joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47af1f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov ecx, 0x45
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47af2d
push ebx
push esi
push edi
push 0x4b47e4
mov edi, dword [ebp + 8]
add edi, 0x3478
push edi
lea edi, [ebp - 0x104]
push edi
call fcn.00401c00
add esp, 0xc
mov edi, dword [ebp + 8]
add edi, 0x3578
push edi
lea edi, [ebp - 0x104]
push edi
call fcn.0047aeb6
add esp, 8
push 0x5437e0
lea edi, [ebp - 0x104]
push edi
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x47b13a
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0x108], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
cmp dword [ebp - 0x108], 0
je 0x47b12d
mov edi, dword [ebp + 8]
mov dword [edi + 0x3584], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x3580], 0
je 0x47aff0
mov edi, dword [ebp + 8]
push dword [edi + 0x3580]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp - 0x108]
add edi, 1
push edi
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov esi, dword [ebp + 8]
mov dword [esi + 0x3580], eax
cmp eax, 0
je 0x47b12d
push dword [ebp - 4]
push dword [ebp - 0x108]
push 1
mov edi, dword [ebp + 8]
push dword [edi + 0x3580]
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp eax, dword [ebp - 0x108]
je 0x47b057
mov edi, dword [ebp + 8]
push dword [edi + 0x3580]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x3580], 0
jmp 0x47b12d
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x3580]
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x108]
mov esi, dword [ebp - 0x10c]
mov byte [esi + edi], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x3584], 0
jmp 0x47b11e
mov edi, dword [ebp - 0x10c]
mov dword [ebp - 0x110], edi
jmp 0x47b09d
add dword [ebp - 0x10c], 1
mov edi, dword [ebp - 0x10c]
movsx ebx, byte [edi]
cmp ebx, 0
je 0x47b0b0
cmp ebx, 0xa
jne 0x47b096
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0xa
jne 0x47b0cf
mov edi, dword [ebp - 0x10c]
mov esi, edi
add esi, 1
mov dword [ebp - 0x10c], esi
mov byte [edi], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x3584], 0x1f3
jge 0x47b11e
mov edi, dword [ebp + 8]
mov eax, 0xc
mul dword [edi + 0x3584]
mov dword [ebp - 0x114], eax
mov esi, dword [ebp - 0x114]
lea edi, [esi + edi + 0x3588]
push edi
push dword [ebp - 0x110]
call fcn.0047ac0c
add esp, 8
cmp eax, 0
je 0x47b11e
mov edi, dword [ebp + 8]
add edi, 0x3584
inc dword [edi]
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0
jne 0x47b088
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
jmp 0x47b178
mov edi, dword [ebp + 8]
cmp dword [edi + 0x3580], 0
je 0x47b16e
mov edi, dword [ebp + 8]
push dword [edi + 0x3580]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x3580], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x3584], 0
mov edi, dword [ebp + 8]
mov byte [edi + 0x3478], 0
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x47b197
push 0
mov edi, dword [ebp + 8]
push dword [edi + 0x3584]
push 0x1799
push dword [edi]
call sub.USER32.DLL_SetDlgItemInt
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47eb00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 6
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47eb0b
push esi
push edi
push 0x543ef7
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
jne 0x47eb39
mov eax, 0
jmp 0x47ec3b
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
push dword [ebp - 4]
push 0xe
push 1
lea edi, [ebp - 0x16]
push edi
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp word [ebp - 0x16], 0x4d42
jne 0x47eb84
mov edi, dword [ebp - 8]
cmp dword [ebp - 0x14], edi
je 0x47eb99
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov eax, 0
jmp 0x47ec3b
sub dword [ebp - 8], 0xe
push dword [ebp - 8]
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0
jne 0x47ebc3
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov eax, 0
jmp 0x47ec3b
push dword [ebp - 4]
push dword [ebp - 8]
push 1
mov edi, dword [ebp + 8]
push dword [edi]
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp eax, dword [ebp - 8]
je 0x47ebfa
push dword [ebp + 8]
call fcn.0047e84c
add esp, 4
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov eax, 0
jmp 0x47ec3b
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
push dword [ebp + 8]
call fcn.0047e9f6
add esp, 4
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x10]
movzx edi, word [edi + 0xe]
cmp edi, 8
je 0x47ec36
cmp edi, 0x18
je 0x47ec36
push dword [ebp + 8]
call fcn.0047e84c
add esp, 4
mov eax, 0
jmp 0x47ec3b
mov eax, 1
pop edi
pop esi
leave
ret

Function at 0x47f1d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47f1de
push edi
mov dword [ebp - 4], 0
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x47f247
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, dword [ebp + 0xc]
jne 0x47f231
push dword [ebp - 8]
call sub.KERNEL32.dll_SetEndOfFile
mov dword [ebp - 4], eax
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 4], 0
jne 0x47f247
push dword [ebp + 8]
call sub.KERNEL32.dll_DeleteFileA
movzx eax, word [ebp - 4]
pop edi
leave
ret
Function at 0x47f24e
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47f259
push edi
mov word [ebp - 0xa], 0
mov dword [0x50be20], 0
mov dword [0x50be24], 0
mov dword [0x4becc4], 0
push dword [ebp + 8]
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x47f2b5
mov edi, dword [ebp + 0xc]
shl edi, 0xa
shl edi, 0xa
mov dword [ebp - 4], edi
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0047f1d4
add esp, 8
mov edi, eax
mov word [ebp - 0xa], di
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x47f2de
mov eax, 0
jmp 0x47f3df
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x50be20], eax
cmp eax, 0
jne 0x47f311
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, 0
jmp 0x47f3df
mov edi, dword [ebp - 8]
mov dword [0x50be24], edi
mov edi, dword [ebp - 4]
mov dword [0x4becc4], edi
mov edi, dword [0x4becc4]
shr edi, 0xc
mov word [0x4be4b8], di
cmp word [ebp - 0xa], 0
je 0x47f3c0
movzx edi, word [0x4be4b8]
sub edi, 0x100
movzx edi, di
push edi
push 0x100
call fcn.0047f502
add esp, 8
mov dword [ebp - 0x10], 0xf5000
push 0x2e5d1
push 0x543f00
lea edi, [ebp - 0x10]
push edi
mov edi, dword [0x50be20]
add edi, 0x100000
push edi
call fcn.0048c9d0
add esp, 0x10
push 0
push 0
push 0x100000
push dword [ebp - 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0x100000
jne 0x47f3da
push 0
lea edi, [ebp - 0x10]
push edi
push 0xf5000
mov edi, dword [0x50be20]
add edi, 0x100000
push edi
push dword [ebp - 8]
call sub.KERNEL32.dll_WriteFile
jmp 0x47f3da
push 0
lea edi, [ebp - 0x10]
push edi
push dword [ebp - 4]
push dword [0x50be20]
push dword [0x50be24]
call sub.KERNEL32.dll_ReadFile
mov eax, 1
pop edi
leave
ret

Function at 0x47f3e2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00491c48
mov ecx, 0x402
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47f3f4
push edi
mov edi, dword [ebp + 8]
mov word [ebp + 8], di
movzx edi, word [ebp + 8]
shl edi, 0xc
mov dword [ebp - 4], edi
cmp dword [0x50be20], 0
je 0x47f435
push 0x1000
push 0xff
mov edi, dword [ebp - 4]
add edi, dword [0x50be20]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
cmp dword [0x50be24], 0
je 0x47f48e
push 0
push 0
push dword [ebp - 4]
push dword [0x50be24]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, dword [ebp - 4]
jne 0x47f48e
push 0x1000
push 0xff
lea edi, [ebp - 0x1004]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
push 0
lea edi, [ebp - 0x1008]
push edi
push 0x1000
lea edi, [ebp - 0x1004]
push edi
push dword [0x50be24]
call sub.KERNEL32.dll_WriteFile
pop edi
leave
ret
Function at 0x47f61f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 1
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47f628
push edi
cmp dword [0x50be20], 0
je 0x47f64d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
mov edi, dword [0x50be20]
sub dword [ebp + 8], edi
cmp dword [0x50be24], 0
je 0x47f66d
mov edi, dword [ebp + 8]
add edi, dword [ebp + 0x10]
cmp edi, dword [0x4becc4]
jbe 0x47f674
mov eax, 0
jmp 0x47f6c2
push 0
push 0
push dword [ebp + 8]
push dword [0x50be24]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, dword [ebp + 8]
je 0x47f692
mov eax, 0
jmp 0x47f6c2
push 0
lea edi, [ebp - 4]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [0x50be24]
call sub.KERNEL32.dll_WriteFile
cmp eax, 0
je 0x47f6b6
mov edi, dword [ebp - 4]
cmp dword [ebp + 0x10], edi
je 0x47f6bd
mov eax, 0
jmp 0x47f6c2
mov eax, 1
pop edi
leave
ret

Function at 0x47f77c
Capabilities:
Check if file exists
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov dword [0x50be38], 0
push 0x4a2fa4
call sub.KERNEL32.dll_SetCurrentDirectoryA
push str.IJL15.DLL
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47f7c7
push str.eaconvert.dll
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0x50be38], eax
cmp eax, 0
je 0x47f7c7
call fcn.0047f6c8
cmp eax, 0
jne 0x47f7c7
call fcn.0047f7ec
push 0x4b47e4
call sub.KERNEL32.dll_SetCurrentDirectoryA
cmp dword [0x50be38], 0
je 0x47f7e1
mov ebx, 1
jmp 0x47f7e6
mov ebx, 0
mov eax, ebx
pop edi
pop ebx
leave
ret

Function at 0x47f8b8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 1
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47f8c1
push edi
push dword [ebp + 0xc]
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 4], eax
cmp eax, 0
je 0x47f971
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Register
call sub.KERNEL32.dll_GetPrivateProfileSectionA
cmp eax, 0
je 0x47f90f
push 0x510ab4
push 0x50be40
push dword [ebp - 4]
call fcn.0047f810
add esp, 0xc
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.StringRegister
call sub.KERNEL32.dll_GetPrivateProfileSectionA
cmp eax, 0
je 0x47f93c
push 0x510950
push 0x510ac0
push dword [ebp - 4]
call fcn.0047f810
add esp, 0xc
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Array
call sub.KERNEL32.dll_GetPrivateProfileSectionA
cmp eax, 0
je 0x47f969
push 0x50e3c0
push 0x50e3d0
push dword [ebp - 4]
call fcn.0047f810
add esp, 0xc
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalFree
pop edi
leave
ret
Function at 0x47f9d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 5
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x47f9de
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
push 0x572b88
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0xc], eax
cmp eax, 0
je 0x47faef
push 2
push 0
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_rewind
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x47fae4
mov edi, dword [ebp - 0x14]
add edi, 1
push edi
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp eax, 0
je 0x47fae4
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp eax, dword [ebp - 0x14]
je 0x47fa8a
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalFree
mov dword [ebp - 0x10], 0
jmp 0x47fae4
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
mov byte [esi + edi], 0
jmp 0x47fadc
mov edi, dword [ebp - 8]
mov esi, edi
add esi, 1
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
mov dword [esi + edi*4], ebx
jmp 0x47fab6
add dword [ebp - 4], 1
mov edi, dword [ebp - 4]
movsx ebx, byte [edi]
cmp ebx, 0
je 0x47fac6
cmp ebx, 0xa
jne 0x47fab2
mov edi, dword [ebp - 4]
cmp byte [edi], 0xa
jne 0x47fadc
mov edi, dword [ebp - 4]
mov esi, edi
add esi, 1
mov dword [ebp - 4], esi
mov byte [edi], 0
mov edi, dword [ebp - 4]
cmp byte [edi], 0
jne 0x47fa9c
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
mov dword [edi], esi
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x484ad8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov ecx, 0xbe
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x484ae6
push ebx
push esi
push edi
lea edi, [ebp - 0x2d4]
push edi
push 1
push 0
push dword [ebp + 8]
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x484d45
mov dword [ebp - 0x208], 0xc8
lea edi, [ebp - 0x208]
push edi
lea edi, [ebp - 0x2d0]
push edi
lea edi, [ebp - 0x2d8]
push edi
push 0
push str.Count
push dword [ebp - 0x2d4]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x484d3a
mov edi, dword [ebp - 0x2d0]
mov dword [ebp - 0x2dc], edi
mov dword [ebp - 4], 0
jmp 0x484d2b
push dword [ebp - 4]
push 0x572cf2
lea edi, [ebp - 0x204]
push edi
call fcn.00491c0d
add esp, 0xc
mov dword [ebp - 0x208], 0xc8
lea edi, [ebp - 0x208]
push edi
lea edi, [ebp - 0x2d0]
push edi
lea edi, [ebp - 0x2d8]
push edi
push 0
lea edi, [ebp - 0x204]
push edi
push dword [ebp - 0x2d4]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x484d28
lea edi, [ebp - 0x2d0]
push edi
push str.SYSTEMCurrentControlSetEnum_s
lea edi, [ebp - 0x204]
push edi
call fcn.00491c0d
add esp, 0xc
lea edi, [ebp - 0x2e0]
push edi
push 1
push 0
lea edi, [ebp - 0x204]
push edi
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x484d28
mov dword [ebp - 0x208], 0xc8
lea edi, [ebp - 0x208]
push edi
lea edi, [ebp - 0x2d0]
push edi
lea edi, [ebp - 0x2d8]
push edi
push 0
push str.FriendlyName
push dword [ebp - 0x2e0]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x484d1d
push str._COM
lea edi, [ebp - 0x2d0]
push edi
call sub.CRTDLL.DLL_strstr
add esp, 8
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0
je 0x484d1d
lea edi, [ebp - 0x2e8]
push edi
push str._COM_d_
push dword [ebp - 0x2e4]
call fcn.00491acc
add esp, 0xc
mov eax, 0x8c
mul dword [0x5166f4]
mov dword [ebp - 0x2ec], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x2ec]
mov dword [esi + 0x513044], edi
mov eax, 0x8c
mul dword [0x5166f4]
mov dword [ebp - 0x2f0], eax
mov edi, dword [ebp - 0x2e8]
mov esi, dword [ebp - 0x2f0]
mov dword [esi + 0x513048], edi
cmp dword [ebp + 0xc], 2
jne 0x484cc6
mov ebx, 0
jmp 0x484ccb
mov ebx, 1
mov eax, 0x8c
mul dword [0x5166f4]
mov dword [ebp - 0x2f4], eax
mov edi, dword [ebp - 0x2f4]
mov dword [edi + 0x51304c], ebx
lea edi, [ebp - 0x2d0]
push edi
mov eax, 0x8c
mul dword [0x5166f4]
mov dword [ebp - 0x2f8], eax
mov edi, dword [ebp - 0x2f8]
lea edi, [edi + 0x513050]
push edi
call fcn.00491c91
add esp, 8
inc dword [0x5166f4]
push dword [ebp - 0x2e0]
call sub.ADVAPI32.DLL_RegCloseKey
inc dword [ebp - 4]
mov edi, dword [ebp - 0x2dc]
cmp dword [ebp - 4], edi
jb 0x484b66
push dword [ebp - 0x2d4]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4859b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x20]
cmp edi, 0
jl 0x4859d3
cmp edi, 0xc8
jge 0x4859d3
cmp dword [edi*4 + 0x4e5a34], 0
jne 0x485a1e
mov edi, dword [ebp + 8]
cmp dword [edi + 0x78c], 0
je 0x485a14
mov edi, dword [ebp + 8]
push dword [edi + 0x78c]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x78c], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x768], 0xffffffff
mov edi, dword [ebp + 8]
mov dword [edi + 0x76c], 0
mov eax, 0
jmp 0x485b7c
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
cmp esi, dword [edi + 0x768]
jne 0x485a3e
mov esi, dword [esi*4 + 0x4e5a34]
mov esi, dword [esi + 8]
cmp dword [edi + 0x774], esi
je 0x485a7f
mov edi, dword [ebp + 8]
cmp dword [edi + 0x78c], 0
je 0x485a7f
mov edi, dword [ebp + 8]
push dword [edi + 0x78c]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x78c], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x768], 0xffffffff
mov edi, dword [ebp + 8]
mov dword [edi + 0x76c], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x78c], 0
jne 0x485b62
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
movzx ebx, word [esi + 6]
imul ebx, dword [esi + 8]
push ebx
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [edi + 0x78c], eax
cmp eax, 0
je 0x485b62
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov dword [edi + 0x768], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
movzx ebx, byte [esi]
mov dword [edi + 0x76c], ebx
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
movzx esi, word [esi + 6]
mov dword [edi + 0x770], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
mov esi, dword [esi + 8]
mov dword [edi + 0x774], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
mov esi, dword [esi + 0x10]
mov dword [edi + 0x77c], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
mov esi, dword [esi + 0x14]
mov dword [edi + 0x780], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
mov esi, dword [esi + 0x18]
mov dword [edi + 0x784], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x20]
mov esi, dword [esi*4 + 0x4e5a34]
mov esi, dword [esi + 0x1c]
mov dword [edi + 0x788], esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x78c], 0
je 0x485b75
mov ebx, 1
jmp 0x485b7a
mov ebx, 0
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4867b4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push 0xfaa
push dword [0x4a2490]
call sub.USER32.DLL_GetDlgItem
cmp dword [ebp + 8], eax
jne 0x486814
push 0xf
push 0x4aedc4
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
push 0x4aedd4
push 0x572e18
push 0x4aedc4
call fcn.00491acc
add esp, 0xc
cmp eax, 1
je 0x486802
mov dword [0x4aedd4], 0xffffffff
push 0x4aedb4
call fcn.004860ee
add esp, 4
jmp 0x4868f4
push 0xfab
push dword [0x4a2490]
call sub.USER32.DLL_GetDlgItem
cmp dword [ebp + 8], eax
jne 0x48685a
push 0xff
push 0x4aedd8
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
push 0x4aedb4
call fcn.00474e05
add esp, 4
push 0x4aedb4
call fcn.004860ee
add esp, 4
jmp 0x4868f4
push 0xfb4
push dword [0x4a2490]
call sub.USER32.DLL_GetDlgItem
cmp dword [ebp + 8], eax
jne 0x4868b3
push 0xf
push 0x4a1cf4
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
push 0x4a1d04
push 0x572e18
push 0x4a1cf4
call fcn.00491acc
add esp, 0xc
cmp eax, 1
je 0x4868a4
mov dword [0x4a1d04], 0xffffffff
push 0x4a1ce4
call fcn.004860ee
add esp, 4
jmp 0x4868f4
push 0xfb5
push dword [0x4a2490]
call sub.USER32.DLL_GetDlgItem
cmp dword [ebp + 8], eax
jne 0x4868f4
push 0xff
push 0x4a1d08
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
push 0x4a1ce4
call fcn.00474e05
add esp, 4
push 0x4a1ce4
call fcn.004860ee
add esp, 4
pop edi
leave
ret

Function at 0x48e200
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x48e234
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x48e24f
mov edi, eax
inc edi
jmp 0x48e22c
inc edi
cmp byte [edi], 0x20
je 0x48e22b
jmp 0x48e24f
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x48e240
cmp eax, 0x20
jne 0x48e233
jmp 0x48e243
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x48e24f
cmp eax, 0x20
je 0x48e242
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.0040bc84
pop edi
leave
ret
Function at 0x401207
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4182d8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4182dc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x9e3779b9
mov dword [ebp - 0x34], eax
call fcn.00401200
add dword [ebp - 0x10], 0x23f
cmp dword [0xae6984], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x834]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov eax, dword [0x4182e4]
mov edi, dword [0x4182e0]
push 0x20
pop edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov eax, esi
mov dword [ebp - 0xc], 0xedeb2e40
shl eax, 4
add eax, edi
cmp dword [0xae6984], 0xfa9
mov dword [ebp - 8], eax
mov eax, dword [0xae6980]
cmove eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
cmp dword [0xae6984], 0x3eb
mov dword [0xae6980], eax
mov eax, dword [0xae68d8]
cmove eax, dword [ebp - 0xc]
mov dword [0xae68d8], eax
mov eax, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
shr eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x14], 0
mov dword [0xae697c], 0xf4ea3dee
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 0x18], eax
mov eax, ebx
shl eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
add eax, ebx
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor dword [ebp - 0x14], eax
cmp dword [0xae6984], 0xb03
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jne 0x401362
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x10], eax
dec edx
mov dword [ebp - 0x20], edx
jne 0x401277
mov edi, dword [ebp - 0x30]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret