joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4112cc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push 0x52ffb0
push 0x3e7
push 0x543bd3
push str.MS_Sans_Serif_8
push dword [ebp + 0xc]
push 0x529144
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 1
push 0x2c
push 0x543bd3
call fcn.0051833c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x411387
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x411364
push 0x2c
push ebx
call fcn.0051833c
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41135a
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
cmp byte [edx], 0
je 0x41135a
push dword [ebp - 0x1c]
call fcn.0052175c
pop ecx
mov dword [ebp - 0xc], eax
push ebx
call fcn.0052175c
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x411371
mov dword [ebp - 4], 8
cmp dword [ebp - 4], 0x64
jle 0x4113ae
sub dword [ebp - 4], 0x64
add dword [ebp - 8], 0x64
cmp dword [ebp - 4], 0x64
jg 0x411377
jmp 0x4113ae
push esi
push edi
mov esi, 0x52915c
mov edi, 0x543bd3
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
mov dword [ebp - 4], 8
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x14], 0
je 0x4113d8
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 0x543bd3
push esi
call fcn.004689ea
test eax, eax
jne 0x4113d8
mov eax, edi
jmp 0x41149e
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push 0x543bd3
push 0
push 0
push 0
push 0
push dword [ebp - 0xc]
push 0
push 0
push 0
push dword [ebp - 8]
push 0
push 0
push 0
mov edx, dword [ebp - 4]
neg edx
push edx
call sub.GDI32.dll_CreateFontA
mov ebx, eax
test ebx, ebx
je 0x411436
test edi, edi
je 0x411424
push edi
call sub.GDI32.dll_DeleteObject
push 0
push ebx
push 0x30
push 0x12c
push esi
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x411438
mov ebx, edi
cmp dword [ebp + 0x14], 0
je 0x411476
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
push eax
push 0x543bd3
push 0x52916b
push 0x5437ec
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 0x52ffb0
push 0x5437ec
push dword [ebp + 0xc]
push 0x529175
call fcn.00486c04
push 1
push 0
push 0x12c
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_InvalidateRect
push 0x12c
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4124ac
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x5291d4
push 0
call fcn.004f7814
mov esi, eax
mov dword [ebx], esi
test esi, esi
je 0x412601
mov esi, str._mdi
mov edi, 0x5291d8
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
add edx, 4
mov esi, edx
mov edi, 0x5291d8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov edx, dword [0x537424]
mov dword [eax], edx
mov byte [eax + 0x638], 9
mov dword [eax + 0x768], 2
mov byte [eax + 0x655], 1
xor ecx, ecx
mov dword [eax + 0x770], ecx
xor edx, edx
mov dword [eax + 0x754], edx
xor ecx, ecx
mov dword [eax + 0x750], ecx
xor edx, edx
mov dword [eax + 0x76c], edx
push 0x52ffb0
push 0x3e7
push 0x55219c
push 0x5291fa
add eax, 4
push eax
push 0x5291ee
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x55219c], 0
je 0x4125df
push 0x2c
push 0x55219c
call fcn.005186c4
add esp, 8
mov esi, eax
test esi, esi
je 0x4125b1
mov byte [esi], 0
inc esi
cmp byte [esi], 0
je 0x4125b1
push esi
call fcn.0052175c
pop ecx
mov edx, dword [ebx]
mov dword [edx + 0x768], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x768]
test eax, eax
jl 0x4125a9
cmp eax, 4
jle 0x4125b1
xor ecx, ecx
mov dword [edx + 0x768], ecx
push 0x55219c
call fcn.00416498
push 0x55219c
mov eax, dword [ebx]
push dword [eax]
call fcn.0041364e
test eax, eax
je 0x4125df
push dword [ebx]
call fcn.004542bc
mov edx, dword [ebx]
push dword [edx]
call sub.USER32.dll_UpdateWindow
jmp 0x412601
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x770], edx
xor ecx, ecx
mov dword [eax + 0x754], ecx
xor edx, edx
mov dword [eax + 0x750], edx
xor ecx, ecx
mov dword [eax + 0x76c], ecx
pop edi
pop esi
pop ebx
ret
Function at 0x412605
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x54440c
mov eax, dword [0x5291d4]
test eax, eax
je 0x412624
