joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fe99
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x44ff50
Capabilities:
Read file on windows

Disassembly:
call fcn.00433dc0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x44ff61
jmp dword [ecx*4 + 0x44ffb8]
xor eax, eax
jmp case.default.0x44ff61
push 0xfffffffffffffff6
jmp 0x44ff76
push 0xfffffffffffffff5
jmp 0x44ff76
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00450740
add esp, 8
call fcn.00432080
mov eax, esi
pop esi
ret
Function at 0x44ff68
Capabilities:
Read file on windows

Disassembly:
call fcn.00433dc0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x44ff61
jmp dword [ecx*4 + 0x44ffb8]
xor eax, eax
jmp case.default.0x44ff61
push 0xfffffffffffffff6
jmp 0x44ff76
push 0xfffffffffffffff5
jmp 0x44ff76
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00450740
add esp, 8
call fcn.00432080
mov eax, esi
pop esi
ret

Function at 0x44ff6c
Capabilities:
Read file on windows

Disassembly:
call fcn.00433dc0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x44ff61
jmp dword [ecx*4 + 0x44ffb8]
xor eax, eax
jmp case.default.0x44ff61
push 0xfffffffffffffff6
jmp 0x44ff76
push 0xfffffffffffffff5
jmp 0x44ff76
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00450740
add esp, 8
call fcn.00432080
mov eax, esi
pop esi
ret

Function at 0x44ff70
Capabilities:
Read file on windows

Disassembly:
call fcn.00433dc0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x44ff61
jmp dword [ecx*4 + 0x44ffb8]
xor eax, eax
jmp case.default.0x44ff61
push 0xfffffffffffffff6
jmp 0x44ff76
push 0xfffffffffffffff5
jmp 0x44ff76
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00450740
add esp, 8
call fcn.00432080
mov eax, esi
pop esi
ret

Function at 0x44ff74
Capabilities:
Read file on windows

Disassembly:
call fcn.00433dc0
mov eax, dword [esp + 4]
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x44ff61
jmp dword [ecx*4 + 0x44ffb8]
xor eax, eax
jmp case.default.0x44ff61
push 0xfffffffffffffff6
jmp 0x44ff76
push 0xfffffffffffffff5
jmp 0x44ff76
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
push 0
cmovne esi, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.00450740
add esp, 8
call fcn.00432080
mov eax, esi
pop esi
ret
Function at 0x44ffd0
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push dword [esp + 0x10]
call fcn.0044fa00
push dword [esp + 0x18]
mov ebx, eax
call fcn.0044fa00
add esp, 8
mov edi, eax
call fcn.00433dc0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00450740
add esp, 8
call fcn.00432080
test ebx, ebx
je 0x45001c
push ebx
call fcn.00434080
add esp, 4
test edi, edi
je 0x450029
push edi
call fcn.00434080
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x450030
Capabilities:
Delete directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0044fa00
add esp, 4
mov edi, eax
call fcn.00433dc0
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00450740
add esp, 8
call fcn.00432080
test edi, edi
je 0x45006f
push edi
call fcn.00434080
add esp, 4
pop edi
mov eax, esi
pop esi
ret

Function at 0x450200
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
call fcn.00433dc0
push dword [esp + 0x10]
call fcn.0044fa00
mov ebx, dword [esp + 0x18]
add esp, 4
mov edx, ebx
mov ecx, ebx
and edx, 1
mov edi, eax
mov esi, edx
mov eax, ebx
or esi, 2
and cl, 2
cmove esi, edx
mov ecx, esi
or ecx, 4
and al, 4
cmove ecx, esi
mov eax, ecx
or eax, 0x20
and bl, 0x20
cmove eax, ecx
mov ecx, 0x80
test eax, eax
cmove eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00450740
add esp, 8
test edi, edi
je 0x450273
push edi
call fcn.00434080
add esp, 4
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4502a0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x40
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x58]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00462970
mov ebp, dword [esp + 0x6c]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push ebp
call fcn.00462fb0
call fcn.00433dc0
push 0
push 0x42
push esi
call fcn.0044fcd0
mov esi, eax
xor ebx, ebx
add esp, 0x30
cmp esi, 0xffffffff
setne bl
je 0x4503d3
test edi, edi
jle 0x450321
test ebp, ebp
js 0x450321
xorps xmm0, xmm0
movups xmmword [esp + 0x3c], xmm0
jmp 0x45032c
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test edi, edi
jle 0x45034e
movzx eax, word [esp + 0x10]
mov word [esp + 0x3c], ax
movzx eax, word [esp + 0x14]
mov word [esp + 0x3e], ax
movzx eax, word [esp + 0x18]
mov word [esp + 0x42], ax
test ebp, ebp
js 0x45037a
movzx eax, word [esp + 0x1c]
mov word [esp + 0x44], ax
movzx eax, word [esp + 0x20]
mov word [esp + 0x46], ax
movzx eax, word [esp + 0x24]
mov word [esp + 0x48], ax
movzx eax, word [esp + 0x28]
mov word [esp + 0x4a], ax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x4503c0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [esp + 0x2c]
push eax
push eax
push 0
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
jmp 0x4503c2
xor ebx, ebx
push 0
push ebx
call fcn.00450740
push esi
call fcn.0044ec50
add esp, 0xc
call fcn.00432080
mov ecx, dword [esp + 0x4c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a209e
add esp, 0x40
ret
Function at 0x4504d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x450551
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x45051a
jmp dword [edi*4 + 0x45060c]
xor esi, esi
jmp case.default.0x45051a
push 0xfffffffffffffff6
jmp 0x45052f
push 0xfffffffffffffff5
jmp 0x45052f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x4505e3
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x45055a
jmp dword [edi*4 + 0x45061c]
xor eax, eax
jmp 0x450585
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x450585
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x450585
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x450585
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4505c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4505c0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x450630
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ecx
push esi
xor esi, esi
call fcn.00433dc0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 1]
cmp dword [esp + 0x14], esi
je 0x4506a1
cmp ecx, 3
ja case.default.0x45064b
jmp dword [ecx*4 + 0x4506e4]
xor eax, eax
jmp case.default.0x45064b
push 0xfffffffffffffff6
jmp 0x450660
push 0xfffffffffffffff5
jmp 0x450660
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
test ecx, ecx
push 0
cmovne esi, dword [esp + 8]
xor eax, eax
test ecx, ecx
setne al
push eax
call fcn.00450740
add esp, 8
call fcn.00432080
mov eax, esi
pop esi
pop ecx
ret
cmp ecx, 3
ja case.default.0x4506a6
jmp dword [ecx*4 + 0x4506f4]
xor eax, eax
jmp case.default.0x4506a6
push 0xfffffffffffffff6
jmp 0x4506bb
push 0xfffffffffffffff5
jmp 0x4506bb
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
add esp, 8
call fcn.00432080
mov eax, esi
pop esi
pop ecx
ret
Function at 0x454bf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x430
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x42c], eax
mov eax, dword [esp + 0x440]
push ebx
mov ebx, dword [esp + 0x43c]
push ebp
mov ebp, dword [esp + 0x43c]
push esi
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x3e6
nop dword [eax]
mov byte [eax], 0
call fcn.00433dc0
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x454c4b
push ebx
call fcn.0044fa00
add esp, 4
mov esi, eax
test ebp, ebp
je 0x454c64
cmp byte [ebp], 0
je 0x454c64
push ebp
call fcn.0044fa00
mov edi, eax
add esp, 4
mov ecx, edi
jmp 0x454c8a
lea eax, [esp + 0x1c]
push eax
push 0x108
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x454d24
xor eax, eax
lea ecx, [esp + 0x1c]
mov word [esp + 0x22a], ax
lea eax, [esp + 0x22c]
test esi, esi
push eax
push 0
mov eax, 0x4be5f8
cmovne eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
test ebx, ebx
je 0x454cc5
push 0x107
push dword [esp + 0x14]
lea eax, [esp + 0x234]
push eax
call fcn.0042a4f0
add esp, 0xc
test esi, esi
je 0x454cd2
push esi
call fcn.00434080
add esp, 4
test edi, edi
je 0x454cdf
push edi
call fcn.00434080
add esp, 4
push 0
push ebx
call fcn.00450740
add esp, 8
call fcn.00432080
test ebx, ebx
je 0x454d30
push 0x210
push dword [esp + 0x450]
push dword [esp + 0x18]
call fcn.0044ed30
add esp, 0xc
cmp eax, 0xffffffff
jne 0x454d33
sub dword [esp + 0x14], 1
je 0x454d30
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
jmp 0x454c30
push 0
push 0
call fcn.00450740
add esp, 8
or eax, 0xffffffff
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a209e
add esp, 0x430
ret

Function at 0x454eb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
lea eax, [esp + 4]
push edi
push eax
push 0x108
or edi, 0xffffffff
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x454f47
xor eax, eax
xor edi, edi
push 0x107
mov word [esp + 0x21a], ax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0042a4f0
add esp, 0xc
cmp byte [esi], 0
je 0x454f47
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454f10
sub ecx, edx
cmp byte [esi + ecx - 1], 0x5c
je 0x454f50
mov eax, edi
cmp ecx, 0x107
jge 0x454f52
pop edi
mov word [esi + ecx], 0x5c
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004a209e
add esp, 0x214
ret
mov word [esi], 0x5c2e
mov byte [esi + 2], 0
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
call fcn.004a209e
add esp, 0x214
ret
Function at 0x4556b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
xor edi, edi
test esi, esi
je 0x4557e5
call fcn.00433dc0
cmp dword [0x4d4978], edi
jne 0x455723
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x455706
push str.GetFinalPathNameByHandleW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d4978], eax
jmp 0x45570b
mov eax, dword [0x4d4978]
test eax, eax
jne 0x455723
push 1
call fcn.00450720
add esp, 4
call fcn.00432080
jmp 0x4557ef
push esi
call fcn.0044fa00
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x455745
test al, 0x10
je 0x455745
mov ecx, 1
jmp 0x455747
xor ecx, ecx
push 0
test ecx, ecx
mov edx, 0x2000010
mov eax, 0x80
cmovne eax, edx
push eax
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
cmp eax, 0xffffffff
jne 0x45577e
push 0
call fcn.00450740
add esp, 8
jmp 0x4557d1
push 0x108
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [0x4d4978]
cmp eax, 0x108
jae 0x4557c7
test eax, eax
je 0x4557b9
add eax, eax
cmp eax, 0x210
jae 0x455808
xor ecx, ecx
mov word [esp + eax + 8], cx
lea eax, [esp + 8]
push eax
call fcn.0042a460
add esp, 4
mov edi, eax
push 0
push 1
call fcn.00450740
add esp, 8
jmp 0x4557d1
push 9
call fcn.00450720
add esp, 4
test esi, esi
je 0x4557de
push esi
call fcn.00434080
add esp, 4
call fcn.00432080
jmp 0x4557ef
push 2
call fcn.00450720
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004a209e
add esp, 0x214
ret
call fcn.004a1fc4
int3

Function at 0x455810
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x4558e5
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4558e5
call fcn.00433dc0
cmp dword [0x4d4974], 0
jne 0x455879
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45585a
push str.CreateSymbolicLinkW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d4974], eax
jmp 0x45585f
mov eax, dword [0x4d4974]
test eax, eax
jne 0x455879
push 1
call fcn.00450720
add esp, 4
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
ret
push ebx
push edi
call fcn.0044fa00
push esi
mov ebx, eax
call fcn.0044fa00
add esp, 8
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4558a4
test al, 0x10
je 0x4558a4
mov eax, 1
jmp 0x4558a6
xor eax, eax
push eax
push edi
push ebx
call dword [0x4d4974]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00450740
add esp, 8
test ebx, ebx
je 0x4558cd
push ebx
call fcn.00434080
add esp, 4
pop ebx
test edi, edi
je 0x4558db
push edi
call fcn.00434080
add esp, 4
call fcn.00432080
pop edi
mov eax, esi
pop esi
ret
push 2
call fcn.00450720
add esp, 4
xor eax, eax
pop edi
pop esi
ret
Function at 0x455bb0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push ebx
xor esi, esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov edi, dword [esp + 0x14]
test eax, eax
je 0x455cae
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x455cae
push ebp
push ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
je 0x455ca3
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x455c9f
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, ebx
mov esi, eax
sub ecx, 1
je 0x455c44
sub ecx, 6
je 0x455c44
sub ecx, 6
jne 0x455c50
shr esi, 1
push esi
push edi
call fcn.00433eb0
mov esi, eax
add esp, 8
test esi, esi
je 0x455c92
push esi
push edi
mov edi, dword [esp + 0x20]
push 0
push edi
call fcn.00425420
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x455ca3
push esi
push edi
call fcn.00460160
add esp, 8
mov esi, eax
test esi, esi
je 0x455c92
cmp ebx, 1
jne 0x455c77
call fcn.0042c9a0
push esi
push edi
mov edi, dword [esp + 0x20]
push eax
push edi
call fcn.00425390
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x455ca3
push esi
push edi
mov edi, dword [esp + 0x20]
xor eax, eax
push eax
push edi
call fcn.00425390
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x455ca3
mov edi, dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x455ca3
mov edi, dword [esp + 0x18]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebp
test esi, esi
jne 0x455cb9
push 0
push edi
call fcn.00424870
add esp, 8
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
ret
Function at 0x455cd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x455da8
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebp, dword [esp + 0x18]
push ebx
push ebx
cmp ebp, 0xd
jne 0x455d04
mov esi, dword [esp + 0x24]
push ebx
push esi
call fcn.00423cc0
jmp 0x455d14
call fcn.0042c9a0
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.00423c50
add esp, 0x10
test eax, eax
je 0x455d9a
lea ecx, [eax + 1]
xor eax, eax
cmp ebp, 0xd
mov dword [esp + 0x10], ecx
sete al
inc eax
imul eax, ecx
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x455d9f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x455d85
push dword [esp + 0x10]
push eax
cmp ebp, 0xd
jne 0x455d5c
push 0
push esi
call fcn.00423cc0
jmp 0x455d68
call fcn.0042c9a0
push eax
push esi
call fcn.00423c50
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push ebp
call dword [sym.imp.USER32.dll_SetClipboardData]
xor ebx, ebx
test eax, eax
setne bl
test eax, eax
jne 0x455d9f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
mov ebx, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x45ee00
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xc10
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0xc0c], eax
mov eax, dword [esp + 0xc24]
push ebx
mov ebx, dword [esp + 0xc1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc2c]
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0xc1c]
push esi
push edi
mov edi, dword [esp + 0xc30]
mov dword [esp + 0x18], edi
test ebx, ebx
je 0x45ee61
nop dword [eax + eax]
mov al, byte [ebx]
cmp al, 0x2e
je 0x45ee5e
cmp al, 0x2f
je 0x45ee5e
cmp al, 0x5c
jne 0x45ee66
inc ebx
jmp 0x45ee50
mov ebx, 0x4baf8d
cmp ebp, 6
ja 0x45ee74
mov ebp, dword [ebp*4 + 0x4d2804]
jmp 0x45ee79
mov ebp, str._____
cmp dword [0x4d27fc], 0
mov esi, dword [esp + 0xc2c]
jle 0x45ef6f
call fcn.004152d0
test eax, eax
je 0x45eec4
push dword [esp + 0x10]
call fcn.00460a50
add esp, 4
cmp eax, 0x10
jle 0x45eec4
push dword [esp + 0x10]
lea eax, [esp + 0x820]
push str.more_then_16_parameters_in_message__s
push 0x400
push eax
call fcn.00460d40
jmp 0x45eede
push dword [esp + 0x14]
lea eax, [esp + 0x820]
push dword [esp + 0x14]
push 0x400
push eax
call fcn.00460d60
add esp, 0x10
lea eax, [esp + 0x81c]
push eax
lea eax, [esp + 0x20]
push ebp
test edi, edi
je 0x45ef0a
push edi
push esi
push ebx
push str._s:_d:_s____s__s_n
push 0x400
push eax
call fcn.00460d40
add esp, 0x20
jmp 0x45ef1f
push esi
push ebx
push str._s:_d:__s__s_n
push 0x400
push eax
call fcn.00460d40
add esp, 0x1c
push 0x400
lea eax, [esp + 0x20]
mov ecx, 0x100
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x828]
push eax
push 0
lea esi, [esp + 0x30]
lea edi, [esp + 0x830]
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
mov word [esp + 0x81a], ax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [esp + 0xc2c]
mov edi, dword [esp + 0x18]
push ebp
test edi, edi
je 0x45ef8c
push edi
push esi
push ebx
push str._s:_d:_s__:__s
push dword [0x4d4ad8]
call fcn.0041f730
add esp, 0x18
jmp 0x45efa1
push esi
push ebx
push str._s:_d:__s
push dword [0x4d4ad8]
call fcn.0041f730
add esp, 0x14
push dword [esp + 0x14]
push 0
push dword [esp + 0x18]
push dword [0x4d4ad8]
call fcn.0041f680
push dword [eax + 4]
push dword [eax]
call fcn.004a60e4
push 0x4bb938
push dword [0x4d4ad8]
call fcn.0041f730
add esp, 0x20
cmp dword [0x4d27f8], 0
pop edi
pop esi
pop ebp
pop ebx
jle 0x45efee
push dword [0x4d4ad8]
call fcn.004a8013
add esp, 4
mov ecx, dword [esp + 0xc0c]
xor ecx, esp
call fcn.004a209e
add esp, 0xc10
ret

Function at 0x45f700
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
inc eax
push eax
call fcn.004340b0
push dword [edi]
mov esi, eax
push dword [esp + 0x18]
push esi
call fcn.004a34e0
mov ecx, dword [edi]
add esp, 0x10
cmp dword [esp + 0xc], 1
mov byte [esi + ecx], 0
jne 0x45f73c
xor eax, eax
cmp dword [edi], eax
jbe 0x45f73c
xor byte [eax + esi], 0xf3
inc eax
cmp eax, dword [edi]
jb 0x45f733
pop edi
mov eax, esi
pop esi
ret