joyce8/EMBER2024-capa huggingface dataset:
Function at 0x537810
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5379fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x5379d9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x268]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x5379cf
call fcn.00642efc
test al, al
je 0x537895
xor eax, eax
push ebp
push 0x53788e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537895
call sub.user32.dll_CloseClipboard
ret
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x268]
lea eax, [ebp - 0x10]
call fcn.004053b0
jmp 0x5378f6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov si, word [eax + ebx*2]
cmp si, 0xa
jne 0x5378d7
push dword [ebp - 0x10]
push 0x537a10
push 0x537a18
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004056f0
jmp 0x5378f5
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x218]
mov edx, esi
call fcn.004054d8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.0040562c
inc ebx
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x26c]
jl 0x5378a8
call fcn.005227bc
mov edx, dword [ebp - 0x10]
call fcn.00522710
call fcn.00642efc
test al, al
je 0x5379cf
xor eax, eax
push ebp
push 0x5379c8
push dword fs:[eax]
mov dword fs:[eax], esp
imul eax, dword [ebp - 0xc], 0x118
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edi, eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x268]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x26c]
dec esi
sub esi, ebx
jl 0x53799d
inc esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax + ebx*4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
call fcn.004210b0
mov edx, dword [ebp - 4]
mov ecx, ebx
sub ecx, dword [edx + 0x268]
imul edx, ecx, 0x118
lea edx, [edi + edx]
mov ecx, 0x118
call fcn.00402d50
inc ebx
dec esi
jne 0x537961
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x98ed1c]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5379cf
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5379e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537a05
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004053c8
ret
Function at 0x537a1c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x537bbc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x537b9c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x537b92
call fcn.005227bc
lea edx, [ebp - 0x14]
call fcn.00522634
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00405738
jne 0x537a7e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537ba6
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x537b8b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00642efc
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x537afe
mov eax, dword [0x98ed1c]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x537afe
mov eax, dword [0x98ed1c]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x537afe
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalSize
mov ecx, eax
mov eax, ecx
mov ebx, 0x118
cdq
idiv ebx
test edx, edx
jne 0x537afe
mov eax, ecx
mov ecx, 0x118
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov edi, 1
mov eax, dword [ebp - 0x14]
call fcn.00405620
mov esi, eax
test esi, esi
jle 0x537b63
mov ebx, 1
mov eax, dword [ebp - 0x14]
cmp word [eax + ebx*2 - 2], 0xd
je 0x537b5f
cmp dword [ebp - 0xc], 0
je 0x537b4f
cmp edi, dword [ebp - 0x10]
jg 0x537b4f
mov eax, edi
dec eax
imul eax, eax, 0x118
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x278]
mov ecx, 0x118
call fcn.00402d50
inc edi
mov eax, dword [ebp - 0x14]
mov dx, word [eax + ebx*2 - 2]
mov eax, dword [ebp - 4]
call fcn.005325ec
inc ebx
dec esi
jne 0x537b16
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537b92
cmp dword [ebp - 8], 0
je 0x537b7f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
cmp byte [ebp - 0x15], 0
je 0x537b8a
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537ba6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537bc3
lea eax, [ebp - 0x14]
call fcn.004053b0
ret
Function at 0x569694
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00642efc
test al, al
je 0x5697ea
xor edx, edx
push ebp
push 0x5697e3
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
mov dl, 1
mov eax, dword [0x41f018]
call fcn.00403dfc
mov dword [ebp - 0xc], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x5fc9b4]
call fcn.005fceb8
mov dword [ebp - 0x14], eax
lea edx, [ebx + 0x94c]
mov ecx, 4
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edi, dword [ebx + 0x734]
dec edi
test edi, edi
jl 0x56976c
inc edi
mov dword [ebp - 0x10], 0
mov eax, dword [ebx + 0x738]
mov edx, dword [ebp - 0x10]
mov esi, dword [eax + edx*4]
mov edx, esi
mov eax, ebx
call fcn.0053ff88
test al, al
je 0x569766
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00557d24
mov edx, esi
mov eax, ebx
call fcn.005402a4
cmp byte [eax + 0x10], 5
jne 0x569766
mov eax, dword [eax + 0x58]
mov edx, dword [ebx + 0x96c]
mov edx, dword [edx + eax*8]
mov eax, dword [ebp - 0x14]
call fcn.00611784
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0060cfe0
inc dword [ebp - 0x10]
dec edi
jne 0x569713
mov eax, dword [ebp - 0x14]
call fcn.00403e2c
mov eax, dword [ebp - 0xc]
call fcn.00424530
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.00424530
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, esi
call fcn.00408a24
mov eax, dword [ebp - 0xc]
call fcn.00424530
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
call fcn.00403e2c
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
mov eax, dword [0x98ed20]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5697ea
call sub.user32.dll_CloseClipboard
ret
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x572a84
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x572c11
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x572ad5
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x572ae6
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x572afc
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x572b1e
mov ebx, dword [ecx]
test ebx, ebx
jg 0x572b12
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x572b16
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x572b06
test di, di
je 0x572c11
mov dl, byte [eax + 9]
sub dl, 2
je 0x572b47
sub dl, 2
je 0x572b67
sub dl, 4
je 0x572ba1
sub dl, 8
je 0x572bc5
jmp 0x572c11
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x572c11
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x572b57
jmp 0x572c11
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x572c11
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x572b91
jmp 0x572c11
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x572c11
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x572bb1
jmp 0x572c11
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x572c11
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x572bdc
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x57dda4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x98ab48]
cmp dword [eax], 1
jne 0x57ddba
mov eax, ebx
call fcn.004852dc
pop ebx
ret
mov eax, ebx
call fcn.00405610
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x57ddd0
test al, 0x10
je 0x57ddd4
xor eax, eax
jmp 0x57ddd6
mov al, 1
pop ebx
ret

Function at 0x57f354
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405610
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x5926fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
test dl, dl
je 0x592721
add esp, 0xfffffff0
call fcn.00404190
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x592806
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x989ef8]
cmp dword [eax], 0
jne 0x59278b
lea eax, [ebp - 0x105]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404ef4
mov eax, dword [ebp - 0x210]
call fcn.0062b2cc
lea eax, [ebp - 0x20a]
push eax
push 0
push 0x59282c
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetTempFileNameA
jmp 0x5927ab
lea eax, [ebp - 0x20a]
push eax
push 0
push 0x59282c
mov eax, dword [0x989ef8]
mov eax, dword [eax]
call fcn.0040513c
push eax
call sub.kernel32.dll_GetTempFileNameA
push 0xffff
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00404ef4
mov ecx, dword [ebp - 0x214]
xor edx, edx
mov eax, esi
call fcn.00424a18
lea eax, [esi + 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00404ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59280d
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00404ca0
ret

Function at 0x5a977c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov edx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
mov ecx, dword [edx]
mov eax, ecx
movzx eax, word [eax]
cmp eax, esi
jbe 0x5a97a3
mov eax, ecx
movzx esi, word [eax + 2]
xor esi, 1
mov eax, dword [eax + 8]
mov dword [edx], eax
jmp 0x5a97b1
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
movzx esi, word [eax + 2]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov edx, dword [ebx + 8]
test edx, edx
jne 0x5a9880
mov ecx, dword [ebx + 0x20]
test ecx, ecx
jne 0x5a9873
mov eax, dword [ebx + 0x18]
test byte [eax + 8], 7
jne 0x5a9820
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x5a97f3
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x5a97f3
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x5a9823
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x5a980c
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.005b07f4
mov edi, eax
jmp 0x5a9823
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x5a9823
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x5a9834
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x5a9865
cmp edi, 0x8f
jle 0x5a9857
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x5a9880
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x5a9880
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x5a9880
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x5a97b1
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5a989c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov eax, edx
movzx ecx, word [eax]
mov eax, dword [ebx + 4]
cmp ecx, eax
ja 0x5a98cc
mov eax, edx
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 8]
xor esi, 1
mov dword [edx], eax
jmp 0x5a98e3
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x5a99b2
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x5a99a5
mov edx, dword [ebx + 0x18]
test byte [edx + 8], 7
jne 0x5a9952
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x5a9925
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x5a9925
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x5a9955
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x5a993e
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.005b07f4
mov edi, eax
jmp 0x5a9955
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x5a9955
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x5a9966
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x5a9997
cmp edi, 0x8f
jle 0x5a9989
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x5a99b2
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x5a99b2
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x5a99b2
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x5a98e3
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5d5794
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov dx, word [0x5d5824]
mov eax, ebx
call fcn.005d1018
test al, al
je 0x5d581f
call fcn.00642efc
test al, al
je 0x5d581f
xor eax, eax
push ebp
push 0x5d5818
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5d5805
push 8
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x5d5805
cmp byte [ebx + 0x30], 0
je 0x5d57f0
mov cl, 1
mov edx, 0x5d5830
mov eax, ebx
call fcn.005d1770
push 0
mov edx, dword [ebx + 0x58]
xor ecx, ecx
mov eax, esi
call fcn.005dcb44
mov eax, ebx
call fcn.005d0ee0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d581f
call sub.user32.dll_CloseClipboard
ret
pop esi
pop ebx
pop ebp
ret

Function at 0x5d70e4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
mov dx, word [0x5d71d4]
mov eax, ebx
call fcn.005d1018
test al, al
je 0x5d71ce
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, ebx
mov si, 0xffef
call fcn.00404028
test al, al
je 0x5d71c7
call fcn.00642efc
test al, al
je 0x5d71ce
xor edx, edx
push ebp
push 0x5d71c0
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
cmp dword [ebp - 0x1c], 0
je 0x5d718f
mov eax, dword [ebp - 0x1c]
call fcn.0062fa9c
test al, al
jne 0x5d718f
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.005d1f34
push eax
mov eax, dword [ebx + 0x58]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.005d7058
jmp 0x5d71a5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x58]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.005d5c9c
push eax
push 8
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d71ce
call sub.user32.dll_CloseClipboard
ret
mov eax, ebx
call fcn.005d5724
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d71d8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push esi
mov dword [ebp - 4], eax
mov dx, word [0x5d7348]
mov eax, dword [ebp - 4]
call fcn.005d1018
test al, al
je 0x5d7340
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov si, 0xffef
call fcn.00404028
test al, al
je 0x5d7340
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x5d723f
mov cl, 1
mov edx, 0x5d7354
mov eax, dword [ebp - 4]
call fcn.005d1770
call fcn.00642efc
test al, al
je 0x5d72dc
xor edx, edx
push ebp
push 0x5d72d5
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
cmp dword [ebp - 0x20], 0
je 0x5d72a1
mov eax, dword [ebp - 0x20]
call fcn.0062fa9c
test al, al
jne 0x5d72a1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.005d1f34
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.005d7058
jmp 0x5d72ba
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.005d5c9c
push eax
push 8
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d72dc
call sub.user32.dll_CloseClipboard
ret
cmp dword [ebp - 0x20], 0
je 0x5d7308
mov eax, dword [ebp - 0x20]
call fcn.0062fa9c
test al, al
jne 0x5d7308
mov eax, dword [ebp - 4]
call fcn.005d1f34
mov ecx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov edx, dword [ebp - 0x20]
call fcn.005d73c8
jmp 0x5d7338
mov eax, dword [ebp - 0x10]
dec eax
push eax
mov eax, dword [ebp - 0x14]
dec eax
push eax
mov eax, dword [ebp - 4]
call fcn.005d1f34
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x24]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.006385c4
mov eax, dword [ebp - 4]
call fcn.005d0ee0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e1098
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x34], 0
jne 0x5e10c3
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx + 0xc]
call fcn.00435bf8
xor ecx, ecx
xor edx, edx
call fcn.00430818
jmp 0x5e1153
mov eax, dword [ebx + 0x20]
imul dword [ebx + 0x24]
test eax, eax
jns 0x5e10d0
add eax, 0x3f
sar eax, 6
imul esi
mov dword [esp], eax
fild dword [esp]
mov dword [esp + 4], esi
fild dword [esp + 4]
fdiv dword [0x5e115c]
fmulp st(1)
fdiv dword [0x5e1160]
call fcn.00402ffc
mov edx, eax
mov eax, edx
sub eax, dword [ebx + 0x38]
mov dword [ebx + 0x38], edx
mov ebp, eax
dec ebp
test ebp, ebp
jl 0x5e1153
inc ebp
mov eax, dword [ebx + 0x20]
call fcn.0040359c
mov esi, eax
and esi, 0xfffffff8
mov eax, dword [ebx + 0x24]
call fcn.0040359c
mov edi, eax
and edi, 0xfffffff8
push 0xcc0020
push edi
push esi
mov eax, dword [ebx + 8]
call fcn.00435bf8
call fcn.00430f3c
push eax
push 8
push 8
push edi
push esi
mov eax, dword [ebx + 0xc]
call fcn.00435bf8
call fcn.00430f3c
push eax
call sub.gdi32.dll_BitBlt
dec ebp
jne 0x5e1108
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x62b2a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040513c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x62b2c1
test al, 0x10
jne 0x62b2c5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x632570
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x6325b3
cmp dword [esp + 0x10], 2
jne 0x63259c
cmp dword [esp + 4], 5
jb 0x63259c
mov bl, 1
jmp 0x6325b3
cmp dword [esp + 0x10], 1
jne 0x6325b3
cmp dword [esp + 4], 4
jb 0x6325b3
cmp dword [esp + 8], 0x5a
jb 0x6325b3
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x63e6e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x63e7f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [0x989ef8]
cmp dword [eax], 0
jne 0x63e747
lea eax, [ebp - 0x10d]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 8]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404ef4
jmp 0x63e757
lea eax, [ebp - 8]
mov edx, dword [0x989ef8]
mov edx, dword [edx]
call fcn.00404d14
lea ecx, [ebp - 0x114]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00642398
mov edx, dword [ebp - 0x114]
lea eax, [edi + 8]
call fcn.00404cd0
xor eax, eax
push ebp
push 0x63e7c6
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x63e79b
mov ecx, dword [edi + 8]
mov dl, 1
mov eax, dword [0x62a730]
call fcn.0063ea4c
mov dword [edi + 4], eax
jmp 0x63e7aa
mov dl, 1
mov eax, dword [0x41f018]
call fcn.00403dfc
mov dword [edi + 4], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [edi + 4]
call fcn.00424580
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63e7d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63e7f8
lea eax, [ebp - 0x114]
call fcn.00404c7c
lea eax, [ebp - 8]
call fcn.00404c7c
ret