joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4c0d4f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4c0dce
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004bf5dc
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c0d9c
mov cx, word [esp]
sub cx, si
jmp 0x4c0d9e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c0d85
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c0dc4
mov cx, word [esp]
sub cx, si
jmp 0x4c0dc6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c0dad
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4c0e2b
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004c09f4
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4c0e16
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4c0e2b
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4c0d2a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c7364
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5492b0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4c7386
shr eax, 1
xor eax, 0xedb88320
jmp 0x4c7388
shr eax, 1
dec edx
jne 0x4c7374
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4c736d
mov byte [0x5496b0], 1
pop esi
pop ebx
ret

Function at 0x4c73a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5496b0], 0
jne 0x4c73bb
call fcn.004c7364
mov eax, edi
dec eax
test eax, eax
jl 0x4c73e3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5492b0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4c73c5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4c9d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45e]
movzx ecx, dl
cmp ecx, 6
ja case.0x4c9dba.0
jmp dword [ecx*4 + 0x4c9d53]
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x4c9d85
sub dl, 8
je 0x4c9d94
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c99cc
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9a24
jmp case.0x4c9dba.0
movzx ecx, byte [eax + 0x45d]
cmp ecx, 0x10
ja case.0x4c9dba.0
movzx ecx, byte [ecx + 0x4c9dc1]
jmp dword [ecx*4 + 0x4c9dd2]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9ad0
jmp case.0x4c9dba.0
cmp dl, 3
jne 0x4c9dff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9b24
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9ae0
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9b68
jmp case.0x4c9dba.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x4c9e2a
sub dl, 8
je 0x4c9e36
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9b94
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9c00
jmp case.0x4c9dba.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x4c9e55
sub dl, 8
je 0x4c9e61
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9cbc
jmp case.0x4c9dba.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4c9ce4
mov edx, dword [eax + 0x462]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x44d]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x451]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x449]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4c9f05
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x49]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004c8ed8
test eax, eax
je 0x4c9f05
mov eax, ebx
call fcn.004c9f10
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x462]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4c9e9e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c9f10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4c9f41
dec al
je 0x4c9f7c
dec al
je 0x4c9fc1
dec al
je 0x4ca02a
jmp 0x4ca0b4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4ca0b4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4c9f51
jmp 0x4ca0b4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ca0b4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4c9f8c
jmp 0x4ca0b4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ca0b4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4c9ff0
xor ebp, ebp
jmp 0x4ca000
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4ca009
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4c9fd1
jmp 0x4ca0b4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ca0b4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4ca083
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004c73ec
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ca03e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cfabc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x21], 0
je 0x4cfade
mov eax, dword [ebp - 4]
cmp dword [eax + 0x19], 0
jne 0x4cfc07
mov eax, dword [ebp - 4]
cmp dword [eax + 0x19], 0
jne 0x4cfaf9
mov dl, 1
mov eax, dword [0x44e880]
call fcn.00455004
mov edx, dword [ebp - 4]
mov dword [edx + 0x19], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x11]
mov ebx, dword [esi + 0xc]
mov eax, ebx
mov edx, dword [0x4c6b64]
call fcn.004043f4
test al, al
je 0x4cfb58
mov eax, ebx
mov dl, 1
call fcn.004d26dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cfb51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfb6c
mov eax, dword [ebp - 8]
call fcn.00404268
ret
mov eax, esi
call fcn.00452aac
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x23], 0
je 0x4cfc00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
dec esi
test esi, esi
jl 0x4cfc00
inc esi
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
mov edx, edi
call fcn.00455748
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x4cfbfc
inc ecx
movzx eax, byte [ebx]
movzx edx, byte [ebx + 3]
imul edx
push ecx
mov ecx, 0xff
xor edx, edx
div ecx
pop ecx
mov byte [ebx], al
movzx eax, byte [ebx + 1]
movzx edx, byte [ebx + 3]
imul edx
push ecx
mov ecx, 0xff
xor edx, edx
div ecx
pop ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx + 2]
movzx edx, byte [ebx + 3]
imul edx
push ecx
mov ecx, 0xff
xor edx, edx
div ecx
pop ecx
mov byte [ebx + 2], al
add ebx, 4
dec ecx
jne 0x4cfbb0
inc edi
dec esi
jne 0x4cfb8e
mov eax, dword [ebp - 4]
mov byte [eax + 0x21], 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4df6d4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor edx, edx
mov ecx, edx
mov edi, dword [esi + 0x154]
test edi, edi
je 0x4df70a
test dl, dl
jne 0x4df6f4
test byte [edi + 0x70], 0x10
setne dl
test cl, cl
jne 0x4df6ff
test byte [edi + 0x71], 0x10
setne cl
test cl, dl
jne 0x4df70a
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x4df6e9
test dl, dl
jne 0x4df71b
test byte [esi + 0xb8], 0x10
jne 0x4df71b
xor eax, eax
jmp 0x4df71d
mov al, 1
test cl, cl
jne 0x4df72e
test byte [esi + 0xb9], 0x10
jne 0x4df72e
xor ebx, ebx
jmp 0x4df730
mov bl, 1
mov byte [esp], bl
mov edi, dword [esi + 0x154]
test edi, edi
je 0x4df801
mov ebp, dword [edi + 0x70]
mov ebx, ebp
and ebx, 0x1f
sub ebx, 2
je 0x4df755
sub ebx, 2
je 0x4df775
jmp 0x4df793
test al, al
jne 0x4df76c
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x70], ebp
mov dl, 1
jmp 0x4df793
and dword [edi + 0x70], 0xff9fffff
jmp 0x4df793
test al, al
je 0x4df78c
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x70], ebp
mov dl, 1
jmp 0x4df793
and dword [edi + 0x70], 0xff9fffff
mov ebx, dword [edi + 0x70]
and ebx, 0x1f00
sub ebx, 0x200
je 0x4df7ae
sub ebx, 0x200
je 0x4df7d3
jmp 0x4df7f6
cmp byte [esp], 0
jne 0x4df7ca
mov ecx, dword [edi + 0x70]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x70], ecx
mov cl, 1
jmp 0x4df7f6
and dword [edi + 0x70], 0x9fffffff
jmp 0x4df7f6
cmp byte [esp], 0
je 0x4df7ef
mov ecx, dword [edi + 0x70]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x70], ecx
mov cl, 1
jmp 0x4df7f6
and dword [edi + 0x70], 0x9fffffff
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x4df741
test dl, dl
je 0x4df81f
mov edx, dword [esi + 0xb8]
or edx, 0x400000
or edx, 0x100000
mov dword [esi + 0xb8], edx
jmp 0x4df829
and dword [esi + 0xb8], 0xffafffff
mov edx, dword [esi + 0xb8]
mov ebx, edx
and ebx, 0x1f
sub ebx, 2
je 0x4df840
sub ebx, 2
je 0x4df85b
jmp 0x4df874
test al, al
jne 0x4df852
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xb8], edx
jmp 0x4df874
and dword [esi + 0xb8], 0xffffff9f
jmp 0x4df874
test al, al
je 0x4df86d
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xb8], edx
jmp 0x4df874
and dword [esi + 0xb8], 0xffffff9f
test cl, cl
je 0x4df890
mov eax, dword [esi + 0xb8]
or eax, 0x40000000
or eax, 0x10000000
mov dword [esi + 0xb8], eax
jmp 0x4df89a
and dword [esi + 0xb8], 0xafffffff
mov eax, dword [esi + 0xb8]
mov edx, eax
and edx, 0x1f00
sub edx, 0x200
je 0x4df8ba
sub edx, 0x200
je 0x4df8de
jmp 0x4df900
cmp byte [esp], 0
jne 0x4df8d2
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xb8], eax
jmp 0x4df900
and dword [esi + 0xb8], 0xffff9fff
jmp 0x4df900
cmp byte [esp], 0
je 0x4df8f6
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xb8], eax
jmp 0x4df900
and dword [esi + 0xb8], 0xffff9fff
mov edi, dword [esi + 0x144]
mov eax, edi
call fcn.004d50d8
mov ebx, dword [edi + 0x20]
test ebx, ebx
jle 0x4df92b
dec ebx
mov edx, ebx
mov eax, edi
call fcn.004d59f0
mov edx, dword [eax]
mov eax, esi
call fcn.004df3d0
test ebx, ebx
jne 0x4df914
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dff50
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor edx, edx
mov ecx, edx
mov edi, dword [esi + 0x154]
test edi, edi
je 0x4dff8c
test dl, dl
jne 0x4dff73
test byte [edi + 0x80], 0x10
setne dl
test cl, cl
jne 0x4dff81
test byte [edi + 0x81], 0x10
setne cl
test cl, dl
jne 0x4dff8c
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x4dff65
test dl, dl
jne 0x4dff9d
test byte [esi + 0xc8], 0x10
jne 0x4dff9d
xor eax, eax
jmp 0x4dff9f
mov al, 1
test cl, cl
jne 0x4dffb0
test byte [esi + 0xc9], 0x10
jne 0x4dffb0
xor ebx, ebx
jmp 0x4dffb2
mov bl, 1
mov byte [esp], bl
mov edi, dword [esi + 0x154]
test edi, edi
je 0x4e00a7
mov ebp, dword [edi + 0x80]
mov ebx, ebp
and ebx, 0x1f
sub ebx, 2
je 0x4dffda
sub ebx, 2
je 0x4e0000
jmp 0x4e0024
test al, al
jne 0x4dfff4
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x80], ebp
mov dl, 1
jmp 0x4e0024
and dword [edi + 0x80], 0xff9fffff
jmp 0x4e0024
test al, al
je 0x4e001a
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x80], ebp
mov dl, 1
jmp 0x4e0024
and dword [edi + 0x80], 0xff9fffff
mov ebx, dword [edi + 0x80]
and ebx, 0x1f00
sub ebx, 0x200
je 0x4e0042
sub ebx, 0x200
je 0x4e0070
jmp 0x4e009c
cmp byte [esp], 0
jne 0x4e0064
mov ecx, dword [edi + 0x80]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x80], ecx
mov cl, 1
jmp 0x4e009c
and dword [edi + 0x80], 0x9fffffff
jmp 0x4e009c
cmp byte [esp], 0
je 0x4e0092
mov ecx, dword [edi + 0x80]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x80], ecx
mov cl, 1
jmp 0x4e009c
and dword [edi + 0x80], 0x9fffffff
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x4dffc3
test dl, dl
je 0x4e00c5
mov edx, dword [esi + 0xc8]
or edx, 0x400000
or edx, 0x100000
mov dword [esi + 0xc8], edx
jmp 0x4e00cf
and dword [esi + 0xc8], 0xffafffff
mov edx, dword [esi + 0xc8]
mov ebx, edx
and ebx, 0x1f
sub ebx, 2
je 0x4e00e6
sub ebx, 2
je 0x4e0101
jmp 0x4e011a
test al, al
jne 0x4e00f8
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xc8], edx
jmp 0x4e011a
and dword [esi + 0xc8], 0xffffff9f
jmp 0x4e011a
test al, al
je 0x4e0113
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xc8], edx
jmp 0x4e011a
and dword [esi + 0xc8], 0xffffff9f
test cl, cl
je 0x4e0136
mov eax, dword [esi + 0xc8]
or eax, 0x40000000
or eax, 0x10000000
mov dword [esi + 0xc8], eax
jmp 0x4e0140
and dword [esi + 0xc8], 0xafffffff
mov eax, dword [esi + 0xc8]
mov edx, eax
and edx, 0x1f00
sub edx, 0x200
je 0x4e0160
sub edx, 0x200
je 0x4e0184
jmp 0x4e01a6
cmp byte [esp], 0
jne 0x4e0178
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xc8], eax
jmp 0x4e01a6
and dword [esi + 0xc8], 0xffff9fff
jmp 0x4e01a6
cmp byte [esp], 0
je 0x4e019c
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xc8], eax
jmp 0x4e01a6
and dword [esi + 0xc8], 0xffff9fff
mov edi, dword [esi + 0x148]
mov eax, edi
call fcn.004d50d8
mov ebx, dword [edi + 0x20]
test ebx, ebx
jle 0x4e01d1
dec ebx
mov edx, ebx
mov eax, edi
call fcn.004d59f0
mov edx, dword [eax]
mov eax, esi
call fcn.004dfc40
test ebx, ebx
jne 0x4e01ba
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e0710
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
xor edx, edx
mov ecx, edx
mov edi, dword [esi + 0x154]
test edi, edi
je 0x4e074c
test dl, dl
jne 0x4e0733
test byte [edi + 0x8c], 0x10
setne dl
test cl, cl
jne 0x4e0741
test byte [edi + 0x8d], 0x10
setne cl
test cl, dl
jne 0x4e074c
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x4e0725
test dl, dl
jne 0x4e075d
test byte [esi + 0xd4], 0x10
jne 0x4e075d
xor eax, eax
jmp 0x4e075f
mov al, 1
test cl, cl
jne 0x4e0770
test byte [esi + 0xd5], 0x10
jne 0x4e0770
xor ebx, ebx
jmp 0x4e0772
mov bl, 1
mov byte [esp], bl
mov edi, dword [esi + 0x154]
test edi, edi
je 0x4e0867
mov ebp, dword [edi + 0x8c]
mov ebx, ebp
and ebx, 0x1f
sub ebx, 2
je 0x4e079a
sub ebx, 2
je 0x4e07c0
jmp 0x4e07e4
test al, al
jne 0x4e07b4
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x8c], ebp
mov dl, 1
jmp 0x4e07e4
and dword [edi + 0x8c], 0xff9fffff
jmp 0x4e07e4
test al, al
je 0x4e07da
or ebp, 0x400000
or ebp, 0x200000
mov dword [edi + 0x8c], ebp
mov dl, 1
jmp 0x4e07e4
and dword [edi + 0x8c], 0xff9fffff
mov ebx, dword [edi + 0x8c]
and ebx, 0x1f00
sub ebx, 0x200
je 0x4e0802
sub ebx, 0x200
je 0x4e0830
jmp 0x4e085c
cmp byte [esp], 0
jne 0x4e0824
mov ecx, dword [edi + 0x8c]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x8c], ecx
mov cl, 1
jmp 0x4e085c
and dword [edi + 0x8c], 0x9fffffff
jmp 0x4e085c
cmp byte [esp], 0
je 0x4e0852
mov ecx, dword [edi + 0x8c]
or ecx, 0x40000000
or ecx, 0x20000000
mov dword [edi + 0x8c], ecx
mov cl, 1
jmp 0x4e085c
and dword [edi + 0x8c], 0x9fffffff
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x4e0783
test dl, dl
je 0x4e0885
mov edx, dword [esi + 0xd4]
or edx, 0x400000
or edx, 0x100000
mov dword [esi + 0xd4], edx
jmp 0x4e088f
and dword [esi + 0xd4], 0xffafffff
mov edx, dword [esi + 0xd4]
mov ebx, edx
and ebx, 0x1f
sub ebx, 2
je 0x4e08a6
sub ebx, 2
je 0x4e08c1
jmp 0x4e08da
test al, al
jne 0x4e08b8
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xd4], edx
jmp 0x4e08da
and dword [esi + 0xd4], 0xffffff9f
jmp 0x4e08da
test al, al
je 0x4e08d3
or edx, 0x20
or edx, 0x40
mov dword [esi + 0xd4], edx
jmp 0x4e08da
and dword [esi + 0xd4], 0xffffff9f
test cl, cl
je 0x4e08f6
mov eax, dword [esi + 0xd4]
or eax, 0x40000000
or eax, 0x10000000
mov dword [esi + 0xd4], eax
jmp 0x4e0900
and dword [esi + 0xd4], 0xafffffff
mov eax, dword [esi + 0xd4]
mov edx, eax
and edx, 0x1f00
sub edx, 0x200
je 0x4e0920
sub edx, 0x200
je 0x4e0944
jmp 0x4e0966
cmp byte [esp], 0
jne 0x4e0938
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xd4], eax
jmp 0x4e0966
and dword [esi + 0xd4], 0xffff9fff
jmp 0x4e0966
cmp byte [esp], 0
je 0x4e095c
or eax, 0x2000
or eax, 0x4000
mov dword [esi + 0xd4], eax
jmp 0x4e0966
and dword [esi + 0xd4], 0xffff9fff
mov edi, dword [esi + 0x14c]
mov eax, edi
call fcn.004d50d8
mov ebx, dword [edi + 0x20]
test ebx, ebx
jle 0x4e0991
dec ebx
mov edx, ebx
mov eax, edi
call fcn.004d59f0
mov edx, dword [eax]
mov eax, esi
call fcn.004e0400
test ebx, ebx
jne 0x4e097a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4eb91c
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
test dl, dl
je 0x4eb934
add esp, 0xfffffff0
call fcn.004045cc
mov esi, ecx
mov ebx, edx
mov edi, eax
mov dl, 1
mov eax, esi
call fcn.00469188
mov dword [edi + 4], eax
mov byte [edi + 0xc], 0
push 0xffffffffffffffec
mov eax, dword [edi + 4]
call fcn.004902a4
push eax
call sub.user32.dll_GetWindowLongA
mov dword [edi + 0xd], eax
xor eax, eax
mov dword [edi + 8], eax
mov byte [edi + 0x21], 0
xor eax, eax
mov dword [edi + 0x26], eax
mov dword [edi + 0x22], 0xdcdbda
xor eax, eax
mov dword [edi + 0x2a], eax
mov dword [edi + 0x2e], 0x20
xor eax, eax
mov dword [edi + 0x32], eax
xor eax, eax
mov dword [edi + 0x36], eax
mov byte [edi + 0x3a], 0
mov byte [edi + 0x3b], 0
xor eax, eax
mov dword [0x54970c], eax
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x94
call fcn.004039c4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4eba6d
cmp dword [ebp - 0x84], 2
jne 0x4eba6d
cmp dword [ebp - 0x90], 5
jb 0x4eba6d
push 0x4eba8c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x54970c], eax
cmp dword [0x54970c], 0
je 0x4eba6d
push 0x4eba98
mov eax, dword [0x54970c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549710], eax
push 0x4ebaac
mov eax, dword [0x54970c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549714], eax
push 0x4ebac4
mov eax, dword [0x54970c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549718], eax
push 0x4ebae4
mov eax, dword [0x54970c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x54971c], eax
push 0x4ebb00
push 0x4ebb1c
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549720], eax
mov eax, edi
test bl, bl
je 0x4eba82
call fcn.00404624
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f0114
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f01ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.0040539c
mov edx, dword [ebp - 0x18]
mov eax, dword [0x54974c]
call fcn.004ef5d4
test al, al
je 0x4f015a
mov ebx, 1
jmp 0x4f01d8
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4f0187
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor ebx, ebx
jmp 0x4f01d8
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x4f01bb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x4f01bb
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
movzx eax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f01f5
lea eax, [ebp - 0x18]
call fcn.004051a4
ret

Function at 0x4f0200
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4f0248
lea eax, [esp + 0x105]
push eax
push 0
push 0x4f0280
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x4f0248
lea eax, [esp + 0x105]
call fcn.0040b064
cmp ebx, eax
jg 0x4f024c
xor eax, eax
jmp 0x4f024e
mov al, 1
mov ebx, eax
test bl, bl
je 0x4f0268
lea edx, [esp + 0x105]
mov eax, esi
call fcn.0040b0b8
push esi
call sub.kernel32.dll_DeleteFileA
movzx eax, bl
mov edx, dword [0x542eb8]
mov eax, dword [edx + eax*4]
add esp, 0x20c
pop esi
pop ebx
ret