joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fa8d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x10
push ebx
push 0
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5faa2d
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x2710
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
je 0x5faa1b
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x5faa11
mov byte [ebp], 0
mov dword [esp + 0xc], 0
push edi
jmp 0x5fa930
mov ecx, dword [ebx + 0xd0]
test ecx, ecx
je 0x5fa9fc
mov eax, dword [ebx + 0xd4]
sub eax, ecx
mov ecx, dword [esp + 0x10]
sar eax, 2
cmp ecx, eax
jae 0x5fa9fc
xor edi, edi
jmp 0x5fa960
mov eax, dword [ebx + 0xd0]
mov ecx, dword [esp + 0x10]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5fa9ea
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x5fa9ea
mov edx, dword [edx]
mov eax, dword [edx + 4]
mov esi, dword [eax + edi*4]
test esi, esi
lea eax, [eax + edi*4]
je 0x5fa9e0
mov al, byte [esi + 4]
test al, al
je 0x5fa9e0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
test eax, eax
je 0x5fa9e0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push eax
call fcn.0062f7d0
push ebp
mov dword [esp + 0x20], eax
call fcn.0062f7d0
mov ecx, dword [esp + 0x20]
add ecx, eax
add esp, 8
cmp ecx, 0x2710
jge 0x5fa9e6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ebp, dword [esp + 0x14]
push eax
push ebp
call fcn.00630970
add esp, 8
inc edi
jmp 0x5fa960
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x10], eax
jmp 0x5fa930
push ebp
call fcn.0062f7d0
add esp, 4
push esi
mov byte [eax + ebp], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x5faa2c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x602cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbe29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], 1
call fcn.0047efd0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x602d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbe29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], al
call fcn.0047efd0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x602f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbe29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 2
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.0047efd0
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0xc], 0x7308ac
jne 0x602ffa
xor edx, edx
jmp 0x603002
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
cmp eax, ebx
je 0x603023
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x603023
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x603035
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.00487c00
mov edx, dword [esi + 4]
cmp edx, ebx
mov dword [esp + 0xc], 0x7308ac
jne 0x603048
xor ecx, ecx
jmp 0x603050
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
cmp edx, ebx
je 0x603071
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x603071
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x603083
mov eax, dword [esi + 8]
lea edx, [esp + 0xc]
push edx
push 1
push eax
mov ecx, esi
call fcn.00487c00
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 3
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x6030a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbe29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.0047efd0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x732158
jne 0x60310a
xor edx, edx
jmp 0x603112
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x603133
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x603133
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x603145
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.00487c00
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x603170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbe29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.0047efd0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x7308ac
jne 0x6031da
xor edx, edx
jmp 0x6031e2
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x603203
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x603203
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x603215
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.00487c00
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x603240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbe29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.0047efd0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x7311ec
jne 0x6032aa
xor edx, edx
jmp 0x6032b2
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x6032d3
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x6032d3
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x6032e5
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.00487c00
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x6058d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbf69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], al
call fcn.0047efd0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x605940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbf69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.0047efd0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x7311ec
jne 0x6059aa
xor edx, edx
jmp 0x6059b2
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x6059d3
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x6059d3
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x6059e5
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.00487c00
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x605a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cbf69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.0047efd0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x7308ac
jne 0x605a7a
xor edx, edx
jmp 0x605a82
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x605aa3
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x605aa3
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x605ab5
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.00487c00
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x606b10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, ecx
test byte [esi + 0xa8], 1
jne 0x606bc6
mov eax, dword [esi + 0x1d4]
cmp eax, dword [esi + 0x1d8]
je 0x606bc6
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x606bc6
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x110]
lea ecx, [eax + eax + 1]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x606bb4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x606bab
mov byte [eax], 0
mov edx, dword [esi + 0x1d4]
mov ecx, dword [esi + 0x1d8]
cmp edx, ecx
push edi
mov edi, edx
jl 0x606b89
mov edi, ecx
jle 0x606b89
mov ecx, edx
sub ecx, edi
test ecx, ecx
jle 0x606ba3
mov edx, dword [esi + 0x104]
push ecx
lea ecx, [edx + edi*2]
push ecx
push eax
call fcn.00579570
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
je 0x606bc5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop esi
ret
Function at 0x609120
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push ebp
mov ebp, ecx
test byte [ebp + 0xa8], 0x10
jne 0x60913d
lea eax, [ebp + 0x1d4]
push eax
call fcn.00606610
test al, al
jne 0x609142
xor al, al
pop ebp
pop ecx
ret
push ebx
push 0
xor bl, bl
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x60922d
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
mov dword [esp + 8], eax
je 0x609227
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x609226
push esi
mov ecx, ebp
call fcn.00608fc0
push 0xfefe
push edi
call fcn.00579260
push edi
call fcn.0062f7d0
lea eax, [eax + eax + 2]
push eax
call fcn.0062e919
push 0xffffffffffffffff
mov esi, eax
push edi
push esi
call fcn.005794f0
add esp, 0x1c
cmp word [esi], 0
mov eax, esi
je 0x6091d3
mov cx, word [eax]
cmp cx, 0xd
je 0x6091ce
cmp cx, 0xa
je 0x6091ce
add eax, 2
cmp word [eax], 0
jne 0x6091b4
jmp 0x6091d3
mov word [eax], 0
mov ecx, dword [ebp + 0x1d4]
push 0xffffffffffffffff
push 0
push esi
push ecx
lea ecx, [ebp + 0x104]
call fcn.00607030
test al, al
je 0x609203
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp + 0x1d4]
push eax
mov ecx, ebp
call fcn.006068a0
mov edx, dword [ebp + 0x1d4]
push esi
mov dword [ebp + 0x1d8], edx
call fcn.00631fc2
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov bl, 1
pop esi
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop ebx
pop ebp
pop ecx
ret

Function at 0x6099f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x609a06
mov ecx, dword [esi + 8]
sub ecx, eax
mov dword [esp + 4], ecx
jne 0x609a0b
xor al, al
pop esi
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x609a38
mov eax, dword [esi + 8]
sub eax, ecx
cmp edi, eax
jae 0x609a38
push 0x12
call ebx
test ax, ax
jl 0x609a31
inc edi
jmp 0x609a15
pop edi
pop ebx
mov al, 1
pop esi
pop ecx
ret
pop edi
pop ebx
xor al, al
pop esi
pop ecx
ret

Function at 0x609a40
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x609a56
mov ecx, dword [esi + 8]
sub ecx, eax
mov dword [esp + 4], ecx
jne 0x609a5b
xor al, al
pop esi
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x609a8b
mov eax, dword [esi + 8]
sub eax, ecx
cmp edi, eax
jae 0x609a8b
movzx edx, byte [ecx + edi]
push edx
call ebx
test ax, ax
jge 0x609a84
inc edi
jmp 0x609a65
pop edi
pop ebx
xor al, al
pop esi
pop ecx
ret
pop edi
pop ebx
mov al, 1
pop esi
pop ecx
ret
Function at 0x60dc80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cc293
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x30]
xor eax, eax
lea edi, [esi + 0x18]
mov dword [esi], 0x6f2588
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], eax
mov dword [esp + 0x18], eax
mov byte [edi + 4], al
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
push ebx
mov byte [esp + 0x1c], 1
mov dword [esi + 0x34], edx
call fcn.0062f7d0
add esp, 4
push eax
push ebx
mov ecx, edi
call fcn.00404c50
mov ecx, dword [0x74e914]
mov edx, dword [esi + 0x34]
mov eax, dword [ecx]
mov edi, dword [esi + 0x2c]
push edx
call dword [eax + 0xb4]
imul eax, edi
mov edx, dword [esi + 0x34]
mov dword [esi + 4], eax
mov ecx, dword [0x74e914]
mov eax, dword [ecx]
push edx
call dword [eax + 0xb0]
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x60e4b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6cc248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, 0xff000000
push 0x20
mov dword [esp + 0x18], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], 0xb4000000
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.0060e010
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], ebx
mov byte [esi + 0x35], bl
mov dword [esi + 0x20], 2
mov byte [esi + 0x34], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x613fa0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x148]
cmp eax, dword [esi + 0x150]
jne 0x613fc6
mov ecx, dword [esi + 0x14c]
cmp ecx, dword [esi + 0x154]
je 0x614122
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x614122
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x124]
lea edx, [eax*4 + 1]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
je 0x614110
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x614106
push ebp
lea eax, [esp + 0x1c]
push eax
mov byte [edi], 0
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x150]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x14c]
push edx
mov edx, dword [esi + 0x148]
push eax
push ecx
push edx
call fcn.006133a0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi + 0x13c]
mov edx, dword [esp + 0x38]
mov ebp, dword [esp + 0x28]
lea ecx, [ecx + ecx*2]
lea ecx, [eax + ecx*4]
mov ecx, dword [ecx]
lea edx, [edx + edx*2]
lea eax, [eax + edx*4]
mov eax, dword [eax]
mov edx, dword [esp + 0x34]
add ecx, ebp
add eax, edx
sub eax, ecx
add esp, 0x18
test eax, eax
jle 0x6140fe
mov edx, dword [esi + 0x118]
push eax
lea eax, [edx + ecx*2]
push eax
push edi
xor esi, esi
call fcn.00579570
mov ebp, eax
mov al, byte [edi]
add esp, 0xc
inc ebp
test al, al
je 0x6140fe
mov al, byte [esi + edi]
test al, al
lea ebx, [esi + edi]
jns 0x6140af
mov al, byte [esi + edi + 1]
test al, al
je 0x6140fa
add esi, 2
jmp 0x6140f4
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.004402c0
add esp, 8
test al, al
je 0x6140f3
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x6140e6
sub ebp, eax
mov edx, ebp
add eax, esi
sub edx, esi
push edx
add eax, edi
push eax
lea eax, [esi + edi + 2]
push eax
call fcn.0062fc50
add esp, 0xc
add ebp, 2
mov byte [esi + edi + 1], 0xa
mov byte [ebx], 0xd
add esi, 2
jmp 0x6140f4
inc esi
cmp byte [esi + edi], 0
jne 0x614098
mov ebx, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebp
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
je 0x614121
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop esi
add esp, 0x14
ret

Function at 0x616620
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
mov edi, ecx
test byte [edi + 0xa8], 0x10
jne 0x616674
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x616674
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x616665
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x616665
push 0
push 0
push eax
mov ecx, edi
call fcn.00615ee0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov ecx, edi
pop edi
jmp fcn.006164e0
pop edi
ret
Function at 0x619430
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6cc668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0x34]
call fcn.005857e0
xor eax, eax
mov byte [esp + 0x2c], al
mov dword [esp + 0x30], eax
sub esp, 0x64
mov edi, esp
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0xe4]
mov ecx, 0x19
lea esi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebx
call fcn.00619250
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], 0xffffffff
call fcn.004231f0
mov ecx, dword [esp + 0x70]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x70
ret 4

Function at 0x619540
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6cc668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
push esi
mov ebp, ecx
push edi
lea ecx, [esp + 0x38]
call fcn.005857e0
xor ebx, ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x10]
push eax
lea ecx, [ebp + 0xcc]
mov dword [esp + 0x80], ebx
call fcn.006194b0
lea ecx, [esp + 0x38]
mov dword [esp + 0x7c], 0xffffffff
call fcn.004231f0
mov esi, dword [ebp + 0xd4]
mov cl, byte [esp + 0x94]
mov edx, dword [esp + 0x98]
sub esi, 0x64
mov byte [esi + 0x20], cl
mov ecx, dword [esp + 0x84]
mov eax, dword [edx]
push ebx
lea edi, [esi + 0x28]
push ecx
mov ecx, edi
mov dword [esi + 0x24], eax
call fcn.00586180
mov edx, dword [esp + 0x88]
push edx
mov ecx, edi
call fcn.0045b570
push ebx
mov ecx, edi
call fcn.00586100
push ebx
mov ecx, edi
mov dword [esp + 0x98], eax
call fcn.005860d0
mov dword [esi + 8], eax
mov eax, dword [esp + 0x94]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x8c]
cmp eax, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
je 0x619624
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
push ebx
mov ecx, edi
call fcn.00586100
push ebx
mov ecx, edi
mov dword [esp + 0x98], eax
call fcn.005860d0
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x94]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x90]
cmp eax, ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
je 0x619670
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x1c], edx
mov eax, dword [esi + 0x18]
cmp eax, dword [ebp + 0x54]
jle 0x61967b
mov dword [ebp + 0x54], eax
mov esi, dword [esi + 0x1c]
cmp esi, dword [ebp + 0x58]
jle 0x619686
mov dword [ebp + 0x58], esi
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret 0x18