joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410450
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
jb 0x410484
mov eax, dword [ebp + 8]
push eax
push str..Global_s
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x41049d
mov edx, dword [ebp + 8]
push edx
push str.._s
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4104e6
cmp dword [ebp + 0xc], 0
je 0x4104d5
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx], eax
jmp 0x4104df
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4104e8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4104f0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x178
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x41055b
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4105fb
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
push 0x10
push 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4105e8
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
je 0x4105e8
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x28]
push ecx
call fcn.00474343
add esp, 8
test eax, eax
jne 0x4105dd
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4105db
cmp dword [ebp + 0xc], 0
je 0x4105c7
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edx + 4]
jne 0x4105d0
mov dword [ebp - 8], 1
jmp 0x4105db
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x18], edx
jmp 0x4105ad
jmp 0x4105e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x14], ecx
jmp 0x410587
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x410820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x410840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0xa0cd80], eax
pop ebp
ret
Function at 0x4110c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [0xa0cd84], 0
je 0x4110eb
mov eax, dword [0xa0cd84]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4110eb
push 0
mov ecx, dword [0xa0cd84]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x411940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [0xa0cd84], 0
je 0x411973
mov eax, dword [0xa0cd84]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41196e
push 8
mov ecx, dword [0xa0cd84]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x411a8a
mov dword [ebp - 0x50], str.__SAFE_MODE__
mov dword [ebp - 0x4c], 0x30
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x411a90
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x38], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x34], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x24], edx
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x1c], 0x1c0
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [ebp - 0xc]
mov edx, 0xa8
sub edx, eax
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x54]
mov dword [ebp - 4], ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push connect
push 0
mov eax, dword [ebp - 0x50]
push eax
push 0x8000000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0xa0cd84], eax
push 4
mov ecx, dword [0xa0cd84]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0xa0cd84]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esp, ebp
pop ebp
ret
Function at 0x411fc0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41206e
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x412064
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x214]
push eax
call fcn.00474343
add esp, 8
test eax, eax
jne 0x412050
mov ecx, dword [ebp - 0x230]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x412050
push 0
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x411ffd
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x4120c0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push 0x104
lea eax, [ebp - 0x110]
push eax
call sub.WS2_32.dll_gethostname
lea ecx, [ebp - 0x110]
push ecx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
jmp 0x412104
mov edx, dword [ebp - 0x114]
add edx, 1
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x114]
cmp dword [ecx + edx*4], 0
je 0x412154
push 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x114]
mov eax, dword [ecx + edx*4]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.004746a0
add esp, 0xc
mov edx, dword [ebp - 0x118]
push edx
call fcn.00412170
add esp, 4
test eax, eax
jne 0x412152
mov eax, dword [ebp - 0x118]
jmp 0x41215e
jmp 0x4120f5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret

Function at 0x4121c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 8], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41223e
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x412234
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x214]
push eax
call fcn.00474343
add esp, 8
test eax, eax
jne 0x412220
mov dword [ebp - 8], 1
jmp 0x412234
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x412200
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x412250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push str._C:Program_FilesTencentQQQQProtectBinQQProtect.exe_
lea eax, [ebp - 0x260]
push eax
call fcn.004740dd
add esp, 8
push 0x44
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.00474100
add esp, 0xc
mov dword [ebp - 0x58], 0x44
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
push str.C:Program_FilesTencentQQQQProtectBin
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x260]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4122c2
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x4126d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov byte [ebp - 0x18], 0x62
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x6b
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0
lea eax, [ebp - 0x18]
push eax
call dword [0x94a1e8]
push 0
push 0
push 0x200
lea ecx, [ebp - 0x218]
push ecx
push 0xffffffffffffffff
push 0x94a9c8
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp + 8], 0
je 0x41279a
cmp dword [ebp + 8], 1
jne 0x412763
mov dword [ebp - 0x220], 0x48adb4
jmp 0x41276d
mov dword [ebp - 0x220], str.captchacaptcha.gif
push 0x48aa9e
push 1
push 0x96
push 0x4e25
mov edx, dword [ebp - 0x220]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [0x94a1ec]
mov dword [ebp - 0x224], eax
jmp 0x4127ce
push 0x48aa9f
push 1
push 0x12c
push 0x4e25
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [0xa4ee4c]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x23
jne 0x4127e7
mov eax, dword [ebp - 4]
jmp 0x412833
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
test eax, eax
je 0x41282d
mov ecx, dword [ebp - 4]
push ecx
call dword [0x909a6c]
mov dword [ebp - 0x21c], eax
mov edx, dword [ebp - 0x21c]
push edx
call fcn.00474a10
add esp, 4
test eax, eax
jbe 0x412820
jmp 0x41282d
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4127f2
mov eax, dword [ebp - 0x21c]
mov esp, ebp
pop ebp
ret
Function at 0x412840
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
push 0x4f
push 0xde
mov eax, dword [ebp + 8]
push eax
call fcn.00412940
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41292f
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x412923
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0x136
mov dword [ebp - 0x10], 0xd7
cmp dword [ebp - 0x10], 0xef
jge 0x4128f9
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, 0xd2d2d2
je 0x4128ee
mov dword [ebp - 0x1c], 0
jmp 0x4128f9
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x4128c3
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x20]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x412940
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41295b
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410120
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x12
call fcn.0040fc60
add esp, 8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x2c
call fcn.0040fc60
add esp, 8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push 0x2c
call fcn.0040fc60
add esp, 8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push 0x12
call fcn.0040fc60
add esp, 8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebp
ret
Function at 0x4129e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 0x4f
push 0xde
mov eax, dword [ebp + 8]
push eax
call fcn.00412940
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x412b61
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x412b55
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0xffe9d3
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x20], 0x54
jmp 0x412a6e
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xd9
jg 0x412ab2
push 0xae
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
jne 0x412aa7
push 0xe6
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
je 0x412ab0
mov dword [ebp - 0x14], 0
jmp 0x412ab2
jmp 0x412a65
cmp dword [ebp - 0x14], 0
je 0x412b0b
mov dword [ebp - 0x24], 0xae
jmp 0x412aca
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xe6
jg 0x412b0b
mov ecx, dword [ebp - 0x24]
push ecx
push 0x54
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
jne 0x412b00
mov eax, dword [ebp - 0x24]
push eax
push 0xd9
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
je 0x412b09
mov dword [ebp - 0x14], 0
jmp 0x412b0b
jmp 0x412ac1
cmp dword [ebp - 0x14], 0
je 0x412b2b
push 0x37
push 0x84
push 0xaf
push 0x55
mov edx, dword [ebp - 0xc]
push edx
call fcn.00412b70
add esp, 0x14
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x412b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x48ae08
push str.captchacaptcha.bmp
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412d6d
mov eax, dword [ebp + 0x14]
imul eax, eax, 3
add eax, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
shl eax, 2
imul eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, 0x4d42
mov word [ebp - 0x40], ax
mov ecx, dword [ebp - 8]
add ecx, 0x36
mov dword [ebp - 0x3e], ecx
xor edx, edx
mov word [ebp - 0x3a], dx
xor eax, eax
mov word [ebp - 0x38], ax
mov dword [ebp - 0x36], 0x36
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0xe
lea edx, [ebp - 0x40]
push edx
call fcn.00474cee
add esp, 0x10
mov dword [ebp - 0x30], 0x28
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x28], ecx
mov edx, 1
mov word [ebp - 0x24], dx
mov eax, 0x18
mov word [ebp - 0x22], ax
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
push edx
push 1
push 0x28
lea eax, [ebp - 0x30]
push eax
call fcn.00474cee
add esp, 0x10
mov ecx, dword [ebp + 0x18]
sub ecx, 1
mov dword [ebp - 0x44], ecx
jmp 0x412c60
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0
jl 0x412d61
mov dword [ebp - 0x4c], 0
jmp 0x412c7c
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp + 0x14]
jge 0x412cf0
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x50]
shr eax, 0x10
and eax, 0xff
movzx ecx, al
push ecx
call fcn.00474a9b
add esp, 8
mov edx, dword [ebp - 4]
push edx
movzx eax, word [ebp - 0x50]
sar eax, 8
and eax, 0xff
movzx ecx, al
push ecx
call fcn.00474a9b
add esp, 8
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x50]
and eax, 0xff
movzx ecx, al
push ecx
call fcn.00474a9b
add esp, 8
jmp 0x412c73
mov edx, dword [ebp + 0x14]
imul edx, edx, 3
and edx, reloc.WS2_32.dll_closesocket
jns 0x412d03
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x412d25
mov eax, dword [ebp + 0x14]
imul eax, eax, 3
and eax, reloc.WS2_32.dll_closesocket
jns 0x412d19
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, 4
sub ecx, eax
mov dword [ebp - 0x58], ecx
jmp 0x412d2c
mov dword [ebp - 0x58], 0
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x54], 0
jmp 0x412d44
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x48]
jge 0x412d5c
mov edx, dword [ebp - 4]
push edx
push 0
call fcn.00474a9b
add esp, 8
jmp 0x412d3b
jmp 0x412c57
mov eax, dword [ebp - 4]
push eax
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x412d80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 0x4f
push 0xde
mov eax, dword [ebp + 8]
push eax
call fcn.00412940
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x412f01
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x412ef5
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0xdcdcdc
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x20], 0x52
jmp 0x412e0e
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xd5
jg 0x412e52
push 0xc3
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
jne 0x412e47
push 0xf9
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
je 0x412e50
mov dword [ebp - 0x14], 0
jmp 0x412e52
jmp 0x412e05
cmp dword [ebp - 0x14], 0
je 0x412eab
mov dword [ebp - 0x24], 0xc3
jmp 0x412e6a
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xf9
jg 0x412eab
mov ecx, dword [ebp - 0x24]
push ecx
push 0x52
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
jne 0x412ea0
mov eax, dword [ebp - 0x24]
push eax
push 0xd5
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x18]
je 0x412ea9
mov dword [ebp - 0x14], 0
jmp 0x412eab
jmp 0x412e61
cmp dword [ebp - 0x14], 0
je 0x412ecb
push 0x37
push 0x84
push 0xc4
push 0x53
mov edx, dword [ebp - 0xc]
push edx
call fcn.00412b70
add esp, 0x14
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x412f10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x4f
push 0xde
mov eax, dword [ebp + 8]
push eax
call fcn.00412940
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x412ff5
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x412fe9
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0x412f90
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x10
jge 0x412fc5
push 0xe7
mov edx, dword [ebp - 0x18]
imul edx, edx, 7
add edx, 0x99
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
test eax, eax
jne 0x412fc1
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x412fc3
jmp 0x412fc5
jmp 0x412f87
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret