joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490c10
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push 0x3c
mov ebx, ecx
call fcn.005ddbe0
mov esi, eax
add esp, 4
test esi, esi
je 0x490c66
mov ecx, ebx
call fcn.00449f80
test eax, eax
je 0x490c3f
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x20]
mov cl, byte [eax + 0x129]
test cl, cl
jne 0x490c55
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 8]
cmp eax, dword [ecx + 0x3e8]
jne 0x490c55
mov eax, dword [ecx + 0x3e4]
jmp 0x490c58
add eax, 0x10
push eax
mov ecx, esi
call fcn.004632c0
mov esi, eax
test esi, esi
jne 0x490c6d
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, dword [ebx + 0x50]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], ecx
mov dword [ebx + 0x50], esi
push ebp
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp]
mov dword [esi + 0x1c], edx
movzx cx, byte [eax + 3]
mov word [esi + 0xa], cx
movzx dx, byte [eax]
mov word [esi + 8], dx
movzx cx, byte [eax + 1]
mov word [esi + 6], cx
movzx dx, byte [eax + 2]
mov eax, dword [esp + 0x14]
test eax, eax
push edi
lea edi, [esi + 4]
mov word [edi], dx
je 0x490cc3
lea ecx, [eax + 0x1c]
cmp dword [ecx], 0
je 0x490cc3
push 1
push edi
call fcn.0046bce0
movzx eax, word [edi + 6]
cmp eax, 0xff
jge 0x490cfe
movzx ecx, word [edi + 4]
movzx edx, word [edi + 2]
inc eax
imul ecx, eax
imul edx, eax
sar ecx, 8
mov word [edi + 4], cx
movzx ecx, word [edi]
imul ecx, eax
sar edx, 8
sar ecx, 8
mov word [edi + 2], dx
mov word [edi], cx
mov eax, 1
jmp 0x490d00
xor eax, eax
mov ecx, ebx
mov byte [esi + 0x24], al
call fcn.00449f80
test eax, eax
je 0x490d23
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x20]
mov cl, byte [eax + 0x129]
test cl, cl
je 0x490d23
add eax, 0x10
jmp 0x490d3c
mov ebx, dword [ebx + 0x2c]
mov eax, dword [ebx + 8]
cmp ebx, dword [eax + 0x3e8]
jne 0x490d39
mov eax, dword [eax + 0x3e4]
jmp 0x490d3c
lea eax, [ebx + 0x10]
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x490d4a
mov ecx, esi
call fcn.0046fb60
mov eax, dword [ebp]
inc eax
pop edi
mov dword [ebp], eax
pop ebp
mov eax, esi
pop esi
pop ebx
ret 0xc
Function at 0x4936a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4936c1
mov eax, dword [esp + 0x30]
push eax
call fcn.0043d810
add esp, 4
pop esi
add esp, 0x24
ret 8
mov eax, dword [eax + 0x78]
cmp eax, 7
push edi
jne 0x493728
mov ecx, dword [esi + 4]
movzx edi, word [ecx + 0x5a]
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
lea ecx, [eax + 0x10]
push edi
push ecx
add eax, 0x3c
push eax
call fcn.0044f280
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
push edi
push eax
add eax, 0x4c
push eax
call fcn.0044f280
mov eax, dword [esi + 0x18]
movzx ecx, byte [eax + 0x20]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
add esp, 0x20
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.00490950
pop edi
pop esi
add esp, 0x24
ret 8
test eax, eax
mov ecx, esi
jne 0x493761
push eax
call fcn.00492130
push 1
mov ecx, esi
mov edi, eax
call fcn.00492130
mov ecx, dword [esi + 0x18]
movzx edx, byte [ecx]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push eax
push edi
mov ecx, esi
call fcn.00490950
pop edi
pop esi
add esp, 0x24
ret 8
push ebx
push ebp
push 0
call fcn.00492130
push 1
mov ecx, esi
mov ebp, eax
call fcn.00492130
mov edi, eax
push 0
push edi
push ebp
call fcn.0043db30
add esp, 0xc
test eax, eax
jne 0x4937d4
mov eax, dword [esp + 0x38]
push eax
call fcn.0043f0c0
add esp, 4
test eax, eax
jne 0x4937d4
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x4937b9
mov ecx, dword [ecx + 0x48]
test cl, 2
je 0x4937af
mov eax, 1
test cl, 1
je 0x4937be
or eax, 2
jmp 0x4937be
mov eax, 0xff
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ebx
push edx
push edi
push ebp
mov ecx, esi
call fcn.00490950
jmp 0x4937e7
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push edi
push eax
call fcn.0043e440
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x493806
mov ecx, esi
call fcn.0048eaf0
mov edx, dword [eax]
neg edx
push ebx
push edx
call fcn.0043f800
add esp, 8
mov ecx, dword [esi + 0x18]
cmp dword [ecx + 0x78], 4
jne 0x493868
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x493868
mov edx, dword [eax + 0xc]
test edx, edx
jbe 0x493868
mov ecx, dword [ecx + 0x68]
mov eax, dword [ecx + 0x210]
test eax, eax
jne 0x493832
call fcn.004a0f20
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], eax
call fcn.0043d810
mov eax, dword [esp + 0x3c]
add esp, 4
lea edx, [esp + 0x20]
push edx
push 0x48cea0
push eax
mov ecx, esi
call fcn.00490250
push ebx
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.0043f920
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret 8
Function at 0x497de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x18]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x497e6e
cmp dword [eax + 0x78], 9
jne 0x497e6e
mov eax, dword [ebp + 0x2c]
cmp eax, ebx
je 0x497e0e
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x497e0e
mov eax, dword [eax + 0x3e0]
jmp 0x497e10
xor eax, eax
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.0043fb10
add esp, 0xc
test al, al
je 0x497eb8
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0043df30
mov edx, dword [ebp + 4]
mov ecx, dword [edx + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call fcn.00433070
push eax
call fcn.0043dad0
add esp, 8
test eax, eax
je 0x497eb8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
cmp dword [esp + 0x44], ebx
je 0x497ec4
mov ecx, ebp
call fcn.0048e210
test eax, eax
je 0x497eb8
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push ecx
push edx
sub esp, 0xdc
mov ecx, esp
push eax
call fcn.00493640
mov ecx, ebp
call fcn.00498690
test eax, eax
je 0x497eb8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
mov edi, dword [esp + 0x40]
lea ecx, [ebp + 0x7c]
push edi
push ecx
mov dword [esp + 0x4c], ebx
call fcn.0043dad0
add esp, 8
test eax, eax
je 0x497fba
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push edx
push eax
mov ecx, ebp
call fcn.004969a0
mov esi, dword [ebp + 0x4c]
test esi, esi
je 0x497fba
movsx eax, word [esi + 0x12]
mov edx, dword [edi + 4]
cmp eax, edx
jg 0x497f8a
movsx ecx, word [esi + 0x1a]
cmp edx, ecx
jge 0x497f8a
movsx edx, word [esi + 0x10]
mov dword [esp + 0x1c], eax
movsx eax, word [esi + 0x14]
mov dword [esp + 0x18], edx
movsx edx, word [esi + 0x16]
mov dword [esp + 0x20], eax
movsx eax, word [esi + 0x18]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [esi + 0x1c]
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x1c]
push edi
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ecx
call fcn.00420360
add esp, 0xc
test ax, ax
je 0x497f8a
movzx eax, byte [esi + 0x1d]
sub eax, 0
mov ebx, 1
je 0x497f7c
dec eax
je 0x497f77
dec eax
jne 0x497f8a
mov eax, dword [esi + 8]
mov cl, byte [esi + 0x1e]
add byte [eax + 0x25], cl
jmp 0x497f8a
mov eax, dword [esi + 8]
jmp 0x497f86
mov eax, dword [esi + 8]
xor byte [eax + 0x25], 1
mov eax, dword [esi + 0xc]
xor byte [eax + 0x25], 1
mov esi, dword [esi]
test esi, esi
jne 0x497f00
test ebx, ebx
je 0x497fba
mov eax, dword [ebp + 0x50]
test eax, eax
je 0x497fba
nop
mov cl, byte [eax + 0x25]
test cl, cl
je 0x497faf
mov dword [esp + 0x44], 1
mov byte [eax + 0x25], 0
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x497fa0
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
Function at 0x4a0190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov edx, ecx
mov ecx, dword [edx + 8]
mov eax, dword [edx + 4]
push esi
push edi
lea edi, [edx + 4]
add eax, ecx
add ecx, 2
mov dword [edi + 4], ecx
xor ecx, ecx
mov ch, byte [eax + 1]
mov dword [esp + 0x10], edx
mov cl, byte [eax]
push ecx
mov ecx, dword [edx + 0x2c]
call fcn.0049dc20
mov esi, eax
test esi, esi
je 0x4a0376
cmp dword [esi + 0x78], 3
jne 0x4a0376
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov cl, byte [eax + edx]
inc eax
mov dword [edi + 4], eax
movzx eax, cl
shr eax, 6
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4a0376
cmp word [esi + 0x36], 0
je 0x4a0376
push ebx
push ebp
mov ecx, esi
call fcn.0049d3c0
mov ebp, dword [esi + 0x74]
mov ebx, eax
cmp ebx, ebp
ja 0x4a0348
lea ecx, [esp + 0x1c]
call fcn.00401580
mov ecx, dword [esi + 0x70]
push ebp
push ebx
push ecx
lea ecx, [esp + 0x28]
call fcn.0049cc10
xor ebx, ebx
cmp word [esi + 0x36], bx
jbe 0x4a0306
push 0x14
call fcn.005ddbe0
add esp, 4
cmp eax, ebx
je 0x4a0253
movzx edx, word [esi + 0x36]
push 1
push edx
mov ecx, eax
call fcn.004408b0
jmp 0x4a0255
xor eax, eax
cmp word [esi + 0x36], bx
mov dword [esi + 0x24], eax
mov dword [esp + 0x14], ebx
jbe 0x4a0306
test byte [esi + 0x38], 4
lea ecx, [esp + 0x1c]
je 0x4a027b
call fcn.00425360
mov dword [esp + 0x10], eax
jmp 0x4a0289
call fcn.00425330
movzx ax, al
mov word [esp + 0x10], ax
push 0xc
call fcn.005ddbe0
add esp, 4
mov ecx, edi
mov ebp, eax
call fcn.00425330
mov bl, al
cmp bl, 1
jbe 0x4a02ba
mov ecx, edi
call fcn.00405c40
mov ecx, edi
mov dword [ebp], eax
call fcn.00405c40
mov dword [ebp + 4], eax
add bl, 0xfe
movzx ecx, bl
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 8]
shl ecx, 2
add eax, ecx
mov ecx, edi
mov dword [ebx + 8], eax
call fcn.00425330
movzx edx, al
movzx eax, word [esp + 0x10]
push ebp
mov dword [ebp + 8], edx
mov ecx, dword [esi + 0x24]
push eax
call fcn.00440c90
mov al, byte [ebx + 0x24]
test al, al
jne 0x4a0304
mov eax, dword [esp + 0x14]
movzx ecx, word [esi + 0x36]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x4a0266
xor ebx, ebx
mov edi, dword [esp + 0x18]
mov al, byte [edi + 0x24]
test al, al
jne 0x4a0319
mov al, byte [esp + 0x3c]
test al, al
je 0x4a0374
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x4a0326
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x70], ebx
mov word [esi + 0x36], bx
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax + 0xd4]
push 1
call fcn.004b5570
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
mov ecx, dword [esi + 0x68]
mov ecx, dword [ecx + 0xd4]
push 1
call fcn.004b5570
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0xd4]
mov ecx, dword [eax]
push 0x8e
push 3
push eax
call dword [ecx + 0xe0]
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x4b4ac0
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
push ebx
mov bl, byte [eax]
test bl, bl
push esi
mov byte [esp + 0xb], 0
mov esi, eax
je 0x4b4b1c
cmp bl, 0x3d
mov byte [esp + 0xc], bl
je 0x4b4b1c
cmp bl, 0x3b
je 0x4b4b1c
cmp bl, 0x2f
je 0x4b4b1c
cmp bl, 0x23
je 0x4b4b1c
cmp bl, 0x3f
je 0x4b4b1c
cmp bl, 0x20
je 0x4b4b1c
cmp bl, 0x3a
je 0x4b4b24
mov eax, dword [esp + 0xc]
push eax
call fcn.004b48f0
add esp, 4
test al, al
jne 0x4b4b14
cmp bl, 0x2d
je 0x4b4b14
mov byte [esp + 0xb], 1
mov bl, byte [esi + 1]
inc esi
test bl, bl
jne 0x4b4ad2
pop esi
xor al, al
pop ebx
add esp, 8
ret
mov al, byte [esp + 0xb]
test al, al
pop esi
setne al
pop ebx
add esp, 8
ret

Function at 0x4b59a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x4b59ce
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x4b59b1
pop esi
ret 4

Function at 0x4b59e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
mov eax, dword [ebx + 0xdc8]
mov ecx, dword [ebx + 0xdcc]
push edi
lea edi, [esi*4]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call fcn.005ddbe0
mov edx, eax
mov ecx, edi
mov dword [ebx + 0xdc8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
xor eax, eax
add esp, 4
cmp ecx, eax
mov dword [ebx + 0xdcc], esi
mov dword [ebx + 0xdd4], eax
lea ebp, [esi - 1]
mov dword [esp + 0x1c], eax
jle 0x4b5ae9
mov edi, edi
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + eax*4]
and edi, 0xfffffff8
cmp edi, 1
jbe 0x4b5ad8
mov ecx, edi
xor esi, esi
call fcn.0043c840
mov cx, word [eax]
test cx, cx
je 0x4b5a8e
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x4b5a70
mov edx, dword [ebx + 0xdc8]
and esi, ebp
and esi, 0x7fffffff
cmp dword [edx + esi*4], 0
mov eax, 7
je 0x4b5abc
mov ecx, edx
lea esp, [esp]
add esi, eax
and esi, ebp
mov edx, dword [ecx + esi*4]
inc eax
test edx, edx
jne 0x4b5ab0
mov ecx, edi
call fcn.0043c840
movzx eax, byte [eax]
mov ecx, dword [ebx + 0xdc8]
and eax, 7
or eax, edi
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x4b5a50
mov edx, dword [esp + 0x14]
push edx
call fcn.005ddc00
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4be290
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.0043c840
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.0043c840
mov cx, word [eax]
test cx, cx
je 0x4be2d2
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x4be2b4
push esi
push ebp
mov ecx, edi
call fcn.004ba5a0
mov edx, dword [edi + 0xdc8]
mov ecx, dword [edx + eax*4]
cmp ecx, 1
ja 0x4be301
push esi
mov esi, dword [esp + 0x18]
push eax
push ebx
push esi
mov ecx, edi
call fcn.004ba500
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
and ecx, 0xfffffffd
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x4c0690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.00486bd0
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x54]
test esi, esi
mov byte [esp + 0x13], 0
je 0x4c08b4
mov ebx, dword [esi + 0x18]
test ebx, ebx
mov dword [esp + 0x18], ebx
je 0x4c08b4
mov eax, dword [ebp + 0xb4]
mov ecx, dword [eax + 0x2c]
push ecx
lea ecx, [esp + 0x20]
call fcn.00487650
mov eax, dword [ebx + 0x78]
add eax, 0xfffffffe
cmp eax, 0x5f
ja case.0x4c06f7.3
movzx edx, byte [eax + 0x4c08f8]
jmp dword [edx*4 + 0x4c08e4]
mov ecx, dword [edi + 0x860]
test ecx, ecx
jne 0x4c070c
xor esi, esi
jmp 0x4c0713
call fcn.00487cb0
mov esi, eax
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4c075f
test esi, esi
je 0x4c075f
mov ecx, dword [edi + 0xc74]
mov dl, byte [ecx + 0x215]
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0x3c], dl
call fcn.004bfd80
mov ecx, dword [esp + 0x34]
mov eax, dword [eax]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.004a76b0
test eax, eax
mov dword [esp + 0x18], 0
jne case.0x4c06f7.3
mov ecx, dword [ebp + 0xb4]
push 0
push str.MovieClip
push ecx
mov ecx, edi
call fcn.004c0140
jmp 0x4c08b4
mov ebx, str.Button
jmp 0x4c078c
mov ebx, str.TextField
jmp 0x4c078c
mov ebx, str.Video
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], edx
call fcn.0040dd00
test al, al
je 0x4c08b4
mov esi, dword [edi + 0x860]
test esi, esi
je 0x4c08b4
mov ecx, esi
call fcn.00487c80
test eax, eax
jne 0x4c07c4
mov ecx, edi
call fcn.004bf860
mov ecx, esi
call fcn.00487c80
test eax, eax
je 0x4c08b4
push ebx
mov ecx, eax
call fcn.004aa0d0
mov esi, eax
test esi, esi
je 0x4c08b4
mov ecx, esi
call fcn.00457590
test al, al
je 0x4c08b4
mov ecx, esi
call fcn.0040c060
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4c08b4
mov ecx, ebp
call fcn.0040c940
push 0
mov esi, eax
mov edx, dword [esi + 4]
push 1
push 0
inc edx
mov dword [esi + 4], edx
mov eax, dword [esp + 0x20]
mov ecx, dword [edi + 0xcc8]
mov edx, dword [ebp + 0xb4]
push eax
push 1
push 0
push ecx
push ebp
push edx
mov ecx, edi
mov byte [esp + 0x37], 1
call fcn.004b8830
mov ecx, edi
call fcn.0040dff0
cmp ebp, dword [esi]
je 0x4c0856
xor ebp, ebp
mov ecx, dword [esi + 4]
dec ecx
mov eax, ecx
test eax, eax
mov dword [esi + 4], ecx
jg 0x4c086c
push esi
call fcn.005ddc00
add esp, 4
mov eax, dword [ebx + 0x78]
cmp eax, 6
je 0x4c0879
cmp eax, 0x61
jne 0x4c08b4
test ebp, ebp
je 0x4c08ce
mov eax, dword [ebp + 0x5c]
test eax, eax
je 0x4c0889
cmp dword [eax], 0
jne 0x4c08b4
mov ecx, dword [ebp + 0xb4]
call fcn.004aba70
test al, 1
je 0x4c08b4
mov ecx, dword [edi + 0x554]
push 0x7fffffff
push 0
push 0
push 0
push ebp
push 0
push 0
push edi
call fcn.0047ab10
test ebp, ebp
je 0x4c08ce
mov al, byte [esp + 0x13]
test al, al
jne 0x4c08ce
mov ecx, ebp
call fcn.004a4bb0
mov ecx, ebp
call fcn.004abc70
lea ecx, [esp + 0x1c]
call fcn.00486bf0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4df030
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x1c], 0xca
jne 0x4df06b
push esi
call fcn.004e3990
add esp, 4
test eax, eax
jl 0x4df0e5
mov al, byte [esi + 0x48]
test al, al
je 0x4df064
mov dword [esi + 0x1c], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x1c], 0xcb
mov eax, dword [esi + 0x1c]
cmp eax, 0xcb
jne 0x4df0e7
mov eax, dword [esi + 0x198]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4df0d4
mov eax, dword [esi + 8]
test eax, eax
je 0x4df08f
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x198]
push esi
call dword [ecx]
add esp, 4
test eax, eax
jl 0x4df0e5
je 0x4df0d0
cmp eax, 2
je 0x4df0d4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4df082
cmp eax, 3
je 0x4df0b7
cmp eax, 1
jne 0x4df082
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4df082
mov ecx, dword [esi + 0x124]
add dword [eax + 8], ecx
jmp 0x4df082
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x84]
mov dword [esi + 0x8c], edx
call fcn.004def10
pop esi
ret
cmp eax, 0xcc
je 0x4df0e0
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov edx, dword [esi + 0x1c]
mov dword [ecx + 0x18], edx
mov eax, 0xffffffec
pop esi
ret
Function at 0x4ec6f0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0xc
push esi
call dword [0x5f626c]
push eax
call dword [0x5f64c4]
push 7
lea ecx, [esp + 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
xor esi, esi
call dword [0x5f6270]
test eax, eax
je 0x4ec73a
push esi
push 0xa
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004b2660
add esp, 0x10
test eax, eax
mov eax, dword [esp + 4]
jne 0x4ec73c
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x4ec7e0
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [0x681024]
sub esp, 8
test eax, eax
push edi
mov edi, str.UNKNOWN
jne 0x4ec7f7
call fcn.004ec5e0
push 0
call dword [0x5f64c4]
cmp dword [0x681024], 2
jne 0x4ec918
mov eax, dword [0x681044]
test eax, eax
je 0x4ec918
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [0x681028]
mov esi, eax
test esi, esi
je 0x4ec917
push ebx
call fcn.004ec6f0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
mov ebx, eax
call dword [0x681044]
test eax, eax
je case.0x4ec890.17
mov eax, dword [esp + 0xc]
cmp eax, 0x400
jbe 0x4ec860
sub eax, 0x400
lea ecx, [ebx - 0x3a4]
cmp ecx, 0x12
ja case.0x4ec890.17
movzx ecx, byte [ecx + 0x4ec930]
jmp dword [ecx*4 + 0x4ec920]
add eax, 0xfffffff0
cmp eax, 0xb
ja case.0x4ec890.17
movzx edx, byte [eax + 0x4ec95c]
jmp dword [edx*4 + 0x4ec944]
pop ebx
mov edi, 0x601af4
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, 0x601adc
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, 0x601ac4
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, 0x601ab0
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4ec890.17
movzx eax, byte [eax + 0x4ec978]
jmp dword [eax*4 + 0x4ec968]
pop ebx
mov edi, str.ALPHANUMERIC_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.KOREAN
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4ec890.17
movzx ecx, byte [eax + 0x4ec994]
jmp dword [ecx*4 + 0x4ec984]
mov edi, str.CHINESE
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 8
ret
Function at 0x4f4e10
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push esi
mov esi, ecx
mov eax, dword [esi + 0xa0]
test eax, eax
push edi
jne 0x4f4f1e
mov eax, dword [esi + 0x80]
test eax, eax
je 0x4f4e6e
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x1a
push 0
call eax
cmp eax, 0x80070057
je 0x4f4eef
push 0x5f9d3c
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004f4520
mov dword [esi + 0xa0], eax
jmp 0x4f4eef
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x1c], 0
call dword [0x5f6004]
test eax, eax
jne 0x4f4eef
mov byte [esp + 0x10], al
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
stosw word es:[edi], ax
push 0
push 0
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push str.AppData
push eax
mov dword [esp + 0x24], 0x104
call dword [0x5f6008]
test eax, eax
jne 0x4f4ee4
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004f49b0
mov dword [esi + 0xa0], eax
mov edx, dword [esp + 8]
push edx
call dword [0x5f600c]
mov edi, dword [esi + 0xa0]
test edi, edi
je 0x4f4f1e
push edi
call fcn.005f0a4d
add esp, 4
test eax, eax
jbe 0x4f4f1e
mov cx, word [edi + eax*2 - 2]
cmp cx, 0x2f
je 0x4f4f17
cmp cx, 0x5c
jne 0x4f4f1e
mov word [edi + eax*2 - 2], 0
mov eax, dword [esi + 0xa0]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4f5290
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x94]
test eax, eax
push esi
push edi
je 0x4f52e9
mov ecx, dword [ebx + 0x98]
test ecx, ecx
je 0x4f52e9
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push ebp
call eax
mov esi, eax
test esi, esi
je 0x4f5345
push esi
call fcn.005ddbe0
mov edi, eax
add esp, 4
test edi, edi
je 0x4f5345
push edi
push esi
push 0
push ebp
call dword [ebx + 0x98]
test eax, eax
je 0x4f5345
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x1c]
call fcn.004f44b0
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4f533c
push esi
call fcn.005ddbe0
mov edi, eax
add esp, 4
test edi, edi
je 0x4f533c
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4f533c
push ebx
call fcn.005ddc00
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push ebx
call fcn.005ddc00
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4