joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449580
Capabilities:
Compare security identifiers
Get token privileges

Disassembly:
sub esp, 0x18
mov eax, dword [0x40a5d4]
xor eax, esp
mov dword [esp + 0x14], eax
call fcn.00449550
test eax, eax
je 0x4496f3
push ebx
push esi
lea eax, [esp + 8]
push eax
xor ebx, ebx
push ebx
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4495f2
call esi
cmp eax, 0x3f0
jne 0x4495df
lea ecx, [esp + 8]
push ecx
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4495f2
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046db77
add esp, 0x18
ret
mov eax, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push 2
push eax
call edi
test eax, eax
jne 0x449614
call esi
cmp eax, 0x7a
je 0x449628
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046db77
add esp, 0x18
ret
mov ecx, dword [esp + 0x10]
add ecx, 3
and ecx, 0xfffffffc
push ebp
push ecx
call fcn.0046d240
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
push eax
push esi
push 2
push ecx
call edi
test eax, eax
je 0x4496b7
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4496b7
xor edi, edi
cmp dword [esi], ebx
jbe 0x4496b7
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ebx, [esi + 4]
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx]
push ecx
push edx
call ebp
test eax, eax
jne 0x4496d5
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x4496a1
push esi
call fcn.0046e383
add esp, 4
pop ebp
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046db77
add esp, 0x18
ret
push esi
call fcn.0046e383
add esp, 4
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046db77
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
xor ecx, esp
mov al, 1
call fcn.0046db77
add esp, 0x18
ret
Function at 0x449710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
mov eax, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push 0x40d138
push 0x80000001
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x449759
xor eax, eax
pop ebx
add esp, 0x10
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x40d12c
push ecx
call esi
test eax, eax
jne 0x4498e2
mov dl, byte [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov byte [0x485f32], dl
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x40d120
push eax
call esi
test eax, eax
jne 0x4498e2
mov cl, byte [esp + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
mov byte [0x485f33], cl
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x40d118
push edx
call esi
test eax, eax
jne 0x4498e2
mov al, byte [esp + 8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
mov byte [0x486539], al
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x40d108
push ecx
call esi
test eax, eax
jne 0x4498e2
mov dl, byte [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov byte [0x4861b2], dl
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x40d0f8
push eax
call esi
test eax, eax
jne 0x4498e2
mov cl, byte [esp + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
mov byte [0x485d87], cl
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x40d0ec
push edx
call esi
test eax, eax
jne 0x4498e2
mov al, byte [esp + 8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
mov byte [0x485d84], al
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x40d0d8
push ecx
call esi
test eax, eax
jne 0x4498e2
mov dl, byte [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
mov byte [0x485d85], dl
lea edx, [esp + 0x1c]
push edx
push ebx
push 0x40d0d0
push eax
call esi
test eax, eax
jne 0x4498e2
mov cl, byte [esp + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
mov byte [0x4861b1], cl
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x40d0c8
push edx
call esi
test eax, eax
je 0x4498ea
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov al, byte [esp + 8]
push ecx
mov byte [0x486538], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x44a040
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x480326
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x40a5d4]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40a5d4]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov eax, dword [esp + 0x180]
mov ebp, dword [esp + 0x178]
mov edi, dword [esp + 0x184]
mov esi, dword [esp + 0x188]
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x170], ebx
call fcn.0045d4c0
push 1
push esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x178], 1
call fcn.00446900
test al, al
je 0x44a1b7
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ebx
push ecx
push edx
lea ecx, [esp + 0x3c]
call fcn.0045d880
test al, al
je 0x44a1ae
push esi
lea eax, [esp + 0x64]
push 0x104
push eax
call fcn.0046e38e
push edi
lea ecx, [esp + 0x70]
push 0x104
push ecx
call fcn.0046e3f6
mov edx, dword [esp + 0x194]
add esp, 0x18
push 1
push edx
lea ecx, [esp + 0x38]
call fcn.0045d660
push ebx
push 0x80
push 4
push ebx
push 3
mov edi, eax
push 0xc0000000
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44a16f
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x14]
push 0x10
push 0x40cd28
push 0x40d210
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44a1b7
mov eax, dword [esp + 0x30]
push ebx
lea edx, [esp + 0x30]
push edx
push edi
add ebp, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
test eax, eax
jne 0x44a1a8
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x14]
push 0x10
push 0x40cd28
push 0x40d1f8
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44a1b7
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esp + 0x18]
call fcn.004468b0
lea ecx, [esp + 0x30]
mov byte [esp + 0x170], bl
call fcn.0045d4d0
lea ecx, [esp + 0x18]
mov dword [esp + 0x170], 0xffffffff
call fcn.004468b0
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0046db77
add esp, 0x160
ret
Function at 0x44dc10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x16c
mov eax, dword [0x40a5d4]
xor eax, esp
mov dword [esp + 0x168], eax
push edi
mov edi, dword [0x486a0c]
push 0x106
lea eax, [esp + 0x69]
push 0
push eax
mov dword [esp + 0x14], edi
mov byte [esp + 0x70], 0
call fcn.0046de30
add esp, 0xc
test edi, edi
je 0x44de79
push 0x58
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0046de30
mov eax, dword [0x486540]
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x64]
push ecx
mov dword [esp + 0x10], 0x58
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], 0x40d4e0
mov dword [esp + 0x40], 0x40d4d4
mov dword [esp + 0x3c], 0x40cf3c
mov dword [esp + 0x28], 1
mov dword [esp + 0x44], 4
mov dword [esp + 0x14], eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
je 0x44de79
lea eax, [esp + 0x64]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44dcc4
sub eax, edx
cmp dword [esp + eax + 0x61], 0x7478742e
je 0x44dcee
push 0x40d4cc
lea edx, [esp + 0x68]
push 0x107
push edx
call fcn.0046e3f6
add esp, 0xc
push esi
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44dd48
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x10
push 0x40cd28
push 0x40d210
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0046db77
add esp, 0x16c
ret
push ebx
xor ebx, ebx
test edi, edi
jle 0x44de54
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebp
lea ebx, [ebx]
push 0x4086dc
push 0
push ebx
mov ecx, 0x486a08
call fcn.00447e50
mov ebp, dword [0x4086f4]
mov eax, dword [0x4086e0]
cmp ebp, 0x10
jae 0x44dd87
mov eax, 0x4086e0
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x44dd90
sub eax, ecx
mov ecx, dword [0x4086e0]
cmp ebp, 0x10
jae 0x44dda9
mov ecx, 0x4086e0
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 4
push 0x40d4c4
push esi
call edi
push 0
push 0x40cee7
mov ecx, 0x4086dc
call fcn.0043c530
push 0x4086dc
push 1
push ebx
mov ecx, 0x486a08
call fcn.00447e50
mov ebp, dword [0x4086f4]
mov eax, dword [0x4086e0]
cmp ebp, 0x10
jae 0x44ddfe
mov eax, 0x4086e0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x44de01
sub eax, ecx
mov ecx, dword [0x4086e0]
cmp ebp, 0x10
jae 0x44de1a
mov ecx, 0x4086e0
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push esi
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x40d4c0
push esi
call edi
push 0
push 0x40cee7
mov ecx, 0x4086dc
call fcn.0043c530
inc ebx
cmp ebx, dword [esp + 0x14]
jl 0x44dd60
pop ebp
mov edx, dword [0x486540]
push 0x40000
push 0x40d4b4
lea ecx, [esp + 0x74]
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop esi
mov ecx, dword [esp + 0x16c]
pop edi
xor ecx, esp
call fcn.0046db77
add esp, 0x16c
ret
Function at 0x458dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x480da8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x40a5d4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push 1
push eax
mov ecx, 0x408668
call fcn.00446900
test al, al
je 0x458e30
mov ecx, dword [0x408678]
mov edx, dword [0x408674]
push 0
push ecx
push edx
mov ecx, 0x4867b0
call fcn.0045d880
test al, al
jne 0x458e42
mov ecx, 0x408668
call fcn.004468b0
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret
lea eax, [esp + 4]
push 0x4867b0
push eax
call fcn.00443230
add esp, 8
mov ecx, dword [eax]
mov dword [0x487468], ecx
mov edx, dword [eax + 4]
add eax, 8
push eax
mov ecx, 0x487470
mov dword [esp + 0x30], 0
mov dword [0x48746c], edx
call fcn.00455c70
lea ecx, [esp + 0xc]
call fcn.00442780
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret
Function at 0x45cc00
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x410
mov eax, dword [esp + 0x414]
cmp dword [eax + 4], 0x100
push edi
mov edi, ecx
mov dword [esp + 4], edi
ja 0x45cc29
xor al, al
pop edi
add esp, 0x410
ret 8
push esi
mov esi, dword [edi + 0x864]
cmp esi, dword [edi + 0x868]
jbe 0x45cc3d
call fcn.0046d6b5
mov edi, dword [edi + 0x858]
push ebx
push ebp
mov ebp, esi
lea ebx, [esi + 0x28]
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 0x868]
cmp dword [eax + 0x864], esi
jbe 0x45cc6b
call fcn.0046d6b5
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x858]
test edi, edi
je 0x45cc79
cmp edi, eax
je 0x45cc7e
call fcn.0046d6b5
cmp ebp, esi
je 0x45cdfc
test edi, edi
jne 0x45cd3f
call fcn.0046d6b5
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x45cc9f
call fcn.0046d6b5
cmp byte [ebx + 0xc], 0
jne 0x45cd8e
test edi, edi
jne 0x45cd46
call fcn.0046d6b5
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x45ccc2
call fcn.0046d6b5
mov ecx, dword [ebx + 4]
sub ecx, dword [ebx]
test ecx, 0xfffffffe
je 0x45cd8e
test edi, edi
jne 0x45cd4d
call fcn.0046d6b5
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x45cce8
call fcn.0046d6b5
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
sar esi, 1
test edi, edi
jne 0x45cd51
call fcn.0046d6b5
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x45cd04
call fcn.0046d6b5
mov edx, dword [ebx + 4]
sub edx, dword [ebx]
sar edx, 1
jne 0x45cd12
call fcn.0046d6b5
mov eax, dword [ebx]
push esi
push eax
lea ecx, [esp + 0x20]
call fcn.0043d3c0
test edi, edi
jne 0x45cd55
call fcn.0046d6b5
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x45cd34
call fcn.0046d6b5
cmp dword [ebx - 0x10], 0x10
jb 0x45cd59
mov eax, dword [ebx - 0x24]
jmp 0x45cd5c
mov eax, dword [edi]
jmp 0x45cc95
mov eax, dword [edi]
jmp 0x45ccb8
mov eax, dword [edi]
jmp 0x45ccde
mov eax, dword [edi]
jmp 0x45ccfa
mov eax, dword [edi]
jmp 0x45cd2a
lea eax, [ebx - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov eax, dword [esp + 0x424]
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
sub edx, 0x100
push edx
add eax, 0x100
push eax
lea ecx, [esp + 0x24]
call fcn.00444a10
test al, al
jne 0x45cdb2
test edi, edi
jne 0x45cdae
call fcn.0046d6b5
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x45cda3
call fcn.0046d6b5
add ebp, 0x38
add ebx, 0x38
jmp 0x45cc50
mov eax, dword [edi]
jmp 0x45cd99
mov esi, dword [esp + 0x428]
mov byte [esi], 1
test edi, edi
jne 0x45cdf8
call fcn.0046d6b5
cmp ebp, dword [edi + 0x10]
jb 0x45cdcf
call fcn.0046d6b5
push 0xffffffffffffffff
push 0
push ebp
lea ecx, [esi + 4]
call fcn.0043c450
mov ecx, dword [esp + 0x14]
pop ebp
add ecx, 0x100
pop ebx
mov dword [esi + 0x20], ecx
pop esi
mov al, 1
pop edi
add esp, 0x410
ret 8
mov edi, dword [edi]
jmp 0x45cdc5
pop ebp
pop ebx
pop esi
xor al, al
pop edi
add esp, 0x410
ret 8
Function at 0x45d880
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
cmp ebx, 0x40
jae 0x45d894
pop esi
xor al, al
pop ebx
ret 0xc
push edi
mov edi, dword [esp + 0x10]
mov eax, 0x5a4d
mov dword [esi + 8], edi
cmp word [edi], ax
jne 0x45d8c6
mov ecx, dword [edi + 0x3c]
lea eax, [ecx + edi]
mov dword [esp + 0x14], ecx
cmp eax, edi
jbe 0x45d8c6
add ecx, 0x18
cmp ebx, ecx
jb 0x45d8c6
mov dword [esi + 0xc], eax
cmp dword [eax], 0x4550
je 0x45d8ce
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
lea ecx, [eax + 4]
add eax, 0x18
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
movzx edx, word [ecx + 0x10]
add edx, eax
push ebp
mov ebp, 0x10b
mov dword [esi + 0x18], edx
cmp word [eax], bp
jne 0x45d955
movzx eax, word [ecx + 0x10]
mov ebp, dword [esp + 0x18]
lea eax, [eax + ebp + 0x18]
cmp ebx, eax
jb 0x45d955
mov ebp, edi
sub ebp, edx
add ebp, ebx
mov eax, 0xcccccccd
mul ebp
movzx eax, word [ecx + 2]
shr edx, 5
cmp eax, edx
ja 0x45d955
mov eax, dword [esp + 0x1c]
test al, al
je 0x45d924
test byte [ecx + 0x12], 2
je 0x45d955
push eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], ebx
call fcn.0045d6b0
test al, al
je 0x45d955
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx + 0x10]
push edx
mov ecx, esi
call fcn.0045d4e0
cmp eax, 0xffffffff
je 0x45d955
cmp eax, ebx
jae 0x45d955
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
Function at 0x45e4e0
Capabilities:
Check for peb beingdebugged flag
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x481298
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40a5d4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea ebp, [edi + edi + 2]
cmp ebp, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], edi
jge 0x45e5b8
mov eax, ebp
shl eax, 5
mov ecx, dword [eax + ebx - 0xc]
add eax, ebx
cmp dword [eax - 8], 0x10
mov dword [esp + 0x14], ecx
jb 0x45e545
mov edx, dword [eax - 0x1c]
jmp 0x45e548
lea edx, [eax - 0x1c]
mov esi, dword [eax + 0x14]
cmp esi, ecx
jae 0x45e551
mov ecx, esi
cmp dword [eax + 0x18], 0x10
jb 0x45e55c
mov eax, dword [eax + 4]
jmp 0x45e55f
add eax, 4
push ecx
push edx
push eax
call fcn.0043bf60
add esp, 0xc
test eax, eax
jne 0x45e581
mov eax, dword [esp + 0x14]
cmp esi, eax
jb 0x45e583
xor ecx, ecx
cmp esi, eax
setne cl
mov eax, ecx
test eax, eax
jge 0x45e584
dec ebp
mov esi, ebp
push 0xffffffffffffffff
shl esi, 5
shl edi, 5
push 0
add esi, ebx
add edi, ebx
push esi
mov ecx, edi
call fcn.0043c450
mov edx, dword [esi + 0x1c]
mov dword [edi + 0x1c], edx
mov edi, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, dword [esp + 0x34]
jl 0x45e52b
mov eax, dword [esp + 0x34]
cmp ebp, eax
jne 0x45e5e1
mov esi, edi
push 0xffffffffffffffff
shl eax, 5
shl esi, 5
lea ebp, [eax + ebx - 0x20]
add esi, ebx
push 0
push ebp
mov ecx, esi
call fcn.0043c450
mov eax, dword [ebp + 0x1c]
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x1c], eax
lea edi, [ecx - 1]
mov edx, dword [esp + 0x58]
push edx
sub esp, 0x20
mov esi, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x64]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
push eax
mov ecx, esi
mov byte [esi + 4], 0
call fcn.0043c450
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x78]
push edx
push edi
push ebx
mov dword [esi + 0x1c], ecx
call fcn.0045e090
add esp, 0x30
cmp dword [esp + 0x50], 0x10
jb 0x45e63b
mov eax, dword [esp + 0x3c]
push eax
call fcn.0046d54d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x460590
Capabilities:
Check for peb beingdebugged flag
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x481468
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40a5d4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea esi, [ebx + ebx + 2]
cmp esi, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], ebx
jge 0x46068e
jmp 0x4605e0
mov eax, esi
shl eax, 4
sub eax, esi
cmp dword [ebp + eax*4 - 0x24], 0x10
mov ecx, dword [ebp + eax*4 - 0x28]
lea eax, [ebp + eax*4]
mov dword [esp + 0x14], ecx
jb 0x4605ff
mov edx, dword [eax - 0x38]
jmp 0x460602
lea edx, [eax - 0x38]
mov edi, dword [eax + 0x14]
cmp edi, ecx
jae 0x46060b
mov ecx, edi
cmp dword [eax + 0x18], 0x10
jb 0x460616
mov eax, dword [eax + 4]
jmp 0x460619
add eax, 4
push ecx
push edx
push eax
call fcn.0043bf60
add esp, 0xc
test eax, eax
jne 0x46063b
mov eax, dword [esp + 0x14]
cmp edi, eax
jb 0x46063d
xor ecx, ecx
cmp edi, eax
setne cl
mov eax, ecx
test eax, eax
jge 0x46063e
dec esi
mov eax, ebx
mov edx, esi
shl edx, 4
shl eax, 4
push 0xffffffffffffffff
sub edx, esi
sub eax, ebx
lea edi, [ebp + edx*4]
lea ebx, [ebp + eax*4]
push 0
push edi
mov ecx, ebx
call fcn.0043c450
mov cl, byte [edi + 0x1c]
mov byte [ebx + 0x1c], cl
mov edx, dword [edi + 0x20]
add edi, 0x24
push edi
lea ecx, [ebx + 0x24]
mov dword [ebx + 0x20], edx
call fcn.0045fce0
mov ebx, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x34]
jl 0x4605e0
mov eax, dword [esp + 0x34]
cmp esi, eax
jne 0x4606d1
mov ecx, eax
shl ecx, 4
mov edx, ebx
shl edx, 4
sub ecx, eax
push 0xffffffffffffffff
sub edx, ebx
lea esi, [ebp + ecx*4 - 0x3c]
lea edi, [ebp + edx*4]
push 0
push esi
mov ecx, edi
call fcn.0043c450
mov al, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov ecx, dword [esi + 0x20]
add esi, 0x24
mov dword [edi + 0x20], ecx
push esi
lea ecx, [edi + 0x24]
call fcn.0045fce0
mov edx, dword [esp + 0x34]
lea ebx, [edx - 1]
mov eax, dword [esp + 0x74]
push eax
sub esp, 0x3c
lea edx, [esp + 0x78]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.0045fc60
mov eax, dword [esp + 0x58]
push eax
push ebx
push ebp
call fcn.00460200
mov eax, dword [esp + 0xb4]
xor esi, esi
add esp, 0x4c
cmp eax, esi
je 0x460727
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x68]
push edx
push ecx
push eax
call fcn.0045e360
mov edx, dword [esp + 0x78]
push edx
call fcn.0046d54d
add esp, 0x14
mov eax, dword [esp + 0x5c]
push eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
call fcn.0046d54d
add esp, 4
cmp dword [esp + 0x50], 0x10
jb 0x460754
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0046d54d
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x468d60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x2b8]
test eax, eax
jne 0x468d73
xor eax, eax
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [ebp + 0x2c0]
push edi
sub ebx, dword [ebp + 0x2bc]
push 0
inc ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x468dae
mov eax, dword [ebp + 0x140]
push 0x10
push 0x439328
push 0x439374
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
lea ecx, [ebx + 4]
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x468deb
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp + 0x140]
push 0x10
push 0x439328
push 0x439354
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, dword [ebp + 0x2bc]
mov esi, dword [ebp + 0x150]
mov ecx, ebx
mov edx, ecx
add esi, edi
shr ecx, 2
lea edi, [eax + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
push esi
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0x308]
push esi
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x468e67
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp + 0x140]
push 0x10
push 0x439328
push 0x439330
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebx
mov eax, 1
pop ebp
pop ecx
ret