joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3db8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c3f62
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.006265c4
mov dl, 1
mov eax, dword [0x64dec8]
call fcn.006515a0
mov ebx, eax
push 0
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 4]
call fcn.0059cec8
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov dl, 6
mov eax, ebx
call fcn.006525b0
mov edi, dword [0x674c84]
sub edi, 4
mov dword [ebp - 8], edi
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x1c]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x28]
pop edx
cmp edx, eax
jle 0x4c3e4e
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x1c]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x28]
push eax
push edi
call sub.kernel32.dll_MulDiv
mov edi, eax
jmp 0x4c3e6a
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x28]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_MulDiv
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, ebx
call fcn.0065371c
mov edi, eax
cmp dword [esi + 8], 0
jne 0x4c3e8f
mov dl, 1
mov eax, dword [0x64dec8]
call fcn.006515a0
mov dword [esi + 8], eax
mov esi, dword [esi + 8]
mov dl, 6
mov eax, esi
call fcn.006525b0
mov ecx, dword [0x674c84]
mov edx, dword [0x674c84]
mov eax, esi
call fcn.006526e8
mov eax, esi
call fcn.00651940
mov eax, dword [eax + 0x14]
mov edx, 0x80000005
call fcn.0064e7f4
mov eax, esi
call fcn.00651940
mov eax, dword [eax + 0xc]
mov edx, 0x80000008
call fcn.0064e304
lea ecx, [ebp - 0x18]
mov edx, dword [0x674c84]
mov eax, dword [0x674c84]
call fcn.0065623c
mov eax, esi
call fcn.00651940
lea edx, [ebp - 0x18]
call fcn.0064ed10
push edi
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x1c]
mov edx, dword [0x674c84]
sub edx, eax
sar edx, 1
jns 0x4c3f0f
adc edx, 0
push edx
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x28]
mov edx, dword [0x674c84]
sub edx, eax
sar edx, 1
jns 0x4c3f26
adc edx, 0
push edx
mov eax, esi
call fcn.00651940
pop edx
pop ecx
call fcn.0064ec30
mov eax, edi
call fcn.004028c0
mov eax, ebx
call fcn.004028c0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3f69
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x4c8648
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c8780
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c8760
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x104
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.00403990
lea eax, [ebp - 0x21c]
mov edx, 0x4c8794
call fcn.00403ac4
mov eax, dword [ebp - 0x21c]
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x4c86e9
lea eax, [ebp - 0x216]
push eax
call sub.kernel32.dll_lstrlenW
mov ecx, eax
lea edx, [ebp - 0x216]
mov eax, ebx
call fcn.00403964
jmp 0x4c86f0
mov eax, ebx
call fcn.00403880
cmp si, 0x61
jae 0x4c8712
lea edx, [ebp - 0x21c]
mov eax, dword [ebx]
call fcn.0065c3f0
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.004038bc
jmp 0x4c872c
lea edx, [ebp - 0x21c]
mov eax, dword [ebx]
call fcn.0065c380
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.004038bc
cmp dword [ebx], 0
je 0x4c8749
push 0x4c87a0
push dword [ebx]
push 0x4c87a8
mov eax, ebx
mov edx, 3
call fcn.00403b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8767
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4c8884
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c89dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0063cbe0
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
mov dword [esi + 0x18c], ebx
mov dword [ebp - 4], ebx
mov ebx, 2
mov eax, ebx
cmp eax, 0x1f
ja 0x4c88cf
bt dword [ebp - 4], eax
jae 0x4c89af
mov edi, ebx
add di, 0x61
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00403990
lea eax, [ebp - 0x14]
mov edx, 0x4c89f0
call fcn.00403ac4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetDriveTypeW
mov byte [ebp - 5], al
cmp byte [ebp - 5], 5
je 0x4c89af
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00403990
lea eax, [ebp - 0x14]
mov edx, 0x4c89f0
call fcn.00403ac4
mov eax, dword [ebp - 0x14]
call fcn.00626348
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4c893e
mov al, byte [esi + 0x190]
test al, al
je 0x4c894e
sub al, 2
je 0x4c894e
cmp byte [ebp - 0xd], 0
jne 0x4c89af
mov al, byte [esi + 0x190]
sub al, 2
jae 0x4c89af
cmp byte [ebp - 5], 4
jne 0x4c8960
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.004c87ac
jmp 0x4c896a
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.004c8648
cmp byte [ebp - 0xd], 0
je 0x4c8976
mov byte [ebp - 6], 3
jmp 0x4c897a
mov byte [ebp - 6], 2
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.00403990
push dword [ebp - 0x18]
push 0x4c89fc
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403b88
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [ebp - 6]
mov eax, dword [esi + 0x120]
call fcn.0065779c
inc ebx
cmp ebx, 0x1a
jne 0x4c88c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c89e3
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0xc]
call fcn.00403880
ret

Function at 0x4ca810
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ca8bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0065b8e4
cmp ax, 0x5c
jne 0x4ca845
push 0
push edi
call sub.kernel32.dll_CreateDirectoryW
mov bl, 1
jmp 0x4ca8a1
xor ebx, ebx
lea edx, [ebp - 4]
mov eax, edi
call fcn.0065cfe0
mov eax, dword [ebp - 4]
call fcn.0062afc8
mov eax, esi
call fcn.0065cc54
test al, al
je 0x4ca871
push 0
push edi
push esi
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x4ca875
mov bl, 1
jmp 0x4ca8a1
lea ecx, [ebp - 8]
mov eax, 0x4ca8d0
mov edx, edi
call fcn.0065d968
mov eax, dword [ebp - 8]
mov cx, word [0x4ca8ec]
mov dl, 1
call fcn.004c9950
sub eax, 3
je 0x4ca8a1
sub eax, 2
jne 0x4ca859
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca8c6
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x4dad18
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4dae6f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00656a20
mov ebx, eax
sub esi, 0x131
je 0x4dad4a
sub esi, 0x14
je 0x4dad5a
jmp 0x4dad6b
call fcn.004d66ac
mov edx, eax
mov eax, ebx
call fcn.00656c78
jmp 0x4dad7a
call fcn.005397ec
mov edx, dword [eax + 0xc]
mov eax, ebx
call fcn.00656bec
jmp 0x4dad7a
call fcn.005397ec
mov edx, dword [eax + 0x10]
mov eax, ebx
call fcn.00656bec
mov esi, dword [ebx + 0x18]
cmp esi, 1
jne 0x4dada7
call fcn.004d66ac
mov eax, dword [eax + 0x158]
lea edx, [ebp - 0xc]
call fcn.0065d088
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
mov edx, 0x4dae84
call fcn.0065ced8
jmp 0x4dadc1
lea ecx, [ebp - 0x10]
mov eax, 0x4dae90
mov edx, esi
call fcn.0065da0c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0065c958
lea eax, [ebp - 0xc]
call fcn.006261cc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00403b24
mov eax, dword [ebp - 8]
call fcn.0065cc54
test al, al
je 0x4dadf0
lea edx, [ebp - 8]
mov eax, 0x4dae84
call fcn.00626580
call fcn.005397ec
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.005392c0
test al, al
je 0x4dae45
call fcn.006562d0
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x30]
call fcn.006562d0
mov edi, eax
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, edi
mov eax, esi
call fcn.00539e24
mov eax, edi
call fcn.004028c0
mov eax, esi
call fcn.004028c0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, ebx
call fcn.00656ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dae76
lea eax, [ebp - 0x10]
call fcn.00403274
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403898
ret
Function at 0x4df900
Capabilities:
Create process on windows

Disassembly:
call fcn.005397ec
mov edx, dword [0x672428]
mov edx, dword [edx + 0x2dc]
xor ecx, ecx
call fcn.00537bbc
test eax, eax
je 0x4df922
call fcn.0059a5e8
ret
mov eax, dword [0x672234]
cmp byte [eax], 0
je 0x4df96f
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
call fcn.00539bcc
cmp al, 0xff
je 0x4df96f
push 5
push 0
push 0
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
push eax
push 0x4df9bc
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4df9b9
mov eax, 0x4df9c8
call fcn.00629668
jmp 0x4df9b9
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
call fcn.00539ba0
test al, al
je 0x4df99b
call fcn.005397ec
mov edx, dword [0x672428]
mov edx, dword [edx + 0x2dc]
call fcn.00536890
jmp 0x4df9b9
push 5
push 0
push 0
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
push eax
push 0x4df9f0
push 0
call sub.shell32.dll_ShellExecuteW
ret

Function at 0x4df9fc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4dfb83
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
call fcn.0065d088
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.0065cf64
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
push eax
push 0x4f5ab4
lea eax, [ebp - 8]
mov cl, 1
mov edx, 0x4dfb98
call fcn.0042964c
test al, al
je 0x4dfb68
call fcn.005397ec
mov edx, dword [0x672428]
mov edx, dword [edx + 0x2dc]
xor ecx, ecx
call fcn.00537bbc
mov ebx, eax
test ebx, ebx
je 0x4dfa9b
mov eax, ebx
call fcn.0059a5e8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov edx, 0x8c
call fcn.004ed070
call fcn.005397ec
mov eax, dword [eax + 0xc]
mov edx, ebx
call fcn.00656dac
test al, al
jne 0x4dfb68
lea edx, [ebp - 0x10]
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
call fcn.0065d0b8
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0065ced8
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
call fcn.0065cfe0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
pop ecx
call fcn.00403b24
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4dfb47
mov eax, dword [0x672428]
add eax, 0x2dc
mov edx, dword [ebp - 8]
call fcn.004038bc
call fcn.00501d74
mov byte [eax + 0x281], 1
test ebx, ebx
je 0x4dfb40
call fcn.005397ec
mov edx, dword [ebp - 8]
call fcn.00536890
call fcn.00501d7c
jmp 0x4dfb68
mov eax, dword [0x672428]
mov eax, dword [eax + 0x2dc]
call fcn.0065cc54
test al, al
je 0x4dfb68
mov eax, 0x4dfba4
mov edx, dword [ebp - 4]
call fcn.0062967c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfb8a
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403898
ret
Function at 0x4fa7a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.005c9e8c
test al, al
jne 0x4fa8d5
cmp byte [ebx + 0x466], 0
jne 0x4fa8d5
cmp byte [ebx + 0x406], 0
je 0x4fa824
mov eax, ebx
call fcn.005bdb8c
lea edx, [ebx + 0x250]
xor ecx, ecx
mov eax, ebx
call fcn.005c2354
mov dl, 0x27
mov eax, ebx
call fcn.00565be8
mov dl, 0x12
mov eax, ebx
call fcn.00565be8
lea edx, [ebx + 0x250]
mov cl, byte [0x4fa8d8]
mov eax, ebx
call fcn.005c315c
mov edx, 2
mov eax, ebx
call fcn.00565ca4
mov byte [ebx + 0x406], 0
jmp 0x4fa8d5
cmp byte [ebx + 0x404], 0
jne 0x4fa8be
cmp byte [ebx + 0x405], 0
jne 0x4fa8be
mov eax, 0x12c
call fcn.0065ed7c
test al, al
je 0x4fa8be
call fcn.00660e34
mov esi, eax
mov eax, dword [ebx + 0x134]
cmp dword [eax + 0x18], 0x3e8
jl 0x4fa870
mov byte [ebx + 0x405], 1
call fcn.00501d7c
jmp 0x4fa8be
cmp byte [ebx + 0x146], 0
je 0x4fa888
mov eax, ebx
call fcn.005c76dc
test al, al
je 0x4fa888
xor eax, eax
jmp 0x4fa88a
mov al, 1
and eax, 0x7f
lea ecx, [eax + eax*4]
mov eax, dword [ebx + 0x134]
add ecx, dword [eax + 0x18]
mov eax, dword [ebx + 0x134]
mov edx, dword [eax + 0x18]
mov eax, ebx
call fcn.005bfa4c
cmp byte [ebx + 0x404], 0
jne 0x4fa8be
call fcn.00660e34
sub eax, esi
cmp eax, 0x32
jl 0x4fa853
mov eax, 0x1388
call fcn.0065ed7c
test al, al
je 0x4fa8d5
xor edx, edx
mov eax, ebx
call fcn.005f02e4
pop esi
pop ebx
ret
Function at 0x50d328
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x50d472
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.0065c380
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 4]
call fcn.004038bc
mov edx, dword [ebp - 4]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x50d432
lea edx, [ebp - 0x2c0]
mov eax, dword [ebp - 4]
call fcn.0065d0b8
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 0x2c4]
call fcn.004034e4
mov eax, dword [ebp - 0x2c4]
lea edx, [ebp - 8]
call fcn.0065c348
mov eax, dword [ebp - 8]
mov edx, 0x50d48c
call fcn.0040362c
je 0x50d3f9
mov eax, dword [esi + 4]
mov edi, dword [eax + 0x24]
dec edi
cmp edi, 0
jl 0x50d3f9
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + edi*4]
mov edx, dword [ebp - 8]
call fcn.0065cf78
test al, al
je 0x50d3f3
mov ebx, edi
jmp 0x50d3f9
dec edi
cmp edi, 0xffffffff
jne 0x50d3da
cmp ebx, 0xffffffff
jne 0x50d432
push 0x101
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ecx, dword [ebp - 0x2bc]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 4]
call fcn.0065779c
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x24]
dec ebx
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d479
lea eax, [ebp - 0x2c4]
call fcn.00403274
lea eax, [ebp - 0x2c0]
call fcn.00403880
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x531538
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x53159a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x198]
mov edx, dword [eax]
call dword [edx + 0x28]
push eax
push 0x64
mov eax, dword [ebx + 0x194]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_MulDiv
mov edx, eax
lea ecx, [ebp - 4]
mov eax, 0x5315a8
call fcn.0065da0c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00646734
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5315a1
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x5345f4
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x28], 0
jne 0x53460c
push esi
call sub.user32.dll_GetClipboardData
jmp 0x534646
mov edi, esi
mov edx, edi
mov eax, dword [ebx + 0x1c]
call fcn.00656dac
test al, al
je 0x534644
push esp
mov edx, edi
mov eax, dword [ebx + 0x1c]
call fcn.00656d48
mov edx, dword [ebx + 0x24]
mov edx, dword [edx + 0x1c]
mov eax, dword [edx + eax*4]
push eax
mov eax, dword [ebx + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x534644
mov eax, dword [esp + 4]
jmp 0x534646
xor eax, eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x534810
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.00660e34
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x14]
push eax
call sub.user32.dll_OpenClipboard
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x534844
call fcn.00660e34
sub eax, esi
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jl 0x53481c
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x534b80
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x534c65
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x30]
call fcn.00403274
mov edx, dword [0x674e20]
mov eax, dword [ebx + 0x1c]
call fcn.00656dac
test al, al
je 0x534c4f
mov eax, dword [0x674e20]
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
call sub.kernel32.dll_GlobalSize
mov edi, eax
lea eax, [ebx + 0x2c]
mov edx, edi
call fcn.00403804
push esi
call sub.kernel32.dll_GlobalLock
mov edx, eax
lea eax, [ebx + 0x2c]
mov ecx, edi
call fcn.00403358
push esi
call sub.kernel32.dll_GlobalUnlock
mov edx, dword [ebx + 0x2c]
mov eax, 0x534c7c
call fcn.0065c708
mov esi, eax
test esi, esi
je 0x534c47
add esi, 0xa
jmp 0x534c20
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2c]
mov dl, byte [edx + esi - 1]
call fcn.00403418
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x30]
call fcn.00403524
inc esi
cmp edi, esi
jl 0x534c47
mov eax, dword [ebx + 0x2c]
cmp byte [eax + esi - 1], 0x20
je 0x534c05
mov eax, dword [ebx + 0x2c]
xor edx, edx
mov dl, byte [eax + esi - 1]
mov eax, dword [0x672820]
mov eax, dword [eax]
call fcn.006570e4
test al, al
jne 0x534c05
lea eax, [ebx + 0x30]
call fcn.0065b940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534c6c
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x534e78
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor eax, eax
push ebp
push 0x534ff3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x28]
call fcn.004a46f0
call fcn.00656518
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x44]
lea eax, [ebp - 0xc]
mov ecx, 0x535008
call fcn.00403b24
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
call fcn.00656834
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x44]
lea eax, [ebp - 0xc]
mov ecx, 0x535008
call fcn.00403b24
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [esi]
cmp dword [eax + 8], 0
jle 0x534fce
push 0x53501c
call sub.kernel32.dll_lstrlenA
mov ebx, eax
add ebx, 0x14
mov edx, 0x535074
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.0065ba80
mov edi, eax
mov eax, dword [esi]
sub edi, dword [eax + 4]
add edi, ebx
add edi, 0x16
mov edx, 0x53508c
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.0065ba80
mov edx, dword [esi]
sub eax, dword [edx + 4]
add eax, ebx
sub eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x28], 0
mov eax, dword [esi]
mov eax, dword [eax + 8]
add eax, ebx
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
mov eax, 0x53501c
mov ecx, 3
call fcn.0065d7d4
push ebx
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00656790
mov eax, dword [esi]
mov eax, dword [eax + 8]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov edx, dword [ebp + 8]
mov dword [edx - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.004023c8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [esi]
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534ffa
lea eax, [ebp - 0xc]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x5356f8
Capabilities:
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov esi, edx
test esi, esi
je 0x53573b
call sub.user32.dll_EmptyClipboard
mov eax, esi
call fcn.00403ab8
mov edi, eax
inc edi
add edi, edi
push edi
push 2
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, esi
mov ecx, edi
call fcn.004023c8
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
pop edi
pop esi
pop ebx
ret

Function at 0x535d64
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
mov byte [esp + 4], 0
mov ecx, 1
mov edx, 0x80000000
mov eax, dword [esp]
call fcn.00660d68
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x535d9f
mov eax, 0x535e00
mov edx, dword [esp]
call fcn.00629744
jmp 0x535df2
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
mov eax, edi
mov edx, esi
call fcn.00403804
push 0
lea eax, [esp + 0xc]
push eax
push esi
mov eax, dword [edi]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x535ddc
mov edx, dword [ebp + 4]
mov eax, 0x535e18
call fcn.00629744
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x535df2
push ebx
call sub.kernel32.dll_CloseHandle
lea eax, [ebp + 4]
mov edx, dword [esp]
call fcn.004038bc
mov byte [esp + 4], 1
mov al, byte [esp + 4]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret