joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e994
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x47e9ba
mov eax, str.comctl32.dll
call fcn.0046e660
mov dword [ebx + 8], eax
mov eax, dword [ebx]
test eax, eax
je 0x47e9c6
push eax
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4ae758]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x47e9fe
mov ecx, str.ComboBoxEx32
jmp 0x47ea03
mov ecx, str.combobox
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x47eab0
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4c9a0c]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.0047ee28
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x47eac3
call fcn.0046ea00
jmp 0x47eac3
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x47eaf0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x47eaf0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0047eb54
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x47eb41
call fcn.0046e978
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x47eb3b
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push str._c:_
push eax
call fcn.00497928
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.0047ee28
inc esi
cmp esi, 0x20
jl 0x47eaff
mov eax, ebx
call fcn.0047efb8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47ee28
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x1c]
push 0x408
call fcn.00493000
pop ecx
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [ebp + 0x20]
mov dword [esi + 4], edx
mov eax, dword [ebp - 4]
call fcn.0040ed6c
push eax
lea edx, [esi + 8]
push edx
call fcn.004949c8
add esp, 8
cmp byte [ebx + 4], 0
je 0x47ef8f
cmp dword [ebx + 8], 0x50000
jb 0x47ee91
cmp dword [0x4c475c], 4
jne 0x47ee95
cmp dword [0x4c4760], 0
jne 0x47ee95
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x47eea6
cmp edi, 0xffffffff
je 0x47eeaa
cmp dword [ebp + 0x18], 0
je 0x47eeaa
xor eax, eax
jmp 0x47eeaf
mov eax, 1
test al, al
je 0x47eef2
cmp dword [ebp - 8], 2
mov eax, 0x4201
jne 0x47eec1
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x168]
push edx
push 0
push dword [ebp - 4]
call sub.SHELL32.DLL_SHGetFileInfoA
cmp edi, 0xffffffff
jne 0x47eee3
mov edi, dword [ebp - 0x164]
cmp dword [ebp + 0x18], 0
jne 0x47eef2
lea eax, [ebp - 0x15c]
mov dword [ebp + 0x18], eax
push 0x24
push 0
lea edx, [ebp - 0x18c]
push edx
call fcn.00494848
add esp, 0xc
mov dword [ebp - 0x18c], 0x37
cmp dword [ebp + 0x18], 0
je 0x47ef1a
mov ecx, dword [ebp + 0x18]
jmp 0x47ef1d
or ecx, 0xffffffff
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x16c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x17c], edi
mov dword [ebp - 0x178], edi
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x170], edx
cmp dword [ebp + 0x14], 0
je 0x47ef76
call fcn.0040ff8c
test eax, eax
je 0x47ef76
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x18c]
mov dword [ebp - 0x184], eax
push edx
push 0
push 0x40b
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47efaf
lea ecx, [ebp - 0x18c]
push ecx
push 0
push 0x401
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47efaf
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x14a
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push esi
push eax
push 0x151
push dword [ebx]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x47efb8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbf4
mov esi, eax
mov eax, 0x4c1454
call fcn.004693c4
mov edi, eax
test edi, edi
je 0x47f03f
xor eax, eax
mov dword [esp], eax
push esp
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x47f02c
xor ebx, ebx
push 0
push ebx
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x47f02c
mov edx, dword [eax + 4]
test edx, edx
je 0x47f023
push edx
push edi
push 0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x47f023
push 0
push ebx
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x47f02c
inc ebx
cmp ebx, 0x80
jl 0x47efe5
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x47f0e5
lea ecx, [esp + 0xc]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov byte [esp + 4], 0
xor edi, edi
push 0
push edi
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47f0b4
cmp dword [ebx], 0
jne 0x47f0ab
movzx ebp, byte [ebx + 8]
push ebp
call fcn.004989ac
pop ecx
push eax
xor eax, eax
mov al, byte [esp + 0x10]
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
call fcn.004989ac
pop ecx
pop edx
cmp edx, eax
jne 0x47f0ab
push 0
push edi
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov byte [esp + 4], 1
jmp 0x47f0b4
inc edi
cmp edi, 0x80
jl 0x47f055
cmp byte [esp + 4], 0
jne 0x47f0cc
push 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x10]
mov eax, esi
call fcn.0047f28c
cmp dword [0x4c3de0], 0
je 0x47f0de
mov eax, esi
call fcn.0047f554
jmp 0x47f0e5
mov eax, esi
call fcn.0047f500
add esp, 0x40c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47f0f0
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
push dword [ebx]
call sub.USER32.DLL_GetWindowTextA
mov eax, esp
call fcn.00448988
mov edx, esp
push edx
push 0xffffffffffffffff
push 0x158
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x47f158
push 0
push eax
push 0x14e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov eax, ebx
call fcn.0047f1ac
cmp dword [0x4c3de0], 0
je 0x47f14f
mov eax, ebx
call fcn.0047f554
jmp 0x47f1a2
mov eax, ebx
call fcn.0047f500
jmp 0x47f1a2
cmp dword [0x4c3de0], 0
je 0x47f17c
mov eax, esp
call fcn.0040c464
test al, al
jne 0x47f17c
mov edx, esp
mov eax, 0x4c1454
xor ecx, ecx
call fcn.00466f5c
jmp 0x47f1a2
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47f19b
test al, 0x10
jne 0x47f19b
mov edx, esp
mov eax, 0x4c1454
xor ecx, ecx
call fcn.00466dec
jmp 0x47f1a2
mov eax, esp
call fcn.00448e08
add esp, 0x400
pop ebx
ret
Function at 0x47f500
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff400
mov esi, eax
xor ebx, ebx
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
call fcn.0040ff8c
test eax, eax
je 0x47f539
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea ebx, [esp + 0x400]
push ebx
lea ecx, [esp + 4]
lea edx, [esp + 4]
mov eax, esi
call fcn.0047f28c
add esp, 0xc00
pop esi
pop ebx
ret

Function at 0x47f808
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
cmp ecx, 0x4e
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
jne 0x47f8e9
mov edx, eax
mov ecx, dword [edx + 8]
sub ecx, 0xfffffcdb
je 0x47f837
sub ecx, 5
je 0x47f851
jmp 0x47f8e5
cmp dword [eax + 0x118], 2
jne 0x47f84a
mov eax, 0x4c19b4
call fcn.0047f0f0
xor eax, eax
jmp 0x47f8f4
mov ebx, eax
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x2c]
cmp dword [eax], 4
jne 0x47f863
mov edi, dword [eax + 4]
jmp 0x47f866
lea edi, [eax + 8]
mov edx, 8
cmp dword [eax], 4
je 0x47f873
add edx, 0xfffffff8
test esi, 1
mov dword [ebp - 4], edx
je 0x47f8a8
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x164]
or eax, 0x200
push eax
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x47f8a8
lea eax, [ebp - 0x158]
mov dword [ebx + 0x14], eax
test esi, 6
je 0x47f8da
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x2c4]
or edx, 0x4001
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x2c0]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x1c], eax
or dword [ebx + 0xc], 0x10000000
xor eax, eax
jmp 0x47f8f4
xor eax, eax
jmp 0x47f8f4
push eax
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47fa20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov byte [ebp - 1], cl
push dword [ebp + 8]
mov ebx, edx
call sub.USER32.DLL_GetSysColor
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x47fa52
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [edx*8 + 0x4a9264]
jmp 0x47fa60
mov eax, ebx
shl eax, 3
sub eax, ebx
mov ecx, dword [eax*8 + 0x4a9268]
cmp byte [ebp - 1], 0
mov ebx, ecx
jne 0x47fa9f
push 2
push ebx
push dword [0x4ae754]
call sub.KERNEL32.DLL_FindResourceA
push eax
push dword [0x4ae754]
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x47fa8d
mov edx, 4
jmp 0x47fa91
movzx edx, word [eax + 0xe]
mov eax, edx
cmp eax, 8
je 0x47fa9f
mov dword [ebp - 0xc], 0x800080
push 1
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [0x4ae754]
call sub.COMCTL32.DLL_CreateMappedBitmap
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x480f90
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov ebx, eax
lea edi, [esp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x480faf
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
mov edx, str.ViewSmall
mov eax, str.GeneralToolbar
mov ecx, 1
call fcn.0046bff8
test eax, eax
je 0x481102
mov esi, 0x56000944
push 0
push dword [0x4ae758]
push 0xd
push dword [0x4c1440]
push 0
push 0
push 0
push 0
push esi
push 0
push str.ToolbarWindow32
push 0
call sub.USER32.DLL_CreateWindowExA
mov ebp, eax
mov dword [ebx + 4], ebp
push 0
push 0x14
push 0x41e
push ebp
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x41f
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x420
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0
mov edx, str.FolderUp.bmp
mov eax, 0x4c1c80
mov ecx, 0xf
call fcn.0048404c
test eax, eax
jne 0x481050
mov eax, dword [ebx + 0x1c]
xor edx, edx
mov ecx, esp
mov dword [esp], edx
mov dword [esp + 4], eax
push ecx
push 1
push 0x413
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x4a96c0
push 1
push 0x414
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
mov ecx, edi
mov edx, 2
mov eax, ebx
call fcn.00481188
mov dword [edi], 0x38
mov dword [edi + 4], 0x173
cmp dword [edi + 8], 0
jne 0x4810a4
or dword [edi + 8], 1
or dword [edi + 8], 4
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x34], 2
mov dword [edi + 0x24], edx
push 0x12
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0xc], eax
push 0xf
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0x10], eax
cmp dword [edi + 0x2c], 0
jne 0x4810db
mov dword [edi + 0x2c], 0x28
mov eax, dword [0x4c19b4]
lea edx, [esp + 0x58]
push edx
push eax
call sub.USER32.DLL_GetClientRect
mov ecx, dword [esp + 0x64]
mov dword [edi + 0x28], ecx
push edi
push 0xffffffffffffffff
push 0x401
push dword [ebx + 8]
call sub.USER32.DLL_SendMessageA
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x483ce4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov esi, edx
mov ebx, eax
cmp esi, 0xa8
jne 0x483d04
mov eax, ebx
call fcn.00484690
mov al, 1
jmp 0x483e0b
cmp esi, 0xa9
jne 0x483d30
push 1
push 0x4a9a34
push 0
mov eax, 0x4f7
call fcn.00411fe8
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, 1
jmp 0x483e0b
mov eax, ebx
call fcn.00483ba8
mov edi, eax
cmp esi, 0xaa
jne 0x483d61
mov dword [ebx + 0x114], 0xffffffff
mov ecx, 0x4a9a34
mov edx, str.ActivePath
mov eax, str.InterfaceThemes
call fcn.0046bc44
jmp 0x483ddd
cmp esi, 0x3e8
jl 0x483d71
cmp esi, 0x428
jl 0x483d78
xor eax, eax
jmp 0x483e0b
push 0x2c
push 0
lea edx, [esp + 8]
push edx
call fcn.00494848
add esp, 0xc
mov dword [esp], 0x2c
mov dword [esp + 4], 0x20
push esp
push 0
push esi
push edi
call sub.USER32.DLL_GetMenuItemInfoA
test eax, eax
jne 0x483daa
xor eax, eax
jmp 0x483e0b
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x10c]
jb 0x483dba
xor eax, eax
jmp 0x483e0b
mov edx, eax
mov eax, str.InterfaceThemes
imul ecx, edx, 0x584
mov dword [ebx + 0x114], edx
mov edx, str.ActivePath
add ecx, dword [ebx + 0x108]
call fcn.0046bc44
mov eax, dword [ebx + 0x518]
cmp eax, 0xffffffff
je 0x483df1
push 0
push eax
push edi
call sub.USER32.DLL_CheckMenuItem
push 8
push esi
push edi
call sub.USER32.DLL_CheckMenuItem
mov dword [ebx + 0x518], esi
xor edx, edx
mov eax, ebx
call fcn.00483f18
mov al, 1
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x48b6b6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.0048b80c
push 0xc
push ebx
lea edx, [esp + 8]
push edx
call fcn.004947d8
add esp, 0xc
xor ebx, ebx
call fcn.0048b784
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.0048b7a8
inc ebx
cmp ebx, 0xc
jl 0x48b6d6
mov edx, dword [0x4d20cc]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x28], 2
je 0x48b70f
movzx ecx, word [0x4e2132]
sar ecx, 8
jmp 0x48b71b
mov ecx, dword [0x4e2138]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x48b727
or eax, 0xffffffff
jmp 0x48b77b
mov eax, dword [0x4e20e0]
cdq
cmp edx, dword [0x4d15a4]
jne 0x48b740
cmp eax, dword [0x4d15a0]
jbe 0x48b74c
jmp 0x48b742
jle 0x48b74c
mov eax, dword [0x4d15a0]
mov ebx, eax
jmp 0x48b754
mov eax, dword [0x4e20e0]
mov ebx, eax
mov esi, dword [0x4e20dc]
jmp 0x48b770
call fcn.0048b784
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0048b7a8
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x48b75c
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x48b7a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4e23f8]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4b0070]
xor ecx, edx
mov dword [0x4e23f8], ecx
and ecx, 0xff
add dword [0x4e23fc], ecx
imul edx, dword [0x4e23fc], 0x8088405
inc edx
mov dword [0x4e23fc], edx
shr edx, 0x18
mov ecx, dword [0x4e2400]
xor edx, ecx
and edx, 0xff
shr ecx, 8
mov edx, dword [edx*4 + 0x4b0070]
xor edx, ecx
mov dword [0x4e2400], edx
ret

Function at 0x48bb21
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4e247c
push ebx
mov ecx, dword [edx]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr ecx, 8
mov ebx, dword [ebx*4 + 0x4b0070]
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
mov ebx, dword [edx + 8]
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4b0070]
xor ecx, ebx
mov dword [edx + 8], ecx
pop ebx
ret

Function at 0x48bc84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x4b7bd5], 0
je 0x48bcc9
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x48bcc9
call fcn.0048bb00
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.0048bb21
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x48bcad
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00496d18
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48be19
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4e24a0
mov edi, 0x4e2498
xor ebx, ebx
mov dword [0x4e249c], 2
jmp 0x48bfa9
mov edx, dword [0x4aa27c]
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [edx + eax + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e2488]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
and eax, 0x7fff
mov edx, dword [0x4aa280]
mov word [edx + eax*2], bp
mov eax, dword [0x4e2488]
mov ecx, dword [edi]
mov dx, word [esi]
mov word [eax + ecx*2], dx
test ebp, ebp
je 0x48bea1
mov eax, dword [esi]
sub eax, ebp
cmp eax, 0x7efa
ja 0x48bea1
mov eax, ebp
call fcn.0048c20c
mov ebx, eax
mov eax, dword [0x4e24ac]
cmp ebx, eax
jbe 0x48bea1
mov ebx, eax
cmp ebx, 3
jb 0x48bf4b
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4e24a4]
call fcn.0048de10
sub dword [0x4e24ac], ebx
cmp ebx, dword [0x4e24b4]
ja 0x48bf1d
dec ebx
inc dword [esi]
mov ecx, dword [0x4aa27c]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e2488]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4aa280]
mov word [ecx + edx*2], bp
mov edx, dword [0x4e2488]
mov ecx, dword [edi]
mov bp, word [esi]
mov word [edx + ecx*2], bp
dec ebx
jne 0x48becb
inc dword [esi]
jmp 0x48bf65
add dword [esi], ebx
xor ebx, ebx
mov ecx, dword [esi]
mov edx, dword [0x4aa27c]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ebp, dword [esi]
mov ecx, dword [0x4aa27c]
shl edx, 5
movzx ecx, byte [ecx + ebp + 1]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x48bf65
mov eax, dword [0x4aa27c]
mov edx, dword [esi]
movzx edx, byte [eax + edx]
xor eax, eax
call fcn.0048de10
dec dword [0x4e24ac]
inc dword [esi]
test eax, eax
je 0x48bf98
mov edx, dword [esi]
sub edx, dword [0x4e2490]
cmp dword [0x4e2490], 0
jl 0x48bf87
mov eax, dword [0x4aa27c]
add eax, dword [0x4e2490]
jmp 0x48bf89
xor eax, eax
xor ecx, ecx
call fcn.0048dc34
mov edx, dword [esi]
mov dword [0x4e2490], edx
cmp dword [0x4e24ac], 0x106
jae 0x48bfa9
call fcn.0048bce8
cmp dword [0x4e24ac], 0
jne 0x48be38
mov edx, dword [esi]
sub edx, dword [0x4e2490]
cmp dword [0x4e2490], 0
jl 0x48bfd4
mov eax, dword [0x4aa27c]
add eax, dword [0x4e2490]
jmp 0x48bfd6
xor eax, eax
mov ecx, 1
call fcn.0048dc34
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48bfe8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
mov esi, 0x4e2498
cmp ebx, 1
jl 0x48bfff
cmp ebx, 9
jle 0x48c009
mov eax, 0x4aa2d4
call fcn.0048fbd0
xor edx, edx
mov dword [0x4e2494], edx
cmp dword [0x4e248c], 0
jne 0x48c02e
mov dword [0x4e2494], 1
mov dword [0x4e248c], 0x10000
cmp dword [0x4aa27c], 0
jne 0x48c06b
push 2
push 0x8000
call fcn.00492fa0
add esp, 8
mov edi, eax
mov dword [0x4aa27c], edi
test edi, edi
jne 0x48c06b
mov eax, 0x4ae120
call fcn.0042cd64
mov edx, 0x4aa2d4
mov eax, 4
call fcn.0048fa70
cmp dword [0x4aa280], 0
jne 0x48c0ce
push 2
push 0x8000
call fcn.00492fa0
add esp, 8
mov dword [0x4aa280], eax
push 2
push 0x8000
call fcn.00492fa0
add esp, 8
mov dword [0x4e2488], eax
cmp dword [0x4aa280], 0
je 0x48c0ae
cmp dword [0x4e2488], 0
jne 0x48c0ce
mov eax, 0x1ff
call fcn.00411fe8
push eax
call fcn.0044e1d4
pop ecx
mov edx, 0x4aa2d4
mov eax, 4
call fcn.0048fa70
mov eax, dword [0x4e2488]
mov word [eax + 0xfffe], 0
push 0xfffe
push 0
push eax
call fcn.00494848
movzx edx, word [ebx*8 + 0x4aa286]
mov dword [0x4e24b4], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x4aa284]
mov dword [0x4e24b8], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x4aa288]
mov dword [0x4e24bc], eax
movzx edx, word [ebx*8 + 0x4aa28a]
mov dword [0x4e24b0], edx
jg 0x48c12f
or word [ebp], 4
jmp 0x48c139
cmp ebx, 8
jl 0x48c139
or word [ebp], 2
xor ecx, ecx
xor eax, eax
mov dword [0x4e24a0], ecx
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4e2490], eax
mov eax, dword [0x4aa27c]
mov edx, ebx
call dword [0x4aa6ac]
mov dword [0x4e24ac], eax
mov eax, dword [0x4e24ac]
test eax, eax
je 0x48c16f
cmp eax, 0xffffffff
jne 0x48c183
mov dword [0x4e24a8], 1
xor edx, edx
mov dword [0x4e24ac], edx
jmp 0x48c1c1
xor ecx, ecx
mov dword [0x4e24a8], ecx
cmp dword [0x4e24ac], 0x106
jae 0x48c19c
call fcn.0048bce8
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov edx, dword [0x4aa27c]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x48c1a2
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x494204
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x495a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x495a5c
call fcn.004971a4
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x495a78
test bl, 1
je 0x495a78
call fcn.0049b288
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret