joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e7b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x43e7e9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403db4
jmp 0x43e7f3
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403d20
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x43f648
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x43f680
mov eax, esi
call fcn.0042b590
test al, al
je 0x43f680
mov eax, dword [ebx + 0x74]
call fcn.0042b300
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43f680
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042b300
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x440200
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0043fd98
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404110
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x44025e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5299b0]
mov dl, 1
mov eax, dword [0x43fc90]
call fcn.0040bf04
call fcn.00403718
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x440268
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404110
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4402c0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x529bf0]
mov dl, 1
mov eax, dword [0x43fc90]
call fcn.0040bf04
call fcn.00403718
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0043fdc8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44bc30
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x44bc84
mov eax, dword [0x529a34]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x44bc5c
push ebx
push 0x44bc8c
call fcn.00436ec8
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x44bc80
mov ecx, dword [0x529778]
mov dl, 1
mov eax, dword [0x407cf0]
call fcn.0040bec8
call fcn.00403718
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret
Function at 0x44bcac
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044bc30
xor edx, edx
push ebp
push 0x44bd4e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x44bd21
mov edx, ebx
mov eax, dword [0x4195c4]
call fcn.0041d740
test al, al
je 0x44bd11
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041d650
call fcn.004037b8
jmp 0x44bd55
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x44bcdc
mov ecx, dword [0x5297f8]
mov dl, 1
mov eax, dword [0x407cf0]
call fcn.0040bec8
call fcn.00403718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bd55
mov eax, dword [ebp - 4]
call fcn.0044bc04
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x44bd5c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044bc30
xor eax, eax
push ebp
push 0x44bdb4
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bdbb
mov eax, dword [ebp - 4]
call fcn.0044bc04
ret

Function at 0x44be10
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044bc30
xor eax, eax
push ebp
push 0x44be85
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044bbe8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041d714
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x44be6f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44be8c
mov eax, dword [ebp - 4]
call fcn.0044bc04
ret
Function at 0x44be94
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044bc30
xor eax, eax
push ebp
push 0x44bf09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044bbe8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x44bef3
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf10
mov eax, dword [ebp - 4]
call fcn.0044bc04
ret

Function at 0x44bf64
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044bc30
xor eax, eax
push ebp
push 0x44bfa8
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bfaf
mov eax, dword [ebp - 4]
call fcn.0044bc04
ret
Function at 0x466cf8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov edx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
mov ecx, dword [edx]
mov eax, ecx
movzx eax, word [eax]
cmp eax, esi
jbe 0x466d1f
mov eax, ecx
movzx esi, word [eax + 2]
xor esi, 1
mov eax, dword [eax + 8]
mov dword [edx], eax
jmp 0x466d2d
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
movzx esi, word [eax + 2]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov edx, dword [ebx + 8]
test edx, edx
jne 0x466dfc
mov ecx, dword [ebx + 0x20]
test ecx, ecx
jne 0x466def
mov eax, dword [ebx + 0x18]
test byte [eax + 8], 7
jne 0x466d9c
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x466d6f
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x466d6f
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x466d9f
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x466d88
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.0046dd70
mov edi, eax
jmp 0x466d9f
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x466d9f
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x466db0
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x466de1
cmp edi, 0x8f
jle 0x466dd3
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x466dfc
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x466dfc
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x466dfc
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x466d2d
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x466e18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov eax, edx
movzx ecx, word [eax]
mov eax, dword [ebx + 4]
cmp ecx, eax
ja 0x466e48
mov eax, edx
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 8]
xor esi, 1
mov dword [edx], eax
jmp 0x466e5f
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
movzx edx, word [eax]
mov dword [ebx + 4], edx
movzx esi, word [eax + 2]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 4]
mov dword [edx], eax
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x466f2e
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x466f21
mov edx, dword [ebx + 0x18]
test byte [edx + 8], 7
jne 0x466ece
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x40]
test eax, eax
jl 0x466ea1
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x40]
mov eax, dword [ebp + 0x3c]
cmp ecx, eax
jg 0x466ea1
mov edx, dword [ebx + 0x18]
or dword [edx + 8], 4
or edi, 0xffffffff
jmp 0x466ed1
mov eax, dword [ebx + 0x18]
dec dword [eax + 0x1c]
jns 0x466eba
mov edx, 1
mov eax, dword [ebx + 0x18]
call fcn.0046dd70
mov edi, eax
jmp 0x466ed1
mov eax, dword [ebx + 0x18]
inc dword [eax + 0x3c]
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx + 0x18]
inc dword [edx + 0x18]
movzx edi, byte [ecx]
jmp 0x466ed1
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x466ee2
mov dword [ebx + 0x20], 1
mov edi, 0xff
mov al, byte [ebx + 0x1c]
mov edx, edi
mov byte [ebx + 0x1c], dl
cmp al, 0xff
jne 0x466f13
cmp edi, 0x8f
jle 0x466f05
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
jmp 0x466f2e
shl edi, 9
add dword [ebx], edi
mov dword [ebx + 8], 7
jmp 0x466f2e
shl edi, 8
add dword [ebx], edi
mov dword [ebx + 8], 8
jmp 0x466f2e
add dword [ebx], 0xff00
mov dword [ebx + 8], 8
shl dword [ebx + 4], 1
shl dword [ebx], 1
dec dword [ebx + 8]
test byte [ebx + 5], 0x80
je 0x466e5f
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47c48c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47c4b9
mov eax, ebx
call fcn.0047aeec
cmp byte [ebx + 0x40], 0
je 0x47c4b2
mov dword [ebx + 0x14], 0xcf
mov al, 1
pop esi
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x14]
cmp eax, 0xcb
jne 0x47c526
mov eax, dword [ebx + 0x184]
cmp byte [eax + 0x10], 0
je 0x47c51e
mov eax, dword [ebx + 8]
test eax, eax
je 0x47c4dc
mov esi, eax
mov eax, ebx
call dword [esi]
mov esi, dword [ebx + 0x184]
mov eax, ebx
call dword [esi]
test eax, eax
jne 0x47c4ef
xor eax, eax
pop esi
pop ebx
ret
cmp eax, 2
je 0x47c51e
cmp dword [ebx + 8], 0
je 0x47c4cf
cmp eax, 3
je 0x47c502
dec eax
jne 0x47c4cf
mov eax, dword [ebx + 8]
inc dword [eax + 4]
mov eax, dword [ebx + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x47c4cf
mov edx, dword [ebx + 0x110]
add dword [eax + 8], edx
jmp 0x47c4cf
mov eax, dword [ebx + 0x70]
mov dword [ebx + 0x78], eax
jmp 0x47c538
cmp eax, 0xcc
je 0x47c538
mov ecx, eax
mov dl, 0x14
mov eax, ebx
call fcn.0047117c
mov eax, ebx
call fcn.0047c544
pop esi
pop ebx
ret
Function at 0x4860f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x48611e
cmp dword [ebx + 0x64], 0
jne 0x48611e
cmp dword [ebx + 0x6c], 0
jne 0x48611e
mov edi, esi
jmp 0x4861a5
cmp edi, 0xffffffff
jne 0x486126
dec edi
jmp 0x4861a5
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4861a5
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004854f0
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x486173
mov cx, word [esp]
sub cx, si
jmp 0x486175
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48615c
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48619b
mov cx, word [esp]
sub cx, si
jmp 0x48619d
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x486184
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x486202
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.00485e90
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4861ed
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x486202
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4860fe
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x497548
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497620
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x531f74], 0
jne 0x497604
lea eax, [ebp - 4]
mov edx, 0x497638
call fcn.00403d64
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404110
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x497604
mov eax, ebx
call fcn.00402714
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4975fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4975e7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x497648
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4975e7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x531f74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497604
mov eax, dword [ebp - 0xc]
call fcn.0040272c
ret
mov ebx, dword [0x531f74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497627
lea eax, [ebp - 4]
call fcn.00403ccc
ret

Function at 0x4a5084
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x531f98], 0
jne 0x4a50a7
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4a5008
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x531f98], eax
ret

Function at 0x4a5a64
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x84], 1
sete byte [0x527344]
cmp dword [ebp - 0x84], 1
jne 0x4a5aa5
cmp word [ebp - 0x88], 0x3e8
jae 0x4a5aa9
xor eax, eax
jmp 0x4a5aab
mov al, 1
mov byte [0x527360], al
cmp dword [ebp - 0x84], 2
sete byte [0x527348]
cmp dword [ebp - 0x84], 2
jne 0x4a5ad0
cmp dword [ebp - 0x90], 5
jae 0x4a5ad4
xor eax, eax
jmp 0x4a5ad6
mov al, 1
mov byte [0x52734c], al
mov al, byte [0x52734c]
mov byte [0x527354], al
cmp byte [0x527348], 0
jne 0x4a5afb
cmp byte [0x527354], 0
jne 0x4a5afb
xor eax, eax
jmp 0x4a5afd
mov al, 1
mov byte [0x527350], al
cmp dword [ebp - 0x84], 1
jne 0x4a5b14
cmp dword [ebp - 0x8c], 0
ja 0x4a5b18
xor eax, eax
jmp 0x4a5b1a
mov al, 1
mov byte [0x527364], al
mov al, byte [0x527364]
mov byte [0x52736c], al
cmp dword [ebp - 0x84], 1
jne 0x4a5b3b
cmp dword [ebp - 0x8c], 0x5a
jae 0x4a5b3f
xor eax, eax
jmp 0x4a5b41
mov al, 1
mov byte [0x527368], al
cmp dword [ebp - 0x84], 2
jne 0x4a5b61
cmp dword [ebp - 0x90], 5
jne 0x4a5b61
cmp dword [ebp - 0x8c], 1
je 0x4a5b65
xor eax, eax
jmp 0x4a5b67
mov al, 1
mov byte [0x527358], al
cmp dword [ebp - 0x84], 2
jne 0x4a5b87
cmp dword [ebp - 0x90], 5
jb 0x4a5b87
cmp dword [ebp - 0x8c], 1
jae 0x4a5b8b
xor eax, eax
jmp 0x4a5b8d
mov al, 1
mov byte [0x52735c], al
mov esp, ebp
pop ebp
ret
Function at 0x4b7ae4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x531ff0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4b7b06
shr eax, 1
xor eax, 0xedb88320
jmp 0x4b7b08
shr eax, 1
dec edx
jne 0x4b7af4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4b7aed
mov byte [0x5323f0], 1
pop esi
pop ebx
ret

Function at 0x4b7b24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5323f0], 0
jne 0x4b7b3b
call fcn.004b7ae4
mov eax, edi
dec eax
test eax, eax
jl 0x4b7b64
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x531ff0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4b7b45
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4ba0d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4ba105
dec al
je 0x4ba146
dec al
je 0x4ba18a
dec al
je 0x4ba1f5
jmp 0x4ba27f
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4ba27f
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ba115
jmp 0x4ba27f
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ba27f
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ba156
jmp 0x4ba27f
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ba27f
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4ba1b8
xor ebp, ebp
jmp 0x4ba1c9
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4ba1d2
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ba19a
jmp 0x4ba27f
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ba27f
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4ba24d
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004b7b6c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ba209
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fc1dc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
test dl, dl
je 0x4fc1f1
add esp, 0xfffffff0
call fcn.004032c0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00402f50
xor ecx, ecx
mov dl, 1
mov eax, dword [0x424198]
call fcn.0042d678
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x424198]
call fcn.0042d678
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
push 0x31
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0042d94c
push 0x32
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0042d990
push 0xb
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0042d94c
push 0xc
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0042d990
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
movzx eax, byte [eax + 0x35]
mov eax, dword [eax*4 + 0x529560]
mov dword [ebp - 0x10], eax
mov eax, dword [0x529b40]
cmp byte [eax], 0
je 0x4fc29d
or dword [ebp - 0x10], 0x20
jmp 0x4fc2a4
or dword [ebp - 0x10], 0xfe
push 0x10
push 0x10
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x28]
push eax
call sub.comctl32.dll_ImageList_Create
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0042d9d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
movzx eax, byte [eax + 0x35]
mov eax, dword [eax*4 + 0x529560]
mov dword [ebp - 0x10], eax
mov eax, dword [0x529b40]
cmp byte [eax], 0
je 0x4fc2f6
or dword [ebp - 0x10], 0x20
jmp 0x4fc2fd
or dword [ebp - 0x10], 0xfe
push 0x10
push 0x10
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x28]
push eax
call sub.comctl32.dll_ImageList_Create
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0042d9d4
mov dl, 1
mov eax, dword [0x4b0194]
call fcn.004b0304
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x1c], edx
mov dword [eax + 0x18], 0x4fc440
mov dword [ebp - 0xc], 0x111
mov eax, dword [ebp - 0xc]
push eax
push 0x160
lea eax, [ebp - 0x170]
push eax
push 0
push 0x4fc3d0
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x170]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov dword [ebp - 0xc], 0x110
mov eax, dword [ebp - 0xc]
push eax
push 0x160
lea eax, [ebp - 0x170]
push eax
push 0
push 0x4fc3d0
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x170]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4fc3c6
call fcn.00403318
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret