joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503e04
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
and edx, 0xc122
sub edx, 0x6793
and edx, 0x16236
xor edx, 0xfced
pop edx
push ebx
push ecx
add esp, 4
xor ebx, 0xf8ae
and ebx, 0x7c65
add ebx, 0x3d0
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
push edi
add esp, 4
call fcn.00503f06
add byte [edi], bh
dec edx
inc edi
inc esi
dec esi
dec edi
dec eax
dec esi
inc esp

Function at 0x503f06
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x503f0e
add edi, 0x1187e
or edi, 0x15baa
pop edi
push edi
or edi, 0xe527
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd4f9
or edx, 0xd95
pop edx
push ebx
push ecx
add esp, 4
or ebx, 0x34a1
call 0x503f86
add byte [edx + 0x44], cl
dec ecx
dec eax
cmp edi, dword [esi]
inc edx
push eax
dec ebp
add esp, 4
sub ebx, 0x1085e
pop ebx
mov dword [ebp - 0x10], 1
push ebx
or ebx, 0xb525
jmp 0x503fa3
and ebx, 0x12282
call 0x503fb9
add byte [edx + 0x4d], al
xor dh, byte [edx]
cmp esi, dword [edx]
inc ebx
inc edi
xor al, 0x35
add esp, 4
pop ebx
push esi
push esi
add esp, 4
or esi, 0x1595e
pop esi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push ecx
add esp, 4
sub esi, 0x14ab5
or esi, 0x1cda
and esi, 0xad28
pop esi
push edx
push ebx
add esp, 4
and edx, 0x11069
pop edx
push ecx
xor ecx, 0x5545
sub ecx, 0x3358
pop ecx
push ecx
xor ecx, 0x15e04
call 0x50403a
add byte [0x4f384c3a], dh
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
jmp 0x504046
pop edx
push eax
push esi
add esp, 4
or eax, 0x15d12
sub eax, 0x16aa2
pop eax
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x184e8
jmp 0x50406d
and esi, 0x1cf5
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x1458
xor ebx, 0xdb85
or ebx, 0x138d
add ebx, 0xc374
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504273
Function at 0x503f86
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x503f0e
add edi, 0x1187e
or edi, 0x15baa
pop edi
push edi
or edi, 0xe527
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd4f9
or edx, 0xd95
pop edx
push ebx
push ecx
add esp, 4
or ebx, 0x34a1
call 0x503f86
add byte [edx + 0x44], cl
dec ecx
dec eax
cmp edi, dword [esi]
inc edx
push eax
dec ebp
add esp, 4
sub ebx, 0x1085e
pop ebx
mov dword [ebp - 0x10], 1
push ebx
or ebx, 0xb525
jmp 0x503fa3
and ebx, 0x12282
call 0x503fb9
add byte [edx + 0x4d], al
xor dh, byte [edx]
cmp esi, dword [edx]
inc ebx
inc edi
xor al, 0x35
add esp, 4
pop ebx
push esi
push esi
add esp, 4
or esi, 0x1595e
pop esi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push ecx
add esp, 4
sub esi, 0x14ab5
or esi, 0x1cda
and esi, 0xad28
pop esi
push edx
push ebx
add esp, 4
and edx, 0x11069
pop edx
push ecx
xor ecx, 0x5545
sub ecx, 0x3358
pop ecx
push ecx
xor ecx, 0x15e04
call 0x50403a
add byte [0x4f384c3a], dh
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
jmp 0x504046
pop edx
push eax
push esi
add esp, 4
or eax, 0x15d12
sub eax, 0x16aa2
pop eax
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x184e8
jmp 0x50406d
and esi, 0x1cf5
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x1458
xor ebx, 0xdb85
or ebx, 0x138d
add ebx, 0xc374
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504273
Function at 0x503fb9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x503f0e
add edi, 0x1187e
or edi, 0x15baa
pop edi
push edi
or edi, 0xe527
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd4f9
or edx, 0xd95
pop edx
push ebx
push ecx
add esp, 4
or ebx, 0x34a1
call 0x503f86
add byte [edx + 0x44], cl
dec ecx
dec eax
cmp edi, dword [esi]
inc edx
push eax
dec ebp
add esp, 4
sub ebx, 0x1085e
pop ebx
mov dword [ebp - 0x10], 1
push ebx
or ebx, 0xb525
jmp 0x503fa3
and ebx, 0x12282
call 0x503fb9
add byte [edx + 0x4d], al
xor dh, byte [edx]
cmp esi, dword [edx]
inc ebx
inc edi
xor al, 0x35
add esp, 4
pop ebx
push esi
push esi
add esp, 4
or esi, 0x1595e
pop esi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push ecx
add esp, 4
sub esi, 0x14ab5
or esi, 0x1cda
and esi, 0xad28
pop esi
push edx
push ebx
add esp, 4
and edx, 0x11069
pop edx
push ecx
xor ecx, 0x5545
sub ecx, 0x3358
pop ecx
push ecx
xor ecx, 0x15e04
call 0x50403a
add byte [0x4f384c3a], dh
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
jmp 0x504046
pop edx
push eax
push esi
add esp, 4
or eax, 0x15d12
sub eax, 0x16aa2
pop eax
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x184e8
jmp 0x50406d
and esi, 0x1cf5
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x1458
xor ebx, 0xdb85
or ebx, 0x138d
add ebx, 0xc374