cmp eax, ebx
je 0x41280e
push ebx
call fcn.004f7de3
test eax, eax
je 0x41280e
cmp byte [ebx + 0x638], 1
jne 0x412660
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x529214
push 0x52920a
push 0x5291fe
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4126d0
cmp byte [ebx + 0x638], 2
jne 0x41280e
mov al, byte [ebx + 0x639]
cmp al, 1
je 0x41267b
cmp al, 3
jne 0x4126a0
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x52922c
push 0x529224
push 0x529218
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4126d0
cmp byte [ebx + 0x639], 4
jne 0x41280e
push 0x52ffb0
push 0x3e7
push 0x555704
push 0x529243
push 0x52923c
push 0x529230
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor edx, edx
mov dword [0x544410], edx
push 0x2c
push 0x555704
call fcn.005186c4
add esp, 8
mov ebx, eax
mov dword [0x544408], ebx
test ebx, ebx
je 0x412729
mov byte [ebx], 0
inc dword [0x544408]
mov ebx, dword [0x544408]
cmp byte [ebx], 0
je 0x412729
push ebx
call fcn.0052175c
pop ecx
mov dword [0x544410], eax
mov eax, dword [0x544410]
test eax, eax
jl 0x412721
cmp eax, 5
jle 0x412729
xor edx, edx
mov dword [0x544410], edx
mov ebx, dword [0x537418]
test ebx, ebx
je 0x41280e
push 0
push dword [ebx]
call sub.USER32.dll_GetSystemMenu
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x412800
push 0
push 0x64
push 0x555aeb
push 0xb0
push esi
call sub.USER32.dll_GetMenuStringA
test eax, eax
jle 0x412800
cmp byte [0x555704], 0
je 0x4127d9
cmp dword [ebx + 0x76c], 0
jne 0x41278a
push 0
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x412800
push 0x555704
call fcn.00416498
push dword [ebx + 0x76c]
push 0x555704
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4127c9
mov eax, dword [ebx + 0x768]
cmp eax, dword [0x544410]
jne 0x4127c9
push 8
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x412800
push 0
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x412800
cmp dword [ebx + 0x76c], 0
jne 0x4127f2
push 8
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
jmp 0x412800
push 0
push 0xb0
push dword [edi]
call sub.USER32.dll_CheckMenuItem
mov ebx, dword [ebx + 0x9a8]
test ebx, ebx
jne 0x412737
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x415f93
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x415fa4
cmp byte [ebx], 0
jne 0x415fab
xor eax, eax
jmp 0x41615a
mov dword [0x54463c], 0xffffffff
push 0x2e
push ebx
call fcn.0051833c
add esp, 8
mov esi, eax
mov dword [0x544638], esi
test esi, esi
je 0x415fcf
mov byte [esi], 0
push 0x529474
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
je 0x416139
push 0x529479
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
je 0x416139
push 0x52947e
push ebx
call fcn.005185a0
add esp, 8
test eax, eax
je 0x416139
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 0
push 0
push 3
push 0
push 0
push 0
push ebx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
mov dword [0x544650], esi
cmp esi, 0xffffffff
je 0x41605d
push esi
call sub.KERNEL32.dll_GetFileType
mov dword [0x544654], eax
push dword [0x544650]
call sub.KERNEL32.dll_CloseHandle
test byte [0x544654], 2
jne 0x416139
push 0
call sub.KERNEL32.dll_SetErrorMode
push 0xa
push 0x544640
push ebx
call sub.KERNEL32.dll_QueryDosDeviceA
test eax, eax
jne 0x416139
push 0x544614
push ebx
call fcn.0051ef24
add esp, 8
test eax, eax
jne 0x4160ba
movsx eax, word [0x544618]
sub eax, 0x1000
je 0x416139
sub eax, 0x1000
je 0x416139
sub eax, 0x1000
je 0x416139
sub eax, 0xc000
je 0x416139
push 0
push 0
push ebx
call fcn.0051e680
add esp, 0xc
mov esi, eax
mov dword [0x54463c], esi
cmp esi, 0xffffffff
je 0x416119
push esi
call fcn.0051c380
pop ecx
test eax, eax
jne 0x416139
push 0x544614
push dword [0x54463c]
call fcn.0051e848
add esp, 8
test eax, eax
jne 0x416119
movsx eax, word [0x544618]
sub eax, 0x1000
je 0x416139
sub eax, 0x1000
je 0x416139
sub eax, 0x1000
je 0x416139
sub eax, 0xc000
je 0x416139
mov eax, dword [0x54463c]
test eax, eax
jl 0x416129
push eax
call fcn.0051b824
pop ecx
mov eax, dword [0x544638]
test eax, eax
