joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4933fe
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x60cc8a
call fcn.0060bd28
push ecx
push ecx
push ebx
push esi
push edi
push 0x208
push 0x199
mov esi, ecx
call fcn.00493273
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x5d4], eax
sete al
push eax
call fcn.0049395f
mov ecx, esi
call fcn.00493565
push str.soguo_mainbg_new
push str.skin
lea edi, [esi + 0x28]
push 3
mov ecx, edi
call fcn.0044a310
push str.0_0__0__0
mov ebx, 0x69ae18
mov ecx, edi
push ebx
push 3
call fcn.0044a310
cmp dword [esi + 0x5d4], 0
jne 0x493554
push str.15__153__15__63
push ebx
push 0xc8
mov ecx, edi
call fcn.0044a310
push str.softtemprory.png
lea edx, [esi + 0x620]
lea ecx, [ebp - 0x10]
call fcn.0040aec1
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, edi
test eax, eax
je 0x4934c4
push dword [ebp - 0x10]
mov esi, 0x25c
push str.filepath
push esi
call fcn.004475a0
push str._36_103_36_175
mov ecx, edi
jmp 0x4934ce
push str._30_103_30_163
mov esi, 0x25d
push ebx
push esi
call fcn.0044a310
push 1
push esi
mov ecx, edi
call fcn.0044755b
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
call fcn.00437393
add eax, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.00406123
mov esi, dword [ebp - 0x14]
mov ebx, 0x25e
push esi
push ebx
mov ecx, edi
call fcn.00447618
push str.30_190__30_234
push 0x69ae18
push ebx
mov ecx, edi
call fcn.0044a310
push str.sogou_aladdin_titlt
push str.class
push ebx
mov ecx, edi
call fcn.004475a0
push 1
push ebx
mov ecx, edi
call fcn.0044755b
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4936d4
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x612ad6
call fcn.0060bd28
sub esp, 0x90
push ebx
push esi
push edi
push 0x1b8
push 0x258
mov edi, ecx
call fcn.00493273
push 1
mov ecx, edi
call fcn.0049395f
push str.scene5_logo
push str.skin
lea esi, [edi + 0x28]
mov ebx, 0x25a
push ebx
mov ecx, esi
call fcn.0044a310
push str.16_0
push 0x69ae18
push ebx
mov ecx, esi
call fcn.0044a310
push 1
push ebx
mov ecx, esi
call fcn.0044755b
push str.scene5_bg
push str.skin
push 3
mov ecx, esi
call fcn.0044a310
push str.0_0__0__0
mov ebx, 0x69ae18
mov ecx, esi
push ebx
push 3
call fcn.0044a310
push str.0__105__0__15
push ebx
push 0xc8
mov ecx, esi
call fcn.0044a310
push 1
push 0x262
mov ecx, esi
call fcn.0044755b
push str.softtemprory.png
lea edx, [edi + 0x624]
lea ecx, [ebp - 0x14]
call fcn.0040aec1
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
je 0x4937c7
push dword [ebp - 0x14]
mov ebx, 0x264
push str.filepath
push ebx
call fcn.004475a0
push 1
push ebx
mov ecx, esi
call fcn.0044755b
xor ebx, ebx
jmp 0x4937d3
push 1
push 0x265
call fcn.0044755b
push 1
push 0x263
mov ecx, esi
call fcn.0044755b
push 0x64
lea eax, [ebp - 0x10]
push eax
call fcn.00493d00
mov byte [ebp - 4], 1
mov ecx, esi
push dword [eax]
push 0x266
call fcn.00447618
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push 0x65
lea eax, [ebp - 0x18]
push eax
call fcn.00493d00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98]
push 0xfde9
push dword [eax]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x9c]
call fcn.00408f48
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
push dword [ebp - 0x9c]
call fcn.00413e4d
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x9c], eax
je 0x493869
push dword [ebp - 0x9c]
call fcn.005f0033
pop ecx
push dword [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.004943b3
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404ea9
push ecx
push ecx
mov ecx, edi
call fcn.00493d80
xor eax, eax
mov ecx, esi
cmp dword [edi + 0x5d4], ebx
sete al
push eax
push 0x267
call fcn.0044755b
cmp dword [edi + 0x5d4], ebx
jne 0x4938c6
push ebx
push 0x53
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4938dc
push str.0_268__0_300
push 0x69ae18
push 0x1fb
mov ecx, esi
call fcn.0044a310
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493f8f
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x493fc6
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x493fb9
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
Function at 0x4941b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x49422c
cmp dword [ebp + 0xc], esi
je 0x49422c
cmp dword [edi + 0x10], esi
je 0x4941eb
push esi
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4941e6
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
cmp dword [edi + 0x10], esi
jne 0x49422c
mov ebx, dword [edi]
push 0x18
call fcn.00430c2b
pop ecx
mov ecx, eax
test ecx, ecx
je 0x494220
push esi
push esi
push ecx
mov dword [ecx], ebx
mov dword [ecx + 0x10], esi
mov eax, dword [ebp + 0xc]
push 0x48db94
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push esi
mov dword [ecx + 0xc], eax
call fcn.005f3920
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 0x10], esi
test esi, esi
setne al
jmp 0x49422e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x49477e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x4948ca
mov ebx, dword [ebp + 0xc]
xor esi, esi
inc esi
cmp ebx, 0x4e
jne 0x4947cf
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x4948d3
push ecx
mov ecx, edi
mov dword [edi + 0x580], esi
call fcn.004946d8
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], 0
je 0x4948a6
mov eax, esi
jmp 0x4948cc
cmp ebx, 0x113
jne 0x49481e
mov eax, 0x2711
mov dword [edi + 0x580], esi
cmp dword [ebp + 0x10], eax
jne 0x494816
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [edi + 0x58c]
push 0x3ed
push 0x476
push dword [edi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp + 0x18]
and dword [ecx], 0
jmp 0x4947bb
cmp ebx, 0x110
jne 0x494840
push 0
push 0
push 0x473
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x494816
cmp ebx, 0x473
jne 0x494863
call fcn.00494af3
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x4948cc
cmp ebx, 0x477
jne 0x494880
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.00494956
jmp 0x4947b6
cmp ebx, 0x478
jne 0x4948d3
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.004949b8
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x580], 0
jne 0x49485e
mov ecx, esi
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0044a38e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x49485e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
jmp 0x4948a6
Function at 0x494bb8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x494c21
cmp dword [ebp + 0x1c], 0x12d
jne 0x494d8b
cmp dword [ebp + 0xc], 0x100
jne 0x494d8b
xor ebx, ebx
push 0x11
mov dword [edi + 0x580], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebp + 0x10], 0x61
movzx eax, ax
je 0x494bff
cmp dword [ebp + 0x10], 0x41
jne 0x494c11
test al, al
jns 0x494c11
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.0049418b
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x580], ebx
jmp 0x494d89
mov eax, dword [ebp + 0xc]
xor esi, esi
inc esi
xor ebx, ebx
cmp eax, 0x4e
jne 0x494c78
mov edx, dword [ebp + 0x14]
cmp dword [edx + 4], 0xffffffff
jne 0x494d64
mov dword [edi + 0x580], esi
cmp dword [edx + 8], esi
jne 0x494c58
cmp dword [edx + 0xc], 0x12e
jne 0x494c58
call fcn.00494f21
mov eax, esi
jmp 0x494c60
mov dword [edi + 0x580], ebx
mov eax, ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], ebx
je 0x494d64
mov eax, esi
jmp 0x494d8d
cmp eax, 0x110
jne 0x494c9b
mov dword [edi + 0x580], esi
call fcn.00495090
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
jmp 0x494c65
cmp eax, 0x465
jne 0x494cb4
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.00494e71
jmp 0x494c60
cmp eax, 0x466
jne 0x494ccb
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.00494ec7
jmp 0x494c60
mov edx, 0x46c
cmp eax, edx
jne 0x494ce7
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.0049533d
jmp 0x494c60
cmp eax, 0x46f
jne 0x494d08
push dword [edi + 0x5b0]
mov dword [edi + 0x580], esi
push dword [edi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x494c94
cmp eax, 0x10
jne 0x494d29
push ebx
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x494c94
cmp eax, 0x111
jne 0x494d64
mov eax, dword [ebp + 0x10]
mov ecx, 0x300
shr eax, 0x10
mov dword [edi + 0x580], ebx
cmp cx, ax
jne 0x494d52
push ebx
push ebx
push edx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
cmp dword [edi + 0x580], ebx
je 0x494d64
xor eax, eax
inc eax
jmp 0x494d8d
mov esi, dword [edi + 0x578]
mov ecx, edi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a38e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x494d5f
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x494f21
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x60d425
call fcn.0060bd28
sub esp, 0x43c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x18], ebx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov edi, 0x208
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.005e1780
push edi
lea eax, [ebp - 0x448]
push ebx
push eax
call fcn.005e1780
add esp, 0x18
lea eax, [ebp - 0x448]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x69fcec
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
push 0x105
mov dword [ebp - 0x34], eax
call fcn.0040682a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x2c], 0x69fcdc
mov dword [ebp - 0x28], 0x8041
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00408f1c
test edi, edi
je 0x495067
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x240]
push eax
call fcn.005f0038
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x10]
call fcn.0046f590
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov dword [esp], str.kingsoft_antivirus_
call fcn.004062d3
push dword [ebp - 0x10]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00495262
push eax
push 0x46c
push dword [esi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x495090
Capabilities:
Get common file path
Get program files directory
Hide graphical window

Disassembly:
mov eax, 0x60ca45
call fcn.0060bd28
sub esp, 0x20c
push ebx
push esi
push edi
push ecx
push ecx
mov eax, esp
mov ebx, ecx
sub esp, 0x10
xor esi, esi
mov dword [eax], 0x12d
lea edi, [ebx + 0x588]
mov eax, esp
mov ecx, edi
mov dword [eax], esi
push dword [ebx + 4]
call fcn.00493ffe
push 0x6a0248
push 0x20
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x64
push esi
push esi
push esi
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi]
call esi
push 0
push 0x96
push 0xc5
push dword [edi]
call esi
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
xor esi, esi
lea eax, [ebp - 0x218]
push 0x208
push esi
push eax
mov dword [ebp - 4], esi
call fcn.005e1780
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x495162
push str.c:program_files
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005f184c
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push str._skingsoftkingsoft_antivirus_
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x5b0]
call fcn.00406123
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x495262
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], ecx
lea ecx, [ebp + 8]
mov edx, dword [edi]
call fcn.0046f590
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [edi]
cmp dword [eax - 0xc], 3
jl 0x495320
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4952aa
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x495320
push 3
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp + 8]
cmp eax, 3
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x4952d9
push 2
pop esi
jmp 0x495323
push edi
call fcn.004951ae
push 3
test eax, eax
jne 0x4952d6
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.00490c7d
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00404ea9
add bl, 1
je 0x495311
push 4
jmp 0x4952d6
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x495323
push 5
jmp 0x4952d6
xor esi, esi
inc esi
mov eax, dword [ebp - 4]
push dword [eax + 0x584]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49878f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x612bcd
call fcn.0060bd28
sub esp, 0x26c
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x693da4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], edi
call fcn.00406173
mov dword [ebp - 4], edi
call fcn.00417aae
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov al, byte [eax + 0x20]
mov byte [ebp - 4], 1
test al, al
je 0x4987ed
cmp dword [esi + 0x14], edi
jne 0x4987ed
push 0x20119
push dword [esi + 8]
lea ecx, [ebp - 0x24]
push dword [esi + 4]
call fcn.00416598
test eax, eax
je 0x49881e
push 0x20219
push dword [esi + 8]
lea ecx, [ebp - 0x24]
push dword [esi + 4]
call fcn.00416598
test eax, eax
je 0x49881e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.004067cf
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov dword [esi], eax
jmp 0x49891b
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
push 0x20a
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 2
push edi
push eax
mov dword [ebp - 0x18], edi
call fcn.005e1780
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [esi + 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4988f3
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x4988c8
cmp eax, 2
je 0x4988c8
cmp eax, 7
je 0x4988c8
cmp eax, 4
jne 0x4988a5
push 0xa
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x278]
call fcn.005f559e
add esp, 0x10
lea eax, [ebp - 0x6c]
jmp 0x4988ce
cmp eax, 0xb
jne 0x4988d7
push 0xa
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x274]
push dword [ebp - 0x278]
call fcn.005f555d
add esp, 0x14
jmp 0x4988a0
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x10]
call fcn.004060f8
lea ecx, [ebp - 0x10]
call fcn.0046e743
lea ecx, [ebp - 0x10]
call fcn.0046e833
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406123
lea ecx, [ebp - 0x24]
call fcn.004165ef
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.004067cf
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.00404ea9
lea ecx, [ebp - 0x24]
call fcn.004165ef
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x498a77
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x498a90
mov eax, dword [ebp - 4]
jmp 0x498b6a
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x498b45
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x692d38]
dec ebp
jne 0x498aaf
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x498b61
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x692d38]
dec ecx
jne 0x498b4f
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499290
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612c90
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x3c], ecx
je 0x499449
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x499449
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x499449
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x49943c
cmp dword [ebp - 0x14], 0
jbe 0x49943c
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.004997f0
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
call fcn.00439e6b
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
call fcn.00408bd9
cmp dword [ebp - 0x28], 0
lea ecx, [ebp - 0x30]
je 0x499413
mov esi, dword [ebp - 0x34]
push dword [esi]
call fcn.00407a4a
test eax, eax
je 0x4993ae
push dword [esi]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.00408e5b
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00407a36
mov ecx, dword [ebp - 0x38]
push eax
call fcn.004060f8
mov byte [ebp - 4], 1
push dword [edi]
lea ecx, [ebp - 0x30]
call fcn.00407a4a
test eax, eax
je 0x4993e5
push dword [edi]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.00408e5b
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00407a36
mov ecx, dword [ebp - 0x3c]
push eax
call fcn.004060f8
mov dword [ebp - 0x48], vtable.cf::BkJson::Handle.0
lea ecx, [ebp - 0x30]
call fcn.00408bb4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49940f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
jmp 0x49944b
call fcn.00408bb4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x499449
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x499449
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a6f7
mov esp, ebp
pop ebp
ret
Function at 0x4a37b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x1505
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0xc]
jae 0x4a3803
mov edx, dword [ebp - 8]
shl edx, 5
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
push edx
call fcn.004b1360
add esp, 4
movsx eax, al
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x4a37c6
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0x100
div ecx
mov eax, edx
mov esp, ebp
pop ebp
ret