joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49416a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x4941e2
cmp dword [ebp + 0xc], esi
je 0x4941e2
cmp dword [edi + 0x10], esi
je 0x4941a1
push esi
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x49419c
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
cmp dword [edi + 0x10], esi
jne 0x4941e2
mov ebx, dword [edi]
push 0x18
call fcn.00430c2b
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4941d6
push esi
push esi
push ecx
mov dword [ecx], ebx
mov dword [ecx + 0x10], esi
mov eax, dword [ebp + 0xc]
push 0x48db48
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push esi
mov dword [ecx + 0xc], eax
call fcn.005f3950
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 0x10], esi
test esi, esi
setne al
jmp 0x4941e4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x494734
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x494880
mov ebx, dword [ebp + 0xc]
xor esi, esi
inc esi
cmp ebx, 0x4e
jne 0x494785
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x494889
push ecx
mov ecx, edi
mov dword [edi + 0x580], esi
call fcn.0049468e
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], 0
je 0x49485c
mov eax, esi
jmp 0x494882
cmp ebx, 0x113
jne 0x4947d4
mov eax, 0x2711
mov dword [edi + 0x580], esi
cmp dword [ebp + 0x10], eax
jne 0x4947cc
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [edi + 0x58c]
push 0x3ed
push 0x476
push dword [edi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp + 0x18]
and dword [ecx], 0
jmp 0x494771
cmp ebx, 0x110
jne 0x4947f6
push 0
push 0
push 0x473
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4947cc
cmp ebx, 0x473
jne 0x494819
call fcn.00494aa9
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x494882
cmp ebx, 0x477
jne 0x494836
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.0049490c
jmp 0x49476c
cmp ebx, 0x478
jne 0x494889
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.0049496e
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x580], 0
jne 0x494814
mov ecx, esi
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0044a38e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x494814
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
jmp 0x49485c
Function at 0x494b6e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x494bd7
cmp dword [ebp + 0x1c], 0x12d
jne 0x494d41
cmp dword [ebp + 0xc], 0x100
jne 0x494d41
xor ebx, ebx
push 0x11
mov dword [edi + 0x580], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebp + 0x10], 0x61
movzx eax, ax
je 0x494bb5
cmp dword [ebp + 0x10], 0x41
jne 0x494bc7
test al, al
jns 0x494bc7
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00494141
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x580], ebx
jmp 0x494d3f
mov eax, dword [ebp + 0xc]
xor esi, esi
inc esi
xor ebx, ebx
cmp eax, 0x4e
jne 0x494c2e
mov edx, dword [ebp + 0x14]
cmp dword [edx + 4], 0xffffffff
jne 0x494d1a
mov dword [edi + 0x580], esi
cmp dword [edx + 8], esi
jne 0x494c0e
cmp dword [edx + 0xc], 0x12e
jne 0x494c0e
call fcn.00494ed7
mov eax, esi
jmp 0x494c16
mov dword [edi + 0x580], ebx
mov eax, ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], ebx
je 0x494d1a
mov eax, esi
jmp 0x494d43
cmp eax, 0x110
jne 0x494c51
mov dword [edi + 0x580], esi
call fcn.00495046
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
jmp 0x494c1b
cmp eax, 0x465
jne 0x494c6a
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.00494e27
jmp 0x494c16
cmp eax, 0x466
jne 0x494c81
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.00494e7d
jmp 0x494c16
mov edx, 0x46c
cmp eax, edx
jne 0x494c9d
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.004952f3
jmp 0x494c16
cmp eax, 0x46f
jne 0x494cbe
push dword [edi + 0x5b0]
mov dword [edi + 0x580], esi
push dword [edi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x494c4a
cmp eax, 0x10
jne 0x494cdf
push ebx
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x494c4a
cmp eax, 0x111
jne 0x494d1a
mov eax, dword [ebp + 0x10]
mov ecx, 0x300
shr eax, 0x10
mov dword [edi + 0x580], ebx
cmp cx, ax
jne 0x494d08
push ebx
push ebx
push edx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
cmp dword [edi + 0x580], ebx
je 0x494d1a
xor eax, eax
inc eax
jmp 0x494d43
mov esi, dword [edi + 0x578]
mov ecx, edi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a38e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x494d15
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x494ed7
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x60d3d5
call fcn.0060bcd8
sub esp, 0x43c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x18], ebx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov edi, 0x208
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.005e1720
push edi
lea eax, [ebp - 0x448]
push ebx
push eax
call fcn.005e1720
add esp, 0x18
lea eax, [ebp - 0x448]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x69fcd4
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
push 0x105
mov dword [ebp - 0x34], eax
call fcn.0040682a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x2c], 0x69fcc4
mov dword [ebp - 0x28], 0x8041
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00408f1c
test edi, edi
je 0x49501d
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x240]
push eax
call fcn.005f0068
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x10]
call fcn.0046f562
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov dword [esp], str.kingsoft_antivirus_
call fcn.004062d3
push dword [ebp - 0x10]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00495218
push eax
push 0x46c
push dword [esi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x495046
Capabilities:
Get common file path
Get program files directory
Hide graphical window

Disassembly:
mov eax, 0x60c9f5
call fcn.0060bcd8
sub esp, 0x20c
push ebx
push esi
push edi
push ecx
push ecx
mov eax, esp
mov ebx, ecx
sub esp, 0x10
xor esi, esi
mov dword [eax], 0x12d
lea edi, [ebx + 0x588]
mov eax, esp
mov ecx, edi
mov dword [eax], esi
push dword [ebx + 4]
call fcn.00493fb4
push 0x6a0230
push 0x20
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x64
push esi
push esi
push esi
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi]
call esi
push 0
push 0x96
push 0xc5
push dword [edi]
call esi
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
xor esi, esi
lea eax, [ebp - 0x218]
push 0x208
push esi
push eax
mov dword [ebp - 4], esi
call fcn.005e1720
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x495118
push str.c:program_files
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005f187c
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push str._skingsoftkingsoft_antivirus_
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x5b0]
call fcn.00406123
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x495218
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], ecx
lea ecx, [ebp + 8]
mov edx, dword [edi]
call fcn.0046f562
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [edi]
cmp dword [eax - 0xc], 3
jl 0x4952d6
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x495260
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x4952d6
push 3
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp + 8]
cmp eax, 3
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x49528f
push 2
pop esi
jmp 0x4952d9
push edi
call fcn.00495164
push 3
test eax, eax
jne 0x49528c
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.00490c33
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00404ea9
add bl, 1
je 0x4952c7
push 4
jmp 0x49528c
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x4952d9
push 5
jmp 0x49528c
xor esi, esi
inc esi
mov eax, dword [ebp - 4]
push dword [eax + 0x584]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x498747
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x612b7d
call fcn.0060bcd8
sub esp, 0x26c
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x693da4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], edi
call fcn.00406173
mov dword [ebp - 4], edi
call fcn.00417aae
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov al, byte [eax + 0x20]
mov byte [ebp - 4], 1
test al, al
je 0x4987a5
cmp dword [esi + 0x14], edi
jne 0x4987a5
push 0x20119
push dword [esi + 8]
lea ecx, [ebp - 0x24]
push dword [esi + 4]
call fcn.00416598
test eax, eax
je 0x4987d6
push 0x20219
push dword [esi + 8]
lea ecx, [ebp - 0x24]
push dword [esi + 4]
call fcn.00416598
test eax, eax
je 0x4987d6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.004067cf
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov dword [esi], eax
jmp 0x4988d3
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
push 0x20a
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 2
push edi
push eax
mov dword [ebp - 0x18], edi
call fcn.005e1720
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [esi + 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4988ab
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x498880
cmp eax, 2
je 0x498880
cmp eax, 7
je 0x498880
cmp eax, 4
jne 0x49885d
push 0xa
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x278]
call fcn.005f55ce
add esp, 0x10
lea eax, [ebp - 0x6c]
jmp 0x498886
cmp eax, 0xb
jne 0x49888f
push 0xa
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x274]
push dword [ebp - 0x278]
call fcn.005f558d
add esp, 0x14
jmp 0x498858
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x10]
call fcn.004060f8
lea ecx, [ebp - 0x10]
call fcn.0046e715
lea ecx, [ebp - 0x10]
call fcn.0046e805
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406123
lea ecx, [ebp - 0x24]
call fcn.004165ef
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.004067cf
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.00404ea9
lea ecx, [ebp - 0x24]
call fcn.004165ef
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x498a2f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x498a48
mov eax, dword [ebp - 4]
jmp 0x498b22
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x498afd
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x692d38]
dec ebp
jne 0x498a67
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x498b19
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x692d38]
dec ecx
jne 0x498b07
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499240
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612c40
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x3c], ecx
je 0x4993f9
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x4993f9
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4993f9
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4993ec
cmp dword [ebp - 0x14], 0
jbe 0x4993ec
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.004997a0
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
call fcn.00439e6b
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
call fcn.00408bd9
cmp dword [ebp - 0x28], 0
lea ecx, [ebp - 0x30]
je 0x4993c3
mov esi, dword [ebp - 0x34]
push dword [esi]
call fcn.00407a4a
test eax, eax
je 0x49935e
push dword [esi]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.00408e5b
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00407a36
mov ecx, dword [ebp - 0x38]
push eax
call fcn.004060f8
mov byte [ebp - 4], 1
push dword [edi]
lea ecx, [ebp - 0x30]
call fcn.00407a4a
test eax, eax
je 0x499395
push dword [edi]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.00408e5b
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00407a36
mov ecx, dword [ebp - 0x3c]
push eax
call fcn.004060f8
mov dword [ebp - 0x48], vtable.cf::BkJson::Handle.0
lea ecx, [ebp - 0x30]
call fcn.00408bb4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4993bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
jmp 0x4993fb
call fcn.00408bb4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4993f9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4993f9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a6a7
mov esp, ebp
pop ebp
ret
Function at 0x4a3770
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x1505
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0xc]
jae 0x4a37c3
mov edx, dword [ebp - 8]
shl edx, 5
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
push edx
call fcn.004b1300
add esp, 4
movsx eax, al
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x4a3786
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x100
div ecx
mov eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x4add40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6f2], 0
je 0x4addc3
cmp dword [edi + 0x1b0], 0
je 0x4add8d
push esi
push 1
push edi
call fcn.0049fa50
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.0049fa50
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4addc3
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x617d50
push 2
push eax
call fcn.005f2439
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.005f2439
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x4ae140
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov eax, dword [edx + 0xc]
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [eax + ecx*4 + 0x148]
push ecx
push eax
push edx
mov dword [ebp - 0x108], edx
call fcn.004ae5a0
add esp, 0xc
test eax, eax
je 0x4ae19b
pop edi
mov dword [esi], 0x1b
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a6a7
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0x14]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x4ae218
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x4ae1e0
xor edi, edi
mov dword [esi], 0x51
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a6a7
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.004d8c60
push eax
push str.Send_failure:__s
push dword [ebp - 0x108]
call fcn.004addd0
mov eax, dword [ebp - 0x108]
add esp, 0x18
mov dword [eax + 0x950], ebx
mov dword [esi], 0x37
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049a6a7
mov esp, ebp
pop ebp
ret
Function at 0x4ae5a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
lea esi, [edx + 0x17]
mov eax, dword [ecx + 0x288]
mov ebx, dword [ecx + edx*4 + 0x148]
shl esi, 4
add esi, ecx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x4ae656
cmp dword [ecx + edx*4 + 0x160], 0x4ae040
jne 0x4ae656
cmp dword [esi], 0
je 0x4ae5e7
test edi, edi
je 0x4ae656
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.004baf60
add esp, 0x14
cmp eax, 0xffffffff
je 0x4ae656
test al, 1
je 0x4ae656
cmp dword [esi], 0
jne 0x4ae63f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x6ba08c]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x4ae62e
pop edi
pop esi
mov eax, 0x1b
pop ebx
pop ebp
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4ae656
add dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4ae7e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x19c], 0
je 0x4ae800
push eax
call fcn.004a7d10
add esp, 4
test eax, eax
jne 0x4ae822
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x148]
cmp eax, 0xffffffff
je 0x4ae7fc
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4ae822
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret

Function at 0x4ae9f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x184]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x188], 0x80
call fcn.005e1720
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4aea6d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.004d8c60
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x4aeab0
push edi
push esi
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
call fcn.004ae660
add esp, 0x10
test al, al
jne 0x4aeab9
call fcn.005f074c
mov esi, dword [eax]
call fcn.005f074c
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.004d8c60
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004addd0
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049a6a7
mov esp, ebp
pop ebp
ret
Function at 0x4af250
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6c4684]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x4af2a1
push 3
push 2
push eax
push 6
call fcn.004d9940
add esp, 0x10
test al, al
je 0x4af295
mov dword [0x6c4684], 2
mov esp, ebp
pop ebp
ret
mov dword [0x6c4684], 1
jmp 0x4af2a6
cmp eax, 2
je 0x4af2e6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4af2cd
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4af2e6
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret