joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4269a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x426a3c
mov eax, dword [ebp - 0x1c]
sub eax, 2
mov dword [ebp - 0x20], 0
cmp eax, dword [ebp - 0x20]
jl 0x426a58
sub dword [ebp - 0x20], 1
nop
add dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x426a58
sub dx, 0x20
je 0x426a35
sub dx, 0x80
je 0x426a35
sub dx, 0x1f62
jb 0x426a58
sub dx, 1
jbe 0x426a35
sub dx, 6
je 0x426a35
sub dx, 0x26
jne 0x426a58
jmp 0x426a35
cmp eax, dword [ebp - 0x20]
jg 0x4269e8
jmp 0x426a58
cmp dword [ebp - 0x1c], 2
jne 0x426a4c
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x426a58
mov al, byte [ebp - 0xc]
call fcn.0040b210
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x426aa6
sub ax, 0x21
je 0x426ab4
sub ax, 0x17
je 0x426aba
sub ax, 0x222
je 0x426ac0
sub ax, 0x392
je 0x426ac6
sub ax, 1
je 0x426acc
sub ax, 0x1996
je 0x426ad2
sub ax, 1
je 0x426ad8
sub ax, 6
je 0x426ade
sub ax, 0xb
je 0x426aea
sub ax, 0x1b
je 0x426ae4
sub ax, 0x367
je 0x426af0
jmp 0x426af6
mov ax, word [ebp - 0x24]
call fcn.0040b280
mov byte [ebp - 0x10], al
jmp 0x426afc
mov byte [ebp - 0x10], 0x20
jmp 0x426afc
mov byte [ebp - 0x10], 0x2e
jmp 0x426afc
mov byte [ebp - 0x10], 0x27
jmp 0x426afc
mov byte [ebp - 0x10], 0x2c
jmp 0x426afc
mov byte [ebp - 0x10], 0x27
jmp 0x426afc
mov byte [ebp - 0x10], 0x20
jmp 0x426afc
mov byte [ebp - 0x10], 0x20
jmp 0x426afc
mov byte [ebp - 0x10], 0x20
jmp 0x426afc
mov byte [ebp - 0x10], 0x20
jmp 0x426afc
mov byte [ebp - 0x10], 0x2d
jmp 0x426afc
mov byte [ebp - 0x10], 0x27
jmp 0x426afc
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0x10]
leave
ret

Function at 0x437810
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x43782a
mov dword [ebx + 0xc], 0
pop ebx
leave
ret

Function at 0x44aa00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x44aa0c
mov eax, 0x5d92e0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44aa1f
and eax, 0x10
sete al
jmp 0x44aa21
mov al, 0
leave
ret

Function at 0x44aa30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x44aa3c
mov eax, 0x5d92e0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44aa4f
and eax, 0x10
seta al
jmp 0x44aa51
mov al, 0
leave
ret
Function at 0x44b050
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x44b114
mov ebx, 1
sub ebx, 1
mov esi, esi
add ebx, 1
lea eax, [ebx*4 + 0x5daabc]
mov edx, 0
call fcn.00408b30
mov dword [ebx*4 + 0x5daadc], 0xffffffff
cmp ebx, 7
jl 0x44b088
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x44b114
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0xa
call fcn.004094f0
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.00443060
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x44b114
push 4
push ebx
push esi
mov eax, 0x44af10
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x44afb0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
call fcn.0040d890
lea eax, [ebp - 0x38]
call fcn.00403b70
pop eax
test eax, eax
je 0x44b12b
call fcn.0040d9c0
pop esi
pop ebx
leave
ret

Function at 0x44b7d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x44b8d4
mov eax, dword [ebp - 0x3c]
mov edx, 0
call fcn.0040b050
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00449390
jmp 0x44b8c3
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b000
mov edx, dword [ebp - 4]
mov al, 0x3d
call fcn.0040b740
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebx - 1]
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040b690
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00449390
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.0040b500
test eax, eax
jne 0x44b8b2
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x44b894
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea eax, [ebx + 1]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0040b690
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
call fcn.0040b050
jmp 0x44b8ce
mov eax, esi
call fcn.00404060
shl eax, 1
lea eax, [esi + eax]
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x44b840
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
call fcn.0040d890
lea eax, [ebp - 0x38]
call fcn.0040ada0
lea eax, [ebp - 0x34]
call fcn.0040ada0
lea eax, [ebp - 4]
call fcn.0040ada0
lea eax, [ebp - 8]
call fcn.0040ada0
pop eax
test eax, eax
je 0x44b903
call fcn.0040d9c0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x468a10
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
mov byte [ebp - 4], al
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x468b65
cmp byte [ebp - 4], 0
je 0x468b0f
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040a830
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040a830
lea eax, [ebp - 0x44]
call fcn.0040ada0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x48]
call fcn.0040b300
mov edx, dword [ebp - 0x48]
mov ecx, 0x590600
lea eax, [ebp - 0x44]
call fcn.0040b090
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
call fcn.0040af90
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x468b0f
push 0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea ecx, [ebp - 0x4c]
mov dx, 0
call fcn.004093f0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov ecx, 0x590610
call fcn.00408c30
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x468b65
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040a830
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040a830
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
call fcn.0040abf0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00408b30
cmp byte [ebp - 4], 0
je 0x468b65
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
call fcn.0040d890
lea eax, [ebp - 0x4c]
call fcn.00403b70
lea eax, [ebp - 0x48]
call fcn.0040ada0
lea eax, [ebp - 0x44]
call fcn.0040ada0
lea eax, [ebp - 0xc]
call fcn.0040a290
lea eax, [ebp - 0x10]
call fcn.0040a290
lea eax, [ebp - 0x14]
call fcn.0040a290
pop eax
test eax, eax
je 0x468ba4
call fcn.0040d9c0
leave
ret

Function at 0x468ce0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x468d2b
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0040c330
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x468d22
mov eax, 0x5d92e0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
call fcn.0040d890
lea eax, [ebp - 0x34]
call fcn.0040ada0
pop eax
test eax, eax
je 0x468d42
call fcn.0040d9c0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x487aa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 4]
mov edi, edx
mov dword [esp], eax
lea eax, [ecx - 1]
mov esi, eax
mov ecx, 0
cmp esi, ecx
jl 0x487ae8
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov al, byte [esp]
mov dl, byte [edi]
xor dl, al
movzx eax, dl
mov ebx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ebx*4 + 0x5db120]
xor edx, eax
mov dword [esp], edx
add edi, 1
cmp esi, ecx
jg 0x487ac0
mov eax, dword [esp]
lea esp, [esp + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x4a5590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov ecx, eax
mov eax, 0
lea ebx, [ecx + 1]
movzx edx, byte [ecx]
add edx, 1
and edx, 0xff
lea edx, [ecx + edx]
jmp 0x4a55c1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor esi, ecx
mov eax, esi
add ebx, 1
cmp ebx, edx
jb 0x4a55b0
pop esi
pop ebx
ret

Function at 0x4b0db0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4b0de0
mov eax, esi
call fcn.004b5210
cmp byte [esi + 0x40], 0
je 0x4b0dd9
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4b0e78
mov dword [esi + 0x14], 0xcb
cmp dword [esi + 0x14], 0xcb
jne 0x4b0e5a
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4b0e52
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4b0e09
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4b0e1d
mov bl, 0
jmp 0x4b0e78
cmp edi, 2
je 0x4b0e52
cmp dword [esi + 8], 0
je 0x4b0dfc
cmp edi, 3
je 0x4b0e32
cmp edi, 1
jne 0x4b0dfc
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
cmp eax, dword [edx + 8]
jl 0x4b0dfc
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
jmp 0x4b0dfc
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4b0e6f
cmp dword [esi + 0x14], 0xcc
je 0x4b0e6f
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004b1160
mov eax, esi
call fcn.004b0e80
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x4ccfa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x28], 0
je 0x4ccfe8
mov eax, dword [0x563110]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x168]
cmp eax, dword [edx + 0x28]
jne 0x4ccfe8
mov eax, dword [0x563110]
cmp byte [eax + 0x114], 0
jne 0x4ccfe8
mov eax, dword [0x563530]
mov edx, dword [0x563530]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x563530]
mov edx, dword [0x563530]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x4cd0de
mov eax, dword [0x563110]
cmp byte [eax + 0x114], 0
jne 0x4cd0de
mov eax, dword [0x563530]
mov edx, dword [0x563530]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00542290
mov eax, dword [0x563110]
cmp dword [eax + 0x168], 0
je 0x4cd0a3
push 0x10
push 0
mov eax, dword [0x563110]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x563110]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x563110]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x563110]
mov eax, dword [eax + 0x168]
call fcn.004eaec0
test al, al
je 0x4cd0a3
push 0
mov eax, dword [0x563110]
call fcn.0041ec50
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x563110]
call fcn.00421a40
jmp 0x4cd175
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4cd133
mov eax, dword [ebp - 4]
mov edx, dword [0x563110]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x168]
jne 0x4cd133
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x563110]
call fcn.00421a40
jmp 0x4cd175
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4cd175
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x488], 8
je 0x4cd175
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x563530]
mov edx, dword [0x563530]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
leave
ret
Function at 0x4d1fc0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.004d09e0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.004122d0
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x5d92b0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4d2016
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, str.Window
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x4d208e
or dword [ebp - 0x30], 0x800
cmp dword [0x57ab40], 6
jb 0x4d2068
or dword [ebp - 0x30], 0x20000
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret

Function at 0x4d2f50
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4d2ffd
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x4d2ffd
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x4d2fdf
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040d890
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4d2ff9
call fcn.0040d9c0
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
leave
ret
Function at 0x4d3660
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x78]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, 1
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x4d37cb
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4d3766
lea eax, [ebp - 0x40]
call fcn.00403b70
lea eax, [ebp - 0x44]
call fcn.00403b70
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
call fcn.0046a8f0
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
call fcn.00408b30
lea eax, [ebp - 0x44]
call fcn.00403b70
lea eax, [ebp - 0x54]
call fcn.00403b70
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x10]
call fcn.0046a8a0
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x44]
call fcn.00408b30
call fcn.0046aee0
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0046c370
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4d37cb
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x4d37a9
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
call fcn.0040d890
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4d37c0
call fcn.0040d9c0
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
call fcn.0040d890
lea eax, [ebp - 0x54]
call fcn.00403b70
lea eax, [ebp - 0x44]
call fcn.00403b70
lea eax, [ebp - 0x40]
call fcn.00403b70
pop eax
test eax, eax
je 0x4d37f2
call fcn.0040d9c0
pop ebx
leave
ret
Function at 0x526c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
cmp ebx, esi
jl 0x526c8b
sub esi, 1
lea esi, [esi]
add esi, 1
push dword [ebp - 8]
push esi
mov ecx, esi
mov eax, ecx
sar eax, 0x1f
mov edx, eax
mov eax, ecx
xor eax, edx
sub eax, edx
and eax, 0x1f
mov ecx, edx
xor ecx, eax
mov eax, ecx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 4]
push dword [eax + edx*4]
push edi
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.005261c0
cmp ebx, esi
jg 0x526c50
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x542670
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
mov eax, 1
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.0040d610
call fcn.0040f200
push eax
test eax, eax
jne 0x542701
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a830
cmp dword [ebp - 0xc], 0
jbe 0x5426e0
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x5426d4
mov eax, 0x5d92e0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a830
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040afc0
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
call fcn.0042b250
call fcn.0040d890
lea eax, [ebp - 0x3c]
call fcn.0040ada0
lea eax, [ebp - 0x10]
call fcn.0040a290
pop eax
test eax, eax
je 0x542720
call fcn.0040d9c0
leave
ret
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x10
mov edi, edi
movzx edi, byte [ecx]
xor ebx, ebx
movzx edx, ax
mov bh, al
shr edx, 8
xor edx, edi
xor bx, word [edx*2 + 0x100181d0]
inc ecx
dec esi
mov eax, ebx
jne 0x10001010
pop edi
not eax
pop esi
mov byte [ecx], ah
mov byte [ecx + 1], al
pop ebx
ret

Function at 0x10001400
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [esp + 0x224]
push esi
push edi
mov edi, eax
mov ecx, 0x20
jmp 0x10001420
mov byte [eax], 0
add eax, 0x104
dec ecx
jne 0x10001420
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
xor esi, esi
mov al, byte [esp + 0x230]
test al, al
push esi
je 0x10001495
lea eax, [esp + 0x1c]
push 0x10018418
push eax
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
lea eax, [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100014d6
push eax
push eax
push 0x104
push edi
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
push ecx
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x100014c6
lea edx, [esp + 0x18]
push 0x10018414
push edx
mov dword [esp + 0x1c], 0x104
call ebx
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100014d6
inc esi
add edi, 0x104
cmp esi, 0x20
jl 0x10001433
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret

Function at 0x100014f0
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x218
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push ebp
mov ebp, dword [esp + 0x224]
push esi
push edi
xor edi, edi
mov esi, eax
jmp 0x10001510
push edi
lea eax, [esp + 0x14]
push 0x10018414
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov al, byte [esi]
add esp, 0xc
test al, al
je 0x100015a2
mov al, byte [esp + 0x230]
test al, al
je 0x10001586
push edi
lea ecx, [esp + 0x18]
push 0x10018418
push ecx
call ebx
add esp, 0xc
push 0x105
lea edx, [esp + 0x20]
push edx
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x20]
push edx
push 1
push 0
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100015ae
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push 0
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100015ae
lea edx, [esp + 0x10]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc edi
add esi, 0x104
cmp edi, 0x20
jl 0x10001510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret