joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c25a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0xbc], esi
movdqu xmmword [ebp - 0x58], xmm0
movdqu xmmword [ebp - 0x48], xmm0
movdqu xmmword [ebp - 0x38], xmm0
movdqu xmmword [ebp - 0x28], xmm0
cmp edi, 0x40
jbe 0x4c2624
lea eax, [ebp - 0xb8]
push eax
call fcn.0047a1e0
push edi
push ebx
lea eax, [ebp - 0xb8]
push eax
call fcn.0047a220
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00479800
xor ecx, ecx
lea esp, [esp]
mov eax, dword [ebp + ecx - 0x18]
bswap eax
mov dword [ebp + ecx - 0x58], eax
add ecx, 4
cmp ecx, 0x14
jb 0x4c2610
jmp 0x4c2661
xor esi, esi
test edi, edi
je 0x4c265f
lea ebx, [ebx]
mov eax, esi
lea edx, [ebp - 0x58]
shr eax, 2
mov ecx, 3
lea edx, [edx + eax*4]
mov eax, esi
and eax, 3
sub ecx, eax
movzx eax, byte [ebx + esi]
shl ecx, 3
inc esi
shl eax, cl
or dword [edx], eax
cmp esi, edi
jb 0x4c2630
mov esi, dword [ebp - 0xbc]
jmp 0x4c2661
mov esi, ecx
movdqa xmm1, xmmword [str.6666666666666666jjjjjjjjjjjjjjjjP]
lea eax, [ebp - 0x48]
mov ecx, 2
lea eax, [eax + 0x20]
movdqu xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm1
movdqu xmmword [eax - 0x30], xmm0
movdqu xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm1
movdqu xmmword [eax - 0x20], xmm0
dec ecx
jne 0x4c2671
push esi
call fcn.0047a1e0
push 0x10
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.004797b0
movdqa xmm1, xmmword [0x6bcb10]
lea eax, [ebp - 0x48]
mov ecx, 2
jmp 0x4c26c0
lea eax, [eax + 0x20]
movdqu xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm1
movdqu xmmword [eax - 0x30], xmm0
movdqu xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm1
movdqu xmmword [eax - 0x20], xmm0
dec ecx
jne 0x4c26c0
add esi, 0x60
push esi
call fcn.0047a1e0
push 0x10
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.004797b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8
Function at 0x4c2710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
push edi
cmp eax, 0x40
jae 0x4c2820
mov byte [ebp + eax - 0x44], 0
inc eax
cmp eax, 0x40
jb 0x4c2733
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jbe 0x4c2760
push esi
call fcn.0047a1e0
push edi
push ebx
push esi
call fcn.0047a220
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00479800
jmp 0x4c2772
test edi, edi
je 0x4c2772
push edi
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.0066e160
add esp, 0xc
movdqa xmm1, xmmword [str.6666666666666666jjjjjjjjjjjjjjjjP]
xor eax, eax
lea esp, [esp]
movdqu xmm0, xmmword [ebp + eax - 0x44]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x44], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x34]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x34], xmm0
add eax, 0x20
cmp eax, 0x40
jb 0x4c2780
push esi
call fcn.0047a1e0
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.0047a220
movdqa xmm1, xmmword [0x6bcb10]
xor eax, eax
jmp 0x4c27d0
movdqu xmm0, xmmword [ebp + eax - 0x44]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x44], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x34]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x34], xmm0
add eax, 0x20
cmp eax, 0x40
jb 0x4c27d0
add esi, 0x60
push esi
call fcn.0047a1e0
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.0047a220
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8
call fcn.0066e9b7
int3

Function at 0x4c2de1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edx + 4]
mov ecx, dword [edx]
add esi, 2
lea esi, [edx + esi*4]
mov dword [ebp - 4], esi
test edi, edi
je 0x4c2e73
push ebx
mov ebx, dword [ebp + 0xc]
cmp ecx, 0x10
je 0x4c2e1a
mov al, byte [esi + ecx]
xor byte [ebx], al
inc ecx
inc ebx
dec edi
je 0x4c2e17
cmp ecx, 0x10
jne 0x4c2e08
mov dword [ebp + 0x10], edi
cmp edi, 0x10
jb 0x4c2e43
mov ecx, dword [ebp - 4]
mov esi, edi
shr esi, 4
add ecx, 0x10
push esi
mov edx, ebx
call dword [0x78d380]
shl esi, 4
add ebx, esi
sub edi, esi
mov esi, dword [ebp - 4]
push 0x10
mov dword [ebp + 0x10], edi
pop ecx
test edi, edi
je 0x4c2e6d
xor eax, eax
lea ecx, [esi + 0x10]
mov edi, esi
mov edx, esi
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x78d380]
mov edx, dword [ebp + 0x10]
xor ecx, ecx
sub esi, ebx
mov al, byte [esi + ebx]
xor byte [ebx], al
inc ecx
inc ebx
dec edx
jne 0x4c2e63
mov eax, dword [ebp + 8]
pop ebx
mov dword [eax], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c3194
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov ecx, 0x12345678
mov esi, 0x23456789
mov edx, 0x34567890
cmp dword [ebp + 0x10], edi
jbe 0x4c31f1
push ebx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [edi + ebx]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x78d3a0]
movzx eax, cl
add eax, esi
imul esi, eax, 0x8088405
inc esi
mov eax, esi
shr eax, 0x18
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x78d3a0]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x4c31b3
pop ebx
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x1c], edx
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x4c3205
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
push esi
mov ebx, dword [edx + 0xc]
mov eax, dword [edx + 0x10]
mov esi, dword [edx + 0x14]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4c328f
mov edx, eax
mov edi, dword [ebp + 0xc]
mov eax, esi
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 4]
shr ecx, 8
xor cl, byte [eax + edi]
movzx eax, cl
xor eax, ebx
shr ebx, 8
and eax, 0xff
xor ebx, dword [eax*4 + 0x78d3a0]
movzx eax, bl
add eax, edx
imul edx, eax, 0x8088405
inc edx
mov eax, edx
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [eax*4 + 0x78d3a0]
mov eax, dword [ebp - 4]
mov byte [eax + edi], cl
inc eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
cmp eax, edi
jb 0x4c3226
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, edi
pop edi
mov dword [edx + 0x14], esi
pop esi
mov dword [edx + 0xc], ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4c32a3
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov edi, dword [esi + 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], ecx
jbe 0x4c3330
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
mov dl, byte [ecx + eax]
mov eax, edi
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 4]
shr ecx, 8
xor cl, dl
mov byte [eax + esi], cl
mov ecx, 0xff
movzx eax, dl
xor eax, ebx
shr ebx, 8
and eax, ecx
xor ebx, dword [eax*4 + 0x78d3a0]
movzx eax, bl
add eax, dword [ebp - 8]
imul esi, eax, 0x8088405
inc esi
mov eax, esi
mov dword [ebp - 8], esi
shr eax, 0x18
xor eax, edi
shr edi, 8
and eax, ecx
mov ecx, dword [ebp - 4]
xor edi, dword [eax*4 + 0x78d3a0]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp + 0x10]
jb 0x4c32c4
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], edi
pop edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c33ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
movzx eax, al
push 0x40
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0066eb10
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
add esp, 0xc
xor edx, edx
sub esi, eax
lea ecx, [ebp - 0x44]
add ecx, edx
mov al, byte [esi + ecx]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x4c3436
lea eax, [ebp - 0xa4]
push eax
call fcn.0047a1e0
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0047a220
push edi
lea eax, [ebp - 0xa4]
push eax
call fcn.00479800
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c52fe
Capabilities:
Read file via mapping

Disassembly:
push 0x34
mov eax, 0x6aa0b3
call fcn.0066edc8
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.0047f05a
push 0x3a
push dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0047f611
mov esi, eax
test esi, esi
js 0x4c54bf
lea ecx, [esi + 1]
push ecx
push 0x3a
lea ecx, [ebp - 0x1c]
call fcn.0047f5c3
mov edi, eax
test edi, edi
js 0x4c54bf
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*2]
add ecx, 2
push ecx
lea ecx, [ebp - 0x40]
call fcn.0047f08b
cmp edi, dword [ebp - 0x18]
jae 0x4c5369
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x18], edi
mov word [eax + edi*2], cx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp + 0xc]
push ecx
lea eax, [eax + esi*2]
add eax, 2
push eax
call fcn.004c5a47
test al, al
je 0x4c54ad
mov ecx, dword [ebp + 0xc]
lea eax, [ecx - 2]
cmp eax, 0x7ffffffe
ja 0x4c54ad
test cl, 1
jne 0x4c54ad
cmp esi, dword [ebp - 0x18]
jae 0x4c53af
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x18], esi
mov word [eax + esi*2], cx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004c47c6
push dword [eax]
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4c53db
mov eax, ebx
jmp 0x4c53e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x34]
test eax, eax
setne bl
call fcn.00480130
pop ecx
test bl, bl
je 0x4c53fd
mov esi, str.Can_not_open_mapping
jmp 0x4c54a1
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebx
push eax
push eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4c541e
mov esi, str.MapViewOfFile_error
jmp 0x4c54a1
mov dword [ebp + 0xc], edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0047f0c1
xor eax, eax
mov byte [ebp - 4], 4
cmp word [edi], ax
je 0x4c543f
mov esi, str.Unsupported_Map_data
jmp 0x4c5491
xor esi, esi
shr ebx, 1
inc esi
cmp ebx, esi
jbe 0x4c5484
movzx eax, word [edi + esi*2]
test ax, ax
jne 0x4c5474
push dword [ebp + 0x18]
lea eax, [ebp - 0x28]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004c3d14
mov eax, dword [ebp - 0x28]
and dword [ebp - 0x24], 0
xor ecx, ecx
mov word [eax], cx
jmp 0x4c547d
push eax
lea ecx, [ebp - 0x28]
call fcn.0047e3b8
inc esi
cmp esi, ebx
jb 0x4c5448
xor eax, eax
cmp dword [ebp - 0x24], 0
mov esi, str.Map_data_error
jne 0x4c5491
mov esi, eax
push dword [ebp - 0x28]
call fcn.00480130
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea ecx, [ebp - 0x10]
call fcn.004c41ea
xor ebx, ebx
jmp 0x4c54b2
mov esi, str.Unsupported_Map_data_size
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.004c3b24
jmp 0x4c54c5
mov esi, dword [str.Incorrect_Map_command]
push dword [ebp - 0x1c]
call fcn.00480130
pop ecx
mov eax, esi
call fcn.0066ed96
ret 0x14
Function at 0x4cae12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x1c]
movlpd qword [ebp - 0x4c], xmm0
mov ecx, dword [ebp - 0x48]
push esi
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
push edi
mov dword [ebp - 0x50], edx
test ecx, ecx
ja 0x4caf1e
jb 0x4cae55
cmp eax, 0x40
jae 0x4caf1e
mov byte [ebp + eax - 0x44], 0
add eax, 1
adc ecx, 0
jne 0x4cae67
cmp eax, 0x40
jb 0x4cae42
cmp dword [ebp + 0x14], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x4c], xmm0
jb 0x4caf1a
ja 0x4cae85
cmp dword [ebp + 0x10], 0
jbe 0x4caf1a
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x4c]
test edx, edx
je 0x4caea3
movzx eax, byte [ebp - 0x4c]
or eax, 0
jne 0x4caea3
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 8]
test eax, eax
jne 0x4caf07
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push dword [ebp + 0xc]
mov eax, dword [ebx]
push dword [ebp - 0x54]
push ebx
call dword [eax + 0x10]
mov eax, dword [ebx]
lea ecx, [ebp - 0x44]
push ecx
push ebx
call dword [eax + 0x14]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x18]
mov edx, eax
xor eax, eax
cmp edx, 0x40
ja 0x4caf06
xor ecx, ecx
test edx, edx
je 0x4caedf
xor ecx, dword [ebp + eax - 0x44]
add eax, 4
cmp eax, edx
jb 0x4caed4
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4caeea
cmp ecx, dword [eax]
jne 0x4caf04
add esi, 1
mov dword [ebp - 0x4c], esi
adc edi, 0
cmp edi, dword [ebp + 0x14]
ja 0x4caf1a
jb 0x4caeff
cmp esi, dword [ebp + 0x10]
jae 0x4caf1a
mov edx, dword [ebp - 0x50]
jmp 0x4cae8b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 0x1c
xor eax, eax
jmp 0x4caf07
call fcn.0066e9b7
int3

Function at 0x4caf24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
or ecx, 0xffffffff
cmp dword [ebp + 0xc], edx
jbe 0x4caf51
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x78d3a0]
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x4caf35
pop esi
not ecx
mov eax, ecx
pop ebp
ret 8
Function at 0x4cdc21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test edx, edx
je 0x4cdd3c
mov ecx, dword [ebp + 0x10]
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
add eax, ecx
xor eax, ecx
dec edx
jne 0x4cdc35
pop ebp
ret 0xc
Function at 0x4e6960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x14], 0
je 0x4e69b8
lea eax, [ebp - 0x20c]
push eax
call fcn.00503b50
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x4e69cf
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00418f80
mov ecx, dword [ebp - 0x210]
or ecx, 1
mov dword [ebp - 0x210], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e85c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6accb2
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.00419670
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x4e862c
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419eb0
mov al, byte [ebp - 0x2c]
jmp 0x4e874b
mov edx, dword [ebp - 0x3c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4e865c
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419eb0
mov al, byte [ebp - 0x2d]
jmp 0x4e874b
mov eax, dword [ebp - 0x3c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x4e868c
mov byte [ebp - 0x2b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419eb0
mov al, byte [ebp - 0x2b]
jmp 0x4e874b
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4e86ba
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419eb0
mov al, byte [ebp - 0x29]
jmp 0x4e874b
mov edx, dword [ebp - 0x38]
add edx, 1
push edx
call fcn.00657741
add esp, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call fcn.0066eb10
add esp, 0xc
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call fcn.0066e160
add esp, 0xc
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004157b0
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
push edx
call fcn.00480130
add esp, 4
cmp dword [ebp - 0x40], 0
jne 0x4e8728
mov dword [ebp - 0x50], 0
jmp 0x4e8735
mov dword [ebp - 0x34], 0x8123
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x2a], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419eb0
mov al, byte [ebp - 0x2a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e8770
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x4e878f
cmp dword [ebp + 0x10], 0
jne 0x4e8799
mov eax, 0x80004003
jmp 0x4e88c6
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.0066eb10
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x214], edx
cmp dword [ebp - 0x214], 5
ja case.0x4e87d0.4
mov eax, dword [ebp - 0x214]
jmp dword [eax*4 + 0x4e88d4]
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004ecac0
add esp, 4
jmp 0x4e883d
lea edx, [ebp - 0x20c]
push edx
call fcn.004ecb90
add esp, 4
jmp 0x4e883d
lea eax, [ebp - 0x20c]
push eax
call fcn.004ecbf0
add esp, 4
jmp 0x4e883d
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004ecb20
add esp, 4
jmp 0x4e883d
lea edx, [ebp - 0x20c]
push edx
call fcn.004ecc50
add esp, 4
jmp 0x4e883d
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e8855
mov eax, 0x80004005
jmp 0x4e88c6
cmp dword [ebp + 0x18], 0
je 0x4e887b
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call fcn.00503b50
add esp, 4
push 1
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ecd20
add esp, 0x24
test eax, eax
je 0x4e88b6
mov dword [ebp - 0x210], 0
jmp 0x4e88c0
mov dword [ebp - 0x210], 0x80004005
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4e88f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.0066eb10
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
push 0x20019
push 0
push 0x6c1274
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x21c], eax
push 0xff
push 0
lea edx, [ebp - 0x208]
push edx
call fcn.0066eb10
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
mov dword [ebp - 0x210], 1
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push 0x6c129c
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x108]
push edx
call fcn.006724bc
add esp, 4
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jg 0x4e89cc
mov dword [ebp - 0x218], 0x20
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x218]
add ecx, 1
mov dword [ebp - 0x218], ecx
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.0066eb10
add esp, 0xc
mov eax, dword [ebp - 0x218]
push eax
push 0x6c12ac
lea ecx, [ebp - 0x108]
push ecx
call fcn.0066d97a
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
push 0x20006
push 0
push 0x6c12b0
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x108]
push eax
call fcn.00671990
add esp, 4
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push 0x6c12d8
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x2a
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.0066eb10
add esp, 0xc
mov edx, dword [ebp - 0x220]
push edx
push 0x6c12e8
lea eax, [ebp - 0x108]
push eax
call fcn.0066d97a
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
push 0x20006
push 0
push str.Control_Panel__Desktop__WindowMetrics
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x21c], eax
lea edx, [ebp - 0x108]
push edx
call fcn.00671990
add esp, 4
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Shell_Icon_Size
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x2a
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret