joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ed64
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x47ed8a
mov eax, 0x4aa100
call fcn.0046e8f4
mov dword [ebx + 8], eax
mov eax, dword [ebx]
test eax, eax
je 0x47ed96
push eax
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4af658]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x47edce
mov ecx, 0x4aa10d
jmp 0x47edd3
mov ecx, 0x4aa11a
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x47ee80
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4ca90c]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.0047f1f8
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x47ee93
call fcn.0046ec94
jmp 0x47ee93
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x47eec0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x47eec0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0047ef24
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x47ef11
call fcn.0046ec0c
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x47ef0b
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push 0x4aa123
push eax
call fcn.00497dc4
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.0047f1f8
inc esi
cmp esi, 0x20
jl 0x47eecf
mov eax, ebx
call fcn.0047f388
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47f1f8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x1c]
push 0x408
call fcn.0049349c
pop ecx
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [ebp + 0x20]
mov dword [esi + 4], edx
mov eax, dword [ebp - 4]
call fcn.0040eda0
push eax
lea edx, [esi + 8]
push edx
call fcn.00494e64
add esp, 8
cmp byte [ebx + 4], 0
je 0x47f35f
cmp dword [ebx + 8], 0x50000
jb 0x47f261
cmp dword [0x4c565c], 4
jne 0x47f265
cmp dword [0x4c5660], 0
jne 0x47f265
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x47f276
cmp edi, 0xffffffff
je 0x47f27a
cmp dword [ebp + 0x18], 0
je 0x47f27a
xor eax, eax
jmp 0x47f27f
mov eax, 1
test al, al
je 0x47f2c2
cmp dword [ebp - 8], 2
mov eax, 0x4201
jne 0x47f291
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x168]
push edx
push 0
push dword [ebp - 4]
call sub.SHELL32.DLL_SHGetFileInfoA
cmp edi, 0xffffffff
jne 0x47f2b3
mov edi, dword [ebp - 0x164]
cmp dword [ebp + 0x18], 0
jne 0x47f2c2
lea eax, [ebp - 0x15c]
mov dword [ebp + 0x18], eax
push 0x24
push 0
lea edx, [ebp - 0x18c]
push edx
call fcn.00494ce4
add esp, 0xc
mov dword [ebp - 0x18c], 0x37
cmp dword [ebp + 0x18], 0
je 0x47f2ea
mov ecx, dword [ebp + 0x18]
jmp 0x47f2ed
or ecx, 0xffffffff
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x16c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x17c], edi
mov dword [ebp - 0x178], edi
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x170], edx
cmp dword [ebp + 0x14], 0
je 0x47f346
call fcn.0040ffc8
test eax, eax
je 0x47f346
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x18c]
mov dword [ebp - 0x184], eax
push edx
push 0
push 0x40b
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47f37f
lea ecx, [ebp - 0x18c]
push ecx
push 0
push 0x401
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47f37f
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x14a
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push esi
push eax
push 0x151
push dword [ebx]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x47f388
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbf4
mov esi, eax
mov eax, 0x4c2354
call fcn.004696ac
mov edi, eax
test edi, edi
je 0x47f40f
xor eax, eax
mov dword [esp], eax
push esp
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x47f3fc
xor ebx, ebx
push 0
push ebx
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x47f3fc
mov edx, dword [eax + 4]
test edx, edx
je 0x47f3f3
push edx
push edi
push 0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x47f3f3
push 0
push ebx
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x47f3fc
inc ebx
cmp ebx, 0x80
jl 0x47f3b5
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x47f4b5
lea ecx, [esp + 0xc]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov byte [esp + 4], 0
xor edi, edi
push 0
push edi
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47f484
cmp dword [ebx], 0
jne 0x47f47b
movzx ebp, byte [ebx + 8]
push ebp
call fcn.00498e48
pop ecx
push eax
xor eax, eax
mov al, byte [esp + 0x10]
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
call fcn.00498e48
pop ecx
pop edx
cmp edx, eax
jne 0x47f47b
push 0
push edi
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov byte [esp + 4], 1
jmp 0x47f484
inc edi
cmp edi, 0x80
jl 0x47f425
cmp byte [esp + 4], 0
jne 0x47f49c
push 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x10]
mov eax, esi
call fcn.0047f65c
cmp dword [0x4c4ce0], 0
je 0x47f4ae
mov eax, esi
call fcn.0047f924
jmp 0x47f4b5
mov eax, esi
call fcn.0047f8d0
add esp, 0x40c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47f4c0
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
push dword [ebx]
call sub.USER32.DLL_GetWindowTextA
mov eax, esp
call fcn.00448b90
mov edx, esp
push edx
push 0xffffffffffffffff
push 0x158
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x47f528
push 0
push eax
push 0x14e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov eax, ebx
call fcn.0047f57c
cmp dword [0x4c4ce0], 0
je 0x47f51f
mov eax, ebx
call fcn.0047f924
jmp 0x47f572
mov eax, ebx
call fcn.0047f8d0
jmp 0x47f572
cmp dword [0x4c4ce0], 0
je 0x47f54c
mov eax, esp
call fcn.0040c494
test al, al
jne 0x47f54c
mov edx, esp
mov eax, 0x4c2354
xor ecx, ecx
call fcn.00467200
jmp 0x47f572
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47f56b
test al, 0x10
jne 0x47f56b
mov edx, esp
mov eax, 0x4c2354
xor ecx, ecx
call fcn.00467090
jmp 0x47f572
mov eax, esp
call fcn.00449010
add esp, 0x400
pop ebx
ret
Function at 0x47f8d0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff400
mov esi, eax
xor ebx, ebx
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
call fcn.0040ffc8
test eax, eax
je 0x47f909
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea ebx, [esp + 0x400]
push ebx
lea ecx, [esp + 4]
lea edx, [esp + 4]
mov eax, esi
call fcn.0047f65c
add esp, 0xc00
pop esi
pop ebx
ret

Function at 0x47fbd8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
cmp ecx, 0x4e
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
jne 0x47fcbb
mov edx, eax
mov ecx, dword [edx + 8]
sub ecx, 0xfffffcdb
je 0x47fc07
sub ecx, 5
je 0x47fc21
jmp 0x47fcb7
cmp dword [eax + 0x118], 2
jne 0x47fc1a
mov eax, 0x4c28b4
call fcn.0047f4c0
xor eax, eax
jmp 0x47fcc6
mov ebx, eax
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x2c]
cmp dword [eax], 4
jne 0x47fc33
mov edi, dword [eax + 4]
jmp 0x47fc36
lea edi, [eax + 8]
cmp dword [eax], 4
jne 0x47fc42
mov eax, 8
jmp 0x47fc44
xor eax, eax
test esi, 1
mov dword [ebp - 4], eax
je 0x47fc7a
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x164]
or edx, 0x200
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x47fc7a
lea eax, [ebp - 0x158]
mov dword [ebx + 0x14], eax
test esi, 6
je 0x47fcac
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x2c4]
or edx, 0x4001
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x2c0]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x1c], eax
or dword [ebx + 0xc], 0x10000000
xor eax, eax
jmp 0x47fcc6
xor eax, eax
jmp 0x47fcc6
push eax
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47fdf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov byte [ebp - 1], cl
push dword [ebp + 8]
mov ebx, edx
call sub.USER32.DLL_GetSysColor
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x47fe22
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [edx*8 + 0x4aa164]
jmp 0x47fe30
mov eax, ebx
shl eax, 3
sub eax, ebx
mov ecx, dword [eax*8 + 0x4aa168]
cmp byte [ebp - 1], 0
mov ebx, ecx
jne 0x47fe6f
push 2
push ebx
push dword [0x4af654]
call sub.KERNEL32.DLL_FindResourceA
push eax
push dword [0x4af654]
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x47fe5d
mov edx, 4
jmp 0x47fe61
movzx edx, word [eax + 0xe]
mov eax, edx
cmp eax, 8
je 0x47fe6f
mov dword [ebp - 0xc], 0x800080
push 1
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [0x4af654]
call sub.COMCTL32.DLL_CreateMappedBitmap
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x481368
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov ebx, eax
lea edi, [esp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x481387
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
mov edx, 0x4aa7d1
mov eax, 0x4aa76c
mov ecx, 1
call fcn.0046c29c
test eax, eax
je 0x4814da
mov esi, 0x56000944
push 0
push dword [0x4af658]
push 0xd
push dword [0x4c2340]
push 0
push 0
push 0
push 0
push esi
push 0
push 0x4aa79e
push 0
call sub.USER32.DLL_CreateWindowExA
mov ebp, eax
mov dword [ebx + 4], ebp
push 0
push 0x14
push 0x41e
push ebp
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x41f
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x420
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0
mov edx, 0x4aa7db
mov eax, 0x4c2b80
mov ecx, 0xf
call fcn.00484448
test eax, eax
jne 0x481428
mov eax, dword [ebx + 0x1c]
xor edx, edx
mov ecx, esp
mov dword [esp], edx
mov dword [esp + 4], eax
push ecx
push 1
push 0x413
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x4aa5c0
push 1
push 0x414
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
mov ecx, edi
mov edx, 2
mov eax, ebx
call fcn.00481560
mov dword [edi], 0x38
mov dword [edi + 4], 0x173
cmp dword [edi + 8], 0
jne 0x48147c
or dword [edi + 8], 1
or dword [edi + 8], 4
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x34], 2
mov dword [edi + 0x24], edx
push 0x12
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0xc], eax
push 0xf
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0x10], eax
cmp dword [edi + 0x2c], 0
jne 0x4814b3
mov dword [edi + 0x2c], 0x28
mov eax, dword [0x4c28b4]
lea edx, [esp + 0x58]
push edx
push eax
call sub.USER32.DLL_GetClientRect
mov ecx, dword [esp + 0x64]
mov dword [edi + 0x28], ecx
push edi
push 0xffffffffffffffff
push 0x401
push dword [ebx + 8]
call sub.USER32.DLL_SendMessageA
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4840e0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov esi, edx
mov ebx, eax
cmp esi, 0xa8
jne 0x484100
mov eax, ebx
call fcn.00484a94
mov al, 1
jmp 0x484207
cmp esi, 0xa9
jne 0x48412c
push 1
push 0x4aa934
push 0
mov eax, 0x4f7
call fcn.0041202c
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, 1
jmp 0x484207
mov eax, ebx
call fcn.00483fa4
mov edi, eax
cmp esi, 0xaa
jne 0x48415d
mov dword [ebx + 0x114], 0xffffffff
mov ecx, 0x4aa934
mov edx, 0x4aa935
mov eax, 0x4aa924
call fcn.0046bee8
jmp 0x4841d9
cmp esi, 0x3e8
jl 0x48416d
cmp esi, 0x428
jl 0x484174
xor eax, eax
jmp 0x484207
push 0x2c
push 0
lea edx, [esp + 8]
push edx
call fcn.00494ce4
add esp, 0xc
mov dword [esp], 0x2c
mov dword [esp + 4], 0x20
push esp
push 0
push esi
push edi
call sub.USER32.DLL_GetMenuItemInfoA
test eax, eax
jne 0x4841a6
xor eax, eax
jmp 0x484207
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x10c]
jb 0x4841b6
xor eax, eax
jmp 0x484207
mov edx, eax
mov eax, 0x4aa924
imul ecx, edx, 0x584
mov dword [ebx + 0x114], edx
mov edx, 0x4aa935
add ecx, dword [ebx + 0x108]
call fcn.0046bee8
mov eax, dword [ebx + 0x518]
cmp eax, 0xffffffff
je 0x4841ed
push 0
push eax
push edi
call sub.USER32.DLL_CheckMenuItem
push 8
push esi
push edi
call sub.USER32.DLL_CheckMenuItem
mov dword [ebx + 0x518], esi
xor edx, edx
mov eax, ebx
call fcn.00484314
mov al, 1
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x48bae2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.0048bc38
push 0xc
push ebx
lea edx, [esp + 8]
push edx
call fcn.00494c74
add esp, 0xc
xor ebx, ebx
call fcn.0048bbb0
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.0048bbd4
inc ebx
cmp ebx, 0xc
jl 0x48bb02
mov edx, dword [0x4d2fcc]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x28], 2
je 0x48bb3b
movzx ecx, word [0x4e3032]
sar ecx, 8
jmp 0x48bb47
mov ecx, dword [0x4e3038]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x48bb53
or eax, 0xffffffff
jmp 0x48bba7
mov eax, dword [0x4e2fe0]
cdq
cmp edx, dword [0x4d24a4]
jne 0x48bb6c
cmp eax, dword [0x4d24a0]
jbe 0x48bb78
jmp 0x48bb6e
jle 0x48bb78
mov eax, dword [0x4d24a0]
mov ebx, eax
jmp 0x48bb80
mov eax, dword [0x4e2fe0]
mov ebx, eax
mov esi, dword [0x4e2fdc]
jmp 0x48bb9c
call fcn.0048bbb0
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0048bbd4
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x48bb88
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x48bbd4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4e32f8]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4b0f70]
xor ecx, edx
mov dword [0x4e32f8], ecx
and ecx, 0xff
add dword [0x4e32fc], ecx
imul edx, dword [0x4e32fc], 0x8088405
inc edx
mov dword [0x4e32fc], edx
shr edx, 0x18
mov ecx, dword [0x4e3300]
xor edx, ecx
and edx, 0xff
shr ecx, 8
mov edx, dword [edx*4 + 0x4b0f70]
xor edx, ecx
mov dword [0x4e3300], edx
ret

Function at 0x48bf4d
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4e337c
push ebx
mov ecx, dword [edx]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr ecx, 8
mov ebx, dword [ebx*4 + 0x4b0f70]
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
mov ebx, dword [edx + 8]
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4b0f70]
xor ecx, ebx
mov dword [edx + 8], ecx
pop ebx
ret

Function at 0x48c0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x4b8ad5], 0
je 0x48c0f5
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x48c0f5
call fcn.0048bf2c
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.0048bf4d
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x48c0d9
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004971b4
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48c245
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4e33a0
mov edi, 0x4e3398
xor ebx, ebx
mov dword [0x4e339c], 2
jmp 0x48c3d5
mov edx, dword [0x4ab17c]
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [edx + eax + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e3388]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
and eax, 0x7fff
mov edx, dword [0x4ab180]
mov word [edx + eax*2], bp
mov eax, dword [0x4e3388]
mov ecx, dword [edi]
mov dx, word [esi]
mov word [eax + ecx*2], dx
test ebp, ebp
je 0x48c2cd
mov eax, dword [esi]
sub eax, ebp
cmp eax, 0x7efa
ja 0x48c2cd
mov eax, ebp
call fcn.0048c638
mov ebx, eax
mov eax, dword [0x4e33ac]
cmp ebx, eax
jbe 0x48c2cd
mov ebx, eax
cmp ebx, 3
jb 0x48c377
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4e33a4]
call fcn.0048e250
sub dword [0x4e33ac], ebx
cmp ebx, dword [0x4e33b4]
ja 0x48c349
dec ebx
inc dword [esi]
mov ecx, dword [0x4ab17c]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e3388]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4ab180]
mov word [ecx + edx*2], bp
mov edx, dword [0x4e3388]
mov ecx, dword [edi]
mov bp, word [esi]
mov word [edx + ecx*2], bp
dec ebx
jne 0x48c2f7
inc dword [esi]
jmp 0x48c391
add dword [esi], ebx
xor ebx, ebx
mov ecx, dword [esi]
mov edx, dword [0x4ab17c]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ebp, dword [esi]
mov ecx, dword [0x4ab17c]
shl edx, 5
movzx ecx, byte [ecx + ebp + 1]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x48c391
mov eax, dword [0x4ab17c]
mov edx, dword [esi]
movzx edx, byte [eax + edx]
xor eax, eax
call fcn.0048e250
dec dword [0x4e33ac]
inc dword [esi]
test eax, eax
je 0x48c3c4
mov edx, dword [esi]
sub edx, dword [0x4e3390]
cmp dword [0x4e3390], 0
jl 0x48c3b3
mov eax, dword [0x4ab17c]
add eax, dword [0x4e3390]
jmp 0x48c3b5
xor eax, eax
xor ecx, ecx
call fcn.0048e074
mov edx, dword [esi]
mov dword [0x4e3390], edx
cmp dword [0x4e33ac], 0x106
jae 0x48c3d5
call fcn.0048c114
cmp dword [0x4e33ac], 0
jne 0x48c264
mov edx, dword [esi]
sub edx, dword [0x4e3390]
cmp dword [0x4e3390], 0
jl 0x48c400
mov eax, dword [0x4ab17c]
add eax, dword [0x4e3390]
jmp 0x48c402
xor eax, eax
mov ecx, 1
call fcn.0048e074
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48c414
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
mov esi, 0x4e3398
cmp ebx, 1
jl 0x48c42b
cmp ebx, 9
jle 0x48c435
mov eax, 0x4ab1d4
call fcn.00490020
xor edx, edx
mov dword [0x4e3394], edx
cmp dword [0x4e338c], 0
jne 0x48c45a
mov dword [0x4e3394], 1
mov dword [0x4e338c], 0x10000
cmp dword [0x4ab17c], 0
jne 0x48c497
push 2
push 0x8000
call fcn.0049343c
add esp, 8
mov edi, eax
mov dword [0x4ab17c], edi
test edi, edi
jne 0x48c497
mov eax, 0x4af020
call fcn.0042cda4
mov edx, 0x4ab1d4
mov eax, 4
call fcn.0048fec0
cmp dword [0x4ab180], 0
jne 0x48c4fa
push 2
push 0x8000
call fcn.0049343c
add esp, 8
mov dword [0x4ab180], eax
push 2
push 0x8000
call fcn.0049343c
add esp, 8
mov dword [0x4e3388], eax
cmp dword [0x4ab180], 0
je 0x48c4da
cmp dword [0x4e3388], 0
jne 0x48c4fa
mov eax, 0x1ff
call fcn.0041202c
push eax
call fcn.0044e3e0
pop ecx
mov edx, 0x4ab1d4
mov eax, 4
call fcn.0048fec0
mov eax, dword [0x4e3388]
mov word [eax + 0xfffe], 0
push 0xfffe
push 0
push eax
call fcn.00494ce4
movzx edx, word [ebx*8 + 0x4ab186]
mov dword [0x4e33b4], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x4ab184]
mov dword [0x4e33b8], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x4ab188]
mov dword [0x4e33bc], eax
movzx edx, word [ebx*8 + 0x4ab18a]
mov dword [0x4e33b0], edx
jg 0x48c55b
or word [ebp], 4
jmp 0x48c565
cmp ebx, 8
jl 0x48c565
or word [ebp], 2
xor ecx, ecx
xor eax, eax
mov dword [0x4e33a0], ecx
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4e3390], eax
mov eax, dword [0x4ab17c]
mov edx, ebx
call dword [0x4ab5ac]
mov dword [0x4e33ac], eax
mov eax, dword [0x4e33ac]
test eax, eax
je 0x48c59b
cmp eax, 0xffffffff
jne 0x48c5af
mov dword [0x4e33a8], 1
xor edx, edx
mov dword [0x4e33ac], edx
jmp 0x48c5ed
xor ecx, ecx
mov dword [0x4e33a8], ecx
cmp dword [0x4e33ac], 0x106
jae 0x48c5c8
call fcn.0048c114
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov edx, dword [0x4ab17c]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x48c5ce
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4946a0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x495edc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x495ef8
call fcn.00497640
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x495f14
test bl, 1
je 0x495f14
call fcn.0049b724
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret