joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477a84
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x477aaa
mov eax, 0x4a1ac8
call fcn.00467ce4
mov dword [ebx + 8], eax
mov eax, dword [ebx]
test eax, eax
je 0x477ab6
push eax
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4a6fb4]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x477aee
mov ecx, 0x4a1ad5
jmp 0x477af3
mov ecx, 0x4a1ae2
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x477b9e
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4c316c]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.00477f0c
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x477bb1
call fcn.00468044
jmp 0x477bb1
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x477bde
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x477bde
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00477c40
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x477c2d
call fcn.00467fbc
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x477c27
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push 0x4a1aeb
push eax
call fcn.004902f4
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.00477f0c
inc esi
cmp esi, 0x20
jl 0x477bed
mov eax, ebx
call fcn.00478070
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x477f0c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
push 0x408
call fcn.0048ba5c
mov ebx, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebx], eax
mov edx, dword [ebp + 0x1c]
mov eax, edi
mov dword [ebx + 4], edx
call fcn.0040e694
push eax
lea edx, [ebx + 8]
push edx
call fcn.0048d424
add esp, 8
cmp byte [esi + 4], 0
je 0x478048
cmp dword [esi + 8], 0x50000
jb 0x477f70
cmp dword [0x4bcb14], 4
jne 0x477f74
cmp dword [0x4bcb18], 0
jne 0x477f74
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x477f86
cmp dword [ebp + 0x18], 0xffffffff
je 0x477f8a
cmp dword [ebp + 0x14], 0
je 0x477f8a
xor eax, eax
jmp 0x477f8f
mov eax, 1
test al, al
je 0x477fd4
cmp dword [ebp - 4], 2
mov eax, 0x4201
jne 0x477fa1
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x164]
push edx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
cmp dword [ebp + 0x18], 0xffffffff
jne 0x477fc5
mov ecx, dword [ebp - 0x160]
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0x14], 0
jne 0x477fd4
lea eax, [ebp - 0x158]
mov dword [ebp + 0x14], eax
push 0x24
push 0
lea edx, [ebp - 0x188]
push edx
call fcn.0048d2a4
add esp, 0xc
mov dword [ebp - 0x188], 0x37
cmp dword [ebp + 0x14], 0
je 0x477ffc
mov ecx, dword [ebp + 0x14]
jmp 0x477fff
or ecx, 0xffffffff
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x168], ebx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x184], eax
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x178], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x174], eax
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x16c], edx
push ecx
push 0
push 0x401
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x478066
push edi
push dword [ebp + 0xc]
push 0x14a
push dword [esi]
call sub.USER32.DLL_SendMessageA
push ebx
push eax
push 0x151
push dword [esi]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x478070
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbf4
mov esi, eax
mov eax, 0x4b982c
call fcn.00463efc
mov edi, eax
test edi, edi
je 0x4780f7
xor eax, eax
mov dword [esp], eax
push esp
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x4780e4
xor ebx, ebx
push 0
push ebx
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x4780e4
mov edx, dword [eax + 4]
test edx, edx
je 0x4780db
push edx
push edi
push 0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x4780db
push 0
push ebx
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x4780e4
inc ebx
cmp ebx, 0x80
jl 0x47809d
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x47819b
lea ecx, [esp + 0xc]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov byte [esp + 4], 0
xor edi, edi
push 0
push edi
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47816c
cmp dword [ebx], 0
jne 0x478163
movzx ebp, byte [ebx + 8]
push ebp
call fcn.00491378
pop ecx
push eax
xor eax, eax
mov al, byte [esp + 0x10]
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
call fcn.00491378
pop ecx
pop edx
cmp edx, eax
jne 0x478163
push 0
push edi
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov byte [esp + 4], 1
jmp 0x47816c
inc edi
cmp edi, 0x80
jl 0x47810d
cmp byte [esp + 4], 0
jne 0x478182
lea ecx, [esp + 0xc]
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00478344
cmp dword [0x4bc1a0], 0
je 0x478194
mov eax, esi
call fcn.004785cc
jmp 0x47819b
mov eax, esi
call fcn.004785a4
add esp, 0x40c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4781a8
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
push dword [ebx]
call sub.USER32.DLL_GetWindowTextA
mov eax, esp
call fcn.00444ab8
mov edx, esp
push edx
push 0xffffffffffffffff
push 0x158
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x478210
push 0
push eax
push 0x14e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov eax, ebx
call fcn.00478264
cmp dword [0x4bc1a0], 0
je 0x478207
mov eax, ebx
call fcn.004785cc
jmp 0x47825a
mov eax, ebx
call fcn.004785a4
jmp 0x47825a
cmp dword [0x4bc1a0], 0
je 0x478234
mov eax, esp
call fcn.0040bf3c
test al, al
jne 0x478234
mov edx, esp
mov eax, 0x4b982c
xor ecx, ecx
call fcn.00461b34
jmp 0x47825a
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x478253
test al, 0x10
jne 0x478253
mov edx, esp
mov eax, 0x4b982c
xor ecx, ecx
call fcn.004619c4
jmp 0x47825a
mov eax, esp
call fcn.00444f38
add esp, 0x400
pop ebx
ret

Function at 0x4785a4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov ecx, esp
mov edx, esp
mov eax, ebx
call fcn.00478344
add esp, 0x400
pop ebx
ret
Function at 0x47877c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
cmp ecx, 0x4e
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
jne 0x47885f
mov edx, eax
mov ecx, dword [edx + 8]
sub ecx, 0xfffffcdb
je 0x4787ab
sub ecx, 5
je 0x4787c5
jmp 0x47885b
cmp dword [eax + 0x118], 2
jne 0x4787be
mov eax, 0x4b9d74
call fcn.004781a8
xor eax, eax
jmp 0x47886a
mov ebx, eax
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x2c]
cmp dword [eax], 4
jne 0x4787d7
mov edi, dword [eax + 4]
jmp 0x4787da
lea edi, [eax + 8]
cmp dword [eax], 4
jne 0x4787e6
mov eax, 8
jmp 0x4787e8
xor eax, eax
test esi, 1
mov dword [ebp - 4], eax
je 0x47881e
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x164]
or edx, 0x200
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x47881e
lea eax, [ebp - 0x158]
mov dword [ebx + 0x14], eax
test esi, 6
je 0x478850
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x2c4]
or edx, 0x4001
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x2c0]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x1c], eax
or dword [ebx + 0xc], 0x10000000
xor eax, eax
jmp 0x47886a
xor eax, eax
jmp 0x47886a
push eax
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x478994
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov byte [ebp - 1], cl
push dword [ebp + 8]
mov ebx, edx
call sub.USER32.DLL_GetSysColor
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4789c6
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [edx*8 + 0x4a1b28]
jmp 0x4789d4
mov eax, ebx
shl eax, 3
sub eax, ebx
mov ecx, dword [eax*8 + 0x4a1b2c]
cmp byte [ebp - 1], 0
mov ebx, ecx
jne 0x478a13
push 2
push ebx
push dword [0x4a6fb0]
call sub.KERNEL32.DLL_FindResourceA
push eax
push dword [0x4a6fb0]
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x478a01
mov edx, 4
jmp 0x478a05
movzx edx, word [eax + 0xe]
mov eax, edx
cmp eax, 8
je 0x478a13
mov dword [ebp - 0xc], 0x800080
push 1
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [0x4a6fb0]
call sub.COMCTL32.DLL_CreateMappedBitmap
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x479efc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov ebx, eax
lea edi, [esp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x479f1b
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
mov edx, 0x4a2195
mov eax, 0x4a2130
mov ecx, 1
call fcn.004659f0
test eax, eax
je 0x47a06e
mov esi, 0x56000944
push 0
push dword [0x4a6fb4]
push 0xd
push dword [0x4b9818]
push 0
push 0
push 0
push 0
push esi
push 0
push 0x4a2162
push 0
call sub.USER32.DLL_CreateWindowExA
mov ebp, eax
mov dword [ebx + 4], ebp
push 0
push 0x14
push 0x41e
push ebp
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x41f
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x420
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0
mov edx, 0x4a219f
mov eax, 0x4ba040
mov ecx, 0xf
call fcn.0047cf78
test eax, eax
jne 0x479fbc
mov eax, dword [ebx + 0x1c]
xor edx, edx
mov ecx, esp
mov dword [esp], edx
mov dword [esp + 4], eax
push ecx
push 1
push 0x413
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x4a1f84
push 1
push 0x414
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
mov ecx, edi
mov edx, 2
mov eax, ebx
call fcn.0047a0f4
mov dword [edi], 0x38
mov dword [edi + 4], 0x173
cmp dword [edi + 8], 0
jne 0x47a010
or dword [edi + 8], 1
or dword [edi + 8], 4
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x34], 2
mov dword [edi + 0x24], edx
push 0x12
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0xc], eax
push 0xf
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0x10], eax
cmp dword [edi + 0x2c], 0
jne 0x47a047
mov dword [edi + 0x2c], 0x28
mov eax, dword [0x4b9d74]
lea edx, [esp + 0x58]
push edx
push eax
call sub.USER32.DLL_GetClientRect
mov ecx, dword [esp + 0x64]
mov dword [edi + 0x28], ecx
push edi
push 0xffffffffffffffff
push 0x401
push dword [ebx + 8]
call sub.USER32.DLL_SendMessageA
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47cc1c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov esi, edx
mov ebx, eax
cmp esi, 0xa6
jne 0x47cc3c
mov eax, ebx
call fcn.0047d5a0
mov al, 1
jmp 0x47cd43
cmp esi, 0xa7
jne 0x47cc68
push 1
push 0x4a22fc
push 0
mov eax, 0x4f7
call fcn.004117b8
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, 1
jmp 0x47cd43
mov eax, ebx
call fcn.0047cae0
mov edi, eax
cmp esi, 0xa8
jne 0x47cc99
mov dword [ebx + 0x114], 0xffffffff
mov ecx, 0x4a22fc
mov edx, 0x4a22fd
mov eax, 0x4a22ec
call fcn.00465650
jmp 0x47cd15
cmp esi, 0x3e8
jl 0x47cca9
cmp esi, 0x428
jl 0x47ccb0
xor eax, eax
jmp 0x47cd43
push 0x2c
push 0
lea edx, [esp + 8]
push edx
call fcn.0048d2a4
add esp, 0xc
mov dword [esp], 0x2c
mov dword [esp + 4], 0x20
push esp
push 0
push esi
push edi
call sub.USER32.DLL_GetMenuItemInfoA
test eax, eax
jne 0x47cce2
xor eax, eax
jmp 0x47cd43
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x10c]
jb 0x47ccf2
xor eax, eax
jmp 0x47cd43
mov edx, eax
mov eax, 0x4a22ec
imul ecx, edx, 0x584
mov dword [ebx + 0x114], edx
mov edx, 0x4a22fd
add ecx, dword [ebx + 0x108]
call fcn.00465650
mov eax, dword [ebx + 0x518]
cmp eax, 0xffffffff
je 0x47cd29
push 0
push eax
push edi
call sub.USER32.DLL_CheckMenuItem
push 8
push esi
push edi
call sub.USER32.DLL_CheckMenuItem
mov dword [ebx + 0x518], esi
xor edx, edx
mov eax, ebx
call fcn.0047ce50
mov al, 1
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x4843a6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.004844fc
push 0xc
push ebx
lea edx, [esp + 8]
push edx
call fcn.0048d234
add esp, 0xc
xor ebx, ebx
call fcn.00484474
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.00484498
inc ebx
cmp ebx, 0xc
jl 0x4843c6
mov edx, dword [0x4cb82c]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x28], 2
je 0x4843ff
movzx ecx, word [0x4db892]
sar ecx, 8
jmp 0x48440b
mov ecx, dword [0x4db898]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x484417
or eax, 0xffffffff
jmp 0x48446b
mov eax, dword [0x4db840]
cdq
cmp edx, dword [0x4cad04]
jne 0x484430
cmp eax, dword [0x4cad00]
jbe 0x48443c
jmp 0x484432
jle 0x48443c
mov eax, dword [0x4cad00]
mov ebx, eax
jmp 0x484444
mov eax, dword [0x4db840]
mov ebx, eax
mov esi, dword [0x4db83c]
jmp 0x484460
call fcn.00484474
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.00484498
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x48444c
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x484498
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4dbb58]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4a88cc]
xor ecx, edx
mov dword [0x4dbb58], ecx
and ecx, 0xff
add dword [0x4dbb5c], ecx
imul edx, dword [0x4dbb5c], 0x8088405
inc edx
mov dword [0x4dbb5c], edx
shr edx, 0x18
mov ecx, dword [0x4dbb60]
xor edx, ecx
and edx, 0xff
shr ecx, 8
mov edx, dword [edx*4 + 0x4a88cc]
xor edx, ecx
mov dword [0x4dbb60], edx
ret

Function at 0x484811
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4dbbdc
push ebx
mov ecx, dword [edx]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr ecx, 8
mov ebx, dword [ebx*4 + 0x4a88cc]
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
mov ebx, dword [edx + 8]
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4a88cc]
xor ecx, ebx
mov dword [edx + 8], ecx
pop ebx
ret

Function at 0x484974
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x4b03f4], 0
je 0x4849b9
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x4849b9
call fcn.004847f0
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.00484811
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x48499d
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0048f7e4
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x484b09
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4dbc00
mov edi, 0x4dbbf8
xor ebx, ebx
mov dword [0x4dbbfc], 2
jmp 0x484c99
mov edx, dword [0x4a2b20]
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [edx + eax + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4dbbe8]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
and eax, 0x7fff
mov edx, dword [0x4a2b24]
mov word [edx + eax*2], bp
mov eax, dword [0x4dbbe8]
mov ecx, dword [edi]
mov dx, word [esi]
mov word [eax + ecx*2], dx
test ebp, ebp
je 0x484b91
mov eax, dword [esi]
sub eax, ebp
cmp eax, 0x7efa
ja 0x484b91
mov eax, ebp
call fcn.00484efc
mov ebx, eax
mov eax, dword [0x4dbc0c]
cmp ebx, eax
jbe 0x484b91
mov ebx, eax
cmp ebx, 3
jb 0x484c3b
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4dbc04]
call fcn.00486b1c
sub dword [0x4dbc0c], ebx
cmp ebx, dword [0x4dbc14]
ja 0x484c0d
dec ebx
inc dword [esi]
mov ecx, dword [0x4a2b20]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4dbbe8]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4a2b24]
mov word [ecx + edx*2], bp
mov edx, dword [0x4dbbe8]
mov ecx, dword [edi]
mov bp, word [esi]
mov word [edx + ecx*2], bp
dec ebx
jne 0x484bbb
inc dword [esi]
jmp 0x484c55
add dword [esi], ebx
xor ebx, ebx
mov ecx, dword [esi]
mov edx, dword [0x4a2b20]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ebp, dword [esi]
mov ecx, dword [0x4a2b20]
shl edx, 5
movzx ecx, byte [ecx + ebp + 1]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x484c55
mov eax, dword [0x4a2b20]
mov edx, dword [esi]
movzx edx, byte [eax + edx]
xor eax, eax
call fcn.00486b1c
dec dword [0x4dbc0c]
inc dword [esi]
test eax, eax
je 0x484c88
mov edx, dword [esi]
sub edx, dword [0x4dbbf0]
cmp dword [0x4dbbf0], 0
jl 0x484c77
mov eax, dword [0x4a2b20]
add eax, dword [0x4dbbf0]
jmp 0x484c79
xor eax, eax
xor ecx, ecx
call fcn.00486940
mov edx, dword [esi]
mov dword [0x4dbbf0], edx
cmp dword [0x4dbc0c], 0x106
jae 0x484c99
call fcn.004849d8
cmp dword [0x4dbc0c], 0
jne 0x484b28
mov edx, dword [esi]
sub edx, dword [0x4dbbf0]
cmp dword [0x4dbbf0], 0
jl 0x484cc4
mov eax, dword [0x4a2b20]
add eax, dword [0x4dbbf0]
jmp 0x484cc6
xor eax, eax
mov ecx, 1
call fcn.00486940
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x484cd8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
mov esi, 0x4dbbf8
cmp ebx, 1
jl 0x484cef
cmp ebx, 9
jle 0x484cf9
mov eax, 0x4a2b78
call fcn.004885c8
xor edx, edx
mov dword [0x4dbbf4], edx
cmp dword [0x4dbbec], 0
jne 0x484d1e
mov dword [0x4dbbf4], 1
mov dword [0x4dbbec], 0x10000
cmp dword [0x4a2b20], 0
jne 0x484d5b
push 2
push 0x8000
call fcn.0048b9fc
add esp, 8
mov edi, eax
mov dword [0x4a2b20], edi
test edi, edi
jne 0x484d5b
mov eax, 0x4a697c
call fcn.00429774
mov edx, 0x4a2b78
mov eax, 4
call fcn.0048848c
cmp dword [0x4a2b24], 0
jne 0x484dbe
push 2
push 0x8000
call fcn.0048b9fc
add esp, 8
mov dword [0x4a2b24], eax
push 2
push 0x8000
call fcn.0048b9fc
add esp, 8
mov dword [0x4dbbe8], eax
cmp dword [0x4a2b24], 0
je 0x484d9e
cmp dword [0x4dbbe8], 0
jne 0x484dbe
mov eax, 0x1ff
call fcn.004117b8
push eax
call fcn.0044a23c
pop ecx
mov edx, 0x4a2b78
mov eax, 4
call fcn.0048848c
mov eax, dword [0x4dbbe8]
mov word [eax + 0xfffe], 0
push 0xfffe
push 0
push eax
call fcn.0048d2a4
movzx edx, word [ebx*8 + 0x4a2b2a]
mov dword [0x4dbc14], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x4a2b28]
mov dword [0x4dbc18], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x4a2b2c]
mov dword [0x4dbc1c], eax
movzx edx, word [ebx*8 + 0x4a2b2e]
mov dword [0x4dbc10], edx
jg 0x484e1f
or word [ebp], 4
jmp 0x484e29
cmp ebx, 8
jl 0x484e29
or word [ebp], 2
xor ecx, ecx
xor eax, eax
mov dword [0x4dbc00], ecx
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4dbbf0], eax
mov eax, dword [0x4a2b20]
mov edx, ebx
call dword [0x4a2f08]
mov dword [0x4dbc0c], eax
mov eax, dword [0x4dbc0c]
test eax, eax
je 0x484e5f
cmp eax, 0xffffffff
jne 0x484e73
mov dword [0x4dbc08], 1
xor edx, edx
mov dword [0x4dbc0c], edx
jmp 0x484eb1
xor ecx, ecx
mov dword [0x4dbc08], ecx
cmp dword [0x4dbc0c], 0x106
jae 0x484e8c
call fcn.004849d8
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov edx, dword [0x4a2b20]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x484e92
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48cc60
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x48e50c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x48e528
call fcn.0048fc70
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x48e544
test bl, 1
je 0x48e544
call fcn.00493c54
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x48e728
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0048f82c
test byte [ebp + 0xd], 0xc0
jne 0x48e74c
mov eax, dword [0x4a3ac0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x48e759
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x48e786
je 0x48e798
sub ecx, 0x100
je 0x48e7a6
sub ecx, 0x100
je 0x48e7ad
sub ecx, 0x100
je 0x48e79f
jmp 0x48e7b4
sub ecx, 0x600
je 0x48e7ad
sub ecx, 0x100
je 0x48e798
jmp 0x48e7b4
mov edi, 1
jmp 0x48e7b9
mov edi, 2
jmp 0x48e7b9
mov edi, 4
jmp 0x48e7b9
mov edi, 5
jmp 0x48e7b9
mov edi, 3
test byte [ebp + 0xd], 1
je 0x48e7e0
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4a3538]
test al, 0x80
je 0x48e7d9
mov ebx, 0x80
jmp 0x48e7f2
mov ebx, 1
jmp 0x48e7f2
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x48e7f2
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x48e804
je 0x48e80d
dec eax
je 0x48e816
jmp 0x48e81f
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x48e82e
mov dword [ebp - 4], 0x40000000
jmp 0x48e82e
mov dword [ebp - 4], 0xc0000000
jmp 0x48e82e
push 1
call fcn.0048fc04
pop ecx
mov ebx, eax
jmp 0x48e91e
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x48e84a
sub eax, 0x10
je 0x48e851
sub eax, 0x10
je 0x48e85a
sub eax, 0x10
je 0x48e863
jmp 0x48e863
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x48e86a
mov dword [ebp - 8], 1
jmp 0x48e86a
mov dword [ebp - 8], 2
jmp 0x48e86a
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x48e8d7
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x48e8cc
test byte [ebp + 0xd], 1
je 0x48e8c7
mov ebx, 0x50
jmp 0x48e8cc
mov ebx, 2
push ebx
call fcn.0048fc04
pop ecx
mov ebx, eax
jmp 0x48e91e
mov edi, esi
push edi
call fcn.0048e68c
pop ecx
test eax, eax
je 0x48e8eb
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x48e8f7
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0048f92c
add esp, 8
mov ebx, eax
inc eax
jne 0x48e91e
push 4
call fcn.0048fc04
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0048f860
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret