joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e41
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.01008904
push 0x1001794
mov ecx, esi
call fcn.01009627
test al, al
je 0x1009f0f
push dword [esi + 0x28]
call fcn.0100e704
test al, al
je 0x1009e85
mov dword [ebp - 4], 4
jmp 0x1009f26
mov eax, dword [esi + 0x28]
xor bl, bl
xor ecx, ecx
test eax, eax
je 0x1009e96
cmp word [eax], cx
setne cl
test cl, cl
je 0x1009ebf
mov eax, dword [esi + 0x28]
movzx cx, byte [eax]
cmp cx, word [eax]
jne 0x1009ebf
mov bl, byte [eax]
movzx eax, bl
mov al, byte [eax + 0x101c488]
test al, al
jbe 0x1009ebf
movzx eax, al
test eax, eax
mov dword [ebp - 4], eax
jne 0x1009f26
mov eax, dword [esi + 0x28]
push 3
push eax
lea ecx, [ebp - 0x10]
call fcn.01008eee
test eax, eax
jl 0x1009f26
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
mov dword [ebp - 4], eax
jne 0x1009f01
push dword [ebp - 0x10]
mov ecx, esi
call fcn.01009aea
cmp eax, 0x15e
je 0x1009efa
cmp eax, 0x20d
jne 0x1009f01
mov dword [ebp - 4], 0x80
mov cl, byte [ebp - 4]
movzx eax, bl
mov byte [eax + 0x101c488], cl
jmp 0x1009f26
push 0x10017c0
mov ecx, esi
call fcn.01009627
test al, al
je 0x1009f26
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x10]
call fcn.01008e9a
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x100c9b3
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0x80070005
call fcn.0100a82c
push dword [ebp + 8]
lea ecx, [ebp - 0x60]
push 2
call fcn.0100b6d7
xor ebx, ebx
test eax, eax
jl 0x100ca17
lea ecx, [ebp - 0x60]
call fcn.01009e41
cmp eax, 4
jne 0x100ca17
push 0x1f4
lea eax, [ebp - 0x60]
push eax
call fcn.0100becb
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x100ca1c
cmp byte [0x101c5bc], bl
je 0x100ca17
lea eax, [ebp - 0x60]
push eax
mov ecx, 0x101c5c0
call fcn.0100c8d1
cmp dword [ebp - 4], ebx
jge 0x100ca96
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 8]
push 0x100bd12
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x100ca96
mov ecx, 0x101cae8
call fcn.0100bca8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100ca8f
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x100ca8f
cmp dword [ebp - 4], ebx
je 0x100ca6d
mov dword [ebp - 4], 0x80070005
jmp 0x100ca8f
cmp byte [0x101c5bc], bl
je 0x100ca8f
lea ecx, [ebp - 0x60]
call fcn.01009e25
test al, al
jne 0x100ca8f
lea eax, [ebp - 0x60]
push eax
mov ecx, 0x101c5c0
call fcn.0100c8d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x60]
call fcn.010080af
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x100caae
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
call fcn.0100c23d
push dword [ebp + 8]
lea esi, [edi + 0x2c]
push esi
mov ecx, edi
call fcn.0100c5ad
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100cb4a
cmp byte [ebp + 0xc], 0
je 0x100cb46
mov ecx, edi
call fcn.0100c25a
lea ecx, [ebp - 0x10]
call fcn.01008904
lea ecx, [ebp - 0x6c]
call fcn.0100a82c
push dword [ebp + 8]
lea ecx, [ebp - 0x6c]
call fcn.0100bc4b
push ebx
push 0x1001728
lea ecx, [ebp - 0x6c]
call fcn.0100ab0e
mov esi, eax
test esi, esi
jl 0x100cb32
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x6c]
call fcn.0100b621
mov esi, eax
test esi, esi
jl 0x100cb32
push dword [ebp - 0x10]
call fcn.0100c9b3
mov esi, eax
lea ecx, [ebp - 0x6c]
call fcn.010080af
lea ecx, [ebp - 0x10]
call fcn.01008e9a
mov eax, esi
jmp 0x100cbb2
xor edi, edi
jmp 0x100cba8
push ebx
mov ecx, esi
call fcn.0100c300
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x208]
mov ecx, 0x101cae8
mov edi, eax
call fcn.0100bc8c
cmp edi, eax
mov ecx, esi
push ebx
jb 0x100cb9d
call fcn.0100c300
push eax
call fcn.0100c9b3
mov edi, eax
test edi, edi
jge 0x100cba8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ecx, esi
mov edi, eax
call fcn.0100c300
mov dword [eax + 0x208], edi
push ebx
mov ecx, esi
call fcn.0100c300
mov edi, dword [eax + 0x20c]
mov ecx, dword [ebp - 4]
call fcn.0100c25a
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100cc30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.01008904
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0
call fcn.0100b621
test eax, eax
jl 0x100ccbd
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call edi
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0100cbbe
test eax, eax
jl 0x100ccb8
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x100cca9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100cc9b
call esi
jmp 0x100ccab
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x100ccab
xor eax, eax
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0100c930
pop esi
push ebx
call edi
pop edi
pop ebx
lea ecx, [ebp - 0x14]
call fcn.01008e9a
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x100d4d6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
je 0x100d5c0
mov edi, dword [ebp + 8]
test edi, edi
je 0x100d5c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101ca9c]
mov ebx, 0x101ca90
cmp eax, 0xea60
jae 0x100d52a
push edi
push ebx
call fcn.010088c0
test al, al
je 0x100d52a
mov eax, dword [0x101ca8c]
mov dword [esi], eax
jmp 0x100d5c7
push esi
push edi
push 0x10049e8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0100d3b3
cmp eax, 3
je 0x100d545
cmp eax, 2
jne 0x100d569
push esi
push edi
push 0x1004978
push SysReAllocString
call fcn.0100d3b3
cmp eax, 3
je 0x100d560
cmp eax, 2
jne 0x100d569
mov dword [ebp - 4], 0xc00d0fda
xor eax, eax
test eax, eax
je 0x100d57c
jle 0x100d579
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x100d5c7
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jae 0x100d5c7
push 5
push ebx
lea ecx, [ebp - 0x10]
call fcn.0100899d
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x10]
call fcn.01008eee
mov eax, dword [esi]
mov dword [0x101ca8c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [0x101ca9c], eax
call fcn.01008e9a
jmp 0x100d5c7
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100d65b
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
je 0x100d72a
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x100d72a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xea60
cmp eax, dword [0x101cab0]
mov edi, 0x101caa4
jae 0x100d6af
push ebx
push edi
call fcn.010088c0
test al, al
je 0x100d6af
mov eax, dword [0x101caa0]
mov dword [esi], eax
jmp 0x100d731
push esi
push ebx
push 0x10049e8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0100d5d6
test eax, eax
je 0x100d6ec
push esi
push ebx
push 0x1004978
push SysReAllocString
call fcn.0100d5d6
test eax, eax
je 0x100d6ec
jle 0x100d6e5
and eax, 0xffff
or eax, 0x80070000
test eax, eax
mov dword [ebp - 4], eax
jl 0x100d731
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jae 0x100d731
push 5
push edi
lea ecx, [ebp - 0x10]
call fcn.0100899d
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x10]
call fcn.01008eee
mov eax, dword [esi]
mov dword [0x101caa0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [0x101cab0], eax
call fcn.01008e9a
jmp 0x100d731
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100daeb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 8], 3
mov ecx, dword [ebp - 4]
jne 0x100db25
cmp ecx, edi
jne 0x100db25
push 2
pop eax
cmp eax, edi
jne 0x100db5d
shr ecx, 1
push ecx
call fcn.010087f3
cmp eax, edi
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
je 0x100db5d
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x10], ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100db57
mov al, 1
jmp 0x100db5f
push ebx
call fcn.0100881d
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x100dd1b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100dd6d
push edi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
jmp 0x100dd6f
xor al, al
pop esi
leave
ret 0xc
Function at 0x100e3ad
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x101a094]
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x118]
push eax
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x100e3fd
cmp dword [ebp - 0x108], 2
jne 0x100e3fd
cmp dword [ebp - 0x114], 5
ja 0x100e3fb
jne 0x100e3fd
cmp dword [ebp - 0x110], ebx
jbe 0x100e3fd
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
call fcn.0100829a
leave
ret

Function at 0x100fd69
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [0x101dad8], 0
mov eax, dword [0x101a094]
mov dword [ebp - 4], eax
jne 0x100fe57
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100fe4c
xor eax, eax
cmp dword [ebp - 0x88], 2
push esi
sete al
test eax, eax
mov dword [0x101c2e8], eax
je 0x100fe1a
push 0x1005874
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x100fe4b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1005858
push edi
call esi
test eax, eax
mov dword [0x101dac4], eax
je 0x100fdfe
mov dword [0x101c2e4], 0x4000
push 0x100584c
push edi
call esi
push 0x1005834
push edi
mov dword [0x101dac8], eax
call esi
mov dword [0x101dacc], eax
jmp 0x100fe4b
push 0x1005828
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100fe4b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1005818
push edi
call esi
push 0x1005808
push edi
mov dword [0x101dabc], eax
call esi
mov dword [0x101dac0], eax
pop esi
mov dword [0x101dad8], 1
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [0x101c2e8]
call fcn.0100829a
leave
ret
Function at 0x1010960
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x10109ad
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x1010984
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x1010ba5
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x1010bf2
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x1010bc9
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x101376e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.010136ed
test eax, eax
je 0x10137af
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push 0x100598c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8
Function at 0x10139d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x1013b0b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x1013ae0
test eax, eax
jne 0x1013ae0
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x1013a20
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x1013b0b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x1013ae0
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x1013f40
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x403a9f
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x11
mov edi, edx
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
test ax, ax
push 0x10
sets bl
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [0x41f594]
xor edx, edx
mov ecx, dword [0x41f558]
test ax, ax
sets dl
mov dword [ebp - 8], edx
cmp edi, 0x26
ja 0x403bd4
je 0x403bb9
cmp edi, 0x21
jb 0x403c88
cmp edi, 0x22
jbe 0x403b83
cmp edi, 0x23
je 0x403b47
cmp edi, 0x24
je 0x403b1e
cmp edi, 0x25
jne 0x403c88
and dword [0x41f558], 0xffffffef
dec esi
jmp 0x403bc4
mov eax, dword [0x41f558]
test ebx, ebx
je 0x403b2b
xor esi, esi
jmp 0x403b37
test al, 0x10
je 0x403b34
sub esi, 8
jmp 0x403b37
and esi, 0xfffffff8
and eax, 0xffffffef
mov dword [0x41f558], eax
mov ebx, dword [ebp - 4]
jmp 0x403c7e
test ebx, ebx
jne 0x403c4f
mov eax, dword [0x41f558]
test al, 0x10
jne 0x403c88
mov ecx, dword [0x41f560]
and esi, 0xfffffff8
mov ebx, dword [ebp - 4]
add esi, 8
cmp esi, ecx
jle 0x403b76
mov esi, ecx
jmp 0x403c7e
or eax, 0x10
mov dword [0x41f558], eax
jmp 0x403c7e
imul eax, dword [0x41f584], 0xfffffff8
mov ebx, dword [ebp - 4]
mov ecx, ebx
push 0
add esi, eax
xor eax, eax
cmp edi, 0x21
setne al
add eax, 2
push eax
call fcn.00403478
mov eax, dword [0x41f584]
mov edx, dword [ebp - 8]
lea esi, [esi + eax*8]
cmp edi, 0x21
je 0x403bc7
jmp 0x403c73
test ebx, ebx
jne 0x403c88
sub esi, 8
mov ebx, dword [ebp - 4]
test esi, esi
js 0x403c88
jmp 0x403c7e
sub edi, 0x27
je 0x403c63
sub edi, 1
je 0x403c2d
sub edi, 5
je 0x403c0e
sub edi, 1
jne 0x403c88
test ebx, ebx
jne 0x403c88
test edx, edx
je 0x403c01
push ecx
push 0x18
jmp 0x403c19
mov ecx, dword [ebp - 4]
push 0x2e
pop edx
call fcn.004041bf
jmp 0x403c88
test edx, edx
je 0x403c24
test ebx, ebx
jne 0x403c88
push ecx
push 0x16
mov ecx, dword [ebp - 4]
pop edx
call fcn.00403c95
jmp 0x403c88
test ebx, ebx
je 0x403c88
push ecx
push 3
jmp 0x403c19
test ebx, ebx
jne 0x403c88
add esi, 8
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, dword [0x41f580]
jle 0x403c6d
test cl, 0x10
je 0x403c88
mov edx, dword [ebp - 8]
mov esi, dword [0x41f560]
and ecx, 0xffffffef
mov dword [0x41f558], ecx
jmp 0x403b3f
and dword [0x41f558], 0xffffffef
inc esi
jmp 0x403c70
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov eax, dword [0x41f560]
cmp esi, eax
jle 0x403c7e
mov esi, eax
push edx
mov edx, esi
mov ecx, ebx
call fcn.00403ff4
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4042fb
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x41f598]
push esi
push edi
mov edi, dword [0x41f59c]
xor esi, esi
sub edi, edx
je 0x40437f
mov eax, dword [0x41f55c]
add eax, edx
push ecx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40437f
push ebx
lea eax, [edi + 7]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x404378
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push edi
push dword [ebp - 4]
lea eax, [esi + 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push dword [0x41f5a8]
call dword [sym.imp.USER32.dll_SetClipboardData]
xor esi, esi
inc esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x40438b
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41f558]
push ebx
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x1c], ebx
test al, 8
je 0x4043b3
and eax, 0xfffffff7
inc dword [0x41f594]
mov dword [0x41f558], eax
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404524
push dword [0x41f5a8]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40451e
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x404515
mov eax, dword [eax]
mov edi, dword [0x41f564]
push esi
mov esi, dword [0x41f560]
add eax, esi
cmp eax, edi
jle 0x404453
xor edi, edi
mov dword [ebp - 0x14], edi
cmp eax, esi
jb 0x404437
push 2
mov edi, eax
push edi
push dword [0x41f55c]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ecx, eax
test ecx, ecx
je 0x404434
mov esi, dword [0x41f560]
mov dword [0x41f55c], ecx
mov dword [0x41f564], edi
jmp 0x404459
mov edi, dword [ebp - 0x14]
push 0
push 0x10
push 0x70
push 0x76
push ebx
push dword [0x41fe14]
call fcn.0040fa08
add esp, 0x18
jmp 0x404514
mov ecx, dword [0x41f55c]
mov eax, dword [0x41f598]
cmp eax, dword [0x41f59c]
je 0x404482
push 8
pop edx
mov ecx, ebx
call fcn.004041bf
mov edi, dword [0x41f564]
mov esi, dword [0x41f560]
mov ecx, dword [0x41f55c]
mov ebx, dword [0x41f594]
mov edx, dword [ebp - 0xc]
lea eax, [ecx + ebx]
add ecx, edi
mov edx, dword [edx]
mov dword [ebp - 0x10], eax
add eax, edx
mov dword [ebp - 4], eax
mov eax, esi
sub eax, ebx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], eax
add eax, ecx
mov dword [ebp - 0x14], edx
cmp eax, dword [ebp - 8]
ja 0x4044cf
mov eax, dword [ebp - 0x18]
cmp eax, edi
jge 0x4044cf
test eax, eax
js 0x4044cf
push eax
push dword [ebp - 0x10]
push ecx
call sub.msvcrt.dll_memmove
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
ja 0x4044eb
cmp edx, edi
jae 0x4044eb
mov eax, dword [ebp - 0xc]
push edx
add eax, 4
push eax
push dword [ebp - 0x10]
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 0x14]
add esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [0x41f560], esi
mov dword [0x41f594], ebx
mov dword [0x41f598], ebx
mov dword [0x41f59c], ebx
call fcn.00403409
xor edi, edi
inc edi
pop esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x40491e
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x41f024]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x80c], 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push 0x500
push esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [0x41f5ac], eax
test eax, eax
jne 0x404a0f
push 0x428
mov ebx, 0x41f5b0
push ebx
push 0x502
push esi
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
cmp word [0x41f5b0], 0
jne 0x40498a
mov dword [0x41f5ac], 1
jmp 0x404a0f
mov eax, dword [0x461250]
push 0
push 9
push 0x110a
push dword [eax + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x461250]
push 0
push ebx
push eax
call fcn.0040a839
lea edx, [ebp - 0x80c]
mov ecx, eax
call fcn.00411bfd
test eax, eax
je 0x404a03
test edi, edi
je 0x4049ce
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push 0x400
lea eax, [ebp - 0x808]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10
lea eax, [ebp - 0x808]
push eax
push 0x94
push esi
push dword [0x41fe14]
call fcn.0040fa08
xor eax, eax
add esp, 0x14
inc eax
jmp 0x404a11
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041dc30
leave
ret