joyce8/EMBER2024-capa huggingface dataset:
Function at 0x520850
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, ecx
mov dword [eax], 1
mov ax, word [esp + 0x230]
mov ebp, dword [esi + 0xc4]
lea ebx, [esi + 0xc4]
cmp ax, 0x84ec
push edi
jne 0x52088b
mov dword [ebx], 0
jmp 0x5209fb
cmp ax, 0x84ed
jne 0x52089c
mov dword [ebx], 1
jmp 0x5209fb
cmp ax, 0x84ee
jne 0x5208ad
mov dword [ebx], 2
jmp 0x5209fb
cmp ax, 0x84ef
jne 0x5208be
mov dword [ebx], 3
jmp 0x5209fb
cmp ax, 0x84f0
jne 0x5209ee
mov ecx, dword [esi + 0xec]
push ecx
lea ecx, [esp + 0x20]
call fcn.0050fe10
lea edx, [esp + 0x18]
lea ecx, [esp + 0x1c]
push edx
call fcn.00510700
mov edi, eax
mov eax, dword [0x546560]
mov ecx, str.MEDIA2017_IZASSHJ
mov dword [esp + 0x10], eax
test ecx, ecx
jne 0x5208fe
xor eax, eax
jmp 0x520909
push str.MEDIA2017_IZASSHJ
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
push ecx
mov edx, dword [ecx - 8]
lea ecx, [esp + 0x14]
push edx
push str.MEDIA2017_IZASSHJ
push eax
call fcn.004059f0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call fcn.00405440
mov eax, dword [esp + 0x10]
mov edx, dword [0x546564]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x52095e
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x52095e
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x520989
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x520989
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov ecx, dword [0x55e300]
lea eax, [esp + 0x24]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [esp + 0x14]
push 5
push 0
lea eax, [esp + 0x2c]
push edx
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x5209e3
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x5209e3
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0050fe40
jmp 0x5209fb
cmp ax, 0x84f3
jne 0x5209fb
mov ecx, esi
call fcn.0051cc40
push ebx
push ecx
mov ecx, esp
push str.m_type
call fcn.00412740
mov ecx, esi
call fcn.0051d650
cmp ebp, dword [ebx]
je 0x520a78
lea eax, [esi + 0xc8]
push eax
push ecx
mov ecx, esp
push 0x54fd10
mov dword [eax], 0
call fcn.00405730
mov ecx, esi
call fcn.0051d650
mov eax, dword [esi + 0xec]
mov ecx, esi
push eax
call fcn.0051f6e0
mov ecx, esi
call fcn.00520a90
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
add esi, 0x98
mov eax, dword [esi]
test eax, eax
je 0x520a6f
mov edx, dword [ebx]
xor ecx, ecx
cmp edx, edi
setne cl
dec ecx
and ecx, 5
push ecx
push eax
call ebp
inc edi
add esi, 4
cmp edi, 5
jl 0x520a58
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x21c
ret 0x10
Function at 0x525220
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
push eax
push 2
push ecx
mov ecx, esi
mov dword [esi], 0x542194
call fcn.005253d0
mov eax, dword [esi + 8]
test eax, eax
je 0x525251
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xc]
mov ecx, dword [0x546564]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x52527e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x52527e
mov eax, dword [esi + 0xc]
sub eax, 0xc
push eax
call fcn.00531732
add esp, 4
pop esi
ret

Function at 0x525280
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
push eax
push 2
push ecx
mov ecx, esi
call fcn.005253d0
mov eax, dword [esi + 8]
test eax, eax
je 0x5252b2
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
pop esi
ret

Function at 0x525470
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.Shell_TrayWnd
push 0
push 0
call esi
test eax, eax
je 0x5254ac
push 0
push str.TrayNotifyWnd
push 0
push eax
call esi
test eax, eax
je 0x5254ac
mov ecx, dword [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
pop esi
add esp, 0x24
ret
lea edx, [esp + 4]
mov dword [esp + 4], 0x24
push edx
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x525525
mov eax, dword [esp + 0x10]
cmp eax, 3
ja case.default.0x5254d2
jmp dword [eax*4 + 0x5255a0]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
pop esi
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov dword [eax + 8], edx
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
pop esi
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0xc], edx
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
add esp, 0x24
ret
push 0
push str.Shell_TrayWnd
push 0
push 0
call esi
test eax, eax
je 0x525574
mov esi, dword [esp + 0x2c]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov edx, dword [esi]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x96
jle 0x52555a
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov edx, eax
sub edx, ecx
cmp edx, 0x1e
jle case.default.0x5254d2
add eax, 0xffffffe2
mov dword [esi + 4], eax
pop esi
add esp, 0x24
ret
mov esi, dword [esp + 0x2c]
push 0
push esi
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub eax, 0x96
sub ecx, 0x1e
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
add esp, 0x24
ret
Function at 0x5255e0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
push esi
call fcn.005255b0
mov esi, dword [esp + 0x28]
test eax, eax
je 0x52561d
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 4]
push ecx
call fcn.00525470
add esp, 4
lea edx, [esp + 4]
lea eax, [esp + 0x14]
push edx
push eax
push 3
push esi
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x20
ret 4

Function at 0x5258f0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
lea ebx, [ebp + 0xc]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebx]
push edi
cmp eax, esi
je 0x5259a4
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
mov edx, dword [0x546564]
jge 0x52592c
lea edi, [eax - 0xc]
cmp edi, edx
jne 0x525935
cmp dword [esi - 0xc], 0
lea edi, [esi - 0xc]
jge 0x525974
mov edi, dword [esi - 8]
mov ecx, ebx
push edi
mov dword [esp + 0x18], edi
call fcn.00405660
test eax, eax
je 0x5259a4
lea eax, [edi + edi]
mov edi, dword [ebx]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x1c]
mov dword [ecx - 8], edx
mov ecx, dword [ebx]
mov word [eax + ecx], 0
jmp 0x5259a4
add eax, 0xfffffff4
cmp eax, edx
je 0x52599b
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x525994
mov edx, dword [ebx]
sub edx, 0xc
push edx
call fcn.00531732
add esp, 4
mov eax, dword [0x546560]
mov dword [ebx], eax
push edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, ebp
call fcn.00525790
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5259b6
mov dword [ebp + 0x18], eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5259ea
mov eax, dword [ebp + 8]
test eax, eax
je 0x5259d1
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [ebp + 4]
push ecx
push 0
push ebp
push 0x525a20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], eax
mov eax, dword [0x546564]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x525a0d
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x525a0d
push esi
call fcn.00531732
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14

Function at 0x525f30
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
test eax, eax
je 0x525f7a
mov eax, dword [esi + 4]
push 0x23
push 0x548094
push str.Save_the_changes__
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
je 0x525f75
cmp eax, 6
jne 0x525f75
mov ecx, dword [esi + 4]
push 0
push 0x3fb
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop esi
ret 0x10
cmp eax, 2
je 0x525f90
mov dword [0x55d028], 0
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10
Function at 0x5292a0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
mov ecx, 0xad
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c0]
pop edi
test eax, eax
mov eax, dword [esp + 0x2c0]
je 0x5292e2
neg eax
sbb eax, eax
lea ecx, [esp]
and eax, 2
or eax, 0x4011
push eax
push 0x2b4
push ecx
push 0x10
jmp 0x5292fe
neg eax
sbb eax, eax
lea ecx, [esp]
and eax, 2
or eax, 0x4011
push eax
push 0x2b4
push ecx
push 0x80
mov edx, dword [esp + 0x2c8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 4]
add esp, 0x2b4
ret

Function at 0x529400
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edx, dword [0x562ab8]
sub esp, 0x2b8
xor eax, eax
push esi
mov esi, dword [esp + 0x2c0]
test edx, edx
push edi
jle 0x529431
mov ecx, dword [0x562ab0]
cmp dword [ecx], esi
je 0x529509
inc eax
add ecx, 4
cmp eax, edx
jl 0x529421
lea edx, [esp + 8]
mov dword [esp + 8], 0
push edx
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, 0xad
xor eax, eax
lea edi, [esp + 0xc]
mov edx, dword [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c8]
lea ecx, [esp + 0xc]
or eax, 0x4008
push eax
push 0x2b4
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x10]
push 0
push eax
call fcn.00529320
mov ecx, dword [0x562ab8]
mov edi, eax
mov eax, dword [0x562ab0]
lea edx, [ecx*4 + 4]
push edx
push eax
call fcn.00531bb3
add esp, 0x10
test eax, eax
je 0x5294fe
mov ecx, dword [0x562ab8]
mov dword [0x562ab0], eax
mov eax, dword [0x562ab4]
lea edx, [ecx*4 + 4]
push edx
push eax
call fcn.00531bb3
add esp, 8
test eax, eax
je 0x5294fe
mov edx, dword [0x562ab0]
mov dword [0x562ab4], eax
mov eax, dword [0x562ab8]
inc eax
mov dword [0x562ab8], eax
lea ecx, [eax*4 - 4]
lea eax, [ecx + edx]
test eax, eax
je 0x5294f1
mov dword [eax], esi
mov eax, dword [0x562ab4]
add eax, ecx
test eax, eax
je 0x5294fe
mov dword [eax], edi
mov eax, edi
pop edi
pop esi
add esp, 0x2b8
ret
cmp eax, 0xffffffff
je 0x529431
mov ecx, dword [0x562ab4]
pop edi
pop esi
mov eax, dword [ecx + eax*4]
add esp, 0x2b8
ret
Function at 0x52d3a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x55e3d4]
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
and ebx, 0xffff
push 0xf1
push ebx
mov edi, ecx
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x52d3d5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x52d3eb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x52d400
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
xor esi, esi
lea ecx, [eax + 8]
mov si, word [eax + 6]
mov eax, dword [edi + 0xcc]
test eax, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x34], esi
jne 0x52d423
push esi
mov ecx, edi
call fcn.0052c980
mov edx, dword [0x55e3d4]
push ebx
push edx
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x52d445
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0x10
je 0x52d544
push 1
mov ecx, edi
call fcn.0052c980
lea eax, [esp + 0x18]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x20]
push 1
push 1
push 0x21
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov ecx, dword [edi + 0x40f0]
mov ebx, eax
push ecx
push ebp
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
jne 0x52d4a1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov ebp, eax
xor esi, esi
test ebp, ebp
jle 0x52d4cf
push 0
push esi
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov edx, dword [edi + 0xcc]
push eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
inc esi
cmp esi, ebp
jl 0x52d4b0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test ebp, ebp
je 0x52d4e5
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov esi, dword [esp + 0x34]
test esi, esi
jle 0x52d51e
mov ecx, dword [esp + 0x14]
mov ax, word [ecx]
test ax, ax
je 0x52d518
mov edx, dword [edi + 0x40e4]
and eax, 0xffff
mov dword [edi + edx*4 + 0xe4], eax
mov eax, dword [edi + 0x40e4]
inc eax
mov dword [edi + 0x40e4], eax
add ecx, 2
dec esi
jne 0x52d4f1
mov eax, dword [edi + 0xcc]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov edx, dword [edi + 0x40e4]
xor ecx, ecx
cmp eax, edx
pop edi
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x20
ret 4
mov ecx, dword [edi + 0x40f0]
mov edx, dword [edi + 0xcc]
push ecx
push ebp
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
jne 0x52d4e9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x52ea90
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x52eaf5
mov eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x6c]
push eax
push ecx
mov dword [esi + 0x9c], 0
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esi + 0x6c]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], 0
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esi + 0x64]
push 0
push ecx
mov dword [esi + 0x70], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x64]
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_KillTimer]
pop esi
ret

Function at 0x52eb10
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x6c]
cmp eax, edi
je 0x52eb4a
mov ecx, dword [esi + 0x98]
push ecx
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esi + 0x6c]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x70], edi
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [esi + 0x74], eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
mov dword [esi + 0x78], eax
call ebx
push eax
push 0x4e
call ebx
push eax
push 0x4d
call ebx
push eax
push 0x4c
call ebx
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, eax
sub ecx, edx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x74], ecx
mov ecx, dword [esp + 0x1c]
mov ebp, ecx
mov dword [esi + 0x80], ebx
sub ebp, ebx
mov dword [esi + 0x78], ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x52ebe2
mov dword [esi + 0x20], 1
mov edx, dword [ebp]
mov ebx, dword [ebp + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jmp 0x52ebe9
mov dword [esi + 0x20], 0
sub eax, edx
sub ecx, ebx
add eax, 8
add ecx, 8
push edi
mov ebp, eax
mov ebx, ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov dword [esi + 0x6c], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push ebx
push ebp
push edi
mov dword [esi + 0x98], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edx, dword [esi + 0x6c]
push eax
push edx
mov dword [esi + 0x70], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x6c]
push 0xcc0020
push eax
push ecx
push edi
push ebx
push ebp
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x52ec60
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x64]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x52ec79
pop esi
add esp, 8
ret
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x44]
mov dword [esi + 0x9c], 1
test eax, eax
jne 0x52ecac
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x52eca5
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0052eb00
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x8c]
push edx
push eax
mov ecx, esi
call fcn.0052dbf0
mov ecx, dword [esi + 0x64]
push 0
push 0xa
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi + 0x64]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
push 1
mov ecx, esi
call fcn.0052f200
mov eax, dword [esi + 0x64]
push 0x63
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x52f550
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x52f601
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [ebp + 0x64]
mov esi, eax
xor eax, eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push esi
sub edi, ecx
sub ebx, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x6c]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, dword [esp + 0x10]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
mov ecx, ebp
call fcn.0052ed10
push edi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x14
ret 4
Function at 0x52f610
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x52f6cb
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
test eax, eax
je 0x52f6cb
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x52f6cb
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call esi
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x52f6c5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov dword [ebp - 4], eax
call esi
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00531740
mov eax, dword [ebp + 8]
mov edi, esp
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52f6f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x40
lea ecx, [esp]
call fcn.0040f8f0
mov eax, dword [0x546560]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], eax
call fcn.0044bd40
mov ecx, dword [esp + 4]
mov dword [esp], 0x5421f8
push ecx
mov dword [esp + 0x3c], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x52f753
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x52f74d
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [0x562d9c], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [0x562d9c]
test eax, eax
je 0x52f772
push eax
lea ecx, [esp + 0x2c]
call fcn.0044be00
test eax, eax
je 0x52f772
mov dword [esp + 0x38], 1
push esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0x55e2f8
call fcn.0040f8b0
mov ecx, dword [0x55e300]
push 0
push 0x414350
push esi
push 0x1d5
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edx, dword [esp + 0x28]
pop esi
lea ecx, [esp + 0x28]
cmp dword [edx - 8], 4
jle 0x52f7f5
call fcn.0044bdc0
mov eax, dword [esp + 0x24]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x52f7ec
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x52f7ec
mov edx, dword [esp + 0x24]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, 1
add esp, 0x40
ret
call fcn.0044bdc0
mov eax, dword [esp + 0x24]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x52f829
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x52f829
mov edx, dword [esp + 0x24]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
xor eax, eax
add esp, 0x40
ret