joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4391eb
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
call fcn.00482b51
add esp, 8
test eax, eax
je 0x43920d
cmp eax, dword [ebp + 0xc]
jbe 0x43920d
cmp word [eax - 2], 0xd
jne 0x43920d
mov byte [esp + 0x15], 1
mov byte [esp + 0x14], 1
cmp edi, 1
jne 0x43922a
mov edx, dword [ebp + 0xc]
push edi
push 0
push ebx
push edx
mov ecx, esi
call fcn.004698a0
mov dword [esp + 0x20], eax
jmp 0x4399df
cmp dword [0x4bfb24], 0
jne 0x43923a
cmp byte [esp + 0x15], 0
je 0x4392b0
lea eax, [ebx + ebx + 6]
push eax
call fcn.00481e64
mov esi, eax
add esp, 4
mov dword [esp + 0x38], esi
test esi, esi
jne 0x43926d
mov ecx, dword [ebp + 8]
push 0x4a5c64
push eax
push str.Out_of_memory.
call fcn.0042b6a0
mov dword [esp + 0x20], eax
jmp 0x4399df
mov edx, dword [ebp + 0xc]
lea edi, [ebx + ebx]
lea ecx, [edi + 2]
push ecx
push edx
push esi
call fcn.00485e70
add esp, 0xc
cmp byte [esp + 0x15], 0
mov dword [ebp + 0xc], esi
je 0x4392ac
mov eax, 0x4a48d0
sub edi, eax
add edi, dword [esp + 0x38]
movzx ecx, word [eax]
mov word [edi + eax], cx
add eax, 2
test cx, cx
jne 0x439296
add ebx, 2
mov dword [esp + 0x30], ebx
mov edi, dword [esp + 0x20]
xor eax, eax
cmp byte [esp + 0x13], al
setne al
inc edi
inc eax
add eax, eax
add eax, eax
imul edi, eax
push edi
mov dword [esp + 0x2c], eax
call fcn.00481e64
mov ebx, eax
add esp, 4
mov dword [esp + 0x40], ebx
test ebx, ebx
jne 0x4392f5
mov ecx, dword [ebp + 8]
push 0x4a5c64
push eax
push str.Out_of_memory.
call fcn.0042b6a0
mov dword [esp + 0x20], eax
jmp 0x4399df
mov edi, dword [ebp + 0xc]
mov dword [ebx], edi
cmp word [edi], 0
mov esi, ebx
mov dword [esp + 0x20], 0
add byte [eax], al
mov edx, 1
je 0x43938a
mov ax, word [edi]
cmp ax, word [esp + 0x24]
jne 0x439381
add dword [esp + 0x20], edx
xor ecx, ecx
mov word [edi], cx
cmp byte [esp + 0x13], cl
je 0x439378
sub dword [0x4bd3b0], edx
jne 0x43933a
call fcn.00411f30
mov edx, 1
mov ecx, dword [0x4bfc68]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4bfc68], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
shr ecx, 1
mov dword [esi + 4], ecx
add esi, dword [esp + 0x28]
lea eax, [edi + 2]
inc edi
invalid
mov dword [esi], eax
add edi, 2
cmp word [edi], 0
jne 0x43930f
cmp byte [esp + 0x14], 0
jne 0x4393e7
add dword [esp + 0x20], edx
cmp byte [esp + 0x13], 0
Function at 0x43937d
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
call fcn.00482b51
add esp, 8
test eax, eax
je 0x43920d
cmp eax, dword [ebp + 0xc]
jbe 0x43920d
cmp word [eax - 2], 0xd
jne 0x43920d
mov byte [esp + 0x15], 1
mov byte [esp + 0x14], 1
cmp edi, 1
jne 0x43922a
mov edx, dword [ebp + 0xc]
push edi
push 0
push ebx
push edx
mov ecx, esi
call fcn.004698a0
mov dword [esp + 0x20], eax
jmp 0x4399df
cmp dword [0x4bfb24], 0
jne 0x43923a
cmp byte [esp + 0x15], 0
je 0x4392b0
lea eax, [ebx + ebx + 6]
push eax
call fcn.00481e64
mov esi, eax
add esp, 4
mov dword [esp + 0x38], esi
test esi, esi
jne 0x43926d
mov ecx, dword [ebp + 8]
push 0x4a5c64
push eax
push str.Out_of_memory.
call fcn.0042b6a0
mov dword [esp + 0x20], eax
jmp 0x4399df
mov edx, dword [ebp + 0xc]
lea edi, [ebx + ebx]
lea ecx, [edi + 2]
push ecx
push edx
push esi
call fcn.00485e70
add esp, 0xc
cmp byte [esp + 0x15], 0
mov dword [ebp + 0xc], esi
je 0x4392ac
mov eax, 0x4a48d0
sub edi, eax
add edi, dword [esp + 0x38]
movzx ecx, word [eax]
mov word [edi + eax], cx
add eax, 2
test cx, cx
jne 0x439296
add ebx, 2
mov dword [esp + 0x30], ebx
mov edi, dword [esp + 0x20]
xor eax, eax
cmp byte [esp + 0x13], al
setne al
inc edi
inc eax
add eax, eax
add eax, eax
imul edi, eax
push edi
mov dword [esp + 0x2c], eax
call fcn.00481e64
mov ebx, eax
add esp, 4
mov dword [esp + 0x40], ebx
test ebx, ebx
jne 0x4392f5
mov ecx, dword [ebp + 8]
push 0x4a5c64
push eax
push str.Out_of_memory.
call fcn.0042b6a0
mov dword [esp + 0x20], eax
jmp 0x4399df
mov edi, dword [ebp + 0xc]
mov dword [ebx], edi
cmp word [edi], 0
mov esi, ebx
mov dword [esp + 0x20], 0
add byte [eax], al
mov edx, 1
je 0x43938a
mov ax, word [edi]
cmp ax, word [esp + 0x24]
jne 0x439381
add dword [esp + 0x20], edx
xor ecx, ecx
mov word [edi], cx
cmp byte [esp + 0x13], cl
je 0x439378
sub dword [0x4bd3b0], edx
jne 0x43933a
call fcn.00411f30
mov edx, 1
mov ecx, dword [0x4bfc68]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4bfc68], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
shr ecx, 1
mov dword [esi + 4], ecx
add esi, dword [esp + 0x28]
lea eax, [edi + 2]
inc edi
invalid
mov dword [esi], eax
add edi, 2
cmp word [edi], 0
jne 0x43930f
cmp byte [esp + 0x14], 0
jne 0x4393e7
add dword [esp + 0x20], edx
cmp byte [esp + 0x13], 0
Function at 0x439ae2
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
in al, dx
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x4c0cc0]
push ebx
push edi
push 0
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [esi]
test cx, cx
je 0x439bb9
cmp word [esi + 2], 0
jne 0x439b3f
cmp ecx, 0xa
jne 0x439b1e
push eax
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
mov ecx, eax
shr ecx, 8
cmp cl, 0xff
jne 0x439bb3
cmp al, 0xff
jne 0x439bb3
xor al, al
jmp 0x439bb3
mov edi, ecx
test edi, 0xffffff80
jne 0x439b5b
push 2
push edi
call fcn.00482fce
add esp, 8
test eax, eax
je 0x439b5b
and edi, 0xffffffdf
cmp di, 0x56
jne 0x439b82
mov ax, word [esi + 2]
call fcn.00408f90
cmp ax, 0x4b
cmp eax, 0x4b

Function at 0x439b0c
Capabilities:
Log keystrokes via polling

Disassembly:
in al, dx
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x4c0cc0]
push ebx
push edi
push 0
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [esi]
test cx, cx
je 0x439bb9
cmp word [esi + 2], 0
jne 0x439b3f
cmp ecx, 0xa
jne 0x439b1e
push eax
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
mov ecx, eax
shr ecx, 8
cmp cl, 0xff
jne 0x439bb3
cmp al, 0xff
jne 0x439bb3
xor al, al
jmp 0x439bb3
mov edi, ecx
test edi, 0xffffff80
jne 0x439b5b
push 2
push edi
call fcn.00482fce
add esp, 8
test eax, eax
je 0x439b5b
and edi, 0xffffffdf
cmp di, 0x56
jne 0x439b82
mov ax, word [esi + 2]
call fcn.00408f90
cmp ax, 0x4b
cmp eax, 0x4b

Function at 0x439ca0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x4c1688]
sub esp, 0x238
push esi
push edi

Function at 0x439cb4
Capabilities:
Get disk size

Disassembly:
push 1
push 0
add byte [edx - 1], ch
push 0x49eb0c
mov esi, eax
call fcn.004698a0
mov ecx, dword [0x4c0cc0]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004698a0
test esi, esi
je 0x439e32
cmp word [esi], 0
je 0x439e32
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00485434
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
add ah, byte [esi - 0x7b]
leave
jne 0x439d10
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x439d47
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x439e32
invalid
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
push esp
inc esp
invalid
push 1
Function at 0x439d15
Capabilities:
Get disk size

Disassembly:
push 1
push 0
add byte [edx - 1], ch
push 0x49eb0c
mov esi, eax
call fcn.004698a0
mov ecx, dword [0x4c0cc0]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004698a0
test esi, esi
je 0x439e32
cmp word [esi], 0
je 0x439e32
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00485434
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
add ah, byte [esi - 0x7b]
leave
jne 0x439d10
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x439d47
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x439e32
invalid
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
push esp
inc esp
invalid
push 1

Function at 0x439d35
Capabilities:
Get disk size

Disassembly:
push 1
push 0
add byte [edx - 1], ch
push 0x49eb0c
mov esi, eax
call fcn.004698a0
mov ecx, dword [0x4c0cc0]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004698a0
test esi, esi
je 0x439e32
cmp word [esi], 0
je 0x439e32
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00485434
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
add ah, byte [esi - 0x7b]
leave
jne 0x439d10
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x439d47
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x439e32
invalid
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
push esp
inc esp
invalid
push 1

Function at 0x439d44
Capabilities:
Get disk size

Disassembly:
push 1
push 0
add byte [edx - 1], ch
push 0x49eb0c
mov esi, eax
call fcn.004698a0
mov ecx, dword [0x4c0cc0]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004698a0
test esi, esi
je 0x439e32
cmp word [esi], 0
je 0x439e32
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00485434
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
add ah, byte [esi - 0x7b]
leave
jne 0x439d10
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x439d47
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x439e32
invalid
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
push esp
inc esp
invalid
push 1

Function at 0x439d45
Capabilities:
Get disk size

Disassembly:
push 1
push 0
add byte [edx - 1], ch
push 0x49eb0c
mov esi, eax
call fcn.004698a0
mov ecx, dword [0x4c0cc0]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004698a0
test esi, esi
je 0x439e32
cmp word [esi], 0
je 0x439e32
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00485434
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
add ah, byte [esi - 0x7b]
leave
jne 0x439d10
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x439d47
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x439e32
invalid
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
push esp
inc esp
invalid
push 1
Function at 0x43a0d1
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, eax
call fcn.0042ce90
mov ebx, eax
cmp ebx, 9
jne 0x43a0ef
cmp ebx, 4
jne 0x43a195
push 0x103
lea eax, [esp + 0x6c]
push edi
push eax
call fcn.00485434
add al, 0
add esp, 0xc
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49eb0c
call fcn.004698a0
mov esi, dword [0x4c0cc0]
mov dword [esp + 0xc], esi
cmp ebx, 8

Function at 0x43a254
Capabilities:
Get disk information

Disassembly:
or byte [ebp - 0x72fa8a40], al
js 0x43a262
jmp 0x43a276
add byte [edi - 0x18], dl
jo 0x43a2e2
add al, 0
add esp, 8
test eax, eax
jne 0x43a30e
xor edi, edi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x10], 0
mov bl, 0x41
jmp 0x43a290
push es
movzx esi, bl
lea ecx, [esp + 0x278]
xor eax, eax
push ecx
mov word [esp + 0x27c], si
mov dword [esp + 0x27e], 0x5c003a
mov word [esp + 0x282], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, edi
je 0x43a2cf
cmp edi, 0x100
jne 0x43a2dd
cmp eax, 1
je 0x43a2dd
mov eax, dword [esp + 0x10]
mov word [esp + eax*2 + 0x28], si
inc eax
mov dword [esp + 0x10], eax
inc bl
cmp bl, 0x5a
jbe 0x43a290
mov eax, dword [esp + 0x10]
push 1
xor edx, edx
push edx
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x1c]
mov word [esp + eax*2 + 0x38], dx
call fcn.004698a0
cmp word [esp + 0x28], 0
jne 0x43a67e
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a2c4
Capabilities:
Get disk information

Disassembly:
or byte [ebp - 0x72fa8a40], al
js 0x43a262
jmp 0x43a276
add byte [edi - 0x18], dl
jo 0x43a2e2
add al, 0
add esp, 8
test eax, eax
jne 0x43a30e
xor edi, edi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x10], 0
mov bl, 0x41
jmp 0x43a290
push es
movzx esi, bl
lea ecx, [esp + 0x278]
xor eax, eax
push ecx
mov word [esp + 0x27c], si
mov dword [esp + 0x27e], 0x5c003a
mov word [esp + 0x282], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, edi
je 0x43a2cf
cmp edi, 0x100
jne 0x43a2dd
cmp eax, 1
je 0x43a2dd
mov eax, dword [esp + 0x10]
mov word [esp + eax*2 + 0x28], si
inc eax
mov dword [esp + 0x10], eax
inc bl
cmp bl, 0x5a
jbe 0x43a290
mov eax, dword [esp + 0x10]
push 1
xor edx, edx
push edx
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x1c]
mov word [esp + eax*2 + 0x38], dx
call fcn.004698a0
cmp word [esp + 0x28], 0
jne 0x43a67e
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b7d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
push ebx
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov dword [esp + 0x18], ecx
mov ecx, dword [0x4c1688]
push 0x49eb0c
call fcn.004698a0
mov edi, dword [ebp + 8]
test edi, edi
je 0x43b82c
cmp word [edi], 0
je 0x43b82c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43b83a
test al, 0x10
je 0x43b82c
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x5c
push edi
call fcn.00483835
mov ebx, eax
add esp, 8
cmp ebx, edi
jbe 0x43b8aa
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43b850
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x43b82c
mov esi, ebx
sub esi, edi
sar esi, 1
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00485434
xor ecx, ecx
add esp, 0xc
lea edx, [esp + 0x10]
mov word [esp + esi*2 + 0x10], cx
mov ecx, dword [esp + 0xc]
push edx
call fcn.0043b7d0
cmp word [ebx + 2], 0
je 0x43b82c
mov ecx, dword [0x4c1688]
push 1
call fcn.00401240
cmp word [eax], 0x31
je 0x43b82c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov eax, 0x49c138
jne 0x43b8c1
mov eax, 0x49eb0c
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.004698a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43b906
Capabilities:
Read file on windows

Disassembly:
add byte [ebx + 0x4c16880d], cl
add byte [edx + 1], ch
push 0
push edi
push 0x49eb0c
call fcn.004698a0
mov eax, dword [0x4bd4c4]
mov eax, dword [eax + 0xf0]
and eax, 0x7fffffff
mov byte [esp + 0xf], 0
mov byte [esp + 0x14], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], eax

Function at 0x43b954
Capabilities:
Read file on windows

Disassembly:
mov eax, esi
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x43b951
cmp ecx, 9
jne 0x43b956
add eax, 2
jmp 0x43b944
cmp word [eax], 0x2a
jne 0x43ba36
movzx ebx, word [eax + 2]
lea esi, [eax + 2]
test ebx, 0xffffff80
jne 0x43b981
push 2
push ebx
call fcn.00482fce
add esp, 8
test eax, eax
je 0x43b981
and ebx, 0xffffffdf
movzx eax, bx
add eax, 0xffffffbd
cmp eax, 0x11
ja case.0x43b997.68
movzx ecx, byte [eax + 0x43bd7c]
jmp dword [ecx*4 + 0x43bd68]
mov byte [esp + 0x14], 1
jmp case.0x43b997.68
lea ebx, [esi + 2]
mov eax, ebx
call fcn.0040c8b0
movzx edx, al
neg edx
sbb edx, edx
and edx, 6
add edx, 0xa
push edx
push 0
push ebx
call fcn.0048376e
add esp, 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
test edx, edx
ja 0x43bd57
jb 0x43b9e5
cmp eax, 0x40000000
ja 0x43bd57
mov ebx, 0x49eed0
mov eax, esi
call fcn.00408fc0
invalid
Function at 0x43baaa
Capabilities:
Read file on windows

Disassembly:
mov ebx, eax
mov esi, edx
mov ecx, ebx
and ecx, esi
cmp ecx, 0xffffffff
je 0x43bd41
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
jne 0x43bae2
test esi, esi
ja 0x43bd41
jb 0x43bae2
cmp ebx, 0x40000000
ja 0x43bd41
cmp ecx, esi
ja 0x43baf0
jb 0x43baec
cmp eax, ebx
jae 0x43baf0
mov ebx, eax
mov esi, ecx
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
mov eax, ebx
or eax, esi
jne 0x43bb1a
mov ecx, dword [0x4bd4c4]
mov dword [ecx + 0x30], eax
jmp 0x43bd50
cmp byte [esp + 0x14], 0
je 0x43bb55
mov esi, dword [esp + 0x10]
push 0
mov edx, ebx
mov eax, ebx
shr edx, 1
and eax, 1
push 1
add edx, eax
push edx
push 0
mov ecx, esi
call fcn.004698a0
cmp eax, 1
je 0x43bb63
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebx + 2]
push ecx
call fcn.00481e64
add esp, 4
jmp 0x43bb6c
push 1
mov ecx, esi
call fcn.00401240
push 0
lea edx, [esp + 0x1c]
push edx
push ebx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4bd4c4]
push edi
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x43bcf3
cmp byte [esp + 0x14], 0
mov edx, dword [esp + 0x18]
mov byte [edx + esi], 0
mov eax, dword [esp + 0x18]
mov byte [eax + esi + 1], 0
jne 0x43bc41
mov eax, dword [esp + 0x18]
cmp eax, 3
jb 0x43bbec
cmp byte [esi], 0xef
jne 0x43bbec
cmp byte [esi + 1], 0xbb
jne 0x43bbec
cmp byte [esi + 2], 0xbf
jne 0x43bbec
mov ebx, dword [esp + 0x10]
push 0xfde9
add eax, 0xfffffffd
push eax
lea ecx, [esi + 3]
push ecx
call fcn.0046a310
jmp 0x43bc27
cmp eax, 2
jb 0x43bc92
cmp byte [esi], 0xff
jne 0x43bc92
cmp byte [esi + 1], 0xfe
jne 0x43bc92
mov dl, 1
mov ecx, esi
test dl, dl
je 0x43bc16
lea ecx, [esi + 2]
add eax, 0xfffffffe
push 1
push 0
shr eax, 1
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.004698a0
test esi, esi
je 0x43bc34
push esi
call fcn.004833c5
add esp, 4
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
xor dl, dl
cmp ecx, 0x4b0
je 0x43bc0a
mov ebx, dword [esp + 0x10]
push ecx
push eax
push esi
call fcn.0046a310
jmp 0x43bc27
cmp byte [esp + 0x14], 0
jne 0x43bd03
push esi
call fcn.004833c5
add esp, 4
mov ecx, dword [esp + 0x10]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004698a0
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49eb0c
call fcn.004698a0
add al, byte [eax]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
call fcn.00412940
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4bd4c4]
mov dword [ecx + 0x30], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43c236
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49eb0c
call fcn.004698a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
dec ecx
or al, 0x8a
dec ecx
adc eax, 0xf01c1f6
test byte [ecx + 0x6a000000], ah
add byte [edx], ch
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43c275
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x4bd4c4]
mov dword [edx + 0x30], eax
jmp 0x43c150
mov eax, dword [0x4c0cc0]
call fcn.00412820
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x4c0cc0]
push edx
push 1
call fcn.00401240
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc esi
mov ecx, dword [0x4bd4c4]
mov dword [ecx + 0x30], eax
mov eax, 0x49eb0c
jne 0x43c2be
mov eax, 0x49c138
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.004698a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43c470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov ecx, 0x4c2fe4
call fcn.00404030
test eax, eax
jne 0x43c4a6
mov ecx, dword [ebp + 8]
push 0x4a5c64
push eax
push str.Cant_open_clipboard_for_reading.
call fcn.0042b6a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4c1688]
push 1
xor esi, esi
push esi
push 0xffffffffffffffff
push 0x49eb0c
call fcn.004698a0
mov eax, dword [ebp + 0xc]
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x18], ebx
cmp ebx, 0xffffffff
jne 0x43c533
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4bd4c4]
mov dword [ecx + 0x30], eax
cmp dword [0x4c2ffc], esi
je 0x43c754
cmp dword [0x4c2fec], esi
je 0x43c513
mov edx, dword [0x4c2fe4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4c2fec], esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4c2ffc], esi
mov dword [0x4c2fe4], esi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4bd4c4]
mov dword [eax + 0x30], esi
push esi
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
mov dword [esp + 0x14], eax
cmp eax, esi
je 0x43c6ce
Function at 0x43d5b1
Capabilities:
Check for time delay via gettickcount

Disassembly:
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43d5b4
sub eax, edx
sar eax, 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4c38b4]
mov ecx, dword [0x4bd4c4]
cmp eax, dword [ecx + 0xd0]
jbe 0x43d610
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x43d605
push 1
push 0xffffffffffffffff
call fcn.00401350
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c38b4], eax
test byte [esp + 0x28], 0x10
je 0x43d699
cmp word [esp + 0x54], 0x2e
jne 0x43d63b
mov ax, word [esp + 0x56]
test ax, ax
je 0x43d699
cmp ax, 0x2e
jne 0x43d63b
cmp word [esp + 0x58], 0
je 0x43d699
lea eax, [esp + 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43d642
sub eax, edx
sar eax, 1
add eax, esi
cmp eax, dword [esp + 0x14]
jae 0x43d699
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x58]
push ecx
push 0x49fbb8
push edx
call fcn.004821e3
mov eax, dword [ebp + 0x10]
add esp, 0x10
push 1
push ebx
push eax
lea ecx, [esp + 0x324]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x2a8]
push edx
call fcn.0043d0b0
add dword [esp + 0x10], eax
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43d5c5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x18], 0
jne 0x43d6cd
mov eax, dword [esp + 0x10]
cdq
push 0x18
push edx
push eax
mov eax, dword [0x4c1688]
call fcn.004010e0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14