joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40341a
Capabilities:
Extract resource via kernel32 functions
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
xor esi, esi
cmp dword [0x61a120], 0x400
push edi
jne 0x403487
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__hwrite]
push esi
push esi
call fcn.00403780
push esi
push esi
call fcn.00403780
push esi
call fcn.0040394a
push esi
push esi
push esi
call fcn.00404221
add esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00402ee0
fstp st(0)
push esi
call fcn.004042a6
push esi
call fcn.00404038
push esi
push esi
call fcn.00403674
add esp, 0x10
mov eax, dword [0x4a6b54]
mov dword [0x61a120], eax
mov eax, dword [0x4a6b2c]
mov dword [0x61a124], eax
call fcn.0040321b
mov dword [ebp - 4], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 4], ebx
jle 0x4034e9
cmp dword [ebp - 8], 0x785074d5
jne 0x4034f5
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1c1b
jl 0x4034a8
xor edi, edi
push esi
lea eax, [ebp - 0x820]
push eax
push esi
push 0x402dc8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x402dec
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp edi, ebx
jle 0x403525
cmp dword [ebp - 8], 0x785074d5
jne 0x40352e
inc edi
cmp edi, 0x11915
jl 0x4034f7
mov eax, dword [0x619074]
mov dword [0x6196b4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x404c10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a50e8]
jne 0x404c1a
repz ret
jmp fcn.0040a7b2
Function at 0x40a4d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407192
and dword [ebp - 4], 0
cmp dword [0x4a7420], 0
mov ebx, eax
jne 0x40a586
push 0x401bc4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a637
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401bb8
push edi
call esi
test eax, eax
je 0x40a637
push eax
call fcn.00407120
mov dword [esp], 0x401ba8
push edi
mov dword [0x4a7420], eax
call esi
push eax
call fcn.00407120
mov dword [esp], 0x401b94
push edi
mov dword [0x4a7424], eax
call esi
push eax
call fcn.00407120
mov dword [esp], 0x401b78
push edi
mov dword [0x4a7428], eax
call esi
push eax
call fcn.00407120
pop ecx
mov dword [0x4a7430], eax
test eax, eax
je 0x40a586
push 0x401b60
push edi
call esi
push eax
call fcn.00407120
pop ecx
mov dword [0x4a742c], eax
mov eax, dword [0x4a742c]
cmp eax, ebx
je 0x40a5de
cmp dword [0x4a7430], ebx
je 0x40a5de
push eax
call fcn.0040719b
push dword [0x4a7430]
mov esi, eax
call fcn.0040719b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a5de
test edi, edi
je 0x40a5de
call esi
test eax, eax
je 0x40a5d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a5d5
test byte [ebp - 0xc], 1
jne 0x40a5de
or dword [ebp + 0x10], 0x200000
jmp 0x40a617
mov eax, dword [0x4a7424]
cmp eax, ebx
je 0x40a617
push eax
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a617
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a617
mov eax, dword [0x4a7428]
cmp eax, ebx
je 0x40a617
push eax
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a617
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a7420]
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a637
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a639
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x414de9
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], esi
add ebx, 0xf23d502d
add eax, edi
add edx, 4
sub edi, eax
cmp edx, ecx
jne fcn.00414de9
ret
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x41c498
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x41c4a7
pop dword [ebp - 0xc]
mov eax, 0xc8d8b490
sub eax, 0xc896efe9
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x4154a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xac5f902c
sub ecx, 0xac5f4e34
xor edi, edi
add edi, eax
mov edx, 0xd9b2bdc5
sub edx, 0xd96e35c5
add edx, dword [ebp - 0xc]
mov esi, 0xc5dd391
sub esi, 0x2577b841
xor dword [ebp - 4], ecx
mov ebx, dword [edx]
xor dword [ebp - 8], 0x9832ea97
sub ebx, esi
sub dword [ebp - 4], 0x37e06afd
mov dword [edi], ebx
mov dword [ebp - 8], 0xc22f1bf0
add edi, 0x62da5869
add edi, 0x9d25a79b
add edx, 0x619b36bf
add edx, 0x9e64c945
loop 0x41c503
add eax, 0xfab3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x27c5c5c2
sub ecx, 0x2785c5c2
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x65a0100b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x52354be5
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x419173
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x419182
pop dword [ebp - 0x40]
mov eax, 0x419182
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x397adc2
add dword [ebp - 0x50], 0x4aba9789
mov dword [ebp - 0x4c], 0x89e72f3f
sub dword [ebp - 0x4c], 0x57b3e2fa
mov dword [ebp - 0x48], 0x48ad9647
sub dword [ebp - 0x48], 0xfc615219
mov dword [ebp - 0x44], 0xf5a70392
sub dword [ebp - 0x44], 0xf5a70392
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf1e95144
sub dword [ebp - 0x50], 0x7d76e7ee
mov dword [ebp - 0x4c], 0xf5e4a6e2
sub dword [ebp - 0x4c], 0xb478456d
mov dword [ebp - 0x48], 0x306d23c1
add dword [ebp - 0x48], 0x330248ab
mov dword [ebp - 0x44], 0xffa1f371
add dword [ebp - 0x44], 0x5e0c8f
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x262ef892
add eax, 0xda133892
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x41094
push 0
call eax
mov ecx, 0x578f4f5b
sub ecx, 0x578efa0e
xor edx, edx
add edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x40]
mov edi, 0x900a3509
sub dword [ebp - 0x34], 0x7eb202fd
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xc5bc3b08
xor esi, edi
xor dword [ebp - 8], 0x7f809c0f
mov dword [edx], esi
mov dword [ebp - 4], 0x7384973a
add edx, 0x3491faf6
sub edx, 0x3491faf2
add ebx, 0x137c12b9
sub ebx, 0x137c12b5
loop 0x419290
add eax, 0x14807
mov ebx, eax
add eax, 0xde1e10e7
add eax, 0x21e1ef1e
mov ecx, 0x8dd2690
sub ecx, 0x89d2690
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x418160
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.00405a30
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [esp + 8]
sub edx, 0x41
lea ebx, [esp + 4]
call fcn.00414a90
mov ebx, dword [esp + 4]
call fcn.00414b90
cmp eax, 0xffffffff
jne 0x4181df
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret
push esi
call fcn.00417f30
mov ecx, dword [esp + 0x218]
add esp, 4
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret

Function at 0x402da5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405537], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Magnetick
push str.Charge_Window_App
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402dec
xor eax, eax
jmp 0x402e03
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x403222
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404488
push 0x403384
push eax
mov eax, dword [0x4055b4]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x4055b0]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.0040337a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x4055ac]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d0
push 0x4040cc
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4032bd
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4032b5
cmp al, 0x22
jne 0x4032aa
cmp byte [esi], 0x22
jne 0x4032c7
inc esi
jmp 0x4032c7
cmp al, 0x20
jbe 0x4032c7
inc esi
cmp byte [esi], 0x20
ja 0x4032c1
cmp byte [esi], 0
je 0x4032d7
cmp byte [esi], 0x20
ja 0x4032d7
inc esi
cmp byte [esi], 0
jne 0x4032cc
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4032f7
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x403333
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403790
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x4037a4
inc dword [0x4ca6d8]
add dword [0x4c6a44], 0x108
mov edx, dword [0x4c6a44]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c91b0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4037d3
push 0
mov eax, 0x4cb508
call fcn.00417a60
cmp dword [0x4ca70c], 0
mov dword [0x4cbff0], 0
mov dword [0x4cbff4], 0
je 0x40380b
mov eax, dword [0x4c7b78]
test eax, eax
je 0x4037ff
mov eax, dword [eax]
test eax, eax
jne 0x403804
mov eax, 0x4a3920
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40388f
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x40383a
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x40383a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4cbffc], 0
je 0x40384c
cmp dword [0x4cbff8], 0
jne 0x403855
cmp byte [esi + 0xee], 0
je 0x40388f
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x40388f
cmp dword [0x4cbffc], 0
jge 0x403877
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x4cbffc]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret
Function at 0x4046e0
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x404703
call fcn.004049b0
test eax, eax
jne 0x404703
push str.Cant_open_clipboard_for_writing.
call fcn.004047e0
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x40473c
cmp dword [esi + 0x18], ebx
je 0x40472e
cmp dword [esi + 8], ebx
je 0x404723
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3cf4
call fcn.004047e0
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404775
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40479c
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x40479c
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404792
cmp dword [esi + 8], ebx
je 0x404787
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4047b1
mov dword [esi + 4], ebx
jmp 0x404775
cmp dword [esi + 0x18], ebx
je 0x4047ce
cmp dword [esi + 8], ebx
je 0x4047c3
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3d14
call fcn.004047e0
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4048b0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x4048c0
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x40498f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.004901fd
add esp, 0xc
test eax, eax
je 0x404986
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.0048fff9
add esp, 8
test eax, eax
je 0x404986
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.0048fff9
add esp, 8
test eax, eax
je 0x404986
lea edx, [esp]
push str.Native
push edx
call fcn.0048fff9
add esp, 8
test eax, eax
je 0x404986
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.0048fff9
add esp, 8
test eax, eax
je 0x404986
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.0048fff9
add esp, 8
test eax, eax
je 0x40497c
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.0048fff9
add esp, 8
test eax, eax
jne 0x404995
test esi, esi
je 0x404986
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret
Function at 0x40ae80
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100c
call fcn.0049b300
cmp byte [0x4cc200], 0
push ebx
push ebp
mov ebp, dword [esp + 0x101c]
push esi
push edi
jne 0x40aff4
cmp dword [0x4cadb0], 0
jne 0x40aeb6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4cadb0], eax
mov ebx, 1
add dword [0x4cc204], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4cc204]
mov esi, dword [0x4c6960]
mov ecx, eax
sub ecx, dword [0x4cadb0]
mov dword [0x4cadb4], eax
cmp edx, dword [0x4c695c]
jbe 0x40aeec
cmp ecx, esi
jb 0x40af50
xor edx, edx
cmp ecx, esi
jbe 0x40af09
mov dword [0x4cc204], 0
mov dword [0x4cadb0], eax
test edx, edx
jne 0x40aff4
mov esi, dword [esp + 0x1020]
mov cl, byte [esi + 0xf]
push 0
mov byte [0x4cbfce], cl
mov ecx, dword [ebp]
add byte [ebp + 0x16], bl
push 0
push 0x4a3914
push ecx
xor eax, eax
xor edx, edx
call fcn.0046e880
dec byte [ebp + 0x16]
add esp, 0x10
test eax, eax
jne 0x40afc2
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100c
ret 8
push ecx
push edx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
mov esi, 0x800
lea edi, [esp + 0x24]
call fcn.00476740
add esp, 0xc
call fcn.00409d20
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x4cc200], bl
mov dword [0x4c694c], 0
call fcn.0047b3a0
add esp, 0x18
cmp eax, 7
jne 0x40afa9
push 0
push 4
push 0x4cb508
call fcn.00417de0
mov eax, dword [0x4cadb4]
mov dword [0x4c694c], ebx
mov byte [0x4cc200], 0
mov edx, ebx
jmp 0x40aef2
cmp byte [ebp + 0x1b], 0
je 0x40aff4
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x40aff4
movzx edx, word [esi + 4]
mov eax, dword [0x4ca564]
push 0
push edx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100c
ret 8