je 0x416135
mov byte [eax], 0x2e
xor eax, eax
jmp 0x41615a
mov eax, dword [0x54463c]
test eax, eax
jl 0x416149
push eax
call fcn.0051b824
pop ecx
mov eax, dword [0x544638]
test eax, eax
je 0x416155
mov byte [eax], 0x2e
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x416273
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x416288
cmp byte [ebx], 0
jne 0x416292
xor eax, eax
jmp 0x41642a
mov byte [esi], 0x5c
push 0x2f
push ebx
call fcn.0051833c
add esp, 8
mov esi, eax
mov dword [0x544680], esi
test esi, esi
jne 0x41628f
push 0x529492
push ebx
call fcn.00518698
add esp, 8
test eax, eax
je 0x4162c2
xor eax, eax
jmp 0x41642a
push edi
mov esi, 0x545820
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push 0x545820
call fcn.005183dc
pop ecx
mov ebx, eax
mov dword [0x544688], ebx
test ebx, ebx
jg 0x416306
xor eax, eax
jmp 0x41642a
mov edx, dword [0x544688]
cmp byte [edx + 0x54581f], 0x5c
jne 0x416330
mov ecx, dword [0x544688]
mov byte [ecx + 0x545820], 0x2e
mov eax, dword [0x544688]
mov byte [eax + 0x545821], 0
jmp 0x416358
mov edx, dword [0x544688]
cmp byte [edx + 0x54581f], 0x3a
jne 0x416358
mov ecx, dword [0x544688]
mov byte [ecx + 0x545820], 0x5c
mov eax, dword [0x544688]
mov byte [eax + 0x545821], 0
cmp dword [0x532a54], 0
je 0x416391
push 0
push 0x54468c
push 0
push 0
push 0x545820
call fcn.0051d600
add esp, 0x14
push 0x54468c
call fcn.00415f93
test eax, eax
je 0x416391
mov eax, 1
jmp 0x41642a
xor edx, edx
mov dword [0x544684], edx
cmp dword [0x532a54], 0
je 0x4163d0
test edi, 2
je 0x4163d0
push 0x545820
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
mov dword [0x54478c], ebx
cmp ebx, 0xffffffff
je 0x4163d0
test bl, 0x10
je 0x4163d0
mov dword [0x544684], 1
cmp dword [0x544684], 0
jne 0x416425
push 0x54465c
push 0x545820
call fcn.0051ef24
add esp, 8
test eax, eax
jne 0x416425
test edi, 1
je 0x41640a
test byte [0x544661], 0x80
je 0x41640a
mov dword [0x544684], 1
test edi, 2
je 0x416425
test byte [0x544661], 0x40
je 0x416425
mov dword [0x544684], 1
mov eax, dword [0x544684]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41686d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [0x558244], 0
jne 0x41689b
push 0x53747c
push dword [0x537420]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.004f181f
jmp 0x416919
push 0x558244
push 0x53747c
push 0x5294f2
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0xf
push ebx
call fcn.004e51c7
push dword [0x537420]
call sub.USER32.dll_GetWindowTextLengthA
mov edi, eax
push ebx
call fcn.005183dc
pop ecx
cmp edi, eax
jne 0x416906
push 0x3b5
push esi
push dword [0x537420]
call sub.USER32.dll_GetWindowTextA
mov eax, ebx
mov edx, esi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x416906
test cl, cl
je 0x416904
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x416906
add eax, 2
add edx, 2
test cl, cl
jne 0x4168e8
je 0x416919
push ebx
push dword [0x537420]
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.004f181f
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x416a64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x52feac
push 0
push ebx
push 0x529523
push dword [0x537420]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x416aa2
push 0
call sub.KERNEL32.dll_SetErrorMode
mov eax, 1
jmp 0x416b11
push 0
call sub.KERNEL32.dll_SetErrorMode
push 0x5447a0
push ebx
call fcn.0051ef24
add esp, 8
test eax, eax
je 0x416ac3
xor edx, edx
mov dword [0x5447b2], edx
cmp dword [0x5447b2], 0xe678
jle 0x416ae4
push ebx
push str.write.exe__s
push 0x55219c
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x416af7
push ebx
push str.notepad.exe__s
push 0x55219c
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xa
push 0x55219c
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jae 0x416b0c
xor eax, eax
jmp 0x416b11
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x416b16
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x5447c4
push dword [0x537420]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x416b3a
xor eax, eax
jmp 0x416cd7
xor edx, edx
mov dword [0x5447c8], edx
cmp dword [ebp + 0xc], 1
jne 0x416bec
push 1
call sub.USER32.dll_GetClipboardData
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x416bec
push esi
call sub.KERNEL32.dll_GlobalLock
mov dword [0x5447cc], eax
cmp dword [0x5447cc], 0
je 0x416be5
push dword [0x5447cc]
call fcn.005183dc
pop ecx
mov esi, eax
push ebx
call fcn.005183dc
pop ecx
add esi, eax
add esi, 5
push esi
call fcn.00524378
pop ecx
mov dword [0x5447c8], eax
cmp dword [0x5447c8], 0
je 0x416be5
mov eax, dword [0x5447c8]
mov edx, dword [0x5447cc]
push edi
mov esi, eax
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
push dword [0x5447c8]
call fcn.00518300
add esp, 8
mov ebx, dword [0x5447c8]
push dword [edi]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_EmptyClipboard
test eax, eax
jne 0x416c11
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x5447c8]
test eax, eax
je 0x416c0a
push eax
call fcn.00524270
pop ecx
xor eax, eax
jmp 0x416cd7
push ebx
call fcn.005183dc
pop ecx
add eax, 0xa
push eax
push 0x2042
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
mov dword [edi], esi
test esi, esi
jne 0x416c4a
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x5447c8]
test eax, eax
je 0x416c43
push eax
call fcn.00524270
pop ecx
xor eax, eax
jmp 0x416cd7
push dword [edi]
call sub.KERNEL32.dll_GlobalLock
mov esi, eax
mov dword [0x5447cc], esi
test esi, esi
jne 0x416c84
push dword [edi]
call sub.KERNEL32.dll_GlobalUnlock
push dword [edi]
call sub.KERNEL32.dll_GlobalFree
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x5447c8]
test eax, eax
je 0x416c80
push eax
call fcn.00524270
pop ecx
xor eax, eax
jmp 0x416cd7
mov edx, dword [0x5447cc]
push edi
mov esi, edx
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push dword [edi]
push 1
call sub.USER32.dll_SetClipboardData
push dword [edi]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x5447c8]
test eax, eax
je 0x416cd2
push eax
call fcn.00524270
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x416e0c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
je 0x416ed5
cmp dword [ebp - 0x84], 0
jne 0x416e51
mov esi, 0x529550
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
jmp 0x416ef6
cmp dword [ebp - 0x84], 1
jne 0x416ea8
cmp dword [ebp - 0x90], 4
jne 0x416e7a
cmp dword [ebp - 0x8c], 0x5a
jb 0x416e7a
mov esi, 0x529555
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x416ef6
cmp dword [ebp - 0x90], 4
jne 0x416e9a
cmp dword [ebp - 0x8c], 1
jb 0x416e9a
mov esi, 0x529559
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x416ef6
mov esi, 0x52955d
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x416ef6
cmp dword [ebp - 0x84], 2
jne 0x416ed5
cmp dword [ebp - 0x90], 5
jb 0x416ec7
mov esi, str.2000
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x416ef6
mov esi, 0x529567
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x416ef6
cmp dword [0x532a54], 0
je 0x416eec
mov esi, 0x52956b
mov edi, ebx
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x416ef6
mov esi, 0x52956f
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417385
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, 0x544808
mov edi, 0x544804
push dword [0x537420]
call sub.USER32.dll_OpenClipboard
test eax, eax
jne 0x4173ae
xor eax, eax
jmp 0x417557
xor edx, edx
mov dword [edi], edx
push 1
call sub.USER32.dll_GetClipboardData
mov dword [0x544810], eax
cmp dword [0x544810], 0
je 0x41749b
push dword [0x544810]
call sub.KERNEL32.dll_GlobalLock
mov dword [0x544814], eax
cmp dword [0x544814], 0
je 0x41749b
push 0xa
push dword [0x544814]
call fcn.0051833c
add esp, 8
mov dword [esi], eax
cmp dword [esi], 0
je 0x417404
mov ecx, dword [esi]
mov byte [ecx], 0
push 0x3b5
push dword [0x544814]
push ebx
call fcn.005185e8
add esp, 0xc
mov byte [ebx + 0x3b5], 0
push 0xd
push ebx
call fcn.0051833c
add esp, 8
mov dword [0x54480c], eax
cmp dword [0x54480c], 0
je 0x417440
mov eax, dword [0x54480c]
mov byte [eax], 0
push 0
push 0
push ebx
push dword [edi]
call fcn.0049d9f0
mov dword [0x544800], eax
cmp dword [0x544800], 0
jne 0x417463
push dword [edi]
call fcn.0049dfbe
jmp 0x417490
mov edx, dword [0x544800]
mov dword [edi], edx
mov eax, dword [esi]
test eax, eax
je 0x417490
mov byte [eax], 0xa
inc dword [esi]
mov edx, dword [esi]
cmp byte [edx], 0xd
jne 0x41747f
inc dword [esi]
mov eax, dword [esi]
cmp byte [eax], 0
je 0x417490
mov dword [0x544814], eax
jmp 0x4173e8
push dword [0x544810]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [edi], 0
jne 0x4174ac
xor eax, eax
jmp 0x417557
mov edx, dword [ebp + 8]
cmp byte [edx], 0
jne 0x4174ef
mov dword [0x54481c], 1
push dword [0x54481c]
push 0x52feac
push str._splayq_d.txt
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push dword [ebp + 8]
call fcn.00416273
test eax, eax
je 0x4174ef
inc dword [0x54481c]
jmp 0x4174be
push 0
push 0x5295bc
push dword [ebp + 8]
call fcn.0051e654
add esp, 0xc
mov esi, eax
mov dword [0x544818], esi
test esi, esi
jne 0x417540
push dword [edi]
call fcn.0049dfbe
xor eax, eax
jmp 0x417557
push dword [eax]
push 0x5295bf
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x544818]
push ebx
call fcn.0051c050
add esp, 8
push dword [edi]
call fcn.0049dcbd
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
jne 0x417518
push dword [0x544818]
call fcn.0051b82c
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x417745
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x18], 0xffffffff
je 0x4178e1
cmp dword [ebp + 0x14], 0
je 0x4177cf
cmp dword [ebp + 0x10], 0
jne 0x4177cf
push 5
push 0x84
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
lea eax, [ebp - 0x1c]
push eax
push 0x84
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_GetWindowRect
push 2
lea edx, [ebp - 0x1c]
push edx
push dword [ebp + 8]
push 0
call sub.USER32.dll_MapWindowPoints
mov eax, dword [ebp - 0x1c]
mov esi, eax
add esi, 0xfffffffb
mov edx, dword [ebp - 0x18]
mov edi, edx
add edi, 0xfffffff6
mov ecx, dword [ebp - 0x14]
sub ecx, eax
add ecx, 0xa
mov dword [ebp + 0x24], ecx
mov eax, dword [ebp - 0x10]
sub eax, edx
add eax, 0x13
mov dword [ebp + 0x28], eax
push 0x10
call sub.USER32.dll_GetSysColor
push eax
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [ebp - 4], eax
push dword [ebp - 4]
push ebx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0
lea edx, [edi - 1]
push edx
lea eax, [esi - 1]
push eax
push ebx
call sub.GDI32.dll_MoveToEx
lea edx, [edi - 1]
push edx
mov ecx, dword [ebp + 0x24]
add ecx, esi
push ecx
push ebx
call sub.GDI32.dll_LineTo
mov eax, dword [ebp + 0x28]
add eax, edi
push eax
mov edx, dword [ebp + 0x24]
add edx, esi
push edx
push ebx
call sub.GDI32.dll_LineTo
mov ecx, dword [ebp + 0x28]
add ecx, edi
push ecx
lea eax, [esi - 1]
push eax
push ebx
call sub.GDI32.dll_LineTo
lea edx, [edi - 1]
push edx
lea ecx, [esi - 1]
push ecx
push ebx
call sub.GDI32.dll_LineTo
push dword [ebp - 0xc]
push ebx
call sub.GDI32.dll_SelectObject
push dword [ebp - 4]
call sub.GDI32.dll_DeleteObject
push 0x14
call sub.USER32.dll_GetSysColor
push eax
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [ebp - 8], eax
push dword [ebp - 8]
push ebx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0
lea eax, [edi - 1]
push eax
mov edx, dword [ebp + 0x24]
add edx, esi
inc edx
push edx
push ebx
call sub.GDI32.dll_MoveToEx
mov ecx, dword [ebp + 0x28]
add ecx, edi
inc ecx
push ecx
mov eax, dword [ebp + 0x24]
add eax, esi
inc eax
push eax
push ebx
call sub.GDI32.dll_LineTo
mov edx, dword [ebp + 0x28]
add edx, edi
inc edx
push edx
lea ecx, [esi - 1]
push ecx
push ebx
call sub.GDI32.dll_LineTo
cmp dword [ebp + 0x10], 0
jne 0x4178d0
push 0
mov eax, dword [ebp + 0x28]
add eax, edi
push eax
push esi
push ebx
call sub.GDI32.dll_MoveToEx
push edi
push esi
push ebx
call sub.GDI32.dll_LineTo
push edi
add esi, dword [ebp + 0x24]
push esi
push ebx
call sub.GDI32.dll_LineTo
push dword [ebp - 0xc]
push ebx
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
call sub.GDI32.dll_DeleteObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24