joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529504
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x52950c
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52969c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
movzx edx, word [eax + 0x3e]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x30
mov ecx, dword [ebp - 4]
call fcn.004bde18
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xb3c]
mov eax, dword [eax + 0xa0]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.004b5860
test al, al
je 0x529681
cmp dword [ebp - 4], 0x3e7
jle 0x5295af
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b31c
push dword [ebp - 0xc]
push 0x5296b0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040b31c
push dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov edx, 3
call fcn.00405174
jmp 0x529623
cmp dword [ebp - 4], 0x64
jge 0x5295ed
push 0x5296bc
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040b31c
push dword [ebp - 0x14]
push 0x5296b0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0040b31c
push dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov edx, 4
call fcn.00405174
jmp 0x529623
push 0x5296c8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040b31c
push dword [ebp - 0x1c]
push 0x5296b0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0040b31c
push dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov edx, 4
call fcn.00405174
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x5160]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x529681
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x5160]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x68
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
lea eax, [ebp - 0x24]
mov edx, 0x5296d4
call fcn.00405100
mov eax, dword [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, 1
mov dl, 1
call fcn.00527250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5296a3
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404df4
ret
Function at 0x552d20
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x48], 0
je 0x552d31
mov eax, ebx
call fcn.00552e4c
mov eax, dword [ebx + 0x30]
xor edx, edx
call fcn.0040589c
je 0x552dfc
test byte [ebx + 0x1c], 0x10
jne 0x552dfc
push 0
push 0
push 0
call fcn.00407908
mov esi, eax
mov dword [ebx + 0x40], esi
test esi, esi
jne 0x552d75
mov ecx, 0x552e08
mov dl, 1
mov eax, dword [0x409fd8]
call fcn.0040f828
call fcn.00404770
push 0xffffffffffffffff
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, 0x21c
call fcn.00402a9c
mov esi, eax
mov dword [ebx + 0x3c], esi
mov eax, dword [ebx + 0x38]
mov dword [esi], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x214], eax
mov al, byte [ebx + 0x44]
mov byte [esi + 0x218], al
mov eax, dword [ebx + 0x30]
call fcn.00405774
mov edx, eax
lea eax, [esi + 8]
call fcn.004a7614
lea eax, [ebx + 0x4c]
push eax
push 0
mov eax, dword [ebx + 0x3c]
push eax
push 0x552c60
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov esi, eax
mov dword [ebx + 0x48], esi
test esi, esi
jne 0x552df5
mov ecx, 0x552e2c
mov dl, 1
mov eax, dword [0x409fd8]
call fcn.0040f828
call fcn.00404770
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x34]
pop esi
pop ebx
ret

Function at 0x553df0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x14], 0x706564
xor edx, edx
push ebp
push 0x553e70
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x553e66
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x719480]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
test eax, eax
jne 0x553e57
mov al, byte [ebp - 0xd]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553e87
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x71947c]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553e7a
inc byte [ebp - 0xd]
add dword [ebp - 0x14], 4
cmp byte [ebp - 0xd], 0x25
jne 0x553e0b
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x554aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00405b2c
xor eax, eax
push ebp
push 0x554bd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x30]
mov eax, dword [ebp - 4]
call fcn.0040b098
test al, al
je 0x554ae5
mov eax, dword [ebp - 4]
call fcn.00405784
test eax, eax
jg 0x554ba6
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x30]
call fcn.00405580
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 4]
call fcn.0040555c
mov eax, dword [ebx + 0x30]
call fcn.00405784
test eax, eax
jne 0x554b1c
lea eax, [ebp - 8]
push eax
push 0x11
mov eax, ebx
call fcn.00554120
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x554b29
mov edx, dword [ebx + 0x30]
xor eax, eax
call fcn.00553d58
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x554b69
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.0040555c
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x554be4
call fcn.004057f0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.0040507c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x553b74]
call fcn.0040f828
call fcn.00404770
mov eax, dword [ebx + 0x30]
call fcn.00405784
test eax, eax
jle 0x554b8d
mov edx, dword [ebx + 0x30]
cmp word [edx + eax*2 - 2], 0x5c
je 0x554b8d
lea eax, [ebx + 0x30]
mov edx, 0x554c14
call fcn.00405790
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00554c18
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x71947c]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554bdb
lea eax, [ebp - 0x14]
call fcn.00405520
lea eax, [ebp - 0x10]
call fcn.00404dd0
lea eax, [ebp - 0xc]
call fcn.00405520
lea eax, [ebp - 4]
call fcn.00405520
ret
Function at 0x55c39c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x55c520
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x55c505
cmp byte [ebx + 0x268], 0
je 0x55c505
mov eax, dword [ebp - 4]
call fcn.0055ff78
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x55c4fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x55c442
dec ax
je 0x55c418
sub ax, 0x12
jne 0x55c45c
call fcn.0040481c
jmp 0x55c505
cmp byte [ebx + 0x269], 0
je 0x55c4e4
mov eax, ebx
call fcn.0043ceac
test al, al
je 0x55c4e4
xor edx, edx
mov eax, ebx
call fcn.0043ced0
jmp 0x55c4e4
mov eax, dword [esi]
call fcn.00405784
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.0040596c
jmp 0x55c4e4
cmp byte [ebx + 0x269], 0
je 0x55c479
mov eax, ebx
call fcn.0043ceac
test al, al
jne 0x55c479
mov dl, 1
mov eax, ebx
call fcn.0043ced0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x55c491
mov eax, esi
call fcn.00405520
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.00405648
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.004057f0
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.0055c1ec
test al, al
je 0x55c4e4
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.00405648
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405790
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c505
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.0055ffac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c527
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405538
ret

Function at 0x55da74
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x715514]
cmp byte [eax], 0
jne 0x55daa2
mov ecx, 0xaf
mov edx, 0x55daf0
mov eax, 0x55db38
call fcn.00404d2c
mov eax, ebx
call fcn.00405520
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x55dae1
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004056dc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55db4c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x715514]
cmp byte [eax], 0
jne 0x55db6f
mov ecx, 0xbd
mov edx, 0x55dbb0
mov eax, 0x55dbf8
call fcn.00404d2c
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x55dba2
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x55dba2
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x55dba2
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x56d5e4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x56d614
mov eax, ebx
call fcn.0056e108
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x56d60d
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x56d68c
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x56d67e
mov edx, dword [ebx + 8]
test edx, edx
je 0x56d63a
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x56d64c
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x56d67e
mov edx, dword [ebx + 8]
test edx, edx
je 0x56d62c
cmp eax, 3
je 0x56d660
dec eax
jne 0x56d62c
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x56d62c
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x56d62c
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x56d6ac
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x56d6ac
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0056d6b8
pop ebx
ret
Function at 0x5940d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x594129
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x715b68]
cmp dword [eax], 1
jne 0x594103
mov eax, ebx
call fcn.004aca74
mov ebx, eax
jmp 0x59411f
mov eax, ebx
call fcn.00405774
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x594119
test al, 0x10
je 0x59411d
xor ebx, ebx
jmp 0x59411f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x594135
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x59bccc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59bd9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x59bd53
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x59bd26
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00405688
jmp 0x59bd2e
mov eax, dword [ebp - 8]
call fcn.00405520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59bd5a
cmp dword [ebp - 0xc], 0
je 0x59bd4a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x5a0954
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a0afe
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x5a0ad9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edi, dword [ebx + 0x26c]
sub edi, dword [ebx + 0x268]
test edi, edi
jle 0x5a0acf
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5a09ac
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
mov esi, dword [ebx + 0x268]
lea eax, [ebp - 0xc]
call fcn.00405520
jmp 0x5a0a03
mov eax, dword [ebx + 0x218]
cmp word [eax + esi*2], 0xa
jne 0x5a09e5
push dword [ebp - 0xc]
push 0x5a0b10
push 0x5a0b18
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405854
jmp 0x5a0a02
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x218]
mov dx, word [edx + esi*2]
call fcn.00405648
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405790
inc esi
cmp esi, dword [ebx + 0x26c]
jl 0x5a09bc
call fcn.0059be54
mov edx, dword [ebp - 0xc]
call fcn.0059bda8
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5a0acf
xor eax, eax
push ebp
push 0x5a0ac8
push dword fs:[eax]
mov dword fs:[eax], esp
imul eax, edi, 0x118
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
mov esi, dword [ebx + 0x268]
mov edi, dword [ebx + 0x26c]
dec edi
sub edi, esi
jl 0x5a0a9d
inc edi
mov eax, dword [ebx + 0x2a0]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx + 0x29c]
call fcn.0041e790
mov edx, esi
sub edx, dword [ebx + 0x268]
imul edx, edx, 0x118
mov ecx, dword [ebp - 8]
lea edx, [ecx + edx]
mov ecx, 0x118
call fcn.00402d78
inc esi
dec edi
jne 0x5a0a67
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x7199f8]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0acf
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a0ae3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0b05
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405538
ret
Function at 0x5a0b1c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a0cc4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a0ca4
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5a0c9a
call fcn.0059be54
lea edx, [ebp - 0x14]
call fcn.0059bccc
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.0040589c
jne 0x5a0b7e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a0cae
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5a0c93
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x5a0c06
mov eax, dword [0x7199f8]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5a0c06
mov eax, dword [0x7199f8]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5a0c06
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalSize
mov ecx, eax
mov eax, ecx
mov ebx, 0x118
cdq
idiv ebx
test edx, edx
jne 0x5a0c06
mov eax, ecx
mov ecx, 0x118
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov edi, 1
mov eax, dword [ebp - 0x14]
call fcn.00405784
mov esi, eax
test esi, esi
jle 0x5a0c6b
mov ebx, 1
mov eax, dword [ebp - 0x14]
cmp word [eax + ebx*2 - 2], 0xd
je 0x5a0c67
cmp dword [ebp - 0xc], 0
je 0x5a0c57
cmp edi, dword [ebp - 0x10]
jg 0x5a0c57
mov eax, edi
dec eax
imul eax, eax, 0x118
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x278]
mov ecx, 0x118
call fcn.00402d78
inc edi
mov eax, dword [ebp - 0x14]
mov dx, word [eax + ebx*2 - 2]
mov eax, dword [ebp - 4]
call fcn.0059c740
inc ebx
dec esi
jne 0x5a0c1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0c9a
cmp dword [ebp - 8], 0
je 0x5a0c87
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
cmp byte [ebp - 0x15], 0
je 0x5a0c92
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a0cae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0ccb
lea eax, [ebp - 0x14]
call fcn.00405520
ret
Function at 0x5a8014
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x710a90
test edx, edx
jne 0x5a8024
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x5a80ec
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ecx, 8
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
cmp ecx, 8
mov eax, esi
jae 0x5a8030
test ecx, ecx
je 0x5a8109
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
dec ecx
mov eax, esi
jne 0x5a80f0
xor eax, 0xffffffff
pop esi
pop ebx
ret
Function at 0x5c42d4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5c43e5
call sub.user32.dll_EmptyClipboard
mov dl, 1
mov eax, dword [0x41c770]
call fcn.00403f74
mov dword [esp], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x611e58]
call fcn.00612250
mov dword [esp + 4], eax
lea edx, [ebx + 0x88c]
mov ecx, 4
mov eax, dword [esp]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edi, dword [ebx + 0x6f4]
dec edi
test edi, edi
jl 0x5c4389
inc edi
xor ebp, ebp
mov eax, dword [ebx + 0x6f8]
mov esi, dword [eax + ebp*4]
mov edx, esi
mov eax, ebx
call fcn.005ab99c
test al, al
je 0x5c4385
mov ecx, esi
mov edx, dword [esp]
mov eax, ebx
call fcn.005bbebc
mov edx, esi
mov eax, ebx
call fcn.005abcb8
cmp byte [eax + 0x10], 5
jne 0x5c4385
mov eax, dword [eax + 0x50]
mov edx, dword [ebx + 0x8ac]
mov edx, dword [edx + eax*8]
mov eax, dword [esp + 4]
call fcn.0061d6b0
mov edx, dword [esp]
mov eax, dword [esp + 4]
call fcn.0061a528
inc ebp
dec edi
jne 0x5c4333
mov eax, dword [esp + 4]
call fcn.00403fa4
mov eax, dword [esp]
call fcn.00421204
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
mov eax, dword [esp]
call fcn.00421204
mov ecx, eax
mov eax, dword [esp]
mov edx, dword [eax + 4]
mov eax, esi
call fcn.00408894
mov eax, dword [esp]
call fcn.00403fa4
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
mov eax, dword [0x719a00]
push eax
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c43ec
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5c4585
mov eax, dword [0x719a00]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5c4580
cmp byte [ebx + 0x92c], 0
je 0x5c442d
mov eax, ebx
call fcn.005c6144
mov eax, dword [0x719a00]
push eax
call sub.user32.dll_GetClipboardData
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x5c4580
jmp 0x5c445a
mov eax, dword [ebx + 0x888]
mov esi, dword [eax]
mov edx, esi
mov eax, ebx
call fcn.005bbaa4
cmp dword [ebx + 0x88c], 0
jg 0x5c4449
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
mov dl, 1
mov eax, dword [0x41c770]
call fcn.00403f74
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GlobalSize
mov ecx, eax
mov edx, esi
mov eax, dword [esp + 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
push 0
push 0
mov eax, dword [esp + 0x14]
call fcn.004211f0
mov dl, 1
mov eax, dword [0x62f52c]
call fcn.006369fc
mov dword [esp + 0x18], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x611e58]
call fcn.00612250
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
call fcn.0061d6b0
lea edx, [esp + 0x10]
mov ecx, 4
mov eax, dword [esp + 0xc]
mov esi, dword [eax]
call dword [esi + 8]
mov edi, dword [esp + 0x10]
dec edi
test edi, edi
jl 0x5c4551
inc edi
push 0
mov cl, byte [0x710eb4]
mov edx, dword [esp + 0x10]
mov eax, ebx
call fcn.005bc744
mov esi, eax
mov edx, esi
mov eax, ebx
call fcn.005abcb8
mov edx, dword [esp]
add dword [eax], edx
mov edx, dword [esp]
add dword [eax + 8], edx
mov edx, dword [esp + 4]
add dword [eax + 4], edx
mov edx, dword [esp + 4]
add dword [eax + 0xc], edx
cmp byte [eax + 0x10], 5
jne 0x5c4545
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
call fcn.0061a1ec
mov ecx, dword [esp + 0x18]
mov edx, esi
mov eax, ebx
call fcn.005ab588
mov edx, esi
mov eax, ebx
call fcn.005ab928
dec edi
jne 0x5c44ee
mov eax, dword [esp + 0x14]
call fcn.00403fa4
mov eax, dword [esp + 0x18]
call fcn.00403fa4
mov eax, dword [esp + 0xc]
call fcn.00403fa4
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x88]
call sub.user32.dll_CloseClipboard
add esp, 0x1c
pop edi
pop esi
pop ebx
ret