joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458be8
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push edx
push ecx
push edi
call fcn.004a4ac4
add esp, 0x10
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push edx
push ecx
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004a4fbc
add esp, 0x14
call fcn.0041aa48
push 0x42
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458858
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
setne bl
and ebx, 1
test ebx, ebx
je 0x458cfd
test edi, edi
jle 0x458c55
cmp dword [ebp + 0x10], 0
jge 0x458c60
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetLocalTime
jmp 0x458c70
push 0x10
push 0
lea edx, [ebp - 0x3c]
push edx
call fcn.004ab4f0
add esp, 0xc
test edi, edi
jle 0x458c8c
mov cx, word [ebp - 4]
mov word [ebp - 0x3c], cx
mov ax, word [ebp - 8]
mov word [ebp - 0x3a], ax
mov dx, word [ebp - 0xc]
mov word [ebp - 0x36], dx
cmp dword [ebp + 0x10], 0
jl 0x458cb2
mov cx, word [ebp - 0x10]
mov word [ebp - 0x34], cx
mov ax, word [ebp - 0x14]
mov word [ebp - 0x32], ax
mov dx, word [ebp - 0x18]
mov word [ebp - 0x30], dx
mov cx, word [ebp - 0x1c]
mov word [ebp - 0x2e], cx
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x3c]
push edx
call sub.KERNEL32.DLL_SystemTimeToFileTime
lea ecx, [ebp - 0x24]
push ecx
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x24]
push ecx
push 0
push esi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_SetFileTime
test eax, eax
setne bl
and ebx, 1
push 0
push ebx
call fcn.0045a680
add esp, 8
push esi
call fcn.004589e8
pop ecx
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x458d0c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.0041aa48
mov ebx, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.0045a214
pop ecx
mov dword [ebp - 4], eax
test esi, 1
mov edi, eax
je 0x458d3a
or ebx, 1
test esi, 2
je 0x458d45
or ebx, 2
test esi, 4
je 0x458d50
or ebx, 4
test esi, 0x80
je 0x458d5e
or ebx, 0x80
push ebx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne cl
and ecx, 1
mov ebx, ecx
push 0
push ebx
call fcn.0045a680
add esp, 8
test edi, edi
je 0x458d88
push edi
call fcn.0043b208
pop ecx
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x458d98
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0041aa48
push 0
lea eax, [ebp - 4]
push eax
movzx edx, word [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
push 0
test ebx, ebx
setne al
and eax, 1
push eax
call fcn.0045a680
add esp, 8
test ebx, ebx
je 0x458de0
mov dx, word [ebp - 4]
jmp 0x458de2
xor edx, edx
mov ebx, edx
call fcn.0041aab8
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x458df0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
call fcn.0041aa48
xor eax, eax
mov dword [ebp - 4], eax
test si, si
je 0x458e2a
movzx ecx, si
lea edx, [ebp - 4]
push 0
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
mov ebx, eax
jmp 0x458e3e
xor edx, edx
mov dword [ebp - 4], edx
push ebx
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
push 0
test ebx, ebx
setne cl
and ecx, 1
push ecx
call fcn.0045a680
add esp, 8
test ebx, ebx
je 0x458e5b
mov ax, word [ebp - 4]
jmp 0x458e5d
xor eax, eax
mov ebx, eax
call fcn.0041aab8
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x458e6c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0041aa48
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x458e9d
mov ebx, dword [ebp - 4]
jmp 0x458e9f
xor ebx, ebx
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.0045a680
add esp, 8
call fcn.0041aab8
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x458ec0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.0041aa48
test edi, edi
je 0x458f0c
push 0
lea eax, [ebp - 4]
push eax
push edi
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x458ef7
mov ebx, dword [ebp - 4]
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.0045a680
add esp, 8
jmp 0x458f2c
push 0
push esi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.0045a680
add esp, 8
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x458f3c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0041aa48
xor esi, esi
call fcn.004a98d8
test eax, eax
je 0x458fb9
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x28]
push edx
call fcn.004ab4f0
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x1c], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x28]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
push edi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne cl
and ecx, 1
push ecx
call fcn.0045a680
add esp, 8
mov esi, dword [ebp - 4]
jmp 0x459051
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push 0
push edx
push ebx
push edi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x45901b
cmp dword [ebp - 0xc], 0xffffffff
jne 0x45901b
push 0
push 0
call fcn.0045a680
add esp, 8
jmp 0x459051
xor ecx, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push 0
push 0
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.0045a680
add esp, 8
mov esi, dword [ebp - 0x14]
call fcn.0041aab8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0041aa48
xor esi, esi
call fcn.004a98d8
test eax, eax
je 0x4590dd
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x28]
push edx
call fcn.004ab4f0
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x1c], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x28]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
push edi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
push ecx
call fcn.0045a680
add esp, 8
mov esi, dword [ebp - 4]
jmp 0x459175
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push 0
push edx
push ebx
push edi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x45913f
cmp dword [ebp - 0xc], 0xffffffff
jne 0x45913f
push 0
push 0
call fcn.0045a680
add esp, 8
jmp 0x459175
xor ecx, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push 0
push 0
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call fcn.00458514
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.0045a680
add esp, 8
mov esi, dword [ebp - 0x14]
call fcn.0041aab8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4596fc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.0045a214
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0041aa48
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.0045a680
add esp, 8
call fcn.0041aab8
test esi, esi
je 0x45973f
push esi
call fcn.0043b208
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x459748
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.0045a214
pop ecx
mov esi, eax
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0045a214
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
call fcn.0041aa48
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne cl
and ecx, 1
mov ebx, ecx
push 0
push ebx
call fcn.0045a680
add esp, 8
call fcn.0041aab8
test esi, esi
je 0x4597a0
push esi
call fcn.0043b208
pop ecx
test edi, edi
je 0x4597ab
push edi
call fcn.0043b208
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4598cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov byte [ebx], 0
cmp dword [ebp + 8], 0
jle 0x459903
call fcn.00459b70
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
je 0x459903
mov ecx, dword [ebp + 8]
dec ecx
push ecx
call fcn.00459b20
pop ecx
call fcn.0041aa48
mov edi, dword [ebp + 0x10]
mov eax, edi
add eax, eax
push eax
call fcn.0043b120
pop ecx
mov esi, eax
mov word [esi], 0
push 0
push esi
push edi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
push eax
call fcn.0045a680
mov word [esi + edi*2 - 2], 0
add esp, 8
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
push esi
call fcn.004496d8
add esp, 0xc
push esi
call fcn.0043b208
pop ecx
call fcn.0041aab8
call fcn.0045a644
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x45997a
mov edx, dword [ebp - 4]
dec edx
push edx
call fcn.00459b20
pop ecx
push edi
call fcn.0045a66c
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ebx + ecx - 1], 0
test edi, edi
jne 0x4599ff
cmp byte [ebx], 0
je 0x4599ff
push ebx
call fcn.004ab624
pop ecx
mov dword [ebp - 8], ebx
mov esi, eax
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x4599a7
add dword [ebp - 8], 2
sub esi, 2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx]
push ecx
push 0x53a688
call fcn.004ab5d0
add esp, 8
test eax, eax
je 0x4599c4
inc dword [ebp - 8]
dec esi
test esi, esi
je 0x4599e4
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + esi - 1]
push edx
push 0x53a688
call fcn.004ab5d0
add esp, 8
test eax, eax
je 0x4599e4
dec esi
test esi, esi
je 0x4599fb
cmp ebx, dword [ebp - 8]
je 0x4599fb
push esi
mov ecx, dword [ebp - 8]
push ecx
push ebx
call fcn.004ab4a4
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x459a08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [esi], 0
call fcn.0041aa48
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edx
push edx
call fcn.0043b120
pop ecx
mov ebx, eax
mov word [ebx], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne dl
and edx, 1
mov edi, edx
push 0
push edi
call fcn.0045a680
add esp, 8
mov eax, dword [ebp - 4]
mov word [ebx + eax*2 - 2], 0
mov edx, dword [ebp + 0xc]
dec edx
push edx
push esi
push ebx
call fcn.004496d8
add esp, 0xc
push ebx
call fcn.0043b208
pop ecx
call fcn.0041aab8
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx - 1], 0
test edi, edi
je 0x459aba
cmp byte [esi], 0
je 0x459aba
push esi
call fcn.004ab624
pop ecx
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x459aba
xor edx, edx
mov dl, byte [esi + ebx - 1]
push edx
push 0x53a688
call fcn.004ab5d0
add esp, 8
test eax, eax
jne 0x459aba
mov byte [esi + ebx], 0x5c
inc ebx
mov byte [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x459ac4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.0045a214
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0041aa48
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.0045a680
add esp, 8
push edi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.0041aab8
test esi, esi
je 0x459b17
push esi
call fcn.0043b208
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x45a7f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [eax], 0
call fcn.0041aa48
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x45a825
push ebx
call fcn.0045a214
pop ecx
mov esi, eax
jmp 0x45a827
xor eax, eax
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x45a848
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x45a848
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0045a214
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x45a87f
lea edx, [ebp - 0x424]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
jne 0x45a86d
push 0
push 0
call fcn.0045a680
add esp, 8
xor eax, eax
jmp 0x45a8e1
mov word [ebp - 0x216], 0
lea edx, [ebp - 0x424]
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x214]
push ecx
push 0
test ebx, ebx
jne 0x45a891
mov ebx, 0x53a68c
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov ebx, eax
test ebx, ebx
je 0x45a8b9
push 0x107
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.004496d8
add esp, 0xc
test esi, esi
je 0x45a8c4
push esi
call fcn.0043b208
pop ecx
test edi, edi
je 0x45a8cf
push edi
call fcn.0043b208
pop ecx
push 0
push ebx
call fcn.0045a680
add esp, 8
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebx], 0
lea eax, [ebp - 0x210]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
je 0x45a976
mov word [ebp - 2], 0
push 0x107
push ebx
lea eax, [ebp - 0x210]
xor esi, esi
push eax
call fcn.004496d8
add esp, 0xc
test esi, esi
jne 0x45a99f
cmp byte [ebx], 0
je 0x45a99f
push ebx
call fcn.004ab624
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x45a9aa
cmp eax, 0x107
jge 0x45a9aa
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x45a9aa
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bea8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x45bf99
call sub.USER32.DLL_EmptyClipboard
cmp dword [ebp + 8], 0xd
jne 0x45bee1
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440a2c
add esp, 0x10
mov esi, eax
jmp 0x45bef9
push 0
push 0
call fcn.0044923c
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440958
add esp, 0x10
mov esi, eax
test esi, esi
je 0x45bf8f
cmp dword [ebp + 8], 0xd
lea eax, [esi + 1]
jne 0x45bf11
mov edx, 2
jmp 0x45bf16
mov edx, 1
imul edx
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x45bf94
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45bf83
cmp dword [ebp + 8], 0xd
jne 0x45bf51
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00440a2c
add esp, 0x10
jmp 0x45bf69
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.0044923c
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00440958
add esp, 0x10
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_SetClipboardData
test eax, eax
setne al
and eax, 1
mov edi, eax
test edi, edi
jne 0x45bf94
push ebx
call sub.KERNEL32.DLL_GlobalFree
jmp 0x45bf94
mov edi, 1
call sub.USER32.DLL_CloseClipboard
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x45bfa4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
call sub.USER32.DLL_IsClipboardFormatAvailable
test eax, eax
je 0x45c06b
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x45c06b
push edi
call sub.USER32.DLL_GetClipboardData
mov esi, eax
test esi, esi
je 0x45c066
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45c066
push esi
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov eax, edi
dec eax
je 0x45c02d
sub eax, 6
je 0x45c02d
sub eax, 6
jne 0x45c03c
shr ebx, 1
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.00440478
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45c060
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440b58
add esp, 0x10
jmp 0x45c060
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004a85e8
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45c060
push ebx
cmp edi, 1
mov ecx, dword [ebp - 4]
push ecx
jne 0x45c051
call fcn.0044923c
jmp 0x45c053
xor eax, eax
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00440a9c
add esp, 0x10
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
test ebx, ebx
jne 0x45c07d
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043da04
add esp, 8
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45c454
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
xor ebx, ebx
push esp
call sub.USER32.DLL_GetKeyboardState
test byte [esp + 0x10], 0x80
je 0x45c46d
or ebx, 1
test byte [esp + 0x11], 0x80
je 0x45c477
or ebx, 2
test byte [esp + 0x12], 0x80
je 0x45c481
or ebx, 4
test byte [esp + 0x5b], 0x80
je 0x45c48b
or ebx, 8
test byte [esp + 0x5c], 0x80
je 0x45c495
or ebx, 0x10
test byte [esp + 0x5d], 0x80
je 0x45c49f
or ebx, 0x20
test byte [esp + 0x91], 1
je 0x45c4af
or ebx, 0x100
test byte [esp + 0x90], 1
je 0x45c4bf
or ebx, 0x200
test byte [esp + 0x14], 1
je 0x45c4cc
or ebx, 0x400
test byte [esp + 0x2d], 1
je 0x45c4d9
or ebx, 0x80
test byte [esp + 0xa0], 0x80
je 0x45c4e9
or ebx, 0x10000
test byte [esp + 0xa1], 0x80
je 0x45c4f9
or ebx, 0x20000
test byte [esp + 0xa2], 0x80
je 0x45c509
or ebx, 0x40000
test byte [esp + 0xa3], 0x80
je 0x45c519
or ebx, 0x80000
test byte [esp + 0xa4], 0x80
je 0x45c529
or ebx, 0x100000
test byte [esp + 0xa5], 0x80
je 0x45c539
or ebx, 0x200000
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x45c544
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test bl, 1
je 0x45c566
mov dl, 0x80
jmp 0x45c568
xor edx, edx
test bl, 2
mov byte [ebp - 0xf0], dl
je 0x45c577
mov al, 0x80
jmp 0x45c579
xor eax, eax
test bl, 4
mov byte [ebp - 0xef], al
je 0x45c588
mov dl, 0x80
jmp 0x45c58a
xor edx, edx
test bl, 8
mov byte [ebp - 0xee], dl
je 0x45c599
mov al, 0x80
jmp 0x45c59b
xor eax, eax
test bl, 0x10
mov byte [ebp - 0xa5], al
je 0x45c5aa
mov dl, 0x80
jmp 0x45c5ac
xor edx, edx
test bl, 0x20
mov byte [ebp - 0xa4], dl
je 0x45c5bb
mov al, 0x80
jmp 0x45c5bd
xor eax, eax
test bh, 1
mov byte [ebp - 0xa3], al
je 0x45c5cc
mov dl, 1
jmp 0x45c5ce
xor edx, edx
test bh, 2
mov byte [ebp - 0x6f], dl
je 0x45c5da
mov al, 1
jmp 0x45c5dc
xor eax, eax
test bh, 4
mov byte [ebp - 0x70], al
je 0x45c5e8
mov dl, 1
jmp 0x45c5ea
xor edx, edx
test bl, 0x80
mov byte [ebp - 0xec], dl
je 0x45c5f9
mov al, 1
jmp 0x45c5fb
xor eax, eax
test ebx, 0x10000
mov byte [ebp - 0xd3], al
je 0x45c60d
mov dl, 0x80
jmp 0x45c60f
xor edx, edx
test ebx, 0x20000
mov byte [ebp - 0x60], dl
je 0x45c61e
mov al, 0x80
jmp 0x45c620
xor eax, eax
test ebx, 0x40000
mov byte [ebp - 0x5f], al
je 0x45c62f
mov dl, 0x80
jmp 0x45c631
xor edx, edx
test ebx, 0x80000
mov byte [ebp - 0x5e], dl
je 0x45c640
mov al, 0x80
jmp 0x45c642
xor eax, eax
test ebx, 0x100000
mov byte [ebp - 0x5d], al
je 0x45c651
mov dl, 0x80
jmp 0x45c653
xor edx, edx
test ebx, 0x200000
mov byte [ebp - 0x5c], dl
je 0x45c662
mov al, 0x80
jmp 0x45c664
xor eax, eax
mov byte [ebp - 0x5b], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.DLL_SetKeyboardState
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cdc8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, 0xffffffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x45cdfe
test ecx, ecx
je 0x45cdfe
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x53a6b4]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x45cde0
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x45ce04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ax, 0xffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x45ce43
test ecx, ecx
je 0x45ce43
movzx ebx, ax
movzx edi, byte [edx]
mov esi, ebx
inc edx
xor esi, edi
and esi, 0xff
sar ebx, 8
mov si, word [esi*2 + 0x53aab4]
xor si, bx
dec ecx
mov eax, esi
jne 0x45ce1f
xor ax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4659d4
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
xor ebx, ebx
push 0x53b230
call fcn.004499f4
pop ecx
inc dword [0x54dda4]
mov eax, dword [0x54dda4]
dec eax
jne 0x465a03
push esp
push 0x101
call sub.WS2_32.DLL_WSAStartup
mov ebx, eax
push 0x53b230
call fcn.00449a14
pop ecx
mov eax, ebx
add esp, 0x190
pop ebx
ret