joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435ce6
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5e6e74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x128
xor edi, edi
push edi
push esi
call fcn.0054b0f0
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.00554ac7
push eax
call fcn.00403410
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x5949d8]
je 0x435e44
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x435e58
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x435e58
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
je 0x435da2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x435d96
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.00435a97
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
jmp 0x435d9d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x435da4
mov eax, edi
mov ecx, esi
mov dword [ecx + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00435f96
test eax, eax
je 0x435dcb
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.0043591e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x435dcf
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00435f96
test eax, eax
je 0x435df6
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.0043591e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x435dfa
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00435f96
test eax, eax
je 0x435e22
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.0043591e
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x435e24
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x435e36
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x435e44
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00549544
leave
ret 4
xor eax, eax
jmp 0x435e47
Function at 0x4481d2
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x5e6e74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x168], esi
test eax, eax
je 0x44823c
push 0x208
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, esi
test eax, eax
je 0x448221
lea eax, [ebp - 0x158]
push eax
jmp 0x448226
push 0x598300
call fcn.004037f0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00549544
leave
ret 8
call fcn.0040e13d
int3
Function at 0x450422
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x45043b
call fcn.004175c7
mov esi, dword [eax + 0xc]
push 0x598dd8
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x45047d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45047d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x45047d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00450486
jmp 0x45047f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ea959
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x587125
call fcn.00549e8a
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403510
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x591078
call fcn.00410a53
cmp eax, 0xffffffff
jne 0x4eaa34
push 0
push 0x598d94
lea ecx, [ebp - 0x278]
call fcn.00410a53
cmp eax, 0xffffffff
jne 0x4eaa34
push 0
push 0x58ffb4
lea ecx, [ebp - 0x278]
call fcn.00410a53
cmp eax, 0xffffffff
jne 0x4eaa34
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403510
add eax, 0x10
pop ecx
mov dword [ebp - 0x280], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x27c], edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4eaa03
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x58da18]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.00401db0
jmp 0x4eaa6d
lea eax, [ebp - 0x114]
push eax
call fcn.00554940
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.00402120
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00401db0
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4eaa5a
mov edi, dword [ebp - 0x274]
jmp 0x4eaa6d
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x58da18]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00401db0
mov eax, edi
call fcn.00549e39
ret
Function at 0x504603
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0055bd15
pop ecx
test eax, eax
jne 0x504645
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00401be0
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x50460b
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x54a615
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x54a654
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x54a654
