joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4fa9
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x56a4e0
call fcn.004a6418
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x59492c], edi
jne 0x4b4fed
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x4b4fd8
mov dword [0x59492c], ebx
jmp 0x4b4fed
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x4b4fed
mov dword [0x59492c], 2
mov eax, dword [0x59492c]
cmp eax, ebx
jne 0x4b500d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
jmp 0x4b50d0
cmp eax, 2
je 0x4b5016
cmp eax, edi
jne 0x4b503e
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x4b5029
mov eax, dword [0x5947b8]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x4b5045
xor eax, eax
jmp 0x4b50d0
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.004a2fa0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x4b5078
cmp esi, edi
jne 0x4b508e
push dword [ebp - 0x20]
call fcn.004a2ea9
pop ecx
mov esi, eax
cmp esi, edi
je 0x4b503e
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x4b50c1
cmp dword [ebp + 0x14], edi
jne 0x4b50ab
push edi
push edi
jmp 0x4b50b1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x4b50cd
push esi
call fcn.004a25de
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.004a6453
ret
Function at 0x4b50d9
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x56a4f0
call fcn.004a6418
xor esi, esi
cmp dword [0x594930], esi
jne 0x4b511d
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x4b5108
mov dword [0x594930], edi
jmp 0x4b511d
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x4b511d
mov dword [0x594930], 2
mov eax, dword [0x594930]
cmp eax, 2
je 0x4b51fe
cmp eax, esi
je 0x4b51fe
cmp eax, 1
jne 0x4b5162
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x4b514b
mov eax, dword [0x5947b8]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4b5169
xor eax, eax
jmp 0x4b5210
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.004a2fa0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4b519f
cmp edi, esi
jne 0x4b51ba
lea eax, [ebx + ebx]
push eax
call fcn.004a2ea9
pop ecx
mov edi, eax
cmp edi, esi
je 0x4b5162
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x4b51ed
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x4b51d7
push esi
push esi
jmp 0x4b51dd
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x4b51f9
push edi
call fcn.004a25de
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4b5210
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.004a6453
ret
Function at 0x4bb390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x529223
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x28]
push edi
push eax
mov eax, dword [esp + 0x100]
push eax
push ecx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4bb5f2
mov edx, dword [esi + 0x28]
push ebx
push edi
push edx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jne 0x4bb3e8
xor eax, eax
jmp 0x4bb5f1
mov eax, dword [esi + 0x28]
push edi
push eax
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4bb3e1
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov edx, eax
xor eax, eax
test edx, edx
je 0x4bb5f1
mov ecx, 0x12
lea edi, [esp + 0x8c]
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x90]
push ecx
push eax
mov dword [esp + 0x9c], 0x204d454d
mov dword [esp + 0xb0], edx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xc8], eax
call dword [sym.imp.winmm.dll_mmioOpenA]
mov ebx, eax
test ebx, ebx
je 0x4bb3e1
push 1
push 2
lea ecx, [esp + 0x14]
call fcn.004b95c0
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 4]
mov ecx, dword [esi + 0x28]
lea eax, [esp + eax + 0xc]
push ecx
mov byte [eax + 0x30], 0x30
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 4]
push 0x4b7960
push 0x4b7940
lea edx, [esp + 0x18]
lea eax, [esp + eax + 0x18]
push 0x56af44
push edx
mov dword [esp + 0x10c], 0
mov dword [eax + 0x18], 8
call fcn.004b8c20
add esp, 8
mov ecx, eax
call fcn.004b7990
mov ecx, eax
call fcn.004b7990
mov ecx, eax
call fcn.004b9330
mov edi, eax
push 0xa
mov ecx, edi
call fcn.004b94a0
mov ecx, edi
call fcn.004b8650
push 0x4b7920
lea eax, [esp + 0x10]
push 0x56af3c
push eax
call fcn.004b8c20
add esp, 8
mov ecx, eax
call fcn.004b7990
mov eax, dword [esi + 0x24]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4bb504
push eax
lea ecx, [esp + 0x10]
call fcn.004b91c0
jmp 0x4bb528
push 0x27
push eax
lea edx, [esp + 0x14]
push 0x27
push edx
call fcn.004b8e30
add esp, 8
push eax
call fcn.004b8c20
add esp, 8
push eax
call fcn.004b8e30
add esp, 8
mov edi, eax
mov ecx, edi
push 0xa
call fcn.004b94a0
mov ecx, edi
call fcn.004b8650
lea eax, [esp + 0xc]
push 0x56af34
push eax
call fcn.004b8c20
mov eax, dword [esp + 0x108]
mov ecx, eax
shr ecx, 0x10
add esp, 8
test ecx, ecx
jne 0x4bb568
push eax
lea ecx, [esp + 0x10]
call fcn.004b91c0
jmp 0x4bb58c
push 0x27
push eax
lea edx, [esp + 0x14]
push 0x27
push edx
call fcn.004b8e30
add esp, 8
push eax
call fcn.004b8c20
add esp, 8
push eax
call fcn.004b8e30
add esp, 8
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0x10]
call fcn.004bb370
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0xf8], 1
jb 0x4bb5b0
mov eax, dword [eax + 4]
jmp 0x4bb5b3
add eax, 4
push eax
push ebx
mov ecx, esi
call fcn.004b76d0
lea ecx, [esp + 0xd4]
mov esi, eax
call fcn.00478c10
lea ecx, [esp + 0x58]
mov dword [esp + 0xf8], 0xffffffff
call fcn.004b86b0
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], 0x56ae00
call fcn.004e89c4
mov eax, esi
pop ebx
mov ecx, dword [esp + 0xec]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xf0
ret 4
Function at 0x4ccdd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
test eax, eax
jne 0x4ccdfb
push 0x40
push 0x1000
push 0x800
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
pop esi
ret
Function at 0x4d30d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4d30db
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x4d31d3
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x56cc48]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x4d30f6
test edi, edi
je 0x4d31f2
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x56cc48]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x4d31d7
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret
Function at 0x4e8e94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x570088
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e8eea
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x52a984
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e8edd
inc esi
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x4e8eec
xor eax, eax
pop esi
leave
ret 4

Function at 0x4e9580
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x5c65a4]
test eax, eax
je 0x4e9591
mov eax, 0xfffffffb
ret 4
mov eax, dword [0x5c65ac]
test eax, eax
jne 0x4e95b9
push 0
push 0
push 1
push 0
call dword [sym.imp.kernel32.dll_CreateEventA]
test eax, eax
mov dword [0x5c65ac], eax
jne 0x4e95b9
mov eax, 0xfffffffa
ret 4
mov eax, dword [esp + 4]
push 0x5c65a8
push 0
push 0
push 0x4e9370
push 0
push 0
mov dword [0x5c65a0], eax
call dword [sym.imp.kernel32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x5c65a4], eax
dec ecx
and ecx, 0xfffffffa
mov eax, ecx
ret 4

Function at 0x4e96d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5293db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x638
mov eax, dword [0x58f2d4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x634], eax
mov dword [esp], 0x3fc
mov dword [esp + 8], 1
mov byte [esp + 0x234], 0
call fcn.004ea5b0
cmp dword [esp + 0x64c], 0x10
mov dword [esp + 0x640], 0
jl 0x4e978f
lea eax, [esp + 4]
push eax
push 1
push 0
push 0x57010c
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e9785
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x238]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x570100
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e977a
mov edx, dword [esp]
mov byte [esp + edx + 0x234], al
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp]
cmp eax, 0x3fc
jne 0x4e97aa
lea ecx, [esp + 0xc]
mov dword [esp + 0x640], 0xffffffff
call fcn.004ea410
mov eax, 0xfffffff7
jmp 0x4e97e3
push eax
lea ecx, [esp + 0x238]
push ecx
lea ecx, [esp + 0x14]
call fcn.004ea2f0
mov edx, dword [esp + 0x648]
push edx
lea ecx, [esp + 0x10]
call fcn.004ea3d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x640], 0xffffffff
call fcn.004ea410
xor eax, eax
mov ecx, dword [esp + 0x638]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x634]
call fcn.004a5518
add esp, 0x644
ret 8
Function at 0x4e9810
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5293db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x648
mov eax, dword [0x58f2d4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x644], eax
mov dword [esp], 0x3fc
mov dword [esp + 8], 1
mov byte [esp + 0x244], 0
call fcn.004ea5b0
cmp dword [esp + 0x65c], 0x10
mov dword [esp + 0x650], 0
jl 0x4e98cf
lea eax, [esp + 4]
push eax
push 1
push 0
push 0x57010c
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e98c5
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x248]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x570100
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e98ba
mov edx, dword [esp]
mov byte [esp + edx + 0x244], al
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp]
cmp eax, 0x3fc
jne 0x4e98ea
mov dword [esp + 0x650], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004ea410
mov eax, 0xfffffff7
jmp 0x4e993a
push esi
push edi
push eax
lea ecx, [esp + 0x250]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004ea2f0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
call fcn.004ea3d0
mov edi, dword [esp + 0x660]
mov ecx, 4
lea esi, [esp + 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x650], 0xffffffff
jne 0x4e98de
call fcn.004ea410
xor eax, eax
mov ecx, dword [esp + 0x648]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x644]
call fcn.004a5518
add esp, 0x654
ret 8
Function at 0x4e9e50
Capabilities:
Clear file content
Delete file
Write file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x58f2d4]
mov dword [esp + 0x14], eax
mov eax, dword [0x5c65b0]
test eax, eax
je 0x4ea05e
mov eax, dword [0x5c65b4]
test eax, eax
je 0x4ea05e
mov eax, dword [0x5c65b8]
test eax, eax
je 0x4ea05e
mov eax, dword [0x5c65bc]
test eax, eax
je 0x4ea05e
mov eax, dword [0x5c65c0]
test eax, eax
push 0x10
jne 0x4e9ea7
lea eax, [esp + 8]
push eax
call fcn.004e96d0
jmp 0x4e9eae
lea ecx, [esp + 8]
push ecx
call eax
cmp eax, 0xfffffff7
jne 0x4e9ec2
mov ecx, dword [esp + 0x14]
call fcn.004a5518
add esp, 0x18
ret 4
test eax, eax
je 0x4e9eda
mov eax, 0xfffffffb
mov ecx, dword [esp + 0x14]
call fcn.004a5518
add esp, 0x18
ret 4
push esi
mov esi, dword [0x5c65b8]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004e9670
test eax, eax
jne 0x4e9f98
mov ecx, esi
call fcn.004ea980
test eax, eax
jne 0x4e9f98
mov eax, dword [0x5c65b8]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x4e9f15
inc eax
test eax, eax
jg 0x4e9f28
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x14]
call fcn.004a5518
add esp, 0x18
ret 4
inc eax
push eax
call fcn.004fb3b1
mov ecx, dword [0x5c65b8]
add esp, 4
mov esi, eax
push esi
call fcn.004e96a0
test eax, eax
jne 0x4e9f98
mov ecx, dword [esp + 0x20]
push edi
push esi
push ecx
mov ecx, dword [0x5c65b4]
call fcn.004eb190
push esi
mov edi, eax
call fcn.004fb3dc
add esp, 4
test edi, edi
jne 0x4e9f7b
pop edi
mov eax, 0xfffffffb
pop esi
mov ecx, dword [esp + 0x14]
call fcn.004a5518
add esp, 0x18
ret 4
mov ecx, dword [0x5c65b4]
push ebx
push 0
push 0
call fcn.004eb5f0
mov ebx, eax
test ebx, ebx
jg 0x4e9fa8
pop ebx
mov eax, 0xfffffffa
pop edi
pop esi
mov ecx, dword [esp + 0x14]
call fcn.004a5518
add esp, 0x18
ret 4
mov edx, dword [0x5c65b0]
mov eax, dword [edx + 4]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4ea01d
push ebx
call fcn.004fb3b1
mov ecx, dword [0x5c65b4]
add esp, 4
mov esi, eax
push ebx
push esi
call fcn.004eb5f0
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
push edi
jne 0x4ea034
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [0x5c65b0]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
push esi
call fcn.004fb3dc
add esp, 4
pop ebx
pop edi
mov eax, 0xfffffffc
pop esi
mov ecx, dword [esp + 0x14]
call fcn.004a5518
add esp, 0x18
ret 4
call dword [sym.imp.kernel32.dll_SetEndOfFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push esi
call fcn.004fb3dc
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
call fcn.004a5518
add esp, 0x18
ret 4
mov ecx, dword [esp + 0x14]
mov eax, 0xfffffff8
call fcn.004a5518
add esp, 0x18
ret 4
Function at 0x4f17dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x4f1823
cmp edx, 0x10
jl 0x4f180f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x4f17fc
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x4f1823
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x4f181b
and edx, 3
cmp edx, 3
jne 0x4f1837
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x4f183c
cmp edx, 2
jne 0x4f1848
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x4f184d
cmp edx, 1
jne 0x4f1853
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4f2480
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, 0x8000
xor cx, cx
push edi
mov edi, dword [esp + 0xc]
mov word [edi + 0x3c], ax
mov esi, dword [edi + 0x14]
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], eax
movzx eax, cx
inc cx
xor edx, edx
mov dl, byte [eax + esi + 0x8000]
mov eax, dword [edi + 0x20]
shl eax, 5
xor edx, eax
and edx, 0x7fff
cmp cx, 2
mov dword [edi + 0x20], edx
jb 0x4f249f
pop edi
pop esi
ret
Function at 0x4f7bca
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x52871d
call fcn.004a5528
sub esp, 0x9c
mov eax, dword [0x58f2d4]
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa8], esi
call fcn.004faabe
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CFileDialog.0
call fcn.00401a40
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
jne 0x4f7c5b
mov edi, 0x94
push edi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.004a5920
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], edi
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 2
jne 0x4f7c54
cmp dword [ebp - 0xa0], 5
mov dword [ebp + 0x20], 0x58
jae 0x4f7c5b
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.004a2ea9
cmp eax, ebx
pop ecx
mov dword [esi + 0x70], eax
jne 0x4f7c70
call fcn.004f794a
push dword [ebp + 0x20]
push ebx
push eax
call fcn.004a5920
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x74], eax
add esp, 0xc
neg eax
sbb eax, eax
add eax, 0x7005
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x1c0], ebx
lea ecx, [esi + 0x7c]
mov byte [ecx], bl
lea edi, [esi + 0xbc]
mov byte [edi], bl
mov dword [eax], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x70]
mov dword [eax + 0x20], 0x104
mov eax, dword [esi + 0x70]
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x70]
push 0x40
pop ecx
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x70]
or edx, 0x80020
or dword [eax + 0x34], edx
test byte [ebp + 0x14], cl
je 0x4f7ced
mov eax, dword [esi + 0x70]
and byte [eax + 0x36], 0x7f
call fcn.005157bf
cmp dword [ebp + 0x10], ebx
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x44], 0x4f7f8b
je 0x4f7d19
push 0x104
push dword [ebp + 0x10]
push edi
call dword [sym.imp.kernel32.dll_lstrcpyn]
cmp dword [ebp + 0x18], ebx
je 0x4f7d4f
push dword [ebp + 0x18]
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.00402460
push ebx
mov ecx, edi
call fcn.00401a80
jmp 0x4f7d38
mov byte [eax], bl
inc eax
push 0x7c
push eax
call fcn.004a2bdc
cmp eax, ebx
pop ecx
pop ecx
jne 0x4f7d35
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x78]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004a5518
leave
ret 0x1c
Function at 0x4fae6b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov dword [ebp - 4], eax
je 0x4faea2
call fcn.005157bf
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x54]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4faeb3
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_LockResource_1]
mov esi, eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x4faeec
cmp word [esi + 2], 0xffff
mov ecx, dword [esi]
jne 0x4faed1
mov ecx, dword [esi + 0xc]
mov ax, word [esi + 0x12]
mov si, word [esi + 0x14]
jmp 0x4faed9
mov ax, word [esi + 0xa]
mov si, word [esi + 0xc]
test cx, 0x1801
jne 0x4faeea
test ax, ax
jne 0x4faeea
test si, si
je 0x4faeec
xor ebx, ebx
cmp dword [edi + 0x54], 0
je 0x4faefb
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4fb14d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x527dd5
call fcn.004a5528
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.005157bf
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x4fb19b
call fcn.005157bf
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4fb1ac
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_LockResource_1]
mov ebx, eax
test ebx, ebx
jne 0x4fb1b8
or eax, 0xffffffff
jmp 0x4fb2bb
mov ecx, esi
call fcn.004fac8d
mov dword [ebp - 0x14], eax
call fcn.004fe7f4
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x4fb1fb
call dword [sym.imp.user32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x4fb1fb
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_IsWindowEnabled]
test eax, eax
je 0x4fb1fb
push 0
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.004ffdec
push dword [ebp - 0x14]
call fcn.004fe74c
push edi
push eax
push ebx
mov ecx, esi
call fcn.004faf40
xor ebx, ebx
cmp eax, ebx
je 0x4fb26f
test byte [esi + 0x38], 0x10
je 0x4fb23d
push 4
pop edi
mov ecx, esi
call fcn.004fc648
test ah, 1
je 0x4fb235
push 5
pop edi
push edi
mov ecx, esi
call fcn.004fe1f0
cmp dword [esi + 0x1c], ebx
je 0x4fb26f
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.004fc8be
jmp 0x4fb26f
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x4fb283
push 1
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x4fb29c
call dword [sym.imp.user32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4fb29c
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004facc7
cmp dword [esi + 0x54], ebx
je 0x4fb2b8
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret