joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f128
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a54
test eax, eax
jne 0x40f14c
push 0x57
call sub.kernel32.dll_SetLastError
jmp 0x40f1cb
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40f1cb
xor eax, eax
push ebp
push 0x40f1bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
test ecx, ecx
jns 0x40f17d
call fcn.00403edc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00403348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f1c4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414630
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
call fcn.004144e4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.004038b8
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
push 0x10
push 0x3000
mov eax, dword [ebp - 0x24]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x414691
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
mov eax, ebx
call fcn.0041462c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41469d
push 0x8000
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFree_1
test bl, bl
je 0x4146b9
mov eax, dword [0x565cbc]
or dword [eax], 0x10
xor ebx, ebx
xor eax, eax
test al, al
je 0x41473d
push 4
push 0x3000
mov eax, dword [ebp - 0x24]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
mov esi, fcn.0041462c
mov eax, esi
mov edx, 0x32
call fcn.00414210
mov ebx, eax
test ebx, ebx
jns 0x4146f2
call fcn.00403edc
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, ebx
call fcn.00403348
mov eax, dword [ebp - 4]
xor edx, edx
push ebp
push 0x414721
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, eax
mov eax, ebx
call esi
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41472d
push 0x8000
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFree_1
test bl, bl
je 0x414756
mov eax, dword [0x565e08]
mov eax, dword [eax]
or eax, 2
or eax, 4
mov edx, dword [0x565e08]
mov dword [edx], eax
call fcn.004145d8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415e38
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov edi, eax
mov ebx, dword [ebp + 8]
test bl, bl
je 0x415f58
mov eax, ebx
cmp al, 7
ja 0x415e64
and eax, 0x7f
bt dword [0x55e130], eax
jb 0x415f58
mov esi, 0xcc
movzx eax, bl
cmp eax, 6
ja case.0x415e7b.0
jmp dword [eax*4 + 0x415e82]
push 0x415f64
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415f1c
push 0x415f7c
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415f1c
push 0x415f94
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415f1c
push 0x415fb0
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415f1c
push 0x415fc4
call sub.kernel32.dll_OutputDebugStringA
jmp 0x415f1c
push 0x415fe0
call sub.kernel32.dll_OutputDebugStringA
mov esi, 0xcb
mov eax, dword [0x669f48]
call fcn.0040e49c
test al, al
je 0x415f1c
push 0x8000
push 0
mov eax, dword [0x669f48]
push eax
call sub.kernel32.dll_VirtualFree_1
xor eax, eax
mov dword [0x669f48], eax
jmp 0x415f1c
push 0x415ffc
call sub.kernel32.dll_OutputDebugStringA
cmp dword [0x55e134], 0
jne 0x415f3a
mov eax, esi
cmp eax, 0xff
jbe 0x415f33
call fcn.00403edc
call fcn.00404f4c
jmp 0x415f58
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp - 1]
mov eax, edi
call dword [0x55e134]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x14

Function at 0x419ea8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00419c14
pop ecx
lea eax, [ebp - 0x2c]
call fcn.00402c98
cmp dword [ebp - 0x20], 0
je 0x419ee1
mov ecx, 0x242010
mov edx, 0x419fa8
mov eax, 0x419fdc
call fcn.00415d84
jmp 0x419f98
xor eax, eax
push ebp
push 0x419f91
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x419f70
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov esi, eax
mov edi, 0x55e188
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x55e1a0
mov esi, eax
mov edi, edx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
call fcn.00419a60
mov eax, 0x55e188
call fcn.00403134
mov byte [0x669f0e], 1
mov byte [0x669f0f], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419f77
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a0ec
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00419c14
pop ecx
lea eax, [ebp - 0x2c]
call fcn.00402c98
cmp dword [ebp - 0x20], 0
je 0x41a126
mov ecx, 0x242010
mov edx, 0x41a2e0
mov eax, 0x41a314
call fcn.00415d84
jmp 0x41a2ce
xor eax, eax
push ebp
push 0x41a2bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41a29c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.0040e9d4
test al, al
je 0x41a17d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0xc
call fcn.0040e9d4
test al, al
jne 0x41a18c
mov eax, 0x55e1a0
call fcn.00403120
jmp 0x41a26d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x18
call fcn.0040e9d4
test al, al
je 0x41a224
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov esi, eax
mov edi, 0x55e188
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [0x55e194]
test ebx, ebx
je 0x41a1d0
mov edx, 1
mov eax, ebx
call fcn.0040ea20
test al, al
jne 0x41a1da
mov dword [0x55e194], 0x4180d8
mov ebx, dword [0x55e198]
test ebx, ebx
je 0x41a1f4
mov edx, 1
mov eax, ebx
call fcn.0040ea20
test al, al
jne 0x41a1fe
mov dword [0x55e198], 0x4180fc
mov ebx, dword [0x55e19c]
test ebx, ebx
je 0x41a218
mov edx, 1
mov eax, ebx
call fcn.0040ea20
test al, al
jne 0x41a25c
mov dword [0x55e19c], 0x418148
jmp 0x41a25c
mov eax, 0x55e188
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov dword [0x55e194], 0x4180d8
mov dword [0x55e198], 0x4180fc
mov dword [0x55e19c], 0x418148
mov esi, 0x55e188
mov edi, 0x55e1a0
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, 0x55e188
call fcn.00403134
mov byte [0x669f0e], 1
mov byte [0x669f0f], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a2a3
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bd24
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
test esi, esi
jne 0x41bd3a
call fcn.0040f584
mov esi, eax
xor ebx, ebx
xor ecx, ecx
push ebp
push 0x41bdba
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, esi
cmp word [edx], 0x5a4d
jne 0x41bdb0
mov eax, edx
add eax, 0x3c
mov eax, dword [eax]
test eax, eax
je 0x41bdb0
mov edi, edx
add edi, eax
mov edx, dword [edi]
cmp edx, 0x4550
jne 0x41bdb0
lea edx, [ebp - 0x14]
add edi, 4
mov eax, edi
mov ecx, 0x14
call fcn.00403348
test byte [ebp - 1], 0x20
je 0x41bdae
push 0xa
push 0x41bdd0
push esi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x41bdaa
push 0xa
push 0x41bddc
push esi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x41bdaa
mov bl, 3
jmp 0x41bdb0
mov bl, 2
jmp 0x41bdb0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41bdc6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41bf94
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
test eax, eax
jns 0x41bfae
call fcn.00403edc
push eax
push 0x41bf54
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret
Function at 0x41d60c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.0041c5d8
test al, al
je 0x41d653
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x41d653
cmp dword [eax + 0x3c], 0
je 0x41d653
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.0041c5d8
test al, al
je 0x41d651
cmp dword [esi], 0x4550
je 0x41d653
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x427be4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x427c74
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x427c74
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x427c27
test edx, 3
jne 0x427c16
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x427c21
jmp 0x427c27
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x427c27
cmp dword [ecx - 8], 1
je 0x427c31
mov edx, ebx
or edx, 3
call fcn.00405794
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x427c43
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.0040502c

Function at 0x427c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x427d10
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x427d10
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x427cc3
test edx, 3
jne 0x427cb2
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x427cbd
jmp 0x427cc3
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x427cc3
cmp dword [ecx - 8], 1
je 0x427ccd
mov edx, ebx
or edx, 3
call fcn.00405794
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x427cdf
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.0040502c

Function at 0x428b64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x428b7d
test al, 0x10
je 0x428b81
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x428b88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x428ba1
test al, 0x10
jne 0x428ba5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x42bea4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x42bedd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040511c
jmp 0x42bee6
mov eax, ebx
mov edx, esi
call fcn.00405080
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42bef0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x42bf12
movzx eax, byte [esp]
jmp 0x42bf14
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42c5a4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x42c41c
mov eax, dword [0x566188]
cmp byte [eax], 0
je 0x42c620
mov eax, dword [0x565dbc]
call fcn.00403708
call fcn.00403230
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00429298
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x42c668
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x42c656
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x565d2c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5697f8]
call fcn.00406acc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x42cf20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cff6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 4]
call fcn.0040555c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x42cfe0
mov eax, ebx
call fcn.0040309c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42cfd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x42cfc3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42d008
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42cfc3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cfe0
mov eax, dword [ebp - 0x10]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cffd
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x42e648
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.0040502c
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040550c
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x42e68d
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040511c
jmp 0x42e6a6
mov edx, ebx
dec edx
mov eax, esi
call fcn.00405794
push ebx
mov eax, dword [esi]
call fcn.0040550c
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x444d00
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00444a10
dec esi
jne 0x444d22
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x445e94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x66aed4
cmp dword [edi], 0
jne 0x445f10
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x66aed0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x55e790
mov ecx, 2
call fcn.00403348
mov edx, 0x445e6c
lea eax, [esi + 5]
call fcn.00445e8c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00445e8c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x445ee5
mov dword [0x66aed0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x44611c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x44613c
test al, 0x10
sete al
jmp 0x446163
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x44615d
cmp ebx, 3
je 0x44615d
cmp ebx, 0x7b
je 0x44615d
mov eax, esi
call fcn.004460dc
test al, al
jne 0x446161
xor eax, eax
jmp 0x446163
mov al, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x446194
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4461b0
test al, 0x10
jne 0x4461b5
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x447d40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
add eax, 0x10
test eax, eax
jns 0x447d50
call fcn.00403edc
push eax
push 8
mov eax, dword [0x66b01c]
push eax
call sub.kernel32.dll_HeapAlloc
mov ebx, eax
test ebx, ebx
jne 0x447d7f
mov eax, 0x447d98
call fcn.004470e8
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [str.PLEH]
mov dword [ebx], eax
add ebx, 0x10
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x447fc8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0
push 0x500000
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x66b01c], eax
cmp dword [0x66b01c], 0
jne 0x447ffa
push 0
push 0
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x66b01c], eax
cmp dword [0x66b01c], 0
jne 0x44801e
mov eax, 0x44805c
call fcn.004470e8
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x18], fcn.00447d40
mov dword [ebp - 0x14], 0x447db8
mov dword [ebp - 0x10], 0x447e20
mov dword [ebp - 0xc], 0x447f50
mov dword [ebp - 8], 0x447fc0
mov dword [ebp - 4], 0x447fc4
lea eax, [ebp - 0x18]
call fcn.00403134
mov esp, ebp
pop ebp
ret
Function at 0x44a9bc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.004038b8
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x44aa30
inc dword [ebp - 0x5c]
test ebx, ebx
jbe 0x44aaac
mov edi, 0x40
sub edi, dword [ebp - 0x54]
cmp ebx, edi
jb 0x44aa80
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44aa4d
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, edi
test ecx, ecx
jns 0x44aa5c
call fcn.00403edc
mov eax, esi
call fcn.00403348
mov eax, 0x40
sub eax, dword [ebp - 0x54]
sub ebx, eax
mov eax, 0x40
sub eax, dword [ebp - 0x54]
add esi, eax
push ebp
call fcn.0044a100
pop ecx
jmp 0x44aaa8
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44aa8d
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, ebx
test ecx, ecx
jns 0x44aa9c
call fcn.00403edc
mov eax, esi
call fcn.00403348
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x44aa34
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44aab9
call fcn.00403edc
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x44aacb
push ebp
call fcn.0044a100
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.0044a100
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.00403348
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b254
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44b442
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405a08
call sub.kernel32.dll_GetUserDefaultLCID
mov dword [ebp - 0x10], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x44b417
xor edx, edx
push ebp
push 0x44b410
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
test ebx, ebx
je 0x44b304
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x44b2da
mov eax, dword [ebp - 8]
call fcn.00405a28
inc eax
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, 0xd
call fcn.0044b194
mov eax, dword [ebp - 4]
call fcn.00405308
inc eax
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 1
call fcn.0044b194
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, 0x10
call fcn.0044b194
test esi, esi
je 0x44b3fd
lea eax, [ebp - 0x18]
mov ecx, 0x44b458
mov edx, esi
call fcn.00405358
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00405a08
mov eax, dword [ebp - 0xc]
call fcn.00405a28
add eax, eax
add eax, 0x14
test eax, eax
jns 0x44b33c
call fcn.00403edc
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44b3fd
xor edx, edx
push ebp
push 0x44b3f6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
je 0x44b3d9
xor edx, edx
push ebp
push 0x44b3d2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov dword [eax], 0x14
mov dword [eax + 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.00405a28
mov ecx, eax
add ecx, ecx
mov edx, ebx
add edx, 0x14
mov eax, dword [ebp - 0xc]
call fcn.00403348
mov eax, dword [ebp - 0x14]
push eax
push 0xf
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x44b3bb
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b3d9
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b3fd
cmp dword [ebp - 0x14], 0
je 0x44b3f5
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b417
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b449
lea eax, [ebp - 0x18]
call fcn.0040502c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040586c
lea eax, [ebp - 4]
call fcn.0040502c
ret