joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cf78
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44cf8f
add esp, 0xfffffff0
call fcn.0040347c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418704
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40ffb8]
call fcn.0040310c
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x40ffb8]
call fcn.0040310c
mov dword [ebx + 0x90], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x44], 0x80000018
mov dword [ebx + 0x60], 0x1f4
mov byte [ebx + 0x64], 1
xor eax, eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x85], 1
mov dl, 1
mov eax, dword [0x41a490]
call fcn.00421840
mov esi, eax
mov dword [ebx + 0x80], esi
push 0x44d100
mov eax, dword [0x4e8400]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421be4
mov eax, dword [ebx + 0x80]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x44ea3c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4e8400]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d3bc
test eax, eax
je 0x44d07f
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409868
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d3e4
test eax, eax
je 0x44d093
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x74]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403f5c
mov eax, dword [0x4e81e8]
cmp byte [eax], 0
jne 0x44d0c4
mov eax, ebx
call fcn.0044d1ec
mov byte [ebx + 0x41], 1
mov byte [ebx + 0x42], 1
mov byte [ebx + 0x43], 1
mov byte [ebx + 0x86], 1
xor eax, eax
mov dword [ebx + 0x88], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44d0f6
call fcn.004034d4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d448
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4e97ac]
cmp dword [eax + 0x24], 0
je 0x44d4d8
cmp dword [ebx + 0x7c], 0
jne 0x44d4d5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44d3dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x78]
cmp dword [eax + 8], 0
je 0x44d4d5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44d4a4
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x78]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44d4d5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x78]
call fcn.00411a0c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44d4b0
inc dword [ebx + 0x7c]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x44de28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x44de5d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403e14
jmp 0x44de67
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403dc8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44ed6c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x44eda4
mov eax, esi
call fcn.00437fd4
test al, al
je 0x44eda4
mov eax, dword [ebx + 0x6c]
call fcn.00437bac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44eda4
push 0
mov eax, dword [ebx + 0x6c]
call fcn.00437bac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x456854
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45692c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e9858], 0
jne 0x456910
lea eax, [ebp - 4]
mov edx, 0x456944
call fcn.00403dc8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404170
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x456910
mov eax, ebx
call fcn.004027c4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x456909
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4568f3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x456954
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4568f3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4e9858], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456910
mov eax, dword [ebp - 0xc]
call fcn.004027dc
ret
mov ebx, dword [0x4e9858]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456933
lea eax, [ebp - 4]
call fcn.00403d30
ret
Function at 0x46487c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464917
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404170
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4648f1
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x4e8918]
call fcn.0040603c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x46431c]
call fcn.0040c680
call fcn.00403828
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00464464
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46491e
lea eax, [ebp - 0x10]
call fcn.00403d30
ret
Function at 0x46531c
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9f4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x504], ecx
mov dword [ebp - 0x608], ecx
mov dword [ebp - 0x60c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x465576
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, ebx
call fcn.00402c54
jmp 0x465539
mov edx, esi
mov eax, 0x465584
call fcn.00402b28
mov edi, eax
mov ebx, edi
cmp ebx, 2
jle 0x465399
xor eax, eax
mov al, byte [esi]
cmp ebx, eax
jg 0x465399
cmp byte [esi + ebx], 0x3f
jne 0x465399
cmp byte [esi + ebx + 1], 0x3d
jne 0x465399
cmp byte [esi + ebx - 2], 0x3f
jne 0x46539d
mov al, byte [esi + ebx - 1]
sub al, 0x42
je 0x465399
sub al, 0xf
jne 0x46539d
xor eax, eax
jmp 0x46539f
mov al, 1
inc ebx
test al, al
jne 0x4653ac
xor edx, edx
mov dl, byte [esi]
cmp ebx, edx
jl 0x46536c
test al, al
je 0x4653b3
dec ebx
jmp 0x4653c8
push esi
mov ecx, edi
dec ecx
mov eax, esi
mov edx, 1
call fcn.004028c4
jmp 0x46554d
lea eax, [ebp - 0x100]
push eax
mov ecx, edi
dec ecx
mov eax, esi
mov edx, 1
call fcn.004028c4
lea eax, [ebp - 0x200]
push eax
xor ecx, ecx
mov cl, byte [esi]
lea edx, [ebx + 2]
mov eax, esi
call fcn.004028c4
lea eax, [ebp - 0x400]
push eax
mov ecx, ebx
sub ecx, edi
sub ecx, 2
lea edx, [edi + 2]
mov eax, esi
call fcn.004028c4
lea edx, [ebp - 0x400]
mov eax, 0x465588
call fcn.00402b28
mov edi, eax
lea eax, [ebp - 0x500]
push eax
mov ecx, edi
dec ecx
mov edx, 1
lea eax, [ebp - 0x400]
call fcn.004028c4
lea eax, [ebp - 0x400]
mov ecx, edi
mov edx, 1
call fcn.00402908
mov bl, byte [ebp - 0x3ff]
lea eax, [ebp - 0x400]
mov ecx, 2
mov edx, 1
call fcn.00402908
mov eax, ebx
call fcn.00402ba8
cmp al, 0x42
jne 0x465487
lea edx, [ebp - 0x300]
lea eax, [ebp - 0x400]
mov ecx, 0xff
call fcn.004650d0
jmp 0x4654a8
mov eax, ebx
call fcn.00402ba8
cmp al, 0x51
jne 0x4654a8
lea edx, [ebp - 0x300]
lea eax, [ebp - 0x400]
mov ecx, 0xff
call fcn.00465dcc
lea edx, [ebp - 0x100]
lea eax, [ebp - 0x604]
call fcn.00402c54
lea edx, [ebp - 0x300]
lea eax, [ebp - 0x604]
call fcn.00402bfc
lea edx, [ebp - 0x604]
lea eax, [ebp - 0x504]
call fcn.00403f50
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x60c]
lea edx, [ebp - 0x200]
call fcn.00403f50
mov eax, dword [ebp - 0x60c]
lea edx, [ebp - 0x608]
call fcn.00408cc0
mov edx, dword [ebp - 0x608]
pop eax
call fcn.00403fb4
mov edx, dword [ebp - 0x504]
mov eax, esi
mov ecx, 0xff
call fcn.00403f88
xor edx, edx
mov dl, byte [esi]
test edx, edx
jle 0x465539
lea eax, [esi + 1]
cmp byte [eax], 0x5f
jne 0x465535
mov byte [eax], 0x20
inc eax
dec edx
jne 0x46552d
mov edx, esi
mov eax, 0x465584
call fcn.00402b28
test eax, eax
jne 0x46535c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46557d
lea eax, [ebp - 0x60c]
mov edx, 2
call fcn.00403d54
lea eax, [ebp - 0x504]
call fcn.00403d30
ret
Function at 0x4682d0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [esp + 0x100]
push eax
push 0
push 0x468314
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [esp + 0x100]
call fcn.00409a70
add esp, 0x200
pop ebx
ret

Function at 0x47a824
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47aa06
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x47a86e
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0047a2f4
mov eax, dword [ebp - 0x204]
mov edx, ebx
call fcn.0040cfac
cmp al, 1
jne 0x47a86e
dec ebx
mov edi, ebx
mov eax, esi
call fcn.0047a608
test al, al
je 0x47a9a6
test edi, edi
jge 0x47a885
xor edi, edi
lea ebx, [edi + 1]
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0047a2f4
mov eax, dword [ebp - 0x204]
call fcn.00403fac
cmp ebx, eax
jge 0x47a8cc
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0047a2f4
mov eax, dword [ebp - 0x204]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4e88e4]
and eax, 0xff
bt dword [edx], eax
jae 0x47a8cc
inc ebx
mov eax, dword [esi + 0x20c]
cmp edi, eax
jl 0x47a8da
mov edi, eax
mov ebx, edi
mov ecx, ebx
mov edx, ebx
mov eax, esi
call fcn.0047a800
cmp ebx, edi
je 0x47a99e
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x47a904
mov byte [ebp - 0x1f0], 0x81
mov eax, esi
mov bx, 0xffcf
call fcn.00403318
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e6e70]
mov byte [ebp + eax - 0x200], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403318
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e6e70]
push eax
push pe_nt_image_headers32
mov eax, esi
call fcn.00437bac
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403318
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e6e70]
push eax
push 0x101
mov eax, esi
call fcn.00437bac
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [esi + 0x214], edi
jmp 0x47a9ed
test edi, edi
jge 0x47a9ac
xor edi, edi
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0047a2f4
mov eax, dword [ebp - 0x204]
call fcn.00403fac
cmp edi, eax
jl 0x47a9e2
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.0047a2f4
mov eax, dword [ebp - 0x204]
call fcn.00403fac
mov edi, eax
mov ecx, edi
mov edx, edi
mov eax, esi
call fcn.0047a800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47aa0d
lea eax, [ebp - 0x204]
call fcn.00403d30
ret
Function at 0x49005f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4e7bd2
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4900b7
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4e7bf3
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4900ad
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4900bb
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4adca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x1ec]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4ade43
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x224]
mov eax, dword [ebx + 0x10]
call fcn.0041b81c
cmp byte [ebp + 8], 0
je 0x4adcf9
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.0041b6ec
jmp 0x4add07
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x10]
call fcn.0041b6ec
mov eax, dword [ebx + 0x10]
call fcn.0041b814
dec eax
jle 0x4add4d
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
call fcn.0041b6e4
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, dword [ebx + 0x10]
mov eax, edi
call fcn.0041b814
push eax
push 0x12200
call sub.gdi32.dll_ExtCreatePen
mov edx, eax
mov eax, edi
call fcn.0041b7ac
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shr ecx, 1
add edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov bx, 0xffcf
call fcn.00403318
test al, al
je 0x4add96
test esi, esi
jne 0x4add96
inc dword [ebp - 0xc]
mov eax, esi
xor eax, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x14], edx
add eax, 2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
lea eax, [esi + 2]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [esi + ebx]
mov edx, dword [ebp - 0xc]
mov dword [edi + eax*4], edx
mov eax, esi
xor eax, 1
mov edx, eax
add edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [edi + edx*4], ecx
add ebx, 2
lea edx, [esi + ebx]
mov ecx, dword [ebp - 0xc]
mov dword [edi + edx*4], ecx
add eax, ebx
mov edx, dword [ebp - 0x18]
mov dword [edi + eax*4], edx
add ebx, 2
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x28]
call dword [ecx + 0x24]
mov edx, dword [ebp - 4]
add eax, dword [edx]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x4addcc
shr ebx, 2
push ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 0xc]
push eax
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1ec]
call fcn.0041c2f8
push eax
call sub.gdi32.dll_PolyPolyline
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c0d90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00403fac
mov edx, eax
mov eax, ebp
call fcn.004042dc
xor ebx, ebx
mov eax, dword [esp]
call fcn.00403fac
test eax, eax
jne 0x4c0dc4
mov eax, ebp
call fcn.00403d30
jmp 0x4c0e34
mov eax, ebp
call fcn.0040417c
mov esi, ebx
and esi, 0xff
mov edx, dword [esp]
mov dl, byte [edx + esi - 1]
mov byte [eax + esi - 1], dl
mov esi, 0x1ff
mov eax, dword [esp]
call fcn.00403fac
test al, al
jbe 0x4c0e34
mov byte [esp + 4], al
mov bl, 1
mov eax, ebp
call fcn.0040417c
mov edi, ebx
and edi, 0xff
mov edx, dword [esp]
mov dl, byte [edx + edi - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + edi - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec byte [esp + 4]
jne 0x4c0df5
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c0e3c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov edi, eax
mov eax, edi
call fcn.00403fac
mov edx, eax
mov eax, dword [esp]
call fcn.004042dc
xor ebx, ebx
mov eax, edi
call fcn.00403fac
test eax, eax
jne 0x4c0e70
mov eax, dword [esp]
call fcn.00403d30
jmp 0x4c0ed9
mov eax, dword [esp]
call fcn.0040417c
mov esi, ebx
and esi, 0xff
mov dl, byte [edi + esi - 1]
mov byte [eax + esi - 1], dl
mov esi, 0x1ff
mov eax, edi
call fcn.00403fac
test al, al
jbe 0x4c0ed9
mov byte [esp + 4], al
mov bl, 1
mov eax, dword [esp]
call fcn.0040417c
mov ebp, ebx
and ebp, 0xff
mov dl, byte [edi + ebp - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebp - 1], dl
xor eax, eax
mov al, byte [edi + ebp - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec byte [esp + 4]
jne 0x4c0e9e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ccc58
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404160
xor eax, eax
push ebp
push 0x4cce16
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404170
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x4cccb0
mov ecx, 0x4cce30
mov dl, 1
mov eax, dword [0x407f20]
call fcn.0040c644
call fcn.00403828
lea eax, [edi + 1]
call fcn.00409a84
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ccdf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push edi
push 0
mov eax, dword [ebp - 4]
call fcn.00404170
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4cccf8
mov ecx, 0x4cce4c
mov dl, 1
mov eax, dword [0x407f20]
call fcn.0040c644
call fcn.00403828
lea eax, [ebp - 0x14]
push eax
push esi
push 0x4cce6c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4ccd25
mov ecx, 0x4cce4c
mov dl, 1
mov eax, dword [0x407f20]
call fcn.0040c644
call fcn.00403828
mov eax, dword [esi]
mov edx, dword [ebp - 8]
push esi
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, ebx
call fcn.00403d30
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
test edi, 1
je 0x4ccd5c
mov eax, ebx
mov edx, 0x4cce78
call fcn.00403fb4
test edi, 2
je 0x4ccd70
mov eax, ebx
mov edx, 0x4cce90
call fcn.00403fb4
test edi, 4
je 0x4ccd84
mov eax, ebx
mov edx, 0x4cceac
call fcn.00403fb4
test edi, 8
je 0x4ccd98
mov eax, ebx
mov edx, 0x4ccec4
call fcn.00403fb4
test edi, 0x10
je 0x4ccdac
mov eax, ebx
mov edx, 0x4ccedc
call fcn.00403fb4
test edi, 0x20
je 0x4ccdc0
mov eax, ebx
mov edx, 0x4ccef4
call fcn.00403fb4
mov eax, dword [ebx]
call fcn.00403fac
test eax, eax
jle 0x4ccde3
mov eax, dword [ebx]
cmp byte [eax], 0x2c
jne 0x4ccde3
mov eax, ebx
mov ecx, 2
mov edx, 1
call fcn.004041f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cce00
mov eax, dword [ebp - 0x10]
call fcn.00409ad0
ret

Function at 0x4ccfdc
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, ecx
mov ebx, eax
lea eax, [esp + 0x200]
call fcn.004098f0
mov eax, esp
mov edx, ebx
call fcn.004098f0
lea eax, [esp + 0x100]
push eax
push 0
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, esi
lea eax, [esp + 0x100]
call fcn.00409a70
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x4cd08c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404170
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4cd0a5
test al, 0x10
jne 0x4cd0a9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4d5d20
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
mov esi, ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4d5de3
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x100]
xchg edx, eax
call fcn.004098f0
lea eax, [ebp - 0x20b]
mov edx, ebx
call fcn.004098f0
lea eax, [ebp - 0x200]
push eax
push 0
lea eax, [ebp - 0x20b]
push eax
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetTempFileNameA
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_DeleteFileA_1
lea edx, [ebp - 0x210]
lea eax, [ebp - 0x200]
call fcn.00409a70
mov eax, dword [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
mov ecx, esi
mov edx, 0x4d5dfc
call fcn.00403ff8
mov edx, dword [ebp - 0x214]
mov ecx, dword [ebp + 8]
pop eax
call fcn.00409310
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5dea
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00403d54
ret