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504273
Function at 0x50403a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x503f0e
add edi, 0x1187e
or edi, 0x15baa
pop edi
push edi
or edi, 0xe527
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd4f9
or edx, 0xd95
pop edx
push ebx
push ecx
add esp, 4
or ebx, 0x34a1
call 0x503f86
add byte [edx + 0x44], cl
dec ecx
dec eax
cmp edi, dword [esi]
inc edx
push eax
dec ebp
add esp, 4
sub ebx, 0x1085e
pop ebx
mov dword [ebp - 0x10], 1
push ebx
or ebx, 0xb525
jmp 0x503fa3
and ebx, 0x12282
call 0x503fb9
add byte [edx + 0x4d], al
xor dh, byte [edx]
cmp esi, dword [edx]
inc ebx
inc edi
xor al, 0x35
add esp, 4
pop ebx
push esi
push esi
add esp, 4
or esi, 0x1595e
pop esi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push ecx
add esp, 4
sub esi, 0x14ab5
or esi, 0x1cda
and esi, 0xad28
pop esi
push edx
push ebx
add esp, 4
and edx, 0x11069
pop edx
push ecx
xor ecx, 0x5545
sub ecx, 0x3358
pop ecx
push ecx
xor ecx, 0x15e04
call 0x50403a
add byte [0x4f384c3a], dh
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
jmp 0x504046
pop edx
push eax
push esi
add esp, 4
or eax, 0x15d12
sub eax, 0x16aa2
pop eax
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x184e8
jmp 0x50406d
and esi, 0x1cf5
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x1458
xor ebx, 0xdb85
or ebx, 0x138d
add ebx, 0xc374
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504273
Function at 0x508e89
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0x1805c
or edi, 0x2538
add edi, 0x15076
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x508e04
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x508e5e
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x508d2c
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x508d2c
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x508e48
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x508e52
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x508ea7
push edx
call 0x508e77
add byte [esi + 0x3d], cl
dec edx
dec ecx
inc esi
cmp al, 0x32
dec ebp
add esp, 4
call 0x508e89
add byte [edi], dh
cmp ecx, dword [edi + 0x35]
cmp dword [ebx], edi
xor eax, dword ss:[ebx - 0xd7efb3c]
push ecx
pop esi
add dword [eax], eax
sub edx, 0x12175
pop edx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x508f0f
push ecx
call 0x508eb4
add byte [eax + 0x4a], cl
aas
inc ebp
cmp eax, dword [eax - 0x7d]
les eax, [ecx + eax*4]
leave
cdq
inc eax
add byte [eax], al
jmp 0x508ec6
pop ecx
push esi
push edi
add esp, 4
xor esi, 0x126c1
and esi, 0x17bfa
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x508f05
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x508cd0
mov dword [ebp - 0x2e0], 0
Function at 0x508eb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0x1805c
or edi, 0x2538
add edi, 0x15076
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x508e04
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x508e5e
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x508d2c
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x508d2c
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x508e48
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x508e52
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x508ea7
push edx
call 0x508e77
add byte [esi + 0x3d], cl
dec edx
dec ecx
inc esi
cmp al, 0x32
dec ebp
add esp, 4
call 0x508e89
add byte [edi], dh
cmp ecx, dword [edi + 0x35]
cmp dword [ebx], edi
xor eax, dword ss:[ebx - 0xd7efb3c]
push ecx
pop esi
add dword [eax], eax
sub edx, 0x12175
pop edx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x508f0f
push ecx
call 0x508eb4
add byte [eax + 0x4a], cl
aas
inc ebp
cmp eax, dword [eax - 0x7d]
les eax, [ecx + eax*4]
leave
cdq
inc eax
add byte [eax], al
jmp 0x508ec6
pop ecx
push esi
push edi
add esp, 4
xor esi, 0x126c1
and esi, 0x17bfa
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x508f05
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x508cd0
mov dword [ebp - 0x2e0], 0
Function at 0x509694
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push ebx
jmp 0x5095b2
xor ebx, 0x77e4
pop ebx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
add ebx, 0xebbf
sub ebx, 0x815b
pop ebx
push edx
push edi
add esp, 4
or edx, 0xce7d
or edx, 0xf868
and edx, 0x7550
pop edx
push ebx
push ebx
add esp, 4
sub ebx, 0x9f47
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
jmp 0x50967a
add esi, 0x19cd
and esi, 0x3798
pop esi
push ebx
call 0x509694
add byte [ebx], dh
dec ebx
xor esi, dword [0xc4833943]
add al, 0x81
ret

Function at 0x509785
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x16072
xor ecx, 0x8a8b
pop ecx
push ecx
call fcn.005095a5
add byte [ebp + 0x34], cl
cmp edi, dword [ecx]
inc eax
inc edx
cmp al, 0x45
cmp eax, dword [ebx + 0x535904c4]
add esp, 4
pop ecx
push ebx
add esp, 4
jmp 0x50978f
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x5097bc
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509587
mov dword [ebp - 0x2a8], 0
Function at 0x51a910
Capabilities:
Execute syscall

Disassembly:
or eax, 0x5e050632
push edi
push edi
mov cl, cl
or dword [esi + 0x613eec7], eax
add eax, 0x8a906b5f
fyl2x
add al, 4
imul ecx, dword [esi + 0x4ffad8a], 4
nop

Function at 0x51a930
Capabilities:
Execute syscall

Disassembly:
push edx
stc
mov ss, word [edx + 0x404009d]
push ebp
xchg ch, ch
out 0xb, al
push es
add eax, 0x885b565d
leave
or ebp, ebp
syscall
add eax, 0x494e0505
dec ecx
dec esp
inc eax
dec eax
cmp al, 0x3b
dec ebp
mov cl, cl
or dword [esi + 0x62347f6], eax
add eax, 0x885b585e
leave
or dword [esi + 0x616f4c8], eax
add eax, 0x518acc60
sti
add al, 4
invalid
invalid
invalid
invalid

Function at 0x548e98
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x548f85
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x548f57
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x548f46
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.0040660c
mov eax, dword [ebp - 4]
call fcn.00548bd8
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x548f2f
mov ecx, dword [0x618698]
mov dl, 1
mov eax, dword [0x489728]
call fcn.00429230
call fcn.00408d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548f4d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x5490b0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x549122
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5490f6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.0040a52c
jmp 0x5490fd
mov eax, ebx
call fcn.004096d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549129
cmp dword [ebp - 8], 0
je 0x549119
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x549164
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x54920c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x5491df
mov edx, ebx
mov eax, dword [0x4f3204]
call fcn.004fb040
test al, al
je 0x5491cf
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004faf58
call fcn.00408e84
jmp 0x549213
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x549197
mov ecx, dword [0x618708]
mov dl, 1
mov eax, dword [0x548ae0]
call fcn.00429230
call fcn.00408d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549213
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x54921c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x549278
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54927f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x549288
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x5492dd
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5492e4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x549354
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x5493c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00548bd8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.004fb01c
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x5493b3
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5493d0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x5493d8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x54944d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00548bd8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x549437
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549454
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x55f1c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004097b4
xor eax, eax
push ebp
push 0x55f2ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x55f2d2
xor edx, edx
push ebp
push 0x55f2cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x55f20d
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x55f2a0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x55f28f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x55f252
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.0040a4c4
lea ecx, [esi + 2]
mov edx, ebx
call fcn.0040660c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f296
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x618664]
mov dl, 1
mov eax, dword [0x41d2c4]
call fcn.00429230
call fcn.00408d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f306
lea eax, [ebp - 4]
call fcn.004096d0
ret

Function at 0x586dbc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00586e6c
test eax, eax
je 0x586df7
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00586e6c
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409858
jmp 0x586e05
mov ecx, esi
mov edx, 0x586e24
mov eax, ebx
call fcn.00586d44
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.00409ab0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5a74f8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.004096d0
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5a754a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5a7543
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a580
jmp 0x5a754a
mov eax, esi
call fcn.004096d0
add esp, 0x200
pop esi
pop ebx
ret