joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4edd70
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4edf29
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4edefc
push dword fs:[edx]
mov dword fs:[edx], esp
mov edi, dword [ebx + 0x24c]
sub edi, dword [ebx + 0x248]
test edi, edi
jle 0x4edef2
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4eddc4
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
mov esi, dword [ebx + 0x248]
lea eax, [ebp - 0xc]
call fcn.0040485c
jmp 0x4ede19
mov eax, dword [ebx + 0x210]
cmp byte [eax + esi], 0xa
jne 0x4eddfc
push dword [ebp - 0xc]
push 0x4edf40
push 0x4edf4c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404bd4
jmp 0x4ede18
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x210]
mov dl, byte [edx + esi]
call fcn.00404a3c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404b1c
inc esi
cmp esi, dword [ebx + 0x24c]
jl 0x4eddd4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004050dc
mov eax, dword [ebp - 0x14]
push eax
call fcn.004e9d8c
pop edx
call fcn.004e9ce0
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4edef2
xor eax, eax
push ebp
push 0x4edeeb
push dword fs:[eax]
mov dword fs:[eax], esp
imul eax, edi, 0x118
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 8], eax
mov esi, dword [ebx + 0x248]
mov edi, dword [ebx + 0x24c]
dec edi
sub edi, esi
jl 0x4edec0
inc edi
mov eax, dword [ebx + 0x280]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx + 0x27c]
call fcn.0041bd08
mov edx, esi
sub edx, dword [ebx + 0x248]
imul edx, edx, 0x118
mov ecx, dword [ebp - 8]
lea edx, [ecx + edx]
mov ecx, 0x118
call fcn.00402a20
inc esi
dec edi
jne 0x4ede8a
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x6648dc]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edef2
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4edf06
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edf30
lea eax, [ebp - 0x14]
call fcn.00404f80
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404880
ret
Function at 0x4edf50
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ee106
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ee0de
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x4ee0d4
call fcn.004e9d8c
lea edx, [ebp - 0x1c]
call fcn.004e9c04
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
call fcn.00404adc
cmp dword [ebp - 0x14], 0
jne 0x4edfba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ee0e8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ee0cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4ee042
mov eax, dword [0x6648dc]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x4ee042
mov eax, dword [0x6648dc]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ee042
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalSize
mov ecx, eax
mov eax, ecx
mov ebx, 0x118
cdq
idiv ebx
test edx, edx
jne 0x4ee042
mov eax, ecx
mov ecx, 0x118
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov edi, 1
mov eax, dword [ebp - 0x14]
call fcn.00404b14
mov esi, eax
test esi, esi
jle 0x4ee0a5
mov ebx, 1
mov eax, dword [ebp - 0x14]
cmp byte [eax + ebx - 1], 0xd
je 0x4ee0a1
cmp dword [ebp - 0xc], 0
je 0x4ee092
cmp edi, dword [ebp - 0x10]
jg 0x4ee092
mov eax, edi
dec eax
imul eax, eax, 0x118
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x258]
mov ecx, 0x118
call fcn.00402a20
inc edi
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + ebx - 1]
mov eax, dword [ebp - 4]
call fcn.004ea600
inc ebx
dec esi
jne 0x4ee05a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee0d4
cmp dword [ebp - 8], 0
je 0x4ee0c1
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
cmp byte [ebp - 0x15], 0
je 0x4ee0cc
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ee0e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee10d
lea eax, [ebp - 0x1c]
call fcn.00404f80
lea eax, [ebp - 0x14]
call fcn.0040485c
ret
Function at 0x4f54a8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x651b8c
test edx, edx
jne 0x4f54b8
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x4f5580
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ecx, 8
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
cmp ecx, 8
mov eax, esi
jae 0x4f54c4
test ecx, ecx
je 0x4f559d
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
dec ecx
mov eax, esi
jne 0x4f5584
xor eax, 0xffffffff
pop esi
pop ebx
ret
Function at 0x50d4e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x50d510
mov eax, ebx
call fcn.0050e004
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x50d509
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x50d588
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x50d57a
mov edx, dword [ebx + 8]
test edx, edx
je 0x50d536
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x50d548
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x50d57a
mov edx, dword [ebx + 8]
test edx, edx
je 0x50d528
cmp eax, 3
je 0x50d55c
dec eax
jne 0x50d528
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x50d528
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x50d528
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x50d5a8
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x50d5a8
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0050d5b4
pop ebx
ret
Function at 0x535030
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x53505e
mov eax, ebx
call fcn.00535ae8
cmp dword [ebx + 0x3c], 0
je 0x535057
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x5350cf
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x5350c1
cmp dword [ebx + 8], 0
je 0x535080
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x535092
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5350c1
cmp dword [ebx + 8], 0
je 0x535073
cmp eax, 3
je 0x5350a5
dec eax
jne 0x535073
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x535073
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x535073
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x5350ed
cmp dword [ebx + 0x10], 0xcc
je 0x5350ed
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005350f8
pop ebx
ret

Function at 0x54ec18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x54ec69
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x660430]
cmp dword [eax], 1
jne 0x54ec43
mov eax, ebx
call fcn.00409814
mov ebx, eax
jmp 0x54ec5f
mov eax, ebx
call fcn.00404d0c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x54ec59
test al, 0x10
je 0x54ec5d
xor ebx, ebx
jmp 0x54ec5f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54ec75
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x55b9fc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x55bb89
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x55ba4d
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x55ba5e
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x55ba74
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x55ba96
mov ebx, dword [ecx]
test ebx, ebx
jg 0x55ba8a
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x55ba8e
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x55ba7e
test di, di
je 0x55bb89
mov dl, byte [eax + 9]
sub dl, 2
je 0x55babf
sub dl, 2
je 0x55badf
sub dl, 4
je 0x55bb19
sub dl, 8
je 0x55bb3d
jmp 0x55bb89
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x55bb89
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x55bacf
jmp 0x55bb89
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x55bb89
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x55bb09
jmp 0x55bb89
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x55bb89
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x55bb29
jmp 0x55bb89
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x55bb89
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x55bb54
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5734b8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
mov ebx, eax
mov dx, word [0x573524]
mov eax, ebx
call fcn.00570b7c
test al, al
je 0x57351f
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x57351f
push 8
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x57351a
push 8
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x57351a
cmp byte [ebx + 0x30], 0
je 0x573505
mov cl, 1
mov edx, 0x573530
mov eax, ebx
call fcn.00571180
push 0
xor ecx, ecx
mov edx, dword [ebx + 0x58]
mov eax, esi
call fcn.005791fc
mov eax, ebx
call fcn.00570a54
call sub.user32.dll_CloseClipboard
pop esi
pop ebx
ret

Function at 0x574af0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, eax
mov dx, word [0x574bd0]
mov eax, ebx
call fcn.00570b7c
test al, al
je 0x574bc8
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
mov eax, ebx
mov si, 0xffef
call fcn.00403c68
test al, al
je 0x574bc1
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x574bc8
call sub.user32.dll_EmptyClipboard
cmp dword [esp + 0x18], 0
je 0x574b98
mov eax, dword [esp + 0x18]
call fcn.005a5be8
test al, al
jne 0x574b98
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
call fcn.00571944
push eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x58]
call fcn.00574a64
jmp 0x574bb2
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [ebx + 0x58]
call fcn.0057399c
push eax
push 8
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
jmp 0x574bc8
mov eax, ebx
call fcn.00573470
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x574bd4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov ebx, eax
mov dx, word [0x574d24]
mov eax, ebx
call fcn.00570b7c
test al, al
je 0x574d1b
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
mov eax, ebx
mov si, 0xffef
call fcn.00403c68
test al, al
je 0x574d1b
cmp byte [ebx + 0x30], 0
je 0x574c39
mov cl, 1
mov edx, 0x574d30
mov eax, ebx
call fcn.00571180
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x574cb7
call sub.user32.dll_EmptyClipboard
cmp dword [esp + 0x18], 0
je 0x574c90
mov eax, dword [esp + 0x18]
call fcn.005a5be8
test al, al
jne 0x574c90
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
call fcn.00571944
push eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x58]
call fcn.00574a64
jmp 0x574caa
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [ebx + 0x58]
call fcn.0057399c
push eax
push 8
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
cmp dword [esp + 0x18], 0
je 0x574ce2
mov eax, dword [esp + 0x18]
call fcn.005a5be8
test al, al
jne 0x574ce2
mov eax, ebx
call fcn.00571944
mov ecx, eax
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x58]
call fcn.00574da4
jmp 0x574d14
mov eax, dword [esp + 8]
dec eax
push eax
mov eax, dword [esp + 0x10]
dec eax
push eax
mov eax, ebx
call fcn.00571944
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x58]
call fcn.005ac5f0
mov eax, ebx
call fcn.00570a54
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x5a2a64
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
push 0x80
push 3
push 0
push 1
push 0
mov eax, ebx
call fcn.00404d0c
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5a6ff0
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x5a7033
cmp dword [esp + 0x10], 2
jne 0x5a701c
cmp dword [esp + 4], 5
jb 0x5a701c
mov bl, 1
jmp 0x5a7033
cmp dword [esp + 0x10], 1
jne 0x5a7033
cmp dword [esp + 4], 4
jb 0x5a7033
cmp dword [esp + 8], 0x5a
jb 0x5a7033
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x5b16b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b17a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65ff3c]
cmp dword [eax], 0
jne 0x5b170c
lea eax, [ebp - 0x109]
push eax
push 0xfa
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040a024
jmp 0x5b171c
lea eax, [ebp - 4]
mov edx, dword [0x65ff3c]
mov edx, dword [edx]
call fcn.004048f4
lea ecx, [ebp - 0x110]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.005b5244
mov edx, dword [ebp - 0x110]
lea eax, [ebx + 8]
call fcn.004048b0
xor eax, eax
push ebp
push 0x5b177a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x419c90]
call fcn.0041eb1c
mov esi, eax
mov dword [ebx + 4], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, esi
call fcn.0041e684
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b1786
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b17ae
lea eax, [ebp - 0x110]
call fcn.0040485c
lea eax, [ebp - 4]
call fcn.0040485c
ret
Function at 0x5b17bc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
call fcn.005b16b0
test al, al
je 0x5b190e
mov eax, dword [ebp - 4]
call fcn.005b16b0
test al, al
je 0x5b190e
mov eax, ebx
call fcn.005b1a3c
mov eax, dword [ebp - 4]
call fcn.005b1a3c
cmp dword [ebp + 0x14], 0
jne 0x5b1887
cmp dword [ebp + 0x10], 0
jne 0x5b1887
mov eax, dword [ebx + 4]
call fcn.0041e634
cmp edx, dword [ebp + 0xc]
jne 0x5b1887
cmp eax, dword [ebp + 8]
jne 0x5b1887
mov eax, dword [ebx + 4]
call fcn.00403a6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00403a6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00409a20
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404d0c
push eax
mov eax, dword [ebx + 8]
call fcn.00404d0c
push eax
call sub.KERNEL32.DLL_CopyFileA
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dl, 1
mov eax, dword [0x419c90]
call fcn.0041eb1c
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
push 2
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x419c90]
call fcn.0041eb1c
mov dword [ebx + 4], eax
jmp 0x5b190e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebx + 4]
call fcn.0041e620
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0041e620
mov eax, 0x100000
call fcn.004027ac
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x5b18c4
cmp dword [ebp + 8], 0x100000
jae 0x5b18cb
jmp 0x5b18c6
jge 0x5b18cb
mov esi, dword [ebp + 8]
jmp 0x5b18d0
mov esi, 0x100000
mov edx, dword [ebp - 8]
mov ecx, esi
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jne 0x5b1904
cmp dword [ebp + 8], 0
ja 0x5b18b3
jmp 0x5b1906
jg 0x5b18b3
mov eax, dword [ebp - 8]
call fcn.004027cc
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x5b1b74
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov ecx, dword [esp + 0xc]
mov eax, ecx
xor edx, edx
cmp edx, 0
jne 0x5b1b9a
cmp eax, 0x77359400
jbe 0x5b1ba3
jmp 0x5b1b9c
jle 0x5b1ba3
mov eax, 0x77359400
jmp 0x5b1ba5
mov eax, ecx
add esp, 0x20
ret
Function at 0x5c9468
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, eax
xor edx, edx
push ebp
push 0x5c952e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x65fe64]
mov eax, dword [eax]
cmp dword [eax + 0x4d0], 7
je 0x5c949e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c9538
push 0x5c9540
push 0x5c9548
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x5c9524
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c9524
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
sub eax, edi
cmp eax, 0x50
jge 0x5c9524
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0x96
jge 0x5c9524
mov eax, dword [0x660400]
mov eax, dword [eax]
call fcn.00469450
mov edx, dword [esi + 0x308]
add eax, dword [edx + 0x14]
cmp edi, eax
jge 0x5c9524
mov eax, dword [0x660400]
mov eax, dword [eax]
call fcn.00469450
mov edx, dword [esi + 0x308]
add eax, dword [edx + 0x14]
cmp eax, dword [ebp - 4]
jge 0x5c9524
mov eax, ebx
mov dword [esi + 0x2f8], eax
push 0
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c9538
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret