joyce8/EMBER2024-capa huggingface dataset:
Function at 0x521330
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, ecx
mov dword [eax], 1
mov ax, word [esp + 0x230]
mov ebp, dword [esi + 0xc4]
lea ebx, [esi + 0xc4]
cmp ax, 0x84ec
push edi
jne 0x52136b
mov dword [ebx], 0
jmp 0x5214db
cmp ax, 0x84ed
jne 0x52137c
mov dword [ebx], 1
jmp 0x5214db
cmp ax, 0x84ee
jne 0x52138d
mov dword [ebx], 2
jmp 0x5214db
cmp ax, 0x84ef
jne 0x52139e
mov dword [ebx], 3
jmp 0x5214db
cmp ax, 0x84f0
jne 0x5214ce
mov ecx, dword [esi + 0xec]
push ecx
lea ecx, [esp + 0x20]
call fcn.00510710
lea edx, [esp + 0x18]
lea ecx, [esp + 0x1c]
push edx
call fcn.00511000
mov edi, eax
mov eax, dword [0x547570]
mov ecx, str.MEDIA2017_IZASSHJ
mov dword [esp + 0x10], eax
test ecx, ecx
jne 0x5213de
xor eax, eax
jmp 0x5213e9
push str.MEDIA2017_IZASSHJ
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
push ecx
mov edx, dword [ecx - 8]
lea ecx, [esp + 0x14]
push edx
push str.MEDIA2017_IZASSHJ
push eax
call fcn.004059f0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call fcn.00405440
mov eax, dword [esp + 0x10]
mov edx, dword [0x547574]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x52143e
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x52143e
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x521469
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x521469
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov ecx, dword [0x55f3b8]
lea eax, [esp + 0x24]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [esp + 0x14]
push 5
push 0
lea eax, [esp + 0x2c]
push edx
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x5214c3
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x5214c3
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.00510740
jmp 0x5214db
cmp ax, 0x84f3
jne 0x5214db
mov ecx, esi
call fcn.0051d900
push ebx
push ecx
mov ecx, esp
push str.m_type
call fcn.00412590
mov ecx, esi
call fcn.0051e130
cmp ebp, dword [ebx]
je 0x521558
lea eax, [esi + 0xc8]
push eax
push ecx
mov ecx, esp
push 0x550d80
mov dword [eax], 0
call fcn.00405730
mov ecx, esi
call fcn.0051e130
mov eax, dword [esi + 0xec]
mov ecx, esi
push eax
call fcn.005201c0
mov ecx, esi
call fcn.00521570
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
add esi, 0x98
mov eax, dword [esi]
test eax, eax
je 0x52154f
mov edx, dword [ebx]
xor ecx, ecx
cmp edx, edi
setne cl
dec ecx
and ecx, 5
push ecx
push eax
call ebp
inc edi
add esi, 4
cmp edi, 5
jl 0x521538
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x21c
ret 0x10
Function at 0x525cf0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
push eax
push 2
push ecx
mov ecx, esi
mov dword [esi], 0x543194
call fcn.00525ea0
mov eax, dword [esi + 8]
test eax, eax
je 0x525d21
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xc]
mov ecx, dword [0x547574]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x525d4e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x525d4e
mov eax, dword [esi + 0xc]
sub eax, 0xc
push eax
call fcn.00532222
add esp, 4
pop esi
ret

Function at 0x525d50
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
push eax
push 2
push ecx
mov ecx, esi
call fcn.00525ea0
mov eax, dword [esi + 8]
test eax, eax
je 0x525d82
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
pop esi
ret

Function at 0x525f40
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.Shell_TrayWnd
push 0
push 0
call esi
test eax, eax
je 0x525f7c
push 0
push str.TrayNotifyWnd
push 0
push eax
call esi
test eax, eax
je 0x525f7c
mov ecx, dword [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
pop esi
add esp, 0x24
ret
lea edx, [esp + 4]
mov dword [esp + 4], 0x24
push edx
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x525ff5
mov eax, dword [esp + 0x10]
cmp eax, 3
ja case.default.0x525fa2
jmp dword [eax*4 + 0x526070]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
pop esi
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov dword [eax + 8], edx
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
pop esi
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0xc], edx
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
add esp, 0x24
ret
push 0
push str.Shell_TrayWnd
push 0
push 0
call esi
test eax, eax
je 0x526044
mov esi, dword [esp + 0x2c]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov edx, dword [esi]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x96
jle 0x52602a
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov edx, eax
sub edx, ecx
cmp edx, 0x1e
jle case.default.0x525fa2
add eax, 0xffffffe2
mov dword [esi + 4], eax
pop esi
add esp, 0x24
ret
mov esi, dword [esp + 0x2c]
push 0
push esi
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub eax, 0x96
sub ecx, 0x1e
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
add esp, 0x24
ret
Function at 0x5260b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
push esi
call fcn.00526080
mov esi, dword [esp + 0x28]
test eax, eax
je 0x5260ed
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 4]
push ecx
call fcn.00525f40
add esp, 4
lea edx, [esp + 4]
lea eax, [esp + 0x14]
push edx
push eax
push 3
push esi
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x20
ret 4

Function at 0x5263c0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
lea ebx, [ebp + 0xc]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebx]
push edi
cmp eax, esi
je 0x526474
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
mov edx, dword [0x547574]
jge 0x5263fc
lea edi, [eax - 0xc]
cmp edi, edx
jne 0x526405
cmp dword [esi - 0xc], 0
lea edi, [esi - 0xc]
jge 0x526444
mov edi, dword [esi - 8]
mov ecx, ebx
push edi
mov dword [esp + 0x18], edi
call fcn.00405660
test eax, eax
je 0x526474
lea eax, [edi + edi]
mov edi, dword [ebx]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x1c]
mov dword [ecx - 8], edx
mov ecx, dword [ebx]
mov word [eax + ecx], 0
jmp 0x526474
add eax, 0xfffffff4
cmp eax, edx
je 0x52646b
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x526464
mov edx, dword [ebx]
sub edx, 0xc
push edx
call fcn.00532222
add esp, 4
mov eax, dword [0x547570]
mov dword [ebx], eax
push edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, ebp
call fcn.00526260
mov eax, dword [esp + 0x20]
test eax, eax
je 0x526486
mov dword [ebp + 0x18], eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5264ba
mov eax, dword [ebp + 8]
test eax, eax
je 0x5264a1
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [ebp + 4]
push ecx
push 0
push ebp
push 0x5264f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], eax
mov eax, dword [0x547574]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x5264dd
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x5264dd
push esi
call fcn.00532222
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14

Function at 0x526a00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
test eax, eax
je 0x526a4a
mov eax, dword [esi + 4]
push 0x23
push 0x5490b4
push str.Save_the_changes__
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
je 0x526a45
cmp eax, 6
jne 0x526a45
mov ecx, dword [esi + 4]
push 0
push 0x3fb
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop esi
ret 0x10
cmp eax, 2
je 0x526a60
mov dword [0x55e0e0], 0
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10
Function at 0x529d70
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
mov ecx, 0xad
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c0]
pop edi
test eax, eax
mov eax, dword [esp + 0x2c0]
je 0x529db2
neg eax
sbb eax, eax
lea ecx, [esp]
and eax, 2
or eax, 0x4011
push eax
push 0x2b4
push ecx
push 0x10
jmp 0x529dce
neg eax
sbb eax, eax
lea ecx, [esp]
and eax, 2
or eax, 0x4011
push eax
push 0x2b4
push ecx
push 0x80
mov edx, dword [esp + 0x2c8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 4]
add esp, 0x2b4
ret

Function at 0x529ed0
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edx, dword [0x563b70]
sub esp, 0x2b8
xor eax, eax
push esi
mov esi, dword [esp + 0x2c0]
test edx, edx
push edi
jle 0x529f01
mov ecx, dword [0x563b68]
cmp dword [ecx], esi
je 0x529fd9
inc eax
add ecx, 4
cmp eax, edx
jl 0x529ef1
lea edx, [esp + 8]
mov dword [esp + 8], 0
push edx
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, 0xad
xor eax, eax
lea edi, [esp + 0xc]
mov edx, dword [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c8]
lea ecx, [esp + 0xc]
or eax, 0x4008
push eax
push 0x2b4
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x10]
push 0
push eax
call fcn.00529df0
mov ecx, dword [0x563b70]
mov edi, eax
mov eax, dword [0x563b68]
lea edx, [ecx*4 + 4]
push edx
push eax
call fcn.005326a3
add esp, 0x10
test eax, eax
je 0x529fce
mov ecx, dword [0x563b70]
mov dword [0x563b68], eax
mov eax, dword [0x563b6c]
lea edx, [ecx*4 + 4]
push edx
push eax
call fcn.005326a3
add esp, 8
test eax, eax
je 0x529fce
mov edx, dword [0x563b68]
mov dword [0x563b6c], eax
mov eax, dword [0x563b70]
inc eax
mov dword [0x563b70], eax
lea ecx, [eax*4 - 4]
lea eax, [ecx + edx]
test eax, eax
je 0x529fc1
mov dword [eax], esi
mov eax, dword [0x563b6c]
add eax, ecx
test eax, eax
je 0x529fce
mov dword [eax], edi
mov eax, edi
pop edi
pop esi
add esp, 0x2b8
ret
cmp eax, 0xffffffff
je 0x529f01
mov ecx, dword [0x563b6c]
pop edi
pop esi
mov eax, dword [ecx + eax*4]
add esp, 0x2b8
ret
Function at 0x52de70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x55f48c]
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
and ebx, 0xffff
push 0xf1
push ebx
mov edi, ecx
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x52dea5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x52debb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x52ded0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
xor esi, esi
lea ecx, [eax + 8]
mov si, word [eax + 6]
mov eax, dword [edi + 0xcc]
test eax, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x34], esi
jne 0x52def3
push esi
mov ecx, edi
call fcn.0052d450
mov edx, dword [0x55f48c]
push ebx
push edx
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x52df15
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0x10
je 0x52e014
push 1
mov ecx, edi
call fcn.0052d450
lea eax, [esp + 0x18]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x20]
push 1
push 1
push 0x21
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov ecx, dword [edi + 0x40f0]
mov ebx, eax
push ecx
push ebp
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
jne 0x52df71
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov ebp, eax
xor esi, esi
test ebp, ebp
jle 0x52df9f
push 0
push esi
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov edx, dword [edi + 0xcc]
push eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
inc esi
cmp esi, ebp
jl 0x52df80
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test ebp, ebp
je 0x52dfb5
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov esi, dword [esp + 0x34]
test esi, esi
jle 0x52dfee
mov ecx, dword [esp + 0x14]
mov ax, word [ecx]
test ax, ax
je 0x52dfe8
mov edx, dword [edi + 0x40e4]
and eax, 0xffff
mov dword [edi + edx*4 + 0xe4], eax
mov eax, dword [edi + 0x40e4]
inc eax
mov dword [edi + 0x40e4], eax
add ecx, 2
dec esi
jne 0x52dfc1
mov eax, dword [edi + 0xcc]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov edx, dword [edi + 0x40e4]
xor ecx, ecx
cmp eax, edx
pop edi
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x20
ret 4
mov ecx, dword [edi + 0x40f0]
mov edx, dword [edi + 0xcc]
push ecx
push ebp
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
jne 0x52dfb9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x52f580
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x52f5e5
mov eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x6c]
push eax
push ecx
mov dword [esi + 0x9c], 0
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esi + 0x6c]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], 0
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esi + 0x64]
push 0
push ecx
mov dword [esi + 0x70], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x64]
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_KillTimer]
pop esi
ret

Function at 0x52f600
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x6c]
cmp eax, edi
je 0x52f63a
mov ecx, dword [esi + 0x98]
push ecx
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esi + 0x6c]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x70], edi
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [esi + 0x74], eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
mov dword [esi + 0x78], eax
call ebx
push eax
push 0x4e
call ebx
push eax
push 0x4d
call ebx
push eax
push 0x4c
call ebx
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, eax
sub ecx, edx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x74], ecx
mov ecx, dword [esp + 0x1c]
mov ebp, ecx
mov dword [esi + 0x80], ebx
sub ebp, ebx
mov dword [esi + 0x78], ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x52f6d2
mov dword [esi + 0x20], 1
mov edx, dword [ebp]
mov ebx, dword [ebp + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jmp 0x52f6d9
mov dword [esi + 0x20], 0
sub eax, edx
sub ecx, ebx
add eax, 8
add ecx, 8
push edi
mov ebp, eax
mov ebx, ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov dword [esi + 0x6c], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push ebx
push ebp
push edi
mov dword [esi + 0x98], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edx, dword [esi + 0x6c]
push eax
push edx
mov dword [esi + 0x70], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x6c]
push 0xcc0020
push eax
push ecx
push edi
push ebx
push ebp
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x52f750
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x64]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x52f769
pop esi
add esp, 8
ret
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x44]
mov dword [esi + 0x9c], 1
test eax, eax
jne 0x52f79c
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x52f795
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0052f5f0
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x8c]
push edx
push eax
mov ecx, esi
call fcn.0052e6e0
mov ecx, dword [esi + 0x64]
push 0
push 0xa
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi + 0x64]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
push 1
mov ecx, esi
call fcn.0052fcf0
mov eax, dword [esi + 0x64]
push 0x63
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x530040
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5300f1
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [ebp + 0x64]
mov esi, eax
xor eax, eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push esi
sub edi, ecx
sub ebx, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x6c]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, dword [esp + 0x10]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
mov ecx, ebp
call fcn.0052f800
push edi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x14
ret 4
Function at 0x530100
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x5301bb
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
test eax, eax
je 0x5301bb
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5301bb
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call esi
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x5301b5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov dword [ebp - 4], eax
call esi
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00532230
mov eax, dword [ebp + 8]
mov edi, esp
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5301e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x40
lea ecx, [esp]
call fcn.00524330
mov eax, dword [0x547570]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], eax
call fcn.0044bec0
mov ecx, dword [esp + 4]
mov dword [esp], 0x5431f8
push ecx
mov dword [esp + 0x3c], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x530243
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x53023d
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [0x563e54], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [0x563e54]
test eax, eax
je 0x530262
push eax
lea ecx, [esp + 0x2c]
call fcn.0044bf80
test eax, eax
je 0x530262
mov dword [esp + 0x38], 1
push esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0x55f3b0
call fcn.0040f710
mov ecx, dword [0x55f3b8]
push 0
push 0x4141a0
push esi
push 0x1d5
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edx, dword [esp + 0x28]
pop esi
lea ecx, [esp + 0x28]
cmp dword [edx - 8], 4
jle 0x5302e5
call fcn.0044bf40
mov eax, dword [esp + 0x24]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x5302dc
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x5302dc
mov edx, dword [esp + 0x24]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, 1
add esp, 0x40
ret
call fcn.0044bf40
mov eax, dword [esp + 0x24]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x530319
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x530319
mov edx, dword [esp + 0x24]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
xor eax, eax
add esp, 0x40
ret