joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bc00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x45bc28
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x45bcd6
mov esi, esi
xor eax, eax
push 0x45bcb7
push ebp
push 0x4156c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
je 0x45bc8c
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.0042d7d0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x45bcac
cmp dword [ebp - 8], 0
je 0x45bcac
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x45bcd6
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x493310
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x493338
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x4933ee
mov esi, esi
xor eax, eax
push 0x4933cf
push ebp
push 0x4156c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040d710
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x4933c4
cmp dword [ebp - 8], 0
je 0x4933c4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x4933ee
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c0c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x218]
push ebx
push esi
push edi
mov dword [ebp - 0x20c], 0
xor eax, eax
push fcn.0049c0b0
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x69cfd0], 0
push 0x208
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov dword [ebp - 0x210], eax
mov word [ebp + eax*2 - 0x208], 0
mov ecx, dword [ebp - 0x210]
xor edx, edx
mov eax, ebp
call fcn.0049c380
mov ecx, dword [ebp - 0x210]
shl ecx, 1
mov eax, dword [0x69cfc0]
mov edx, dword [eax]
lea eax, [ebp - 0x208]
call fcn.00403750
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
call fcn.00404930
mov dword [ebp - 0x214], eax
mov edx, eax
lea eax, [ebp - 0x20c]
call fcn.0040ad10
mov ecx, dword [ebp - 0x214]
shl ecx, 1
mov eax, ebx
mov edx, dword [ebp - 0x20c]
call fcn.00403750
mov ebx, 1
jmp 0x49c33f
add ebx, 1
cmp dword [ebp - 0x214], ebx
jl 0x49c1a2
mov eax, dword [ebp - 0x20c]
cmp word [eax + ebx*2 - 2], 0x20
jbe 0x49c188
cmp dword [ebp - 0x214], ebx
jl 0x49c34b
mov esi, esi
mov byte [ebp - 0x218], 0
mov edi, ebx
mov dword [ebp - 0x210], 0
jmp 0x49c23b
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x49c230
sub ax, 0x20
jbe 0x49c1ec
sub ax, 2
je 0x49c200
jmp 0x49c230
mov al, byte [ebp - 0x218]
test al, al
je 0x49c243
add dword [ebp - 0x210], 1
jmp 0x49c238
cmp dword [ebp - 0x214], ebx
jle 0x49c22b
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 1]
cmp word [edx + eax*2 - 2], 0x22
je 0x49c22b
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x49c238
add ebx, 1
jmp 0x49c238
add dword [ebp - 0x210], 1
nop
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x49c1c8
cmp dword [0x69cfd0], 0
jle 0x49c338
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x69cfd0]
mov eax, ebp
call fcn.0049c380
mov byte [ebp - 0x218], 0
mov ebx, edi
mov esi, 1
jmp 0x49c32b
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x49c304
sub ax, 0x20
jbe 0x49c2a0
sub ax, 2
je 0x49c2d4
jmp 0x49c304
mov al, byte [ebp - 0x218]
test al, al
je 0x49c337
mov edx, dword [0x69cfc0]
mov eax, dword [0x69cfd0]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
jmp 0x49c328
cmp dword [ebp - 0x214], ebx
jle 0x49c2ff
mov eax, dword [ebp - 0x20c]
lea edx, [ebx + 1]
cmp word [eax + edx*2 - 2], 0x22
je 0x49c2ff
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x49c328
add ebx, 1
jmp 0x49c328
mov eax, dword [0x69cfc0]
mov edx, dword [0x69cfd0]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
lea esi, [esi]
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x49c278
nop
add dword [0x69cfd0], 1
cmp dword [ebp - 0x214], ebx
jge 0x49c18b
sub dword [0x69cfd0], 1
cmp word [0x69a040], 0xfde9
jne 0x49c364
call fcn.0049bfc0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0049c0b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov bl, cl
push 4
lea ecx, [ebp - 8]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 2
jle 0x49c81a
lea edx, [eax - 2]
test edx, edx
jl 0x49c82f
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov si, word [ebp + ecx*2 - 8]
mov di, word [ebp + ecx*2 - 8]
cmp di, 0x20
jb 0x49c82f
sub di, 0x20
je 0x49c814
sub di, 0x80
je 0x49c814
sub di, 0x1f62
jb 0x49c82f
sub di, 1
jbe 0x49c814
sub di, 6
je 0x49c814
sub di, 0x26
jne 0x49c82f
mov esi, esi
jmp 0x49c814
cmp edx, ecx
jg 0x49c7c8
jmp 0x49c82f
cmp eax, 2
jne 0x49c825
mov si, word [ebp - 8]
jmp 0x49c82f
mov al, bl
call fcn.0040b890
mov si, ax
mov ax, si
sub ax, 0x7f
jbe 0x49c8a8
sub ax, 0x21
je 0x49c8b8
sub ax, 0x17
je 0x49c8bc
sub ax, 0x222
je 0x49c8c0
sub ax, 0x392
je 0x49c8c4
sub ax, 1
je 0x49c8c8
sub ax, 0x1996
je 0x49c8cc
sub ax, 1
je 0x49c8d0
sub ax, 6
je 0x49c8d4
sub ax, 0xb
je 0x49c8dc
sub ax, 0x1b
je 0x49c8d8
sub ax, 0x367
je 0x49c8e0
jmp 0x49c8e4
mov ax, si
call fcn.0040b930
jmp 0x49c8e8
mov al, 0x20
jmp 0x49c8e8
mov al, 0x2e
jmp 0x49c8e8
mov al, 0x27
jmp 0x49c8e8
mov al, 0x2c
jmp 0x49c8e8
mov al, 0x27
jmp 0x49c8e8
mov al, 0x20
jmp 0x49c8e8
mov al, 0x20
jmp 0x49c8e8
mov al, 0x20
jmp 0x49c8e8
mov al, 0x20
jmp 0x49c8e8
mov al, 0x2d
jmp 0x49c8e8
mov al, 0x27
jmp 0x49c8e8
mov al, bl
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d5680
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x4d56b4
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x69dfe0]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x4d5690
pop edi
pop esi
pop ebx
ret

Function at 0x4dd680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4dd6b1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4dd6a0
pop esi
pop ebx
ret

Function at 0x4dee90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4deeb4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4def7a
mov esi, esi
xor eax, eax
push 0x4def5b
push ebp
push 0x4156c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040d710
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x604fdc
call fcn.0042f7e0
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004df110
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004df180
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004df1f0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4def50
cmp dword [ebp - 4], 0
je 0x4def50
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4def7a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6920
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4e6954
mov eax, esi
call fcn.004eaea0
cmp byte [esi + 0x40], 0
je 0x4e694c
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4e6a05
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4e69e4
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4e69dc
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4e6988
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4e69a0
xor bl, bl
jmp 0x4e6a05
cmp edi, 2
je 0x4e69da
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4e6978
cmp edi, 3
je 0x4e69b8
cmp edi, 1
jne 0x4e6978
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4e6978
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4e6978
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4e69fc
cmp dword [esi + 0x14], 0xcc
je 0x4e69fc
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004e6d40
lea esi, [esi]
mov eax, esi
call fcn.004e6a10
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x508820
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x508858
mov edx, dword [0x5d7150]
cmp eax, dword [edx + 0x168]
jne 0x508858
cmp byte [edx + 0x114], 0
jne 0x508858
mov eax, dword [0x5da630]
mov edx, dword [0x5da630]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov dword [ebx + 4], eax
nop
mov eax, dword [0x5da630]
mov edx, dword [0x5da630]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x50893c
mov eax, dword [0x5d7150]
cmp byte [eax + 0x114], 0
jne 0x50893c
mov eax, dword [0x5da630]
mov edx, dword [0x5da630]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.0053b9b0
mov eax, dword [0x5d7150]
cmp dword [eax + 0x168], 0
je 0x508910
push 0x10
push 0
mov eax, dword [0x5d7150]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x5d7150]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x5d7150]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
push dword [ebx + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5d7150]
mov eax, dword [eax + 0x168]
call fcn.004851a0
test al, al
je 0x508910
push 0
mov eax, dword [0x5d7150]
call fcn.0041fa60
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push 0x112
push dword [ebx + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebx + 0x24]
mov dword [edx + 0xc], eax
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5d7150]
call fcn.00422a70
jmp 0x5089b0
mov edx, dword [ebx + 0x28]
test edx, edx
je 0x508979
mov eax, dword [0x5d7150]
cmp edx, dword [eax + 0x168]
jne 0x508979
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push 0x112
push dword [ebx + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebx + 0x24]
mov dword [edx + 0xc], eax
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5d7150]
call fcn.00422a70
jmp 0x5089b0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x5089b0
test dword [eax + 0x488], 8
je 0x5089b0
mov eax, dword [ebx + 0x24]
mov dword [eax + 0xc], 1
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5da630]
mov edx, dword [0x5da630]
mov edx, dword [edx]
call dword [edx + 0x8c]
lea esi, [esi]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5089c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [0x5da630]
mov edx, dword [0x5da630]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x508a7c
mov eax, dword [0x5d7150]
cmp byte [eax + 0x114], 0
jne 0x508a7c
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push 0x112
push dword [ebx + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebx + 0x24]
mov dword [edx + 0xc], eax
mov byte [ebx + 0x2c], 0
mov eax, dword [0x5d7150]
cmp dword [eax + 0x168], 0
je 0x508a70
mov eax, dword [0x5d7150]
mov eax, dword [eax + 0x168]
call fcn.004851a0
test al, al
je 0x508a70
mov eax, dword [0x5d7150]
mov eax, dword [eax + 0x168]
mov edx, dword [0x5d7150]
mov edx, dword [edx + 0x168]
mov edx, dword [edx]
call dword [edx + 0x344]
test al, al
je 0x508a68
push 8
mov eax, dword [0x5d7150]
call fcn.0041fa60
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
call fcn.0053ba80
lea esi, [esi]
mov eax, dword [0x5d7150]
call fcn.00422aa0
jmp 0x508ad0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x508a9d
mov edx, dword [0x5d7150]
cmp eax, dword [edx + 0x168]
jne 0x508a9d
mov eax, dword [0x5d7150]
call fcn.00422aa0
jmp 0x508ad0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x508ad0
test dword [eax + 0x488], 8
je 0x508ad0
mov eax, dword [ebx + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [0x5da630]
mov edx, dword [0x5da630]
mov edx, dword [edx]
call dword [edx + 0x90]
lea esi, [esi]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50d0d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x28]
push ebx
mov dword [ebp - 0x28], 8
mov eax, fcn.0050bce0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00414240
mov dword [ebp - 0x18], eax
mov eax, str.MAINICON
push eax
push dword [0x69b2d0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x50d124
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x14], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, str.Window
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne bl
je 0x50d19c
or dword [ebp - 0x28], 0x800
cmp dword [0x5f2890], 6
jb 0x50d174
or dword [ebp - 0x28], 0x20000
lea esi, [esi]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov eax, str.HintWindow
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne bl
lea esi, [esi]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50e090
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x50e128
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x50e128
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.0050e070
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0050e070
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50e7b0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.0050e790
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x50e870
lea eax, [ebp - 0x18]
call fcn.00403c20
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.004a29c0
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.00403c20
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x1c]
call fcn.004a2920
mov esi, dword [ebp - 0x1c]
call fcn.004a3090
mov edx, str._DataSize
push edx
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
call fcn.004a4260
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x50e8c7
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.0050e770
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0050e770
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0050e790
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53bd80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor eax, eax
push fcn.0053bd60
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthW
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 4]
call fcn.0040ad10
test ebx, ebx
jle 0x53bde0
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x53bdd5
mov eax, 0x69b300
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov ebx, eax
mov esi, esi
mov edx, ebx
lea eax, [ebp - 4]
call fcn.0040ad10
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
call fcn.0040b500
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.004a1140
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0053bd60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53d1e0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
mov eax, esi
mov edx, 0x657690
call fcn.0040efd0
mov dword [ebp - 4], 0
xor eax, eax
push fcn.0053d1d0
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 8], 0
mov dword [esi], 0
lea eax, [esi + 0x34]
xor edx, edx
call fcn.00408f40
mov eax, fcn.0050bce0
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [edi]
lea ecx, [ebp - 4]
xor dx, dx
call fcn.00409890
mov edx, dword [ebp - 4]
lea eax, [esi + 0x30]
call fcn.00408f40
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x14]
push eax
lea ecx, [esi + 0x10]
lea edx, [esi + 0xc]
mov eax, ebx
call fcn.0053b5c0
mov edx, esi
mov eax, ebx
call fcn.0053d780
test dword [ebx + 0x28], 0x10
jne 0x53d2b0
mov eax, ebx
call fcn.00489270
test al, al
jne 0x53d2b0
or dword [esi + 0x24], 0x8000000
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0053d1d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x589040
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00408f10
mov eax, dword [ebp + 0xc]
call fcn.00408f10
mov dword [ebp - 8], 0
xor eax, eax
push fcn.00589020
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jb 0x589110
sub ebx, 1
je 0x5890a4
sub ebx, 2
je 0x5890e0
sub ebx, 1
je 0x5890b8
sub ebx, 4
je 0x5890f0
sub ebx, 1
je 0x589100
jmp 0x589110
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.TABLES_WHERE_TABLE_TYPEBASE_TABLE
call fcn.00408f40
jmp 0x58911c
push 0
lea eax, [ebp - 8]
call fcn.00403c20
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
mov dl, 0x27
call fcn.00440f40
mov ecx, dword [ebp - 8]
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.COLUMNS_WHERE_TABLE_NAME
call fcn.00409040
jmp 0x58911c
mov eax, esi
mov edx, str.SELECT___ROUTINE_NAME_AS_PROCEDURE_NAME_FROM_INFORMATION_SCHEMA.ROUTINES
call fcn.00408f40
jmp 0x58911c
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.SCHEMATA
call fcn.00408f40
jmp 0x58911c
mov eax, esi
mov edx, str.SELECT__FROM_INFORMATION_SCHEMA.SEQUENCES
call fcn.00408f40
jmp 0x58911c
mov eax, dword [str.The_metadata_is_not_available_for_this_type_of_database.]
call fcn.0058f840
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00589020
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c6ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, edx
call fcn.00408f10
xor eax, eax
push fcn.005c6ee0
push ebp
push 0x415340
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0x58], 0
je 0x5c6f50
mov eax, dword [ebp - 4]
test eax, eax
je 0x5c6f2a
mov eax, dword [eax - 4]
test eax, eax
jle 0x5c6f50
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x5c6f3e
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x58]
call sub.kernel32.dll_WriteFile
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005c6ee0
mov esp, ebp
pop ebp
ret