joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46beb2
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 1
push edi
jl 0x46bec2
cmp esi, 9
jle 0x46becd
push str.bad_pack_level
call fcn.00465437
pop ecx
xor edi, edi
mov dword [0x4bd760], edi
cmp dword [0x504240], edi
jne 0x46bef1
mov dword [0x4bd760], 1
mov dword [0x504240], 0x10000
push 0xfffe
xor eax, eax
push edi
push 0x4f4240
mov word [0x50423e], ax
call fcn.004858b0
mov eax, esi
shl eax, 3
movzx ecx, word [eax + 0x4ba0a2]
mov dword [0x4bd768], ecx
movzx ecx, word [eax + 0x4ba0a0]
mov dword [0x4f4220], ecx
movzx ecx, word [eax + 0x4ba0a4]
movzx eax, word [eax + 0x4ba0a6]
add esp, 0xc
cmp esi, 2
mov dword [0x524268], ecx
mov dword [0x4f4228], eax
jg 0x46bf53
mov eax, dword [esp + 0x10]
or word [eax], 4
jmp 0x46bf60
cmp esi, 8
jl 0x46bf60
mov eax, dword [esp + 0x10]
or word [eax], 2
push 0x10000
push 0x504260
mov dword [0x524264], edi
mov dword [0x524260], edi
call dword [0x4ba0f0]
pop ecx
pop ecx
mov dword [0x4bd764], eax
cmp eax, edi
je 0x46bfc3
cmp eax, 0xffffffff
je 0x46bfc3
mov dword [0x4bd75c], edi
cmp eax, 0x106
jae 0x46bf9e
call fcn.0046b8d5
xor eax, eax
xor ecx, ecx
movzx edx, byte [ecx + 0x504260]
shl eax, 5
xor edx, eax
and edx, 0x7fff
inc ecx
mov eax, edx
cmp ecx, 2
jb 0x46bfa2
mov dword [0x4bd76c], eax
jmp 0x46bfd3
mov dword [0x4bd75c], 1
mov dword [0x4bd764], edi
pop edi
pop esi
ret

Function at 0x46c0a1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4bd6c4]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x46c0dd
push dword [ebp + 0xc]
push esi
push dword [0x4bd77c]
call fcn.00487020
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x46c1b4
test edi, edi
jne 0x46c181
jmp 0x46c1b4
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x46c128
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push dword [0x4bd77c]
call fcn.00487020
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x46c1b4
test edi, edi
je 0x46c1b4
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
cmp al, 0xa
jne 0x46c121
mov byte [esi - 1], 0xd
mov byte [esi], al
inc esi
inc edi
dec ecx
jne 0x46c10f
sub esi, edi
jmp 0x46c181
dec eax
push eax
push esi
push dword [0x4bd77c]
mov ebx, esi
call fcn.00487020
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x46c1b4
test edi, edi
je 0x46c1b4
mov byte [edi + esi], 0xa
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
cmp al, 0xd
jne 0x46c15d
cmp byte [ebx], 0xa
jne 0x46c15d
dec esi
dec edi
dec ecx
jne 0x46c14c
test edi, edi
jne 0x46c177
inc edi
push edi
push esi
push dword [0x4bd77c]
call fcn.00487020
add esp, 0xc
jmp 0x46c181
sub esi, edi
cmp byte [edi + esi - 1], 0x1a
jne 0x46c181
dec edi
push edi
push esi
push dword [0x4bd778]
call fcn.004635a0
add dword [0x4bd774], edi
add esp, 0xc
mov dword [0x4bd778], eax
cmp dword [0x4bd774], edi
jae 0x46c1b2
push str.file_exceeds_Zips_4GB_uncompressed_size_limit
push 6
call fcn.0046528a
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46c25c
Capabilities:
Encode data using xor

Disassembly:
push esi
push 1
push 0x400
push 0x4bd788
mov esi, ecx
mov dword [0x4bd784], eax
mov dword [fcn.0046c0a1], 0x46c0a1
call fcn.0046d54e
push dword [esp + 0x14]
lea eax, [esi + 0x2a]
push eax
call fcn.0046dd65
add esi, 4
push esi
push dword [0x4ba070]
call fcn.0046beb2
add esp, 0x1c
pop esi
jmp fcn.0046bc15

Function at 0x46cc91
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor esi, esi
cmp dword [0x4bdb8c], esi
je 0x46cca1
xor eax, eax
inc eax
pop esi
ret
push ebx
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
cmp ebx, esi
jne 0x46ccb6
xor eax, eax
jmp 0x46cd27
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
mov ebp, 0x4bdb90
push ebp
call edi
mov esi, eax
test esi, esi
je 0x46ccef
push esi
push ebp
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x4bdb8c]
jmp 0x46cd25
push 0x4f4200
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x4f40c0
call fcn.004858b0
add esp, 0xc
call fcn.0046cbd8
xor esi, esi
inc esi
push ebx
mov dword [0x4bdb8c], esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x46e103
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x4d8aa8]
mov edx, dword [0x524980]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
push esi
mov esi, 0xff
and ecx, esi
xor eax, dword [edx + ecx*4]
mov ecx, dword [0x4d8ab0]
mov dword [0x4d8aa8], eax
movzx eax, al
add eax, dword [0x4d8aac]
imul eax, eax, 0x8088405
inc eax
mov dword [0x4d8aac], eax
shr eax, 0x18
xor eax, ecx
and eax, esi
shr ecx, 8
xor ecx, dword [edx + eax*4]
mov eax, dword [esp + 8]
mov dword [0x4d8ab0], ecx
pop esi
ret

Function at 0x46e193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4ba700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
inc dword [0x4d8ab4]
cmp dword [0x4d8ab4], 1
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
jne 0x46e1d5
push 0
call fcn.0047c54d
xor eax, 0xbb40e64e
push eax
call fcn.0047c4c8
pop ecx
pop ecx
push esi
call fcn.0046e15b
pop ecx
xor esi, esi
mov edi, 0xff
call fcn.0047c4da
mov ebx, eax
sar ebx, 7
and ebx, edi
call fcn.0046e0e3
push ebx
mov dword [ebp - 0x18], eax
call fcn.0046e103
xor bl, byte [ebp - 0x18]
inc esi
cmp esi, 0xa
mov byte [ebp + esi - 0x11], bl
pop ecx
jl 0x46e1e3
push dword [ebp - 0x1c]
call fcn.0046e15b
pop ecx
xor ebx, ebx
call fcn.0046e0e3
movzx esi, byte [ebp + ebx - 0x10]
push esi
mov dword [ebp - 0x18], eax
call fcn.0046e103
push dword [ebp - 0x14]
xor esi, dword [ebp - 0x18]
push esi
call fcn.00484e0f
add esp, 0xc
inc ebx
cmp ebx, 0xa
jl 0x46e216
call fcn.0046e0e3
mov esi, dword [ebp + 0xc]
shr esi, 0x10
and esi, edi
push esi
mov ebx, eax
call fcn.0046e103
push dword [ebp - 0x14]
xor esi, ebx
push esi
call fcn.00484e0f
call fcn.0046e0e3
mov esi, dword [ebp + 0xc]
shr esi, 0x18
push esi
mov edi, eax
call fcn.0046e103
push dword [ebp - 0x14]
xor esi, edi
push esi
call fcn.00484e0f
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c3ff
leave
ret

Function at 0x46e28e
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4bd6dc], 0
je 0x46e2c5
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x46e2c3
push ebx
call fcn.0046e0e3
mov ebx, eax
movsx eax, byte [edi]
push eax
call fcn.0046e103
xor byte [edi], bl
inc edi
dec esi
pop ecx
jne 0x46e2ab
pop ebx
pop edi
pop esi
pop ebp
jmp fcn.004830cf
Function at 0x470043
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
test eax, eax
je 0x4700ca
mov esi, dword [ebp + 8]
cmp dword [esi + 0x108ec], 0
jg 0x470098
mov edi, 0x2000
push edi
push dword [esi + 0x108e4]
push dword [esi + 0x10908]
call fcn.00487020
add esp, 0xc
mov dword [esi + 0x108ec], eax
test eax, eax
je 0x4700d2
jl 0x4700da
