joyce8/EMBER2024-capa huggingface dataset:
Function at 0x89936c
Capabilities:
Delete file
Write file on windows

Disassembly:
cmp dword [0x83cfb8], 0
jne 0x899391
push 0x1000
push str.Arghhh___...
push str.No_Wave_Resources_in_this_PE
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
mov dword [0x82bc00], 0x83cfb8
mov dword [0x82bc04], 0
add dword [0x82bc00], 4
cmp byte [0x82bc04], 0
jne 0x8994a3
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.Wave___.Wav
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x48a948], eax
mov esi, dword [0x82bc00]
push 0
push 0x4319c0
push dword [esi + 4]
push dword [esi]
push dword [0x48a948]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x48a948]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20001
push 0
push str.Wave___.Wav
call dword [sym.imp.WINMM.dll_PlaySound]
call fcn.0088bfc5
push 0x83cfb8
push 0x88c00c
push dword [0x8187e4]
push 0x47926c
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySound]
cmp dword [0x82bc04], 0x1b
jne 0x899460
jmp 0x8994f3
cmp dword [0x82bc00], 0x83cfb8
jae 0x899481
add dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x89949e
mov esi, dword [0x82bc00]
cmp dword [esi], 0
jne 0x89949e
sub dword [0x82bc00], 0xc
mov esi, dword [0x82bc00]
call fcn.0088bfc5
jmp 0x8993ac
push 0x1024
push str.Are_you_sure...
push str.Delete_this_Wave_Resource_
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x8994f3
sub dword [0x82bc00], 4
mov esi, dword [0x82bc00]
mov edi, esi
add esi, 0xc
mov eax, dword [0x82bc00]
sub eax, 0x83cfb8
shr eax, 2
mov ecx, 0x12c
sub ecx, eax
rep movsd dword es:[edi], dword [esi]
sub dword [0x48a6ec], 0xc
push str.Wave___.Wav
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret
Function at 0x89955e
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [0x48a844], str.Cursor_Files
mov dword [0x48a868], 0x48a78f
mov dword [0x48a6fc], 0x82ea08
push dword [0x48a6d0]
pop dword [0x48a700]
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x8995da
mov dword [0x48a6fc], 0
mov dword [0x48a700], 0
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x899609
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x845a18], eax
mov ebx, 0x845a1c
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x845a18]
push dword [0x845a1c]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x845a1c]
cmp dword [eax + 2], 0x10002
je 0x899698
push 0x1000
push str.Arghhh___...
push str.Bad_or_multiple_Cursor_s__file
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x845a1c], 0
je 0x899697
mov eax, dword [0x845a1c]
call fcn.0084b661
mov dword [0x845a1c], 0
ret
mov ebx, 0x845a20
mov edx, dword [0x845a18]
call fcn.0084b515
mov ebx, 0x4cfabc
mov edx, 0x14
call fcn.0084b515
mov edi, dword [0x48a6d4]
mov eax, dword [0x4cfabc]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x14
mov edi, eax
mov esi, dword [0x845a1c]
mov ecx, 0x14
rep movsb byte es:[edi], byte [esi]
push dword [edi - 0xa]
pop dword [0x845a24]
push edi
mov esi, dword [0x845a1c]
add esi, 0x16
sub dword [0x845a18], 0x12
mov ecx, dword [0x845a18]
mov eax, dword [0x845a24]
mov edi, dword [0x845a20]
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
cmp dword [0x845a1c], 0
je 0x899726
mov eax, dword [0x845a1c]
call fcn.0084b661
mov dword [0x845a1c], 0
push dword [0x845a20]
pop dword [0x845a1c]
call fcn.0089a1d2
call fcn.0089a1b2
mov esi, dword [0x48a700]
lodsd eax, dword [esi]
mov edi, dword [0x48a6d4]
stosd dword es:[edi], eax
pop edi
mov word [edi - 2], ax
add dword [edi - 6], 4
add dword [0x48a6d0], 0xc
add dword [0x48a6d4], 0xc
ret
Function at 0x899762
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [0x48a844], str.Icon_Files
mov dword [0x48a868], 0x48a7b6
mov dword [0x48a6fc], 0x832ba8
push dword [0x48a6d8]
pop dword [0x48a700]
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x8997de
mov dword [0x48a6fc], 0
mov dword [0x48a700], 0
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x89980d
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x845a18], eax
mov ebx, 0x845a1c
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x845a18]
push dword [0x845a1c]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x845a1c]
cmp dword [eax + 2], 0x10001
je 0x89989c
push 0x1000
push str.Arghhh___...
push str.Bad_or_multiple_Icon_s__file
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x845a1c], 0
je 0x89989b
mov eax, dword [0x845a1c]
call fcn.0084b661
mov dword [0x845a1c], 0
ret
mov ebx, 0x845a28
mov edx, dword [0x845a18]
call fcn.0084b515
mov ebx, 0x4cfabc
mov edx, 0x14
call fcn.0084b515
mov edi, dword [0x48a6e8]
mov eax, dword [0x4cfabc]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x14
mov edi, eax
mov esi, dword [0x845a1c]
mov ecx, 0x14
rep movsb byte es:[edi], byte [esi]
push edi
mov esi, dword [0x845a1c]
add esi, 0x16
sub dword [0x845a18], 0x12
mov ecx, dword [0x845a18]
mov edi, dword [0x845a28]
rep movsb byte es:[edi], byte [esi]
cmp dword [0x845a1c], 0
je 0x89991b
mov eax, dword [0x845a1c]
call fcn.0084b661
mov dword [0x845a1c], 0
push dword [0x845a28]
pop dword [0x845a1c]
mov byte [0x845a3c], 1
call fcn.0089a1d2
call fcn.0089a1b2
mov byte [0x845a3c], 0
mov esi, dword [0x48a700]
lodsd eax, dword [esi]
mov edi, dword [0x48a6e8]
stosd dword es:[edi], eax
pop edi
mov word [edi - 2], ax
add dword [edi - 6], 4
add dword [0x48a6d8], 0xc
add dword [0x48a6e8], 0xc
ret
Function at 0x8999b6
Capabilities:
Delete file
Write file on windows

Disassembly:
cmp dword [0x83f088], 0
jne 0x8999db
push 0x1000
push str.Arghhh___...
push str.No_Avi_Resources_in_this_PE
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
push 0
push 0x899965
push 0
push 0x48aa04
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [0x845a2c], eax
push 0
push dword [0x8187e0]
push 0
push dword [0x845a2c]
push 0x64
push 0xc8
push 4
push 4
push 0x50000005
push 0
push str.SysAnimate32
push 0x440000
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x48a9a0], eax
mov dword [0x82bc00], 0x83f088
mov dword [0x82bc04], 0
add dword [0x82bc00], 4
cmp byte [0x82bc04], 0
jne 0x899b53
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.Avi___.avi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x48a9a4], eax
mov esi, dword [0x82bc00]
mov ecx, dword [esi + 4]
push 0
push 0x4319c0
push ecx
push dword [esi]
push dword [0x48a9a4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x48a9a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Avi___.avi
push 0
push 0x464
push dword [0x48a9a0]
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.0088bfc5
push 0x83f088
push 0x88c00c
push dword [0x8187e4]
push 0x47926c
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push 0
push 0
push 0x466
push dword [0x48a9a0]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x82bc04], 0x1b
jne 0x899b10
jmp 0x899ba3
cmp dword [0x82bc00], 0x83f088
jae 0x899b31
add dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x899b4e
mov esi, dword [0x82bc00]
cmp dword [esi], 0
jne 0x899b4e
sub dword [0x82bc00], 0xc
mov esi, dword [0x82bc00]
call fcn.0088bfc5
jmp 0x899a4c
push 0x1024
push str.Are_you_sure...
push str.Delete_this_Avi_Resource_
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x899ba3
sub dword [0x82bc00], 4
mov esi, dword [0x82bc00]
mov edi, esi
add esi, 0xc
mov eax, dword [0x82bc00]
sub eax, 0x83f088
shr eax, 2
mov ecx, 0x12c
sub ecx, eax
rep movsd dword es:[edi], dword [esi]
sub dword [0x48a6f0], 0xc
push dword [0x48a9a0]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_EndDialog]
push str.Avi___.avi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret
Function at 0x899bc9
Capabilities:
Delete file
Write file on windows

Disassembly:
cmp dword [0x82ea08], 0
jne 0x899bee
push 0x1000
push str.Arghhh___...
push str.No_Cursor_Resources_in_this_PE
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
mov dword [0x82bc00], 0x82ea08
mov dword [0x82bc04], 0
mov dword [0x845a2c], 0
add dword [0x82bc00], 4
cmp byte [0x82bc04], 0
jne 0x899dc5
cmp dword [0x845a2c], 0
je 0x899c37
push 0
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0x899965
push 0
push 0x48aa04
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [0x845a2c], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.Cursor.___
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x845a34], eax
mov eax, dword [0x82bc00]
sub eax, 0x82ea08
add eax, 0x830ad8
mov ecx, dword [eax]
sub dword [ecx + 0xe], 4
mov ecx, dword [ecx + 0xe]
push eax
push ecx
push 0
push 0x4319c0
push 0x10
push dword [eax]
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x4319c0
push 6
push 0x48aa84
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [0x82bc00]
mov esi, dword [esi]
add esi, 4
pop ecx
pop eax
mov eax, dword [eax]
add dword [eax + 0xe], 4
push 0
push 0x4319c0
push ecx
push esi
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Cursor.___
call dword [sym.imp.USER32.dll_LoadCursorFromFileA]
cmp dword [0x845a30], 0
jbe 0x899d1a
pushal
push dword [0x845a30]
call dword [sym.imp.USER32.dll_DestroyCursor]
popal
mov dword [0x845a30], eax
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_GetDC]
push eax
push dword [0x845a30]
push 0xa
push 0xa
push eax
call dword [sym.imp.USER32.dll_DrawIcon]
pop eax
push eax
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.0088bfc5
push 0x82ea08
push 0x88c00c
push dword [0x8187e4]
push 0x47926c
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
cmp dword [0x82bc04], 0x1b
jne 0x899d88
jmp 0x899e3b
cmp dword [0x82bc00], 0x82ea08
jae 0x899da9
add dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x899dc0
mov esi, dword [0x82bc00]
cmp dword [esi], 0
jne 0x899dc0
sub dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x899c13
push 0x1024
push str.Are_you_sure...
push str.Delete_this_Cursor_
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x899e3b
sub dword [0x82bc00], 4
mov esi, dword [0x82bc00]
mov edi, esi
add esi, 0xc
mov ebx, dword [edi]
mov eax, dword [0x82bc00]
sub eax, 0x82ea08
shr eax, 2
mov ecx, 0x834
sub ecx, eax
rep movsd dword es:[edi], dword [esi]
sub dword [0x48a6d0], 0xc
mov esi, 0x830ad8
mov ecx, 0x834
cmp dword [esi], ebx
je 0x899e2d
add esi, 0xc
sub ecx, 3
jmp 0x899e21
mov edi, esi
add esi, 0xc
rep movsd dword es:[edi], dword [esi]
sub dword [0x48a6d4], 0xc
push 0
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_EndDialog]
push str.Cursor.___
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret
Function at 0x899e55
Capabilities:
Delete file
Write file on windows

Disassembly:
cmp dword [0x832ba8], 0
jne 0x899e7a
push 0x1000
push str.Arghhh___...
push str.Icon_not_found_in_this_file
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
mov dword [0x82bc00], 0x832ba8
mov dword [0x82bc04], 0
mov dword [0x845a2c], 0
add dword [0x82bc00], 4
cmp byte [0x82bc04], 0
jne 0x89a04d
cmp dword [0x845a2c], 0
je 0x899ec3
push 0
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0x899965
push 0
push 0x48aa04
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [0x845a2c], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.Cursor.___
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x845a34], eax
mov eax, dword [0x82bc00]
sub eax, 0x832ba8
add eax, 0x83aee8
cmp dword [eax], 0
jne 0x899f1e
jmp 0x89a0c3
mov ecx, dword [eax]
mov ecx, dword [ecx + 0xe]
push ecx
push 0
push 0x4319c0
push 0x10
push dword [eax]
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x4319c0
push 6
push 0x48aa84
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [0x82bc00]
pop ecx
push 0
push 0x4319c0
push dword [esi + 4]
push dword [esi]
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x845a34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Cursor.___
call dword [sym.imp.USER32.dll_LoadCursorFromFileA]
cmp dword [0x845a30], 0
jbe 0x899fa2
pushal
push dword [0x845a30]
call dword [sym.imp.USER32.dll_DestroyCursor]
popal
mov dword [0x845a30], eax
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_GetDC]
push eax
push dword [0x845a30]
push 0xa
push 0xa
push eax
call dword [sym.imp.USER32.dll_DrawIcon]
pop eax
push eax
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.0088bfc5
push 0x832ba8
push 0x88c00c
push dword [0x8187e4]
push 0x47926c
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
cmp dword [0x82bc04], 0x1b
jne 0x89a010
jmp 0x89a0c3
cmp dword [0x82bc00], 0x832ba8
jae 0x89a031
add dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x89a048
mov esi, dword [0x82bc00]
cmp dword [esi], 0
jne 0x89a048
sub dword [0x82bc00], 0xc
call fcn.0088bfc5
jmp 0x899e9f
push 0x1024
push str.Are_you_sure...
push str.Delete_this_Icon_
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x89a0c3
sub dword [0x82bc00], 4
mov esi, dword [0x82bc00]
mov edi, esi
add esi, 0xc
mov ebx, dword [edi]
mov eax, dword [0x82bc00]
sub eax, 0x832ba8
shr eax, 2
mov ecx, 0x834
sub ecx, eax
rep movsd dword es:[edi], dword [esi]
sub dword [0x48a6d8], 0xc
mov esi, 0x83aee8
mov ecx, 0x834
cmp dword [esi], ebx
je 0x89a0b5
add esi, 0xc
sub ecx, 3
jmp 0x89a0a9
mov edi, esi
add esi, 0xc
rep movsd dword es:[edi], dword [esi]
sub dword [0x48a6e8], 0xc
push 0
push dword [0x845a2c]
call dword [sym.imp.USER32.dll_EndDialog]
push str.Cursor.___
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret
Function at 0x89a0dd
Capabilities:
Get file size
Read file on windows

Disassembly:
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x89a11b
ret
cmp dword [0x845a14], 0
jbe 0x89a130
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x845a14], 0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x89a169
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x845a18], eax
mov ebx, 0x845a1c
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x845a18]
push dword [0x845a1c]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
ret

Function at 0x89a3e4
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.Clip.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x89a410
mov byte [0x845a50], 0
ret
mov byte [0x845a50], 1
mov dword [0x845a40], eax
push 0
push dword [0x845a40]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x845a44], eax
add eax, 0x10000
mov ebx, 0x845a48
mov edx, eax
call fcn.0084b515
add eax, dword [0x845a44]
add eax, 0x10000
mov dword [0x845a4c], eax
push 0
push 0x4319c0
push dword [0x845a44]
push dword [0x845a48]
push dword [0x845a40]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call fcn.0089b232
ret

Function at 0x89a4bc
Capabilities:
Write file on windows

Disassembly:
push dword [0x845a40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.Clip.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x845a40], eax
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x845a44]
push dword [0x845a48]
push dword [0x845a40]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret
Function at 0x89b5db
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp dword [0x845b04], 0
jne 0x89b5e5
ret
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
je 0x89b701
call dword [sym.imp.USER32.dll_EmptyClipboard]
cmp eax, 0
je 0x89b6fb
mov ecx, dword [0x845b04]
shl ecx, 2
push ecx
push ecx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, 0
jne 0x89b62a
pop eax
jmp 0x89b6fb
mov dword [0x818bfc], eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
pop ecx
shr ecx, 2
mov edi, eax
mov esi, dword [0x845af8]
mov ebx, esi
add ebx, 2
cmp byte [ebx], 0x20
ja 0x89b64f
inc ebx
jmp 0x89b647
cmp byte [ebx], 0x40
jne 0x89b689
call fcn.0089a664
cmp dword [0x845b04], 0
jne 0x89b667
ret
mov esi, dword [0x845af8]
mov ecx, dword [0x845b04]
cmp byte [esi], 0x40
je 0x89b67e
inc esi
dec ecx
je 0x89b6fb
jmp 0x89b673
inc esi
dec ecx
je 0x89b6fb
rep movsb byte es:[edi], byte [esi]
jmp 0x89b6c5
cmp byte [0x48ad2b], 1
jne 0x89b6b0
cmp byte [0x48ad2c], 1
jne 0x89b6a6
call fcn.0089b766
jmp 0x89b6ab
call fcn.0089b78f
jmp 0x89b6c5
cmp byte [0x48ad2c], 1
jne 0x89b6c0
call fcn.0089b859
jmp 0x89b6c5
call fcn.0089b89e
mov eax, 0
stosd dword es:[edi], eax
push dword [0x818bfc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x818bfc]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push dword [0x818bfc]
push 0
push 0xc
push dword [0x845b28]
call dword [sym.imp.USER32.dll_SendMessageA]
call dword [sym.imp.USER32.dll_CloseClipboard]
ret

Function at 0x89bc5d
Capabilities:
Get file size
Read file on windows

Disassembly:
cmp byte [0x813d70], 0
jne 0x89bc84
push str.Run__Configuration__Files_Locations___RosAsm_
push str.Include_Files
push str.B_U_Asm.exe
call fcn.008850ab
ret
cmp byte [0x846ccc], 1
jne 0x89bd0f
mov esi, str.Equates.equ
mov edi, 0x846cd8
cmp byte [esi], 0
je 0x89bca3
movsb byte es:[edi], byte [esi]
jmp 0x89bc9b
dec edi
cmp byte [edi], 0x2e
je 0x89bcac
dec edi
jmp 0x89bca4
dec edi
cmp byte [edi], 0x5c
je 0x89bcc1
cmp byte [edi], 0x3a
je 0x89bcc1
cmp edi, 0x846cd8
ja 0x89bcac
jmp 0x89bcc2
inc edi
mov ecx, 0x104
add ecx, 0x846cd8
sub ecx, edi
cmp dword [0x846cc8], 0
jne 0x89bce2
mov dword [0x846cc8], 0xfa1
push 0
push ecx
push edi
push dword [0x846cc8]
push dword [0x4658b0]
call dword [sym.imp.USER32.dll_GetMenuStringA]
mov esi, 0x846cd8
cmp byte [esi], 0
je 0x89bd05
inc esi
jmp 0x89bcfd
mov dword [esi], 0x7274732e
mov byte [esi + 4], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x846cd8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x846cd0], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x846cd4], eax
mov ebx, 0x845b80
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x846cd4]
push dword [0x845b80]
push dword [0x846cd0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x846cd0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x89c519
Capabilities:
Get graphical window text

Disassembly:
push 0x845c60
push 0x96
push 0xd
push dword [0x845b90]
call dword [sym.imp.USER32.dll_SendMessageA]
ret
Function at 0x89c532
Capabilities:
Get graphical window text

Disassembly:
push dword [0x818b5c]
push dword [0x818b60]
push dword [0x818bd8]
mov ebx, 0x846f7c
mov edx, 0xfa0
call fcn.0084b515
push dword [0x846f7c]
pop dword [0x818b5c]
push dword [0x846f7c]
push 0xfa0
push 0xd
push dword [0x845b8c]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0
jbe 0x89c5b1
add eax, dword [0x818b5c]
mov byte [0x818bd8], 1
mov dword [0x818b60], eax
call fcn.00877e2c
cmp dword [0x846f7c], 0
je 0x89c5b1
mov eax, dword [0x846f7c]
call fcn.0084b661
mov dword [0x846f7c], 0
pop dword [0x818bd8]
pop dword [0x818b60]
pop dword [0x818b5c]
ret

Function at 0x89ca6d
Capabilities:
Get graphical window text

Disassembly:
push 0x64
push dword [0x846f94]
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.
push 0xb
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, str.
mov ebx, 0
mov eax, 0
lodsb al, byte [esi]
cmp al, 0x20
je 0x89ca9a
cmp al, 0x5f
je 0x89ca9a
cmp al, 0
je 0x89cac1
sub al, 0x30
cmp al, 9
jbe 0x89caaf
sub al, 7
cmp al, 0xf
jbe 0x89caba
mov eax, 0
jmp 0x89cb06
shl ebx, 4
add ebx, eax
jmp 0x89ca9a
mov eax, ebx
add eax, 0xfff
and eax, 0xfffff000
cmp eax, 0x400000
jae 0x89cad8
jmp 0x89cadf
cmp eax, 0x80000000
jb 0x89cb01
push 0x1000
push str.Dll_Load_Adress_range_is:
push str._r_n_Smaller_than:_0_8000_0000_r_n_Bigger__than:____040_0000
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0
jmp 0x89cb06
mov dword [0x431994], eax
ret

Function at 0x8a08c8
Capabilities:
Hide graphical window

Disassembly:
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x465e79]
shr eax, 1
mov dword [0x465e71], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x465e7d]
shr eax, 1
mov dword [0x465e75], eax
push 0
push dword [0x8187e0]
push 0
push dword [0x8187e4]
push dword [0x465e7d]
push dword [0x465e79]
push dword [0x465e75]
push dword [0x465e71]
push 0xcf0000
push 0
push str.RosAsmWindowClass
push 0x84
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x465e85], eax
push 1
push dword [0x465e85]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x465e85]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push dword [0x8187e0]
push 1
push dword [0x465e85]
push dword [0x465e6d]
push dword [0x465e69]
push dword [0x465e65]
push dword [0x465e61]
push 0x50000000
push 0
push 0x465e4c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x465e81], eax
push 0x800000
push 0
push 0x401
push dword [0x465e81]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 1
push 0x404
push dword [0x465e81]
call dword [sym.imp.USER32.dll_SendMessageA]
push str.Analyze_of_the_Code_flow...
push 0
push 0xc
push dword [0x465e85]
call dword [sym.imp.USER32.dll_SendMessageA]
ret