joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0xb5
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call fcn.004e5080
add esp, 4
cmp eax, 0xffffffff
jne 0x40c8c1
pop edi
pop esi
mov dword [esp + 4], 0
jmp fcn.00421c80
push 1
push eax
push esi
call fcn.004e5140
push 0
push 2
push esi
call fcn.004e4a40
push esi
call fcn.004e5520
push edi
call fcn.0040baa0
add esp, 0x20
pop edi
mov dword [0x60d63c], 1
pop esi
ret

Function at 0x413580
Capabilities:
Get common file path

Disassembly:
lea eax, [esp + 0x14]
sub esp, 0x304
push eax
call fcn.00503130
add esp, 4
test eax, eax
jne 0x41359e
add esp, 0x304
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x314]
push edi
push 0x180
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4135c6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x304
ret
mov edi, esi
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4135d0
mov ecx, dword [str.msagentchars_]
mov dword [edi], ecx
mov edx, dword [0x5e73bc]
mov dword [edi + 4], edx
mov eax, dword [0x5e73c0]
mov dword [edi + 8], eax
mov ecx, dword [0x5e73c4]
push 2
push esi
mov dword [edi + 0xc], ecx
call fcn.00425b60
add esp, 8
test eax, eax
je 0x4135b9
mov edx, dword [esp + 0x328]
mov ebx, dword [esp + 0x31c]
push edx
xor ebp, ebp
push ebp
push ebp
push ebp
mov byte [ebx], 0
call fcn.0057d8e0
push eax
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x3e7
push ebp
push ebp
push ebp
push 1
push ebx
push str..acs
push esi
call fcn.0048f5e0
mov cl, byte [ebx]
add esp, 0x64
test cl, cl
je 0x41375c
test eax, eax
jle 0x41375c
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
inc ebp
call fcn.005cc984
mov edx, ebx
lea ecx, [esp + 0x28]
add esp, 0x14
lea eax, [esp + 0x14]
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x413690
lea eax, [esp + 0x114]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4136a3
mov edi, ebx
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4136b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x324]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jle 0x413701
mov ecx, dword [esp + 0x320]
test ecx, ecx
je 0x4136f5
cmp eax, 0x270f
jne 0x4136f5
push ecx
push ebx
call fcn.005e31f5
add esp, 8
test eax, eax
je 0x41376e
jmp 0x413701
dec eax
test eax, eax
mov dword [esp + 0x324], eax
jle 0x413763
mov edx, dword [esp + 0x328]
push edx
push 0
push 0
push 0
call fcn.0057d8e0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [esp + 0x34c]
push 0
push 0
push 0
push 0
push 0x3e7
push 0
push 0
push 0
lea eax, [ebp + 1]
push eax
push ebx
push str..acs
push ecx
call fcn.0048f5e0
mov cl, byte [ebx]
add esp, 0x64
test cl, cl
jne 0x413655
mov eax, dword [esp + 0x324]
cmp eax, 0x270f
je 0x4135b9
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x304
ret
Function at 0x41e280
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov ecx, 0x412
mov esi, 0x608280
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x41e2a6
mov ecx, 0x48
mov edi, dword [esp + 0x20]
mov eax, edi
lea edx, [ecx + edi]
xor esi, esi
push ebp
movzx ecx, byte [eax]
inc eax
cmp eax, edx
jb 0x41e2bc
mov eax, edi
movzx ebp, byte [eax]
shl ecx, 8
or ecx, ebp
inc eax
cmp eax, edx
jb 0x41e2cb
mov eax, edi
movzx ebp, byte [eax]
shl ecx, 8
or ecx, ebp
inc eax
cmp eax, edx
jb 0x41e2da
mov eax, edi
movzx ebp, byte [eax]
shl ecx, 8
or ecx, ebp
inc eax
cmp eax, edx
jb 0x41e2e9
mov eax, edi
xor dword [ebx + esi*4], ecx
inc esi
cmp esi, 0x12
jl 0x41e2b2
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
nop
push 1
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.0041db50
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 0xc
cmp esi, 0x12
jl 0x41e300
xor esi, esi
lea esp, [esp]
push 1
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.0041db50
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 0xc
cmp esi, 0x400
jl 0x41e330
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x422af0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [0x60f57c], 0
mov dword [0x60f578], 0
mov dword [0x60f574], 0
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ecx, 1
je 0x422cbe
mov eax, dword [esp + 0x10]
cmp eax, ecx
jne 0x422bb6
cmp dword [esp + 4], 4
jne 0x422cbe
mov eax, dword [esp + 8]
cmp eax, 0x5a
jb 0x422b7f
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422b6e
mov cx, word [0x5e77f4]
mov word [eax], cx
mov dl, byte [0x5e77f6]
mov byte [eax + 2], dl
mov dword [0x60f574], 3
add esp, 0x94
ret
cmp eax, ecx
jb 0x422cbe
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422ba5
mov cx, word [0x5e77f0]
mov word [eax], cx
mov dl, byte [0x5e77f2]
mov byte [eax + 2], dl
mov dword [0x60f574], 2
add esp, 0x94
ret
cmp eax, 2
jne 0x422cbe
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x422bfd
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422be6
mov edx, dword [str.Vista]
mov dword [eax], edx
mov dx, word [0x5e77ec]
mov word [eax + 4], dx
mov dword [0x60f580], ecx
mov dword [0x60f57c], 4
add esp, 0x94
ret
cmp eax, 5
jb 0x422c93
mov eax, dword [esp + 8]
cmp eax, 2
jb 0x422c3c
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422c2b
mov ecx, dword [str.2003]
mov dword [eax], ecx
mov dl, byte [0x5e77e4]
mov byte [eax + 4], dl
mov dword [0x60f57c], 3
add esp, 0x94
ret
cmp eax, ecx
mov eax, dword [esp + 0x98]
jb 0x422c6f
test eax, eax
je 0x422c5e
mov cx, word [0x5e77dc]
mov word [eax], cx
mov dl, byte [0x5e77de]
mov byte [eax + 2], dl
mov dword [0x60f57c], 2
add esp, 0x94
ret
test eax, eax
je 0x422c86
mov dx, word [0x5e77d8]
mov word [eax], dx
mov dl, byte [0x5e77da]
mov byte [eax + 2], dl
mov dword [0x60f57c], ecx
add esp, 0x94
ret
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422cb1
mov dx, word [0x5e77d4]
mov word [eax], dx
mov dl, byte [0x5e77d6]
mov byte [eax + 2], dl
mov dword [0x60f578], ecx
add esp, 0x94
ret
mov eax, dword [esp + 0x98]
test eax, eax
je 0x422cdc
mov dx, word [0x5e77d0]
mov word [eax], dx
mov dl, byte [0x5e77d2]
mov byte [eax + 2], dl
mov dword [0x60f574], ecx
add esp, 0x94
ret

Function at 0x423d00
Capabilities:
Log keystrokes via polling

Disassembly:
push 3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x423d28
mov eax, dword [0x615800]
test eax, eax
je 0x423d35
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x615800]
cmp eax, 0xfa
jae 0x423d2b
xor eax, eax
ret
mov dword [0x615800], 0
mov eax, 1
ret
Function at 0x424540
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov al, byte [esp + 0x10]
test al, 8
push ebx
push ebp
push esi
mov ebp, 0x20
push edi
mov dword [esp + 0x10], 0
mov esi, ebp
je 0x424565
mov esi, 0x30
mov ebp, esi
jmp 0x424587
test al, 4
je 0x42456f
xor esi, esi
xor ebp, ebp
jmp 0x424587
test al, 2
je 0x42457c
mov esi, 0x20
mov ebp, esi
jmp 0x424587
test al, 1
je 0x424587
mov esi, 0x10
mov ebp, esi
mov edi, dword [esp + 0x18]
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
je 0x4245f0
xor eax, eax
mov ecx, 0x41
mov edi, 0x60f458
rep stosd dword es:[edi], eax
mov dword [0x60f584], eax
mov eax, dword [esp + 0x1c]
push eax
push 0x424520
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
mov al, byte [0x60f458]
test al, al
je 0x4245df
push 0
push esi
push ebp
push 1
push 0x60f458
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
jmp 0x424608
mov ecx, dword [0x645320]
push 0x10
push esi
push ebp
push 1
push edi
push ecx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esp + 0x10], eax
mov bl, byte [esp + 0x20]
test bl, 2
mov esi, dword [sym.imp.SHELL32.dll_ExtractIconExA]
je 0x42462f
test eax, eax
jne 0x42462f
push 1
push eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x18]
push edx
push eax
push edi
call esi
mov eax, dword [esp + 0x10]
test bl, 1
je 0x42464c
test eax, eax
jne 0x42466a
mov edx, dword [esp + 0x1c]
push 1
lea ecx, [esp + 0x14]
push ecx
push eax
push edx
push edi
call esi
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x42466a
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x645320]
push eax
push edi
push ecx
call dword [sym.imp.SHELL32.dll_ExtractIconA]
cmp eax, 1
jne 0x42466a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x424670
Capabilities:
Get disk size

Disassembly:
mov eax, dword [0x63b6a4]
sub esp, 0x28
test eax, eax
push esi
mov esi, dword [esp + 0x30]
jne 0x424695
push 0x5e7878
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x63b6a4], eax
je 0x4246e2
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4246e2
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push ecx
push esi
call eax
test eax, eax
je 0x4246e2
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4246d0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop esi
add esp, 0x28
ret
cmp eax, 1
jne 0x424738
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
pop esi
add esp, 0x28
ret
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x424738
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x42471e
mov eax, dword [esp + 4]
imul eax, dword [esp + 8]
imul eax, dword [esp + 0xc]
xor edx, edx
pop esi
add esp, 0x28
ret
cmp eax, 1
jne 0x424738
mov eax, dword [esp + 4]
imul eax, dword [esp + 8]
imul eax, dword [esp + 0x10]
xor edx, edx
pop esi
add esp, 0x28
ret
xor eax, eax
xor edx, edx
pop esi
add esp, 0x28
ret

Function at 0x424750
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3ec
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor eax, eax
mov ecx, 0xf9
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424777
mov edi, dword [ebp + 8]
sub eax, edx
mov esi, eax
push 0x3b5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x4247cd
mov esi, ebx
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4247c4
test cl, cl
je 0x4247c0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4247c4
add eax, 2
add esi, 2
test cl, cl
jne 0x4247a0
xor eax, eax
jmp 0x4247c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4247d5
push ebx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4249a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80c
push ebx
xor eax, eax
push esi
push edi
mov ecx, 0xf9
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0xf9
lea edi, [esp + 0x430]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
test eax, eax
je 0x4249ef
push 0x3dd
push eax
lea eax, [esp + 0x438]
push eax
call fcn.005cc410
add esp, 0xc
lea ecx, [esp + 0x430]
push ecx
call fcn.0053b420
xor eax, eax
mov ecx, 0xf9
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
add esp, 4
test eax, eax
je 0x424a29
push 0x3dd
push eax
lea edx, [esp + 0x50]
push edx
call fcn.005cc410
add esp, 0xc
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp eax, 1
jne 0x424a53
mov eax, dword [0x60f574]
test eax, eax
jne 0x424a53
mov eax, dword [0x60f580]
test eax, eax
jne 0x424a4e
call fcn.00424890
test eax, eax
jne 0x424a53
mov esi, str.runas
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x424ace
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea edx, [esp + 0xc]
lea eax, [esp + 0x430]
lea ecx, [esp + 0x48]
push edx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x440
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], 5
mov dword [esp + 0x28], 0x637bf8
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x424abf
mov eax, dword [esp + 0x44]
mov dword [ebx], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push 0x637bf8
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x43c]
push edx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x20
cmp ecx, eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425010
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push str.Shell_TrayWnd
mov dword [esp + 0x1c], eax
call esi
push str.Program_Manager
push str.PROGMAN
mov dword [esp + 0x18], eax
call esi
mov ecx, dword [0x645324]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push ecx
call fcn.005028a0
add esp, 0x10
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x425152
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongA]
nop
mov edx, edi
inc edi
cmp edx, 0x3e8
mov dword [esp + 0x20], edi
jge 0x425152
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42513f
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x42513f
cmp esi, dword [esp + 0x14]
je 0x425152
cmp esi, dword [esp + 0x18]
je 0x425152
cmp esi, dword [esp + 0x10]
je 0x425152
push 0xffffffffffffffec
push esi
call ebp
mov ebx, eax
mov edi, ebx
and edi, 8
jne 0x4250e3
cmp esi, dword [esp + 0x1c]
jne 0x42513b
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x42513b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x42515c
test edi, edi
jne 0x42515c
push esi
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x42515c
push 0xfffffffffffffff0
push esi
call ebp
test eax, 0xc00000
je 0x42515c
mov edi, dword [esp + 0x20]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x425080
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret
test bl, 8
mov eax, 0
setne al
pop edi
pop esi
pop ebp
pop ebx
inc eax
add esp, 0x44
ret
Function at 0x425960
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov edx, dword [ebp + 8]
test edx, edx
push ebx
push esi
push edi
je 0x425ad9
cmp byte [edx], 0
je 0x425ad9
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x340]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.005cc984
add esp, 0x14
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
mov esi, 0x6092d8
lea edx, [esp + 0x38]
push esi
push edx
call fcn.005e31f5
add esp, 8
test eax, eax
je 0x425ac0
add esi, 0xa
cmp esi, 0x6093be
jl 0x4259c8
push 0
push 0
push 3
push 0
push 0
push 0
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x425a20
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, 2
jne 0x425ac0
push 0xfa
lea ecx, [esp + 0x13c]
push ecx
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x425ac0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.005d81c7
add esp, 8
test eax, eax
jne 0x425a69
movzx eax, word [esp + 0x1a]
cmp eax, 0x2000
je 0x425ac0
cmp eax, 0xf000
je 0x425ac0
push 0x40
lea edx, [esp + 0x3c]
push 0
push edx
call fcn.005e1bf4
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x425acc
push esi
call fcn.005e1807
add esp, 4
test eax, eax
jne 0x425ab3
lea eax, [esp + 0x14]
push eax
push esi
call fcn.005e3ecc
add esp, 8
test eax, eax
jne 0x425acc
movzx eax, word [esp + 0x1a]
cmp eax, 0x2000
je 0x425ab3
cmp eax, 0xf000
jne 0x425acc
test esi, esi
jl 0x425ac0
push esi
call fcn.005d4c77
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jl 0x425ad9
push esi
call fcn.005d4c77
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425b60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x6ec
push esi
mov esi, dword [esp + 0x6f4]
test esi, esi
je 0x425c70
cmp byte [esi], 0
je 0x425c70
push 0x2f
push esi
call fcn.005cbf10
add esp, 8
test eax, eax
je 0x425ba2
mov edi, edi
push 0x2f
push esi
mov byte [eax], 0x5c
call fcn.005cbf10
add esp, 8
test eax, eax
jne 0x425b90
push 0x5e7e38
push esi
call fcn.005ce940
add esp, 8
test eax, eax
jne 0x425c70
lea edx, [esp + 8]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x425bc0
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425bd1
sub eax, edx
test eax, eax
jle 0x425c70
mov cl, byte [esp + eax + 7]
cmp cl, 0x5c
jne 0x425bf2
mov byte [esp + eax + 8], 0x2e
jmp 0x425bfc
cmp cl, 0x3a
jne 0x425c01
mov byte [esp + eax + 8], 0x5c
mov byte [esp + eax + 9], 0
lea eax, [esp + 0x4f0]
push eax
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x5f8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.005cc984
lea edx, [esp + 0x404]
push edx
call fcn.00425960
add esp, 0x18
test eax, eax
jne 0x425c70
lea eax, [esp + 8]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x425c70
test al, 0x10
mov al, byte [esp + 0x6f8]
je 0x425c5d
test al, 2
jmp 0x425c5f
test al, 1
je 0x425c66
mov esi, 1
mov eax, esi
pop esi
add esp, 0x6ec
ret
xor eax, eax
pop esi
add esp, 0x6ec
ret

Function at 0x4260d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40c
push ebx
mov bl, byte [esp + 0x418]
test bl, 8
push esi
mov esi, dword [esp + 0x418]
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
je 0x42611d
mov eax, dword [0x645324]
push 5
push 0x637bf8
push 0
push esi
push str.explore
push eax
call edi
cmp eax, 0x20
jbe 0x42611d
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x40c
ret
test bl, 4
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
je 0x42617b
push 1
push esi
call fcn.00425b60
add esp, 8
test eax, eax
je 0x42617b
push esi
lea ecx, [esp + 0x38]
push str._select___s_
push ecx
call ebp
mov eax, dword [0x645324]
add esp, 0xc
push 5
push 0x637bf8
lea edx, [esp + 0x3c]
push edx
push str.explorer.exe
push str.open
push eax
call edi
cmp eax, 0x20
jbe 0x42617b
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x40c
ret
test bl, 2
je 0x42619a
mov ecx, dword [0x645324]
push 5
push 0x637bf8
push 0
push esi
push 0
push ecx
call edi
cmp eax, 0x20
ja 0x42616b
test bl, 1
je 0x4261db
lea edx, [esp + 0x10]
push edx
push esi
call fcn.005d81c7
add esp, 8
test eax, eax
je 0x4261e8
mov dword [esp + 0x24], 0
push esi
push str.notepad.exe___s_
lea ecx, [esp + 0x3c]
push ecx
call ebp
add esp, 0xc
push 0xa
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x42616b
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x40c
ret
cmp dword [esp + 0x24], 0xe678
jle 0x4261b9
push esi
push str.write.exe___s_
lea eax, [esp + 0x3c]
push eax
jmp 0x4261c4
Function at 0x426610
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [0x645324]
sub esp, 8
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x426627
add esp, 8
ret
push ebx
push ebp
push esi
push edi
push 1
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, dword [esp + 0x20]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
je 0x4266e9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x4266e2
mov edi, edi
push 0xa
push ebp
call fcn.005cbf10
mov esi, eax
add esp, 8
test esi, esi
je 0x426674
mov byte [esi], 0
xor eax, eax
mov ecx, 0xf9
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x3b5
stosw word es:[edi], ax
push ebp
push ebx
stosb byte es:[edi], al
call fcn.005cc410
push 0xd
push ebx
call fcn.005cbf10
add esp, 0x14
test eax, eax
je 0x4266a0
mov byte [eax], 0
mov ecx, dword [esp + 0x10]
push 0
push ebx
push ecx
call fcn.004e2f90
add esp, 0xc
test eax, eax
je 0x4266d1
test esi, esi
mov dword [esp + 0x10], eax
je 0x4266de
mov byte [esi], 0xa
mov al, byte [esi + 1]
inc esi
cmp al, 0xd
jne 0x4266c8
inc esi
cmp byte [esi], 0
je 0x4266de
mov ebp, esi
jmp 0x426660
lea edx, [esp + 0x10]
push edx
call fcn.004e33a0
add esp, 4
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x426768
mov esi, dword [esp + 0x1c]
cmp byte [esi], 0
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
jne 0x426745
mov edi, 1
push edi
push 0x637bf8
push str._splayq_d.txt
push esi
call ebp
push edi
push esi
call fcn.00425b60
add esp, 0x18
test eax, eax
je 0x426745
inc edi
push edi
push 0x637bf8
push str._splayq_d.txt
push esi
call ebp
push 1
push esi
call fcn.00425b60
add esp, 0x18
test eax, eax
jne 0x426727
push 0x40
push 0x5e7ecc
push esi
call fcn.005ccd80
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x426772
lea eax, [esp + 0x10]
push eax
call fcn.004e33a0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4267a7
lea ebx, [ebx]
mov ecx, dword [eax]
push ecx
push 0x5e7ec4
push ebx
call ebp
push esi
push ebx
call fcn.005cea5d
mov edx, dword [esp + 0x24]
push edx
call fcn.004e3090
add esp, 0x18
test eax, eax
mov dword [esp + 0x10], eax
jne 0x426780
push esi
call fcn.005ccca9
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret