x5b
je 0x4b3a86
cmp dword [ebp + 0x10], 0xffffffa5
jne 0x4b3a92
mov dword [ebp - 0x1c], 1
jmp 0x4b3a99
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 0x10], 0
jge 0x4b3aab
mov eax, dword [ebp + 0x10]
neg eax
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0x5c
je 0x4b3acb
cmp dword [ebp + 0x10], 0x5a
je 0x4b3acb
mov dword [ebp - 0x28], 1
jmp 0x4b3ad2
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0048b920
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4b3b37
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
je 0x4b3b32
mov eax, dword [ebp - 8]
push eax
call fcn.004b75cc
add esp, 4
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
jmp 0x4b3be5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4b3be5
cmp dword [ebp - 0x10], 0
je 0x4b3be5
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 1
push 6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004a1cd1
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x4b3bdb
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.004b4f96
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x14]
jmp 0x4b3bed
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b7495
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b754b
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4b74ef
mov eax, dword [ebp - 4]
mov ecx, dword [0x531adc]
cmp dword [eax], ecx
jne 0x4b74ea
dec dword [0x531adc]
jmp 0x4b750f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x210], 0
jl 0x4b750f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
push eax
call fcn.00477edb
add esp, 4
push 0x200
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 4]
add eax, 0x10a
push eax
call fcn.004e483d
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004e46eb
add esp, 8
push 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x4b75c7
push 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x4b75c7
push 0
push 0
call fcn.004a1e47
add esp, 8
cmp dword [0x531b48], 0
je 0x4b75c7
cmp dword [0x52cba8], 0
jne 0x4b75c7
push 0
mov eax, dword [0x533644]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
mov eax, dword [0x533644]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b9209
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
jge 0x4b9238
push 0
push 0
push 0x147
push 0x470
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
inc eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x4b926c
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4b9267
push 8
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4b928a
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b928a
push 0
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b94ff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x118], eax
jmp 0x4b97ad
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
cmp dword [0x531cc4], 0
je 0x4b9574
lea eax, [ebp - 0x108]
push eax
push 0x823
call fcn.004e3fc4
add esp, 8
push 0x40e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x108]
push eax
push 0x40e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov word [ebp - 0x110], ax
push 0
push 0x410
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x4b97d9
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004e58b1
add esp, 0x14
mov eax, dword [ebp - 0x114]
and eax, 0xffff
mov dword [ebp - 0x11c], eax
jmp 0x4b9756
mov eax, dword [0x52c5bc]
push eax
call fcn.004bb488
add esp, 4
jmp 0x4b97a3
mov eax, dword [ebp - 0x110]
and eax, 0xffff
mov dword [ebp - 0x120], eax
jmp 0x4b9647
push 0
push 0
push 0x147
push 0x470
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [0x531cc0], eax
cmp dword [0x531cc8], 0
je 0x4b963d
mov eax, dword [0x531cc0]
mov eax, dword [eax*4 + 0x531cd8]
add eax, 0xffffffff
mov dword [0x531cc0], eax
jmp 0x4b9659
cmp dword [ebp - 0x120], 0
je 0x4b95ff
jmp 0x4b9659
jmp 0x4b97a3
mov eax, dword [ebp - 0x110]
and eax, 0xffff
mov dword [ebp - 0x124], eax
jmp 0x4b96bc
cmp dword [0x531cc8], 0
je 0x4b9694
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.004b8e47
add esp, 8
jmp 0x4b96b2
push 0x410
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.004b9209
add esp, 0xc
jmp 0x4b96ce
cmp dword [ebp - 0x124], 1
je 0x4b9674
jmp 0x4b96ce
jmp 0x4b97a3
mov eax, dword [ebp - 0x110]
and eax, 0xffff
mov dword [ebp - 0x128], eax
jmp 0x4b973a
cmp dword [0x531cc4], 0
je 0x4b9722
push 0
push 2
push 0x111
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x531cc0], 0x63
mov eax, 1
jmp 0x4b97d9
mov eax, dword [0x52c5bc]
push eax
call fcn.004bb488
add esp, 4
jmp 0x4b974c
cmp dword [ebp - 0x128], 0
je 0x4b96e9
jmp 0x4b974c
jmp 0x4b97a3
cmp dword [ebp - 0x11c], 0x40e
jg 0x4b977e
je 0x4b96d3
cmp dword [ebp - 0x11c], 1
je 0x4b95e9
jmp 0x4b97a3
cmp dword [ebp - 0x11c], 0x470
je 0x4b965e
cmp dword [ebp - 0x11c], 0x7531
je 0x4b95d6
jmp 0x4b97a3
jmp 0x4b97d2
cmp dword [ebp - 0x118], 0x110
je 0x4b9519
cmp dword [ebp - 0x118], 0x111
je 0x4b959b
jmp 0x4b97d2
xor eax, eax
jmp 0x4b97d9
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4bab9a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 0xc], 0
jne 0x4babbb
mov dword [ebp + 0x10], 1
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.004e3c00
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4babeb
mov eax, dword [ebp - 0x1c]
jmp 0x4bad59
push 2
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.004e3c00
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4bac1b
mov eax, dword [ebp - 0x1c]
jmp 0x4bad59
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, 3
mov eax, dword [ebp - 8]
cdq
idiv ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0x10], 0
je 0x4bad03
cmp dword [ebp + 0xc], 0
je 0x4bacb0
push 1
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004baa6b
add esp, 0xc
push 1
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004ba684
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4bac8d
push 5
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4bacab
push 5
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4bacfe
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004ba684
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4bace0
push 5
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4bacfe
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4bad51
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004baa6b
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4bad33
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4bad51
push 5
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x1c]
jmp 0x4bad59
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c3c7a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
push 0x105
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push eax
call fcn.00523694
add esp, 4
movsx eax, byte [ebp + eax - 0x109]
cmp eax, 0x5c
je 0x4c3ce9
lea eax, [ebp - 0x108]
push eax
call fcn.00523694
add esp, 4
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov byte [ebp + eax - 0x108], 0x5c
mov eax, dword [ebp - 0x10c]
mov byte [ebp + eax - 0x107], 0
push str.MSOPrefs.232
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x118]
push eax
push 0
push 0x531ae8
lea eax, [ebp - 0x108]
push eax
call fcn.00477c64
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4c3e0a
push 0
mov eax, dword [0x531ae8]
push eax
call fcn.00476fa3
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4c3dd0
push 0x531ae4
push 1
push 0x64
mov eax, dword [0x531ae8]
push eax
call fcn.00476b89
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4c3dd0
mov eax, dword [0x531ae4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
movsx eax, word [eax + 0x10]
cmp eax, 0x3f2
je 0x4c3da9
mov dword [ebp - 0x114], 1
mov eax, dword [0x531ae4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x114], 0
je 0x4c3dd0
mov eax, dword [0x531ae4]
push eax
call fcn.0047947b
add esp, 4
cmp dword [ebp - 0x114], 0
je 0x4c3dfa
mov eax, dword [0x531ae8]
push eax
call fcn.00477edb
add esp, 4
mov dword [0x531ae8], 0xffffffff
jmp 0x4c3e0a
push 0x6f
mov eax, dword [0x531ae8]
push eax
call fcn.004751da
add esp, 8
cmp dword [ebp - 0x114], 0
je 0x4c3e22
call fcn.004c3725
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x4c3e34
jmp 0x4c3eba
push 0x531ae4
push 1
push 0x64
mov eax, dword [0x531ae8]
push eax
call fcn.00476b89
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4c3eba
mov eax, dword [0x531ae4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x110], eax
cmp dword [0x533678], 0
jne 0x4c3e8f
mov eax, dword [ebp - 0x110]
mov dword [eax + 0x12], 0
jmp 0x4c3e9c
mov eax, dword [ebp - 0x110]
mov dword [eax + 0x12], 1
mov edi, 0x52cff0
mov esi, dword [ebp - 0x110]
mov ecx, 0x206
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x531ae4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x114]
jmp 0x4c3ec5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cba17
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push 0
call fcn.0049c470
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
cmp dword [0x52d002], 0
jne 0x4cba67
lea eax, [ebp - 0x108]
push eax
push 0x389
call fcn.004e3fc4
add esp, 8
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [ebp + 8]
push eax
call fcn.004cb811
add esp, 4
cmp dword [0x5330d4], 0
jne 0x4cba98
push 0
push 0xcb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x533644]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004e3c5c
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x4cbabd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cdba5
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0045cbca
add esp, 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4cdbf8
mov eax, dword [ebp - 0x20]
jmp 0x4cdd3e
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x2c], 0
jne 0x4cdc4b
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
jmp 0x4cdd3e
push 0x10
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004e3c00
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4cdc76
jmp 0x4cdd0e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 8
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, eax
shl eax, 7
sub eax, ecx
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, 0x90
cdq
idiv ecx
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov ecx, eax
shl eax, 7
sub eax, ecx
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, 0x90
cdq
idiv ecx
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
push eax
push 3
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4cdd07
mov dword [ebp - 8], 0
mov dword [ebp - 0x2c], 0
jmp 0x4cdd0e
mov dword [ebp - 0x20], 1
cmp dword [ebp - 8], 0
je 0x4cdd22
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x2c], 0
je 0x4cdd36
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
mov eax, dword [ebp - 0x20]
jmp 0x4cdd3e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cdd43
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 3
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4cdeea
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
push eax
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 8]
lea eax, [eax + eax*8]
shl eax, 4
mov ecx, 0x9ec
cdq
idiv ecx
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax + 0xc]
lea eax, [eax + eax*8]
shl eax, 4
mov ecx, 0x9ec
cdq
idiv ecx
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x18]
cmp dword [eax + 8], 0
jg 0x4cddf1
mov eax, dword [ebp + 0x18]
mov dword [eax + 8], 0x32
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0xc], 0
jg 0x4cde08
mov eax, dword [ebp + 0x18]
mov dword [eax + 0xc], 0x32
push 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.GDI32.dll_CopyMetaFileA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x14], 0
je 0x4cdee3
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4cde58
mov eax, dword [ebp - 8]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4cde90
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4cde9a
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
cmp dword [ebp + 0x1c], 0
je 0x4cdeb1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x4cdede
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0044dc65
add esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4cdeea
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
jmp 0x4cdef2
pop edi
pop esi
pop ebx
leave
ret