joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e08b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x52563c]
xor al, 1
cmp eax, 0
je 0x4e08fe
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x4e08ed
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.004dea5e
leave
ret 8

Function at 0x4ede19
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [0x5254f0], eax
push 0
call dword [sym.imp.USER32.DLL_GetDC]
mov dword [0x5254f8], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [0x5254fc], eax
mov eax, 0x11c
xchg edx, eax
mov eax, dword [0x525508]
mov dword [eax], edx
push dword [0x525508]
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x525508]
mov eax, dword [eax + 4]
cmp eax, 5
jne 0x4ede87
mov eax, dword [0x525508]
mov eax, dword [eax + 8]
cmp eax, 1
jge 0x4ede87
jmp 0x4ede8b
xor eax, eax
jmp 0x4ede8e
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x4ede9c
call fcn.004edbca
call fcn.004ee9d8
mov dword [0x525644], eax
mov eax, dword [0x525508]
mov eax, dword [eax + 4]
cmp eax, 0xa
jge 0x4edef0
mov eax, dword [0x525508]
mov eax, dword [eax + 4]
cmp eax, 6
jl 0x4edede
mov eax, dword [0x525508]
mov eax, dword [eax + 8]
cmp eax, 2
jl 0x4edede
jmp 0x4edee2
xor eax, eax
jmp 0x4edee5
xor eax, eax
inc eax
cmp eax, 0
jne 0x4edef0
xor eax, eax
jmp 0x4edef3
xor eax, eax
inc eax
mov dword [0x52563c], eax
mov eax, dword [0x525508]
mov eax, dword [eax + 4]
cmp eax, 6
jl 0x4edf0e
xor eax, eax
jmp 0x4edf11
xor eax, eax
inc eax
mov dword [0x525640], eax
push 0x16
push dword [0x524580]
call fcn.0043b655
mov dword [ebp - 0xc], eax
mov eax, 3
shl eax, 0x13
mov edx, eax
mov eax, 0x27
or eax, edx
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x525508]
mov eax, dword [eax + 8]
shl eax, 8
xchg edx, eax
mov eax, dword [0x525508]
mov eax, dword [eax + 4]
or eax, edx
and eax, 0xffff
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
call fcn.004edc17
mov eax, dword [0x525640]
xor al, 1
cmp eax, 0
je 0x4edf82
call fcn.004d75d4
call fcn.004eda41
push dword [0x5254fc]
call fcn.004d89b8
push 0x17
push dword [0x524580]
call fcn.0043b655
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x525508]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
push 0x18
push dword [0x524580]
call fcn.0043b655
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x525508]
mov al, byte [eax + 0x11a]
and eax, 0xff
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
call fcn.004edd08
push 0x4eddff
call fcn.004722d2
leave
ret
Function at 0x4ee624
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x4ee64d
push 0
push dword [ebp + 0xc]
push 0xe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x4ee663
push 0
push dword [ebp + 0xc]
push 0x149
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jl 0x4ee74a
push 3
push dword [ebp + 8]
call fcn.004ecbf8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x4ee69f
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00433b94
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x4ee6b6
push dword [ebp - 0x10]
call fcn.00432209
jmp 0x4ee74a
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x10]
call fcn.00424858
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x4ee6eb
push dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x4ee702
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push 0x148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0
call fcn.00423f63
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.004d8d73
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x4ee743
push dword [0x524e80]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.004290ef
push 1
call fcn.00469a18
leave
ret 8

Function at 0x4eee19
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
push 0xa
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov eax, dword [0x52563c]
xor al, 1
cmp eax, 0
je 0x4eee55
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.004dea5e
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
push dword [ebp + 8]
call fcn.004ecb5a
add eax, 0xa0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x4eee8e
push dword [ebp - 0xc]
call fcn.004ecd9d
push eax
call dword [sym.imp.USER32.DLL_SetFocus]
leave
ret 4
Function at 0x4f0688
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x524bec]
cmp eax, edx
jne 0x4f06c5
mov eax, dword [0x525638]
sub eax, 0xc
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov edx, eax
mov eax, 2
and eax, edx
cmp eax, 0
je 0x4f06c5
jmp 0x4f06c9
xor eax, eax
jmp 0x4f06cc
xor eax, eax
inc eax
cmp eax, 0
je 0x4f06f0
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x4f06ea
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ed5a6
jmp 0x4f06f0
call dword [sym.imp.USER32.DLL_DestroyCaret]
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x4f0715
mov eax, dword [ebp + 0x14]
mov edx, dword [0x524bec]
cmp eax, edx
jne 0x4f070e
mov eax, 8
jmp 0x4f0713
mov eax, 5
jmp 0x4f071a
mov eax, 0
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x52563c]
xor al, 1
cmp eax, 0
je 0x4f0747
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.004dea5e
mov eax, dword [ebp + 0x14]
mov edx, dword [0x524c18]
cmp eax, edx
jne 0x4f0777
mov eax, dword [0x525638]
sub eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov dword [ebp + 8], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebp + 0x14]
mov edx, dword [0x524c08]
cmp eax, edx
jne 0x4f078e
push 9
push dword [ebp + 8]
call fcn.004e0974
leave
ret 0x10
Function at 0x4f263f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
add eax, 0x10
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jae 0x4f2679
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x25
jne 0x4f2679
xor eax, eax
jmp 0x4f267c
xor eax, eax
inc eax
cmp eax, 0
je 0x4f2691
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.004f2322
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, 2
cmp eax, 0
jle 0x4f26ec
push eax
mov eax, dword [ebp + 0x18]
add eax, 0x10
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jae 0x4f26ce
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xb
jne 0x4f26ce
xor eax, eax
jmp 0x4f26d1
xor eax, eax
inc eax
cmp eax, 0
je 0x4f26e6
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.004f2322
pop eax
sub eax, 1
jg 0x4f26a3
mov eax, 3
cmp eax, 0
jle 0x4f2751
push eax
mov eax, dword [ebp + 0x18]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jae 0x4f274b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xb
je 0x4f2733
mov eax, dword [ebp - 0x20]
cmp eax, 0xc
je 0x4f2733
xor eax, eax
jmp 0x4f2736
xor eax, eax
inc eax
cmp eax, 0
je 0x4f2745
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x18], eax
jmp 0x4f274b
pop eax
jmp 0x4f2751
pop eax
sub eax, 1
jg 0x4f26f8
mov eax, 0
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], eax
jmp 0x4f27d6
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
jne 0x4f2789
push dword [ebp + 0x18]
call fcn.0043ad51
jmp 0x4f278c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x27
jne 0x4f27ad
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x27
je 0x4f27c5
mov eax, dword [ebp - 0x20]
cmp eax, 0xc
je 0x4f27c5
xor eax, eax
jmp 0x4f27c8
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x4f27d6
jmp 0x4f27eb
mov eax, dword [ebp + 0x18]
add eax, 0x10
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jb 0x4f276e
mov eax, dword [ebp - 0x24]
cmp eax, 2
jge 0x4f2803
push dword [ebp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004f2322
mov eax, dword [ebp + 0x1c]
mov edx, dword [0x5256d0]
cmp eax, edx
je 0x4f2814
xor eax, eax
jmp 0x4f2817
xor eax, eax
inc eax
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0043a2ed
push eax
push dword [ebp + 8]
call fcn.004ea5d7
mov eax, dword [ebp + 0x18]
sub eax, 0x10
leave
ret 0x1c
Function at 0x460957
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004537f8
and dword [ebp - 4], 0
cmp dword [0x491318], 0
mov ebx, eax
jne 0x460a08
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x460ab9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47aac4
push edi
call esi
test eax, eax
je 0x460ab9
push eax
call fcn.00453786
mov dword [esp], 0x47aab4
push edi
mov dword [0x491318], eax
call esi
push eax
call fcn.00453786
mov dword [esp], 0x47aaa0
push edi
mov dword [0x49131c], eax
call esi
push eax
call fcn.00453786
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x491320], eax
call esi
push eax
call fcn.00453786
pop ecx
mov dword [0x491328], eax
test eax, eax
je 0x460a08
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00453786
pop ecx
mov dword [0x491324], eax
mov eax, dword [0x491324]
cmp eax, ebx
je 0x460a60
cmp dword [0x491328], ebx
je 0x460a60
push eax
call fcn.00453801
push dword [0x491328]
mov esi, eax
call fcn.00453801
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x460a60
test edi, edi
je 0x460a60
call esi
test eax, eax
je 0x460a57
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x460a57
test byte [ebp - 0xc], 1
jne 0x460a60
or dword [ebp + 0x10], 0x200000
jmp 0x460a99
mov eax, dword [0x49131c]
cmp eax, ebx
je 0x460a99
push eax
call fcn.00453801
pop ecx
test eax, eax
je 0x460a99
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x460a99
mov eax, dword [0x491320]
cmp eax, ebx
je 0x460a99
push eax
call fcn.00453801
pop ecx
test eax, eax
je 0x460a99
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x491318]
call fcn.00453801
pop ecx
test eax, eax
je 0x460ab9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x460abb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40891d
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
call fcn.00408948
add ebx, 1
mov ebx, eax
xor dword [edi], esi
mov ebx, 0xcadc51f5
sub ebx, 1
inc edi
and eax, ebx
sub eax, ebx
cmp edi, edx
jne fcn.0040891d
add eax, ebx
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4db56548
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0xe10629c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4d52210
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x49702af6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x406280
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x50302c]
xor ecx, esp
mov dword [esp + 0x1c], ecx
cmp byte [eax], 0x26
jne 0x406322
add eax, 1
mov ecx, esp
lea edx, [esp + 4]
push ecx
push edx
push 0x4df887
push eax
call fcn.00406350
add esp, 0x10
cmp eax, 2
jne 0x406322
push dword [esp]
push 0
push 0
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test eax, eax
je 0x40631b
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [esp + 8], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
push ecx
push eax
call fcn.004353c0
add esp, 8
test al, al
je 0x406337
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
invalid
xchg ebp, eax

Function at 0x406410
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
cmp dword [esp + 0x1c], 2
jne 0x406493
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x406493
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x406493
mov edi, eax
push ebp
push ebx
push eax
call fcn.004a08d0
add esp, 0xc
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esp]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40648c
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
Function at 0x447840
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, dword [esp + 0x224]
mov edi, dword [esp + 0x220]
mov al, byte [esp + 0x228]
mov ecx, dword [0x50302c]
xor ecx, esp
mov dword [esp + 0x208], ecx
xor ebp, ebp
mov ebx, 0
test al, al
je 0x447892
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xffffffff
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x22c]
mov dword [esi], 0x58
test edi, edi
je 0x4478b6
lea ecx, [edi + 0x104]
xor ebp, ebp
cmp word [edi + 0x104], 0
cmovne ebp, ecx
mov dword [esi + 0x2c], ebp
test al, al
je 0x4478c6
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x4478cd
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov esi, eax
test edi, edi
je 0x4478f6
add edi, 0x104
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x4478f6
mov word [edi], 0
test bl, bl
je 0x447903
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
setne bl
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0049e0f0
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x447b40
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
int3
and al, 8
push dword [ecx]
push dword [eax]
call fcn.004b2120
add esp, 8
test eax, eax
sete al
ret
push esi
mov esi, dword [esp + 8]
pushal
pushfd
test ebx, edx
jo 0x447b16
rol esi, 4
call fcn.00406620
dec eax
xor edx, eax
xor edx, esp
mov edx, esi
call fcn.00419a5c
xor esi, eax
add esi, dword [0x503990]
mov esi, 0xb6efa64
test eax, eax
jo 0x447b04
push 0xc6870005

Function at 0x447b70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
inc eax
neg eax
and esi, edi
call fcn.0049e445
call fcn.00419a5c
or esi, edi
call fcn.0049e697
mov ecx, dword [0x503180]
sub ecx, ebp
mov esi, eax

Function at 0x447b90
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
add byte [edi], cl
xchg esp, eax
rol bl, 0xcc
int3
xor esi, eax
dec esi
sub eax, 0x2058d1b5
sub esi, ecx
and esi, edi
call fcn.00406620
dec esi
mov esi, dword [0x50384e]
xor esi, eax
test esp, esi
jo 0x447b39
and eax, 0xc80d458
call fcn.004052a9
mov esi, 0x145658b0
add esi, eax
dec eax
call fcn.0040649a
mov eax, eax
mov edi, ecx
test edx, ebp
jo 0x447be7
not ecx
and esi, edi
add eax, 0x23fe9492
xor esi, 0x6e220d8
mov ecx, 0x933456
or dword [0x505fe6], ecx
shr edx, 0x1b
neg edx
call fcn.0049e445
push ecx
push 0xc6870005
pop edi
push eax
add cl, al
ljmp 0x6851
push ecx
invalid
mov dword [0x505ef2], edx
shr edx, 1
ror edi, 0x10
neg edx
not esi
loop 0x447be4
and esi, edi
test ebp, 0x5a75404
jo 0x447bff
mov ecx, eax
test ecx, 0x64766e8
jb 0x447be4
xor ecx, esp
mov ebx, esp
Function at 0x447c20
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
invalid
int3
xor ecx, ebp
rol eax, 0x1c
shl ebx, 0x14
add edi, eax
xchg esi, eax
dec esi
shr edx, 0x1a
and esi, edi
ror eax, 3
mov dword [0x505fb8], edi
shl ecx, 0x1f
mov esi, eax
xor edx, esp
test edi, 0x12aafc00
jo 0x447c1d
mov ecx, 0x7995a4
neg esi
inc esi
rol eax, 0x12
dec esi
test esp, esi
jb 0x447ca9
inc edx
xchg eax, esi
test esp, eax
invalid
Function at 0x448180
Capabilities:
Hash data using murmur3

Disassembly:
pop esi
push eax
add byte [eax - 0x3ede1557], ah
iretd
Function at 0x491470
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x49149a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea esi, [edi - 1]
mov ebx, edi
and ebx, 3
cmp esi, 3
jae 0x4914a1
xor esi, esi
test ebx, ebx
jne 0x4914ee
jmp 0x491503
mov eax, 1
jmp 0x49150d
mov dword [esp], ebx
and edi, 0xfffffffc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
xor bl, byte [ecx]
mov bh, byte [eax + 1]
movzx ebp, bl
xor bh, byte [ecx + 1]
or ebp, esi
mov bl, byte [eax + 2]
xor bl, byte [ecx + 2]
movzx esi, bh
movzx ebx, bl
or ebx, esi
or ebx, ebp
movzx edx, byte [eax + 3]
add eax, 4
xor dl, byte [ecx + 3]
add ecx, 4
movzx esi, dl
or esi, ebx
add edi, 0xfffffffc
jne 0x4914b0
mov ebx, dword [esp]
test ebx, ebx
je 0x491503
xor edi, edi
movzx edx, byte [eax + edi]
xor dl, byte [ecx + edi]
movzx edx, dl
or esi, edx
add edi, 1
cmp ebx, edi
jne 0x4914f0
mov eax, 0x100
sub eax, esi
shr eax, 8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret