joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3250
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
shr eax, 0x10
movsx ecx, ax
push edi
mov edi, dword [esi + 4]
add edi, ecx
test ecx, ecx
mov dword [esi + 4], edi
mov eax, edi
jl 0x4c3276
mov edi, 0x78
xor ebx, ebx
jmp 0x4c3280
mov edi, 0xffffff88
mov ebx, 1
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl 0x4c32b0
push ebp
mov ebp, dword [esp + 0x14]
mov edx, dword [esi]
push 0
push ebx
push 0
push ebp
mov ecx, esi
call dword [edx]
mov edx, dword [esi + 4]
sub edx, edi
mov eax, edx
mov dword [esi + 4], edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jge 0x4c328f
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4c3320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dfd22
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor ebx, ebx
push edi
push ebx
mov esi, ecx
push ebp
push 0x66696c
mov dword [esp + 0x1c], esi
call fcn.005b91d9
lea edi, [esi + 0x88]
mov dword [esp + 0x1c], ebx
mov ecx, edi
call fcn.004977e0
mov eax, dword [esp + 0x38]
mov dword [esi + 0x1bc], ebp
cmp eax, 1
mov dword [esi + 0x1c4], eax
lea ebp, [esi + 0x1f4]
mov dword [esi + 0x1cc], ebx
sete al
mov ecx, ebp
mov byte [esi + 0x1c8], al
mov dword [esi + 0x1d0], ebx
mov dword [esi + 0x1d4], ebx
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1e4], ebx
mov byte [esi + 0x1e8], bl
mov byte [esi + 0x1e9], bl
mov byte [esi + 0x1ea], bl
mov byte [esi + 0x1f1], bl
call fcn.0059ea56
mov dword [ebp], vtable.CButton.0
lea ebp, [esi + 0x230]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call fcn.0059ea56
mov dword [ebp], vtable.CButton.0
lea ebp, [esi + 0x26c]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call fcn.0059ea56
mov dword [ebp], vtable.CButton.0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov byte [esp + 0x1c], 3
mov byte [esi + 0x2a8], 1
mov byte [esi + 0x2b8], bl
mov dword [esi], method.CPropertySheet.virtual_0
mov dword [edi], 0x5f98c4
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x2ac], ecx
mov dword [esi + 0x2b0], edx
mov dword [esi + 0x2b4], eax
call fcn.005c006c
mov edi, dword [eax + 8]
call fcn.005c006c
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x4c7e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dff78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4c7ebc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
push ebx
push ebp
push edi
mov edi, dword [esi + 0x14]
lea ecx, [esp + 0x34]
mov eax, dword [edi]
push eax
call fcn.0059d86b
lea ebx, [edi + 4]
lea ecx, [esp + 0x34]
push ebx
mov dword [esp + 0x2c], 0
call fcn.0059dc15
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
mov edi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x18]
mov ebp, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebp
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
mov dword [esi + 0xc], ecx
mov eax, dword [edx + 0x14]
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
add eax, 4
cmp ebp, eax
jle 0x4c7f40
mov eax, ebp
mov dword [esi + 0x10], eax
lea eax, [edx + ecx]
mov dword [esi + 0xc], eax
mov ecx, dword [ebx]
mov edx, dword [ecx - 8]
test edx, edx
je 0x4c7f57
add eax, 0x32
jmp 0x4c7f5a
add eax, 0xf
mov edx, dword [esp + 0x14]
mov dword [esi + 0xc], eax
push edx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x30]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.0059d7fd
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x4d53f0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call esi
push eax
push 0
call esi
mov esi, dword [esp + 0x1c]
push eax
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetRect]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4d5469
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 8]
test eax, eax
jg 0x4d5466
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x4d545e
mov eax, dword [esp + 4]
test eax, eax
jg 0x4d5456
mov edx, dword [esp + 0xc]
mov dword [esi], edx
pop esi
add esp, 0x10
ret
mov dword [esi + 8], eax
pop esi
add esp, 0x10
ret
mov dword [esi + 4], eax
pop esi
add esp, 0x10
ret
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret

Function at 0x4d5e90
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5e0618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x6c]
test eax, eax
jne 0x4d5f3a
mov eax, dword [0x677e28]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0059dc2d
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0059dc7c
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0059dbd9
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4d5f21
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4d5f21
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x6c], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0059d7fd
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4d5f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4d5fb2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4d61c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push 0x65464c
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4d62b2
lea ecx, [esp + 0x10]
push ecx
push 0x667c7c
push OleUIAddVerbMenuA
mov ecx, edi
call fcn.004d5f50
test eax, eax
jne 0x4d62b2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push 0x6537dc
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push OleUIAddVerbMenuA
mov ecx, edi
call fcn.004d5f50
test eax, eax
jne 0x4d62b2
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.0055bac0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4d6283
lea eax, [esp + 0x10]
push 0x667c70
push eax
call fcn.0055bac0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4d6283
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x4d6286
mov byte [esi], 0
push 0x652b5c
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x4de840
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x4de881
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
je 0x4de89f
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x4de89f
cmp dword [esp + 0xc], 5
jb 0x4de89f
pop edi
mov eax, 1
pop esi
add esp, 0x9c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret
Function at 0x4ed2cb
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5e25db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x677e28]
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi + 0x24], eax
push 0x4000
mov dword [esp + 0x14], 0
call fcn.0059dece
add esp, 4
mov ecx, esi
mov dword [esi + 4], eax
call fcn.004ed3b0
call fcn.004811b0
push eax
push 0
push str.AssumeDOSASCII
push str.ParseInput
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4f8260
Capabilities:
Get hostname

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xf0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi], 0x5fbca0
mov dword [esi + 4], eax
cmp dword [0x6811f8], ebx
jne 0x4f82a8
push 0x25
push str.8bc1c674_edb6_4109_af85_e5b4547da53d
call fcn.00576910
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edi, eax
mov dword [0x6811f8], edi
mov edi, dword [esp + 0x104]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esi + 8]
push 0x104
push ecx
push edi
call ebp
mov edx, dword [str..rky]
push 0x104
mov dword [eax + esi + 4], edx
lea eax, [esi + 0x10c]
push eax
push edi
call ebp
mov ecx, dword [str..usr]
push 0x104
mov dword [eax + esi + 0x108], ecx
lea eax, [esi + 0x210]
push eax
push edi
call ebp
mov edx, dword [str..rtm]
push 0x104
mov dword [eax + esi + 0x20c], edx
lea eax, [esi + 0x418]
push eax
push edi
call ebp
mov ecx, dword [str..log]
lea edx, [esi + 0x314]
push 0x104
push edx
push edi
mov dword [eax + esi + 0x414], ecx
call ebp
mov ecx, dword [0x6811f8]
lea edx, [eax + esi + 0x310]
push ecx
push 0x66bc44
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi + 4]
mov dword [esi + 0x51c], ebx
mov dword [esi + 0x520], ebx
mov dword [esi + 0x52c], ebx
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 4]
mov ecx, dword [esi + 4]
mov dword [esi + 0x524], eax
mov edx, dword [ecx]
call dword [edx + 8]
mov dword [esi + 0x528], eax
lea ecx, [esi + 0x548]
xor eax, eax
lea edi, [esp + 0x14]
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x40
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esi + 0x534], ebx
push eax
mov dword [esi + 0x558], ebx
mov dword [esi + 0x564], ebx
mov dword [esi + 0x568], ebx
mov dword [esi + 0x56c], ebx
mov dword [esi + 0x570], ebx
mov dword [esi + 0x574], ebx
mov dword [esi + 0x578], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, dword [esp + 0x14]
lea eax, [esi + 0x538]
mov ecx, eax
mov dword [ecx], edx
mov edx, dword [esp + 0x18]
push eax
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x20]
mov byte [esi + 0x547], bl
mov dword [ecx + 8], edx
mov dx, word [esp + 0x24]
mov word [ecx + 0xc], dx
mov dl, byte [esp + 0x26]
mov byte [ecx + 0xe], dl
mov ecx, esi
call fcn.004f9bf0
mov dword [esi + 0x530], eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 2
mov eax, dword [esp + 0xfc]
pop ebp
je 0x4f843e
mov ecx, dword [esp + 0x50]
jmp 0x4f8445
mov edx, dword [esp + 0x50]
lea ecx, [eax + edx]
cdq
xor eax, edx
lea ecx, [ecx + ecx*2]
sub eax, edx
lea ecx, [ecx + ecx*4]
lea eax, [eax + eax*2]
shl ecx, 2
lea edx, [eax + eax*4]
lea eax, [esi + 0x210]
mov dword [esi + 0x55c], ecx
push eax
shl edx, 2
mov ecx, esi
mov dword [esi + 0x560], edx
call fcn.004f9ae0
test eax, eax
je 0x4f8480
mov dword [esi + 0x55c], ebx
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0xf0
ret 8
Function at 0x4f9130
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0x210]
push eax
call edi
test eax, eax
jne 0x4f914f
pop edi
mov eax, 0x1f
pop esi
ret
lea ecx, [esi + 8]
push ecx
call edi
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esi + 0x520], 0
pop edi
xor eax, eax
pop esi
ret

Function at 0x4f9740
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x20]
movsx eax, byte [esi]
push eax
call fcn.0055f10e
add esp, 4
cmp al, 0x41
mov byte [esp + 0x20], al
jl 0x4f98b4
cmp al, 0x5a
jg 0x4f98b4
cmp byte [esi + 1], 0x3a
jne 0x4f98b4
mov al, byte [esi + 2]
add esi, 2
cmp al, 0x5c
mov dword [esp + 0x14], esi
jne 0x4f98b4
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x4f98b4
push ebx
push ebp
mov ebx, 0x640
push edi
push ebx
call fcn.0055c94e
add esp, 4
mov ebp, eax
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push ebp
push eax
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0xffffffff
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x4f97f5
mov eax, dword [esp + 0x14]
push eax
push ebp
mov ebx, eax
call fcn.0055cf0b
add esp, 8
mov ebp, eax
jmp 0x4f97b9
test eax, eax
jne 0x4f9895
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x4f97b9
lea edi, [ebp + 0x10]
mov eax, dword [edi]
test eax, eax
je 0x4f9825
movsx edx, byte [eax]
push edx
call fcn.0055f10e
movsx ecx, byte [esp + 0x30]
add esp, 4
cmp ecx, eax
je 0x4f9833
mov eax, dword [esp + 0x10]
inc esi
add edi, 0x20
cmp esi, eax
jl 0x4f980a
jmp 0x4f97b9
shl esi, 5
or ecx, 0xffffffff
xor eax, eax
mov edi, dword [esi + ebp + 0x14]
mov edx, dword [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x20], 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0055dd1f
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call sub.MPR.dll_WNetCloseEnum
push ebp
call fcn.0055c865
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x4f9a00
Capabilities:
Delete file

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
push 0
lea esi, [edi + 0x314]
push esi
call fcn.0055b320
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 8
test eax, eax
jne 0x4f9a38
push esi
call ebx
test eax, eax
jne 0x4f9a38
pop edi
pop esi
mov eax, 0x20
pop ebx
add esp, 0x24
ret 4
push 0x661ff4
push esi
mov ecx, edi
call fcn.004f9bb0
test eax, eax
jne 0x4f9a57
pop edi
pop esi
mov eax, 0x21
pop ebx
add esp, 0x24
ret 4
push eax
call fcn.0055bb49
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0055eddb
add esp, 0xc
test eax, eax
je 0x4f9a7d
pop edi
pop esi
mov eax, 0x22
pop ebx
add esp, 0x24
ret 4
push esi
call ebx
test eax, eax
jne 0x4f9a92
pop edi
pop esi
mov eax, 0x20
pop ebx
add esp, 0x24
ret 4
mov ecx, dword [esp + 0x28]
mov eax, dword [edi + 0x55c]
mov edx, dword [esp + 0x34]
sub ecx, eax
pop edi
pop esi
mov dword [edx], ecx
xor eax, eax
pop ebx
add esp, 0x24
ret 4

Function at 0x4f9ae0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x218
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x224]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x11]
pop edi
cmp al, 0x3a
pop esi
jne 0x4f9b21
mov byte [esp + 0xb], 0
jmp 0x4f9b53
cmp byte [esp + 8], 0x5c
jne 0x4f9ba4
cmp al, 0x5c
jne 0x4f9ba4
lea ecx, [esp + 0xa]
push 0x5c
push ecx
call fcn.0055c590
add esp, 8
test eax, eax
je 0x4f9b53
inc eax
push 0x5c
push eax
call fcn.0055c590
add esp, 8
test eax, eax
je 0x4f9b53
mov byte [eax + 1], 0
lea edx, [esp + 0x110]
push 0x105
lea eax, [esp + 8]
push edx
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0
lea edx, [esp + 0x20]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4f9ba4
push 4
lea eax, [esp + 0x114]
push str.ntfs
push eax
call fcn.0056e340
add esp, 0xc
neg eax
sbb eax, eax
inc eax
add esp, 0x218
ret 4
xor eax, eax
add esp, 0x218
ret 4

Function at 0x4fa020
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push edi
mov edi, dword [esi]
xor edx, edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x1c], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov edi, 0x20
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov esi, ecx
sub edx, 0x61c88647
shr esi, 5
add esi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x14]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x10]
add eax, esi
mov esi, eax
shr esi, 5
add esi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x4fa056
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 8
ret
Function at 0x4fa9f0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x304
push ebp
push 0x5c
push eax
call fcn.0055b630
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4faa14
pop ebp
add esp, 0x304
ret
push 0x663178
inc ebp
call fcn.0055dc1d
add esp, 4
test eax, eax
jne 0x4faa4b
push 0x66c5e4
call fcn.0055dc1d
add esp, 4
test eax, eax
jne 0x4faa4b
lea ecx, [esp + 4]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 4]
push ebx
push esi
push edi
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x320]
push 0x2e
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x652aec
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0055b630
mov ecx, dword [str..bmp]
push 0x5c
mov dword [eax], ecx
mov dl, byte [0x66c5e0]
push ebx
mov byte [eax + 4], dl
call fcn.0055b630
inc eax
push eax
lea eax, [esp + 0x128]
push str.The_file__s_has_been_converted_to_bitmap_format_for_object_insertion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x334]
add esp, 0x1c
lea ecx, [esp + 0x114]
push ecx
push 0x83d
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
add esp, 0x304
ret
Function at 0x4fb200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
mov eax, dword [esp + 0x54]
push ebx
xor ebx, ebx
push ebp
mov ecx, dword [eax]
mov eax, dword [esp + 0x74]
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
je 0x4fb221
mov dword [eax], ebx
mov edx, dword [esp + 0x60]
push 0x623c2c
push edx
call fcn.004fb3a0
mov edi, eax
cmp edi, ebx
jne 0x4fb245
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x4c
ret 0x20
mov ebp, dword [esp + 0x68]
mov word [esp + 0x28], bx
cmp ebp, 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], ebx
jne 0x4fb274
mov eax, dword [esp + 0x6c]
cmp eax, ebx
mov eax, 1
jne 0x4fb279
mov eax, 2
mov ecx, dword [edi]
lea edx, [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x30]
push eax
push edi
call dword [ecx + 0xc]
mov esi, eax
cmp esi, ebx
jge 0x4fb2a2
push edi
call fcn.004fb460
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x20
mov ecx, dword [esp + 0x64]
cmp ebp, 4
mov dword [ecx], ebp
jne 0x4fb2f4
mov eax, dword [esp + 0x6c]
cmp eax, ebx
je 0x4fb2f4
mov ecx, 0x20
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
push ebx
lea ecx, [esp + 0x2c]
mov word [esp + 0x2c], 3
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x28], ebx
mov edx, dword [edi]
push eax
push ecx
push edi
call dword [edx + 0x1c]
jmp 0x4fb302
mov eax, dword [esp + 0x7c]
cmp eax, ebx
je 0x4fb302
mov dword [eax], 1
cmp dword [esp + 0x74], ebx
je 0x4fb336
cmp dword [esp + 0x78], ebx
je 0x4fb336
mov edx, dword [esp + 0x60]
push 0x623b2c
push edx
call fcn.004fb3a0
mov esi, eax
cmp esi, ebx
je 0x4fb336
mov ecx, dword [esp + 0x78]
mov eax, dword [esi]
push ecx
push ebx
push ebp
push esi
call dword [eax + 0x1c]
push esi
call fcn.004fb460
cmp dword [esp + 0x70], ebx
je 0x4fb38d
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
push edi
call dword [edx + 0x14]
test eax, eax
jne 0x4fb37a
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push ebx
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x4fb37a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
cmp ecx, eax
jne 0x4fb34b
mov edx, dword [esp + 0x58]
mov ecx, dword [edi]
push edx
push edi
call dword [ecx + 0x10]
jmp 0x4fb34b
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4fb38d
push str.OleStdSwitchDisplayAspect:_Cache_enumerator_NOT_released
push eax
call fcn.004fb420
push edi
call fcn.004fb460
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret 0x20