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x54a654
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x54a654
cmp dword [ecx + 0x74], 0xe
jbe 0x54a654
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x55e87a
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x18
mov ecx, dword fs:[0x30]
mov edx, dword [ecx + 0xc]
add edx, 0xc
mov edx, dword [edx]
mov eax, dword [edx + 0x30]
test eax, eax
je 0x55e88a
mov edx, dword [edx + 0x18]
mov dword [esp], edx
mov esi, dword [0x5e6ba4]
mov ebp, dword [ecx + 0xc]
mov dword [esp + 4], eax
add ebp, 0xc
mov ebp, dword [ebp]
mov ebx, dword [ebp + 0x30]
test ebx, ebx
je 0x55e8a9
test esi, esi
je 0x55e90f
movzx eax, word [ebx]
xor ecx, ecx
test eax, eax
je 0x55e8ff
xor edx, edx
inc edx
movzx edi, word [ebx + edx*4 - 4]
cmp edi, 0x41
jl 0x55e8d6
cmp edi, 0x5a
lea eax, [edi + 0x20]
cmovle edi, eax
movzx eax, di
add ecx, eax
movzx eax, word [ebx + edx*4 - 2]
test eax, eax
je 0x55e8ff
cmp eax, 0x41
jl 0x55e8f5
lea edi, [eax + 0x20]
movzx edi, di
cmp eax, 0x5a
cmovle eax, edi
add ecx, eax
movzx eax, word [ebx + edx*4]
test eax, eax
jne 0x55e8c2
nop dword [eax + eax]
nop dword [eax]
cmp esi, ecx
jne 0x55e8a9
mov eax, dword [esp + 4]
mov ebx, dword [ebp + 0x18]
mov ebp, dword [0x5e6bc0]
cmp dword [ebp], 0
je 0x55e988
movzx edx, word [eax]
test edx, edx
je 0x55eadd
xor ecx, ecx
inc ecx
movzx esi, word [eax + ecx*4 - 2]
lea edi, [ecx + ecx]
lea edx, [ecx + ecx - 1]
test esi, esi
je 0x55e94a
movzx esi, word [eax + ecx*4]
mov edx, edi
test esi, esi
jne 0x55e92f
movzx edx, dl
cmp dl, byte [ebp]
je 0x55e95b
cmp dl, byte [ebp + 1]
jne 0x55ea2c
xor ecx, ecx
xor edx, edx
inc edx
movzx esi, word [eax + edx*4 - 4]
add ecx, esi
movzx esi, word [eax + edx*4 - 2]
test esi, esi
je 0x55e97a
add ecx, esi
movzx esi, word [eax + edx*4]
test esi, esi
jne 0x55e95f
cmp ecx, dword [ebp + 4]
je 0x55e988
cmp ecx, dword [ebp + 8]
jne 0x55ea2c
xor eax, eax
mov edx, dword [0x5e6bbc]
mov dword [esp + 4], eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
mov eax, dword [0x5e6bb4]
test eax, eax
jbe 0x55e9c8
xor eax, eax
cmp byte [ebp], 0
je 0x55eaed
cmp byte [ebp + 1], 0
jne 0x55ea2c
xor ecx, ecx
jmp 0x55e97a
Function at 0x55e9bc
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov edx, dword [str.VirtualProtect]
mov ecx, dword [edx + eax]
mov dword [ebp + eax], ecx
mov esi, dword [0x5e6bc8]
add eax, esi
mov edi, dword [0x5e6bb4]
cmp eax, edi
jb 0x55e9a9
test ebx, ebx
je 0x55ea2c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
and byte [ebx + 0x318197c], cl
ret
test edi, edi
jbe 0x55ea2c
mov dl, byte [ebp]
xor esi, esi
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ebp
mov ebp, ebx
add ebp, dword [eax + esi*4]
cmp dl, byte [ebp]
jne 0x55ea27
mov dword [esp + 0x10], edi
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x14]
cmp byte [ecx + ebp], 0
je 0x55ea34
cmp byte [ecx + edi], 0
je 0x55ea34
inc ecx
mov al, byte [ecx + ebp]
cmp al, byte [ecx + edi]
je 0x55ea06
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc esi
cmp esi, edi
jb 0x55e9ee
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 8]
mov eax, dword [ecx + ebx + 0x1c]
mov ecx, dword [ecx + ebx + 0x24]
add eax, ebx
add ecx, ebx
movzx edx, word [ecx + esi*2]
mov ebp, dword [eax + edx*4]
add ebx, ebp
je 0x55ea2c
mov esi, dword [0x5e6bb0]
lea ebp, [esp + 4]
push ebp
mov edx, dword [0x5e6b98]
mov eax, dword [0x5e6bb4]
push eax
push edx
push esi
call ebx
mov edx, dword [0x5e6bac]
mov eax, dword [esp]
add eax, edx
mov ecx, dword [0x5e6b98]
mov dword [esp], eax
mov edx, dword [eax + 4]
cmp ecx, 8
jbe 0x55eaa7
mov ecx, eax
mov eax, 8
mov edi, dword [ecx + eax]
add edi, edx
mov dword [esi + eax], edi
mov edi, dword [0x5e6bc8]
add eax, edi
mov edi, dword [0x5e6b98]
cmp eax, edi
jb 0x55ea8d
mov eax, dword [0x5e6bd0]
push ebp
mov dword [esi + 8], eax
push dword [esp + 8]
mov edx, dword [0x5e6b98]
push edx
push esi
call ebx
mov ecx, dword [esi + 0xc]
add ecx, esi
mov eax, dword [0x5e6b94]
add ecx, eax
mov edx, dword [0x5e6b94]
add esi, edx
push esi
call ecx
add esp, 4
jmp 0x55ea2c

Function at 0x55e9d6
Capabilities:
Terminate process

Disassembly:
and byte [ebx + 0x318197c], cl
ret

Function at 0x560ac3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00560939

Function at 0x56596c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005655e9

Function at 0x56b690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x56b6bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x56b6bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x56bef0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
xor eax, eax
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x12], ax
xorps xmm0, xmm0
mov eax, 3
movlpd qword [ebp - 0x50], xmm0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
movlpd qword [ebp - 0x48], xmm0
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push ecx
push 0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x22], xmm0
movlpd qword [ebp - 0x1a], xmm0
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x56bf69
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x56bf90
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1390
call fcn.0054a000
mov eax, dword [0x5e6e74]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [0x5beef0]
movq xmm0, qword [0x5beee8]
push edi
mov word [ebp - 0xbb4], ax
mov edi, ecx
movzx eax, byte [0x5beef2]
push 0x3dd
mov byte [ebp - 0xbb2], al
lea eax, [ebp - 0xbb1]
push 0
push eax
movq qword [ebp - 0xbbc], xmm0
call fcn.0054b0f0
movups xmm0, xmmword [str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe]
mov eax, dword [0x5bef2c]
mov dword [ebp - 0x3b4], eax
movzx eax, byte [0x5bef30]
movups xmmword [ebp - 0x3ec], xmm0
push 0x3ab
movups xmm0, xmmword [0x5bef04]
mov byte [ebp - 0x3b0], al
lea eax, [ebp - 0x3af]
push 0
movups xmmword [ebp - 0x3dc], xmm0
push eax
movups xmm0, xmmword [0x5bef14]
movups xmmword [ebp - 0x3cc], xmm0
movq xmm0, qword [0x5bef24]
movq qword [ebp - 0x3bc], xmm0
call fcn.0054b0f0
movups xmm0, xmmword [str.C:Program_FilesMicrosoftEdgeApplicationmsedge.exe]
mov eax, dword [0x5bef64]
mov dword [ebp - 0x7a4], eax
movzx eax, word [0x5bef68]
movups xmmword [ebp - 0x7d4], xmm0
mov word [ebp - 0x7a0], ax
movups xmm0, xmmword [0x5bef44]
movzx eax, byte [0x5bef6a]
push 0x3b1
movups xmmword [ebp - 0x7c4], xmm0
mov byte [ebp - 0x79e], al
lea eax, [ebp - 0x79d]
movups xmm0, xmmword [0x5bef54]
push 0
push eax
movups xmmword [ebp - 0x7b4], xmm0
call fcn.0054b0f0
movups xmm0, xmmword [str.C:Program_FilesInternet_Exploreriexplore.exe]
push 0x3b8
lea eax, [ebp - 0xf74]
movups xmmword [ebp - 0xfa4], xmm0
push 0
movups xmm0, xmmword [0x5bef7c]
push eax
movups xmmword [ebp - 0xf94], xmm0
movups xmm0, xmmword [0x5bef8c]
movups xmmword [ebp - 0xf84], xmm0
call fcn.0054b0f0
add esp, 0x30
push 1
push 0
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x56c1d6
push esi
push 0x200
lea eax, [ebp - 0xbbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
mov al, byte [ebp - 0xbbc]
push str.IsWow64Process
push str.kernel32.dll
mov byte [ebp - 0x3ec], al
mov byte [ebp - 0x7d4], al
mov byte [ebp - 0xfa4], al
mov dword [ebp - 0x1390], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x56c16f
lea eax, [ebp - 0x1390]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x1390], 0
lea eax, [ebp - 0x7d4]
lea esi, [ebp - 0x3ec]
cmove esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x56c19c
test al, 0x10
jne 0x56c19c
mov ecx, 1
jmp 0x56c1a4
xor ecx, ecx
lea esi, [ebp - 0xfa4]
push edi
test ecx, ecx
mov edx, 0x5bf038
push esi
mov eax, str._s___s_
cmovne eax, edx
push eax
lea eax, [ebp - 0x138c]
push 0x3e8
push eax
call fcn.00401be0
add esp, 0x14
lea ecx, [ebp - 0x138c]
call fcn.0056bef0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00549544
mov esp, ebp
pop ebp
ret
Function at 0x56c1f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov byte [eax], 0
push ecx
mov dword [esp + 0x50], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x56c244
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x56c26b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x38]
mov eax, ecx
mov edx, dword [esp + 0x3c]
or eax, edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
jne 0x56c285
xor ebx, ebx
jmp 0x56c28a
mov ebx, 1
push dword [esp + 0x30]
shrd ecx, edx, 0xa
push dword [esp + 0x30]
shr edx, 0xa
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
call fcn.0057ca40
mulsd xmm0, qword [0x5c83c0]
sub esp, 8
movsd qword [esp], xmm0
push str.File_Size:__.2f_MB___I64d_Bytes_
push 0x3e8
push dword [esp + 0x4c]
call fcn.00401be0
mov eax, dword [esp + 0x48]
add esp, 0x1c
mov dword [edi], eax
mov eax, dword [esp + 0x30]
mov dword [edi + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56c2f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push ecx
mov dword [ebp - 4], edx
xor edi, edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x56c312
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x56c341
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x56c32d
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call fcn.0054b4e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x56c32d
mov edi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x56e480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b3cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e6e74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0040c12e
mov ecx, eax
test ecx, ecx
je 0x56e598
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x1ee0]
call fcn.004062a3
push 0
push 0
push 0xf0
push dword [esi + 0x1978]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x56e536
cmp dword [eax - 0xc], 3
jge 0x56e50f
push 0x10
mov ecx, 0x5c27a8
mov eax, str.Please_enter_the_full_path_of_the_input_file_for_Hash_generation
push ecx
push eax
mov ecx, esi
call fcn.004067a8
jmp 0x56e566
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x56e51f
test al, 0x10
je 0x56e553
push 0x10
mov ecx, 0x5c27fc
mov eax, str.Input_file_you_have_specified_does_not_exist.Make_sure_that_file_exists_and_you_have_entered_full_path_of_the_file.
push ecx
push eax
mov ecx, esi
call fcn.004067a8
jmp 0x56e566
cmp dword [eax - 0xc], 1
jge 0x56e553
push 0x10
mov ecx, 0x5c28ac
mov eax, str.Please_enter_any_text_for_Hash_generation
push ecx
push eax
mov ecx, esi
call fcn.004067a8
jmp 0x56e566
push 0
push 0
push 0
push 0
push esi
push 0x56e5b0
call fcn.0041545f
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x56e588
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401d90
int3
Function at 0x5704d0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1794
call fcn.0054a000
mov eax, dword [0x5e6e74]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x5c125c]
mov al, byte [0x5c126c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1790], 0
mov dword [ebp - 0x178c], 0
mov dword [ebp - 0x1794], 0x3e8
movups xmmword [ebp - 0x18], xmm0
mov byte [ebp - 8], al
call fcn.00571ec0
push 0xf0000000
push dword [ebx + 0x168]
lea eax, [ebp - 0x1790]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x570551
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x570581
lea eax, [ebp - 0x178c]
push eax
push 0
push 0
push edi
push dword [ebp - 0x1790]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x570596
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push dword [ebp - 0x1790]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00549544
mov esp, ebp
pop ebp
ret 0xc
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x178c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x5705c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x178c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x570573
push 0
lea eax, [ebp - 0x1794]
push eax
lea eax, [ebp - 0x400]
push eax
push 2
push dword [ebp - 0x178c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x5705ac
mov esi, dword [ebp - 0x1794]
cmp esi, 0x3e8
jae 0x5706d0
push 0x1388
lea eax, [ebp - 0x1788]
mov byte [ebp + esi - 0x400], 0
push 0
push eax
call fcn.0054b0f0
add esp, 0xc
xor edx, edx
test esi, esi
je 0x57064d
nop dword [eax + eax]
movzx ecx, byte [ebp + edx - 0x400]
mov eax, ecx
and ecx, 0xf
shr eax, 4
movzx eax, byte [ebp + eax - 0x18]
mov byte [ebp + edx*2 - 0x1788], al
movzx eax, byte [ebp + ecx - 0x18]
mov byte [ebp + edx*2 - 0x1787], al
inc edx
cmp edx, esi
jb 0x570620
add edx, edx
cmp edx, 0x1388
jae 0x5706d0
lea eax, [ebp - 0x1788]
mov byte [ebp + edx - 0x1788], 0
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00571fa0
cmp edi, 0x8003
jne 0x57069e
lea ecx, [ebp - 0x1788]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x570680
sub ecx, edx
lea edx, [ebp - 0x1788]
lea eax, [ecx + 1]
mov ecx, dword [ebx + 0x20]
push eax
call fcn.0056c2f0
add esp, 4
push dword [ebp - 0x178c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x1790]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00549544
mov esp, ebp
pop ebp
ret 0xc
call fcn.00549aff
int3