joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc1ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fc279
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.004054a8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4fc234
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405218
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004054a8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004fc0ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc280
lea eax, [ebp - 0x14]
call fcn.00404d88
ret

Function at 0x5048bc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x50490d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5048f4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5048e4
jmp 0x50490d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5048f5
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51a13c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x51a16a
mov eax, ebx
call fcn.0051abf0
cmp dword [ebx + 0x40], 0
je 0x51a163
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x51a1db
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x51a1cd
cmp dword [ebx + 8], 0
je 0x51a18c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x51a19e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x51a1cd
cmp dword [ebx + 8], 0
je 0x51a17f
cmp eax, 3
je 0x51a1b1
dec eax
jne 0x51a17f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51a17f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51a17f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x51a1f9
cmp dword [ebx + 0x14], 0xcc
je 0x51a1f9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0051a204
pop ebx
ret
Function at 0x534ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x534eff
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x534f7e
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00533764
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x534f4c
mov cx, word [esp]
sub cx, si
jmp 0x534f4e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x534f35
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x534f74
mov cx, word [esp]
sub cx, si
jmp 0x534f76
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x534f5d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x534fdb
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00534ba4
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x534fc6
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x534fdb
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x534eda
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53b508
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0x53b537
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x53b53a
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x53b51e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x57b648], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x53b513
mov byte [0x57ba48], 1
mov esp, ebp
pop ebp
ret

Function at 0x53b568
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x57ba48], 0
jne 0x53b58b
call fcn.0053b508
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x53b5ca
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x57b648]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x53b59e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5437fc
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
lea edx, [ebp - 0x54]
mov eax, dword [0x57ba50]
mov ecx, 0x40
call fcn.00403154
mov dword [0x57ba54], 0xb7e15163
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x57ba50]
add eax, 0x9e3779b9
mov edx, dword [ebp - 4]
mov dword [edx*4 + 0x57ba54], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jne 0x543825
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x57ba54]
add eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov edx, 3
call fcn.0054365c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax*4 + 0x57ba54], edx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x54]
add eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
call fcn.0054365c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], edx
mov eax, dword [ebp - 4]
inc eax
mov ecx, 0x1a
cdq
idiv ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
inc eax
and eax, 0x8000000f
jns 0x5438d0
dec eax
or eax, 0xfffffff0
inc eax
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x4f
jne 0x543862
mov esp, ebp
pop ebp
ret

Function at 0x5438e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [0x57ba54]
add dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, dword [0x57ba58]
add dword [eax + 4], edx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor eax, dword [edx + 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.0054365c
mov edx, dword [ebp - 0xc]
add edx, edx
add eax, dword [edx*4 + 0x57ba54]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
xor eax, dword [edx]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.0054365c
mov edx, dword [ebp - 0xc]
add edx, edx
add eax, dword [edx*4 + 0x57ba58]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xd
jne 0x543907
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x54396c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc]
add edx, edx
sub eax, dword [edx*4 + 0x57ba58]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.00543664
mov edx, dword [ebp - 4]
xor eax, dword [edx]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
add edx, edx
sub eax, dword [edx*4 + 0x57ba54]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.00543664
mov edx, dword [ebp - 4]
xor eax, dword [edx + 4]
mov edx, dword [ebp - 4]
mov dword [edx], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x54397c
mov eax, dword [ebp - 4]
mov edx, dword [0x57ba58]
sub dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [0x57ba54]
sub dword [eax], edx
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x544c64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x544c6c
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405208
xor eax, eax
push ebp
push 0x544dea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x544e00
call fcn.00405054
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00544ac4
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.004050a0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.005449f8
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x20
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405280
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.0044af0c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00404e20
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404ddc
mov dl, 1
mov eax, dword [0x41be30]
call fcn.00403e18
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x41be30]
call fcn.00403e18
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
call fcn.004e558c
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00420cc4
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00420cc4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.005439f8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.004e565c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.0044af0c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
call fcn.00404e20
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
movzx edx, byte [edx + ecx - 1]
xor edx, dword [ebp - 0x1c]
call fcn.00404f70
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + ecx*2]
inc ecx
mov edx, dword [ebp - 8]
call fcn.00405308
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x21
jne 0x544d79
mov eax, dword [ebp - 0x14]
call fcn.00403e48
mov eax, dword [ebp - 0x18]
call fcn.00403e48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544df1
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00404dac
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404dac
lea eax, [ebp - 4]
call fcn.00404d88
ret
Function at 0x544e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405208
xor eax, eax
push ebp
push 0x544f99
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00404d88
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
xor edx, dword [ebp - 0x1c]
call fcn.00404f70
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.00405054
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x21
jne 0x544e72
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.0044af0c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
call fcn.00404e20
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
call fcn.00404d88
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp - 0x1c]
lea edx, [edx + edx*2]
inc edx
sub edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004052c0
inc dword [ebp - 0x20]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x21
jne 0x544ec8
mov dl, 1
mov eax, dword [0x41be30]
call fcn.00403e18
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x41be30]
call fcn.00403e18
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004e558c
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00420cc4
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00420cc4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00543b40
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x18]
call fcn.004e565c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404ddc
mov eax, dword [ebp - 0x14]
call fcn.00403e48
mov eax, dword [ebp - 0x18]
call fcn.00403e48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544fa0
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404dac
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404dac
lea eax, [ebp - 4]
call fcn.00404d88
ret
Function at 0x54c8d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x54c8d8
push ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54cab0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x575c04]
cmp byte [eax], 0
jne 0x54ca88
mov eax, dword [0x575c04]
mov byte [eax], 1
lea edx, [ebp - 8]
mov eax, 1
call fcn.00403350
cmp dword [0x57553c], 0
je 0x54c9bb
mov eax, 0x5f5e0ff
call fcn.004033d8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
call fcn.0056aa6c
push dword [ebp - 0x18]
push 0x54cac4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00409dc8
push dword [ebp - 0x1c]
push 0x54cad0
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040511c
mov edx, dword [ebp - 0xc]
mov eax, dword [0x57553c]
call fcn.004e53d4
push 0x54cae0
push dword [ebp - 0xc]
push 0x54cafc
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x20]
mov eax, dword [0x575b2c]
mov eax, dword [eax]
call fcn.00552558
mov eax, dword [0x575b2c]
mov eax, dword [eax]
mov edx, 0x54cb08
call fcn.00552558
mov eax, dword [ebp - 0xc]
call fcn.00405218
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x54ca80
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0040a594
mov eax, dword [ebp - 0x24]
mov edx, 0x54cb24
call fcn.004051b0
jne 0x54ca21
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004e54b8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0040a55c
mov eax, dword [ebp - 0x28]
mov edx, 0x54cb34
call fcn.004051b0
jne 0x54ca10
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00544e30
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
call fcn.00404e20
mov eax, dword [0x575b2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.00552558
jmp 0x54ca80
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00403350
mov eax, dword [ebp - 0x30]
mov edx, 0x54cb4c
call fcn.004051b0
je 0x54ca64
mov eax, dword [0x575b84]
mov eax, dword [eax]
call fcn.00551750
mov eax, dword [0x575ad4]
mov eax, dword [eax]
mov byte [eax + 0x5b], 1
mov eax, dword [0x575ad4]
mov eax, dword [eax]
mov dl, 1
call fcn.00494854
jmp 0x54ca80
lea edx, [ebp - 0x34]
mov eax, 2
call fcn.00403350
mov edx, dword [ebp - 0x34]
mov eax, dword [0x575b2c]
mov eax, dword [eax]
call fcn.005525e0
mov eax, dword [0x575c04]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54cab7
lea eax, [ebp - 0x34]
mov edx, 8
call fcn.00404dac
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404dac
ret
Function at 0x54d57c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405208
xor eax, eax
push ebp
push 0x54d6b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x54d698
xor eax, eax
push ebp
push 0x54d691
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x54d5db
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x54d666
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x54d655
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405218
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.00403154
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d65c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d6b9
lea eax, [ebp - 8]
call fcn.00404d88
ret

Function at 0x54d6c4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x54d77d
xor eax, eax
push ebp
push 0x54d776
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x54d74d
xor eax, eax
push ebp
push 0x54d746
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalSize
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.00404e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d751
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00405278
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00404f80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d781
call sub.user32.dll_CloseClipboard
ret
mov byte [ebp - 9], 0
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x54d788
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
or edx, edx
je 0x54d7c0
mov esi, edx
mov ecx, dword [edx - 4]
jecxz 0x54d7c0
lea edi, [0x54d7c4]
mov edx, eax
xor eax, eax
cld
lodsb al, byte [esi]
mov ebx, edx
xor ebx, eax
and ebx, 0xff
shl ebx, 2
shr edx, 8
and edx, 0xffffff
xor edx, dword [ebx + edi]
dec ecx
jne 0x54d7a1
mov eax, edx
pop edi
pop esi
pop ebx
ret

Function at 0x5577c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55789a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x55787d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x55785c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.004054a8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00405218
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
jne 0x557842
call fcn.004047a8
jmp 0x557884
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00405218
push eax
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004054a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557884
cmp dword [ebp - 0x10], 0
je 0x55787c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5578a1
lea eax, [ebp - 0xc]
call fcn.00406b98
ret

Function at 0x5593f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push eax
push 0x3ff
call sub.kernel32.dll_GetTempPathA
mov ecx, eax
lea edx, [ebp - 0x404]
mov eax, dword [ebp - 4]
call fcn.00404e78
mov esp, ebp
pop ebp
ret
Function at 0x55bc7c
Capabilities:
Create process on windows
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405208
xor eax, eax
push ebp
push 0x55bdbc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.004036ec
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov ax, word [ebp - 0xc]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405218
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x55bcf7
mov byte [ebp - 0xd], 0
jmp 0x55bda6
cmp byte [ebp - 5], 0
je 0x55bd4f
mov eax, dword [0x575ad4]
mov eax, dword [eax]
call fcn.0049219c
push 0
mov eax, dword [0x575ad4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffff
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x55bd61
mov eax, dword [0x575ad4]
mov eax, dword [eax]
call fcn.0049289c
mov eax, dword [0x575ad4]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
je 0x55bd4f
push 0
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x64
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x55bd28
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x14], 0
sete byte [ebp - 0xd]
cmp byte [ebp - 5], 0
je 0x55bda6
push 0
mov eax, dword [0x575ad4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x575ad4]
mov eax, dword [eax]
call fcn.0049227c
mov eax, dword [0x575ad4]
mov eax, dword [eax]
call fcn.004923ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55bdc3
lea eax, [ebp - 4]
call fcn.00404d88
ret