joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ac00
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [eax]
cmp ecx, 8
push edi
jge 0x43ac19
mov ecx, 8
mov edi, dword [esi + 8]
lea eax, [edi + 9]
cdq
idiv ecx
mov eax, ecx
sub eax, edx
cdq
idiv ecx
mov eax, dword [esp + 0x24]
add dl, 4
mov byte [esi + 0x14], dl
cmp dword [eax + 4], 0
je 0x43ac3d
mov ebp, dword [eax]
jmp 0x43ac3f
xor ebp, ebp
movzx ecx, dl
add ecx, edi
lea ebx, [ecx + ebp + 5]
push ebx
mov dword [esp + 0x18], ebx
call fcn.004ff272
sub ebx, ebp
sub ebx, 4
push 4
mov edi, eax
mov dword [esp + 0x18], ebx
call fcn.004ff272
movzx edx, byte [esp + 0x1b]
mov cl, byte [esp + 0x1a]
mov byte [eax], dl
mov byte [eax + 1], cl
mov byte [eax + 2], bh
mov byte [eax + 3], bl
mov ebx, dword [eax]
push eax
call fcn.004ff267
mov dword [edi], ebx
movzx edx, byte [esi + 0x14]
mov byte [edi + 4], dl
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x20]
push eax
push ecx
lea edx, [edi + 5]
push edx
call fcn.005402a0
movzx eax, byte [esi + 0x14]
mov ebp, dword [esi + 8]
push eax
add ebp, 5
mov dword [esp + 0x2c], eax
call fcn.004ff272
mov ecx, dword [0x5ec70c]
add esp, 0x1c
mov ebx, eax
mov eax, dword [esp + 0x10]
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx edx, byte [esi + 0x14]
push edx
lea eax, [edi + ebp]
push ebx
push eax
mov dword [esi + 0x18], ebx
call fcn.005402a0
movzx ecx, byte [esi + 0x14]
mov ebx, dword [esp + 0x38]
add ebp, ecx
mov ecx, dword [esp + 0x30]
add esp, 0xc
cmp dword [ecx + 4], 0
je 0x43acff
mov eax, dword [ebx]
push 1
lea edx, [edi + ebp]
push edx
push eax
push ebp
push edi
call fcn.00439a30
inc dword [ebx]
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], ebp
test eax, eax
je 0x43ad24
push ebp
lea edx, [esp + 0x28]
push edx
push edi
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
push 0
push eax
push edi
call fcn.004adca0
push edi
mov ebx, eax
call fcn.004ff267
mov ecx, dword [esi + 0x20]
push ecx
call fcn.004ff267
mov edx, dword [esi + 0x18]
push edx
call fcn.004ff267
mov eax, dword [esi + 0x1c]
push eax
call fcn.004ff267
add esp, 0x10
xor eax, eax
pop edi
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov byte [esi + 0x14], al
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi], eax
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 0x14
Function at 0x43fcb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x560698
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5b7a9c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x40]
mov eax, dword [esi + 0xc]
push eax
call fcn.004ff267
xor eax, eax
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], al
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x20], al
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0xc], eax
push eax
push eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0043f560
test eax, eax
jne 0x43fd68
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004ff267
mov edx, dword [esp + 0x28]
push edx
call fcn.004ff267
mov eax, dword [esp + 0x30]
push eax
call fcn.004ff267
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
jge 0x43fd83
mov cl, byte [edx + eax]
inc eax
mov dword [esp + 0x1c], eax
cmp cl, 0x5e
je 0x43fdb6
push edx
call fcn.004ff267
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ff267
mov edx, dword [esp + 0x30]
push edx
call fcn.004ff267
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
lea ecx, [esp + 0xc]
call fcn.0043ae00
cmp eax, dword [edi + 0x1e90]
je 0x43fdfe
mov eax, dword [esp + 0x2c]
push eax
call fcn.004ff267
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ff267
mov edx, dword [esp + 0x30]
push edx
call fcn.004ff267
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
lea ecx, [esp + 0xc]
call fcn.0043ae00
mov dword [esp + 0x40], eax
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.0043fa70
mov edx, dword [esp + 0x2c]
push edx
mov esi, eax
call fcn.004ff267
mov eax, dword [esp + 0x28]
push eax
call fcn.004ff267
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004ff267
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x4463e0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x104], 0
jne 0x44649b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x446416
mov ecx, dword [0x5ed04c]
push 6
mov dword [0x5ed040], 1
call fcn.005069bf
pop esi
ret
mov eax, dword [esi + 0x124]
mov dword [esi + 0x104], 1
test eax, eax
jl 0x44648d
mov ecx, dword [esi + 0xcc]
lea eax, [eax + eax*2]
mov ecx, dword [ecx + eax*8]
test ecx, ecx
jl 0x44648d
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
mov eax, dword [eax*4 + 0x5b8fa8]
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x1ef8
push 0
push 0x1f4
mov dword [ecx + eax + 0xd4], 1
mov ecx, dword [esi + 0x20]
push 0x1f5
push ecx
mov dword [esi + 0x128], 0
call dword [sym.imp.USER32.dll_SetTimer]
push 0xffffffffffffffff
push 0
push 0x4e2d
call fcn.0050bdf5
pop esi
ret
Function at 0x446890
Capabilities:
Check if file exists
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x560560
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x5b7a9c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov edi, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446a22
mov eax, dword [esp + 0x2c]
mov esi, dword [eax]
test esi, esi
jne 0x4469ec
call fcn.0050830c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4468f3
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push edi
lea ecx, [esp + 0x14]
push 0x5461
push ecx
mov dword [esp + 0x2c], 0
call fcn.00402170
add esp, 0xc
test ebp, ebp
je 0x4469a1
call fcn.0050830c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44693c
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
push 0x54c8
mov byte [esp + 0x24], 1
call fcn.00508284
test eax, eax
je 0x446972
push 0x54c8
push eax
lea ecx, [esp + 0x1c]
call fcn.00401da0
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00401fe0
lea eax, [esi - 0x10]
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4469a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x10]
push 0
push 0x23
push edi
call fcn.0050bda7
mov esi, eax
test ebp, ebp
je 0x4469c8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4469c8
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4469ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 2
jne 0x446a07
or eax, 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
xor eax, eax
cmp esi, 6
sete al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x44bbb0
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jle 0x44bc0e
mov eax, dword [esp + 0x10]
push eax
call fcn.00450ac0
add esp, 4
test eax, eax
je 0x44bc0e
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea edi, [esi + esi + 2]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
push edi
push ecx
push eax
call fcn.005402a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret
Function at 0x44cbd0
Capabilities:
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x55df00
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7a9c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 0x2dc]
mov eax, dword [eax + 0x20]
xor esi, esi
push esi
push esi
push 0x18b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
call fcn.0050830c
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x44cc2e
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], esi
call fcn.0050830c
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x44cc5c
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x24], 1
test edi, edi
jle 0x44ccb1
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebp + 0x2dc]
push esi
call fcn.00507736
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401fe0
push 2
push 0x577b70
lea ecx, [esp + 0x1c]
call fcn.00401fe0
inc esi
cmp esi, edi
jl 0x44cc75
mov ebx, dword [esp + 0x14]
mov esi, dword [ebx - 0xc]
mov ebp, dword [ebp + 0x20]
test esi, esi
jle 0x44cd05
push ebp
call fcn.00450ac0
add esp, 4
test eax, eax
je 0x44cd05
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea edi, [esi + esi + 2]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.005402a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44cd2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44cd4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x44e210
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x828
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x824], eax
mov eax, dword [esp + 0x82c]
push ebx
mov ebx, dword [esp + 0x838]
push ebp
push esi
push edi
mov edi, dword [esp + 0x848]
xor ebp, ebp
xor esi, esi
mov dword [esp + 0x10], eax
test edi, edi
jle 0x44e309
lea ecx, [ecx]
mov ecx, 0x25
cmp cx, word [ebx + esi*2]
jne 0x44e32e
push ecx
lea edx, [ebx + esi*2 + 2]
push edx
call fcn.0054068a
add esp, 8
test eax, eax
je 0x44e32e
mov ax, word [ebx + esi*2]
inc esi
cmp esi, edi
mov word [esp + 0x14], ax
mov ecx, 1
jge 0x44e2a9
jmp 0x44e290
movzx eax, word [ebx + esi*2]
mov word [esp + ecx*2 + 0x14], ax
mov edx, 0x25
inc ecx
cmp dx, ax
je 0x44e2a9
inc esi
cmp esi, edi
jl 0x44e290
xor eax, eax
mov word [esp + ecx*2 + 0x14], ax
push 0x208
lea ecx, [esp + 0x428]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
jle 0x44e2f9
lea eax, [edi + ebp]
cmp eax, dword [esp + 0x840]
jge 0x44e309
mov eax, dword [esp + 0x10]
dec edi
lea ecx, [edi + edi]
push ecx
lea edx, [esp + 0x428]
push edx
lea ecx, [eax + ebp*2]
push ecx
call fcn.005402a0
add esp, 0xc
add ebp, edi
mov edi, dword [esp + 0x848]
inc esi
cmp esi, edi
jl 0x44e250
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x834]
pop edi
xor edx, edx
mov word [eax + ebp*2], dx
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0053fa67
add esp, 0x828
ret
lea eax, [ebp + 1]
cmp eax, dword [esp + 0x840]
jge 0x44e309
mov dx, word [ebx + esi*2]
mov ecx, dword [esp + 0x10]
mov word [ecx + ebp*2], dx
mov ebp, eax
jmp 0x44e300

Function at 0x44e780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
xor esi, esi
mov edi, eax
cmp dword [0x5ec750], esi
je 0x44e7b4
push edi
call fcn.0044ceb0
mov esi, eax
add esp, 4
test esi, esi
je 0x44e7b4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push 0
push edx
push edi
mov ecx, ebx
call fcn.004ffc04
mov edi, eax
test esi, esi
je 0x44e7dc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x44fd20
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x44fd45
cmp dword [esi + 8], 0
je 0x44fd36
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov esi, dword [esi + 4]
sub esi, 0x10
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44fd64
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
pop esi
ret
Function at 0x4506e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x14]
push esi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x450714
push eax
push eax
push eax
push 0x53ef
call fcn.00450540
add esp, 0x10
xor eax, eax
mov word [esi], ax
pop esi
ret

Function at 0x450840
Capabilities:
Clear file content
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
jne 0x450856
push 0x80004005
call fcn.00401350
mov eax, dword [0x5ba3b8]
push edi
push eax
call fcn.005408be
add esp, 8
test eax, eax
jne 0x45086f
mov edi, dword [0x5ba3b8]
push ebx
mov ebx, dword [esp + 0x14]
test ebx, 0x40000000
je 0x45088d
mov edx, dword [esp + 0x1c]
mov eax, 1
lea ecx, [eax + 3]
mov dword [esi + 8], edx
jmp 0x45089b
mov eax, 3
mov ecx, eax
mov dword [esi + 8], 0
push 0
push 0x80
push ecx
push 0
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x4508dc
cmp dword [esp + 0x18], 0
je 0x4508ce
push 0
push edi
push 0
push 0x5bfb
call fcn.00450540
add esp, 0x10
pop ebx
pop edi
mov dword [esi], 0
xor eax, eax
pop esi
ret 0x10
cmp ebx, 0x80000000
jne 0x450922
test eax, eax
je 0x450922
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x7fffffff
jb 0x450922
mov eax, dword [esi]
test eax, eax
je 0x45091a
cmp dword [esi + 8], 0
je 0x45090b
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop ebx
pop edi
xor eax, eax
pop esi
ret 0x10
lea ecx, [esi + 4]
test edi, edi
jne 0x45093b
xor eax, eax
push eax
push edi
call fcn.00401e70
pop ebx
lea eax, [edi + 1]
pop edi
pop esi
ret 0x10
mov eax, edi
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x450940
sub eax, esi
sar eax, 1
push eax
push edi
call fcn.00401e70
pop ebx
pop edi
mov eax, 1
pop esi
ret 0x10

Function at 0x450970
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x4509cd
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4509cd
push esi
mov esi, dword [esp + 0x10]
push 0
lea edx, [esp + 0x10]
push edx
push esi
push ecx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4509af
cmp dword [esp + 0x14], 0
je 0x4509c4
cmp dword [esp + 0xc], esi
je 0x4509c4
mov eax, dword [edi + 4]
push 0
push eax
push 0
push 0x5bfb
call fcn.00450540
add esp, 0x10
mov eax, dword [esp + 0xc]
pop esi
pop edi
ret 0xc
xor eax, eax
pop edi
ret 0xc
Function at 0x4509e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push edi
mov ebx, ecx
xor edi, edi
cmp dword [ebx], edi
je 0x450ab0
cmp dword [esp + 0x10], edi
je 0x450ab0
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, eax
shr esi, 0x10
and eax, 0xffff
cmp esi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
jle 0x450a56
jmp 0x450a20
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx]
push 0x10000
lea edx, [edi + ecx]
push edx
push eax
call ebp
test eax, eax
je 0x450a9b
cmp dword [esp + 0x10], 0x10000
jne 0x450a9b
dec esi
add edi, 0x10000
test esi, esi
jg 0x450a20
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x450aa3
mov ecx, dword [ebx]
push 0
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x24]
add edi, eax
push edi
push ecx
call ebp
test eax, eax
je 0x450a7c
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x10], edx
je 0x450aa3
mov eax, dword [ebx + 4]
push 0
push eax
push 0
push 0x5bfb
call fcn.00450540
add esp, 0x10
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret 8
mov ecx, dword [ebx + 4]
push 0
push ecx
jmp 0x450a82
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
pop ecx
ret 8
pop edi
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x450ac0
Capabilities:
Open clipboard

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [esp + 0xc], 5
call dword [sym.imp.USER32.dll_OpenClipboard]
mov esi, eax
test esi, esi
jne 0x450b30
push ebx
mov ebx, dword [sym.imp.USER32.dll_CloseClipboard]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
test eax, eax
jle 0x450b18
call ebx
push 0x64
call ebp
push edi
call fcn.00450ac0
mov esi, eax
add esp, 4
test esi, esi
je 0x450af0
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
test esi, esi
jne 0x450b2c
push esi
push esi
push esi
push 0x59db
call fcn.00450540
add esp, 0x10
pop ebp
mov eax, esi
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x450fb0
Capabilities:
Clear file content

Disassembly:
push 0xffffffffffffffff
push 0x561528
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x5b7a9c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
call fcn.0050830c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x450ff0
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0x40000000
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0
call fcn.00450840
mov ebp, dword [esp + 0x18]
test eax, eax
je 0x45106d
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
lea eax, [edx + edx]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.004509e0
mov esi, dword [esp + 0x10]
mov ebx, eax
test esi, esi
je 0x451073
test ebp, ebp
je 0x451062
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x451073
mov esi, dword [esp + 0x10]
xor ebx, ebx
mov dword [esp + 0x24], 0xffffffff
test esi, esi
je 0x451091
test ebp, ebp
je 0x45108a
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4510b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x459790
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x14]
mov dword [ebx], 0
push eax
mov dword [esi], 0
push edi
mov dword [ebp], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0x28], eax
test eax, eax
jbe 0x459846
push eax
call fcn.004ff272
mov ecx, dword [esp + 0x2c]
add esp, 4
push eax
push ecx
push 0
push edi
mov dword [esp + 0x30], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x459839
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x14]
push eax
push str.StringFileInfo040904b0ProductVersion
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x459839
mov eax, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x28]
push edx
push esi
push ebp
push str._d___d___d___d
push eax
mov dword [esp + 0x3c], 0
call fcn.005412fb
mov eax, dword [esi]
mov edx, dword [esp + 0x3c]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*2]
add esp, 0x18
mov dword [esi], eax
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004ff267
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret