joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ce59
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.0040ffe0
add esp, 8
test al, al
je 0x40ff90
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40fe86
lea eax, [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
je 0x40fe98
test al, 0x10
je 0x40fec8
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00410f50
add esp, 8
mov byte [ebp - 4], 1
mov ebx, 1
mov dword [ebp - 0x48], ebx
cmp dword [eax + 0x14], 8
jb 0x40febc
mov eax, dword [eax]
push eax
call edi
cmp eax, 0xffffffff
je 0x40fece
test al, 0x10
jne 0x40fece
mov byte [ebp - 0x41], 1
jmp 0x40fed2
mov byte [ebp - 0x41], 0
mov dword [ebp - 4], 0
test bl, 1
je 0x40feec
and ebx, 0xfffffffe
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x48], ebx
call fcn.004038c0
cmp byte [ebp - 0x41], 0
jne 0x40ff90
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40ff02
lea eax, [ebp - 0x28]
push eax
call edi
cmp eax, 0xffffffff
je 0x40ff3b
test al, 0x10
je 0x40ff3b
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x40ff21
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00406ac0
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x28]
cmp eax, ecx
je 0x40ff37
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00406ac0
mov bl, 1
jmp 0x40ff92
push 0xffffffffffffffff
push 0x588408
lea ecx, [ebp - 0x28]
call fcn.00410ff0
mov edi, eax
cmp edi, 0xffffffff
je 0x40ff90
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x40ff64
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00406ac0
push edi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040c490
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.00403e70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004038c0
mov bl, 1
jmp 0x40ff92
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x40ffae
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407270
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
Function at 0x414e90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp + 0xc]
sar eax, 0x10
movzx eax, al
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ToAscii]
xor ebx, ebx
lea esi, [eax - 1]
movzx eax, word [ebp - 0x1d0]
test eax, eax
sets bl
dec ebx
and ebx, eax
lea eax, [ebp - 0x1cc]
push ebx
push str.return_value___d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
add esp, 0xc
neg esi
sbb esi, esi
xor ecx, ebp
not esi
and esi, ebx
mov ax, si
pop esi
pop ebx
call fcn.0052c233
mov esp, ebp
pop ebp
ret
Function at 0x418c30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d20b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5fc150]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
xor eax, eax
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
mov dword [ebp - 4], eax
mov word [esi + 0x30], ax
mov dword [esi + 0x38], 0xffffffff
mov word [esi + 0x3c], ax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov byte [ebp - 4], 1
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov byte [ebp - 4], 2
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov byte [ebp - 4], 3
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov byte [esi + 0x70], al
mov dword [esi + 0x88], 7
mov dword [esi + 0x84], eax
mov word [esi + 0x74], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x8c], eax
mov byte [esi + 0x90], al
mov dword [esi + 0x94], 0xffffffff
mov dword [esi + 0xac], 7
mov dword [esi + 0xa8], eax
mov word [esi + 0x98], ax
mov byte [ebp - 4], 5
mov word [esi + 0xb0], ax
mov dword [esi + 0xb4], eax
mov word [esi + 0xb8], ax
mov eax, dword [esi + 0xf0]
mov dword [esi + 0xe0], eax
mov eax, dword [esi + 0xf4]
mov dword [esi + 0xe4], eax
lea eax, [esi + 0xf8]
push 2
push eax
mov dword [esi + 0xc0], 0xffffffff
mov dword [esi + 0xc4], 0xffffffff
mov dword [esi + 0xc8], 0xffffffff
mov dword [esi + 0xcc], 0xffffffff
mov dword [esi + 0xd0], 0xffffffff
mov dword [esi + 0xd4], 0xffffffff
mov dword [esi + 0xd8], 0xffffffff
mov dword [esi + 0xdc], 0xffffffff
mov byte [esi + 0xe8], 0
mov dword [esi + 0xf0], 0x200
mov dword [esi + 0xf4], 0
mov dword [ebp + 8], eax
call fcn.005168af
add esp, 8
mov byte [ebp - 4], 7
call fcn.0040baa0
mov edx, eax
mov cl, byte [edx + 0xcc]
mov byte [esi + 0x31], cl
mov ecx, dword [edx + 0xd0]
mov dword [esi + 0x34], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0x38], ecx
cmp ecx, 0xffffffff
je 0x418df8
mov dword [esi + 0x34], 4
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov dword [esi + 0x64], eax
push dword [edx + 0xd8]
push dword [ebp + 0x18]
call fcn.0041cbe0
mov ecx, esi
call fcn.0041d160
mov ecx, esi
call fcn.00419f50
mov byte [esi + 0x30], 0
mov byte [esi + 4], 1
mov byte [esi + 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x419f50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x64], 2
je 0x41a143
cmp byte [esi + 0xb8], 0
jne 0x41a143
push ebx
push edi
xor bh, bh
call fcn.0040baa0
cmp dword [esi + 0x88], 8
lea edi, [esi + 0x74]
mov dword [ebp - 0x2c], eax
jb 0x419f96
mov ecx, dword [edi]
jmp 0x419f98
mov ecx, edi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x419fae
mov ecx, dword [ebp - 0x2c]
push eax
call fcn.004ba550
mov bh, 1
xor bl, bl
cmp dword [esi + 0x64], 4
je 0x41a01f
cmp dword [edi + 0x14], 8
jb 0x419fc0
mov eax, dword [edi]
jmp 0x419fc2
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a015
mov dword [esi + 0x64], 4
mov byte [esi + 0x70], al
mov byte [esi + 0x30], 1
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
cmp byte [esi + 4], al
je 0x419ff2
mov ecx, dword [esi]
push 0x70
push esi
mov ecx, dword [ecx]
call fcn.00476f10
mov bl, 1
test bh, bh
je 0x41a002
mov ecx, dword [ebp - 0x2c]
push 1
call fcn.004ba550
pop edi
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x64], 4
jne 0x41a09f
cmp dword [edi + 0x14], 8
jb 0x41a029
mov eax, dword [edi]
jmp 0x41a02b
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41a09f
cmp dword [edi + 0x14], 8
jb 0x41a03e
mov edi, dword [edi]
lea eax, [ebp - 0x28]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x419ff4
mov al, byte [ebp - 0x28]
lea ecx, [esi + 0xf8]
and al, 1
mov dword [esi + 0x64], 8
mov byte [esi + 0x70], al
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x68], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x6c], eax
call fcn.0041d110
test al, al
je 0x419ff2
cmp byte [esi + 4], 0
je 0x41a08f
mov ecx, dword [esi]
push 0x70
push esi
mov ecx, dword [ecx]
call fcn.00476f10
lea ecx, [esi + 0xf8]
call fcn.0041d140
jmp 0x419ff2
cmp dword [edi + 0x14], 8
jb 0x41a0a7
mov edi, dword [edi]
lea eax, [ebp - 0x28]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x419ff4
mov al, byte [ebp - 0x28]
xor edi, edi
and al, 1
cmp al, byte [esi + 0x70]
je 0x41a0d0
mov byte [esi + 0x70], al
mov edi, 0x10
lea eax, [ebp - 0x14]
push eax
lea ebx, [esi + 0x68]
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
je 0x41a0f7
mov eax, dword [ebp - 0x14]
or edi, 0x60
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov dword [esi + 0x64], 8
test edi, edi
je 0x41a130
lea ecx, [esi + 0xf8]
call fcn.0041d110
test al, al
je 0x41a130
push edi
mov ecx, esi
call fcn.0041af40
lea ecx, [esi + 0xf8]
call fcn.0041d140
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0052c233
mov esp, ebp
pop ebp
ret
Function at 0x41a510
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x579270
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
mov bl, 1
call fcn.0041b050
mov dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
je 0x41a5df
mov eax, 7
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
mov byte [ebp - 4], bl
lea ecx, [esi + 0x98]
lea edx, [ebp - 0x28]
cmp ecx, edx
je 0x41a59d
push 0xffffffffffffffff
push 0
mov eax, edx
push eax
call fcn.00406ac0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x41a5b3
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407270
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], 0
jae 0x41a5d3
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x41a5fb
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00407270
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov al, bl
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 4
Function at 0x41a630
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d4d8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
add edx, 0x74
cmp dword [edx + 0x14], 8
jb 0x41a668
mov edx, dword [edx]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x41a693
xor ecx, ecx
jmp 0x41a6af
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x41a6a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a6a0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00406c80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0040ae90
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41a6d8
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a6e7
xor bl, bl
jmp 0x41a74c
xor eax, eax
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
jae 0x41a70e
lea eax, [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, 0x40
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x36], 0
mov dword [ebp - 0x32], 0
mov dword [ebp - 0x2e], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41a768
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407270
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 4
Function at 0x41e600
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56da01
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fc150]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0xd
call esi
test eax, eax
jne 0x41e672
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
jmp 0x41e78a
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x41e68e
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
jmp 0x41e775
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x41e75b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
test edi, edi
je 0x41e75b
push str.Notepad_Binary_Text_Length
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
mov dword [ebp - 0x1c], eax
call esi
test eax, eax
je 0x41e71d
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41e74f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x41e74c
xor esi, esi
cmp dword [ebx], esi
jbe 0x41e70d
mov al, byte [esi + edi]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push eax
call fcn.0041e900
inc esi
cmp esi, dword [ebx]
jb 0x41e6f6
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
mov ebx, dword [ebp - 0x14]
jmp 0x41e755
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
lea eax, [eax*2 + 2]
test eax, eax
jle 0x41e74f
mov ebx, eax
mov al, byte [esi + edi]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push eax
call fcn.0041e900
inc esi
cmp esi, ebx
jl 0x41e735
mov ebx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push ebx
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004242c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x425790
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e18d
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
push 0x586904
test eax, eax
jne 0x42580e
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
mov byte [esi], al
call fcn.004069c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x42c], 1
jmp 0x425959
mov dword [ebp - 0x418], 0
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
call fcn.004069c0
mov dword [ebp - 4], 1
push 0x5890c8
push edi
call fcn.0054b683
add esp, 8
mov edi, eax
nop
push edi
push 0x400
lea eax, [ebp - 0x410]
push 1
push eax
call fcn.0054b87d
add esp, 0x10
test eax, eax
je 0x425890
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.00406520
jmp 0x425860
push edi
call fcn.0054b476
mov dword [esi + 0x14], 0xf
add esp, 4
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov ecx, dword [ebp - 0x414]
cmp ecx, 0x10
jae 0x4258d9
mov eax, dword [ebp - 0x418]
add eax, 1
je 0x4258eb
push eax
lea eax, [ebp - 0x428]
push eax
push esi
call fcn.00543060
mov ecx, dword [ebp - 0x414]
add esp, 0xc
jmp 0x4258eb
mov eax, dword [ebp - 0x428]
mov dword [esi], eax
mov dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x418]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
mov dword [ebp - 0x42c], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x414]
cmp eax, 0x10
jb 0x42593e
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.00407220
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
Function at 0x426170
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426220
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00544020
add esp, 0xc
mov dword [ebp - 0x210], 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
push 1
push 0x440
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
jne 0x42620e
lea eax, [ebp - 0x20c]
push str.notepad.exe
push eax
call fcn.00544486
add esp, 8
test eax, eax
jne 0x42620e
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0052c233
mov esp, ebp
pop ebp
ret

Function at 0x426720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e3a2
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x424], 1
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x4267e9
push 0
lea eax, [ebp - 0x218]
push eax
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [ebp - 0x218], 0
jne 0x4267c4
xor ecx, ecx
lea eax, [ebp - 0x218]
push ecx
push eax
jmp 0x426861
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4267d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
jmp 0x426861
movzx eax, word [edi]
cmp eax, 0x5c
jne 0x4267f7
cmp word [edi + 2], ax
jne 0x4267fc
cmp eax, 0x2f
jne 0x426841
lea eax, [ebp - 0x420]
xor bl, bl
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x426825
lea ebx, [eax + 0x41]
movsx ax, bl
mov ecx, esi
movzx eax, ax
push eax
push 1
call fcn.0040ae90
push 0x3a
push 1
mov ecx, esi
call fcn.0040ae90
cmp word [edi], 0
jne 0x42684b
xor ecx, ecx
jmp 0x42685f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426850
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00406760
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret
Function at 0x426ea0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
lea ebx, [eax*2 + 2]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x426ef8
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x426eeb
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
test eax, eax
je 0x426eec
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x426eff
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
cmp dword [edi + 0x14], 8
jb 0x426f07
mov edi, dword [edi]
push edi
shr ebx, 1
push ebx
push eax
call fcn.0054bd88
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x426eeb
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
test eax, eax
pop esi
setne al
pop ebx
pop ebp
ret

Function at 0x427f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x593ad8
push dword [ebp + 8]
call fcn.0054b683
mov edx, dword [ebp + 0xc]
add esp, 8
mov ecx, edx
mov esi, eax
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427f90
push esi
sub ecx, edi
push ecx
push 1
push edx
call fcn.00554cd1
push esi
call fcn.00554913
push esi
call fcn.0054b476
add esp, 0x18
pop edi
pop esi
pop ebp
ret