joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b8a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x631310
push fcn.0057df90
push 0
push edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.0057e120
test eax, eax
jns 0x53b8ee
or esi, 0xffffffff
jmp 0x53b91b
mov esi, dword [esp + 0x18]
jle 0x53b906
cmp esi, dword [esp + 0x1c]
jae 0x53b901
mov byte [esi], 0xa
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, dword [esp + 0x1c]
jae 0x53b913
mov byte [esi], 0
mov esi, dword [esp + 0x18]
test esi, esi
je 0x53ba31
push esi
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x53ba31
mov ecx, dword ds:[ebp + 0xc]
mov edx, ebx
push edi
push esi
call fcn.0057bd00
mov dword [esp + 0x14], eax
test eax, eax
jne 0x53b957
mov edi, 0xc0000001
jmp 0x53ba13
mov esi, dword [ebp + 8]
mov ecx, esi
cdq
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
call fcn.0051ce40
mov edi, eax
test edi, edi
js 0x53ba13
mov edx, 0x6310f0
mov ecx, esi
lfence
call fcn.004f7dc0
push ecx
push 0x60
push 5
push 0
push ecx
mov esi, eax
lea ecx, [esp + 0x24]
lea eax, [esp + 0x34]
mov edx, esi
push eax
push 0
push 0x130116
call fcn.0051bd00
mov edi, eax
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x53b9be
lfence
call fcn.004fe0c0
mov esi, dword [esp + 0x10]
test edi, edi
js 0x53ba08
push 0
push 0
push dword [esp + 0x1c]
lea eax, [esp + 0x34]
push ebx
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov edi, eax
test edi, edi
js 0x53ba08
lea eax, [esp + 0x18]
push eax
push esi
lfence
call dword [sym.imp.ntdll.dll_NtFlushBuffersFile]
push dword [ebp + 8]
push ecx
mov ecx, esi
call fcn.00517600
mov edi, eax
test esi, esi
je 0x53ba13
push esi
call dword [sym.imp.ntdll.dll_NtClose]
push ebx
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0xc0000001
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x53bea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x627610
push 0x5850a0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x62d040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [edi + 4], edx
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
cmp eax, 0x40
jae 0x53befe
mov eax, 0xc000001f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
nop
test edx, edx
je 0x53c098
cmp edx, 0xffffffff
je 0x53c098
mov dword ds:[ebp - 4], 0
lea esi, [edx + 0x40]
cmp esi, edx
jb 0x53c012
lea ecx, [edx + eax]
mov dword [ebp - 0x1c], ecx
cmp esi, ecx
ja 0x53c012
mov dword [ebp - 4], 0xfffffffe
mov ecx, 0x5a4d
cmp word [edx], cx
je 0x53bf63
mov eax, 0xc000012f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lfence
mov ecx, dword [edx + 0x3c]
cmp ecx, eax
jae 0x53c04e
cmp ecx, 0x10000000
jae 0x53c04e
lea esi, [ecx + edx]
mov dword [ebp - 4], 1
lea ebx, [esi + 0x18]
cmp ebx, esi
jb 0x53c012
cmp esi, edx
jb 0x53c012
mov edx, dword [ebp - 0x1c]
cmp ebx, edx
ja 0x53c012
movzx eax, word [esi + 6]
lea ecx, [eax + eax*4]
movzx eax, word [esi + 0x14]
lea eax, [eax + ecx*8]
add eax, 0x18
add eax, esi
cmp eax, esi
jb 0x53c012
cmp eax, edx
ja 0x53c012
mov dword [ebp - 4], 0xfffffffe
cmp dword [esi], 0x4550
jne 0x53c04e
movzx eax, word [ebx]
mov word [edi + 0x18], ax
mov ecx, 0x10b
cmp ax, cx
je 0x53bfe6
mov ecx, 0x20b
cmp ax, cx
jne 0x53c04e
mov dword [edi + 0xc], esi
movzx eax, word [esi + 6]
mov dword [edi + 0x10], eax
movzx eax, word [esi + 0x14]
add eax, 0x18
add eax, esi
mov dword [edi + 0x14], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xc0000005
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, 1
ret
mov eax, 0xc000007b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0xc000000d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53c1e0
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor bl, bl
push edi
test esi, esi
jne 0x53c23a
test eax, eax
jne 0x53c20a
mov eax, 0xc0000030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x60
push 1
push 5
push 0x80
push 0x100081
push eax
lea eax, [ebp + 0xc]
push eax
call sym.SystemInformer.exe_Ordinal_1467
test eax, eax
jns 0x53c235
lfence
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0xc]
mov bl, 1
push esi
push 0x8000000
push 2
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], 0x18
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x34], 0
push eax
push 5
lea eax, [esp + 0x24]
mov dword [esp + 0x44], 0x20
push eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x34], 0x1000
mov dword [esp + 0x38], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test bl, bl
je 0x53c2a6
push esi
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
jns 0x53c2b8
lfence
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 2
push 0
push 2
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1000
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x53c308
lfence
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, dword [ebp + 0x10]
call fcn.0053bea0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x53c380
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 8]
push esi
mov esi, edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], eax
mov byte [esp + 0xb], 0
push edi
test esi, esi
jne 0x53c414
test ecx, ecx
jne 0x53c3cf
mov eax, 0xc0000030
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
push 0
push 0x60
push 1
push 5
push 0x80
push 0
push 0x100081
push ecx
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1469
test eax, eax
jns 0x53c40b
lfence
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x24]
mov byte [esp + 0xf], 1
push 5
push 0x18
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test edi, edi
js 0x53c50a
movq xmm0, qword [esp + 0x60]
lea eax, [esp + 0x18]
movaps xmm1, xmmword [esp + 0x50]
push esi
push 0x8000000
push 2
push eax
lea eax, [esp + 0x48]
movq qword [esp + 0x70], xmm0
push eax
movaps xmm0, xmm1
mov dword [esp + 0x4c], 0x18
push 5
lea eax, [esp + 0x28]
psrldq xmm0, 8
psrldq xmm1, 0xc
push eax
movd dword [esp + 0x34], xmm0
movd dword [esp + 0x38], xmm1
mov dword [esp + 0x58], 0
mov dword [esp + 0x60], 0x20
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x53c50a
mov eax, dword ds:[esp + 0x18]
push 2
push 0
push 2
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword [esp + 0x10]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x53c50a
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
cmp byte [esp + 0xf], 0
je 0x53c518
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x7c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
Function at 0x53c540
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 8]
push esi
mov esi, edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], eax
mov byte [esp + 0xb], 0
push edi
test esi, esi
jne 0x53c5cd
test ecx, ecx
jne 0x53c58f
mov eax, 0xc0000030
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
push 0x60
push 1
push 5
push 0x80
push 0x100081
push ecx
lea eax, [esp + 0x3c]
push eax
call sym.SystemInformer.exe_Ordinal_1467
test eax, eax
jns 0x53c5c4
lfence
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x24]
mov byte [esp + 0xf], 1
push 5
push 0x18
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test edi, edi
js 0x53c6ca
movq xmm0, qword [esp + 0x60]
lea eax, [esp + 0x18]
movaps xmm1, xmmword [esp + 0x50]
push esi
push 0x8000000
push 2
push eax
lea eax, [esp + 0x48]
movq qword [esp + 0x70], xmm0
push eax
movaps xmm0, xmm1
mov dword [esp + 0x4c], 0x18
push 5
lea eax, [esp + 0x28]
psrldq xmm0, 8
psrldq xmm1, 0xc
push eax
movd dword [esp + 0x34], xmm0
movd dword [esp + 0x38], xmm1
mov dword [esp + 0x58], 0
mov dword [esp + 0x60], 0x20
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x53c6ca
mov eax, dword ds:[esp + 0x18]
push 2
push 0
push 2
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword [esp + 0x10]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x53c6ca
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
cmp byte [esp + 0xf], 0
je 0x53c6d8
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x7c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
Function at 0x53c9c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov dword [esp], ecx
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, edx
mov dword [ebx + 4], esi
mov dword [ebx + 8], eax
cmp eax, 0x1000
jae 0x53c9e8
pop esi
mov eax, 0xc0000017
pop ebx
pop ecx
ret 0xc
test esi, esi
je 0x53cb70
cmp esi, 0xffffffff
je 0x53cb70
push ebp
push edi
push 0x1000
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x1000
mov edi, eax
push 0
push edi
call fcn.005861b0
mov ebp, dword [esp + 0x28]
add esp, 0xc
push 0
push 0x1000
push edi
push esi
push dword [esp + 0x20]
test ebp, ebp
je 0x53ca42
mov ecx, ebp
call dword [0x5a9914]
call ebp
nop
jmp 0x53ca48
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov esi, eax
lfence
test esi, esi
js 0x53cb66
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x53cb4d
mov ebp, dword [edi + 0x3c]
test ebp, ebp
je 0x53cb4d
cmp ebp, dword [esp + 0x18]
jae 0x53cb4d
nop
cmp ebp, 0x10000000
jae 0x53cb4d
lea eax, [ebp + 0xf8]
cmp eax, 0x1000
jb 0x53caa5
mov esi, 0xc0000017
jmp 0x53cb52
cmp dword [edi + ebp], 0x4550
lea edx, [edi + ebp]
je 0x53cabb
mov esi, 0xc000007b
jmp 0x53cb52
movzx eax, word [edx + 0x14]
mov ecx, 0xe0
cmp ax, cx
je 0x53cada
mov ecx, 0xf0
cmp ax, cx
je 0x53cada
mov esi, 0xc0000903
jmp 0x53cb52
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
mov word [ebx + 0x18], ax
cmp ax, cx
je 0x53caf6
mov ecx, 0x20b
cmp ax, cx
jne 0x53cab1
movzx eax, word ds:[edx + 6]
mov dword [ebx + 0x10], eax
cmp eax, 0x7f
jae 0x53cab1
lea ecx, ds:[eax + eax*4]
movzx eax, word [edx + 0x14]
add eax, ebp
lea eax, [eax + ecx*8]
add eax, 0x110
cmp eax, 0x1000
jae 0x53ca99
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov dword [ebx + 0xc], edx
movzx eax, word [edx + 0x14]
add eax, 0x18
mov dword [ebx + 0x1c], edi
add eax, edx
mov dword [ebx + 0x14], eax
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
pop ecx
ret 0xc
mov esi, 0xc000012f
push edi
push 0
lfence
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
pop ecx
ret 0xc
pop esi
mov eax, 0xc000000d
pop ebx
pop ecx
ret 0xc
Function at 0x53cb80
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x148
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [esp + 0x160]
mov ebp, ecx
push edi
push esi
push ebx
push dword [esp + 0x164]
mov edi, edx
call fcn.0053c9c0
nop dword [eax + eax]
test eax, eax
jns 0x53cdc7
cmp eax, 0xc0000017
jne 0x53cdc7
mov eax, dword [esp + 0x15c]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
cmp eax, 0x40
jb 0x53cdc2
test edi, edi
je 0x53cdb9
cmp edi, 0xffffffff
je 0x53cdb9
lea eax, [esp + 0x18]
push 0
push 0x40
push eax
push edi
lfence
push ebp
test ebx, ebx
je 0x53cc18
mov ecx, ebx
call dword [0x5a9914]
call ebx
jmp 0x53cc1e
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
nop
test eax, eax
jns 0x53cc2c
lfence
jmp 0x53cdc7
mov eax, 0x5a4d
cmp word [esp + 0x18], ax
je 0x53cc45
mov eax, 0xc000012f
jmp 0x53cdc7
mov eax, dword [esp + 0x54]
test eax, eax
je 0x53cdc2
cmp eax, dword [esp + 0x15c]
jae 0x53cdc2
nop
cmp eax, 0x10000000
jae 0x53cdc2
push 0
push 0xf8
add eax, edi
lea ecx, [esp + 0x60]
mov dword [esp + 0x18], eax
push ecx
push eax
lfence
push ebp
test ebx, ebx
je 0x53cc92
mov ecx, ebx
call dword [0x5a9914]
call ebx
jmp 0x53cc98
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x53cc24
cmp dword [esp + 0x58], 0x4550
jne 0x53cdc2
mov dx, word [esp + 0x6c]
mov eax, 0xe0
cmp dx, ax
je 0x53cccf
mov eax, 0xf0
cmp dx, ax
je 0x53cccf
mov eax, 0xc0000903
jmp 0x53cdc7
mov ax, word ds:[esp + 0x70]
mov ecx, 0x10b
mov word [esi + 0x18], ax
cmp ax, cx
je 0x53ccf3
mov ecx, 0x20b
cmp ax, cx
jne 0x53cdc2
movzx eax, word ds:[esp + 0x5e]
mov dword [esi + 0x10], eax
cmp eax, 0x7f
jae 0x53cdc2
lea edi, ds:[eax + eax*4]
movzx eax, dx
lea edi, [edi + 3]
lea edi, [eax + edi*8]
cmp edi, 0x100000
ja 0x53cdc2
push edi
push 4
lfence
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edi
push 0
push eax
mov dword [esp + 0x20], eax
call fcn.005861b0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov dword [esi + 0xc], eax
lfence
push 0
push edi
test ebx, ebx
je 0x53cd73
push dword [esi + 0xc]
mov ecx, ebx
push dword [esp + 0x1c]
push ebp
call dword [0x5a9914]
call ebx
jmp 0x53cd7f
push eax
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov edi, eax
lfence
test edi, edi
jns 0x53cda4
push dword [esi + 0xc]
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0xc], 0
mov eax, edi
jmp 0x53cdc7
mov ecx, dword [esi + 0xc]
mov dword [esi], ebp
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
jmp 0x53cdc7
mov eax, 0xc000000d
jmp 0x53cdc7
mov eax, 0xc000007b
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x148
ret 0xc
Function at 0x542700
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 8
push ebx
push ecx
mov ebx, edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5428ea
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x1c]
cmp ecx, esi
jle 0x542734
mov eax, esi
mov dword [ebx + 0x1c], ecx
mov esi, ecx
mov dword [ebx + 0x18], eax
mov ecx, eax
sub esi, ecx
cmp dword [ebx + 0x14], 1
push esi
push 0x42
je 0x54280c
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x5428dd
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebx + 0x18]
add ecx, dword [ebx]
push esi
push ecx
push eax
call fcn.00586310
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esi + esi*2]
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je 0x542806
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor edi, edi
mov edx, eax
test esi, esi
je 0x5427ed
lea ebp, [edi + 0x20]
nop word [eax + eax]
mov ecx, dword [ebx + 0x18]
add ecx, dword [ebx]
movzx eax, byte [ecx + edi]
shr eax, 4
movsx eax, byte [eax + 0x61f460]
mov word [edx], ax
mov eax, dword [ebx + 0x18]
add eax, dword [ebx]
movzx eax, byte [eax + edi]
inc edi
and eax, 0xf
movsx eax, byte [eax + 0x61f460]
mov word [edx + 2], ax
mov word [edx + 4], bp
add edx, 6
cmp edi, esi
jb 0x5427b0
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
xor eax, eax
push esi
mov word [edx], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebp
jmp 0x5428cb
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, ds:[esi + 1]
mov edi, eax
push ecx
push 0x42
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test edi, edi
je 0x5428dd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword ds:[ebx + 0x18]
add ecx, dword [ebx]
push esi
push ecx
push eax
call fcn.00586310
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebp, ebp
je 0x5428ca
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebx + 0x18]
mov edi, eax
add ecx, dword [ebx]
push esi
push ecx
push edi
call fcn.00586310
add esp, 0xc
test esi, esi
je 0x5428ad
mov ecx, 0x5e
cmp byte ds:[ebx + 0x28], 0
mov al, byte [edi]
movzx eax, al
jge 0x542897
push 0x117
push eax
call fcn.0058e79b
add esp, 8
mov ecx, 0x5e
jmp 0x54289f
sub eax, 0x20
cmp ecx, eax
sbb eax, eax
inc eax
nop
test eax, eax
jne 0x5428a7
mov byte [edi], 0x2e
inc edi
sub esi, 1
jne 0x542875
push ebp
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, dword [esp + 0x14]
push edi
push str.BinaryData
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
add esp, 8
ret
Function at 0x542900
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, edx
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x542a36
push str.BinaryData
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
jne 0x542948
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
je 0x542a29
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [edi + 0x18]
mov ebx, eax
mov edx, dword [edi + 0x1c]
mov esi, ecx
mov eax, dword [edi + 0x10]
mov dword [esp + 0x18], eax
cmp ecx, edx
jle 0x542979
mov esi, edx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], esi
mov edx, ecx
test byte [edi + 0x28], 0x10
je 0x5429d6
nop
cmp esi, 0xffffffff
jne 0x5429a7
cmp dword [edi + 0x14], 3
mov esi, eax
jne 0x542993
lea esi, [eax + 1]
mov dword [edi + 0x10], esi
mov ecx, dword ds:[esp + 0x10]
mov edx, edi
push ebx
push esi
call fcn.00542b20
jmp 0x5429f3
mov ecx, dword [esp + 0x10]
push edx
push esi
mov edx, edi
call fcn.00542a40
mov ecx, dword ds:[esp + 0x10]
mov edx, edi
push ebx
push esi
call fcn.00542b20
mov ecx, dword [esp + 0x10]
mov edx, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00542580
jmp 0x5429f3
cmp esi, 0xffffffff
jne 0x5429e9
cmp dword [edi + 0x14], 3
mov esi, eax
jne 0x5429e9
lea esi, [eax + 1]
mov dword [edi + 0x10], esi
mov eax, dword [edi + 4]
sub eax, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword ds:[edi]
push ebx
push dword [esp + 0x18]
add eax, esi
push eax
call fcn.00586310
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x18]
push 0x105
push 0
push 0
push dword [esp + 0x1c]
mov dword [edi + 0x10], eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x546400
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x60
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
push 0
lea eax, [esp + 0x14]
mov edi, ecx
push eax
push edi
mov esi, edx
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x5465d1
mov eax, dword ds:[esp + 0x1c]
or eax, dword [esp + 0x14]
or eax, dword [esp + 0x18]
or eax, dword [esp + 0x10]
je 0x5465d1
cmp dword [esi + 0x1c4], 0
jg 0x5464ad
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov eax, dword [esi + 0x1c8]
test eax, eax
jne 0x54647b
mov dword [esi + 0x1c8], ebx
jmp 0x54648d
push 2
push ebx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
nop dword [eax]
test eax, eax
je 0x5465d1
jmp 0x5465c5
test dword [esi + 0x20], 0x200000
je 0x54654c
cmp dword [esi + 0x184], 0
jne 0x54654c
push dword [esi]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x54654c
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0x184], eax
test eax, eax
je 0x54654c
movups xmm0, xmmword [esi + 0x38]
movups xmmword [esi + 0x190], xmm0
mov eax, dword [esi + 0x198]
push dword [esi + 0x19c]
inc eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x18c], eax
test eax, eax
jne 0x546528
push dword [esi + 0x184]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0x184], 0
jmp 0x54654c
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword ds:[esi + 0x18c]
push dword [esi + 0x184]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x188], eax
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov ebx, eax
test ebx, ebx
je 0x5465d1
movups xmm0, xmmword [esp + 0x28]
mov eax, dword [esi + 0x184]
mov edx, esi
movups xmmword [esp + 0x10], xmm0
test eax, eax
je 0x5465b3
lea ecx, ds:[esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.0054bba0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
push 0xcc0020
push edx
push ecx
push dword [esi + 0x184]
sub eax, edx
push eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x5465c5
lea eax, ds:[esp + 0x10]
mov ecx, edi
push eax
push ebx
call fcn.0054bba0
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x60
ret