joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434a5c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
call sub.USER32.DLL_IsClipboardFormatAvailable
test eax, eax
je 0x434b25
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x434b25
push edi
call sub.USER32.DLL_GetClipboardData
mov esi, eax
test esi, esi
je 0x434b20
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x434b20
push esi
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov eax, edi
dec eax
je 0x434ae7
sub eax, 6
je 0x434ae7
sub eax, 6
je 0x434abd
jmp 0x434af6
shr ebx, 1
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.0046f04c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x434b1a
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046f73c
add esp, 0x10
jmp 0x434b1a
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004b46fc
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x434b1a
push ebx
cmp edi, 1
mov ecx, dword [ebp - 4]
push ecx
jne 0x434b0b
call fcn.0047705c
jmp 0x434b0d
xor eax, eax
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0046f680
add esp, 0x10
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
test ebx, ebx
jne 0x434b37
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0046c04c
add esp, 8
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x434ecc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
xor ebx, ebx
push esp
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x434fb9
test byte [esp + 0x10], 0x80
je 0x434eed
or ebx, 1
test byte [esp + 0x11], 0x80
je 0x434ef7
or ebx, 2
test byte [esp + 0x12], 0x80
je 0x434f01
or ebx, 4
test byte [esp + 0x5b], 0x80
je 0x434f0e
or ebx, 0x4000
test byte [esp + 0x5c], 0x80
je 0x434f1b
or ebx, 0x8000
test byte [esp + 0x5d], 0x80
je 0x434f28
or ebx, 0x10000
test byte [esp + 0x91], 1
je 0x434f35
or ebx, 0x10
test byte [esp + 0x90], 1
je 0x434f42
or ebx, 0x20
test byte [esp + 0x14], 1
je 0x434f4c
or ebx, 0x40
test byte [esp + 0x2d], 1
je 0x434f59
or ebx, 0x80
test byte [esp + 0xa0], 0x80
je 0x434f69
or ebx, 0x100
test byte [esp + 0xa1], 0x80
je 0x434f79
or ebx, 0x200
test byte [esp + 0xa2], 0x80
je 0x434f89
or ebx, 0x400
test byte [esp + 0xa3], 0x80
je 0x434f99
or ebx, 0x800
test byte [esp + 0xa4], 0x80
je 0x434fa9
or ebx, 0x1000
test byte [esp + 0xa5], 0x80
je 0x434fb9
or ebx, 0x2000
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x434fc4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x4350ec
test bl, 1
je 0x434fee
mov dl, 0x80
jmp 0x434ff0
xor edx, edx
test bl, 2
mov byte [ebp - 0xf0], dl
je 0x434fff
mov al, 0x80
jmp 0x435001
xor eax, eax
test bl, 4
mov byte [ebp - 0xef], al
je 0x435010
mov dl, 0x80
jmp 0x435012
xor edx, edx
test bh, 0x40
mov byte [ebp - 0xee], dl
je 0x435021
mov al, 0x80
jmp 0x435023
xor eax, eax
test bh, 0x80
mov byte [ebp - 0xa5], al
je 0x435032
mov dl, 0x80
jmp 0x435034
xor edx, edx
test ebx, 0x10000
mov byte [ebp - 0xa4], dl
je 0x435046
mov al, 0x80
jmp 0x435048
xor eax, eax
test bl, 0x10
mov byte [ebp - 0xa3], al
je 0x435057
mov dl, 1
jmp 0x435059
xor edx, edx
test bl, 0x20
mov byte [ebp - 0x6f], dl
je 0x435065
mov al, 1
jmp 0x435067
xor eax, eax
test bl, 0x40
mov byte [ebp - 0x70], al
je 0x435073
mov dl, 1
jmp 0x435075
xor edx, edx
test bl, 0x80
mov byte [ebp - 0xec], dl
je 0x435084
mov al, 1
jmp 0x435086
xor eax, eax
test bh, 1
mov byte [ebp - 0xd3], al
je 0x435095
mov dl, 0x80
jmp 0x435097
xor edx, edx
test bh, 2
mov byte [ebp - 0x60], dl
je 0x4350a3
mov al, 0x80
jmp 0x4350a5
xor eax, eax
test bh, 4
mov byte [ebp - 0x5f], al
je 0x4350b1
mov dl, 0x80
jmp 0x4350b3
xor edx, edx
test bh, 8
mov byte [ebp - 0x5e], dl
je 0x4350bf
mov al, 0x80
jmp 0x4350c1
xor eax, eax
test bh, 0x10
mov byte [ebp - 0x5d], al
je 0x4350cd
mov dl, 0x80
jmp 0x4350cf
xor edx, edx
test bh, 0x20
mov byte [ebp - 0x5c], dl
je 0x4350db
mov al, 0x80
jmp 0x4350dd
xor eax, eax
mov byte [ebp - 0x5b], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.DLL_SetKeyboardState
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4359c4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, 0xffffffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x4359fa
test ecx, ecx
je 0x4359fa
xor ebx, ebx
mov bl, byte [edx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x59aca4]
xor ebx, eax
inc edx
mov eax, ebx
dec ecx
jne 0x4359dc
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x435a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ax, 0xffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x435a3f
test ecx, ecx
je 0x435a3f
movzx ebx, ax
movzx edi, byte [edx]
mov esi, ebx
xor esi, edi
and esi, 0xff
sar ebx, 8
mov si, word [esi*2 + 0x59b0a4]
xor si, bx
inc edx
mov eax, esi
dec ecx
jne 0x435a1b
xor ax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x444f1c
Capabilities:
Get hostname

Disassembly:
add esp, 0xffffffdc
mov dword [esp], 0x10
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov word [esp + 0x22], 0
cmp word [esp + 4], 0
je 0x444f54
lea edx, [esp + 4]
push edx
call fcn.0047740c
pop ecx
jmp 0x444f5f
push str.HOSTNAME
call fcn.004b27a0
pop ecx
add esp, 0x24
ret
Function at 0x444f7c
Capabilities:
Get session user name

Disassembly:
add esp, 0xfffffdfc
mov dword [esp], 0x100
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.ADVAPI32.DLL_GetUserNameW
mov word [esp + 0x202], 0
cmp word [esp + 4], 0
je 0x444fba
lea edx, [esp + 4]
push edx
call fcn.0047740c
pop ecx
jmp 0x444fc5
push str.USER
call fcn.004b27a0
pop ecx
add esp, 0x204
ret
Function at 0x465c58
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
cmp dword [0x6083a0], 0
jne 0x465ccb
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x465c82
mov edx, ebx
dec edx
test edx, ebx
je 0x465c87
call fcn.004d52fc
mov dword [0x6083a8], esi
mov dword [0x6083a4], ebx
mov dword [0x6083ac], 0x40000
mov eax, 5
mov dword [0x6083b0], 0x200000
mov dword [0x6083b4], eax
mov dword [0x608574], eax
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x6083a0], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x469bd4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
mov eax, dword [ebp + 8]
cmp eax, 0x69
jg 0x469c37
je 0x469d0b
cmp eax, 4
jg 0x469c14
je 0x469ccb
sub eax, 1
jb 0x469c70
je 0x469c84
dec eax
je 0x469ca3
dec eax
je 0x469cb7
jmp case.0x469c45.1006
sub eax, 0x65
je 0x469cd2
dec eax
je 0x469ce9
dec eax
je 0x469cf0
dec eax
je 0x469d07
jmp case.0x469c45.1006
add eax, 0xfffffc17
cmp eax, 8
ja case.0x469c45.1006
jmp dword [eax*4 + 0x469c4c]
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x469d59
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x469c98
mov eax, dword [ebp - 0x34]
jmp 0x469c9b
or eax, 0xffffffff
shr eax, 0xa
jmp 0x469d59
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x469d59
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x469d59
xor eax, eax
jmp 0x469d59
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x469d59
mov eax, 1
jmp 0x469d59
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x469d59
xor eax, eax
jmp 0x469d59
xor eax, eax
jmp 0x469d59
call fcn.00469878
jmp 0x469d59
xor eax, eax
jmp 0x469d59
call fcn.00469880
jmp 0x469d59
call fcn.00462db8
jmp 0x469d59
call fcn.00462db8
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x469d59
mov eax, dword [0x60809c]
sub eax, dword [0x6080a4]
test eax, eax
jns 0x469d47
add eax, 3
sar eax, 2
jmp 0x469d59
xor eax, eax
jmp 0x469d59
mov eax, 1
jmp 0x469d59
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x46a238
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
jmp 0x46a2ac
test edx, 0x10000
jne 0x46a37d
test edx, 0x20000
je 0x46a263
mov edx, dword [eax + 8]
push edx
mov eax, dword [eax + 0xc]
call dword [eax + 0x10]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x40
jne 0x46a2a5
cmp dword [eax + 0xc], 0
jne 0x46a2a5
cmp dword [eax + 0x10], 0
jl 0x46a2a5
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5a3c68]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x46a37d
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
push eax
call fcn.0046da58
pop ecx
mov edx, dword [eax]
test dh, 0x20
jne 0x46a240
test byte [eax + 1], 0x80
je 0x46a2e7
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx ecx, word [eax + 0xe]
and ecx, 0xfffffffd
movzx edx, word [0x5a3c68]
cmp ecx, edx
jne 0x46a37d
xor word [eax + 0xe], 1
lea ecx, [eax + 0x10]
push ecx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 4
je 0x46a316
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
movzx ecx, word [0x5a3c68]
cmp edx, ecx
jne 0x46a37d
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x10
je 0x46a348
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5a3c68]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x46a37d
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 1
je 0x46a37d
cmp dword [eax + 0xc], 0
je 0x46a37d
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5a3c68]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x46a37d
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
Function at 0x4b26c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b26fe
push esi
call fcn.004325e4
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
test edi, edi
mov ebx, eax
je 0x4b26fe
push edi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b2708
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b2743
push esi
call fcn.004325e4
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4b272f
test al, 0x50
je 0x4b2733
xor ebx, ebx
jmp 0x4b2738
mov ebx, 1
test edi, edi
je 0x4b2743
push edi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b274c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b2787
push esi
call fcn.004325e4
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4b2773
test al, 0x10
jne 0x4b2777
xor ebx, ebx
jmp 0x4b277c
mov ebx, 1
test edi, edi
je 0x4b2787
push edi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b27a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.00477318
pop ecx
mov ebx, eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov esi, eax
test esi, esi
je 0x4b27f4
mov eax, esi
add eax, eax
push eax
call fcn.004699b8
pop ecx
mov dword [ebp - 4], eax
push esi
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047740c
pop ecx
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.00469a8c
pop ecx
push ebx
call fcn.00469a8c
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b5a20
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xfffffeec
mov ebx, esp
push 1
push 0
push 0
push 0xa
call fcn.004b5f14
add esp, 0x10
mov dword [0x5f1b98], eax
push 1
push 0
push 3
push 6
call fcn.004b5f14
add esp, 0x10
mov dword [0x5f1b9c], eax
push 1
push 0
push 2
push 6
call fcn.004b5f14
add esp, 0x10
mov dword [0x5f1ba0], eax
push 1
push 0
push 1
push 6
call fcn.004b5f14
add esp, 0x10
mov dword [0x5f1ba4], eax
push 1
push 0
push 0
push 6
call fcn.004b5f14
add esp, 0x10
mov dword [0x5f1ba8], eax
push 1
push 3
push 2
push 5
call fcn.004b5f14
add esp, 0x10
test eax, eax
jne 0x4b5abe
push 1
push 2
push 2
push 5
call fcn.004b5f14
add esp, 0x10
test eax, eax
jne 0x4b5abe
xor eax, eax
jmp 0x4b5ac3
mov eax, 1
mov dword [0x5f1bac], eax
push 1
push 0
push 0
push 5
call fcn.004b5f14
add esp, 0x10
mov dword [0x5f1bb0], eax
mov dword [ebx], 0x114
push ebx
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4b5b85
cmp dword [ebx + 0x10], 1
je 0x4b5b01
xor edx, edx
mov dword [0x5f1bb8], edx
jmp 0x4b5b3b
cmp dword [ebx + 4], 4
jne 0x4b5b19
cmp dword [ebx + 8], 0xa
jae 0x4b5b19
mov dword [0x5f1bb8], 5
jmp 0x4b5b3b
cmp dword [ebx + 4], 4
jne 0x4b5b31
cmp dword [ebx + 8], 0xa
jne 0x4b5b31
mov dword [0x5f1bb8], 8
jmp 0x4b5b3b
mov dword [0x5f1bb8], 9
cmp dword [ebx + 0x10], 2
je 0x4b5b4b
xor ecx, ecx
mov dword [0x5f1bb4], ecx
jmp 0x4b5b85
cmp dword [ebx + 4], 3
jne 0x4b5b63
cmp dword [ebx + 8], 0x33
jne 0x4b5b63
mov dword [0x5f1bb4], 3
jmp 0x4b5b85
cmp dword [ebx + 4], 4
jne 0x4b5b7b
cmp dword [ebx + 8], 0
jne 0x4b5b7b
mov dword [0x5f1bb4], 4
jmp 0x4b5b85
mov dword [0x5f1bb4], 5
push str.ntdll.dll
call sub.KERNEL32.DLL_GetModuleHandleW
test eax, eax
je 0x4b5bac
push str.wine_get_version
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4b5bac
mov dword [0x5f1bbc], 1
cmp dword [0x5f1bb0], 0
je 0x4b5bbf
mov dword [0x5f1bb4], 5
mov dword [0x5f1b94], 1
add esp, 0x114
pop ebx
ret

Function at 0x4bb920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push 0
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov ebx, eax
test ebx, ebx
je 0x4bb982
test esi, esi
je 0x4bb946
push esi
call fcn.004bb888
pop ecx
inc eax
add ebx, eax
mov eax, ebx
add eax, eax
push eax
call fcn.004699b8
pop ecx
mov edi, eax
push ebx
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryW
test esi, esi
je 0x4bb97c
mov eax, ebx
dec eax
push eax
push 0x5f39a4
push edi
call fcn.004bb8d8
add esp, 0xc
dec ebx
push ebx
push esi
push edi
call fcn.004bb8d8
add esp, 0xc
mov eax, edi
jmp 0x4bb989
push esi
call fcn.004bb8a4
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c0b78
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c0bad
xor eax, eax
jmp 0x4c0c2a
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
je 0x4c0bca
push esi
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [edi], eax
test eax, eax
jne 0x4c0bd4
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4c0c2a
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalLock
test eax, eax
jne 0x4c0bf7
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4c0c2a
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_CloseHandle
test esi, esi
jne 0x4c0c25
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
jmp 0x4c0c2a
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c31fc
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x602ce0
call fcn.004cca7c
mov word [ebp - 0x18], 0xc
mov edx, 0x6031a0
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004c7be4
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4c3249
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004c641c
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4c324c
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c89dc
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x604098
call fcn.004cca7c
mov word [ebp - 0x18], 0xc
mov edx, 0x604408
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004c7be4
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4c8a29
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004c641c
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4c8a2c
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cc270
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4cd698
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4cd6b4
call fcn.004ced54
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4cd6d2
test bl, 1
je 0x4cd6d2
mov dword [0x6067c0], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4cd884
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4cd8a3
mov eax, dword [0x6054dc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4cd8b0
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4cd8dd
je 0x4cd8ef
sub ecx, 0x100
je 0x4cd8fd
sub ecx, 0x100
je 0x4cd904
sub ecx, 0x100
je 0x4cd8f6
jmp 0x4cd90b
sub ecx, 0x600
je 0x4cd904
sub ecx, 0x100
je 0x4cd8ef
jmp 0x4cd90b
mov edi, 1
jmp 0x4cd910
mov edi, 2
jmp 0x4cd910
mov edi, 4
jmp 0x4cd910
mov edi, 5
jmp 0x4cd910
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4cd937
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x604f54]
test al, 0x80
je 0x4cd930
mov ebx, 0x80
jmp 0x4cd949
mov ebx, 1
jmp 0x4cd949
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4cd949
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4cd95b
je 0x4cd964
dec eax
je 0x4cd96d
jmp 0x4cd976
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x4cd985
mov dword [ebp - 4], 0x40000000
jmp 0x4cd985
mov dword [ebp - 4], 0xc0000000
jmp 0x4cd985
push 1
call fcn.004cecf0
pop ecx
mov ebx, eax
jmp 0x4cda75
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4cd9a1
sub eax, 0x10
je 0x4cd9a8
sub eax, 0x10
je 0x4cd9b1
sub eax, 0x10
je 0x4cd9ba
jmp 0x4cd9ba
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4cd9c1
mov dword [ebp - 8], 1
jmp 0x4cd9c1
mov dword [ebp - 8], 2
jmp 0x4cd9c1
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4cda2e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4cda23
test byte [ebp + 0xd], 1
je 0x4cda1e
mov ebx, 0x50
jmp 0x4cda23
mov ebx, 2
push ebx
call fcn.004cecf0
pop ecx
mov ebx, eax
jmp 0x4cda75
mov edi, esi
push edi
call fcn.004cd7f4
pop ecx
test eax, eax
je 0x4cda42
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4cda4e
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004cea34
add esp, 8
mov ebx, eax
inc eax
jne 0x4cda75
push 4
call fcn.004cecf0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret