joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455270
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x7e8a10]
test eax, eax
je 0x4552c4
push esi
push edi
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x7e8a10], 0
call edi
mov esi, eax
add esi, 0x1f4
mov eax, dword [0x7e8a14]
test eax, eax
je 0x4552a4
call edi
cmp eax, esi
jb 0x455295
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x7e8a0c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x7e8a0c], 0
pop esi
push str.Music_Stream_Stopped_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret

Function at 0x4552d0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
mov dword [0x7e89ac], eax
mov dword [0x7e89cc], 0
mov dword [0x7e8a04], ecx
call fcn.00455270
fld dword [esp + 0xc]
fmul dword [0x47f3b8]
mov eax, dword [0x7e8a0c]
mov byte [0x7e88a8], 0
test eax, eax
fstp dword [0x7e89f4]
je 0x455323
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7e8a0c], 0
fld dword [esp + 0xc]
fcomp dword [0x47f344]
fnstsw ax
test ah, 0x44
jp 0x455345
push str.Music_volume_0._Not_starting_stream
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
ret
mov edx, dword [esp + 8]
push 0x7e8a00
push 0
push edx
push 0x455120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x7e8a0c], eax
mov eax, 1
ret

Function at 0x456e70
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x7e8e78]
sub esp, 0x100
test eax, eax
jne 0x456eb0
mov eax, dword [esp + 0x104]
mov edx, dword [esp + 0x10c]
push edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esp + 0x10c]
push eax
call dword [ecx*4 + 0x4b066c]
add esp, 8
add esp, 0x100
ret
mov ecx, dword [esp + 0x108]
mov edx, dword [0x4b0664]
push esi
push ecx
push edx
lea eax, [esp + 0xc]
push 0x4b0990
push eax
call fcn.00465066
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call esi
push 0x4ae5c4
call esi
mov eax, dword [esp + 0x108]
lea ecx, [esp + 4]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [esp + 0x110]
push eax
push ecx
call dword [edx*4 + 0x4b066c]
add esp, 8
pop esi
add esp, 0x100
ret
Function at 0x460e60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
mov eax, dword [esi + 0x14]
xor ebp, ebp
cmp eax, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
jne 0x460e9e
mov edx, dword [0x7e940c]
xor eax, eax
mov ax, word [esi + 0xc]
xor ecx, ecx
mov cx, word [edx + eax*2]
mov eax, dword [0x7e9410]
lea ecx, [eax + ecx*2]
mov dword [esp + 0x1c], ecx
jmp 0x460ea2
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x24], edi
jne 0x460eb0
push esi
call fcn.00461040
add esp, 4
mov cl, byte [esi + 0x18]
test cl, 1
je 0x460eba
xor ebp, ebp
test cl, 2
je 0x460ecb
mov eax, dword [esi + 0x2c]
cdq
sub eax, edx
sar eax, 1
mov ebp, eax
neg ebp
test cl, 4
je 0x460ed7
mov bp, word [esi + 0x2c]
neg bp
test cl, 8
je 0x460ee0
mov dword [esp + 0x14], edi
test cl, 0x10
je 0x460ef3
mov eax, dword [esi + 0x30]
cdq
sub eax, edx
sar eax, 1
neg eax
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x20]
test cl, 0x40
je 0x460f11
mov eax, dword [esi + 0x2c]
cdq
sub eax, edx
mov edx, 0x140
sar eax, 1
sub edx, eax
xor ebp, ebp
mov word [ebx + 8], dx
test byte [esi + 0x18], 0x20
je 0x460f2c
mov eax, dword [esi + 0x2c]
mov ecx, 0x1e0
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
xor ebp, ebp
mov word [ebx + 8], cx
mov al, byte [esi + 0x18]
test al, al
jns 0x460f48
mov eax, dword [esi + 0x2c]
cdq
sub eax, edx
mov edx, 0xa0
sar eax, 1
sub edx, eax
xor ebp, ebp
mov word [ebx + 8], dx
mov eax, dword [esp + 0x1c]
cmp word [eax], di
je 0x461031
mov di, word [eax]
mov edx, dword [esp + 0x10]
add eax, 2
inc edx
cmp di, 0x26
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
je 0x461027
cmp di, 0x25
je 0x461027
mov eax, dword [esi + 0x38]
test eax, eax
je 0x460f8f
mov ecx, dword [esi + 0x28]
push ecx
push edx
push edi
push ebx
call eax
add esp, 0x10
and edi, 0xffff
push edi
call fcn.00461120
movsx ecx, word [esp + 0x18]
mov edi, eax
xor eax, eax
mov ax, word [esi + 0x1c]
push 1
movsx edx, word [ebx + 0xa]
add eax, ecx
push 0
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
mov dword [esp + 0x2c], edx
fmul dword [esi + 0x48]
fiadd dword [esp + 0x2c]
call fcn.004650b8
push eax
xor eax, eax
mov ax, word [esi + 0x1a]
movsx ecx, bp
movsx edx, word [ebx + 8]
add eax, ecx
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
mov dword [esp + 0x30], edx
fmul dword [esi + 0x48]
fiadd dword [esp + 0x30]
call fcn.004650b8
push eax
mov eax, dword [esp + 0x38]
push eax
push edi
push esi
call fcn.004353a0
push edi
push esi
call fcn.00435310
mov cl, byte [eax + 0xb]
add esp, 0x28
test cl, cl
je 0x46101a
movzx cx, cl
lea ebp, [ecx + ebp + 1]
jmp 0x461023
movzx dx, byte [eax + 6]
lea ebp, [edx + ebp + 1]
mov eax, dword [esp + 0x1c]
cmp word [eax], 0
jne 0x460f55
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4617f0
Capabilities:
Print debug messages

Disassembly:
push str._n_LOAD_GAME...
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 4]
push 0
push eax
push 1
call fcn.00456f90
add esp, 0xc
ret
Function at 0x461810
Capabilities:
Print debug messages

Disassembly:
push esi
push str._n_SAVE_GAME...
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 8]
push 2
push eax
push 1
call fcn.00456e70
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x461835
pop esi
ret
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push edi
push ecx
push esi
call fcn.00456f40
add esp, 0xc
cmp eax, edi
pop edi
jge 0x461852
xor eax, eax
pop esi
ret
push esi
call fcn.00456f60
add esp, 4
mov eax, 1
pop esi
ret
Function at 0x4070e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
mov edi, dword [esp + 0x20]
mov ebx, ecx
cmp byte [ebx + 4], 0
je 0x4071e4
mov esi, dword [esp + 0x1c]
xor ebp, ebp
test edi, edi
jle 0x4071e4
mov dword [esp + 4], edi
add dword [esp + 4], 0xfffffff8
cmp edi, 8
jle 0x4071c6
mov dl, byte [esi + ebp]
mov cl, byte [ebx + 8]
xor byte [esi + ebp], cl
movzx eax, dl
xor dword [ebx + 8], eax
mov ecx, ebp
inc ecx
mov al, byte [esi + ecx]
mov edx, ebp
inc edx
mov cl, byte [ebx + 8]
xor byte [esi + edx], cl
movzx edx, al
xor dword [ebx + 8], edx
lea ecx, [ebp + 2]
mov al, byte [esi + ecx]
lea edx, [ebp + 2]
mov cl, byte [ebx + 8]
xor byte [esi + edx], cl
movzx edx, al
xor dword [ebx + 8], edx
lea ecx, [ebp + 3]
mov al, byte [esi + ecx]
lea edx, [ebp + 3]
mov cl, byte [ebx + 8]
xor byte [esi + edx], cl
movzx edx, al
xor dword [ebx + 8], edx
lea ecx, [ebp + 4]
mov al, byte [esi + ecx]
lea edx, [ebp + 4]
mov cl, byte [ebx + 8]
xor byte [esi + edx], cl
movzx edx, al
xor dword [ebx + 8], edx
lea ecx, [ebp + 5]
mov al, byte [esi + ecx]
lea edx, [ebp + 5]
mov cl, byte [ebx + 8]
xor byte [esi + edx], cl
movzx edx, al
xor dword [ebx + 8], edx
lea ecx, [ebp + 6]
mov al, byte [esi + ecx]
lea edx, [ebp + 6]
mov cl, byte [ebx + 8]
xor byte [esi + edx], cl
movzx edx, al
xor dword [ebx + 8], edx
lea ecx, [ebp + 7]
mov al, byte [esi + ecx]
lea edx, [ebp + 7]
mov cl, byte [ebx + 8]
xor byte [esi + edx], cl
movzx edx, al
xor dword [ebx + 8], edx
add ebp, 8
cmp ebp, dword [esp + 4]
jl 0x407117
cmp ebp, edi
jge 0x4071e4
lea eax, [eax]
mov cl, byte [esi + ebp]
mov dl, byte [ebx + 8]
xor byte [esi + ebp], dl
movzx eax, cl
xor dword [ebx + 8], eax
inc ebp
cmp ebp, edi
jl 0x4071d0
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x4071f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
mov esi, dword [esp + 0x20]
cmp byte [ecx + 4], 0
je 0x4072d3
mov edx, dword [esp + 0x1c]
xor ebx, ebx
test esi, esi
jle 0x4072d3
lea edi, [esi - 8]
cmp esi, 8
jle 0x4072bd
nop
mov al, byte [ecx + 8]
xor byte [edx + ebx], al
movzx eax, byte [edx + ebx]
xor dword [ecx + 8], eax
mov ebp, ebx
inc ebp
mov al, byte [ecx + 8]
xor byte [edx + ebp], al
mov ebp, ebx
inc ebp
movzx eax, byte [edx + ebp]
xor dword [ecx + 8], eax
lea ebp, [ebx + 2]
mov al, byte [ecx + 8]
xor byte [edx + ebp], al
lea ebp, [ebx + 2]
movzx eax, byte [edx + ebp]
xor dword [ecx + 8], eax
lea ebp, [ebx + 3]
mov al, byte [ecx + 8]
xor byte [edx + ebp], al
lea ebp, [ebx + 3]
movzx eax, byte [edx + ebp]
xor dword [ecx + 8], eax
lea ebp, [ebx + 4]
mov al, byte [ecx + 8]
xor byte [edx + ebp], al
lea ebp, [ebx + 4]
movzx eax, byte [edx + ebp]
xor dword [ecx + 8], eax
lea ebp, [ebx + 5]
mov al, byte [ecx + 8]
xor byte [edx + ebp], al
lea ebp, [ebx + 5]
movzx eax, byte [edx + ebp]
xor dword [ecx + 8], eax
lea ebp, [ebx + 6]
mov al, byte [ecx + 8]
xor byte [edx + ebp], al
lea ebp, [ebx + 6]
movzx eax, byte [edx + ebp]
xor dword [ecx + 8], eax
lea ebp, [ebx + 7]
mov al, byte [ecx + 8]
xor byte [edx + ebp], al
lea eax, [ebx + 7]
movzx eax, byte [edx + eax]
xor dword [ecx + 8], eax
add ebx, 8
cmp ebx, edi
jl 0x407220
cmp ebx, esi
jge 0x4072d3
mov al, byte [ecx + 8]
xor byte [edx + ebx], al
movzx eax, byte [edx + ebx]
xor dword [ecx + 8], eax
inc ebx
cmp ebx, esi
jl 0x4072c1
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret 8

Function at 0x407950
Capabilities:
Get common file path

Disassembly:
push ebx
sub esp, 0x800
mov eax, dword [esp + 0x808]
mov ebx, ecx
mov byte [ebx + 0x10], 0
mov ecx, dword [eax]
test ecx, ecx
je 0x407970
mov edx, dword [ecx + 0xc]
jmp 0x407972
xor edx, edx
test edx, edx
je 0x407991
push 0
push 0x4000100
push 3
push 0
push 1
push 0xc0000000
mov ecx, eax
call fcn.0040bb90
jmp 0x4079d3
lea eax, [esp]
push eax
push 0x400
call dword [0x4ea720]
lea eax, [esp + 0x400]
push eax
push 0
push 0x4bea74
lea eax, [esp + 0xc]
push eax
call dword [0x4ea724]
push 0
push 0x4000100
push 3
push 0
push 1
push 0xc0000000
lea eax, [esp + 0x418]
push eax
call dword [0x4ea714]
mov dword [ebx + 0x14], eax
cmp dword [ebx + 0x14], 0xffffffff
jne 0x4079f0
xor al, al
add esp, 0x800
pop ebx
ret 4
push 0xc
call fcn.004496d0
pop ecx
test eax, eax
je 0x407a04
push ebx
mov ecx, eax
call fcn.004076e0
mov dword [ebx + 0x18], eax
mov al, 1
add esp, 0x800
pop ebx
ret 4
Function at 0x40ccc0
Capabilities:
Terminate process

Disassembly:
push ebx
call fcn.0040cd50
mov eax, dword [esp + 8]
push eax
call fcn.00493ea0
pop ecx
mov ebx, eax
call fcn.0040cd60
test ebx, ebx
jne 0x40cd18
cmp byte [esp + 0xc], 1
jne 0x40cce7
xor eax, eax
pop ebx
ret
call fcn.0040b1b0
push str.9This_application_has_run_out_of_memory_and_must_quit_now.
call fcn.0040c710
pop ecx
push 0x2d2
push str.utility.cpp
push 4
push 0x83
call fcn.0044a750
add esp, 0x10
push 0
call dword [0x4ea744]
mov eax, ebx
pop ebx
ret

Function at 0x40cd70
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push ebp
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test esi, esi
jg 0x40cd85
xor eax, eax
pop ebp
pop esi
pop ebx
ret
lea eax, [esi + 3]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ebp, eax
cmp ebp, 0x40
jl 0x40cda7
mov al, bl
push eax
push esi
call fcn.0040ccc0
pop ecx
pop ecx
pop ebp
pop esi
pop ebx
ret
call fcn.0040cd50
add dword [0x4f5ed4], esi
mov ecx, dword [ebp*4 + 0x4bf408]
test ecx, ecx
je 0x40cdd0
mov ebx, ecx
mov eax, dword [ecx]
mov dword [ebp*4 + 0x4bf408], eax
jmp 0x40ce45
lea ebp, [ebp*4]
mov esi, ebp
cmp esi, dword [0x4ed10c]
jle 0x40ce33
inc byte [0x4f6056]
push 0x2000
call fcn.00493ea0
pop ecx
mov dword [0x4ed108], eax
dec byte [0x4f6056]
cmp dword [0x4ed108], 0
jne 0x40ce29
cmp bl, 1
jne 0x40ce11
xor eax, eax
pop ebp
pop esi
pop ebx
ret
call fcn.0040b1b0
push str.9This_application_has_run_out_of_memory_and_must_quit_now.
call fcn.0040c710
pop ecx
push 0
call dword [0x4ea744]
mov dword [0x4ed10c], 0x2000
mov ebx, dword [0x4ed108]
add dword [0x4ed108], esi
sub dword [0x4ed10c], esi
call fcn.0040cd60
mov eax, ebx
pop ebp
pop esi
pop ebx
ret

Function at 0x40de90
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 0x92], 0
jne 0x40dea0
pop ebx
ret
push 0
mov eax, dword [ebx + 0x58]
push eax
call dword [0x4ea900]
mov byte [ebx + 0x92], 0
pop ebx
ret

Function at 0x40e400
Capabilities:
Enumerate gui resources

Disassembly:
push esi
push edi
sub esp, 0x10
lea edi, [esp + 4]
mov esi, 0x4ed118
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0
lea esi, [esp + 4]
push esi
push 0x40e3c0
call dword [0x4ea924]
cmp byte [esp + 0xc], 0
je 0x40e445
xor al, al
add esp, 0x10
pop edi
pop esi
ret
cmp dword [0x4f5f90], 0
je 0x40e460
push esi
push 0x40e3c0
mov eax, dword [0x4f5f90]
push eax
call dword [0x4ea928]
cmp byte [esp + 0xc], 0
je 0x40e470
xor al, al
add esp, 0x10
pop edi
pop esi
ret
mov al, 1
add esp, 0x10
pop edi
pop esi
ret
Function at 0x410c30
Capabilities:
Open clipboard

Disassembly:
push ebx
push esi
push ebp
sub esp, 0x18
mov ebx, dword [esp + 0x28]
mov ebp, ecx
mov dword [esp + 4], 0
mov ecx, ebx
mov esi, dword [ecx]
call dword [esi + 0x1b4]
test al, al
je 0x410de0
mov ecx, ebx
mov esi, dword [ecx]
call dword [esi + 0x1ec]
test al, al
jne 0x410ce2
mov eax, dword [ebp + 4]
cmp byte [eax + 0x8e], 0
jne 0x410ce2
mov dword [esp + 8], 0
push str.EditCut
call fcn.0040ca30
pop ecx
push eax
push str.EditCut
lea ecx, [esp + 0x10]
call fcn.0040bb00
cmp dword [esp + 8], 0
je 0x410ca5
mov edx, dword [esp + 8]
mov eax, dword [0x4bf2dc]
mov dword [edx + 0x10], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
call fcn.0040bbd0
cmp dword [esp + 8], 0
je 0x410cc3
mov ecx, dword [esp + 8]
call fcn.0040b9e0
mov eax, dword [esp + 4]
push eax
call fcn.00497920
pop ecx
mov esi, eax
test esi, esi
je 0x410ce2
push esi
call fcn.004a1a40
pop ecx
push esi
call fcn.00444ab0
pop ecx
mov ecx, ebx
mov esi, dword [ecx]
call dword [esi + 0x1ec]
test al, al
jne 0x410d62
mov dword [esp + 0xc], 0
push str.EditClear
call fcn.0040ca30
pop ecx
push eax
push str.EditClear
lea ecx, [esp + 0x14]
call fcn.0040bb00
cmp dword [esp + 0xc], 0
je 0x410d25
mov ecx, dword [esp + 0xc]
mov eax, dword [0x4bf2dc]
mov dword [ecx + 0x10], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
call fcn.0040bbd0
cmp dword [esp + 0xc], 0
je 0x410d43
mov ecx, dword [esp + 0xc]
call fcn.0040b9e0
mov eax, dword [esp + 4]
push eax
call fcn.00497920
pop ecx
mov esi, eax
test esi, esi
je 0x410d62
push esi
call fcn.004a1a40
pop ecx
push esi
call fcn.00444ab0
pop ecx
mov eax, dword [ebp + 4]
cmp byte [eax + 0x8e], 0
jne 0x410de0
mov dword [esp + 0x10], 0
push str.EditCopy
call fcn.0040ca30
pop ecx
push eax
push str.EditCopy
lea ecx, [esp + 0x18]
call fcn.0040bb00
cmp dword [esp + 0x10], 0
je 0x410da3
mov edx, dword [esp + 0x10]
mov eax, dword [0x4bf2dc]
mov dword [edx + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 8]
call fcn.0040bbd0
cmp dword [esp + 0x10], 0
je 0x410dc1
mov ecx, dword [esp + 0x10]
call fcn.0040b9e0
mov eax, dword [esp + 4]
push eax
call fcn.00497920
pop ecx
mov esi, eax
test esi, esi
je 0x410de0
push esi
call fcn.004a1a40
pop ecx
push esi
call fcn.00444ab0
pop ecx
mov ecx, ebx
mov ebp, dword [ecx]
call dword [ebp + 0x1ec]
test al, al
jne 0x410e86
push 0
call dword [0x4ea94c]
test eax, eax
je 0x410e86
push 1
call dword [0x4ea950]
test eax, eax
je 0x410e80
mov dword [esp + 0x14], 0
push str.EditPaste
call fcn.0040ca30
pop ecx
push eax
push str.EditPaste
lea ecx, [esp + 0x1c]
call fcn.0040bb00
cmp dword [esp + 0x14], 0
je 0x410e43
mov edx, dword [esp + 0x14]
mov eax, dword [0x4bf2dc]
mov dword [edx + 0x10], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 8]
call fcn.0040bbd0
cmp dword [esp + 0x14], 0
je 0x410e61
mov ecx, dword [esp + 0x14]
call fcn.0040b9e0
mov eax, dword [esp + 4]
push eax
call fcn.00497920
pop ecx
mov esi, eax
test esi, esi
je 0x410e80
push esi
call fcn.004a1a40
pop ecx
push esi
call fcn.00444ab0
pop ecx
call dword [0x4ea954]
cmp dword [esp + 4], 0
je 0x410e96
mov ecx, dword [esp + 4]
call fcn.0040b9e0
add esp, 0x18
pop ebp
pop esi
pop ebx
ret 4
Function at 0x417270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
sub esp, 8
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov edx, dword [ebx]
test edx, edx
je 0x417288
mov ecx, dword [edx + 0xc]
jmp 0x41728a
xor ecx, ecx
mov eax, ecx
xor ebx, ebx
xor ebp, ebp
test ecx, ecx
jle 0x4172c5
test edx, edx
je 0x4172a0
mov ecx, ebp
inc ecx
add ecx, dword [edx + 4]
jmp 0x4172a5
mov ecx, 0x4be004
mov cl, byte [ecx]
cmp cl, 0x61
jl 0x4172b4
cmp cl, 0x7a
jg 0x4172b4
add cl, 0xe0
lea ebx, [ebx*4]
movsx ecx, cl
xor ebx, ecx
inc ebp
cmp ebp, eax
jl 0x417294
mov eax, ebx
and eax, 0xff
add esp, 8
pop ebp
pop ebx
ret 4
Function at 0x42cc50
Capabilities:
Read clipboard data

Disassembly:
push ebx
push ebp
sub esp, 8
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
push eax
call fcn.0042cbc0
pop ecx
test al, al
jne 0x42cc84
cmp dword [esp + 4], 0
je 0x42cc7c
mov ecx, dword [esp + 4]
call fcn.0040b9e0
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x18]
push eax
call dword [0x4ea95c]
mov ebx, eax
test ebx, ebx
je 0x42cce0
push ebx
call dword [0x4ea6e8]
mov ebp, eax
push ebp
call fcn.0040ca30
pop ecx
push eax
push ebp
lea ecx, [esp + 0xc]
call fcn.0040bb00
push ebx
call dword [0x4ea6ec]
lea ecx, [esp + 4]
call fcn.0040bb50
mov ebp, eax
cmp dword [esp + 4], 0
je 0x42ccd2
mov ecx, dword [esp + 4]
call fcn.0040b9e0
mov eax, ebp
add esp, 8
pop ebp
pop ebx
ret
cmp dword [esp + 4], 0
je 0x42ccf0
mov ecx, dword [esp + 4]
call fcn.0040b9e0
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret

Function at 0x42cd30
Capabilities:
Write clipboard data

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], edx
test edx, edx
je 0x42cd4b
mov ecx, edx
call fcn.0040b9a0
push ebx
call fcn.0042cbc0
pop ecx
test al, al
jne 0x42cd70
cmp dword [esp + 4], 0
je 0x42cd66
mov ecx, dword [esp + 4]
call fcn.0040b9e0
add esp, 8
pop ebx
ret
push ebx
call fcn.0042cbf0
pop ecx
cmp dword [esp + 4], 0
je 0x42cd87
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
jmp 0x42cd89
xor eax, eax
inc eax
push eax
push 0x2002
call dword [0x4ea6e4]
mov ebx, eax
cmp dword [esp + 4], 0
je 0x42cda8
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
jmp 0x42cdaa
xor eax, eax
inc eax
push eax
lea ecx, [esp + 8]
call fcn.0040bb90
push eax
push ebx
call dword [0x4ea6e8]
push eax
call fcn.0040cef0
add esp, 0xc
push ebx
call dword [0x4ea6ec]
push ebx
mov eax, dword [esp + 0x1c]
push eax
call dword [0x4ea960]
cmp dword [esp + 4], 0
je 0x42cde9
mov ecx, dword [esp + 4]
call fcn.0040b9e0
add esp, 8
pop ebx
ret

Function at 0x42d4d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
mov ebx, dword [esp + 0x1c]
mov ebp, ecx
mov eax, dword [ebp + 0x58]
push eax
call dword [0x4ea978]
mov esi, eax
inc eax
push eax
call fcn.00493ea0
pop ecx
mov edi, eax
mov dword [esp + 4], 0
mov eax, esi
inc eax
push eax
push edi
mov eax, dword [ebp + 0x58]
push eax
call dword [0x4ea97c]
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.0040bb00
push edi
call fcn.00493ed0
pop ecx
mov eax, dword [esp + 4]
mov dword [ebx], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x42d52d
call fcn.0040b9a0
cmp dword [esp + 4], 0
je 0x42d53d
mov ecx, dword [esp + 4]
call fcn.0040b9e0
mov eax, dword [esp + 0x1c]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x42dd80
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push ebp
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp eax, 1
jge 0x42ddb6
cmp eax, 1
jge 0x42ddbb
lea eax, [eax]
dec word [ebx]
add eax, 0xc
cmp eax, 1
jl 0x42dda0
jmp 0x42ddbb
inc word [ebx]
sub eax, 0xc
cmp eax, 0xc
jg 0x42ddb0
mov word [ebx + 2], ax
movzx esi, word [ebx + 6]
mov word [ebx + 6], 1
lea eax, [ebp + 0x18]
push eax
push ebx
call dword [0x4ea758]
push ebx
lea eax, [ebp + 0x18]
push eax
call dword [0x4ea74c]
push ebx
push ebp
push esi
call fcn.0042dd20
add esp, 0xc
pop ebp
pop esi
pop ebx
ret

Function at 0x42e590
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push ebp
sub esp, 0x58
mov ebx, dword [esp + 0x68]
xor ebp, ebp
push 0x50
lea eax, [esp + 8]
push eax
push 0x1f
push 0x400
call dword [0x4ea76c]
or dword [ebx], 0xffffffff
or dword [ebx + 4], 0xffffffff
or dword [ebx + 8], 0xffffffff
xor esi, esi
jmp 0x42e5ef
mov al, byte [esp + esi + 4]
cmp al, 0x4d
jne 0x42e5d1
cmp dword [ebx], 0xffffffff
jne 0x42e5d1
mov dword [ebx], ebp
jmp 0x42e5ed
cmp al, 0x64
jne 0x42e5e0
cmp dword [ebx + 4], 0xffffffff
jne 0x42e5e0
mov dword [ebx + 4], ebp
jmp 0x42e5ed
cmp al, 0x79
jne 0x42e5ee
cmp dword [ebx + 8], 0xffffffff
jne 0x42e5ee
mov dword [ebx + 8], ebp
inc ebp
inc esi
lea eax, [esp + 4]
push eax
call fcn.004aa1a0
pop ecx
cmp esi, eax
jb 0x42e5c0
cmp dword [ebx], 0xffffffff
jne 0x42e606
mov dword [ebx], ebp
inc ebp
cmp dword [ebx + 4], 0xffffffff
jne 0x42e60f
mov dword [ebx], ebp
inc ebp
cmp dword [ebx + 8], 0xffffffff
jne 0x42e617
mov dword [ebx], ebp
add esp, 0x58
pop ebp
pop esi
pop ebx
ret

Function at 0x431890
Capabilities:
Check os version

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], ecx
push str.DllGetVersion
mov eax, dword [0x4ed3dc]
push eax
call dword [0x4ea700]
mov ebx, eax
test ebx, ebx
je 0x4318e0
push 0x14
push 0
lea eax, [esp + 0xc]
push eax
call fcn.0040cf20
add esp, 0xc
mov dword [esp + 4], 0x14
lea eax, [esp + 4]
push eax
call ebx
test eax, eax
jl 0x4318f5
mov eax, dword [esp + 8]
add esp, 0x18
pop ebx
ret
call dword [0x4ea774]
cmp eax, 5
jb 0x4318f5
mov eax, 3
add esp, 0x18
pop ebx
ret
xor eax, eax
add esp, 0x18
pop ebx
ret
Function at 0x438e80
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
sub esp, 0x410
mov ebx, dword [esp + 0x41c]
mov ebp, ecx
cmp byte [ebp + 0x31], 0
jne 0x438ed5
mov dword [ebx], 0
push 0x4c759c
call fcn.0040ca30
pop ecx
push eax
push 0x4c759c
mov ecx, ebx
call fcn.0040bb00
mov ebx, dword [ebx]
test ebx, ebx
je 0x438ec3
mov eax, dword [0x4bf2dc]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x41c]
add esp, 0x410
pop ebp
pop ebx
ret 4
mov dword [esp + 4], 0
lea eax, [eax]
push 0
lea eax, [esp + 0x40c]
push eax
push 0x400
lea ecx, [esp + 0x14]
push ecx
mov eax, dword [ebp + 0x1c]
push eax
call dword [0x4ea734]
cmp dword [esp + 0x408], 0
je 0x438f55
mov dword [esp + 0x40c], 0
mov edx, dword [esp + 0x408]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x414]
call fcn.0040bb00
lea eax, [esp + 0x40c]
push eax
lea ecx, [esp + 8]
call fcn.0040bd20
cmp dword [esp + 0x40c], 0
je 0x438ee0
mov ecx, dword [esp + 0x40c]
call fcn.0040b9e0
jmp 0x438ee0
mov eax, dword [esp + 4]
mov dword [ebx], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x438f66
call fcn.0040b9a0
cmp dword [esp + 4], 0
je 0x438f76
mov ecx, dword [esp + 4]
call fcn.0040b9e0
mov eax, dword [esp + 0x41c]
add esp, 0x410
pop ebp
pop ebx
ret 4

Function at 0x438f90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 8
mov ebx, ecx
cmp byte [ebx + 0x31], 0
jne 0x438fa5
xor eax, eax
add esp, 8
pop ebx
ret 8
push 0
lea ecx, [esp + 8]
push ecx
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [ebx + 0x1c]
push eax
call dword [0x4ea718]
mov eax, dword [esp + 4]
add esp, 8
pop ebx
ret 8