joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5198f0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
pushal
mov esi, eax
mov edx, ebx
mov bx, cx
mov eax, esi
call fcn.00519c80
mov dword [esi + 4], 0x56f3ac
mov dword [esi + 0x1e], edx
movzx eax, bx
and eax, 0x800
cmp eax, 0
je 0x519950
push 0x32
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 0xc], eax
push 0x31
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 8], eax
push 0x4001
push 0x160
lea eax, [esp + 0x28]
push eax
push 0
push 0x56941c
call sub.SHELL32.dll_SHGetFileInfoA
mov dword [esi + 0x22], eax
jmp 0x519982
push 0xc
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 0xc], eax
push 0xb
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 8], eax
push 0x4000
push 0x160
lea eax, [esp + 0x28]
push eax
push 0
push 0x569420
call sub.SHELL32.dll_SHGetFileInfoA
mov dword [esi + 0x22], eax
popal
add esp, 0x160
ret

Function at 0x51998c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x20
push ebx
push ecx
push edx
push esi
push edi
mov dword [esp + 0x20], eax
mov eax, ebx
mov dword [esp + 0x2c], eax
mov word [esp + 0x1e], dx
mov edi, 0
mov dword [esp + 0x30], 0
cmp ecx, 0
pushfd
movzx ebx, dx
and ebx, 0x100
mov dword [esp + 0x2c], ebx
popfd
je 0x519a32
mov ebx, str.IMAGE
call fcn.0053426c
mov ebx, eax
cmp ebx, 0
je 0x519a32
push ebx
push dword [0x78d998]
call sub.KERNEL32.dll_LoadResource
mov dword [esp + 0x24], eax
push eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
push ebx
push dword [0x78d998]
call sub.KERNEL32.dll_SizeofResource
mov esi, eax
mov eax, dword [esp + 0x20]
mov ebx, edi
mov ecx, esi
mov dx, word [esp + 0x1e]
call dword [esp + 0x38]
mov edi, eax
cmp edi, 0
jne 0x519a1e
push dword [esp + 0x24]
call sub.KERNEL32.dll_FreeResource
jmp 0x519a32
cmp dword [esp + 0x28], 0
jne 0x519a13
mov eax, dword [esp + 0x24]
mov dword [edi + 0x10], eax
or word [edi + 0x1c], 0x400
cmp edi, 0
jne 0x519ad4
push 0
push dword [esp + 0x30]
call sub.KERNEL32.dll__lopen
mov dword [esp + 0x1a], eax
cmp eax, 0xffffffff
je 0x519ad4
mov edi, dword [esp + 0x1a]
mov eax, edi
lea ebx, [esp + 0x30]
call fcn.0053d7a8
push 2
push 0
push edi
call sub.KERNEL32.dll__llseek
mov esi, eax
push esi
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov dword [esp + 0x16], eax
push eax
call sub.KERNEL32.dll_GlobalLock
mov ebx, eax
push 0
push 0
push edi
call sub.KERNEL32.dll__llseek
mov eax, esi
push eax
push ebx
push edi
call sub.KERNEL32.dll__hread
push edi
call sub.KERNEL32.dll__lclose
mov eax, dword [esp + 0x20]
mov ecx, esi
mov dx, word [esp + 0x1e]
call dword [esp + 0x38]
mov edi, eax
mov ebx, dword [esp + 0x16]
push ebx
call sub.KERNEL32.dll_GlobalUnlock
cmp edi, 0
jne 0x519ac4
push ebx
call sub.KERNEL32.dll_GlobalFree
jmp 0x519ad4
cmp dword [esp + 0x28], 0
jne 0x519abc
mov dword [edi + 0x10], ebx
and word [edi + 0x1c], 0xfbff
cmp edi, 0
je 0x519ae6
mov eax, edi
mov ebx, esi
mov ecx, dword [esp + 0x30]
call fcn.00519c68
mov eax, edi
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x20
ret 4
Function at 0x51b228
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
push ecx
push edx
push esi
push edi
mov esi, eax
lea edi, [esp + 0x12]
push edi
call sub.USER32.dll_GetKeyboardState
push 0
lea eax, [esp + 0x116]
push eax
push edi
push ebx
push esi
call sub.USER32.dll_ToAscii
cmp eax, 0
jne 0x51b25f
mov word [esp + 0x112], 0
mov al, byte [esp + 0x112]
pop edi
pop esi
pop edx
pop ecx
add esp, 0x104
ret

Function at 0x51b274
Capabilities:
Log keystrokes via polling

Disassembly:
pushal
mov edi, eax
mov esi, ebx
push 0x14
call sub.USER32.dll_GetKeyState
mov bl, al
and bl, 1
xor bl, byte [0x569460]
dec esi
mov eax, esi
inc eax
cmp eax, 0
je 0x51b2df
inc edi
movsx eax, byte [edi - 1]
push eax
call sub.USER32.dll_VkKeyScanA
movsx eax, ax
movzx ecx, al
movzx eax, ax
shr eax, 8
mov bh, al
and bh, 0xff
and bh, 1
mov eax, ecx
call fcn.00429be4
cmp eax, 0
je 0x51b2c1
xor bh, bl
cmp bh, 0
je 0x51b2cc
or ecx, 0x100
mov eax, ecx
call fcn.0051b720
mov eax, 0
call fcn.0051b720
jmp 0x51b28b
call fcn.0051b2e8
popal
ret
Function at 0x5218dc
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x34
push ebx
push ecx
push edx
push esi
push edi
mov edi, eax
mov esi, ebx
call sub.USER32.dll_GetCapture
cmp eax, 0
je 0x5218fc
mov eax, 0
jmp 0x521ac8
cmp dword [0x567800], 0
je 0x521a52
mov eax, 0
jmp 0x521ac8
mov eax, dword [esp + 0x30]
cmp eax, 0x202
jne 0x52192f
mov eax, edi
call fcn.005211f0
mov eax, 1
jmp 0x521ac8
cmp eax, 0x200
jne 0x521980
mov eax, 4
mov ebx, dword [esp + eax + 0x40]
mov dword [esp + eax + 0x24], ebx
sub eax, 4
jae 0x52193b
lea eax, [esp + 0x1c]
lea edx, [esp + 0x24]
mov ebx, 4
mov ecx, dword [edx + ebx]
mov dword [eax + ebx], ecx
sub ebx, 4
jae 0x521955
sub esp, 8
mov eax, 4
mov ebx, dword [esp + eax + 0x24]
mov dword [esp + eax], ebx
sub eax, 4
jae 0x521968
mov eax, edi
call fcn.00521ca8
jmp 0x521a72
cmp eax, 0x101
jne 0x52199c
mov eax, edi
mov ebx, dword [esp + 0x34]
mov ecx, 0
call fcn.005212ac
jmp 0x521a72
cmp eax, 0x100
jne 0x5219cf
mov eax, edi
mov ebx, dword [esp + 0x34]
mov ecx, 1
call fcn.005212ac
cmp dword [esp + 0x34], 0x1b
jne 0x521a72
mov eax, edi
call fcn.005211b4
mov eax, 0
jmp 0x521ac8
cmp eax, 0x204
je 0x5219db
cmp eax, 0x1f
jne 0x5219ec
mov eax, edi
call fcn.005211b4
mov eax, 0
jmp 0x521ac8
push ebx
call sub.USER32.dll_DispatchMessageA
jmp 0x521a72
push 0x17
call sub.USER32.dll_GetSystemMetrics
cmp eax, 0
je 0x521a11
mov eax, 2
jmp 0x521a16
and eax, 1
cmp eax, 0
jne 0x521a24
jmp 0x521a3c
mov eax, 1
push eax
call sub.USER32.dll_GetAsyncKeyState
movsx eax, ax
cmp eax, 0
jl 0x521a35
mov eax, edi
call fcn.005211b4
mov eax, 0
jmp 0x521ac8
cmp dword [esp + 0x14], 0
je 0x521a07
mov dword [esp + 0x14], 0
push 0
push 0
push 0
push esi
call sub.USER32.dll_PostMessageA
jmp 0x521a72
push esi
call sub.USER32.dll_SetCapture
mov dword [0x567800], esi
mov eax, dword [0x56b97c]
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 1
call sub.USER32.dll_GetCapture
cmp eax, esi
jne 0x521abc
push 0xff
push 0x32
push 0
lea eax, [esp + 0x24]
push eax
push 1
call sub.USER32.dll_MsgWaitForMultipleObjects
cmp eax, 1
jne 0x5219f4
push 0
push 0
push 0
lea ebx, [esp + 0x38]
push ebx
call sub.USER32.dll_GetMessageA
cmp eax, 0
jne 0x521913
mov eax, dword [esp + 0x34]
push eax
call sub.USER32.dll_PostQuitMessage
mov eax, edi
call fcn.005211b4
mov eax, 0
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x34
ret
Function at 0x524a38
Capabilities:
Hide graphical window

Disassembly:
pushal
mov edx, eax
mov eax, edx
call fcn.0051fa64
mov ebx, eax
lea esi, [edx + 0x45]
mov eax, esi
mov ecx, 1
call fcn.004c39d8
mov eax, ebx
dec eax
mov ecx, esi
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax*4]
jmp 0x524a71
mov ecx, ebx
mov eax, esi
mov eax, dword [eax + 4]
lea eax, [eax + ecx*4]
cmp dword [eax], 0
je 0x524aae
jmp 0x524aba
cmp dword [eax], 0
je 0x524a60
jmp 0x524aba
mov eax, edx
mov ebx, dword [eax]
call dword [ebx + 0xa8]
cmp eax, 0
je 0x524a89
jmp 0x524ac9
mov ecx, 0
mov ebx, 0x2000
mov eax, esi
mov eax, dword [eax + 4]
call fcn.005213e8
mov eax, 0
push eax
mov eax, dword [esi + 4]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x524ad5
mov eax, esi
mov ecx, 1
call fcn.004c39d8
mov eax, edx
call fcn.0051fd34
mov esi, eax
cmp dword [edx + 0x41], 0
jne 0x524a78
mov eax, esi
mov ebx, 1
call fcn.00520554
popal
ret
Function at 0x5316dc
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
pushal
mov dword [esp + 0x24], ebx
mov ebx, eax
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0x24]
cmp esi, 0
je 0x53172d
push 0
push 0
push 0xe
push esi
call sub.USER32.dll_SendMessageA
mov edi, eax
cmp edi, 0
je 0x53172d
mov eax, ebx
mov ebx, dword [eax + 4]
mov ecx, edi
add ebx, ecx
call fcn.00531998
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx]
add eax, dword [ebx + 4]
push eax
mov eax, edi
inc eax
push eax
push 0xd
push esi
call sub.USER32.dll_SendMessageA
add dword [ebx + 4], edi
popal
add esp, 8
ret

Function at 0x532074
Capabilities:
Get common file path

Disassembly:
sub esp, 8
pushal
mov esi, eax
mov eax, esi
mov ebx, 0
mov cl, 0
mov edx, 0
call fcn.00528d04
mov ebx, esi
add ebx, 0x17
mov eax, ebx
mov dword [eax], 0
mov dword [esi + 4], 0x56f4c4
lea eax, [esi + 0x2b]
mov dword [eax], 0
mov dword [esi + 0x1b], 0
mov dword [esi + 0x1f], 0
mov dword [esi + 0x37], 0
mov dword [esi + 0x23], 0
mov dword [esi + 0x27], 0
mov dword [esi + 0x2f], 0x1f4
mov dword [esi + 0x33], 0x1388
mov dword [esi + 0x3b], 0x1388
mov dword [esi + 0x3f], 0
mov dword [esi + 0x43], 1
mov dword [esi + 0x47], 0
mov word [esi + 0x5b], 2
mov dword [esi + 0x4b], 0
mov dword [esi + 0x4f], 1
mov dword [esi + 0x53], 0
mov dword [esi + 0x57], 0
mov dword [esi + 0x9d], 0
mov dword [esi + 0xa1], 0
mov dword [esi + 0xa5], 0
push 0
push 0
call sub.KERNEL32.dll_GetTempPathA
inc eax
mov dword [esp + 0x20], eax
mov edi, 0
cmp edi, 2
jge 0x532170
mov ecx, dword [esp + 0x20]
mov eax, ecx
call fcn.004b3d54
mov edx, edi
mov dword [esi + edx*4 + 0x5d], eax
mov eax, edi
mov eax, dword [esi + eax*4 + 0x5d]
push eax
push ecx
call sub.KERNEL32.dll_GetTempPathA
inc edi
jmp 0x53214a
mov dword [esi + 0xa9], 0
mov dword [esi + 0xad], 0
call fcn.0042a068
cmp esi, 0
jne 0x532192
mov eax, esi
jmp 0x532194
mov eax, ebx
push 0
movzx ebx, byte [0x569324]
push ebx
mov ebx, 0x56a89c
mov ecx, 8
mov edx, 0
call fcn.00517be0
push 0
call sub.USER32.dll_GetDC
mov edi, eax
push 0x5a
push edi
call sub.GDI32.dll_GetDeviceCaps
push 0x48
push eax
push 8
call sub.KERNEL32.dll_MulDiv
mov ebx, eax
neg ebx
mov dword [esp + 0x24], ebx
push 0x17
call sub.USER32.dll_GetSysColor
mov edx, eax
push 0
push 1
push 0
mov eax, edi
mov ecx, ebx
mov ebx, 0x56a8a4
call fcn.005180b8
mov dword [esi + 0xa9], eax
push 0
push 1
push 0
mov eax, edi
mov ecx, dword [esp + 0x30]
mov ebx, str.Helv
mov edx, 0xffffffff
call fcn.005180b8
mov dword [esi + 0xad], eax
push edi
push 0
call sub.USER32.dll_ReleaseDC
popal
add esp, 8
ret
Function at 0x532c70
Capabilities:
Create thread
Get keyboard layout
Resume thread

Disassembly:
sub esp, 0x10
push ebx
push ecx
push edx
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov esi, 1
mov eax, esi
imul ebx, eax, 0x42
mov dword [esp + 0x14], ebx
cmp dword [ebx + 0x56a8b4], 0
je 0x532cad
cmp esi, 0x3f
jne 0x532caa
mov eax, 0xffffffff
jmp 0x532ddd
inc esi
jmp 0x532c89
push 0
call sub.USER32.dll_GetKeyboardLayout
mov edi, eax
lea eax, [ebx + 0x56a8b4]
push eax
push 4
mov eax, esi
push eax
push 0x532de8
push dword [esp + 0x28]
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebx + 0x56a8b8], eax
cmp dword [ebx + 0x56a8b8], 0
jne 0x532ceb
mov eax, 0xffffffff
jmp 0x532ddd
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x56a8bc], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x56a8c0], eax
mov eax, dword [0x56b97c]
mov eax, dword [eax + 0x18]
call fcn.004f5ef0
mov dword [ebx + 0x56a8cc], eax
mov dword [ebx + 0x56a8c8], 0
mov dword [ebx + 0x56a8ea], 0
mov dword [ebx + 0x56a8c4], 0
mov dword [ebx + 0x56a8d6], 0
mov dword [ebx + 0x56a8da], 0
mov dword [ebx + 0x56a8de], 0
mov dword [ebx + 0x56a8e2], 0
mov dword [ebx + 0x56a8d0], 0
mov byte [ebx + 0x56a8d4], 0
mov byte [ebx + 0x56a8d5], 0
mov dword [ebx + 0x56a8e6], 0
push 0
push 1
push 0
push 0
call sub.KERNEL32.dll_CreateSemaphoreA
mov dword [ebx + 0x56a8ee], eax
mov eax, esi
mov ebx, 1
call fcn.0051a338
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x56a8b8]
push eax
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov eax, dword [ebx + 0x56a8ee]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [ebx + 0x56a8ee]
push eax
call sub.KERNEL32.dll_CloseHandle
push edi
mov eax, esi
push eax
push 0x2414
mov eax, dword [ebx + 0x56a8b4]
push eax
call sub.USER32.dll_PostThreadMessageA
cmp eax, 0
mov eax, esi
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x10
ret
Function at 0x5344dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x80
push ebx
push ecx
push edx
push esi
push edi
mov ecx, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebx
mov eax, ecx
mov ebx, 0x24
call fcn.004f6110
mov ebx, eax
cmp ebx, 0
je 0x534507
inc ebx
jmp 0x534509
mov ebx, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], ecx
mov eax, ecx
call fcn.004f627c
mov eax, ecx
mov ebx, str._RSC
call fcn.004f6220
mov esi, 0
mov edi, dword [0x78d994]
cmp edi, 0
jne 0x534540
mov eax, 0
call fcn.0043c034
mov edi, eax
cmp edi, 0
je 0x534681
cmp edi, esi
je 0x53465b
push str.DABDUMP
push dword [esp + 0x28]
push edi
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 0x28], eax
mov ebx, 0
cmp eax, 0
je 0x53465b
push eax
push edi
call sub.KERNEL32.dll_LoadResource
mov dword [esp + 0x2c], eax
push eax
call sub.KERNEL32.dll_LockResource
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x20]
call fcn.00429604
cmp eax, 0
jne 0x534652
push dword [esp + 0x28]
push edi
call sub.KERNEL32.dll_SizeofResource
mov ecx, eax
mov ebx, dword [esp + 0x18]
mov eax, ebx
call fcn.0042f564
sub ecx, eax
dec ecx
mov eax, ecx
add eax, 2
call fcn.004b3d54
mov dword [0x5692e0], eax
mov eax, dword [0x5692e0]
mov byte [eax], 0
mov eax, ebx
call fcn.0042f564
mov edx, eax
mov eax, dword [0x5692e0]
lea eax, [eax + 2]
lea ebx, [ebx + edx + 1]
call fcn.0042f617
mov eax, dword [0x5692e0]
mov eax, dword [eax + 2]
mov dword [esp + 0x14], eax
push dword [esp + 0x2c]
call sub.KERNEL32.dll_FreeResource
mov ecx, dword [esp + 0x14]
cmp ecx, 0
je 0x53463c
mov eax, dword [esp + 0x1c]
mov ebx, dword [0x5692e0]
mov ebx, dword [0x5692e0]
mov edx, dword [ebx + ecx + 0x21]
lea ebx, [ebx + edx]
call fcn.00429604
cmp eax, 0
jne 0x53462d
mov dword [0x78d998], edi
mov eax, ecx
jmp 0x534686
mov eax, dword [0x5692e0]
mov eax, dword [eax + ecx + 1]
mov dword [esp + 0x14], eax
jmp 0x5345f9
mov eax, dword [0x5692e0]
call fcn.004b3428
mov dword [0x5692e0], 0
jmp 0x53465b
push dword [esp + 0x2c]
call sub.KERNEL32.dll_FreeResource
cmp esi, 0
je 0x53466e
mov eax, edi
call fcn.0043c034
mov edi, eax
jmp 0x534540
mov esi, edi
mov eax, 0
call fcn.0043c034
mov edi, eax
jmp 0x534540
mov eax, 0
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x80
ret
Function at 0x534e7c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ecx
push edx
push esi
push edi
mov dword [esp + 0x1c], ebx
mov ebx, eax
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x1c]
jmp 0x534f3f
cmp dword [esi + 8], 9
je 0x534ea2
jmp 0x534f4c
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x534f4c
mov edx, 0
mov edi, 0
cmp ebx, 0
pushfd
mov ecx, ebx
add ecx, 0x1f8
popfd
jne 0x534ece
jmp 0x534ed0
mov ebx, ecx
mov eax, edi
call fcn.0050b828
cmp eax, 0
je 0x534f1d
mov ebx, dword [esp + 0x14]
cmp ebx, 0
jne 0x534ee9
mov ecx, ebx
jmp 0x534ee9
mov eax, edi
mov ecx, dword [ecx]
mov edx, dword [ecx + eax*4]
cmp edx, 0
jne 0x534f0d
jmp 0x534f10
mov eax, edx
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x18]
call dword [ecx + 0xb4]
cmp eax, 0
jne 0x534f1d
jmp 0x534f1a
sub edx, 0x17
mov dword [esp + 0x18], edx
cmp byte [edx + 0x10], 0x25
je 0x534ef7
inc edi
jmp 0x534ebd
cmp edx, 0
je 0x534f4c
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
push 0x100
mov eax, dword [edx + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x534f51
cmp dword [esi + 4], 0x100
je 0x534e97
mov eax, 0
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0xc
ret
Function at 0x5356e4
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
pushal
mov dword [esp + 0x28], ebx
mov ebx, eax
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
cmp eax, 0
je 0x5358f4
mov edi, 0
mov esi, 0
mov dword [esp + 0x2c], 0
mov ecx, dword [eax + 0x192]
cmp dword [ebx + 0x1f8], ecx
je 0x5357a2
mov eax, dword [eax + 0x192]
mov dword [ebx + 0x1f8], eax
cmp dword [ebx + 0x1f8], 0
je 0x535765
mov eax, dword [ebx + 0x1f8]
call fcn.0051dc38
mov ecx, eax
mov eax, dword [ebx + 0x1f8]
call fcn.0051dc34
push eax
push ecx
push 0x230
mov eax, dword [ebx + 0xfb]
push eax
call sub.USER32.dll_SendMessageA
jmp 0x53577a
push 0
push 0
push 0x230
mov eax, dword [ebx + 0xfb]
push eax
call sub.USER32.dll_SendMessageA
cmp dword [ebx + 0x1f8], 0
jne 0x535791
push 0
mov eax, dword [ebx + 0x83]
push eax
call sub.USER32.dll_SetMenu
mov eax, dword [ebx + 0x83]
push eax
call sub.USER32.dll_DrawMenuBar
mov esi, 1
mov edx, dword [ebx + 0x200]
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov ebx, ecx
call fcn.00535674
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx + 0x200]
cmp edx, eax
je 0x5357ca
mov esi, 1
jmp 0x5357de
cmp dword [ebx + 0x200], 0
je 0x5357de
mov eax, dword [ebx + 0x200]
mov eax, dword [eax + 0xc]
or esi, eax
mov eax, dword [ebx + 0x1fc]
cmp dword [ecx + 0x18e], eax
je 0x5358bd
cmp dword [ebx + 0x1fc], 0
je 0x53581d
mov eax, dword [ebx + 0x1fc]
mov edi, dword [eax + 0x4d]
mov dword [0x545a7c], 1
push 0
mov eax, dword [ebx + 0x1fc]
mov eax, dword [eax + 0x45]
push eax
call sub.USER32.dll_ShowWindow
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x18e]
mov dword [ebx + 0x1fc], eax
mov esi, 1
mov dword [esp + 0x2c], 1
mov eax, ecx
mov edx, dword [ecx + 4]
mov eax, dword [esp + 0x20]
call dword [edx + 0x5c]
cmp eax, 0
je 0x5358bd
cmp dword [ebx + 0x1fc], 0
je 0x53586e
mov eax, dword [ebx + 0x1fc]
mov eax, dword [eax + 0x4d]
jmp 0x535873
mov ecx, eax
and ecx, 0x10000
cmp ecx, 0
je 0x53589f
jmp 0x5358bd
mov eax, 0
cmp edi, eax
je 0x5358bd
mov edi, ecx
push 0xfffffffffffffff0
mov eax, dword [edi + 0x83]
push eax
call sub.USER32.dll_GetWindowLongA
mov ecx, eax
and ecx, 0x1000001
cmp ecx, 0
jne 0x53585f
jmp 0x5358bd
cmp dword [esp + 0x2c], 0
jne 0x5358d9
jmp 0x5358ea
mov dword [edi + 0x209], 1
or eax, 0x10000
push eax
push 0xfffffffffffffff0
mov eax, dword [edi + 0x83]
push eax
call sub.USER32.dll_SetWindowLongA
cmp esi, 0
je 0x5358ce
mov eax, ebx
mov ecx, dword [ebx + 4]
mov eax, dword [esp + 0x24]
call dword [ecx + 0x70]
cmp dword [ebx + 0x1fc], 0
jne 0x535896
jmp 0x5358ea
push 1
mov eax, dword [ebx + 0x1fc]
mov eax, dword [eax + 0x45]
push eax
call sub.USER32.dll_ShowWindow
mov dword [0x545a7c], 0
popal
add esp, 0x10
ret
Function at 0x53abb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
pushal
call sub.USER32.dll_GetActiveWindow
push eax
call sub.USER32.dll_OpenClipboard
cmp eax, 0
je 0x53ac0c
call sub.USER32.dll_EmptyClipboard
call fcn.0042f50f
call fcn.004347ec
mov ebx, eax
cmp ebx, 0
je 0x53ac00
inc ebx
push ebx
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
push esi
call sub.KERNEL32.dll_GlobalLock
call fcn.0043508c
push esi
call sub.KERNEL32.dll_GlobalUnlock
push esi
push 1
call sub.USER32.dll_SetClipboardData
jmp 0x53ac05
call fcn.00434ad4
call sub.USER32.dll_CloseClipboard
jmp 0x53ac11
call fcn.00434ad4
popal
pop ebp
ret

Function at 0x53ac14
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, eax
call sub.USER32.dll_GetActiveWindow
mov ebx, eax
cmp edi, 0
jne 0x53ac2b
mov edi, 1
mov eax, edi
push eax
call sub.USER32.dll_IsClipboardFormatAvailable
jmp 0x53ac9a
push ebx
call sub.USER32.dll_OpenClipboard
cmp eax, 0
jne 0x53ac42
jmp 0x53ac9f
mov eax, edi
push eax
call sub.USER32.dll_GetClipboardData
mov esi, eax
mov eax, edi
cmp eax, 2
je 0x53ac58
cmp eax, 9
jne 0x53ac61
mov eax, esi
call fcn.00434cc8
jmp 0x53ac93
push esi
call sub.KERNEL32.dll_GlobalLock
mov ebx, eax
push esi
call sub.KERNEL32.dll_GlobalSize
mov ecx, eax
cmp edi, 1
jne 0x53ac7f
mov eax, ebx
call fcn.00435120
jmp 0x53ac8d
mov eax, ebx
mov ebx, ecx
call fcn.00434fc0
call fcn.00434ed4
push esi
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
jmp 0x53acae
cmp eax, 0
jne 0x53ac35
mov eax, 0
mov ebx, 0
call fcn.00434fc0
popal
pop ebp
ret

Function at 0x53ad18
Capabilities:
Create process on windows

Disassembly:
enter 0x60, 0
pushal
mov ecx, eax
lea esi, [ebp - 0x60]
mov eax, esi
call fcn.005319c8
mov eax, esi
call fcn.0053176c
mov dword [0x56ba80], 0
call fcn.00421ea4
cmp ecx, 0
je 0x53adde
lea edx, [ebp - 0x44]
mov eax, edx
mov ebx, 0
mov ecx, 0x44
call fcn.0042f5e2
mov dword [ebp - 0x44], 0x44
mov word [ebp - 0x14], 5
mov eax, esi
call fcn.00531428
lea ebx, [ebp - 0x54]
push ebx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call sub.KERNEL32.dll_CreateProcessA
cmp eax, 0
je 0x53adc1
call fcn.00533390
push 0xffffffffffffffff
push dword [ebp - 0x54]
call sub.KERNEL32.dll_WaitForSingleObject
call fcn.00533344
push 0x56ba80
push dword [ebp - 0x54]
call sub.KERNEL32.dll_GetExitCodeProcess
push dword [ebp - 0x54]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x50]
call sub.KERNEL32.dll_CloseHandle
jmp 0x53add5
mov dword [0x56ba80], 0xfffffffc
call sub.KERNEL32.dll_GetLastError
call fcn.00421f94
mov eax, esi
call fcn.005319e0
jmp 0x53ae08
mov eax, esi
call fcn.00531428
push 5
push eax
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jae 0x53ae01
mov dword [0x56ba80], 0xfffffffc
call fcn.00421f94
mov eax, esi
call fcn.005319e0
popal
leave
ret
Function at 0x53d668
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push ecx
push edx
push esi
push edi
mov esi, eax
call sub.KERNEL32.dll_AreFileApisANSI
cmp eax, 0
je 0x53d682
mov edi, esi
jmp 0x53d68d
lea edi, [esp + 0x10]
push edi
push esi
call sub.USER32.dll_CharToOemA
push edi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x53d6a5
mov dword [ebx], 0xffffffff
call fcn.0053dc90
jmp 0x53d6af
and eax, 0x7f
mov dword [ebx], eax
mov eax, 0
pop edi
pop esi
pop edx
pop ecx
add esp, 0x104
ret

Function at 0x53d6e8
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push ecx
push edx
push esi
push edi
mov edi, eax
call sub.KERNEL32.dll_AreFileApisANSI
cmp eax, 0
je 0x53d704
mov esi, edi
mov edi, ebx
jmp 0x53d71d
lea esi, [esp + 0x10]
push esi
push edi
call sub.USER32.dll_CharToOemA
lea edi, [esp + 0x114]
push edi
push ebx
call sub.USER32.dll_CharToOemA
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push esi
call sub.KERNEL32.dll_MoveFileA
cmp eax, 0
je 0x53d737
mov eax, 0
jmp 0x53d73c
call fcn.0053dc90
pop edi
pop esi
pop edx
pop ecx
add esp, 0x208
ret

Function at 0x53d84c
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ecx
push edx
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebx], 0
push 0
call sub.KERNEL32.dll_SetLastError
push 0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push edi
push esi
call sub.KERNEL32.dll_WriteFile
cmp eax, 0
jne 0x53d889
call fcn.0053dc90
jmp 0x53d894
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov eax, 0
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 8
ret

Function at 0x53d914
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ecx
push edx
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], ebx
mov edi, ecx
mov ebx, edx
push 0
call sub.KERNEL32.dll_SetLastError
push 0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push edi
push esi
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
jne 0x53d94b
call fcn.0053dc90
jmp 0x53d956
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov eax, 0
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 8
ret

Function at 0x53dae0
Capabilities:
Get file size

Disassembly:
sub esp, 4
push ecx
push edx
push esi
mov esi, eax
push 0
call sub.KERNEL32.dll_SetLastError
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_GetFileSize
mov dword [ebx], eax
call fcn.0053dc90
pop esi
pop edx
pop ecx
add esp, 4
ret

Function at 0x53db08
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
push ebx
push ecx
push edx
push esi
mov esi, eax
call sub.KERNEL32.dll_AreFileApisANSI
cmp eax, 0
je 0x53db22
mov ebx, esi
jmp 0x53db2d
lea ebx, [esp + 0x10]
push ebx
push esi
call sub.USER32.dll_CharToOemA
push 0
call sub.KERNEL32.dll_SetLastError
push ebx
call sub.KERNEL32.dll_DeleteFileA
cmp eax, 0
jne 0x53db46
call fcn.0053dc90
jmp 0x53db4b
mov eax, 0
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x104
ret