joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47df4c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47dfc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x989a08]
cmp byte [eax], 0
je 0x47df7c
push esi
push ebx
call sub.kernel32.dll_MoveFileW
mov ebx, eax
jmp 0x47dfa9
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404eac
mov eax, dword [ebp - 4]
call fcn.0040513c
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404eac
mov eax, dword [ebp - 8]
call fcn.0040513c
push eax
call sub.kernel32.dll_MoveFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dfcb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca0
ret

Function at 0x47dfd4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47e051
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x989a08]
cmp byte [eax], 0
je 0x47e008
push edi
push esi
push ebx
call sub.kernel32.dll_CopyFileW
mov ebx, eax
jmp 0x47e036
push edi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404eac
mov eax, dword [ebp - 4]
call fcn.0040513c
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404eac
mov eax, dword [ebp - 8]
call fcn.0040513c
push eax
call sub.kernel32.dll_CopyFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e058
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca0
ret

Function at 0x47e4ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00408a10
cmp ax, 0xffff
jne 0x47e4cd
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x47e54e
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x47e54e
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x47e514
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x47e507
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x47e54e
cmp dword [ebp + 8], 0
jle 0x47e54e
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00437efc
mov esi, eax
test esi, esi
jle 0x47e545
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408a24
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47f360
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x47f3c4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404ef4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040b934
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f3cb
lea eax, [ebp - 0xc]
call fcn.00404c7c
ret

Function at 0x47f468
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x47f4c4
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47f493
call fcn.00411854
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402d50
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47f4c4
call fcn.00411854
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x48024c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4803b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404d14
mov eax, dword [ebp - 0x10]
call fcn.0047fe9c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x48029e
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.004051dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00480688
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x480373
xor eax, eax
push ebp
push 0x48036c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00480048
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004803e4
test al, al
je 0x48034a
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00404d6c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x48034a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040513c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x480344
mov eax, dword [ebp - 0x14]
call fcn.0040513c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00404e7c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0048024c
dec ebx
cmp ebx, 0xffffffff
jne 0x4802fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480373
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00480048
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.0040513c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00480034
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4803bc
lea eax, [ebp - 0x3c]
call fcn.00404c7c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404ca0
ret

Function at 0x4803e4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.0040357c
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x98ab70]
cmp byte [edx + 0xc], 0
je 0x480448
mov edx, dword [0x98ab48]
cmp dword [edx], 2
jne 0x480448
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x4805ac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0047feb0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040513c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x48060a
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x98a1dc]
mov dl, 1
mov eax, dword [0x47fd3c]
call fcn.004103e0
call fcn.004045f8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x480614
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040513c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x48066c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x98ab84]
mov dl, 1
mov eax, dword [0x47fd3c]
call fcn.004103e0
call fcn.004045f8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047fee0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x494d98
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x494e70
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x98e1ac], 0
jne 0x494e54
lea eax, [ebp - 4]
mov edx, 0x494e88
call fcn.00404d14
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040513c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x494e54
mov eax, ebx
call fcn.00402ab4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x494e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x494e37
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x494e98
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x494e37
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x98e1ac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494e54
mov eax, dword [ebp - 0xc]
call fcn.00402ad4
ret
mov ebx, dword [0x98e1ac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494e77
lea eax, [ebp - 4]
call fcn.00404c7c
ret
Function at 0x4b12d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4b1458
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x4b143d
cmp byte [ebx + 0x268], 0
je 0x4b143d
mov eax, dword [ebp - 4]
call fcn.004b5800
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x4b1436
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x4b137a
dec ax
je 0x4b1350
sub ax, 0x12
jne 0x4b1394
call fcn.004046a4
jmp 0x4b143d
cmp byte [ebx + 0x269], 0
je 0x4b141c
mov eax, ebx
call fcn.00443df4
test al, al
je 0x4b141c
xor edx, edx
mov eax, ebx
call fcn.00443e18
jmp 0x4b141c
mov eax, dword [esi]
call fcn.00405620
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405808
jmp 0x4b141c
cmp byte [ebx + 0x269], 0
je 0x4b13b1
mov eax, ebx
call fcn.00443df4
test al, al
jne 0x4b13b1
mov dl, 1
mov eax, ebx
call fcn.00443e18
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x4b13c9
mov eax, esi
call fcn.004053b0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.004054d8
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.0040568c
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.004b1124
test al, al
je 0x4b141c
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.004054d8
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.0040562c
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b143d
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.004b5834
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b145f
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004053c8
ret

Function at 0x4b8784
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x98ab48]
cmp dword [eax], 1
jne 0x4b879a
mov eax, ebx
call fcn.004852dc
pop ebx
ret
mov eax, ebx
call fcn.00405610
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4b87b0
test al, 0x10
je 0x4b87b4
xor eax, eax
jmp 0x4b87b6
mov al, 1
pop ebx
ret
Function at 0x4c7dec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x4c7e1c
mov eax, ebx
call fcn.004c8910
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x4c7e15
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x4c7e94
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x4c7e86
mov edx, dword [ebx + 8]
test edx, edx
je 0x4c7e42
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c7e54
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c7e86
mov edx, dword [ebx + 8]
test edx, edx
je 0x4c7e34
cmp eax, 3
je 0x4c7e68
dec eax
jne 0x4c7e34
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x4c7e34
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c7e34
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x4c7eb4
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x4c7eb4
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c7ec0
pop ebx
ret
Function at 0x4db1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x4db1db
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x4db25c
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.004d9764
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x4db229
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4db22b
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4db212
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x4db251
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4db253
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4db23a
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x4db2be
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.004dae64
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4db2a9
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4db2be
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4db1af
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4e0120
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x96a134
test edx, edx
jne 0x4e013f
xor eax, eax
jmp 0x4e025d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4e015c
push esi
push edx
push eax
call fcn.004e0264
add esp, 0xc
jmp 0x4e025d
push esi
push edx
push eax
call fcn.004e0524
add esp, 0xc
jmp 0x4e025d
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f1188
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f1318
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4f1330
call fcn.004f0468
cmp dword [esi], 2
jl 0x4f11ce
mov eax, 0x4f1350
call fcn.004f0468
mov bl, 1
jmp 0x4f12f7
mov eax, dword [esi + 0x184]
mov eax, dword [eax]
test eax, eax
je 0x4f1200
mov dword [esi + 4], eax
mov eax, dword [esi + 0x184]
mov eax, dword [eax + 4]
mov dword [esi + 8], eax
mov bl, 1
mov dword [esi], 2
mov eax, 0x4f1350
call fcn.004f0468
jmp 0x4f12f7
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrlenA_1
test eax, eax
je 0x4f123c
cmp byte [ebp + eax - 0x105], 0x3a
je 0x4f123c
push 0x4f1378
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x96c52c]
call fcn.0040513c
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
xor eax, eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404ef4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
call fcn.00404d14
mov eax, dword [ebp - 4]
call fcn.00642864
test al, al
je 0x4f1298
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.004121d8
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
cmp dword [esi + 4], 0
je 0x4f12e0
mov eax, 0x4f1384
call fcn.004f0468
mov eax, dword [0x96c530]
call fcn.0040513c
push eax
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi + 8], eax
cmp dword [esi + 8], 0
je 0x4f12d2
mov dword [esi], 2
jmp 0x4f12e0
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi], 2
setge bl
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x184]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [eax + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f131f
lea eax, [ebp - 0x108]
call fcn.00404c7c
lea eax, [ebp - 4]
call fcn.00404c7c
ret
Function at 0x4fdc54
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4fdc82
mov eax, ebx
call fcn.004fe70c
cmp dword [ebx + 0x3c], 0
je 0x4fdc7b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4fdcf3
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4fdce5
cmp dword [ebx + 8], 0
je 0x4fdca4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4fdcb6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4fdce5
cmp dword [ebx + 8], 0
je 0x4fdc97
cmp eax, 3
je 0x4fdcc9
dec eax
jne 0x4fdc97
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4fdc97
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4fdc97
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4fdd11
cmp dword [ebx + 0x10], 0xcc
je 0x4fdd11
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004fdd1c
pop ebx
ret

Function at 0x5188dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x51892d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x98ab48]
cmp dword [eax], 1
jne 0x518907
mov eax, ebx
call fcn.004852dc
mov ebx, eax
jmp 0x518923
mov eax, ebx
call fcn.00405610
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x51891d
test al, 0x10
je 0x518921
xor ebx, ebx
jmp 0x518923
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x518939
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x522634
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x522702
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5226bb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x52268e
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00405518
jmp 0x522696
mov eax, dword [ebp - 8]
call fcn.004053b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5226c2
cmp dword [ebp - 0xc], 0
je 0x5226b2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x531c1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x9759a4
test edx, edx
jne 0x531c2c
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x531cf4
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ecx, 8
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
cmp ecx, 8
mov eax, esi
jae 0x531c38
test ecx, ecx
je 0x531d11
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
dec ecx
mov eax, esi
jne 0x531cf8
xor eax, 0xffffffff
pop esi
pop ebx
ret