joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dd2c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4d24a4]
cmp byte [eax + 0xc], 0
je 0x44de99
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44de92
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d3b74], 0
jne 0x44dd80
push 0x44dea0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44dea8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b74], eax
cmp dword [0x4cce68], 0
jne 0x44de7b
push 0x44deb8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4cce68], eax
cmp dword [0x4cce68], 0
je 0x44de7b
push 0x44dec4
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b78], eax
push 0x44ded4
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b7c], eax
push 0x44dee8
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b80], eax
push 0x44df00
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b84], eax
push 0x44df18
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b88], eax
push 0x44df2c
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b8c], eax
push 0x44df44
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b90], eax
push 0x44df5c
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b94], eax
push 0x44df78
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b98], eax
push 0x44df84
mov eax, dword [0x4cce68]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d3b9c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44de99
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x451d24
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404774
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x451d73
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004049e4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a8d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45a928]
test si, 4
je 0x45a8ec
or bl, 1
test si, 8
je 0x45a8f6
or bl, 4
test si, 1
je 0x45a900
or bl, 8
test si, 2
je 0x45a90a
or bl, 0x10
test si, 0x10
je 0x45a914
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45a923
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45a92c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45a964]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45a945
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45a954
or bl, 4
test esi, 0x20000000
je 0x45a95f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x461440
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x461452
add esp, 0xfffffff0
call fcn.00403bbc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424878
mov eax, dword [0x4d1f48]
mov dword [eax + 4], ebx
mov dword [eax], 0x4617e4
mov eax, dword [0x4d1f5c]
mov dword [eax + 4], ebx
mov dword [eax], 0x4617f0
mov eax, ebx
call fcn.004617fc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41b7bc]
call fcn.00403854
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41b7bc]
call fcn.00403854
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41b7bc]
call fcn.00403854
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41b7bc]
call fcn.00403854
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41b7bc]
call fcn.00403854
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45dc14
push eax
push 0
push 0
mov eax, dword [0x4d2174]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x426914]
call fcn.0042814c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x426914]
call fcn.0042814c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x426914]
call fcn.0042814c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00461c4c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x461b14
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x461b14
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x461b14
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46158f
call fcn.00403c14
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4618f8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461aa3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x461a84
mov dl, 1
mov eax, dword [0x41be20]
call fcn.00403854
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404774
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x461a73
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044e08c
test al, al
je 0x461a66
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x461ab4
lea eax, [ebp - 0x254]
call fcn.0040a16c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x461a66
xor eax, eax
push ebp
push 0x461a5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x461aec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x461a48
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004049e4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x461a48
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004049e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461a66
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x461969
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004204cc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461aaa
lea eax, [ebp - 0x260]
call fcn.00404774
ret

Function at 0x4623ec
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4d3bc0]
cmp byte [eax + 0xa5], 0
jne 0x46245d
cmp dword [0x4d3bd8], 0
jne 0x46241e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4623a8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4d3bd8], eax
cmp dword [0x4d3bd4], 0
jne 0x462439
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4d3bd4], eax
cmp dword [0x4d3bdc], 0
jne 0x46245d
push esp
push 0
push 0
push 0x46234c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4d3bdc], eax
pop edx
ret
Function at 0x462af0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4d3bc0]
cmp dword [eax + 0x30], 0
je 0x462b9a
cmp dword [ebx + 0x94], 0
jne 0x462b94
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x462a80
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x462b94
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x462b5a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x462b94
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e14c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x462b69
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4636f8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46372d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404864
jmp 0x46373a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047c8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x464904
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x464945
mov eax, esi
call fcn.00449654
test al, al
je 0x464945
mov eax, dword [ebx + 0x84]
call fcn.00449350
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x464945
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449350
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x470aa0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x470b57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404c34
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x470ae2
call fcn.00404194
jmp 0x470b5e
mov eax, ebx
call fcn.00402b4c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404c34
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x470b0b
call fcn.00404194
jmp 0x470b5e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x470b68
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x470b2c
call fcn.00404194
jmp 0x470b5e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470b5e
mov eax, dword [ebp - 8]
call fcn.00402b7c
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47a2b8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47a2e6
mov eax, ebx
call fcn.0047ad6c
cmp dword [ebx + 0x40], 0
je 0x47a2df
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47a357
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47a349
cmp dword [ebx + 8], 0
je 0x47a308
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47a31a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47a349
cmp dword [ebx + 8], 0
je 0x47a2fb
cmp eax, 3
je 0x47a32d
dec eax
jne 0x47a2fb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47a2fb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47a2fb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47a375
cmp dword [ebx + 0x14], 0xcc
je 0x47a375
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047a380
pop ebx
ret
Function at 0x48c084
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x48c0b3
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x48c132
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0048a940
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48c100
mov cx, word [esp]
sub cx, si
jmp 0x48c102
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48c0e9
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48c128
mov cx, word [esp]
sub cx, si
jmp 0x48c12a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48c111
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48c18f
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0048bd58
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x48c17a
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x48c18f
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48c08e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x492734
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4d3ddc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x492756
shr eax, 1
xor eax, 0xedb88320
jmp 0x492758
shr eax, 1
dec edx
jne 0x492744
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49273d
mov byte [0x4d41dc], 1
pop esi
pop ebx
ret

Function at 0x492774
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4d41dc], 0
jne 0x49278b
call fcn.00492734
mov eax, edi
dec eax
test eax, eax
jl 0x4927b4
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d3ddc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x492795
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4952d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x495301
dec al
je 0x49533d
dec al
je 0x495381
dec al
je 0x4953ec
jmp 0x495476
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x495476
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x495311
jmp 0x495476
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x495476
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49534d
jmp 0x495476
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x495476
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4953af
xor ebp, ebp
jmp 0x4953c0
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4953c9
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x495391
jmp 0x495476
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x495476
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x495444
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004927bc
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x495400
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x499ddc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x499e4d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4d1784]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x499e37
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00499dcc
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x499bd8]
call fcn.00499e74
mov dword [0x4d17e8], eax
mov eax, dword [ebp - 4]
call fcn.00499d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499e54
lea eax, [ebp - 8]
call fcn.004065cc
ret

Function at 0x4b52b4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4b52d9
cmp dword [esp + 4], 5
jb 0x4b52d9
mov al, 1
jmp 0x4b52db
xor eax, eax
add esp, 0x94
ret
Function at 0x4c6b4c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c6cef
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d243c]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4c6d04
call fcn.00404a80
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4c6d18
call fcn.00404a80
mov eax, dword [ebp - 0x10]
call fcn.00404c34
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
call fcn.0040975c
test al, al
jne 0x4c6bb7
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004c5f70
mov eax, ebx
call fcn.004c5c70
mov edx, dword [0x4d243c]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4c6d28
call fcn.00404a80
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x4c6d44
call fcn.00404a80
mov eax, dword [ebp - 0x14]
call fcn.00404c34
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 8]
call fcn.0040975c
test al, al
jne 0x4c6c0c
mov eax, dword [ebp - 8]
push eax
push ebx
call fcn.004c64e8
mov eax, ebx
call fcn.004c5dec
jmp 0x4c6cc7
mov eax, ebx
call fcn.004c5c70
mov eax, ebx
call fcn.004c5dec
mov dl, 1
mov eax, dword [0x41be20]
call fcn.00403854
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c6cc0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x58]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004b98bc
mov edx, 0x4c6d58
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x4c6c77
mov eax, dword [ebx + 0x60]
call fcn.004b0c7c
mov eax, dword [ebx + 0x60]
call fcn.004c55d0
mov edx, 0x4c6d6c
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebx + 0x60]
call fcn.004c54f8
mov edx, 0x4c6efc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x4c6caa
mov eax, dword [ebx + 0x60]
call fcn.004b0c7c
mov eax, dword [ebx + 0x60]
call fcn.004c55d0
mov edx, 0x4c6f14
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebx + 0x60]
call fcn.004c54f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6cc7
mov eax, dword [ebp - 0xc]
call fcn.00403884
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6cf6
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404798
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404798
ret
Function at 0x4c75f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
xor eax, eax
push ebp
push 0x4c7754
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x222]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x14]
mov edx, 0x4c776c
call fcn.0040480c
lea edx, [ebp - 4]
mov eax, dword [0x4d1ea4]
call fcn.004656b8
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0x4c7790
call fcn.00406610
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0x4c77a0
call fcn.00406610
mov eax, dword [ebp - 0x14]
call fcn.00404c34
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 0x14]
call fcn.00409958
mov eax, dword [ebp - 0x228]
call fcn.00404c34
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x10]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.004049e4
lea eax, [ebp - 0x22c]
mov edx, 0x4c77b8
call fcn.00404a3c
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x18]
call fcn.00404ffc
push 0
mov eax, dword [ebp - 0x18]
call fcn.0040500c
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c775b
lea eax, [ebp - 0x22c]
mov edx, 2
call fcn.00404798
lea eax, [ebp - 0x18]
call fcn.00404e80
lea eax, [ebp - 0x14]
call fcn.00404774
lea eax, [ebp - 0xc]
call fcn.004065cc
lea eax, [ebp - 8]
call fcn.004065cc
lea eax, [ebp - 4]
call fcn.004065cc
ret