joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440583
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x46a940]
push edi
jae 0x440758
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x46a960]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x440758
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x44062e
test dl, 2
jne 0x44062e
test dl, 0x48
je 0x4405f8
cmp byte [eax + 5], 0xa
je 0x4405f8
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x440641
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x440629
mov dword [0x46a498], ecx
jmp 0x44075f
cmp eax, 0x6d
jne 0x440635
xor eax, eax
jmp 0x44076c
push eax
call fcn.0043e1e6
pop ecx
jmp 0x440769
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x440753
test eax, eax
je 0x440668
cmp byte [ebx], 0xa
jne 0x440668
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x440671
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x44074d
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x44073d
cmp al, 0xd
je 0x4406a3
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x44072f
dec ecx
cmp dword [ebp - 8], ecx
jae 0x4406bd
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x4406b8
add dword [ebp - 8], 2
jmp 0x440711
mov dword [ebp - 8], eax
jmp 0x44072b
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4406e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44072b
cmp dword [ebp - 0x10], 0
je 0x44072b
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x440706
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x440711
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x44072e
cmp ebx, dword [ebp + 0xc]
jne 0x440716
cmp byte [ebp - 1], 0xa
jne 0x440716
mov byte [ebx], 0xa
jmp 0x44072e
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0043ef4b
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x44072f
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x440687
jmp 0x44074d
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x44074d
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x44076c
and dword [0x46a498], 0
mov dword [0x46a494], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4408d3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00457ac0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44096e
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x46a4a0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x44096e
cmp eax, 1
je 0x44098f
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44096e
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x44093b
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x44096a
xor eax, eax
inc eax
jmp 0x4409ae
cmp edi, eax
jae 0x440972
xor eax, eax
jmp 0x4409ae
cmp eax, esi
jae 0x440979
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x46a4a0]
jmp 0x440992
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44250e
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x460a68
call fcn.00458078
mov edi, 0x94
mov eax, edi
call fcn.00457ac0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x46a4a0], ecx
mov eax, dword [esi + 4]
mov dword [0x46a4ac], eax
mov edx, dword [esi + 8]
mov dword [0x46a4b0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x46a4a4], esi
cmp ecx, 2
je 0x44256e
or esi, 0x8000
mov dword [0x46a4a4], esi
shl eax, 8
add eax, edx
mov dword [0x46a4a8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4425a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4425a9
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4425c1
cmp eax, 0x20b
je 0x4425ae
mov dword [ebp - 0x1c], esi
jmp 0x4425d5
cmp dword [ecx + 0x84], 0xe
jbe 0x4425a9
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4425cf
cmp dword [ecx + 0x74], 0xe
jbe 0x4425a9
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0043e819
pop ecx
test eax, eax
jne 0x442601
cmp dword [0x46a4f0], 1
jne 0x4425ee
call fcn.0043db74
push 0x1c
call fcn.0043dbad
push 0xff
call fcn.0043da91
pop ecx
pop ecx
call fcn.0043e8b2
mov dword [ebp - 4], esi
call fcn.0043ecd8
test eax, eax
jge 0x44261a
push 0x1b
call fcn.004424e9
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x46aa84], eax
call fcn.0043cd2e
mov dword [0x46a4e8], eax
call fcn.0044185f
test eax, eax
jge 0x442640
push 8
call fcn.004424e9
pop ecx
call fcn.00441901
test eax, eax
jge 0x442651
push 9
call fcn.004424e9
pop ecx
push 1
call fcn.0043dadf
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x442667
push eax
call fcn.004424e9
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0044248c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x442688
movzx eax, word [ebp - 0x40]
jmp 0x44268b
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004470c7
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4426a9
push edi
call fcn.0043db5a
call fcn.0043dad0
jmp 0x4426db
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004580b3
ret
Function at 0x44285b
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x46a940]
mov eax, dword [0x465ad8]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x442a21
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x46a960]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x442a21
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x4428c5
xor eax, eax
jmp 0x442a35
test al, 0x20
je 0x4428d6
push 2
push edi
push edi
push ecx
call fcn.0043efd7
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4429ab
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x4429f2
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x442938
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x442929
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x44290b
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x442978
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x442984
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x4428ff
jmp 0x442986
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x442a1c
cmp dword [ebp + 0x3a4], edi
je 0x4429f2
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x4429e4
mov dword [0x46a498], eax
jmp 0x442a28
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4429d6
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x442986
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x442986
push dword [ebp + 0x3a4]
call fcn.0043e1e6
pop ecx
jmp 0x442a32
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x442a0a
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x4428be
mov dword [0x46a494], 0x1c
mov dword [0x46a498], edi
jmp 0x442a32
sub eax, dword [ebp - 0x7c]
jmp 0x442a35
and dword [0x46a498], 0
mov dword [0x46a494], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.004414d9
add ebp, 0x39c
leave
ret
Function at 0x442d0a
Capabilities:
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov dword [ebp - 0x14], ecx
mov ebx, 0x4671d8
mov ecx, ebx
call fcn.004434a3
test eax, eax
jne 0x442d43
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push 0x4595d8
push 0
push str.Cant_open_clipboard_for_writing.
call fcn.0044ba99
jmp 0x442d87
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x442d71
cmp dword [ebp - 4], 4
jae 0x442e21
push edi
mov ecx, ebx
call fcn.0044310a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x442e8e
cmp dword [ebp - 4], 4
jb 0x442e8e
push dword [ebp - 0x10]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x442e2c
cmp dword [ebp - 0x10], edi
je 0x442dfb
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
je 0x442e4a
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x442e7c
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x442e7c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x442e8e
cmp dword [ebp - 4], 4
jb 0x442e8e
cmp dword [ebp - 0xc], edi
jne 0x442d8c
jmp 0x442e8e
push edi
mov ecx, ebx
call fcn.0044310a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4595d8
push edi
push str.Out_of_memory.
jmp 0x442e6f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
mov ecx, ebx
call fcn.0044310a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4595d8
push edi
push 0x459758
mov ecx, dword [ebp - 0x14]
call fcn.0044ba99
jmp 0x442d85
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
mov ecx, ebx
call fcn.0044310a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], edi
jne 0x442d82
mov ecx, dword [0x466b78]
push 1
push edi
push 0xffffffffffffffff
push 0x459724
call fcn.0040187e
jmp 0x442d85
Function at 0x442ec2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov esi, 0x4671d8
mov ecx, esi
call fcn.004434a3
test eax, eax
jne 0x442ef3
push 0x4595d8
push eax
push str.Cant_open_clipboard_for_reading.
mov ecx, edi
call fcn.0044ba99
jmp 0x4430b2
mov ecx, dword [0x466b78]
push ebx
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x45af3c
call fcn.0040187e
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push ebx
jne 0x442f34
mov ecx, esi
call fcn.0044310a
jmp 0x4430b1
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov byte [ebp - 4], bl
mov dword [ebp - 8], ebx
jmp 0x44304c
cmp eax, 1
je 0x442f57
cmp eax, 7
je 0x442f57
cmp eax, 0xd
mov byte [ebp + 0xb], bl
jne 0x442f5b
mov byte [ebp + 0xb], 1
cmp eax, 8
je 0x442f68
cmp eax, 0x11
mov byte [ebp - 1], bl
jne 0x442f6c
mov byte [ebp - 1], 1
cmp eax, 0xe
je 0x442f7a
cmp eax, 3
je 0x442f7a
xor cl, cl
jmp 0x442f7c
mov cl, 1
cmp byte [ebp + 0xb], bl
je 0x442f8a
cmp byte [ebp - 2], bl
jne 0x44304b
cmp byte [ebp - 1], bl
je 0x442f98
cmp byte [ebp - 3], bl
jne 0x44304b
cmp cl, bl
je 0x442fa5
cmp byte [ebp - 4], bl
jne 0x44304b
cmp byte [ebp + 0xb], bl
je 0x442fb0
mov byte [ebp - 2], 1
jmp 0x442fc3
cmp byte [ebp - 1], bl
je 0x442fbb
mov byte [ebp - 3], 1
jmp 0x442fc3
cmp cl, bl
je 0x442fc3
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00443361
mov edi, eax
cmp edi, ebx
je 0x443048
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x442fed
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x443048
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44305f
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44305f
cmp dword [ebp - 0x10], ebx
je 0x443048
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp esi, ebx
mov esi, 0x4671d8
je 0x44306b
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x442f45
jmp 0x44306b
cmp dword [ebp - 0x10], ebx
je 0x44306b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
mov ecx, esi
call fcn.0044310a
cmp dword [ebp - 8], ebx
jne 0x4430a5
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4430a5
mov ecx, dword [0x466b78]
push 1
push ebx
push 0xffffffffffffffff
push 0x459724
call fcn.0040187e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x443156
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x443178
call fcn.004434a3
test eax, eax
jne 0x443178
push str.Cant_open_clipboard_for_writing.
jmp 0x443205
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x443191
push ebx
mov ecx, esi
call fcn.0044310a
push 0x4597e4
jmp 0x443205
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x4431d5
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4431e3
cmp byte [eax], bl
jne 0x4431b4
cmp dword [ebp + 8], 0xd
jne 0x4431ae
cmp byte [eax + 1], bl
jne 0x4431b4
mov byte [ebp - 1], 1
jmp 0x4431b7
mov byte [ebp - 1], bl
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp byte [ebp - 1], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
je 0x4431e3
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
push ebx
mov ecx, esi
call fcn.0044310a
pop esi
pop ebx
leave
ret 4
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4431f8
mov dword [esi + 4], ebx
jmp 0x4431d5
push ebx
mov ecx, esi
call fcn.0044310a
push 0x4597d0
mov ecx, esi
call fcn.004430b8
jmp 0x4431dd

Function at 0x443361
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xc000
jb 0x443416
cmp esi, 0xffff
ja 0x443416
push 0x104
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [ebp - 0x10c]
push str.Link_Source
push eax
call fcn.00441f04
add esp, 0xc
test eax, eax
je 0x44340f
lea eax, [ebp - 0x10c]
push str.ObjectLink
push eax
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x44340f
lea eax, [ebp - 0x10c]
push str.OwnerLink
push eax
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x44340f
lea eax, [ebp - 0x10c]
push str.Native
push eax
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x44340f
lea eax, [ebp - 0x10c]
push str.Embed_Source
push eax
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
jne 0x44341d
xor eax, eax
jmp 0x44349e
mov byte [ebp - 0x10c], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
jmp 0x443493
cmp dword [ebp + 8], 0xf
je 0x44349b
lea eax, [ebp - 0x10c]
push str.OwnerLink
push eax
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x44349b
mov eax, dword [0x464064]
cmp eax, 0xffffffff
je 0x443471
test eax, eax
je 0x44349b
call edi
mov ecx, dword [0x464064]
mov edx, dword [ebp - 4]
add ecx, edx
sub ecx, eax
cmp ecx, 5
jle 0x44349b
and dword [0x46406c], 0
push 1
push 0x8000012f
call fcn.0040dca7
pop ecx
pop ecx
push dword [ebp + 8]
mov dword [0x46406c], 1
call esi
test eax, eax
je 0x443432
jmp 0x44349d
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x4434a3
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ecx
cmp dword [ecx + 0x18], 0
mov dword [esp], ecx
je 0x4434b2
xor eax, eax
inc eax
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push dword [0x466254]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
call edi
xor ebp, ebp
inc ebp
jmp 0x443514
mov eax, dword [0x464064]
cmp eax, 0xffffffff
je 0x4434f2
test eax, eax
je 0x443523
call esi
mov ecx, dword [0x464064]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x443523
and dword [0x46406c], 0
push ebp
push 0x8000012f
call fcn.0040dca7
pop ecx
pop ecx
push dword [0x466254]
mov dword [0x46406c], ebp
call edi
test eax, eax
je 0x4434d3
mov eax, dword [esp + 0x10]
mov dword [eax + 0x18], ebp
mov eax, ebp
jmp 0x443525
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x443866
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
jmp 0x443871
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 0
je 0x44386e
mov edi, dword [esp + 0x14]
cmp byte [edi + 0x17], 0
jne 0x443884
mov edi, dword [edi + 0xc]
mov ecx, edi
call fcn.00401dfc
xor ebx, ebx
inc ebx
cmp byte [esi + 0x17], bl
jne 0x4438d3
push ebx
mov ecx, esi
call fcn.00401e91
cmp dword [edi + 8], eax
je 0x4438cf
push ebx
push 0
push dword [edi + 0xc]
mov ecx, esi
push 0
call fcn.0040187e
test eax, eax
je 0x443920
mov eax, dword [edi + 0xc]
inc eax
push eax
push dword [edi + 8]
mov ecx, esi
push ebx
call fcn.00401e91
push eax
call fcn.00456f20
add esp, 0xc
or byte [esi + 0x15], bl
mov eax, ebx
jmp 0x443920
mov ecx, 0x4671d8
call fcn.004434a3
test eax, eax
jne 0x4438f7
push 0x4595d8
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x466ce0
call fcn.0044bc5a
jmp 0x443920
push ebp
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [edi + 8]
mov eax, dword [edi + 0xc]
lea eax, [eax + esi + 1]
lea edi, [esi + 4]
cmp edi, eax
mov dword [esp + 0x18], eax
jbe 0x44392b
push 0
mov ecx, 0x4671d8
call fcn.0044310a
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x18]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x10], esi
je 0x443913
mov ecx, edi
add edi, 4
cmp edi, eax
ja 0x443913
mov ebx, dword [ecx]
mov esi, edi
add edi, ebx
cmp edi, eax
ja 0x443913
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x443990
test ebx, ebx
je 0x44397a
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4439b5
push ebx
push esi
push eax
call fcn.00456f20
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, edi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
lea edi, [esi + 4]
cmp edi, dword [esp + 0x18]
jbe 0x443927
jmp 0x443913
push 0
mov ecx, 0x4671d8
call fcn.0044310a
push 0x4595d8
push str.Out_of_memory.
mov ecx, 0x466ce0
call fcn.0044bc5a
jmp 0x44391f
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
mov ecx, 0x4671d8
call fcn.0044310a
push 0x4595d8
push 0x459758
jmp 0x4439a6