joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d8130
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6172b4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, edi
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x5d81fe
cmp eax, 0xffffffff
je 0x5d81fe
lea ecx, [esi - 0x88]
push edi
call fcn.005d8e20
mov eax, dword [esi + 0x20]
and eax, 0x108
cmp eax, 8
jne 0x5d82a6
lea ecx, [esi + 0x168]
mov dword [ebp + 8], 0x7a135c
push 1
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
call fcn.0059af30
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5d82a6
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x5d82a6
push ecx
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edx, [esi - 0x88]
lea ecx, [ebp + 8]
call fcn.00494d70
mov dword [ebp - 4], 2
lea ecx, [esi + 0x34]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x20], ecx
add ecx, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0x10], 1
mov dword [ecx], eax
mov byte [ebp - 4], 3
mov esi, dword [ebp + 8]
nop word [eax + eax]
test esi, esi
je 0x5d827b
cmp dword [esi + 8], 0
je 0x5d827b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jle 0x5d827b
mov edx, dword [ebp - 0x20]
dec ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
cmp ecx, eax
jl 0x5d826e
lea ecx, [eax - 1]
mov eax, ecx
mov dword [ebp - 0x1c], ecx
shr eax, 0x1f
xor al, 1
je 0x5d827b
mov eax, dword [edx]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x5d8240
cmp byte [ebp - 0x10], 0
je 0x5d8289
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
test esi, esi
je 0x5d82a6
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
lea eax, [ecx - 1]
test eax, eax
jne 0x5d82a6
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5d9410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6174f2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005d94f0
mov eax, dword [esi + 0xa8]
test al, 8
jne 0x5d9482
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x5d947c
cmp eax, 0xffffffff
je 0x5d947c
xor bl, bl
jmp 0x5d94b5
mov eax, dword [esi + 0xa8]
shr eax, 1
and al, 1
jne 0x5d94b3
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
je 0x5d94af
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5d94b3
xor bl, bl
jmp 0x5d94b5
mov bl, 1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x5d94d6
or ecx, 0xffffffff
lock xadd dword [eax], ecx
test ecx, ecx
jne 0x5d94d6
push eax
call fcn.004a8172
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dab10
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6177ab
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
lea ecx, [ebx + 0x70]
mov al, 1
xchg byte [ecx], al
mov ecx, dword [ebx + 0x40]
lea eax, [ebx + 0x28]
push eax
call fcn.005118a0
lea ecx, [ebx + 0x71]
xor al, al
xchg byte [ecx], al
cmp dword [ebx + 0x68], 0
lea ecx, [ebx + 0x60]
sete al
mov byte [ebx + 0x72], al
call fcn.004946a0
cmp dword [ebx + 0x64], 0
je 0x5dab85
push dword [ebx + 0x60]
call fcn.004c2bdc
add esp, 4
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
lea edx, [ebx + 0x38]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x5dabba
cmp eax, 0xffffffff
je 0x5dabba
mov al, 1
jmp 0x5dabbc
xor al, al
test al, al
je 0x5dac80
push 0x38
call fcn.004a7e6f
mov edi, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov esi, dword [ebx + 0x44]
push 0x7a7100
call fcn.0041d340
add esp, 4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
mov ecx, edi
push esi
push eax
push 0
lea eax, [ebx + 0x38]
push eax
call fcn.00525350
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x5dac31
or ecx, 0xffffffff
lock xadd dword [eax], ecx
test ecx, ecx
jne 0x5dac31
push eax
call fcn.004a8172
add esp, 4
lea eax, [ebx + 0x6c]
lea ecx, [ebp - 0x18]
cmp eax, ecx
je 0x5dac4f
mov edi, dword [eax]
mov dword [eax], esi
test edi, edi
je 0x5dac65
mov ecx, edi
call fcn.004103c0
push 0x38
push edi
jmp 0x5dac5d
test esi, esi
je 0x5dac65
mov ecx, esi
call fcn.004103c0
push 0x38
push esi
call fcn.004a7e9f
add esp, 8
xor al, al
lea ecx, [ebx + 0x70]
xchg byte [ecx], al
mov al, 1
lea ecx, [ebx + 0x71]
xchg byte [ecx], al
push ecx
mov ecx, dword [ebx + 0x40]
lea eax, [ebx + 0x28]
push eax
call fcn.00511920
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dafe0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6177c6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.juce::ChangeBroadcaster.0
call fcn.00532ee0
mov eax, dword [ebp + 8]
mov dword [edi + 4], vtable.juce::ChangeBroadcaster::ChangeBroadcasterCallback.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
mov dword [edi + 0xc], edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi], vtable.juce::DirectoryContentsList.0
mov dword [edi + 0x28], vtable.juce::DirectoryContentsList.1.0
mov dword [edi + 0x38], 0x7a135c
mov dword [edi + 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x40], eax
lea eax, [edi + 0x48]
push eax
mov dword [edi + 0x44], 6
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0x60], 0
mov eax, edi
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov word [edi + 0x70], 1
mov byte [edi + 0x72], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5db0d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6177f1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 4]
add edx, 0x38
mov eax, dword [edx]
cmp byte [eax], 0
je 0x5db1e9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5db1e9
push 0
push 0x7f4060
push 0x7f992c
push 0
push esi
call fcn.004bf54d
add esp, 0x14
lea ecx, [ebp - 0x10]
mov edx, eax
call fcn.00494d70
mov dword [ebp - 4], 1
lea ecx, [esi + 8]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x24], ecx
add ecx, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
mov byte [ebp - 0x14], 1
mov dword [ecx], eax
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x5db1be
cmp dword [esi + 8], 0
je 0x5db1be
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jle 0x5db1be
mov edx, dword [ebp - 0x24]
dec ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x20], ecx
cmp ecx, eax
jl 0x5db1b1
lea ecx, [eax - 1]
mov eax, ecx
mov dword [ebp - 0x20], ecx
shr eax, 0x1f
xor al, 1
je 0x5db1be
mov eax, dword [edx]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x5db183
cmp byte [ebp - 0x14], 0
je 0x5db1cc
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
test esi, esi
je 0x5db1e9
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
lea eax, [ecx - 1]
test eax, eax
jne 0x5db1e9
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5db200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61781c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 4]
add edx, 0x38
mov eax, dword [edx]
cmp byte [eax], 0
je 0x5db31e
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5db31e
push 0
push 0x7f4060
push 0x7f992c
push 0
push esi
call fcn.004bf54d
add esp, 0x14
lea ecx, [ebp - 0x10]
mov edx, eax
call fcn.00494d70
mov dword [ebp - 4], 1
lea ecx, [esi + 8]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x24], ecx
add ecx, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
mov byte [ebp - 0x14], 1
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x5db2f3
cmp dword [esi + 8], 0
je 0x5db2f3
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jle 0x5db2f3
mov edx, dword [ebp - 0x24]
dec ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x20], ecx
cmp ecx, eax
jl 0x5db2e5
lea ecx, [eax - 1]
mov eax, ecx
mov dword [ebp - 0x20], ecx
shr eax, 0x1f
xor al, 1
je 0x5db2f3
mov eax, dword [edx]
push edi
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x5db2b7
cmp byte [ebp - 0x14], 0
je 0x5db301
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
test esi, esi
je 0x5db31e
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
lea eax, [ecx - 1]
test eax, eax
jne 0x5db31e
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5dcd70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
push edi
mov dword [esi], vtable.juce::DrawableShape.0
mov ecx, dword [esi + 0x130]
test ecx, ecx
je 0x5dcd9e
lea eax, [ecx + 4]
mov edx, ebx
lock xadd dword [eax], edx
lea eax, [edx - 1]
test eax, eax
jne 0x5dcd9e
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [esi + 0x12c]
test edi, edi
je 0x5dcdc2
push dword [edi + 0x14]
mov dword [edi + 0x1c], 0
call fcn.004c2bdc
push 0x20
push edi
call fcn.004a7e9f
add esp, 0xc
mov ecx, dword [esi + 0x10c]
test ecx, ecx
je 0x5dcde0
lea eax, [ecx + 4]
lock xadd dword [eax], ebx
lea eax, [ebx - 1]
test eax, eax
jne 0x5dcde0
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [esi + 0x108]
test edi, edi
je 0x5dce04
push dword [edi + 0x14]
mov dword [edi + 0x1c], 0
call fcn.004c2bdc
push 0x20
push edi
call fcn.004a7e9f
add esp, 0xc
push dword [esi + 0xe4]
mov dword [esi + 0xec], 0
call fcn.004c2bdc
push dword [esi + 0xc4]
mov dword [esi + 0xcc], 0
call fcn.004c2bdc
push dword [esi + 0xb8]
mov dword [esi + 0xc0], 0
call fcn.004c2bdc
mov dword [esi], vtable.juce::Drawable.0
add esp, 0xc
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x5dce5c
mov eax, dword [ecx]
push 1
call dword [eax]
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.005fb9f0
Function at 0x5e1200
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0x150]
add ecx, 0x150
cmp byte [eax], 0
jne fcn.004fc960
ret

Function at 0x5e49f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6181f5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0x2c]
mov eax, dword [esi + 0x40]
push dword [esi + 0x28]
mov ecx, dword [ebx + 0xc]
push dword [esi + 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
call fcn.005ef020
push dword [esi + 4]
mov ecx, dword [ebx + 0xc]
push dword [esi]
movss xmm0, dword [eax]
push dword [esi + 0x30]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x50]
push eax
movss dword [ebp - 0x1c], xmm0
call fcn.005ef020
mov ecx, dword [esi + 0x48]
mov edi, dword [esi + 0x34]
movss xmm7, dword [esi + 0x24]
movss xmm0, dword [eax]
movss xmm4, dword [eax + 4]
mov al, byte [esi + 0x4d]
movups xmm2, xmmword [esi + 0x14]
mov byte [ebp - 0x12], al
mov al, byte [esi + 0x4c]
mov byte [ebp - 0x11], al
mov eax, dword [esi + 0x10]
mov esi, dword [ebx + 8]
cmp byte [ebp - 0x12], 0
movss dword [esi], xmm0
cvtps2pd xmm0, xmm0
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 0x2c]
addsd xmm0, qword [0x7b99f0]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x3c]
movsd qword [ebp - 0x48], xmm0
mov edx, dword [ebp - 0x48]
cvtps2pd xmm0, xmm4
mov dword [esi + 8], edx
mov dword [esi + 0x44], eax
mov al, byte [ebp - 0x11]
mov dword [esi + 0x34], edi
movss dword [esi + 4], xmm4
addsd xmm0, qword [0x7b99f0]
movups xmmword [esi + 0x14], xmm2
movss dword [esi + 0x24], xmm7
movsd qword [ebp - 0x48], xmm0
movss xmm0, dword [ebp - 0x18]
mov edx, dword [ebp - 0x48]
movss dword [esi + 0x28], xmm0
movss xmm0, dword [ebp - 0x1c]
mov dword [esi + 0xc], edx
movss dword [esi + 0x2c], xmm0
mov dword [esi + 0x48], ecx
setne cl
mov byte [esi + 0x4c], al
mov eax, esi
mov byte [esi + 0x4d], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x5f4a00
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619616
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
add eax, 0xffffeffe
cmp eax, 7
ja case.0x5f4a42.4103
jmp dword [eax*4 + 0x5f4bd8]
call fcn.0059b950
mov ecx, esi
call fcn.00599e70
mov ecx, esi
call fcn.00599c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0059b950
mov ecx, esi
call fcn.00599e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0059b950
cmp byte [esi + 0x160], 0
jne case.0x5f4a42.4103
cmp byte [esi + 0x81], 0
jl case.0x5f4a42.4103
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x5f4ac3
call fcn.005fadd0
test al, al
je case.0x5f4a42.4103
mov dword [ebp - 4], 0
push 0
mov dword [ebp + 8], 0x7a135c
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_OpenClipboard]
or ebx, 0xffffffff
test eax, eax
je 0x5f4b50
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x5f4b4a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5f4b4a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push dword [ebp - 0x14]
shr eax, 1
lea ecx, [ebp - 0x14]
mov edx, eax
call fcn.0041d620
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 8], ecx
lea ecx, [eax - 8]
cmp ecx, 0x7a1354
je 0x5f4b43
mov eax, ebx
lock xadd dword [ecx], eax
test eax, eax
jne 0x5f4b43
push ecx
call fcn.004a8172
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x5f4b6e
mov eax, dword [esi + 0x88]
lea ecx, [esi + 0x88]
lea edx, [ebp + 8]
push edx
call dword [eax + 0x18]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je case.0x5f4a42.4103
lock xadd dword [eax], ebx
test ebx, ebx
jne case.0x5f4a42.4103
push eax
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00598350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
jmp 0x5f4bbc
push 0
call fcn.0059b780
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5f4a90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619616
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
add eax, 0xffffeffe
cmp eax, 7
ja case.0x5f4a42.4103
jmp dword [eax*4 + 0x5f4bd8]
call fcn.0059b950
mov ecx, esi
call fcn.00599e70
mov ecx, esi
call fcn.00599c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0059b950
mov ecx, esi
call fcn.00599e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0059b950
cmp byte [esi + 0x160], 0
jne case.0x5f4a42.4103
cmp byte [esi + 0x81], 0
jl case.0x5f4a42.4103
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x5f4ac3
call fcn.005fadd0
test al, al
je case.0x5f4a42.4103
mov dword [ebp - 4], 0
push 0
mov dword [ebp + 8], 0x7a135c
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_OpenClipboard]
or ebx, 0xffffffff
test eax, eax
je 0x5f4b50
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x5f4b4a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5f4b4a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push dword [ebp - 0x14]
shr eax, 1
lea ecx, [ebp - 0x14]
mov edx, eax
call fcn.0041d620
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 8], ecx
lea ecx, [eax - 8]
cmp ecx, 0x7a1354
je 0x5f4b43
mov eax, ebx
lock xadd dword [ecx], eax
test eax, eax
jne 0x5f4b43
push ecx
call fcn.004a8172
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x5f4b6e
mov eax, dword [esi + 0x88]
lea ecx, [esi + 0x88]
lea edx, [ebp + 8]
push edx
call dword [eax + 0x18]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je case.0x5f4a42.4103
lock xadd dword [eax], ebx
test ebx, ebx
jne case.0x5f4a42.4103
push eax
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00598350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
jmp 0x5f4bbc
push 0
call fcn.0059b780
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5f6480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61991a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x48]
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push ecx
mov eax, dword [eax + 0xc]
call eax
mov esi, dword [ebx + 0x5c]
mov edi, eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
push eax
mov ecx, dword [ecx + 0x30]
call ecx
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp esi, edi
je 0x5f653c
mov ecx, dword [ebx + 0x48]
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x30]
push ecx
mov eax, dword [eax + 0xc]
call eax
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebx - 0x90]
push 3
push eax
call fcn.005f71a0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x30]
call eax
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret 4

Function at 0x5f73d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619a67
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0xd8]
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x20]
push ecx
mov eax, dword [eax + 0xc]
call eax
add esp, 4
mov ecx, esi
push eax
call fcn.005a34a0
mov ebx, eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
push eax
mov ecx, dword [ecx + 0x30]
call ecx
add esp, 4
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x5f74d4
mov ecx, dword [esi + 0x108]
lea eax, [ebp - 0x24]
push eax
add ecx, 0x118
call fcn.0052dda0
or edi, 0xffffffff
mov esi, dword [eax]
mov dword [eax], 0x7a135c
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5f7492
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x5f7492
push ecx
call fcn.004a8172
add esp, 4
cmp esi, dword [ebx]
jne 0x5f749f
mov dword [ebp - 0x24], 0
jmp 0x5f74ad
push dword [ebx]
push esi
call fcn.0041f150
add esp, 8
mov dword [ebp - 0x24], eax
add esi, 0xfffffff8
cmp esi, 0x7a1354
je 0x5f74c9
lock xadd dword [esi], edi
test edi, edi
jne 0x5f74c9
push esi
call fcn.004a8172
add esp, 4
cmp dword [ebp - 0x24], 0
jne 0x5f74d4
mov eax, dword [ebx + 4]
jmp 0x5f74d6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret