joyce8/EMBER2024-capa huggingface dataset:
Function at 0x672bb8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x672bca
add esp, 0xfffffff0
call fcn.0040b5d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004cf6e8
mov eax, dword [0x72568c]
mov dword [eax + 4], ebx
mov dword [eax], 0x673084
mov eax, dword [0x725690]
mov dword [eax + 4], ebx
mov dword [eax], 0x673090
mov eax, ebx
call fcn.0067309c
push 0
call fcn.00716f02
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0x84], eax
push 0
call fcn.00716eb4
mov esi, eax
push 0x5a
push esi
call fcn.00716b60
mov dword [ebx + 0x50], eax
push esi
push 0
call fcn.0071710c
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x66d5b4
push eax
push 0
push 0
call fcn.00716e42
mov dl, 1
mov eax, dword [0x544480]
call fcn.0054ab54
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x544480]
call fcn.0054ab54
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x544480]
call fcn.0054ab54
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x544480]
call fcn.0054ab54
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x544480]
call fcn.0054ab54
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.00673678
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x6734a8
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x6734a8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x6734a8
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x6734a8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x6734a8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x672d4a
call fcn.0040b62c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x673248
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6733f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x6733d4
mov dl, 1
mov eax, dword [0x493f40]
call fcn.004bd808
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040ccac
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.00716f08
dec eax
test eax, eax
jl 0x6733c3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00578550
test al, al
je 0x6733b6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x673404
lea eax, [ebp - 0x394]
call fcn.0042753c
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
jne 0x6733b6
xor eax, eax
push ebp
push 0x6733af
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x673474
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x673398
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.0040da4c
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x673398
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.0040da4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6733b6
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x6732b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004bd730
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6733fa
lea eax, [ebp - 0x3a0]
call fcn.0040ccac
ret

Function at 0x674000
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x72cbb4]
cmp byte [eax + 0xc5], 0
jne 0x674072
cmp dword [0x72cbd8], 0
jne 0x674032
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x721720]
push eax
push 3
call fcn.007171d2
mov dword [0x72cbd8], eax
cmp dword [0x72cbd4], 0
jne 0x67404d
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x72cbd4], eax
cmp dword [0x72cbdc], 0
jne 0x674072
push esp
push 0
push 0
mov eax, dword [0x721828]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x72cbdc], eax
pop edx
ret
Function at 0x674494
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x6744ab
add esp, 0xfffffff0
call fcn.0040b5d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004cf6e8
mov eax, dword [0x7255f4]
cmp byte [eax], 0
jne 0x6744d8
push 0
call fcn.00717288
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x725694]
cmp word [eax + 2], 0
jne 0x6744f2
mov eax, dword [0x725694]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0067692c
mov eax, dword [0x725698]
cmp word [eax + 2], 0
jne 0x67450c
mov eax, dword [0x725698]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00676b30
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x544480]
call fcn.0054ab54
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x6770a8
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x54921c]
call fcn.00554e10
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x6746fc
mov eax, dword [0x725640]
mov eax, dword [eax]
push eax
call fcn.00717064
mov edx, eax
mov eax, esi
call fcn.0055532c
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x677390
mov dl, 1
mov eax, dword [0x490584]
call fcn.0040aee8
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x725640]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0042733c
test eax, eax
je 0x674626
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00427194
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00427320
test eax, eax
je 0x67463e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.00716d34
push eax
call fcn.00716d2e
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.0040da4c
push ebx
push 0x67630c
call fcn.0066915c
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x7255f4]
cmp byte [eax], 0
jne 0x67468f
mov eax, ebx
call fcn.006748c4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.006775c8
mov eax, ebx
call fcn.00678250
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x6746f3
call fcn.0040b62c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x674bf0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x674c92
cmp dword [ebx + 0xac], 0
jne 0x674c8c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x674b30
call fcn.00716e4e
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x674c8c
push 3
mov eax, dword [esp + 4]
push eax
call fcn.00716fb6
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.00716fc8
test al, 8
je 0x674c52
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x674c8c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004b8878
push eax
call fcn.007171c0
dec esi
cmp esi, 0xffffffff
jne 0x674c61
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x674f38
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x72cbb4]
cmp dword [eax + 0x188], 0
je 0x6750a1
test bl, bl
jne 0x674ff4
cmp dword [esi + 0xb4], 0
jne 0x674fe9
mov eax, esi
call fcn.006780a0
push eax
push 0x674e38
call fcn.00716e4e
cmp dword [esi + 0x58], 0
je 0x674fba
mov eax, dword [0x72cbb4]
cmp byte [eax + 0xeb], 0
je 0x674fba
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x674f9b
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x674fba
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.007171ea
dec edi
cmp edi, 0xffffffff
jne 0x674fa3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x674fe9
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b8878
push eax
call fcn.007171de
dec edi
cmp edi, 0xffffffff
jne 0x674fc9
inc dword [esi + 0xb4]
jmp 0x6750a1
cmp dword [esi + 0xb4], 0
jle 0x6750a1
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x6750a1
cmp dword [esi + 0x58], 0
je 0x675056
mov eax, dword [0x72cbb4]
cmp byte [eax + 0xeb], 0
je 0x675056
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x675037
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x675056
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.007171ea
dec edi
cmp edi, 0xffffffff
jne 0x67503f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x675085
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b8878
push eax
call fcn.007171de
dec edi
cmp edi, 0xffffffff
jne 0x675065
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x66568c]
call fcn.0040f31c
pop edi
pop esi
pop ebx
ret
Function at 0x675e28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x675e85
cmp byte [ebx + 0xeb], 0
jne 0x675e85
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call fcn.00716fda
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040ce34
mov eax, dword [esi]
test eax, eax
je 0x675e72
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x675e92
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040d08c
jmp 0x675e92
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040d08c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x6777dc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x67784d
mov eax, esi
call fcn.00572060
test al, al
je 0x67784d
mov eax, dword [ebx + 0x98]
call fcn.00571c8c
push eax
call fcn.00717046
test eax, eax
je 0x67784d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x67783e
push 0
mov eax, dword [ebx + 0x98]
call fcn.00571c8c
push eax
call fcn.007171ea
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00568864
jmp 0x67784d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.006775e8
pop esi
pop ebx
ret
Function at 0x67f19c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x67f222
mov eax, dword [ebx + 8]
call fcn.00571c8c
mov ecx, eax
mov dl, 1
mov eax, dword [0x58561c]
call fcn.0056bda4
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.00593628
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x67ea6c
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00571c8c
push eax
call fcn.007171c0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00571c8c
push eax
call fcn.007171ea
cmp dword [ebx + 0x9c], 0
jne 0x67f2a4
mov eax, dword [ebx + 8]
call fcn.00571c8c
mov ecx, eax
mov dl, 1
mov eax, dword [0x58561c]
call fcn.0056bda4
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.00593628
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x67eab8
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00571c8c
push eax
call fcn.007171c0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00571c8c
push eax
call fcn.007171ea
cmp dword [ebx + 0x94], 0
jne 0x67f322
mov eax, dword [ebx + 8]
call fcn.00571c8c
mov ecx, eax
mov dl, 1
mov eax, dword [0x586e24]
call fcn.0056bda4
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
mov byte [esi + 0x2a0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00571c8c
push eax
call fcn.007171c0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00571c8c
push eax
call fcn.007171ea
pop esi
pop ebx
ret
Function at 0x6836a8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x683795
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x683767
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x683756
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00409f7c
mov eax, dword [ebp - 4]
call fcn.006833e4
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call fcn.00717154
test eax, eax
jne 0x68373f
mov ecx, dword [0x725aec]
mov dl, 1
mov eax, dword [0x49016c]
call fcn.0042c688
call fcn.0040c47c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68375d
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret

Function at 0x6838c0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call fcn.00716e9c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x683932
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x683906
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.0040da10
jmp 0x68390d
mov eax, ebx
call fcn.0040ccac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683939
cmp dword [ebp - 8], 0
je 0x683929
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x683974
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x683a19
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.00716e3c
mov ebx, eax
test bx, bx
je 0x6839ec
mov edx, ebx
mov eax, dword [0x5475c0]
call fcn.0054fe50
test al, al
je 0x6839dc
movzx eax, bx
push eax
call fcn.00716e9c
mov esi, eax
push 9
call fcn.00716e9c
push eax
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0054fd48
call fcn.0040c570
jmp 0x683a20
movzx eax, bx
push eax
call fcn.00716e3c
mov ebx, eax
test bx, bx
jne 0x6839a6
mov ecx, dword [0x725d20]
mov dl, 1
mov eax, dword [0x6832ec]
call fcn.0042c688
call fcn.0040c47c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683a20
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x683a28
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x683a7d
push dword fs:[edx]
mov dword fs:[edx], esp
push 2
call fcn.00716e9c
mov ebx, eax
push 9
call fcn.00716e9c
push eax
mov ecx, ebx
mov dx, 2
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683a84
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x683a8c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x683ae1
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call fcn.00716e9c
mov ebx, eax
push 9
call fcn.00716e9c
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683ae8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x683b58
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x683bcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006833e4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0054fe30
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call fcn.00717154
cmp dword [ebp - 0x10], 0
je 0x683bb7
mov eax, dword [ebp - 0x10]
push eax
push 9
call fcn.00717154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683bd4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x683bdc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x683c51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006833e4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x6c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call fcn.00717154
cmp dword [ebp - 0x10], 0
je 0x683c3b
mov eax, dword [ebp - 0x10]
push eax
push 9
call fcn.00717154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683c58
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x704c34
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
test edi, edi
je 0x704d66
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x704d66
cmp dword [esp + 0x28], 0
je 0x704d66
mov dword [esp], str.borlndmm
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
test esi, esi
je 0x704d66
mov ebp, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysGetMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [edi], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysFreeMem_qqrpv
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysReallocMem_qqrpvi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysAllocMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebp], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysRegisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [esp], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 4], str._Borlndmm_SysUnregisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [esi], eax
mov eax, dword [edi]
mov dword [0x740af8], eax
cmp dword [ebp], 0
jne 0x704d1a
mov dword [ebp], 0x704c04
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jne 0x704d29
mov dword [eax], 0x704bf4
mov ecx, dword [esi]
test ecx, ecx
je 0x704d56
cmp dword [edi], 0
je 0x704d66
cmp dword [ebx], 0
je 0x704d66
mov esi, dword [esp + 0x28]
cmp dword [esi], 0
je 0x704d66
cmp dword [ebp], 0
je 0x704d66
cmp dword [eax], 0
je 0x704d66
xor eax, eax
test ecx, ecx
setne al
jmp 0x704d68
mov dword [esi], 0x704bf4
mov ecx, 0x704bf4
cmp dword [edi], 0
jne 0x704d34
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x706980
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x7238d0], eax
jbe 0x7069bd
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x740bfc]
call sub.KERNEL32.DLL_ReadFile
add esp, 0xc
cmp eax, 1
jne 0x7069c4
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
jmp 0x7069da
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
jne 0x7069d6
add esp, 0xc
ret
sub esp, 0xc
push ecx
call fcn.00707674
add esp, 0x10
add esp, 0xc
ret

Function at 0x7069f8
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x7238d0], eax
jbe 0x706a35
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x740bfc]
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
cmp eax, 1
jne 0x706a46
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
call fcn.00707674
add esp, 0x10
add esp, 0xc
ret
call fcn.00707714
add esp, 0xc
ret