mov eax, dword [esi + 0x108e4]
add dword [esi + 0x10910], edi
mov dword [esi + 0x108e8], eax
mov ebx, dword [esi + 0x108ec]
cmp dword [ebp + 0x10], ebx
jae 0x4700a6
mov ebx, dword [ebp + 0x10]
push ebx
lea edi, [esi + 0x108e8]
push dword [edi]
push dword [ebp + 0xc]
call fcn.00485490
add dword [ebp + 0xc], ebx
add dword [edi], ebx
sub dword [esi + 0x108ec], ebx
add esp, 0xc
sub dword [ebp + 0x10], ebx
jne 0x470057
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0x10]
jmp 0x4700cd
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call dword [esi + 0x10b54]
xor eax, eax
jmp 0x4700cd

Function at 0x4700f1
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x109b0], 0
je 0x470104
or eax, 0xffffffff
pop esi
ret
lea eax, [esi + 0x90]
mov ecx, dword [eax]
test ecx, ecx
jg 0x47011c
dec ecx
and dword [esi + 0x108ec], 0
mov dword [eax], ecx
jmp 0x4700ff
cmp dword [esi + 0x108ec], 0
push edi
jg 0x470192
mov edi, 0x2000
push edi
push dword [esi + 0x108e4]
push dword [esi + 0x10908]
call fcn.00487020
add esp, 0xc
mov dword [esi + 0x108ec], eax
test eax, eax
jne 0x470158
and dword [esi + 0x108ec], eax
or eax, 0xffffffff
jmp 0x4701df
jge 0x470179
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call dword [esi + 0x10b54]
push 1
push 0x526ac0
call fcn.00480a4c
mov eax, dword [esi + 0x108e4]
add dword [esi + 0x10910], edi
push esi
mov dword [esi + 0x108e8], eax
call fcn.0046ffea
pop ecx
mov eax, dword [esi + 0x8d8]
test byte [eax + 0x18], 1
je 0x4701c9
mov edi, dword [esi + 0x108e8]
push ebx
mov ebx, dword [esi + 0x108ec]
jmp 0x4701c4
push esi
dec ebx
call fcn.00479e37
xor byte [edi], al
movzx eax, byte [edi]
push eax
push esi
call fcn.00479e5b
add esp, 0xc
inc edi
test ebx, ebx
jne 0x4701ad
pop ebx
dec dword [esi + 0x108ec]
lea eax, [esi + 0x108e8]
mov ecx, dword [eax]
mov dl, byte [ecx]
inc ecx
mov dword [eax], ecx
movzx eax, dl
pop edi
pop esi
ret
Function at 0x4701e2
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x10914]
add eax, dword [esp + 0x10]
push edi
mov ebx, eax
and ebx, 0x80001fff
jns 0x470205
dec ebx
or ebx, 0xffffe000
inc ebx
mov ecx, eax
sub ecx, ebx
test eax, eax
jge 0x47023c
push 1
push str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
push dword [esi + 0x10904]
lea edi, [esi + 0x8dc]
push str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
push edi
call fcn.0047c59e
add esp, 0x10
push eax
push edi
push esi
call dword [esi + 0x10b54]
push 3
pop eax
jmp 0x4702b1
cmp ecx, dword [esi + 0x10910]
je 0x470293
push 0
push ecx
lea edi, [esi + 0x10908]
push dword [edi]
call fcn.00487192
push 0x2000
push dword [esi + 0x108e4]
mov dword [esi + 0x10910], eax
push dword [edi]
call fcn.00487020
add esp, 0x18
lea ecx, [esi + 0x108ec]
mov dword [ecx], eax
test eax, eax
jg 0x47027f
push 0x33
jmp 0x470239
sub eax, ebx
mov dword [ecx], eax
mov eax, dword [esi + 0x108e4]
add eax, ebx
mov dword [esi + 0x108e8], eax
jmp 0x4702af
mov ecx, dword [esi + 0x108e4]
lea eax, [esi + 0x108e8]
mov edx, dword [eax]
sub edx, ecx
sub edx, ebx
add dword [esi + 0x108ec], edx
add ecx, ebx
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x47164b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2f
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
neg eax
sbb eax, eax
inc eax
pop ebp
ret
Function at 0x471675
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4ba700]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
push 2
mov ebx, ecx
push 0x49d934
push ebx
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x4716bb
push 2
push 0x49d930
push ebx
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x4716d1
mov al, byte [ebx + 2]
test al, al
je 0x4716d1
cmp al, 0x2f
je 0x4716d1
cmp al, 0x5c
je 0x4716d1
xor eax, eax
jmp 0x4717e1
movzx eax, byte [ebx]
push edi
push eax
call fcn.00480056
pop ecx
mov edi, 0x104
test eax, eax
je 0x4716f0
cmp byte [ebx + 1], 0x3a
jne 0x4716f0
mov dword [ebp - 0x74], ebx
jmp 0x47170a
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x471768
lea eax, [ebp - 0x70]
mov dword [ebp - 0x74], eax
push 2
push dword [ebp - 0x74]
lea ebx, [esi + 0x10b90]
push ebx
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x4717dd
push 2
push dword [ebp - 0x74]
push ebx
call fcn.0047ce10
add esp, 0xc
push edi
lea eax, [ebp + 0x94]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push ebx
mov byte [esi + 0x10b92], 0x2f
mov byte [esi + 0x10b93], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x47176c
mov byte [ebx], al
xor eax, eax
jmp 0x4717e0
push 0xc
pop eax
cmp eax, dword [ebp - 0x78]
push 4
sbb eax, eax
inc eax
mov dword [esi + 0x10b94], eax
lea eax, [ebp + 0x94]
push str.VFAT
push eax
call fcn.0047dce2
pop ecx
push eax
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x4717d4
push 4
lea eax, [ebp + 0x94]
push str.HPFS
push eax
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x4717d4
push 3
lea eax, [ebp + 0x94]
push 0x49da04
push eax
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x4717d4
xor eax, eax
jmp 0x4717d7
xor eax, eax
inc eax
mov dword [esi + 0x10b98], eax
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0x198]
xor ecx, ebp
pop ebx
call fcn.0047c3ff
add ebp, 0x19c
leave
ret

Function at 0x471cc5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x21
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x471cf9
movsx eax, byte [ebp - 4]
sub eax, 0x30
je 0x471cf9
dec eax
je 0x471cf4
dec eax
jne 0x471cf9
push 2
pop eax
leave
ret
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x471cfd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x1d
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x471d1f
mov al, byte [ebp - 4]
test al, al
jne 0x471d21
mov al, 0x2d
leave
ret
Function at 0x471eec
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x109d8]
call fcn.0047fd12
xor ebx, ebx
pop ecx
cmp dword [esi + 0x14], ebx
jne 0x4720e1
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
mov edi, esi
call fcn.00471dc1
pop ecx
pop ecx
push ebx
push 0x80
push 3
push ebx
push 2
push 0x40000000
lea edi, [esi + 0x109f0]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x8d8]
mov eax, dword [eax + 0x14]
test al, 0x5f
je 0x471f88
and eax, 0x7f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x471f88
push 1
lea ebx, [esi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nwarning___d_:_could_not_set_file_attributes_n
push ebx
call fcn.0047c59e
add esp, 0xc
push eax
push ebx
push esi
call dword [esi + 0x10b54]
mov edx, dword [esi + 0x10918]
test edx, edx
je 0x47203d
movzx ecx, word [esi + 0x10938]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.00471d23
pop ecx
pop ecx
test eax, eax
je 0x47203d
push dword [ebp - 4]
mov eax, dword [esi + 0x8d8]
push dword [eax + 0x14]
mov ecx, dword [ebp - 8]
push edi
call fcn.00471100
add esp, 0xc
cmp eax, 0x4f
jne 0x47203d
cmp dword [esi + 0x38], 0
je 0x472011
push 1
lea eax, [esi + 0x88dc]
push eax
push edi
lea ebx, [esi + 0x8dc]
call fcn.00474630
push eax
push str.__22s
push ebx
call fcn.0047c59e
add esp, 0x14
push eax
push ebx
push esi
call dword [esi + 0x10b54]
cmp dword [esi + 0x38], 0
mov eax, 0x4a46d8
jne 0x472016
mov eax, 0x4a3fbe
push 1
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff5
push eax
lea edi, [esi + 0x8dc]
push str._compressed_WinNT_security_data_missing___d_bytes__s
push edi
call fcn.0047c59e
add esp, 0x10
push eax
push edi
push esi
call dword [esi + 0x10b54]
cmp dword [ebp + 8], 0xffffffff
jne 0x47206b
push 1
lea edi, [esi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCreateFile___error__d_when_trying_set_file_time_n
push edi
call fcn.0047c59e
add esp, 0xc
push eax
push edi
push esi
call dword [esi + 0x10b54]
jmp 0x4720e0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4720d7
mov ecx, eax
and cl, 1
movsx ecx, cl
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x14]
and ecx, edx
push ecx
mov ecx, eax
and cl, 2
movsx ecx, cl
neg ecx
sbb ecx, ecx
and al, 4
movsx eax, al
lea edx, [ebp - 0x1c]
and ecx, edx
push ecx
neg eax
sbb eax, eax
lea ecx, [ebp - 0x24]
and eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4720d7
push eax
lea edi, [esi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nSetFileTime_failed:__d_n
push edi
call fcn.0047c59e
add esp, 0xc
push eax
push edi
push esi
call dword [esi + 0x10b54]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x472240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push ebx
push esi
call fcn.0047e6af
pop ecx
pop ecx
test eax, eax
jne 0x472369
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.00471da9
push 0
push 0x80
push 3
push 0
push 3
push bind
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x472365
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x472364
cmp dword [ebp - 4], 0
jne 0x47230f
lea edi, [ebx + 0x20]
mov esi, edi
lea eax, [ebp - 0x1c]
call fcn.0046b451
cmp dword [ebp - 0xc], 0
jne 0x4722e1
cmp dword [ebp - 8], 0
jne 0x4722e1
mov eax, dword [edi]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 4]
mov dword [ebx + 0x1c], eax
jmp 0x4722ec
lea esi, [ebx + 0x18]
lea eax, [ebp - 0xc]
call fcn.0046b451
cmp dword [ebp - 0x14], 0
jne 0x472302
cmp dword [ebp - 0x10], 0
jne 0x472302
mov eax, dword [edi]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 4]
jmp 0x472354
lea esi, [ebx + 0x28]
lea eax, [ebp - 0x14]
call fcn.0046b451
jmp 0x472364
lea esi, [ebx + 0x20]
lea edi, [ebp - 0x1c]
call fcn.00471318
cmp dword [ebp - 0xc], 0
jne 0x472334
cmp dword [ebp - 8], 0
jne 0x472334
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x1c], eax
jmp 0x47233f
lea esi, [ebx + 0x18]
lea edi, [ebp - 0xc]
call fcn.00471318
cmp dword [ebp - 0x14], 0
jne 0x472359
cmp dword [ebp - 0x10], 0
jne 0x472359
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x28], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x2c], eax
jmp 0x472364
lea esi, [ebx + 0x28]
lea edi, [ebp - 0x14]
call fcn.00471318
pop edi
xor eax, eax
jmp 0x4723c7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4723c4
test al, 0x10
je 0x4723c4
push 0x30
push 0
push ebx
call fcn.004858b0
push 0x210000
call fcn.004704ad
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x28], eax
mov eax, edx
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov eax, edx
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 4]
shl eax, 7
not eax
and eax, 0x80
add esp, 0x10
or eax, 0x4100
mov dword [ebx + 0x24], edx
mov word [ebx + 6], ax
jmp 0x472365
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x479e5b
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x10afc]
push ebx
mov edx, ecx
xor edx, dword [esp + 0xc]
push esi
mov esi, dword [eax + 0x108dc]
push edi
shr ecx, 8
mov edi, 0xff
and edx, edi
mov ebx, dword [esi + edx*4]
xor ebx, ecx
lea edx, [eax + 0x10b00]
movzx ecx, bl
add ecx, dword [edx]
mov dword [eax + 0x10afc], ebx
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edx], ecx
lea edx, [eax + 0x10b04]
mov eax, dword [edx]
shr ecx, 0x18
xor ecx, eax
and ecx, edi
shr eax, 8
xor eax, dword [esi + ecx*4]
pop edi
pop esi
mov dword [edx], eax
mov eax, dword [esp + 0xc]
pop ebx
ret

Function at 0x479efc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4ba700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
push ebx
mov esi, ecx
call fcn.00479ebc
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
pop ecx
xor esi, esi
push ebx
lea edx, [ebp + esi - 0x10]
call fcn.00479e37
xor byte [edx], al
movzx eax, byte [edx]
push eax
push ebx
call fcn.00479e5b
add esp, 0xc
inc esi
cmp esi, 0xc
jl 0x479f24
movzx ax, byte [ebp - 5]
movzx ecx, ax
mov eax, dword [ebx + 0x8d8]
test byte [eax + 0x18], 2
je 0x479f60
movzx eax, byte [ebx + 0x10929]
jmp 0x479f67
movzx eax, byte [ebx + 0x1092f]
movzx ecx, cx
cmp ecx, eax
je 0x479f73
or eax, 0xffffffff
jmp 0x479faa
mov eax, dword [ebx + 0x108ec]
mov edi, dword [ebx + 0x90]
cmp eax, edi
jg 0x479f85
mov edi, eax
mov esi, dword [ebx + 0x108e8]
jmp 0x479fa4
push ebx
dec edi
call fcn.00479e37
xor byte [esi], al
movzx eax, byte [esi]
push eax
push ebx
call fcn.00479e5b
add esp, 0xc
inc esi
test edi, edi
jne 0x479f8d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047c3ff
leave
ret

Function at 0x47a426
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor esi, esi
cmp dword [0x4d8ae0], esi
je 0x47a436
xor eax, eax
inc eax
pop esi
ret
push ebx
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
cmp ebx, esi
jne 0x47a44b
xor eax, eax
jmp 0x47a4bc
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
mov ebp, 0x4d8ae4
push ebp
call edi
mov esi, eax
test esi, esi
je 0x47a484
push esi
push ebp
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x4d8ae0]
jmp 0x47a4ba
push 0x4f4200
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x120
push 0
push 0x4f40c0
call fcn.004858b0
add esp, 0xc
call fcn.0047a36d
xor esi, esi
inc esi
push ebx
mov dword [0x4d8ae0], esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x47c390
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
xor eax, eax
cmp dword [ecx + 0x28], eax
jne 0x47c3a8
cmp dword [ecx + 0x2c], eax
jne 0x47c3a8
mov dword [ecx + 0x34], eax
add esp, 4
jmp fcn.0047c2a0
mov byte [esp + 3], al
push 0x4b4e94
lea eax, [esp + 7]
push eax
call fcn.00488486
int3

Function at 0x47c3ff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ba700]
jne 0x47c409
repz ret
jmp fcn.00488683