joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4363d4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
call sub.USER32.DLL_IsClipboardFormatAvailable
test eax, eax
je 0x43649b
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x43649b
push edi
call sub.USER32.DLL_GetClipboardData
mov esi, eax
test esi, esi
je 0x436496
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436496
push esi
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov eax, edi
dec eax
je 0x43645d
sub eax, 6
je 0x43645d
sub eax, 6
jne 0x43646c
shr ebx, 1
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004704e8
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x436490
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00470bc8
add esp, 0x10
jmp 0x436490
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004b44bc
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x436490
push ebx
cmp edi, 1
mov ecx, dword [ebp - 4]
push ecx
jne 0x436481
call fcn.004784e0
jmp 0x436483
xor eax, eax
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00470b0c
add esp, 0x10
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
test ebx, ebx
jne 0x4364ad
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0046d4f0
add esp, 8
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x43683c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
xor ebx, ebx
push esp
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x436929
test byte [esp + 0x10], 0x80
je 0x43685d
or ebx, 1
test byte [esp + 0x11], 0x80
je 0x436867
or ebx, 2
test byte [esp + 0x12], 0x80
je 0x436871
or ebx, 4
test byte [esp + 0x5b], 0x80
je 0x43687e
or ebx, 0x4000
test byte [esp + 0x5c], 0x80
je 0x43688b
or ebx, 0x8000
test byte [esp + 0x5d], 0x80
je 0x436898
or ebx, 0x10000
test byte [esp + 0x91], 1
je 0x4368a5
or ebx, 0x10
test byte [esp + 0x90], 1
je 0x4368b2
or ebx, 0x20
test byte [esp + 0x14], 1
je 0x4368bc
or ebx, 0x40
test byte [esp + 0x2d], 1
je 0x4368c9
or ebx, 0x80
test byte [esp + 0xa0], 0x80
je 0x4368d9
or ebx, 0x100
test byte [esp + 0xa1], 0x80
je 0x4368e9
or ebx, 0x200
test byte [esp + 0xa2], 0x80
je 0x4368f9
or ebx, 0x400
test byte [esp + 0xa3], 0x80
je 0x436909
or ebx, 0x800
test byte [esp + 0xa4], 0x80
je 0x436919
or ebx, 0x1000
test byte [esp + 0xa5], 0x80
je 0x436929
or ebx, 0x2000
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x436934
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x436a5c
test bl, 1
je 0x43695e
mov dl, 0x80
jmp 0x436960
xor edx, edx
test bl, 2
mov byte [ebp - 0xf0], dl
je 0x43696f
mov al, 0x80
jmp 0x436971
xor eax, eax
test bl, 4
mov byte [ebp - 0xef], al
je 0x436980
mov dl, 0x80
jmp 0x436982
xor edx, edx
test bh, 0x40
mov byte [ebp - 0xee], dl
je 0x436991
mov al, 0x80
jmp 0x436993
xor eax, eax
test bh, 0x80
mov byte [ebp - 0xa5], al
je 0x4369a2
mov dl, 0x80
jmp 0x4369a4
xor edx, edx
test ebx, 0x10000
mov byte [ebp - 0xa4], dl
je 0x4369b6
mov al, 0x80
jmp 0x4369b8
xor eax, eax
test bl, 0x10
mov byte [ebp - 0xa3], al
je 0x4369c7
mov dl, 1
jmp 0x4369c9
xor edx, edx
test bl, 0x20
mov byte [ebp - 0x6f], dl
je 0x4369d5
mov al, 1
jmp 0x4369d7
xor eax, eax
test bl, 0x40
mov byte [ebp - 0x70], al
je 0x4369e3
mov dl, 1
jmp 0x4369e5
xor edx, edx
test bl, 0x80
mov byte [ebp - 0xec], dl
je 0x4369f4
mov al, 1
jmp 0x4369f6
xor eax, eax
test bh, 1
mov byte [ebp - 0xd3], al
je 0x436a05
mov dl, 0x80
jmp 0x436a07
xor edx, edx
test bh, 2
mov byte [ebp - 0x60], dl
je 0x436a13
mov al, 0x80
jmp 0x436a15
xor eax, eax
test bh, 4
mov byte [ebp - 0x5f], al
je 0x436a21
mov dl, 0x80
jmp 0x436a23
xor edx, edx
test bh, 8
mov byte [ebp - 0x5e], dl
je 0x436a2f
mov al, 0x80
jmp 0x436a31
xor eax, eax
test bh, 0x10
mov byte [ebp - 0x5d], al
je 0x436a3d
mov dl, 0x80
jmp 0x436a3f
xor edx, edx
test bh, 0x20
mov byte [ebp - 0x5c], dl
je 0x436a4b
mov al, 0x80
jmp 0x436a4d
xor eax, eax
mov byte [ebp - 0x5b], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.DLL_SetKeyboardState
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4371b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, 0xffffffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x4371ea
test ecx, ecx
je 0x4371ea
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5a64dc]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x4371cc
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x4371f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ax, 0xffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x43722f
test ecx, ecx
je 0x43722f
movzx ebx, ax
movzx edi, byte [edx]
mov esi, ebx
inc edx
xor esi, edi
and esi, 0xff
sar ebx, 8
mov si, word [esi*2 + 0x5a68dc]
xor si, bx
dec ecx
mov eax, esi
jne 0x43720b
xor ax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4466e8
Capabilities:
Get hostname

Disassembly:
add esp, 0xffffffdc
mov dword [esp], 0x10
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov word [esp + 0x22], 0
cmp word [esp + 4], 0
je 0x446720
lea edx, [esp + 4]
push edx
call fcn.00478890
pop ecx
jmp 0x44672b
push str.HOSTNAME
call fcn.004b2538
pop ecx
add esp, 0x24
ret
Function at 0x446748
Capabilities:
Get session user name

Disassembly:
add esp, 0xfffffdfc
mov dword [esp], 0x100
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.ADVAPI32.DLL_GetUserNameW
mov word [esp + 0x202], 0
cmp word [esp + 4], 0
je 0x446786
lea edx, [esp + 4]
push edx
call fcn.00478890
pop ecx
jmp 0x446791
push str.USER
call fcn.004b2538
pop ecx
add esp, 0x204
ret
Function at 0x46712c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
cmp dword [0x5d1584], 0
jne 0x46719f
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x467156
mov edx, ebx
dec edx
test edx, ebx
je 0x46715b
call fcn.004cb8e4
mov dword [0x5d158c], esi
mov dword [0x5d1588], ebx
mov dword [0x5d1590], 0x40000
mov eax, 5
mov dword [0x5d1594], 0x200000
mov dword [0x5d1598], eax
mov dword [0x5d1758], eax
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x5d1584], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x46b09c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
mov eax, dword [ebp + 8]
cmp eax, 0x69
jg 0x46b0ff
je 0x46b1d3
cmp eax, 4
jg 0x46b0dc
je 0x46b193
sub eax, 1
jb 0x46b138
je 0x46b14c
dec eax
je 0x46b16b
dec eax
je 0x46b17f
jmp case.0x46b10d.1006
sub eax, 0x65
je 0x46b19a
dec eax
je 0x46b1b1
dec eax
je 0x46b1b8
dec eax
je 0x46b1cf
jmp case.0x46b10d.1006
add eax, 0xfffffc17
cmp eax, 8
ja case.0x46b10d.1006
jmp dword [eax*4 + 0x46b114]
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x46b221
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x46b160
mov eax, dword [ebp - 0x34]
jmp 0x46b163
or eax, 0xffffffff
shr eax, 0xa
jmp 0x46b221
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x46b221
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x46b221
xor eax, eax
jmp 0x46b221
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x46b221
mov eax, 1
jmp 0x46b221
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x46b221
xor eax, eax
jmp 0x46b221
xor eax, eax
jmp 0x46b221
call fcn.0046ad44
jmp 0x46b221
xor eax, eax
jmp 0x46b221
call fcn.0046ad4c
jmp 0x46b221
call fcn.00464298
jmp 0x46b221
call fcn.00464298
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x46b221
mov eax, dword [0x5d1280]
sub eax, dword [0x5d1288]
test eax, eax
jns 0x46b20f
add eax, 3
sar eax, 2
jmp 0x46b221
xor eax, eax
jmp 0x46b221
mov eax, 1
jmp 0x46b221
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x46b700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
jmp 0x46b772
test edx, 0x10000
jne 0x46b843
test edx, 0x20000
je 0x46b729
mov edx, dword [eax + 8]
push edx
mov eax, dword [eax + 0xc]
call dword [eax + 0x10]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x40
jne 0x46b76b
cmp dword [eax + 0xc], 0
jne 0x46b76b
cmp dword [eax + 0x10], 0
jl 0x46b76b
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5accf4]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x46b843
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
push eax
call fcn.0046eed4
pop ecx
mov edx, dword [eax]
test dh, 0x20
jne 0x46b708
test byte [eax + 1], 0x80
je 0x46b7ad
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx ecx, word [eax + 0xe]
and ecx, 0xfffffffd
movzx edx, word [0x5accf4]
cmp ecx, edx
jne 0x46b843
xor word [eax + 0xe], 1
lea ecx, [eax + 0x10]
push ecx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 4
je 0x46b7dc
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
movzx ecx, word [0x5accf4]
cmp edx, ecx
jne 0x46b843
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x10
je 0x46b80e
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5accf4]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x46b843
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 1
je 0x46b843
cmp dword [eax + 0xc], 0
je 0x46b843
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5accf4]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x46b843
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
Function at 0x4b2460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4b2496
push esi
call fcn.00433f60
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
test edi, edi
mov ebx, eax
je 0x4b2496
push edi
call fcn.0046af54
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b24a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4b24db
push esi
call fcn.00433f60
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4b24c7
test al, 0x50
je 0x4b24cb
xor ebx, ebx
jmp 0x4b24d0
mov ebx, 1
test edi, edi
je 0x4b24db
push edi
call fcn.0046af54
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b24e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4b251f
push esi
call fcn.00433f60
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4b250b
test al, 0x10
jne 0x4b250f
xor ebx, ebx
jmp 0x4b2514
mov ebx, 1
test edi, edi
je 0x4b251f
push edi
call fcn.0046af54
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b2538
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.0047879c
pop ecx
mov ebx, eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov esi, eax
test esi, esi
je 0x4b258c
mov eax, esi
add eax, eax
push eax
call fcn.0046ae84
pop ecx
mov dword [ebp - 4], eax
push esi
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov ecx, dword [ebp - 4]
push ecx
call fcn.00478890
pop ecx
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.0046af54
pop ecx
push ebx
call fcn.0046af54
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b57c8
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xfffffeec
mov ebx, esp
push 1
push 0
push 0
push 0xa
call fcn.004b5cbc
add esp, 0x10
mov dword [0x5b2fac], eax
push 1
push 0
push 3
push 6
call fcn.004b5cbc
add esp, 0x10
mov dword [0x5b2fb0], eax
push 1
push 0
push 2
push 6
call fcn.004b5cbc
add esp, 0x10
mov dword [0x5b2fb4], eax
push 1
push 0
push 1
push 6
call fcn.004b5cbc
add esp, 0x10
mov dword [0x5b2fb8], eax
push 1
push 0
push 0
push 6
call fcn.004b5cbc
add esp, 0x10
mov dword [0x5b2fbc], eax
push 1
push 3
push 2
push 5
call fcn.004b5cbc
add esp, 0x10
test eax, eax
jne 0x4b5866
push 1
push 2
push 2
push 5
call fcn.004b5cbc
add esp, 0x10
test eax, eax
jne 0x4b5866
xor eax, eax
jmp 0x4b586b
mov eax, 1
mov dword [0x5b2fc0], eax
push 1
push 0
push 0
push 5
call fcn.004b5cbc
add esp, 0x10
mov dword [0x5b2fc4], eax
mov dword [ebx], 0x114
push ebx
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4b592d
cmp dword [ebx + 0x10], 1
je 0x4b58a9
xor edx, edx
mov dword [0x5b2fcc], edx
jmp 0x4b58e3
cmp dword [ebx + 4], 4
jne 0x4b58c1
cmp dword [ebx + 8], 0xa
jae 0x4b58c1
mov dword [0x5b2fcc], 5
jmp 0x4b58e3
cmp dword [ebx + 4], 4
jne 0x4b58d9
cmp dword [ebx + 8], 0xa
jne 0x4b58d9
mov dword [0x5b2fcc], 8
jmp 0x4b58e3
mov dword [0x5b2fcc], 9
cmp dword [ebx + 0x10], 2
je 0x4b58f3
xor ecx, ecx
mov dword [0x5b2fc8], ecx
jmp 0x4b592d
cmp dword [ebx + 4], 3
jne 0x4b590b
cmp dword [ebx + 8], 0x33
jne 0x4b590b
mov dword [0x5b2fc8], 3
jmp 0x4b592d
cmp dword [ebx + 4], 4
jne 0x4b5923
cmp dword [ebx + 8], 0
jne 0x4b5923
mov dword [0x5b2fc8], 4
jmp 0x4b592d
mov dword [0x5b2fc8], 5
push str.ntdll.dll
call sub.KERNEL32.DLL_GetModuleHandleW
test eax, eax
je 0x4b5954
push str.wine_get_version
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4b5954
mov dword [0x5b2fd0], 1
cmp dword [0x5b2fc4], 0
je 0x4b5967
mov dword [0x5b2fc8], 5
mov dword [0x5b2fa8], 1
add esp, 0x114
pop ebx
ret

Function at 0x4bb7a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push 0
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov ebx, eax
test ebx, ebx
je 0x4bb806
test esi, esi
je 0x4bb7ca
push esi
call fcn.004bb710
pop ecx
inc eax
add ebx, eax
mov eax, ebx
add eax, eax
push eax
call fcn.0046ae84
pop ecx
mov edi, eax
push ebx
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryW
test esi, esi
je 0x4bb800
mov eax, ebx
dec eax
push eax
push 0x5b3d7c
push edi
call fcn.004bb75c
add esp, 0xc
dec ebx
push ebx
push esi
push edi
call fcn.004bb75c
add esp, 0xc
mov eax, edi
jmp 0x4bb80d
push esi
call fcn.004bb728
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4bf6fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
xor edx, edx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x2000
push 0
push 0
push 0
push ebx
call fcn.00419a84
push eax
call sub.USER32.DLL_LoadImageA
test eax, eax
je 0x4bf757
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 4]
push ecx
push 1
push 0x5cde40
lea eax, [ebp - 0x20]
push eax
call sub.OLEPRO32.DLL_OleCreatePictureIndirect
jmp 0x4bf818
push str.HMGPICTURE
push ebx
call fcn.00419a84
push eax
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x4bf775
xor eax, eax
jmp 0x4bf83b
push ebx
call fcn.00419a84
push eax
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
test esi, esi
jne 0x4bf78e
xor eax, eax
jmp 0x4bf83b
push esi
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4bf7a4
xor eax, eax
jmp 0x4bf83b
push ebx
call fcn.00419a84
push eax
call sub.KERNEL32.DLL_SizeofResource
mov edi, eax
push edi
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x4bf7c4
xor eax, eax
jmp 0x4bf83b
push edi
mov edx, dword [ebp - 0xc]
push edx
push ebx
call fcn.004c47c8
add esp, 0xc
push esi
call sub.KERNEL32.DLL_FreeResource
lea ecx, [ebp - 8]
push ecx
push 1
push ebx
call sub.OLE32.DLL_CreateStreamOnHGlobal
cmp dword [ebp - 8], 0
jne 0x4bf7f4
push ebx
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
jmp 0x4bf83b
lea edx, [ebp - 4]
push edx
push 0x5cde40
push 1
push edi
mov ecx, dword [ebp - 8]
push ecx
call sub.OLEPRO32.DLL_OleLoadPicture
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push ebx
call sub.KERNEL32.DLL_GlobalFree
cmp dword [ebp - 4], 0
je 0x4bf838
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp - 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf844
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
xor edx, edx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bf880
xor eax, eax
jmp 0x4bf928
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
lea eax, [edi + 0x1000]
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GlobalLock
push 0
lea edx, [ebp - 0xc]
push edx
push edi
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
push esi
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 4]
push eax
push 1
push ebx
call sub.OLE32.DLL_CreateStreamOnHGlobal
cmp dword [ebp - 4], 0
jne 0x4bf8d6
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
jmp 0x4bf928
lea edx, [ebp - 8]
push edx
push 0x5cde40
push 1
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.OLEPRO32.DLL_OleLoadPicture
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp - 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0
je 0x4bf925
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x18]
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c35a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c35d5
xor eax, eax
jmp 0x4c3652
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
je 0x4c35f2
push esi
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [edi], eax
test eax, eax
jne 0x4c35fc
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4c3652
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalLock
test eax, eax
jne 0x4c361f
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4c3652
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_CloseHandle
test esi, esi
jne 0x4c364d
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
jmp 0x4c3652
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c4494
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4c5ba4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4c5bc3
mov eax, dword [0x5ce940]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4c5bd0
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4c5bfd
je 0x4c5c0f
sub ecx, 0x100
je 0x4c5c1d
sub ecx, 0x100
je 0x4c5c24
sub ecx, 0x100
je 0x4c5c16
jmp 0x4c5c2b
sub ecx, 0x600
je 0x4c5c24
sub ecx, 0x100
je 0x4c5c0f
jmp 0x4c5c2b
mov edi, 1
jmp 0x4c5c30
mov edi, 2
jmp 0x4c5c30
mov edi, 4
jmp 0x4c5c30
mov edi, 5
jmp 0x4c5c30
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4c5c57
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5ce3b8]
test al, 0x80
je 0x4c5c50
mov ebx, 0x80
jmp 0x4c5c69
mov ebx, 1
jmp 0x4c5c69
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4c5c69
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4c5c7b
je 0x4c5c84
dec eax
je 0x4c5c8d
jmp 0x4c5c96
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x4c5ca5
mov dword [ebp - 4], 0x40000000
jmp 0x4c5ca5
mov dword [ebp - 4], 0xc0000000
jmp 0x4c5ca5
push 1
call fcn.004c703c
pop ecx
mov ebx, eax
jmp 0x4c5d95
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4c5cc1
sub eax, 0x10
je 0x4c5cc8
sub eax, 0x10
je 0x4c5cd1
sub eax, 0x10
je 0x4c5cda
jmp 0x4c5cda
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4c5ce1
mov dword [ebp - 8], 1
jmp 0x4c5ce1
mov dword [ebp - 8], 2
jmp 0x4c5ce1
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4c5d4e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4c5d43
test byte [ebp + 0xd], 1
je 0x4c5d3e
mov ebx, 0x50
jmp 0x4c5d43
mov ebx, 2
push ebx
call fcn.004c703c
pop ecx
mov ebx, eax
jmp 0x4c5d95
mov edi, esi
push edi
call fcn.004c5b14
pop ecx
test eax, eax
je 0x4c5d62
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4c5d6e
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004c6d80
add esp, 8
mov ebx, eax
inc eax
jne 0x4c5d95
push 4
call fcn.004c703c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret