joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fb910
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c346d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6510e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x10]
lea ebx, [esi + 0x10]
test ecx, ecx
je 0x4fba64
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4fb954
mov eax, dword [esi]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004e5130
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x4fb969
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
cmp ecx, 8
jb 0x4fb9bd
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4fb9b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4fba7f
push ecx
push edx
call fcn.005815c4
mov eax, dword [ebp - 0x44]
add esp, 8
cmp eax, 0x20
jae 0x4fba64
lea ecx, [ebp - 0x44]
call fcn.00509510
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0x10
jb 0x4fb9dd
mov esi, dword [esi]
push dword [ebx]
lea ecx, [ebp - 0x40]
push esi
call fcn.004e5130
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x4fb9f3
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x4fba3d
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4fba33
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4fba84
push ecx
push edx
call fcn.005815c4
add esp, 8
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x44]
test esi, esi
je 0x4fba64
push 0x61bc08
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4fba5d
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00581335
mov esp, ebp
pop ebp
ret
call fcn.00586698
call fcn.00586698
int3
Function at 0x50f180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c431d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6510e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [ebp - 0x10], ecx
mov dword [esi + 0x38], 1
mov dword [ebp - 4], eax
mov dword [esi], vtable.nana::widgets::skeletons::text_editor::undo_input_text.0
movups xmmword [esi + 0x3c], xmm0
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
jb 0x50f22b
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
cmp eax, 0x7ffffffe
ja 0x50f2fb
mov dword [esi + 0x50], 7
cmp eax, 8
jae 0x50f251
mov dword [esi + 0x4c], eax
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x3c], xmm0
jmp 0x50f2e1
mov edi, eax
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x50f265
mov edi, SysReAllocString
jmp 0x50f26f
mov eax, 0xa
cmp edi, eax
cmovb edi, eax
xor ecx, ecx
mov eax, edi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x7fffffff
ja 0x50f2f6
add ecx, ecx
cmp ecx, 0x1000
jb 0x50f2b0
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x50f2f6
push eax
call fcn.00581343
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x50f300
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x50f2c1
test ecx, ecx
je 0x50f2bf
push ecx
call fcn.00581343
add esp, 4
jmp 0x50f2c1
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x50], edi
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x10]
push eax
call fcn.00582dc0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.00401549
call fcn.004015ed
call fcn.00586698
int3
Function at 0x511840
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c45df
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6510e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
push 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00581343
add esp, 4
mov dword [eax + 4], 0
mov dword [edi], eax
mov dword [eax], edi
mov dword [edi + 0x14], 0x1e
mov dword [edi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x6c], 0
mov byte [edi + 0x70], 1
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov byte [ebp - 4], 2
lea esi, [edi + 0x84]
mov dword [edi + 0x80], 0xffffffff
mov dword [ebp - 0x18], esi
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00581343
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov dword [esi + 0x14], 0
xorps xmm0, xmm0
mov word [esi + 0x18], 0
xor eax, eax
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 7
mov word [esi + 0x1c], ax
movups xmmword [esi + 0x34], xmm0
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 7
mov word [esi + 0x34], ax
mov byte [ebp - 4], 5
mov ecx, esi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
call fcn.0051c880
mov dword [edi + 0xd8], 0
mov dword [edi + 0xdc], vtable.nana::widgets::skeletons::colored_area_access.0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe8], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0x11c], 0
lea ecx, [edi + 0x120]
mov byte [ebp - 4], 8
mov dword [ebp - 0x18], ecx
mov byte [ecx], 0
add ecx, 4
call fcn.0047b1b0
mov byte [edi + 0x128], 0
mov dword [edi + 0x154], 0
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x158]
mov dword [ebp - 0x18], esi
push 0x30
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00581343
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
add esi, 8
mov byte [ebp - 4], 0xb
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00581343
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov eax, edi
mov dword [edi + 0x174], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x520690
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.0051fec0
Function at 0x5218e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
add eax, 0xfffffe00
mov ebx, edx
mov dword [edi + 0xc], ebx
cmp eax, 9
ja case.default.0x5218fd
jmp dword [eax*4 + 0x5219f8]
mov dword [edi + 0x18], 1
mov eax, 5
jmp 0x521990
mov dword [edi + 0x18], 3
mov eax, 5
jmp 0x521990
mov dword [edi + 0x18], 2
mov eax, 5
jmp 0x521990
mov dword [edi + 0x18], 1
mov eax, 6
jmp 0x521990
mov dword [edi + 0x18], 3
mov eax, 6
jmp 0x521990
mov dword [edi + 0x18], 2
mov eax, 6
jmp 0x521990
mov dword [edi + 0x18], 1
movzx eax, byte [ebx + 0x74]
shr eax, 1
shl eax, 2
not eax
and eax, 4
or eax, 1
jmp 0x521990
mov dword [edi + 0x18], 2
jmp 0x52195f
mov dword [edi + 0x18], 3
jmp 0x52195f
mov dword [edi + 0x18], 0
mov eax, 3
push esi
mov esi, dword [ebp + 0xc]
mov edx, 8
push 0x12
mov dword [ecx + edx], eax
movsx eax, word [esi + 4]
sub eax, dword [ebx + 4]
mov dword [edi + 0x10], eax
movsx eax, word [esi + 6]
sub eax, dword [ebx + 8]
mov dword [edi + 0x14], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
mov byte [edi + 0x1f], al
movzx eax, byte [esi]
shr al, 2
and al, 1
mov byte [edi + 0x20], al
movzx eax, byte [esi]
shr al, 3
and al, 1
mov byte [edi + 0x21], al
movzx eax, byte [esi]
and al, 1
mov byte [edi + 0x1c], al
movzx eax, byte [esi]
shr al, 4
and al, 1
mov byte [edi + 0x1d], al
movzx eax, byte [esi]
shr al, 1
and al, 1
mov byte [edi + 0x1e], al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x528910
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x67d978]
cmp eax, dword [ecx + 4]
jle 0x528a9b
push 0x67d978
call fcn.0058178b
add esp, 4
cmp dword [0x67d978], 0xffffffff
jne 0x528a9b
push esi
push edi
push 0x61c3f8
mov dword [0x67d94c], 0
mov dword [0x67d950], 0
mov dword [0x67d954], 0
mov dword [0x67d958], 0
mov dword [0x67d95c], 0
mov dword [0x67d960], 0
mov dword [0x67d964], 0
mov dword [0x67d968], 0
mov dword [0x67d96c], 0
mov dword [0x67d970], 0
mov dword [0x67d974], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x5289db
push 0x61c3f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x528a50
push str.SetProcessDPIAware
push esi
call edi
push str.GetDpiForWindow
push esi
mov dword [0x67d94c], eax
call edi
push str.GetDpiForSystem
push esi
mov dword [0x67d958], eax
call edi
push str.GetDpiFromDpiAwarenessContext
push esi
mov dword [0x67d95c], eax
call edi
push str.GetThreadDpiAwarenessContext
push esi
mov dword [0x67d964], eax
call edi
push str.SetThreadDpiAwarenessContext
push esi
mov dword [0x67d968], eax
call edi
push str.SetProcessDpiAwarenessContext
push esi
mov dword [0x67d96c], eax
call edi
push 0x61c464
push esi
mov dword [0x67d954], eax
call edi
push str.GetSystemMetricsForDpi
push esi
mov dword [0x67d970], eax
call edi
mov dword [0x67d974], eax
push str.Shcore.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x528a72
push str.Shcore.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x528a8c
push str.SetProcessDpiAwareness
push esi
call edi
push str.GetDpiForMonitor
push esi
mov dword [0x67d950], eax
call edi
mov dword [0x67d960], eax
push 0x67d978
call fcn.0058173a
add esp, 4
pop edi
pop esi
mov eax, 0x67d94c
ret
Function at 0x528ab0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae9b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6510e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov esi, eax
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, eax
jne 0x528b83
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 4
push edi
call ebx
test eax, eax
je 0x528b15
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, eax
jne 0x528b83
push 3
push edi
call ebx
mov esi, eax
test esi, esi
je 0x528b42
push 4
push esi
call ebx
cmp eax, edi
jne 0x528b37
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x14], eax
jne 0x528b83
push 3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x528b20
mov ecx, dword [0x67d6b8]
test ecx, ecx
je 0x528b51
call fcn.004d4710
push dword [ebp - 0x10]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0
mov ecx, dword [0x67d6b8]
test ecx, ecx
je 0x528b8d
call fcn.004d4850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
push edi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x530340
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5866
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x6510e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.nana::detail::basic_window.0
xorps xmm0, xmm0
mov dword [edi + 4], 0
xor eax, eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
movups xmmword [edi + 0x40], xmm0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 7
mov word [edi + 0x40], ax
lea esi, [edi + 0x58]
mov dword [ebp - 4], eax
lea ecx, [esi + 4]
mov dword [ebp - 0x18], esi
call fcn.0047b1b0
push 0x70
mov byte [ebp - 4], 1
call fcn.00581343
add esp, 4
mov byte [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 0
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
mov dword [eax], 0
mov dword [edi + 0x70], ecx
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
lea esi, [edi + 0xb0]
mov byte [ebp - 4], 4
lea ecx, [esi + 8]
mov dword [ebp - 0x18], esi
mov dword [esi], 5
mov dword [esi + 4], 0
call fcn.0047b1b0
mov byte [ebp - 4], 5
push 0x60
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00581343
add esp, 4
mov word [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0x44
mov dword [eax + 0x34], 0
mov dword [eax + 0x5c], 0
mov dword [esi + 0x14], eax
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
push dword [ebx + 8]
mov byte [ebp - 4], 7
xor ecx, ecx
mov eax, dword [edi + 0x60]
mov dword [eax + 4], edi
xor eax, eax
mov dword [edi + 8], ecx
mov dword [edi + 0x10], ecx
mov ecx, edi
mov dword [edi + 4], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
call fcn.00530840
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x531f90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c593e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6510e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov edi, dword [ebp + 8]
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
xor esi, esi
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5320e1
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x532034
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x532034
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x5320e1
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x53204f
mov eax, dword [edi]
xor edx, edx
shr esi, 1
mov dword [edi + 0x10], 0
mov word [eax], dx
mov dword [ebp - 0x14], esi
cmp dword [edi + 0x14], esi
jae 0x532081
mov esi, dword [edi + 0x10]
mov ecx, edi
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
sub eax, esi
push eax
call fcn.00532170
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x10], esi
mov esi, dword [ebp - 0x14]
lea eax, [ecx + esi*2]
push eax
push ecx
mov ecx, edi
call fcn.0051d3a0
cmp dword [edi + 0x14], 8
mov edx, edi
mov esi, dword [edi + 0x10]
jb 0x53209a
mov edx, dword [edi]
test esi, esi
je 0x5320e1
lea eax, [esi - 1]
or ecx, 0xffffffff
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0
lea eax, [edx + ecx*2]
jne 0x5320c0
cmp eax, edx
je 0x5320e1
sub eax, 2
cmp word [eax], 0
je 0x5320b3
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x5320e1
inc eax
cmp esi, eax
jb 0x5320f6
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x5320d8
mov ecx, dword [edi]
xor edx, edx
mov dword [edi + 0x10], eax
mov word [ecx + eax*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00403d10
int3

Function at 0x532100
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 0x14]
xor bl, bl
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x532160
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x53215a
push edi
push dword [ebp + 0x10]
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00582dc0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
pop edi
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop ebx
pop ebp
ret 0x10
Function at 0x534e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5ab5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6510e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
push 0x38
mov dword [edi + 4], 0
call fcn.00581343
mov esi, eax
add esp, 4
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
mov dword [ebp - 4], 1
mov ecx, dword [eax]
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
jb 0x534ef0
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
cmp eax, 0x7fffffff
ja 0x534ff4
mov dword [esi + 0x24], 0xf
cmp eax, 0x10
jae 0x534f16
mov dword [esi + 0x20], eax
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
jmp 0x534fa1
mov edi, eax
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x534f2a
mov edi, SysReAllocString
jmp 0x534f34
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
xor ecx, ecx
mov eax, edi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x534f71
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x534ff9
push eax
call fcn.00581343
add esp, 4
test eax, eax
je 0x534ffe
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x534f84
test ecx, ecx
je 0x534f82
push ecx
call fcn.00581343
add esp, 4
mov ecx, eax
jmp 0x534f84
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
inc eax
push eax
push dword [ebp - 0x10]
mov dword [esi + 0x10], ecx
push ecx
mov dword [esi + 0x24], edi
call fcn.00582dc0
mov edi, dword [ebp - 0x18]
add esp, 0xc
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
movups xmmword [esi + 0x28], xmm0
mov dword [esi + 0x2c], 0
mov eax, edi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov ecx, dword [edi + 4]
mov dword [ecx], edx
mov ecx, dword [edi + 4]
mov dword [ecx + 4], edx
mov ecx, dword [edi + 4]
mov dword [ecx + 8], edx
mov ecx, dword [edi + 4]
mov byte [ecx + 0xc], 0
mov ecx, dword [edi + 4]
mov byte [ecx + 0xd], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
call fcn.004015ed
call fcn.00401549
call fcn.00586698
int3
Function at 0x538860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5c45
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6510e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
push 0x34
mov dword [edi + 4], 0
call fcn.00581343
mov esi, eax
add esp, 4
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
mov dword [ebp - 4], 1
mov ecx, dword [eax]
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
jb 0x5388f0
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
cmp eax, 0x7fffffff
ja 0x5389fb
mov dword [esi + 0x24], 0xf
cmp eax, 0x10
jae 0x538916
mov dword [esi + 0x20], eax
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
jmp 0x5389a1
mov edi, eax
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x53892a
mov edi, SysReAllocString
jmp 0x538934
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
xor ecx, ecx
mov eax, edi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x538971
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x538a00
push eax
call fcn.00581343
add esp, 4
test eax, eax
je 0x538a05
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x538984
test ecx, ecx
je 0x538982
push ecx
call fcn.00581343
add esp, 4
mov ecx, eax
jmp 0x538984
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
inc eax
push eax
push dword [ebp - 0x10]
mov dword [esi + 0x10], ecx
push ecx
mov dword [esi + 0x24], edi
call fcn.00582dc0
mov edi, dword [ebp - 0x18]
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, edi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [edi + 4]
mov dword [ecx], edx
mov ecx, dword [edi + 4]
mov dword [ecx + 4], edx
mov ecx, dword [edi + 4]
mov dword [ecx + 8], edx
mov ecx, dword [edi + 4]
mov byte [ecx + 0xc], 0
mov ecx, dword [edi + 4]
mov byte [ecx + 0xd], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
call fcn.004015ed
call fcn.00401549
call fcn.00586698
int3