joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447e0c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x447e23
add esp, 0xfffffff0
call fcn.0047a328
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0046c518
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x4661f0]
call fcn.00479ff8
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4661f0]
call fcn.00479ff8
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], Ordinal_26
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x435200]
call fcn.0043cb94
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x447f98
mov eax, dword [0x492bbc]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0043cf64
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x449924
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x492bbc]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00476684
test eax, eax
je 0x447f16
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0047387c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004766ac
test eax, eax
je 0x447f2a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.0047acc8
mov eax, dword [0x492bc0]
cmp byte [eax], 0
jne 0x447f5b
mov eax, ebx
call fcn.00448084
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x447f8d
call fcn.0047a380
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4482f4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x492f0c]
cmp dword [eax + 0x24], 0
je 0x448397
cmp dword [ebx + 0x84], 0
jne 0x448391
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x448284
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x448391
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x44835a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x448391
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.004678ec
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x448369
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x448da4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x448dd9
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0047ab80
jmp 0x448de3
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.0047aaec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x449c98
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x449cd0
mov eax, esi
call fcn.00458688
test al, al
je 0x449cd0
mov eax, dword [ebx + 0x74]
call fcn.0045838c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x449cd0
push 0
mov eax, dword [ebx + 0x74]
call fcn.0045838c
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x450050
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x492fa8], 0
sete dl
or al, dl
jne 0x450190
mov eax, dword [0x492fac]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x492fa8]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x45015f
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x492fa8]
call fcn.004678ec
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x450157
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x450157
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x450157
mov eax, dword [ebp - 0x14]
call fcn.0045838c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x450157
push ebp
call fcn.0045000c
pop ecx
test al, al
jne 0x450157
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x450113
mov eax, dword [ebp - 0x14]
call fcn.00456d18
dec eax
jle 0x450157
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.0047a204
cmp byte [ebp - 1], 0
je 0x450157
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x450157
mov edx, dword [ebp - 0x14]
mov eax, dword [0x492fac]
call fcn.0044f858
inc edi
dec esi
jne 0x4500a6
mov eax, dword [0x492fac]
cmp dword [eax + 8], 0
jle 0x450177
mov eax, dword [0x492fac]
call fcn.0044f8e8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x450190
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044fe74
pop ecx
test al, al
jne 0x450190
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455d24
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x455d55
je 0x455daf
sub eax, 7
je 0x455d76
dec eax
je 0x455da0
sub eax, 0x17
je 0x455e54
jmp 0x455e92
add eax, 0xffffff00
sub eax, 9
jb 0x455e40
add eax, 0xffffff09
sub eax, 0xb
jb 0x455e08
jmp 0x455e92
mov eax, ebx
call fcn.00440960
mov edi, eax
test edi, edi
je 0x455ef2
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x455efb
jmp 0x455ef2
test byte [ebx + 0x44], 0x20
jne 0x455efb
jmp 0x455ef2
mov edx, esi
mov eax, ebx
call fcn.00453324
cmp dword [esi + 0xc], 0xffffffff
jne 0x455efb
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00471204
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00451e58
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00455bfc
test eax, eax
je 0x455efb
mov dword [esi + 0xc], 1
jmp 0x455efb
mov edx, esi
mov eax, ebx
call fcn.00455c90
test al, al
je 0x455ef2
cmp dword [esi + 0xc], 0
jne 0x455efb
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0045838c
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x455efb
mov eax, ebx
call fcn.004529c0
test al, al
jne 0x455efb
jmp 0x455ef2
mov eax, ebx
call fcn.0045838c
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x455ef2
cmp dword [0x48ea34], 0
je 0x455ef2
mov eax, dword [0x48ea34]
cmp ebx, dword [eax + 0x24]
jne 0x455ef2
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x48ea34]
call fcn.00453258
jmp 0x455ef2
mov eax, dword [0x492f70]
cmp byte [eax + 0x20], 0
je 0x455ef2
mov eax, dword [0x492f70]
cmp dword [eax + 0x1c], 0
je 0x455ef2
mov eax, dword [esi]
mov edx, dword [0x492f70]
cmp eax, dword [edx + 0x1c]
jne 0x455ef2
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.004408a4
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.0047a204
jmp 0x455efb
mov edx, esi
mov eax, ebx
call fcn.00453324
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4563bc
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4563d8
cmp dword [esi + 4], 0
je 0x456405
test byte [ebx + 0x45], 1
jne 0x4563f7
mov eax, ebx
call fcn.004552f4
test eax, eax
jne 0x4563f7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x456515
mov edx, esi
mov eax, ebx
call fcn.00456034
jmp 0x456515
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45650e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0045838c
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00453258
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004563bc
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0045838c
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456515
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45efd8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f0b0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x492ff4], 0
jne 0x45f094
lea eax, [ebp - 4]
mov edx, 0x45f0c8
call fcn.0047ab30
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0047aedc
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x45f094
mov eax, ebx
call fcn.0047984c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45f08d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x45f077
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45f0d8
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x45f077
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x492ff4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f094
mov eax, dword [ebp - 0xc]
call fcn.00479864
ret
mov ebx, dword [0x492ff4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f0b7
lea eax, [ebp - 4]
call fcn.0047aa98
ret

Function at 0x464bf0
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x493018], 0
jne 0x464c13
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x464b74
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x493018], eax
ret

Function at 0x465540
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x465594
mov eax, dword [0x492828]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x46556c
push ebx
push 0x46559c
call fcn.00440738
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.USER32.DLL_OpenClipboard
test eax, eax
jne 0x465590
mov ecx, dword [0x492c20]
mov dl, 1
mov eax, dword [0x4724c8]
call fcn.00475a04
call fcn.0047a760
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret

Function at 0x4655bc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00465540
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46562e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x465602
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.0047ac50
jmp 0x465609
mov eax, ebx
call fcn.0047aa98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465635
cmp dword [ebp - 8], 0
je 0x465625
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.00465514
ret
Function at 0x46563c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00465540
xor edx, edx
push ebp
push 0x4656de
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4656b1
mov edx, ebx
mov eax, dword [0x434e1c]
call fcn.00439474
test al, al
je 0x4656a1
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00439384
call fcn.0047a800
jmp 0x4656e5
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x46566c
mov ecx, dword [0x492c24]
mov dl, 1
mov eax, dword [0x4724c8]
call fcn.00475a04
call fcn.0047a760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4656e5
mov eax, dword [ebp - 4]
call fcn.00465514
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4656ec
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00465540
xor eax, eax
push ebp
push 0x465744
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46574b
mov eax, dword [ebp - 4]
call fcn.00465514
ret

Function at 0x465754
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00465540
xor edx, edx
push ebp
push 0x4657a9
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4657b0
mov eax, dword [ebp - 4]
call fcn.00465514
ret

Function at 0x465820
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00465540
xor eax, eax
push ebp
push 0x465895
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004654f8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00439448
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x46587f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46589c
mov eax, dword [ebp - 4]
call fcn.00465514
ret
Function at 0x4658a4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00465540
xor eax, eax
push ebp
push 0x465919
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004654f8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x465903
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465920
mov eax, dword [ebp - 4]
call fcn.00465514
ret

Function at 0x475154
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x47518d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0047ab80
jmp 0x475196
mov eax, ebx
mov edx, esi
call fcn.0047aaec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4751a0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4751c1
mov al, byte [esp]
jmp 0x4751c3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x479af0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x479b1f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0047ab80
jmp 0x479b3d
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00479a18
mov edi, eax
test ebx, ebx
je 0x479b3d
cmp dword [esi], 0
je 0x479b3d
dec ebx
jmp 0x479b26
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x479ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48ee94]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x479f38
push reloc.NVCLIENT.DLL_Ordinal_2
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x479f18
xor eax, eax
push ebp
push 0x479f11
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x479f54
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479f18
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x48ee94]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48ee94], ax
mov esp, ebp
pop ebp
ret
Function at 0x47c010
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x47c1cc
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x47c071
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x47c1e8
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x47c0e3
xor eax, eax
push ebp
push 0x47c0dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0047be68
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x47c0c5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x47c208
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c0e3
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x47c1c4
cmp byte [ebp - 0xd], 0
jne 0x47c125
cmp byte [ebp - 0x12], 0
je 0x47c1c4
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x47c13e
dec ebx
cmp byte [ebx], 0x2e
je 0x47c14d
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x47c13d
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x47c1c4
inc ebx
cmp byte [ebp - 0x12], 0
je 0x47c17a
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x47c1c4
cmp byte [ebp - 0xd], 0
je 0x47c1c4
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x47c1c4
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret