joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406dbc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406ddd
mov al, byte [esp]
jmp 0x406ddf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c14c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004035f4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x40c1a4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x40d458]
mov dl, 1
mov eax, dword [0x40bd04]
call fcn.004075cc
call fcn.00402d28
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040be0c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40c2c0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, 0x40c250
call fcn.00405450
xor eax, eax
push ebp
push 0x40c3d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40bd64]
call fcn.0040be34
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0040bed4
xor ecx, ecx
mov edx, 0x40c3e8
mov eax, ebx
call fcn.0040bf38
lea ecx, [ebp - 0x10]
mov edx, 0x40c424
mov eax, ebx
call fcn.0040c0d4
mov edx, dword [ebp - 0x10]
mov eax, 0x40e64c
call fcn.004032ac
mov eax, ebx
call fcn.0040bea4
xor ecx, ecx
mov edx, 0x40c434
mov eax, ebx
call fcn.0040bf38
test al, al
jne 0x40c356
xor ecx, ecx
mov edx, 0x40c48c
mov eax, ebx
call fcn.0040bf38
test al, al
je 0x40c377
push 0
push 0x40c4c8
push 0x40c4d0
push 0
call sub.user32.dll_MessageBoxA_1
push 0
push 0x40c548
call sub.kernel32.dll_WinExec
jmp 0x40c383
push 0
push 0x40c550
call sub.kernel32.dll_WinExec
push 0
push 0x40c568
push dword [0x40e64c]
push 0x40c580
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403500
mov eax, dword [ebp - 0x14]
call fcn.004035f4
push eax
call sub.kernel32.dll_WinExec
mov eax, ebx
call fcn.0040296c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c3d9
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040327c
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40345b
pop dword [ebp - 0x30]
mov eax, 0xd2b5d0cc
sub eax, 0xd2759c71
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x30e7ed08
sub dword [ebp - 0x40], 0xe295a7bd
mov dword [ebp - 0x3c], 0x45ba74ef
add dword [ebp - 0x3c], 0xec78d756
mov dword [ebp - 0x38], 0xf3780c46
sub dword [ebp - 0x38], 0xa72bc818
mov dword [ebp - 0x34], 0x64a53f05
sub dword [ebp - 0x34], 0x64a53f05
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x199c9c7a
add dword [ebp - 0x40], 0x5ad5ccdc
mov dword [ebp - 0x3c], 0x268cb8f6
sub dword [ebp - 0x3c], 0xe5205781
mov dword [ebp - 0x38], 0x22cb9d03
add dword [ebp - 0x38], 0x40a3cf69
mov dword [ebp - 0x34], 0x2a61a8f2
add dword [ebp - 0x34], 0xd59e570e
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x33b0b
push 0
call eax
mov ecx, 0x270b111b
add ecx, 0xd8f52a32
xor edi, edi
add edi, eax
mov ebx, 0xaa90f859
add ebx, 0x55af8ba7
add ebx, dword [ebp - 0x30]
mov esi, 0x8766d84
sub esi, 0x9036a1e
add dword [ebp - 0xc], 0x5cd031be
mov edx, dword [ebx]
xor dword [ebp - 4], 0xc21ec8be
sub edx, esi
mov dword [ebp - 8], 0x3e07453a
mov dword [edi], edx
add dword [ebp - 0x14], 0x3f4035b7
add edi, 0xc233f2f0
add edi, 0x3dcc0d14
add ebx, 4
loop 0x403575
add eax, 0xe007
xor ebx, ebx
add ebx, eax
add eax, 0xf2a1c235
sub eax, 0xf2a1c230
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x402b64
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043b0
test esi, esi
jne 0x402b9a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004044a0
jmp 0x402bb8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a78
mov edi, eax
test esi, esi
je 0x402bb8
cmp dword [ebx], 0
je 0x402bb8
dec esi
jmp 0x402ba1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e78
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4f0008], 0x8088405
inc edx
mov dword [ebx + 0x4f0008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40336c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4f0024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403404
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033e4
xor eax, eax
push ebp
push 0x4033dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403420
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4f0024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4f0024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041b0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f404c], 0
je 0x404211
cmp word [0x4f4220], 0xd7b2
jne 0x4041d9
cmp dword [0x4f4228], 0
jbe 0x4041d9
mov eax, 0x4f421c
call dword [0x4f4238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4f0070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404238
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4f0034], 0
jne 0x40422d
push 0
push 0x4f0068
push 0x4f0070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404364
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040283c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4f404d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40432c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4067f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40685a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404620
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402f00
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406844
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406861
lea eax, [ebp - 0x10]
call fcn.004043b0
ret

Function at 0x409620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404870
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409639
test al, 0x10
jne 0x40963d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40d534
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d56d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044a0
jmp 0x40d576
mov eax, ebx
mov edx, esi
call fcn.00404404
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d580
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d5a1
mov al, byte [esp]
jmp 0x40d5a3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40dd74
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40dbec
mov eax, dword [0x4f3520]
cmp byte [eax], 0
je 0x40ddf0
mov eax, dword [0x4f3080]
call fcn.00402ca8
call fcn.004029a4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409a50
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40de38
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40de26
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4f2fd4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4f4668]
call fcn.00405cc4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40e704
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e7da
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404448
lea eax, [ebp - 8]
call fcn.004048c0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404870
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40e7c4
mov eax, ebx
call fcn.0040283c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40e7bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404870
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40e7a7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40e7ec
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e7a7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e7c4
mov eax, dword [ebp - 0x10]
call fcn.0040285c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e7e1
lea eax, [ebp - 8]
call fcn.004043b0
ret

Function at 0x40eddc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40ee40
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404620
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409280
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ee47
lea eax, [ebp - 0xc]
call fcn.004043b0
ret

Function at 0x425a2c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00425884
dec esi
jne 0x425a4e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x426c14
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4f488c
cmp dword [edi], 0
jne 0x426c90
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4f4888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4f06d4
mov ecx, 2
call fcn.00402a38
mov edx, 0x426bec
lea eax, [esi + 5]
call fcn.00426c0c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00426c0c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x426c65
mov dword [0x4f4888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4282dc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4282e2
ret

Function at 0x42a930
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42a981
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42a968
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42a958
jmp 0x42a981
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42a969
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4341ac
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404860
xor eax, eax
push ebp
push 0x4342da
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4342ad
xor eax, eax
push ebp
push 0x4342a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404670
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43427b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x43426a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404670
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404870
mov edx, ebx
pop ecx
call fcn.00402a38
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434271
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4f2eb4]
mov dl, 1
mov eax, dword [0x407e60]
call fcn.0040df28
call fcn.00403d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4342e1
lea eax, [ebp - 4]
call fcn.004043b0
ret
Function at 0x4342e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x434499
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404a60
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4344b0
call fcn.004046bc
mov eax, ebx
call fcn.00426124
mov edi, eax
dec edi
test edi, edi
jl 0x4343a0
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004260f8
mov edx, dword [0x43e958]
call fcn.00403688
test al, al
je 0x43439c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004260f8
lea edx, [ebp - 0x14]
call fcn.00446ff0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404a60
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404730
inc esi
dec edi
jne 0x43434e
mov al, byte [0x4344b4]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4344c0
mov eax, dword [ebp - 0xc]
call fcn.0040f718
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404448
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00446ff0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4344b0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00446ff0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4344b0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4344b0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4344cc
call fcn.0040a12c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4344a0
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004043d4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004043d4
lea eax, [ebp - 0x14]
call fcn.004043b0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004043d4
ret
Function at 0x437410
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x437482
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x437456
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.004045a8
jmp 0x43745d
mov eax, ebx
call fcn.004043b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437489
cmp dword [ebp - 8], 0
je 0x437479
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x437490
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x437532
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x437505
mov edx, ebx
mov eax, dword [0x427d00]
call fcn.0042c1c0
test al, al
je 0x4374f5
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0042c0d0
call fcn.00403df8
jmp 0x437539
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4374c0
mov ecx, dword [0x4f2fb0]
mov dl, 1
mov eax, dword [0x407e60]
call fcn.0040df28
call fcn.00403d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437539
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x437540
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x437598
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43759f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4375a8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4375fd
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437604
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x437674
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4376e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0043734c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0042c194
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4376d3
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4376f0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4376f8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x43776d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0043734c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x437757
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437774
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret