joyce8/EMBER2024-capa huggingface dataset:
Function at 0x151c7a4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [0x1528470], 0
je 0x151c7bc
mov byte [ebp - 1], 1
jmp 0x151c970
push 0x151c978
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1528470], eax
cmp dword [0x1528470], 0
jne 0x151c7dd
mov byte [ebp - 1], 0
jmp 0x151c970
mov eax, dword [0x1528470]
call fcn.014fb290
movzx eax, ax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa6d0
je 0x151c81c
cmp dword [ebp - 8], 0x6a6d
je 0x151c81c
cmp dword [ebp - 8], 0xbfbc
je 0x151c81c
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov byte [ebp - 1], 0
jmp 0x151c970
push 0x151c988
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x152842c], eax
push 0x151c99c
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528430], eax
push 0x151c9b0
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528434], eax
push 0x151c9c0
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528448], eax
push 0x151c9d4
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528438], eax
push 0x151c9e0
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x152843c], eax
push 0x151c9f0
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528440], eax
push 0x151ca00
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528444], eax
push 0x151ca10
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x152844c], eax
push 0x151ca34
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528450], eax
push 0x151ca50
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528454], eax
push 0x151ca6c
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528458], eax
push 0x151ca8c
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x152845c], eax
push 0x151caac
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528460], eax
push 0x151cad4
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528464], eax
push 0x151cafc
mov eax, dword [0x1528470]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1528468], eax
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x1520950
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x15209df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x15284c0
push 0x101
call sub.ws2_32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x15209c9
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0148d72c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov eax, 0x15209f4
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x1c]
push eax
push 2
mov ecx, dword [0x1523f30]
mov dl, 1
mov eax, dword [0x148982c]
call fcn.0148e1f0
call fcn.014840cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x15209e6
lea eax, [ebp - 0x20]
call fcn.014847f4
ret

Function at 0x1520aa4
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
call fcn.01520950
xor eax, eax
push ebp
push 0x1520bb7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1520bc8
call sub.ws2_32.dll_getprotobyname
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movsx eax, word [eax + 8]
push eax
push 2
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x1520afb
call fcn.0148416c
jmp 0x1520bbe
xor eax, eax
push ebp
push 0x1520b9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.01483484
mov word [ebp - 0x28], 2
xor eax, eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x26], 0
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.ws2_32.dll_bind
test eax, eax
je 0x1520b48
call fcn.0148416c
call fcn.0148416c
jmp 0x1520bbe
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x24], eax
mov ax, word [ebp - 8]
push eax
call sub.ws2_32.dll_htons
mov word [ebp - 0x26], ax
push 0x10
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.0148af64
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.ws2_32.dll_sendto
test eax, eax
setge byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1520ba4
mov eax, dword [ebp - 0x18]
push eax
call sub.ws2_32.dll_closesocket
ret
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x1e50144
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x94e661fb
inc si
pop eax
sub eax, 0xc04ba922
bound eax, qword [esi + 0x6939938]
push ecx
cmp bl, al
mov dh, 0x85
push 0xc2f83290
invalid
add byte [eax + ebp*8 + 0x206f], bl
sbb al, ah
neg al
shl al, cl
mov al, byte [edi]
loopne 0x1e5013d
fcom st(2)
loopne 0x1e500d5
pop es
push ebx
call fcn.011f69fa
salc
cmp dword [edx], edi
sbb ch, byte [esi]
xor al, 0xc6
add ebx, dword [edx + 0x7ce605bc]
sahf
das
xchg ecx, eax
out 0xa, al
xor dword [edx + 0x4aaad8f8], edx
jne 0x1e50145
or al, 0xee
mov ebx, 0xf8fb5a9e
sbb edi, esp
dec eax
imul edi, dword [edx], 0x71
stosd dword es:[edi], eax
in al, dx
cli
lodsb al, byte [esi]
dec ebp
pop ds
rol byte [esi], 0xa7
jle 0x1e501f1
push edx
inc ebx
sbb eax, 0xc19f8398
dec ecx
sbb byte [edx - 0x53df9a3d], bh
aas
in al, dx
daa
int3
mov eax, dword [0xa8451370]
std
in al, 0x18
test eax, 0xaf1878a9
adc al, byte [edx + 0x698657a3]
insd dword es:[edi], dx
out 0x2c, eax
xor al, 0xc6
add eax, 0x4e708f68
out dx, eax
in al, dx
mov word [edi - 0x6d], gs
in eax, 0xc7
xchg esp, eax
clc
sub ecx, dword [esi - 0x32]
invalid
Function at 0x402e8c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4bf008], 0x8088405
inc edx
mov dword [ebx + 0x4bf008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4030d4
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403107
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x40310e
cmp edx, dword [ebx + 8]
je 0x403118
mov eax, 0x65
jmp 0x403113
mov eax, 5
jmp 0x403113
call sub.kernel32.dll_GetLastError
call fcn.00402884
mov eax, ebx
pop ebx
ret

Function at 0x403484
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4bf024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40351c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034fc
xor eax, eax
push ebp
push 0x4034f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403538
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4bf024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4bf024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041e0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c2048], 0
je 0x404241
cmp word [0x4c221c], 0xd7b2
jne 0x404209
cmp dword [0x4c2224], 0
jbe 0x404209
mov eax, 0x4c2218
call dword [0x4c2234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4bf094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404268
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4bf034], 0
jne 0x40425d
push 0
push 0x4bf08c
push 0x4bf094
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4060e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40614a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004045cc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403000
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406134
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406151
lea eax, [ebp - 0x10]
call fcn.0040435c
ret

Function at 0x40b490
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040444c
jmp 0x40b4d2
mov eax, ebx
mov edx, esi
call fcn.004043b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b4dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4fd
mov al, byte [esp]
jmp 0x40b4ff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bb84
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b9fc
mov eax, dword [0x4c1008]
cmp byte [eax], 0
je 0x40bc00
mov eax, dword [0x4c0e04]
call fcn.00402cbc
call fcn.00402864
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408bc8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bc48
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bc36
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4c0dac]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c2664]
call fcn.004055f8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c49c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c572
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004043f4
lea eax, [ebp - 8]
call fcn.0040486c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040481c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c55c
mov eax, ebx
call fcn.004026fc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c555
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040481c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c53f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c584
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c53f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c55c
mov eax, dword [ebp - 0x10]
call fcn.0040271c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c579
lea eax, [ebp - 8]
call fcn.0040435c
ret

Function at 0x40ca84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cae8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004045cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408664
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40caef
lea eax, [ebp - 0xc]
call fcn.0040435c
ret

Function at 0x41b918
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4c2884
cmp dword [edi], 0
jne 0x41b994
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4c2880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4bf494
mov ecx, 2
call fcn.00402904
mov edx, 0x41b8f0
lea eax, [esi + 5]
call fcn.0041b910
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b910
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b969
mov dword [0x4c2880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41cf20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41cf26
ret
Function at 0x41f53c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41f58d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41f574
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41f564
jmp 0x41f58d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41f575
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4282a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040480c
xor eax, eax
push ebp
push 0x4283ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4283a1
xor eax, eax
push ebp
push 0x42839a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040461c
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42836f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x42835e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040461c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040481c
mov edx, ebx
pop ecx
call fcn.00402904
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428365
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4c0d44]
mov dl, 1
mov eax, dword [0x40753c]
call fcn.0040bd08
call fcn.00403d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4283d5
lea eax, [ebp - 4]
call fcn.0040435c
ret
Function at 0x4283dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42858d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404a0c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4285a4
call fcn.00404668
mov eax, ebx
call fcn.0041aeac
mov edi, eax
dec edi
test edi, edi
jl 0x428494
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041ae80
mov edx, dword [0x42de1c]
call fcn.00403798
test al, al
je 0x428490
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041ae80
lea edx, [ebp - 0x14]
call fcn.00435e94
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404a0c
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004046dc
inc esi
dec edi
jne 0x428442
mov al, byte [0x4285a8]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4285b4
mov eax, dword [ebp - 0xc]
call fcn.0040d05c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004043f4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00435e94
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4285a4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00435e94
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4285a4
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4285a4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4285c0
call fcn.00409290
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428594
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404380
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404380
lea eax, [ebp - 0x14]
call fcn.0040435c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404380
ret
Function at 0x42a3b4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42a426
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x42a3fa
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404554
jmp 0x42a401
mov eax, ebx
call fcn.0040435c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a42d
cmp dword [ebp - 8], 0
je 0x42a41d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x42a434
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x42a4d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x42a4a9
mov edx, ebx
mov eax, dword [0x41c9e4]
call fcn.00420d20
test al, al
je 0x42a499
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00420c30
call fcn.00403e44
jmp 0x42a4dd
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x42a464
mov ecx, dword [0x4c0da0]
mov dl, 1
mov eax, dword [0x40753c]
call fcn.0040bd08
call fcn.00403d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a4dd
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42a4e4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x42a53c
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a543
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x42a54c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x42a5a1
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a5a8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x42a618
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x42a68d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042a2f0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00420cf4
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x42a677
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a694
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x42a69c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x42a711
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042a2f0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x42a6fb
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a718
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x430678
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4305c4
call sub.user32.dll_EnumWindows
ret