joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x420444]
xor eax, esp
mov dword [esp + 0x620], eax
push esi
push edi
mov edi, dword [esp + 0x630]
xor esi, esi
push 0x20a
lea eax, [esp + 0xe]
push esi
push eax
mov word [esp + 0x14], si
call fcn.004070e0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x4045fa
push 0x410
lea edx, [esp + 0x21a]
push esi
push edx
mov word [esp + 0x21e], si
mov word [esp + 0x220], si
call fcn.004070e0
add esp, 0xc
push 0x208
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4045be
cmp eax, esi
je 0x4045be
lea edx, [esp + 0x214]
push edx
mov ecx, edi
mov word [esp + eax*2 + 0x218], si
call fcn.004036e0
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.004077bb
add esp, 0x624
ret
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4045c5
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00402c40
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.004077bb
add esp, 0x624
ret
mov ecx, dword [esp + 0x628]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.004077bb
add esp, 0x624
ret

Function at 0x405930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x419cab
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push esi
push edi
mov eax, dword [0x420444]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
movzx eax, word [esp + 0xa4]
push 0x41b3a0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x405a2f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405a2f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x405a2f
mov eax, dword [esp + 0xa8]
cmp dword [eax + 0x18], 8
jb 0x4059ba
mov eax, dword [eax + 4]
jmp 0x4059bd
add eax, 4
push 1
push 0x40
push 0x20
push eax
lea ecx, [esp + 0x1c]
call fcn.00405490
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0xa4], 0
call fcn.00405380
lea ecx, [esp + 0xc]
call fcn.00404a50
lea ecx, [esp + 0x60]
mov dword [esp + 0x9c], 0xffffffff
call fcn.004049e0
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x64], vtable.std::ios_base.0
call fcn.004069e4
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x94
ret
xor al, al
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x94
ret
Function at 0x4063a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x419dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x420444]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [0x420444]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x14], bl
mov byte [esp + 0x18], bl
call fcn.00406060
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add esp, 0xc
push eax
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x3c]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edx
mov word [ecx + 4], bx
call fcn.004029b0
call fcn.00405a50
add esp, 0x24
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x28], 8
jb 0x40645c
mov eax, dword [esp + 0x14]
push eax
call fcn.00406ffe
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004077bb
add esp, 0x34
ret 0x10

Function at 0x4077bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420444]
jne 0x4077c5
repz ret
jmp fcn.0040daec
Function at 0x40fd0c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x421018]
je 0x40fd27
inc edi
cmp edi, 0x17
jb 0x40fd18
cmp edi, 0x17
jae 0x40fea7
push ebp
push 3
call fcn.00416baa
cmp eax, 1
pop ecx
je 0x40fe73
push 3
call fcn.00416baa
test eax, eax
pop ecx
jne 0x40fd5b
cmp dword [0x42044c], 1
je 0x40fe73
cmp ebx, 0xfc
je 0x40fea6
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x421b68
push ebp
call fcn.0040bd5b
add esp, 0xc
test eax, eax
je 0x40fd91
push esi
push esi
push esi
push esi
push esi
call fcn.004071f7
add esp, 0x14
push 0x104
mov esi, 0x421b81
push esi
push 0
mov byte [0x421c85], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40fdd5
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040bd5b
add esp, 0xc
test eax, eax
je 0x40fdd5
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004071f7
add esp, 0x14
push esi
call fcn.00409840
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40fe1a
push esi
call fcn.00409840
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x421e7c
push 0x41c4fc
sub ecx, eax
push ecx
push eax
call fcn.00411d46
add esp, 0x14
test eax, eax
je 0x40fe1a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004071f7
add esp, 0x14
jmp 0x40fe1c
xor esi, esi
push 0x41c4f8
push ebx
push ebp
call fcn.00411c85
add esp, 0xc
test eax, eax
je 0x40fe3c
push esi
push esi
push esi
push esi
push esi
call fcn.004071f7
add esp, 0x14
push dword [edi*8 + 0x42101c]
push ebx
push ebp
call fcn.00411c85
add esp, 0xc
test eax, eax
je 0x40fe5e
push esi
push esi
push esi
push esi
push esi
call fcn.004071f7
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004169ed
add esp, 0xc
jmp 0x40fea6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40fea6
cmp ebp, 0xffffffff
je 0x40fea6
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x42101c]
push dword [esi]
call fcn.00409840
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4169ed
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d4f8
xor ebx, ebx
cmp dword [0x42210c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x416ac3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x416ba3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x416ba3
push eax
call fcn.0040d48a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42210c], eax
call esi
push eax
call fcn.0040d48a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x422110], eax
call esi
push eax
call fcn.0040d48a
mov dword [0x422114], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040ad58
test eax, eax
pop ecx
pop ecx
je 0x416a91
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004071f7
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x416ac3
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040d48a
cmp eax, ebx
pop ecx
mov dword [0x42211c], eax
je 0x416ac3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d48a
pop ecx
mov dword [0x422118], eax
mov eax, dword [0x422118]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x416b48
cmp dword [0x42211c], ecx
je 0x416b48
push eax
call fcn.0040d501
push dword [0x42211c]
mov esi, eax
call fcn.0040d501
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x416b48
cmp edi, ebx
je 0x416b48
call esi
cmp eax, ebx
je 0x416b15
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416b15
test byte [ebp - 0x18], 1
jne 0x416b48
lea eax, [ebp - 0x10]
push eax
call fcn.0040ad8f
test eax, eax
pop ecx
je 0x416b30
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004071f7
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x416b3f
or dword [ebp + 0x10], 0x200000
jmp 0x416b83
or dword [ebp + 0x10], 0x40000
jmp 0x416b83
mov eax, dword [0x422110]
cmp eax, dword [ebp - 8]
je 0x416b83
push eax
call fcn.0040d501
cmp eax, ebx
pop ecx
je 0x416b83
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x416b83
mov eax, dword [0x422114]
cmp eax, dword [ebp - 8]
je 0x416b83
push eax
call fcn.0040d501
cmp eax, ebx
pop ecx
je 0x416b83
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42210c]
call fcn.0040d501
cmp eax, ebx
pop ecx
je 0x416ba3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416ba5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402400
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
jne 0x40244c
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.Error__d_when_getting_local_host_name.
call fcn.00413a20
add esp, 8
xor al, al
pop edi
add esp, 0x104
ret
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
mov dword [esp + 4], eax
jne 0x402475
push str.Yow__Bad_host_lookup.
call fcn.00413a20
add esp, 4
xor al, al
pop edi
add esp, 0x104
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x4024eb
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, dword [eax]
push 0x1c
push 1
call sub.util.dll_nd_chk_calloc
add esp, 8
mov ebp, eax
push esi
mov dword [ebp], 0
mov dword [ebp + 4], 0
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x465480
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.util.dll_list_add_first
mov ecx, dword [esp + 0x18]
add ebx, 4
add esp, 8
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + ebx]
test eax, eax
jne 0x402483
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
add esp, 0x104
ret
Function at 0x40d270
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
call fcn.0040d010
add esp, 4
test al, al
jne 0x40d28c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ecx, dword [0x4648f4]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, ebp
and eax, 0xff
push 0
push edi
push esi
lea eax, [eax + eax*2]
mov edx, dword [ecx + eax*8]
push edx
call sub.WS2_32.dll_send
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d2de
cmp edi, 6
jle 0x40d2ce
mov al, byte [esi + 6]
cmp al, 0x1f
je 0x40d2c8
cmp al, 0x1e
jne 0x40d2ce
inc dword [0x42238c]
push ebp
call fcn.0040ccc0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp edi, 6
jle 0x40d2f4
mov al, byte [esi + 6]
cmp al, 0x1f
je 0x40d2ee
cmp al, 0x1e
jne 0x40d2f4
inc dword [0x422388]
mov al, byte [0x41d084]
test al, al
je 0x40d347
mov eax, dword [0x42238c]
mov ecx, dword [0x422388]
add ecx, eax
cmp ecx, 0x7530
jb 0x40d347
call sub.util.dll_sGetMsTime
fsub qword [0x420820]
sub esp, 8
fmul qword [0x41b210]
fstp qword [esp]
push str.send_all_data_dsp_end_time___f_........................._n
call fcn.00413a20
push 0x7530
call sub.util.dll_sMsSleep
add esp, 0x10
mov byte [0x41d084], 0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
Function at 0x410750
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x34
lea eax, [esp + 4]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push edi
push eax
push ecx
lea eax, [esp + 0x44]
push edx
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x44]
push edx
push eax
push str._s__x__d__d_t_d_t_d__x__x___f___f
push ecx
call fcn.00413d5a
mov edx, dword [esp + 0x6c]
push edx
push 0
call fcn.00411f90
mov edi, eax
mov eax, dword [esp + 0x74]
add esp, 0x38
cmp eax, 0x10000
jb 0x4107cf
lea eax, [esp + 0x24]
push eax
push str.iec104
push str.__s_zfyk.xml:_
call sub.dblib.dll_PutInfo
add esp, 0xc
xor al, al
pop edi
add esp, 0x34
ret
push esi
mov esi, dword [0x4227e0]
test esi, esi
je 0x4107f5
cmp dword [esi + 8], edi
je 0x410811
mov ecx, dword [0x4227e0]
push esi
push ecx
call sub.util.dll_list_get_next
mov esi, eax
add esp, 8
test esi, esi
jne 0x4107da
push 0x3c
push 1
call sub.util.dll_nd_chk_calloc
mov esi, eax
push esi
push 0x4227e0
mov dword [esi + 8], edi
call sub.util.dll_list_add_last
add esp, 0x10
mov eax, dword [esp + 8]
cmp eax, 0x2d
je 0x41088a
cmp eax, 0x3a
je 0x41088a
cmp eax, 0xff
je 0x41088a
cmp eax, 0x4a
je 0x41088a
cmp eax, 0x2e
je 0x41087b
cmp eax, 0x3b
je 0x41087b
cmp eax, 0x2f
je 0x41086c
cmp eax, 0x3c
je 0x41086c
cmp eax, 0x30
je 0x41085d
cmp eax, 0x3d
je 0x41085d
cmp eax, 0x31
je 0x41085d
cmp eax, 0x3e
je 0x41085d
cmp eax, 0x32
je 0x41085d
cmp eax, 0x3f
jne 0x41088d
mov eax, dword [esi + 0x28]
inc eax
mov dword [esi + 0x28], eax
pop esi
mov al, 1
pop edi
add esp, 0x34
ret
mov eax, dword [esi + 0x24]
inc eax
mov dword [esi + 0x24], eax
pop esi
mov al, 1
pop edi
add esp, 0x34
ret
mov eax, dword [esi + 0x20]
inc eax
mov dword [esi + 0x20], eax
pop esi
mov al, 1
pop edi
add esp, 0x34
ret
inc dword [esi + 0x1c]
pop esi
mov al, 1
pop edi
add esp, 0x34
ret
Function at 0x403070
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403084
inc dword [0x4c0fe0]
add dword [0x4bd41c], 0xf8
mov edx, dword [0x4bd41c]
push esi
push edi
mov ecx, 0x3e
mov esi, 0x4bfac8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4030b3
push 0
mov eax, 0x4c3168
call fcn.00415140
cmp dword [0x4c1008], 0
mov dword [0x4c3c18], 0
mov dword [0x4c3c1c], 0
je 0x4030db
push 0x4c17f8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40315f
or ecx, 0xffffffff
cmp byte [esi + 0xe6], 0
jne 0x40310a
xor eax, eax
cmp byte [esp + 0x14], 0x64
sete al
mov byte [esi + 0xe6], al
test al, al
je 0x40310a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4c3c24], 0
je 0x40311c
cmp dword [0x4c3c20], 0
jne 0x403125
cmp byte [esi + 0xe6], 0
je 0x40315f
cmp byte [esi + 0xe6], 0
mov byte [esi + 0xe4], 0
jne 0x40315f
cmp dword [0x4c3c24], 0
jge 0x403147
pop edi
mov dword [esi + 0xd8], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xd4], eax
mov edx, dword [0x4c3c24]
mov dword [esi + 0xd8], edx
pop edi
pop esi
ret
Function at 0x403d50
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x403d73
call fcn.00404060
test eax, eax
jne 0x403d73
push str.Cant_open_clipboard_for_writing.
call fcn.00403e50
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x403dac
cmp dword [esi + 0x18], ebx
je 0x403d9e
cmp dword [esi + 8], ebx
je 0x403d93
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49bbac
call fcn.00403e50
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x403de5
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x403e0c
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x403e0c
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x403e02
cmp dword [esi + 8], ebx
je 0x403df7
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x403e21
mov dword [esi + 4], ebx
jmp 0x403de5
cmp dword [esi + 0x18], ebx
je 0x403e3e
cmp dword [esi + 8], ebx
je 0x403e33
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x49bbcc
call fcn.00403e50
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x403f20
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
lea eax, [esi - 0xc000]
sub esp, 0x20c
cmp eax, 0x3fff
ja 0x403fbd
push 0x104
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.00486b72
add esp, 0xc
test eax, eax
je 0x403fb4
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00486339
add esp, 8
test eax, eax
je 0x403fb4
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00486339
add esp, 8
test eax, eax
je 0x403fb4
lea edx, [esp]
push str.Native
push edx
call fcn.00486339
add esp, 8
test eax, eax
je 0x403fb4
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00486339
add esp, 8
test eax, eax
jne 0x403fc3
xor eax, eax
add esp, 0x20c
ret
xor ecx, ecx
mov word [esp], cx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push edi
call ebx
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push esi
mov ebp, eax
call edi
test eax, eax
jne 0x404050
lea ecx, [ecx]
cmp esi, 0xf
je 0x40404e
lea edx, [esp + 0xc]
push str.OwnerLink
push edx
call fcn.00486339
add esp, 8
test eax, eax
je 0x40404e
mov eax, dword [0x4bd3e0]
cmp eax, 0xffffffff
je 0x40401a
test eax, eax
je 0x40404e
call ebx
mov ecx, dword [0x4bd3e0]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x40404e
push 1
push 0x8000012f
mov dword [0x4bd3e4], 0
call fcn.00401360
add esp, 8
push esi
mov dword [0x4bd3e4], 1
call edi
test eax, eax
je 0x403fe0
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x404060
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ecx + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x4040ea
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
mov eax, dword [0x4c0e74]
push eax
call ebx
test eax, eax
jne 0x4040df
mov eax, dword [0x4bd3e0]
cmp eax, 0xffffffff
je 0x4040af
test eax, eax
je 0x4040f6
call esi
mov ecx, dword [0x4bd3e0]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4040f6
push 1
push 0x8000012f
mov dword [0x4bd3e4], 0
call fcn.00401360
mov edx, dword [0x4c0e74]
add esp, 8
push edx
mov dword [0x4bd3e4], 1
call ebx
test eax, eax
je 0x404090
mov eax, dword [esp + 0xc]
mov dword [eax + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407510
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4bfd80], 0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x4075cb
mov al, byte [0x4bfd82]
cmp al, 0xa0
je 0x407536
cmp al, 0x10
jne 0x4075cb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4bfd7c]
cmp eax, 0x16
jae 0x4075cb
test ebp, 0x100
jne case.0x407567.13
movzx eax, byte [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407567.13
movzx eax, byte [eax + 0x407774]
jmp dword [eax*4 + 0x40776c]
mov cl, 1
jmp 0x407574
xor cl, cl
cmp byte [0x4bfd81], 0
jne 0x407591
xor ecx, ecx
nop
cmp byte [ecx + 0x4bfd64], 0
jne 0x40759c
inc ecx
cmp ecx, 0x16
jl 0x407580
jmp 0x4075cb
cmp byte [esp + 0x1c], 0
je 0x4075a5
test cl, cl
je 0x4075cb
mov byte [0x4bfd83], 1
jmp 0x4075a9
test cl, cl
je 0x4075cb
mov cl, byte [0x4bfd7b]
mov dl, byte [0x4bfd7a]
mov al, byte [0x4bfc87]
mov byte [0x4c0e73], cl
mov byte [0x4c0ea8], dl
mov byte [0x4c0f38], al
mov cl, byte [0x4c0e73]
movzx esi, byte [esp + 0x14]
mov dl, byte [0x4c0ea8]
mov al, byte [0x4c0f38]
mov byte [0x4bfd7b], cl
lea ecx, [esi + esi*8]
mov byte [0x4bfd7a], dl
mov edx, dword [0x4c1a28]
shl ecx, 5
mov bl, byte [ecx + edx + 4]
mov byte [0x4bfc87], al
test bl, bl
je case.default.0x407742
cmp dword [edi + 0x10], 0xffc3d44f
setne dl
test byte [edi + 8], 0x10
mov byte [esp + 0xf], dl
je 0x407622
xor al, al
jmp 0x407637
mov eax, dword [esp + 0x1c]
push eax
mov al, byte [esp + 0x18]
call fcn.004077d0
mov dl, byte [esp + 0x13]
add esp, 4
cmp byte [esp + 0x1c], 0
mov byte [esp + 0x18], al
je 0x40770e
cmp byte [esp + 0x20], 0
jne 0x407661
mov cl, bl
not cl
and byte [0x4c0e71], cl
test dl, dl
je 0x407661
and byte [0x4c0e72], cl
cmp byte [esp + 0x18], 0
je case.default.0x407742
not bl
and byte [0x4c0e73], bl
lea ecx, [esi - 0xa0]
mov byte [esi + 0x4c0e98], 0
cmp ecx, 5
ja case.default.0x407742
jmp dword [ecx*4 + 0x407798]
mov cl, byte [0x4c0f39]
mov byte [0x4c0ea8], cl
jmp case.default.0x407742
mov dl, byte [0x4c0f38]
mov byte [0x4c0ea8], dl
jmp case.default.0x407742
mov al, byte [0x4c0f3b]
mov byte [0x4c0ea9], al
jmp case.default.0x407742
mov cl, byte [0x4c0f3a]
mov byte [0x4c0ea9], cl
jmp case.default.0x407742
mov dl, byte [0x4c0f3d]
mov byte [0x4c0eaa], dl
jmp case.default.0x407742
mov al, byte [0x4c0f3c]
mov byte [0x4c0eaa], al
test byte [edi + 8], 0x10
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop esi
mov word [0x4bfd84], bp
pop ebp
mov byte [0x4bfd82], al
mov byte [0x4bfd81], cl
pop ebx
je 0x407750
xor al, al
mov byte [0x4bfd80], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4bfd7c], eax
pop ecx
ret
cmp byte [esp + 0x20], 0
jne 0x407725
or byte [0x4c0e71], bl
test dl, dl
je 0x407725
or byte [0x4c0e72], bl
test al, al
je case.default.0x407742
or byte [0x4c0e73], bl
lea ecx, [esi - 0xa0]
mov al, 0x80
mov byte [esi + 0x4c0e98], al
cmp ecx, 5
ja case.default.0x407742
jmp dword [ecx*4 + 0x4077b0]
mov byte [0x4c0ea8], al
jmp case.default.0x407742
push ecx
call fcn.004077d0
add esp, 4
mov byte [0x4bfd80], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4bfd7c], eax
pop ecx
ret
Function at 0x4077d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp al, 0xa0
je 0x4077df
cmp al, 0x10
jne case.0x407836.13
cmp byte [esp + 8], 0
jne case.0x407836.13
cmp byte [0x4bfd83], 0
je 0x40780b
xor eax, eax
cmp byte [eax + 0x4bfd64], 0
jne 0x40780b
inc eax
cmp eax, 0x16
jl 0x4077f1
mov byte [0x4bfd83], 0
xor al, al
pop esi
ret
cmp byte [0x4bfd81], 0
je case.0x407836.13
test dword [0x4bfd84], 0x100
jne case.0x407836.13
movzx eax, byte [0x4bfd82]
add eax, 0xfffffff4
cmp eax, 0x22
ja case.0x407836.13
movzx eax, byte [eax + 0x407860]
jmp dword [eax*4 + 0x407858]
call esi
sub eax, dword [0x4bfd7c]
cmp eax, 0x16
jb 0x407807
call esi
mov dword [0x4c3fa8], eax
mov al, 1
pop esi
ret