joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x40b478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x10], edi
mov eax, dword [ebx + 0x14]
lea edx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
mov ecx, dword [eax]
push edx
push eax
mov dword [esp + 0x3c], edi
call dword [ecx + 0x30]
test eax, eax
jl 0x40a4e8
mov eax, dword [esp + 0x18]
push ebp
lea edx, [esp + 0x18]
push edi
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40a4dd
mov ebp, dword [esp + 0x44]
mov eax, dword [esp + 0x18]
mov ecx, 4
mov edi, 0x40d374
xor edx, edx
lea esi, [eax + 0x2c]
repe cmpsd dword [esi], dword es:[edi]
jne 0x40a4be
mov ecx, dword [eax + 0x44]
cmp dword [ecx + 0x34], ebp
jne 0x40a4b6
mov edx, dword [esp + 0x48]
mov esi, dword [ecx + 0x38]
cmp esi, edx
je 0x40a4d7
push eax
mov ecx, ebx
call fcn.0040a770
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push 0
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40a48c
jmp 0x40a4db
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop ebp
mov eax, dword [ebx + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x40d304
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x40a54e
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x40a51d
mov eax, dword [esp + 0x10]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, ebx
push eax
call fcn.0040a770
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jl 0x40a54e
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax + 0x44]
mov edx, dword [ecx + 0x34]
mov dword [ebx + 0x20], edx
mov ecx, dword [eax + 0x44]
mov edx, dword [ecx + 0x38]
mov ecx, ebx
mov dword [ebx + 0x24], edx
call fcn.0040a770
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebx + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edi
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, edi
mov dword [esp + 0x34], 0xffffffff
je 0x40a585
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x40a630
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40
push ebx
push ebp
mov ebp, ecx
call fcn.0040a7c0
lea eax, [esp + 0xc]
mov ecx, ebp
push eax
call fcn.0040a8d0
mov ecx, dword [esp + 0x4c]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40a676
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret 4
push esi
mov esi, dword [ebp + 0x20]
xor edx, edx
push edi
lea ecx, [esi + esi*2]
mov dword [esp + 0x18], edx
shl ecx, 3
mov dword [esp + 0x1c], edx
mov edi, dword [ebp + 0x24]
lea eax, [ecx + 0x1f]
mov dword [esp + 0x20], edx
and al, 0xe0
mov word [esp + 0x24], dx
cdq
and edx, 7
push 0
add edx, eax
mov eax, ecx
sar edx, 3
mov ecx, edx
mov word [esp + 0x1c], 0x4d42
mov dword [esp + 0x26], 0x36
cdq
and edx, 7
add eax, edx
lea edx, [esi + esi*2]
sar eax, 3
sub ecx, eax
xor eax, eax
add ecx, edx
mov word [esp + 0x22], ax
imul ecx, edi
add ecx, 0x36
lea edi, [esp + 0x2c]
mov dword [esp + 0x1e], ecx
mov ecx, 0xa
mov word [esp + 0x24], ax
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x24]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
push 0xe
mov dword [esp + 0x38], esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
push ebx
mov dword [esp + 0x3c], 0x28
mov word [esp + 0x48], 1
mov word [esp + 0x4a], 0x18
mov dword [esp + 0x4c], 0
call esi
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x30]
push 0x28
push eax
push ebx
call esi
mov edx, dword [ebp + 0x2c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
Function at 0x40a8f0
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40b4a6
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x828
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40a91e
or eax, 0xffffffff
jmp 0x40aad9
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x834], ebx
push eax
push 0x40d334
push 1
push ebx
push 0x40d394
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
je 0x40a96a
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebx
je 0x40a9bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x40aad9
mov dword [esp + 4], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 4]
push ebx
push ecx
mov edx, dword [eax]
push 0x40d384
push eax
mov byte [esp + 0x844], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x40a9c5
mov eax, dword [esp + 4]
mov byte [esp + 0x834], bl
cmp eax, ebx
je 0x40a9a4
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebx
je 0x40a9bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x40aad9
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 4]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x40aaa7
push ebp
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push 0x40d3bc
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x40aa7c
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x28]
push ebx
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40aa72
mov ecx, dword [esp + 0x30]
push ebx
push ebx
lea eax, [esp + 0x40]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call edi
lea edx, [esp + 0x38]
push eax
push edx
push esi
call dword [esp + 0x854]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
inc edx
push eax
mov dword [esp + 0x1c], edx
call ebp
mov eax, dword [esp + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x20]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebx
je 0x40aa03
pop edi
pop esi
pop ebp
mov eax, dword [esp + 4]
mov byte [esp + 0x834], bl
cmp eax, ebx
je 0x40aabc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebx
je 0x40aad5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x82c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x834
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x1003596d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x14]
je 0x1003555a
dec si
btr dx, 0xd
not si
mov esi, dword [eax + 0x3c]
rol dh, cl
dec dh
test ax, 0xec21
add esi, eax
ror dx, cl
jmp 0x1004b8a6

Function at 0x1004f86f
Capabilities:
Check for software breakpoints

Disassembly:
call 0x1004b8f8
cmp si, bp
sub ecx, ebx
bsr si, bp
push ebp
lea esi, [esp + 4]
push dword [esp]
stc
cmp al, dh
sub edi, 4
clc
cmp di, ax
bt cx, 3
clc
push dword [edi]
pop dword [esp + 4]
cmp bh, 0xcc
push 0x8d4b9035
cmp edi, ebx
jmp 0x1004bf72
push esp
lea esp, [esp + 0x20]
jne 0x1003555a
ror cx, cl
bt bx, di
mov ecx, edi
shr esi, 0x1c
jmp 0x1004dbd5
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x20b63f25
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5ade1a98
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x6548a570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6549ab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6549ab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6548a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x655ae054]
test esi, esi
jle 0x6548a6f0
mov eax, dword [0x655ae058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6548a604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6548a687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6548a5f0
mov dword [esp], ebx
call fcn.6548ad30
mov edi, eax
test eax, eax
je 0x6548a717
mov eax, dword [0x655ae058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6548ae70
mov edx, dword [0x655ae058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6548a6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6548a680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6548a690
add dword [0x655ae054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x655ae058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6548a680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6548a570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6548a60e
mov eax, dword [0x655ae058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6548a570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6548a570
lea esi, [esi]
nop
Function at 0x6548a9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x655ae064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x655ae05c]
sub esp, 4
test ebx, ebx
je 0x6548aa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6548a9fe
test esi, esi
je 0x6548a9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6548a9e0
mov dword [esp], 0x655ae064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6548ad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x65480000], 0x5a4d
jne 0x6548ad55
mov ecx, dword [0x6548003c]
cmp dword [ecx + 0x65480000], 0x4550
lea edx, [ecx + 0x65480000]
je 0x6548ad60
ret
cmp word [ecx + 0x65480018], 0x10b
jne 0x6548ad55
push esi
movzx eax, word [ecx + 0x65480014]
push ebx
movzx esi, word [ecx + 0x65480006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x65480000
test esi, esi
je 0x6548ada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6548ad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6548adaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6548ad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6548b320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x655ae060]
test eax, eax
jne 0x6548aa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x6548aa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x655ae064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x655ae05c]
mov dword [0x655ae05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x655ae064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x6548aa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6548b350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x6549ad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x6549ad90
xor eax, eax
ret
jmp 0x6548aa20

Function at 0x6548b390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6548b3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6548b3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x6549add8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x655ae02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6549ae40
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x65568432
mov ecx, eax
call fcn.65526b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9930
jmp 0x6549afb0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6549ae92
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x65568432
mov ecx, eax
call fcn.65526b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9930
jmp 0x6549afb0
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x6549aeed
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x65568432
mov ecx, eax
call fcn.65526b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9930
jmp 0x6549afb0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x6549af45
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x65568432
mov ecx, eax
call fcn.65526b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9930
jmp 0x6549afb0
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9900
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.65526b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.654e9930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.65526a50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.65527640
mov eax, dword [esp + 0x4c]
sub eax, dword [0x655ae02c]
je 0x6549afc1
call fcn.654815c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret
Function at 0x6549f590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x65569e11
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x65569e75]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6548b010
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.6555eae0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6556726c], 0
jne 0x6549f6b6
mov byte [0x6556726c], 1
call fcn.6555cbd0
test eax, eax
je 0x6549f684
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6548a220
mov dword [esp], 2
mov esi, dword [fcn.6549ab80]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6549f674
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6556a555
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6555f360
jmp 0x6555f358
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6549f63a
mov dword [esp], 2
call dword [0x65566178]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x6555f353
mov dword [esp], 2
call dword [0x65566178]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6556a504
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6549a428
call fcn.6555cfa0
call fcn.6555cab0
call fcn.6555cc20
jmp 0x6555f353
Function at 0x654b0bd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, edx
mov byte [esp + 0x10], al
mov eax, dword [0x655ae02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.655584f0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.65526ee0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x14]
je 0x654b0c78
mov eax, dword [esp + 0x18]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp], edx
mov ecx, eax
call fcn.654aa10c
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.654a9ff0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.65527a60
sub esp, 4
add dword [esp + 0x18], 1
jmp 0x654b0c1c
mov dword [esp + 0x2c], str.dwsmaklthrtter
mov dword [esp + 0x24], 0x65572ec0
mov dword [esp + 0x30], 0x65572f38
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x30]
je 0x654b0d80
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.65559074
test al, al
je 0x654b0d76
cmp byte [esp + 0x10], 0
je 0x654b0d41
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.6552b530
sub esp, 8
lea eax, [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], 3
mov ecx, eax
call fcn.6552b530
sub esp, 8
mov eax, dword [esp + 0x34]
add eax, 4
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov ecx, eax
call fcn.654b0a40
sub esp, 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
mov ecx, eax
call fcn.654b0b18
sub esp, 4
test al, al
je 0x654b0d41
mov eax, 1
jmp 0x654b0d46
mov eax, 0
test al, al
je 0x654b0d6d
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 4
mov ecx, eax
call fcn.6552b530
sub esp, 8
mov ebx, dword [esp + 0x40]
jmp 0x654b0da1
mov eax, dword [esp + 0x34]
mov ebx, dword [eax + 4]
jmp 0x654b0da1
add dword [esp + 0x24], 8
jmp 0x654b0c90
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.6552b530
sub esp, 8
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.65527640
mov eax, ebx
mov ebx, dword [esp + 0x5c]
sub ebx, dword [0x655ae02c]
je 0x654b0dbf
call fcn.654815c0
add esp, 0x68
pop ebx
ret 0xc