joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ca48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x50ca83
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x50cb04
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.0050b00c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x50cad1
mov cx, word [ebp - 4]
sub cx, si
jmp 0x50cad3
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x50caba
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x50caf9
mov cx, word [ebp - 4]
sub cx, si
jmp 0x50cafb
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x50cae2
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x50cb66
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.0050c70c
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x50cb51
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x50cb66
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x50ca57
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x5119c8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x895648
test edx, edx
jne 0x5119e7
xor eax, eax
jmp 0x511b05
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x511a04
push esi
push edx
push eax
call fcn.00511b0c
add esp, 0xc
jmp 0x511b05
push esi
push edx
push eax
call fcn.00511dcc
add esp, 0xc
jmp 0x511b05
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5229b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x522b40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x522b58
call fcn.00521c90
cmp dword [esi], 2
jl 0x5229f6
mov eax, 0x522b78
call fcn.00521c90
mov bl, 1
jmp 0x522b1f
mov eax, dword [esi + 0x184]
mov eax, dword [eax]
test eax, eax
je 0x522a28
mov dword [esi + 4], eax
mov eax, dword [esi + 0x184]
mov eax, dword [eax + 4]
mov dword [esi + 8], eax
mov bl, 1
mov dword [esi], 2
mov eax, 0x522b78
call fcn.00521c90
jmp 0x522b1f
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrlenA_1
test eax, eax
je 0x522a64
cmp byte [ebp + eax - 0x105], 0x3a
je 0x522a64
push 0x522ba0
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x897a40]
call fcn.00404ff4
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
xor eax, eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404dac
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
call fcn.00404bcc
mov eax, dword [ebp - 4]
call fcn.00656504
test al, al
je 0x522ac0
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00411498
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
cmp dword [esi + 4], 0
je 0x522b08
mov eax, 0x522bac
call fcn.00521c90
mov eax, dword [0x897a44]
call fcn.00404ff4
push eax
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi + 8], eax
cmp dword [esi + 8], 0
je 0x522afa
mov dword [esi], 2
jmp 0x522b08
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi], 2
setge bl
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x184]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [eax + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522b47
lea eax, [ebp - 0x108]
call fcn.00404b34
lea eax, [ebp - 4]
call fcn.00404b34
ret
Function at 0x531ea8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x531ed6
mov eax, ebx
call fcn.00532960
cmp dword [ebx + 0x3c], 0
je 0x531ecf
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x531f47
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x531f39
cmp dword [ebx + 8], 0
je 0x531ef8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x531f0a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x531f39
cmp dword [ebx + 8], 0
je 0x531eeb
cmp eax, 3
je 0x531f1d
dec eax
jne 0x531eeb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x531eeb
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x531eeb
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x531f65
cmp dword [ebx + 0x10], 0xcc
je 0x531f65
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00531f70
pop ebx
ret

Function at 0x54c374
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x54c3c5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x8aa39c]
cmp dword [eax], 1
jne 0x54c39f
mov eax, ebx
call fcn.0047c0d8
mov ebx, eax
jmp 0x54c3bb
mov eax, ebx
call fcn.004054c8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x54c3b5
test al, 0x10
je 0x54c3b9
xor ebx, ebx
jmp 0x54c3bb
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54c3d1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x554fb0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55507e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x555037
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x55500a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004053d0
jmp 0x555012
mov eax, dword [ebp - 8]
call fcn.00405268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55503e
cmp dword [ebp - 0xc], 0
je 0x55502e
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x564f64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x8a0ee0
test edx, edx
jne 0x564f74
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x56503c
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ecx, 8
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
cmp ecx, 8
mov eax, esi
jae 0x564f80
test ecx, ecx
je 0x565059
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
dec ecx
mov eax, esi
jne 0x565040
xor eax, 0xffffffff
pop esi
pop ebx
ret
Function at 0x5758a4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x575a92
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x575a6d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x268]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x575a63
call fcn.00656b6c
test al, al
je 0x575929
xor eax, eax
push ebp
push 0x575922
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575929
call sub.user32.dll_CloseClipboard
ret
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x268]
lea eax, [ebp - 0x10]
call fcn.00405268
jmp 0x57598a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov si, word [eax + ebx*2]
cmp si, 0xa
jne 0x57596b
push dword [ebp - 0x10]
push 0x575aa4
push 0x575aac
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004055a8
jmp 0x575989
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x218]
mov edx, esi
call fcn.00405390
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.004054e4
inc ebx
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x26c]
jl 0x57593c
call fcn.00555138
mov edx, dword [ebp - 0x10]
call fcn.0055508c
call fcn.00656b6c
test al, al
je 0x575a63
xor eax, eax
push ebp
push 0x575a5c
push dword fs:[eax]
mov dword fs:[eax], esp
imul eax, dword [ebp - 0xc], 0x118
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edi, eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x268]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x26c]
dec esi
sub esi, ebx
jl 0x575a31
inc esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax + ebx*4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
call fcn.0041e7b0
mov edx, dword [ebp - 4]
mov ecx, ebx
sub ecx, dword [edx + 0x268]
imul edx, ecx, 0x118
lea edx, [edi + edx]
mov ecx, 0x118
call fcn.00402cd4
inc ebx
dec esi
jne 0x5759f5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x8b11ec]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575a63
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x575a77
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575a99
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405280
ret
Function at 0x575ab0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x575c50
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x575c30
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x575c26
call fcn.00555138
lea edx, [ebp - 0x14]
call fcn.00554fb0
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.004055f0
jne 0x575b12
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x575c3a
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x575c1f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00656b6c
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x575b92
mov eax, dword [0x8b11ec]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x575b92
mov eax, dword [0x8b11ec]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x575b92
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalSize
mov ecx, eax
mov eax, ecx
mov ebx, 0x118
cdq
idiv ebx
test edx, edx
jne 0x575b92
mov eax, ecx
mov ecx, 0x118
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov edi, 1
mov eax, dword [ebp - 0x14]
call fcn.004054d8
mov esi, eax
test esi, esi
jle 0x575bf7
mov ebx, 1
mov eax, dword [ebp - 0x14]
cmp word [eax + ebx*2 - 2], 0xd
je 0x575bf3
cmp dword [ebp - 0xc], 0
je 0x575be3
cmp edi, dword [ebp - 0x10]
jg 0x575be3
mov eax, edi
dec eax
imul eax, eax, 0x118
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x278]
mov ecx, 0x118
call fcn.00402cd4
inc edi
mov eax, dword [ebp - 0x14]
mov dx, word [eax + ebx*2 - 2]
mov eax, dword [ebp - 4]
call fcn.00570658
inc ebx
dec esi
jne 0x575baa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575c26
cmp dword [ebp - 8], 0
je 0x575c13
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
cmp byte [ebp - 0x15], 0
je 0x575c1e
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x575c3a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575c57
lea eax, [ebp - 0x14]
call fcn.00405268
ret
Function at 0x5abe3c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00656b6c
test al, al
je 0x5abf92
xor edx, edx
push ebp
push 0x5abf8b
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
mov dl, 1
mov eax, dword [0x41c828]
call fcn.00403cf8
mov dword [ebp - 0xc], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x618368]
call fcn.0061886c
mov dword [ebp - 0x14], eax
lea edx, [ebx + 0x94c]
mov ecx, 4
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edi, dword [ebx + 0x734]
dec edi
test edi, edi
jl 0x5abf14
inc edi
mov dword [ebp - 0x10], 0
mov eax, dword [ebx + 0x738]
mov edx, dword [ebp - 0x10]
mov esi, dword [eax + edx*4]
mov edx, esi
mov eax, ebx
call fcn.00580158
test al, al
je 0x5abf0e
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.005990cc
mov edx, esi
mov eax, ebx
call fcn.00580474
cmp byte [eax + 0x10], 5
jne 0x5abf0e
mov eax, dword [eax + 0x58]
mov edx, dword [ebx + 0x96c]
mov edx, dword [edx + eax*8]
mov eax, dword [ebp - 0x14]
call fcn.00626480
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.006225a4
inc dword [ebp - 0x10]
dec edi
jne 0x5abebb
mov eax, dword [ebp - 0x14]
call fcn.00403d28
mov eax, dword [ebp - 0xc]
call fcn.00421224
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.00421224
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, esi
call fcn.0040873c
mov eax, dword [ebp - 0xc]
call fcn.00421224
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
call fcn.00403d28
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
mov eax, dword [0x8b11f0]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5abf92
call sub.user32.dll_CloseClipboard
ret
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b56e4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x5b5871
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x5b5735
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x5b5746
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x5b575c
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x5b577e
mov ebx, dword [ecx]
test ebx, ebx
jg 0x5b5772
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x5b5776
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x5b5766
test di, di
je 0x5b5871
mov dl, byte [eax + 9]
sub dl, 2
je 0x5b57a7
sub dl, 2
je 0x5b57c7
sub dl, 4
je 0x5b5801
sub dl, 8
je 0x5b5825
jmp 0x5b5871
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x5b5871
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x5b57b7
jmp 0x5b5871
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x5b5871
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x5b57f1
jmp 0x5b5871
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x5b5871
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x5b5811
jmp 0x5b5871
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x5b5871
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x5b583c
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5c0cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x8aa39c]
cmp dword [eax], 1
jne 0x5c0cf2
mov eax, ebx
call fcn.0047c0d8
pop ebx
ret
mov eax, ebx
call fcn.004054c8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5c0d08
test al, 0x10
je 0x5c0d0c
xor eax, eax
jmp 0x5c0d0e
mov al, 1
pop ebx
ret

Function at 0x5c3e24
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004054c8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x5c6e1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5c6ed9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xef], 0x80
jne 0x5c6e55
test byte [ebp - 0x5d], 0x80
jne 0x5c6e55
xor eax, eax
jmp 0x5c6e57
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x5c6ecf
mov eax, dword [0x8a9ffc]
cmp byte [eax], 0
je 0x5c6e83
test byte [ebp - 0xf0], 0x80
jne 0x5c6e77
mov byte [ebp - 1], 0
test byte [ebp - 0x5f], 0x80
jne 0x5c6e9a
mov byte [ebp - 1], 0
jmp 0x5c6e9a
test byte [ebp - 0xf0], 0x80
je 0x5c6e90
mov byte [ebp - 1], 0
test byte [ebp - 0x5f], 0x80
je 0x5c6e9a
mov byte [ebp - 1], 0
test byte [ebp - 0x5e], 0x80
je 0x5c6ea4
mov byte [ebp - 1], 0
test byte [ebp - 0xf1], 0x80
je 0x5c6eb1
mov byte [ebp - 1], 0
test byte [ebp - 0x61], 0x80
je 0x5c6ebb
mov byte [ebp - 1], 0
test byte [ebp - 0x60], 0x80
je 0x5c6ec5
mov byte [ebp - 1], 0
test byte [ebp - 0x5c], 0x80
je 0x5c6ecf
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c6ee3
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f0104
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov dx, word [0x5f01e8]
mov eax, esi
call fcn.005ec9f8
test al, al
je 0x5f01e1
call fcn.00656b6c
test al, al
je 0x5f01e1
xor eax, eax
push ebp
push 0x5f01da
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 8
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5f0182
push 8
call sub.user32.dll_GetClipboardData
mov edi, eax
test edi, edi
je 0x5f0182
cmp byte [esi + 0x30], 0
je 0x5f016b
mov cl, 1
mov edx, 0x5f01f4
mov eax, esi
call fcn.005ed150
push 0
mov edx, dword [esi + 0x58]
xor ecx, ecx
mov eax, edi
call fcn.005f6aa8
mov bl, 1
mov eax, esi
call fcn.005ec8c0
test bl, bl
jne 0x5f01c7
push 0x11
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5f01c7
push 0x11
call sub.user32.dll_GetClipboardData
mov edi, eax
test edi, edi
je 0x5f01c7
cmp byte [esi + 0x30], 0
je 0x5f01b2
mov cl, 1
mov edx, 0x5f01f4
mov eax, esi
call fcn.005ed150
push 0
mov edx, dword [esi + 0x58]
xor ecx, ecx
mov eax, edi
call fcn.005f7110
mov eax, esi
call fcn.005ec8c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f01e1
call sub.user32.dll_CloseClipboard
ret
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5f1c80
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
mov dx, word [0x5f1d70]
mov eax, ebx
call fcn.005ec9f8
test al, al
je 0x5f1d6a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, ebx
mov si, 0xffef
call fcn.00403f24
test al, al
je 0x5f1d63
call fcn.00656b6c
test al, al
je 0x5f1d6a
xor edx, edx
push ebp
push 0x5f1d5c
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
cmp dword [ebp - 0x1c], 0
je 0x5f1d2b
mov eax, dword [ebp - 0x1c]
call fcn.006425d0
test al, al
jne 0x5f1d2b
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.005ed464
push eax
mov eax, dword [ebx + 0x58]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.005f1bf4
jmp 0x5f1d41
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x58]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.005f0660
push eax
push 8
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f1d6a
call sub.user32.dll_CloseClipboard
ret
mov eax, ebx
call fcn.005f0094
pop esi
pop ebx
mov esp, ebp
pop ebp
ret