joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474300
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffff40
xor eax, eax
mov edx, dword [0x4a7d4c]
mov edx, dword [edx]
dec edx
je 0x47431b
dec edx
je 0x474322
jmp 0x47444f
mov al, 1
jmp 0x47444f
mov edx, dword [0x4a79c8]
mov edx, dword [edx]
sub edx, 3
je 0x474341
dec edx
je 0x474370
dec edx
je 0x474377
dec edx
je 0x4743e3
jmp 0x47444f
mov edx, dword [0x4a7bf4]
mov edx, dword [edx]
dec edx
je 0x47435b
sub edx, 4
je 0x474362
sub edx, 0x2e
je 0x474369
jmp 0x47444f
mov al, 2
jmp 0x47444f
mov al, 3
jmp 0x47444f
mov al, 4
jmp 0x47444f
mov al, 5
jmp 0x47444f
mov edx, dword [0x4a7bf4]
mov edx, dword [edx]
sub edx, 1
jb 0x47438e
je 0x474395
dec edx
je 0x47439c
jmp 0x47444f
mov al, 6
jmp 0x47444f
mov al, 7
jmp 0x47444f
mov dword [esp + 0x24], 0x9c
push esp
call sub.kernel32.dll_GetSystemInfo
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x4743bc
mov al, 0xa
jmp 0x47444f
cmp word [esp], 0
je 0x4743df
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x4743df
cmp byte [esp + 0xbe], 1
jne 0x4743df
mov al, 9
jmp 0x47444f
mov al, 8
jmp 0x47444f
mov edx, dword [0x4a7bf4]
mov edx, dword [edx]
sub edx, 1
jb 0x4743f4
je 0x47441c
jmp 0x47444f
mov dword [esp + 0x24], 0x9c
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x474418
cmp byte [esp + 0xbe], 1
jne 0x474418
mov al, 0xb
jmp 0x47444f
mov al, 0xc
jmp 0x47444f
mov dword [esp + 0x24], 0x9c
push esp
call sub.kernel32.dll_GetSystemInfo
cmp word [esp], 0
jne 0x47444d
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x47444d
cmp byte [esp + 0xbe], 1
jne 0x47444d
mov al, 0xe
jmp 0x47444f
mov al, 0xd
add esp, 0xc0
ret

Function at 0x4745c0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402d44
mov dword [esp], 0x3c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x500
mov eax, 0x474628
mov dword [esp + 0xc], eax
mov eax, esi
call fcn.00404694
mov dword [esp + 0x10], eax
mov eax, edi
call fcn.00404694
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 1
push esp
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x47476c
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x474859
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x474839
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x320
call fcn.004026dc
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
lea eax, [ebp - 8]
push eax
push 0x320
push edi
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
mov eax, 0xff
call fcn.004026dc
mov ebx, eax
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x474821
inc esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
lea eax, [edi + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004043b0
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.00474630
test al, al
inc dword [ebp - 0xc]
dec esi
jne 0x4747e7
mov eax, ebx
call fcn.004026fc
mov eax, edi
call fcn.004026fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474843
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474860
lea eax, [ebp - 0x14]
call fcn.004041b8
ret

Function at 0x47b124
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov eax, edi
mov edx, 0x4a4168
mov ecx, dword [0x479368]
call fcn.00404dc4
push 0x10
call sub.kernel32.dll_GetUserGeoID
test eax, eax
jle 0x47b16b
mov esi, 0x10e
mov ebx, 0x4a4168
cmp eax, dword [ebx]
jne 0x47b165
mov eax, edi
mov edx, ebx
mov ecx, dword [0x479368]
call fcn.00404dc4
jmp 0x47b16b
add ebx, 0xc
dec esi
jne 0x47b150
pop edi
pop esi
pop ebx
ret
Function at 0x47ede4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor edx, edx
push ebp
push 0x47efac
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.00404494
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, dword [ebp - 4]
call fcn.00404820
mov eax, esi
call fcn.00404494
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x47ef2f
mov ebx, 1
mov eax, esi
call fcn.00404494
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x47ee72
mov eax, esi
call fcn.00404494
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
call fcn.004028d8
jmp 0x47ee88
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [ebp - 7]
mov ecx, 3
call fcn.004028d8
mov al, byte [ebp - 7]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x47efd0
mov dl, byte [ecx + edx]
mov byte [ebp - 0xb], dl
and al, 3
and eax, 0xff
shl eax, 4
mov dl, byte [ebp - 6]
and dl, 0xf0
and edx, 0xff
shr edx, 4
or eax, edx
mov edx, 0x47efd0
mov al, byte [edx + eax]
mov byte [ebp - 0xa], al
mov dl, byte [ebp - 6]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov al, byte [ebp - 5]
mov ecx, eax
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
or edx, ecx
mov ecx, 0x47efd0
mov dl, byte [ecx + edx]
mov byte [ebp - 9], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x47efd0
mov al, byte [edx + eax]
mov byte [ebp - 8], al
mov eax, dword [ebp - 4]
call fcn.004046ec
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [ebp - 0xb]
mov ecx, 4
call fcn.004028d8
inc ebx
dec edi
jne 0x47ee40
mov eax, esi
call fcn.00404494
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x47ef75
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404494
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046ec
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404494
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046ec
mov byte [eax + ebx - 1], 0x3d
jmp 0x47efa2
mov eax, esi
call fcn.00404494
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x47efa2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404494
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046ec
mov byte [eax + ebx - 1], 0x3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47efbe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f374
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x47f412
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4a4e10]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4a4e10]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4a4e10]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4a4e10]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x47f393
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x47f428
dec edx
je 0x47f45d
jmp 0x47f4ae
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4a4e10]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4a4e10]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x47f4ae
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4a4e10]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4a4e10]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4a4e10]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47f510
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x47f52f
add edx, 3
sar edx, 2
test edx, edx
jle 0x47f63c
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x47f565
je 0x47f5a5
sub ecx, 0x2b
je 0x47f59b
sub ecx, 4
je 0x47f5a0
dec ecx
sub ecx, 0xa
jb 0x47f58e
jmp 0x47f5a8
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x47f577
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x47f581
jmp 0x47f5a8
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x47f5a8
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x47f5a8
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x47f5a8
mov byte [eax], 0x3e
jmp 0x47f5a8
mov byte [eax], 0x3f
jmp 0x47f5a8
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x47f547
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x47f5f9
cmp byte [esp + 7], 0xff
jne 0x47f5f9
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x47f631
cmp dl, 0xff
je 0x47f631
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x47f53e
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x48027c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x48029c
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x48028a
pop edi
pop esi
pop ebx
ret
Function at 0x4858e8
Capabilities:
Check http status code
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x485a81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x485a98
call fcn.0040420c
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404250
mov edx, dword [ebp - 0x14]
mov eax, 0x485aa4
call fcn.004047d8
test eax, eax
jg 0x48594d
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x485ab0
call fcn.004044e0
xor eax, eax
push ebp
push 0x485a56
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x485ab8
call sub.wininet.dll_InternetOpenA
mov ebx, eax
test ebx, ebx
je 0x485a4c
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404694
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edi, 0x194
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x114]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00402d44
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x13
push esi
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x4859ed
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.004043b0
mov eax, dword [ebp - 0x118]
call fcn.00408bbc
mov edi, eax
cmp edi, 0x194
jae 0x485a3c
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x114]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00402d44
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x485a3c
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x114]
call fcn.004043b0
test esi, esi
je 0x485a46
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x485a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485a88
lea eax, [ebp - 0x118]
call fcn.004041b8
lea eax, [ebp - 0x14]
call fcn.004041b8
ret
Function at 0x48a48c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x48a4b9
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x48a538
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00489504
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48a506
mov cx, word [esp]
sub cx, si
jmp 0x48a508
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48a4ef
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48a52e
mov cx, word [esp]
sub cx, si
jmp 0x48a530
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48a517
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48a595
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0048a188
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x48a580
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x48a595
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48a496
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48f95c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4a8fa4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x48f97e
shr eax, 1
xor eax, 0xedb88320
jmp 0x48f980
shr eax, 1
dec edx
jne 0x48f96c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x48f965
mov byte [0x4a93a4], 1
pop esi
pop ebx
ret

Function at 0x48f99c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4a93a4], 0
jne 0x48f9b3
call fcn.0048f95c
mov eax, edi
dec eax
test eax, eax
jl 0x48f9dc
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a8fa4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x48f9bd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x491f2c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x491f5d
dec al
je 0x491f99
dec al
je 0x491fdd
dec al
je 0x492048
jmp 0x4920d2
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4920d2
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x491f6d
jmp 0x4920d2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4920d2
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x491fa9
jmp 0x4920d2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4920d2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x49200b
xor ebp, ebp
jmp 0x49201c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x492025
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x491fed
jmp 0x4920d2
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4920d2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4920a0
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0048f9e4
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49205c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x497a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404694
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x497a89
test al, 0x10
jne 0x497a8d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x497a94
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00404684
xor eax, eax
push ebp
push 0x497c81
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00402d64
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.00402d44
cmp dword [ebp + 0x20], 0
je 0x497b4f
cmp dword [ebp - 0x10], 0
je 0x497b4f
mov eax, dword [ebp + 0x20]
call fcn.00408fdc
test al, al
jne 0x497b05
mov eax, dword [ebp + 0x20]
call fcn.00497a70
test al, al
je 0x497b28
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00404694
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x497b49
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00404694
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x497b76
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x497c94
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x497b95
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x497c94
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00417090
test bl, bl
je 0x497bd5
cmp byte [ebp + 0x14], 0
jne 0x497bd5
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004254b8
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x497c6b
mov dl, 1
mov eax, dword [0x423600]
call fcn.00429368
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.00429930
call fcn.004254b8
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00402b00
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00402b00
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.00497994
mov eax, ebx
call fcn.004033c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497c88
lea eax, [ebp + 0x20]
call fcn.004041b8
ret