joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73b3ab
Capabilities:
Encode data using base64

Disassembly:
call fcn.0073b1cd
jmp 0x73b3c7
lea esp, [esp + 4]
jmp 0x73b587
jmp 0x73b3ff
jmp 0x73b41b
push ebp
jmp 0x73b437
jmp 0x73b453
mov ebp, esp
jmp 0x73b46f
jmp 0x73b48b
movzx eax, byte [ecx]
jmp 0x73b4a7
jmp 0x73b4c3
shl eax, 0x10
jmp 0x73b4df
jmp 0x73b4fb
cmp dword [ebp + 0xc], 2
jmp 0x73b533
jmp 0x785397
jmp 0x73b54f
jb 0x73b517
jae 0x73b56b
push ecx
add dword [edi + 0x2e4bdb55], ebp
fnstsw word [edx]
aam 0x5b
retf
jmp 0x783e3a
jmp 0x73b3e3
jmp 0x73b3a6
movzx edx, byte [ecx + 1]
jmp 0x78462f
shl edx, 8
jmp 0x784655
or eax, edx
jmp 0x73b517
cmp dword [ebp + 0xc], 3
jne 0x7847be
and eax, edx
mov ebx, eax
jmp 0x78470f
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jge 0x78472c
add byte [ebp + 0x6a], bh
hlt
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jae 0x7847f0
jb 0x784834
jg 0x7846b6
jb 0x7846f1
in al, 0x63
daa
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
jg 0x7846bf
pop edi
iretd
cmp ecx, 0x34
jae 0x784733
lea edx, [ecx + 0x47]
jmp 0x7846c4
push 0x3e
pop eax
cmp ecx, 0x1a
jae 0x7846ec
lea edx, [ecx + 0x41]
jmp 0x7846c4
mov esp, 0x1066975e
invalid
cmp ecx, eax
jae 0x7847a0
lea edx, [ecx - 4]
jmp 0x7846c4
xor edx, edx
cmp ecx, eax
jmp 0x784821
mov ebx, dword [ebp + 0xc]
jmp 0x78470f
cmp esi, 0x34
jae 0x784892
lea ecx, [esi + 0x47]
jmp 0x78498d
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0x7846c4
lea ecx, [esi + 0x41]
jmp 0x78498d
xor ecx, ecx
cmp esi, eax
jmp 0x7848da
cmp esi, eax
jae 0x784874
lea ecx, [esi - 4]
jmp 0x78498d
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x78498d
mov byte [edx + 2], 0x3d
jmp 0x784d67
cmp edi, 0x34
jmp 0x784a20
mov byte [edx + 2], cl
jmp 0x784d67
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jb 0x7848fe
cmp edi, 0x1a
jae 0x784954
lea ecx, [edi + 0x41]
jmp 0x784970
cmp edi, eax
jae 0x784a2b
lea ecx, [edi - 4]
jmp 0x784970
jae 0x7849be
lea ecx, [edi + 0x47]
jmp 0x784970
xor ecx, ecx
cmp edi, eax
setne cl
jmp 0x784dde
mov edi, dword [ebp + 0xc]
jmp 0x784684
cmp ebx, eax
jae 0x784b23
lea ecx, [ebx - 4]
jmp 0x784afa
mov byte [edx + 3], cl
jmp 0x784b3c
cmp ebx, 0x34
jae 0x784acc
lea ecx, [ebx + 0x47]
jmp 0x784afa
xor ecx, ecx
cmp ebx, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x784afa
pop edi
pop esi
jmp 0x784b8f
mov byte [edx + 3], 0x3d
jmp 0x784b3c
pop ebx
pop ebp
ret
cmp dword [ebp + 0xc], 3
jne 0x784b59
cmp ebx, 0x1a
jae 0x784b19
lea ecx, [ebx + 0x41]
jmp 0x784afa
lea ecx, [ecx*4 + 0x2b]
jmp 0x784970
push ebx
push esi
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0x784a7e
mov edi, eax
shr edi, 6
and edi, edx
jmp 0x784684
cmp dword [ebp + 0xc], 3
jne 0x785184
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x785184

Function at 0x73c1ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x785c9c
lea esp, [esp + 4]
jmp fcn.00785d7a
Function at 0x73d56f
Capabilities:
Get storage device properties

Disassembly:
jmp 0x73d50b
lea esp, [esp + 4]
jmp 0x73d527
jmp 0x73d543
push 0x3746c6
jmp 0x73d55f
push edi
int3
call fcn.0074dfa6
pushal
pop es
inc ebp
jl 0x73d54a
jbe 0x73d57d
loopne 0x73d5b7
add bl, ch
sbb dl, byte [esi - 0x5b]
adc al, 0x3e
pushfd
xor dl, byte [ebp - 0x5c]
and edx, dword [ecx + 0x32c7a032]
mov ch, 0xbb
aas
scasd eax, dword es:[edi]
retf 0x9339
invalid
or bl, byte [eax + 0x76ad0aff]
invalid
Function at 0x772d53
Capabilities:
Encode data using base64

Disassembly:
call fcn.0073b1cd
jmp 0x73b3c7
lea esp, [esp + 4]
jmp 0x73b587
jmp 0x73b3ff
jmp 0x73b41b
push ebp
jmp 0x73b437
jmp 0x73b453
mov ebp, esp
jmp 0x73b46f
jmp 0x73b48b
movzx eax, byte [ecx]
jmp 0x73b4a7
jmp 0x73b4c3
shl eax, 0x10
jmp 0x73b4df
jmp 0x73b4fb
cmp dword [ebp + 0xc], 2
jmp 0x73b533
jmp 0x785397
jmp 0x73b54f
jb 0x73b517
jae 0x73b56b
push ecx
add dword [edi + 0x2e4bdb55], ebp
fnstsw word [edx]
aam 0x5b
retf
jmp 0x783e3a
jmp 0x73b3e3
jmp 0x73b3a6
movzx edx, byte [ecx + 1]
jmp 0x78462f
shl edx, 8
jmp 0x784655
or eax, edx
jmp 0x73b517
cmp dword [ebp + 0xc], 3
jne 0x7847be
and eax, edx
mov ebx, eax
jmp 0x78470f
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jge 0x78472c
add byte [ebp + 0x6a], bh
hlt
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jae 0x7847f0
jb 0x784834
jg 0x7846b6
jb 0x7846f1
in al, 0x63
daa
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
jg 0x7846bf
pop edi
iretd
cmp ecx, 0x34
jae 0x784733
lea edx, [ecx + 0x47]
jmp 0x7846c4
push 0x3e
pop eax
cmp ecx, 0x1a
jae 0x7846ec
lea edx, [ecx + 0x41]
jmp 0x7846c4
mov esp, 0x1066975e
invalid
cmp ecx, eax
jae 0x7847a0
lea edx, [ecx - 4]
jmp 0x7846c4
xor edx, edx
cmp ecx, eax
jmp 0x784821
mov ebx, dword [ebp + 0xc]
jmp 0x78470f
cmp esi, 0x34
jae 0x784892
lea ecx, [esi + 0x47]
jmp 0x78498d
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0x7846c4
lea ecx, [esi + 0x41]
jmp 0x78498d
xor ecx, ecx
cmp esi, eax
jmp 0x7848da
cmp esi, eax
jae 0x784874
lea ecx, [esi - 4]
jmp 0x78498d
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x78498d
mov byte [edx + 2], 0x3d
jmp 0x784d67
cmp edi, 0x34
jmp 0x784a20
mov byte [edx + 2], cl
jmp 0x784d67
cmp dword [ebp + 0xc], 2
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jb 0x7848fe
cmp edi, 0x1a
jae 0x784954
lea ecx, [edi + 0x41]
jmp 0x784970
cmp edi, eax
jae 0x784a2b
lea ecx, [edi - 4]
jmp 0x784970
jae 0x7849be
lea ecx, [edi + 0x47]
jmp 0x784970
xor ecx, ecx
cmp edi, eax
setne cl
jmp 0x784dde
mov edi, dword [ebp + 0xc]
jmp 0x784684
cmp ebx, eax
jae 0x784b23
lea ecx, [ebx - 4]
jmp 0x784afa
mov byte [edx + 3], cl
jmp 0x784b3c
cmp ebx, 0x34
jae 0x784acc
lea ecx, [ebx + 0x47]
jmp 0x784afa
xor ecx, ecx
cmp ebx, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x784afa
pop edi
pop esi
jmp 0x784b8f
mov byte [edx + 3], 0x3d
jmp 0x784b3c
pop ebx
pop ebp
ret
cmp dword [ebp + 0xc], 3
jne 0x784b59
cmp ebx, 0x1a
jae 0x784b19
lea ecx, [ebx + 0x41]
jmp 0x784afa
lea ecx, [ecx*4 + 0x2b]
jmp 0x784970
push ebx
push esi
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0x784a7e
mov edi, eax
shr edi, 6
and edi, edx
jmp 0x784684
cmp dword [ebp + 0xc], 3
jne 0x785184
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x785184

Function at 0x77334f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x73c168
jmp 0x73c1e7

Function at 0x773531
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x73d56f
jmp 0x73d6bb

Function at 0x7753df
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.00737356
jmp 0x737378
Function at 0x7a9e0d
Capabilities:
Encode data using xor

Disassembly:
call 0x7a81dd
jmp 0x7a9bb0
call 0x7a81fb
jmp 0x7a9ce9
call 0x7a821b
inc edi
je 0x7a8264
outsb dx, byte gs:[esi]
jne 0x7a821b
jmp 0x7a9dd3
call 0x7a8264
jmp 0x7a9d45
call 0x7a82a5
jmp 0x7a9d96
call 0x7a82e0
jmp 0x7a9e2d
call 0x7a883b
push ebx
je 0x7a8884
outsb dx, byte gs:[esi]
jne 0x7a883b
jmp 0x7a9d27
retf 0xedae
push 0
jmp 0x7a81d8
pop eax
sub eax, 0x9b7763f5
jmp 0x7a9eef
test eax, eax
je 0x7a9b6c
jne 0x7a820e
mov ebp, 0x46cbac3e
mov al, byte [0xef881a9a]
sbb bh, bl
push 0xffffffffffffffe9
jns 0x7a9c16
jmp 0x7a9c0b
sbb al, 0x9a
jp 0x7a9c0f
jmp 0x9a981ddb
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
add byte [ecx - 0x17], ah
test al, 0xfe
invalid
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
test eax, eax
je 0x7a9d70
jne 0x7a882e
cmp al, 0xbb
sub ecx, dword [esi - 0x43]
push ebp
movsb byte es:[edi], byte [esi]
sub bh, byte [eax + 0x6ce2adf]
invalid
pop ecx
sub ecx, 0x7a81fb
mov dword [ecx + 0x7a9b8a], eax
mov dword [ecx + 0x7a9b8f], 0x82444ff
mov word [ecx + 0x7a9b93], 0xc39d
movzx ebx, byte [eax]
add ebx, 0x4afc654d
cmp ebx, 0x4afc6619
je 0x7a9d76
jmp 0x7a9c4a
push eax
call fcn.0073cf99
jmp 0x7a9d8b
pop eax
sub eax, 0x82936377
call dword [eax - 0x7d748e9f]
jmp 0x7a9c77
push 0
jmp 0x7a825f
call [edx + eax - 0x54fd0870]
fadd qword [ecx - 0x2f]
mov al, 0x43
test bh, 0x51
shl dword [eax + 0x1817f853], 0xe8
sub al, 0x35
stc
invalid
call fcn.0073d2bc
jmp 0x7a82a0
pop ecx
sub ecx, 0x7a82a5
mov dword [ecx + 0x7a9c2c], eax
mov dword [ecx + 0x7a9c60], 0x82444ff
mov word [ecx + 0x7a9c64], 0xc39d
movzx ebx, byte [eax]
jmp 0x7a9de9
push eax
call fcn.0073cf99
call fcn.0073d2bc
jmp 0x7a81f6
add ebx, 0x557a0d4d
cmp ebx, 0x557a0e19
je 0x7a9e53
jmp 0x7a9e8b
call 0x7a9e0d
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
adc eax, 0xebdfd01c
and eax, 0x6f089a18
lcall 0xbf8, 0x9909884e
out dx, eax
sub byte [eax + 0x49a8593e], ch
fdiv qword [edi - 0x79298cbd]
pop eax
sub eax, 0xdfd80ea7
jmp 0x7a9dfd
xor byte [edi - 0x5e], dl
inc edx
hlt
push edi
mov byte [0xe670f442], al
xor dword [eax - 0x62], 0x75683141
invalid
jne 0x7a9ede
invalid
cmp dword [ecx + eax*4 - 0x1fbdbbc], ebx
inc edx
fisub dword [eax]
jmp 0x7a82db
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
call dword [eax - 0x64908d9a]
jmp fcn.007a9be4
Function at 0x401850
Capabilities:
Capture screenshot

Disassembly:
push 0xffffffffffffffff
push 0x4a9280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
mov dword [esp + 8], ecx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0048deeb
xor ebx, ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x58], ebx
call fcn.0048deeb
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push ebx
push ebx
lea eax, [esp + 0x40]
push ebx
push eax
mov byte [esp + 0x6c], 1
call esi
test eax, eax
je 0x4018cd
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x34]
push ecx
call edi
lea edx, [esp + 0x34]
push edx
call ebp
push 1
push ebx
push ebx
lea eax, [esp + 0x40]
push ebx
push eax
call esi
test eax, eax
jne 0x4018af
push ebx
push ebx
push ebx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
push eax
lea ecx, [esp + 0x18]
call fcn.0048dfa2
cmp eax, ebx
je 0x4019e4
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x14]
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x28]
call fcn.0048dfa2
cmp eax, ebx
jne 0x40191e
lea ecx, [esp + 0x14]
call fcn.0048e00a
jmp 0x4019e4
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push ecx
call esi
mov edx, dword [esp + 0x1c]
push 0xa
push edx
mov edi, eax
call esi
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x10]
push ebp
push edi
push ecx
lea esi, [eax + 0x5c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, esi
call fcn.0048eae4
cmp eax, ebx
jne 0x40196e
lea ecx, [esp + 0x14]
call fcn.0048e00a
lea ecx, [esp + 0x24]
call fcn.0048e00a
jmp 0x4019e4
cmp esi, ebx
jne 0x401976
xor esi, esi
jmp 0x401979
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.0048e0e3
mov ecx, dword [esp + 0x18]
mov esi, eax
lea eax, [esp + 0x14]
push 0xcc0020
neg eax
sbb eax, eax
push ebx
and eax, ecx
push ebx
push eax
mov eax, dword [esp + 0x38]
push ebp
push edi
push ebx
push ebx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
cmp esi, ebx
jne 0x4019b3
xor esi, esi
jmp 0x4019b6
mov esi, dword [esi + 4]
mov ecx, dword [esp + 0x28]
push esi
push ecx
call fcn.0048e0e3
lea ecx, [esp + 0x14]
call fcn.0048e00a
lea ecx, [esp + 0x24]
call fcn.0048e00a
mov edx, dword [esp + 0x10]
push 1
push ebx
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], bl
call fcn.0048e020
lea ecx, [esp + 0x14]
mov dword [esp + 0x58], 0xffffffff
call fcn.0048e020
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x406a10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a97e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4eb288]
test eax, eax
jne 0x406abb
mov eax, dword [0x4da03c]
push esi
mov dword [esp + 4], eax
push 0x104
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.0048b199
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.0048b1e8
push str.winhlp32.exe
lea ecx, [esp + 8]
call fcn.0048b145
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x406aa2
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x406aa2
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [0x4eb288], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.0048ad69
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x406b32
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret

Function at 0x406d40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
push ebx
push 0
push 0
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x406e29
lea eax, [esp + 0x10]
push eax
push str..htm
push SysReAllocStringLen
call fcn.00406ad0
add esp, 0xc
test eax, eax
jne 0x406e29
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push str._shellopencommand
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
push SysReAllocStringLen
call fcn.00406ad0
add esp, 0xc
test eax, eax
jne 0x406e29
lea ecx, [esp + 0x10]
push 0x4d38a8
push ecx
call fcn.004721a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x406e03
lea edx, [esp + 0x10]
push 0x4d38a4
push edx
call fcn.00472120
mov esi, eax
add esp, 8
test esi, esi
jne 0x406e03
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x406e06
mov byte [esi], 0
push 0x4d38a0
push esi
call edi
push ebp
push esi
call edi
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x407210
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4a98b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.0048b437
mov eax, dword [esp + 0x4c]
push 0
push 0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 1
call fcn.0048b549
test eax, eax
je 0x4072a9
lea ecx, [esp + 0x18]
call fcn.0048b843
lea ecx, [esp + 8]
push 0xe
push ecx
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.0048b666
cmp eax, 0xe
jne 0x4072a9
cmp word [esp + 8], 0x4d42
jne 0x4072a9
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4072a9
mov edx, dword [esp + 0x18]
add edi, 0xfffffff2
push edi
push esi
lea ecx, [esp + 0x20]
call dword [edx + 0x34]
cmp eax, edi
je 0x4072db
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.0048b48c
lea ecx, [esp + 0x4c]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048ad69
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x18
mov edx, dword [esi + 0x20]
test edx, edx
je 0x4072e6
mov eax, edx
jmp 0x4072f0
mov cl, byte [esi + 0xe]
mov eax, 1
shl eax, cl
cmp word [esi + 0xe], 8
push ebx
push ebp
jbe 0x40730a
mov ebp, dword [esi + 0x10]
xor eax, eax
cmp ebp, 3
setne al
dec eax
and eax, 3
add eax, edx
mov ebp, dword [esi + 4]
lea ebx, [esi + eax*4 + 0x28]
mov eax, 0x66
mov edi, dword [esi + 8]
sub eax, ebp
cdq
sub eax, edx
mov ecx, eax
mov eax, 0x66
sub eax, edi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
test ecx, ecx
jge 0x407334
xor ecx, ecx
test eax, eax
jge 0x40733a
xor eax, eax
mov edx, dword [esp + 0x48]
push 0
push esi
push ebx
push edi
push 0
push 0
push 0
lea eax, [edx + eax + 2]
mov edx, dword [esp + 0x60]
push edi
push ebp
push eax
lea eax, [edx + ecx + 2]
mov ecx, dword [esp + 0x68]
push eax
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.0048b48c
lea ecx, [esp + 0x54]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048ad69
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x18

Function at 0x40e900
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x15c]
test eax, eax
je 0x40e957
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40e957
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x158]
mov ecx, dword [esi + 0x15c]
push 0
push edx
push eax
push ecx
call fcn.00416d60
add esp, 0x10
test eax, eax
je 0x40e951
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret 4
Function at 0x40f600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aa6c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov dword [esp + 0x24], 0
lea eax, [esp + 0x14]
push 3
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 1
call fcn.00483f44
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 8]
mov byte [esp + 0x30], 2
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x3c]
add eax, 0xfffffffc
push eax
push edx
call fcn.00483fc0
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 3
call fcn.00483f44
push 0x4de688
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 4
call fcn.0048add7
mov bl, 5
push str.1234567890
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], bl
call fcn.0048b26b
cmp eax, 0xffffffff
jle 0x40f71d
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.0048b181
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
mov eax, dword [edx - 8]
dec eax
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00483fc0
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 6
call fcn.0048aea2
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.0048ad69
lea ecx, [esp + 0x1c]
push 1
push ecx
lea ecx, [esp + 0x10]
call fcn.00483f44
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.0048aea2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.0048ad69
push str.1234567890
lea ecx, [esp + 0x14]
call fcn.0048b26b
cmp eax, 0xffffffff
jg 0x40f69d
lea ecx, [esp + 0xc]
call fcn.0048b2af
mov edx, dword [esp + 0xc]
push edx
call fcn.004725cc
add esp, 4
inc eax
push eax
lea eax, [esp + 0x10]
push 0x4d440c
push eax
call fcn.004843a7
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
lea eax, [esp + 0x20]
push ecx
push edx
push eax
call fcn.0048af98
push 0x4d39a0
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x3c], 8
call fcn.0048affe
lea edx, [esp + 0x14]
mov byte [esp + 0x30], 9
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0048af98
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 0xa
call fcn.0048aea2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 9
call fcn.0048ad69
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 8
call fcn.0048ad69
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.0048ad69
mov esi, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0048aade
mov dword [esp + 0x24], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 4
call fcn.0048ad69
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.0048ad69
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.0048ad69
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.0048ad69
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.0048ad69
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x411880
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x1c]
push edi
mov dword [ebp - 0x10], esp
push ecx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
xor esi, esi
cmp eax, esi
je 0x4119dd
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, esi
je 0x4119dd
lea edx, [ebp - 0x18]
push esi
lea ecx, [ebp - 0x14]
push edx
push ecx
push eax
call fcn.00416db0
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x20], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp edi, esi
je 0x4119d3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, esi
mov dword [ebp - 0x1c], eax
je 0x4119d3
mov eax, dword [ebx + 0x15c]
cmp eax, esi
je 0x411917
push eax
call fcn.0048b36f
add esp, 4
mov eax, dword [ebx + 0x160]
mov dword [ebx + 0x15c], esi
cmp eax, esi
mov dword [ebx + 0x158], esi
mov dword [ebx + 0x154], esi
je 0x41193c
push eax
call fcn.0048b36f
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x160], esi
imul eax, dword [ebp - 0x18]
mov dword [ebx + 0x164], esi
mov dword [ebx + 0x168], esi
lea edi, [eax + eax*2]
mov dword [ebp - 4], esi
push edi
call fcn.0048b346
mov esi, dword [ebp - 0x1c]
mov ecx, edi
mov edx, ecx
mov edi, eax
shr ecx, 2
mov dword [ebx + 0x160], eax
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
mov dword [ebp - 4], 0xffffffff
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00412110
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push esi
mov dword [ebx + 0x168], eax
mov dword [ebx + 0x164], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0049fadd
mov eax, dword [eax + 4]
push 0xffffffffffffffff
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x90]
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.0040f830
xor esi, esi
push esi
push esi
push esi
mov ecx, ebx
call fcn.00491bba
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413210
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4aaa20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x4b07d0
mov eax, dword [edi + 0xe4]
mov dword [esp + 0x1c], 4
test eax, eax
je 0x413250
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov ebx, dword [edi + 0xbc]
test ebx, ebx
jle 0x41328e
xor esi, esi
test ebx, ebx
jle 0x41328e
push ebp
lea ebp, [edi + 0xb4]
lea eax, [esp + 0x10]
push esi
push eax
mov ecx, ebp
call fcn.00401300
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
call fcn.0048ad69
inc esi
cmp esi, ebx
jl 0x413267
pop ebp
lea ecx, [edi + 0xe0]
mov byte [esp + 0x1c], 3
call fcn.0048ad69
lea ecx, [edi + 0xb4]
mov byte [esp + 0x1c], 2
call fcn.00485a61
lea ecx, [edi + 0x84]
mov byte [esp + 0x1c], 1
call fcn.004a3b92
lea ecx, [edi + 0x80]
mov byte [esp + 0x1c], 0
call fcn.0048ad69
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.0048fbc0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret