joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47120c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x47121e
add esp, 0xfffffff0
call fcn.00404880
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422770
mov eax, dword [0x5c886c]
mov dword [eax + 4], ebx
mov dword [eax], 0x4715b0
mov eax, dword [0x5c887c]
mov dword [eax + 4], ebx
mov dword [eax], 0x4715bc
mov eax, ebx
call fcn.004715c8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x46cc5c
push eax
push 0
push 0
mov eax, dword [0x5c8af8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x426ad8]
call fcn.004283cc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x426ad8]
call fcn.004283cc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x426ad8]
call fcn.004283cc
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004719f8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4718c8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4718c8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4718c8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47135b
call fcn.004048d8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4716ac
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x471857
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x471838
mov dl, 1
mov eax, dword [0x4194f4]
call fcn.0040452c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040543c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x471827
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004639b0
test al, al
je 0x47181a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x471868
lea eax, [ebp - 0x254]
call fcn.0040baa0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47181a
xor eax, eax
push ebp
push 0x471813
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4718a0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4717fc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004056ac
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4717fc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004056ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47181a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x47171d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041deb4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47185e
lea eax, [ebp - 0x260]
call fcn.0040543c
ret

Function at 0x4721d0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5cdcdc]
cmp byte [eax + 0xad], 0
jne 0x472241
cmp dword [0x5cdcf8], 0
jne 0x472202
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x47218c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5cdcf8], eax
cmp dword [0x5cdcf4], 0
jne 0x47221d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x5cdcf4], eax
cmp dword [0x5cdcfc], 0
jne 0x472241
push esp
push 0
push 0
push 0x472130
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5cdcfc], eax
pop edx
ret
Function at 0x472414
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x47242b
add esp, 0xfffffff0
call fcn.00404880
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422770
mov eax, dword [0x5c8acc]
cmp word [eax + 2], 0
jne 0x472453
mov eax, dword [0x5c8acc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047402c
mov eax, dword [0x5c8c14]
cmp word [eax + 2], 0
jne 0x47246d
mov eax, dword [0x5c8c14]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00474238
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x418e88]
call fcn.0040452c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x427688]
call fcn.0042f8f4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x472624
mov eax, dword [0x5c8930]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042fcc8
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x47490c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5c8930]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040f9d4
test eax, eax
je 0x472574
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040b0a8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040fa08
test eax, eax
je 0x472588
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004056ac
mov byte [ebx + 0xd4], 0
push ebx
push 0x473b3c
call fcn.00423900
mov dword [ebx + 0xc8], eax
mov eax, dword [0x5c86d4]
cmp byte [eax], 0
jne 0x4725d9
mov eax, ebx
call fcn.00472768
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00474ae4
mov eax, ebx
call fcn.00475648
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x472619
call fcn.004048d8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4729e8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x472a87
cmp dword [ebx + 0x94], 0
jne 0x472a81
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x472970
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x472a81
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x472a47
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x472a81
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b558
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x472a56
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x472ca0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5cdcdc]
cmp dword [eax + 0x30], 0
je 0x472dfd
test bl, bl
jne 0x472d4e
cmp dword [esi + 0x9c], 0
jne 0x472d43
mov eax, esi
call fcn.004754c4
push eax
push 0x472bcc
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x472d14
mov eax, dword [0x5cdcdc]
call fcn.00475ba4
test al, al
je 0x472d14
mov eax, dword [0x5cdd00]
call fcn.00406730
mov edi, eax
cmp edi, 0
jl 0x472d14
push 0
mov eax, dword [0x5cdd00]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x472cfe
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x472d43
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b558
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x472d23
inc dword [esi + 0x9c]
jmp 0x472dfd
cmp dword [esi + 0x9c], 0
jle 0x472dfd
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x472dfd
cmp dword [esi + 0x44], 0
je 0x472da9
mov eax, dword [0x5cdcdc]
call fcn.00475ba4
test al, al
je 0x472da9
mov eax, dword [0x5cdd00]
call fcn.00406730
mov edi, eax
cmp edi, 0
jl 0x472da9
push 5
mov eax, dword [0x5cdd00]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x472d93
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x472dd8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b558
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x472db8
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x5cdd00
mov ecx, 1
mov edx, dword [0x472bac]
call fcn.004068e4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x473890
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4738fa
mov eax, ebx
call fcn.00475ba4
test al, al
jne 0x4738fa
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040552c
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4738e7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x473907
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405490
jmp 0x473907
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405490
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x474cc8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x474d36
mov eax, esi
call fcn.0045e62c
test al, al
je 0x474d36
mov eax, dword [ebx + 0x84]
call fcn.0045e27c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x474d36
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x474d2a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045e27c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00456124
jmp 0x474d36
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00474b04
pop esi
pop ebx
ret
Function at 0x4761a4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408528]
call fcn.00405ef4
xor eax, eax
push ebp
push 0x476345
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c9ac4], 0
jne 0x4761ff
mov ecx, dword [0x5c8700]
mov dl, 1
mov eax, dword [0x408b68]
call fcn.0040ea5c
call fcn.00404dd0
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b50
mov eax, ebx
call fcn.00405da4
mov dword [ebp - 0x24], eax
mov esi, 0x476354
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407008
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405db4
test eax, eax
jle 0x4762e8
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4762d4
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004056ac
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x47627a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004056c4
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x476290
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004056c4
mov eax, dword [ebp - 0x54]
call fcn.004058cc
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004056ac
mov eax, dword [ebp - 0x58]
call fcn.004058cc
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4762d6
xor eax, eax
test al, al
je 0x4762e1
mov ebx, 0x15
jmp 0x4762ed
mov ebx, 0x10
jmp 0x4762ed
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4c9ac4]
call fcn.00476024
mov eax, dword [ebp - 4]
call fcn.00476024
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47634c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405460
lea eax, [ebp - 0xc]
mov edx, dword [0x408528]
call fcn.00405fc4
ret
Function at 0x481324
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x481495
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x481470
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00405624
lea eax, [ebp - 0x118]
mov edx, 0x4814ac
call fcn.00405708
mov eax, dword [ebp - 0x118]
call fcn.004058cc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4813e2
lea eax, [ebp - 0x111]
call fcn.0040b054
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0040552c
jmp 0x4813e9
mov eax, esi
call fcn.0040543c
cmp bl, 0x61
jae 0x48140a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040f8a0
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00405490
jmp 0x481424
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040f80c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00405490
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4814b8
call fcn.0040bb20
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00405490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481477
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x485adc
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
mov eax, dword [esi + 0x70]
push eax
call sub.kernel32.dll_PostQueuedCompletionStatus
mov eax, dword [esi + 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0x42000000
push 3
push 0
push 7
push 0xc0000000
mov eax, dword [esi + 0x68]
call fcn.004058cc
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
mov eax, esi
call fcn.00485ad0
mov dword [esi + 0x44], edi
mov eax, esi
call fcn.00485c64
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x485b4b
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
jne 0x485b65
mov eax, esi
call fcn.00485ad0
xor eax, eax
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0x70], eax
mov eax, esi
call fcn.00485c64
jmp 0x485bda
push 0
mov eax, dword [esi + 4]
push eax
push 0
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_CreateIoCompletionPort
mov ebx, eax
mov eax, esi
call fcn.00485ad0
mov dword [esi + 0x70], ebx
mov eax, esi
call fcn.00485c64
xor eax, eax
mov dword [esi + 0x8c], eax
lea eax, [esi + 0x90]
xor ecx, ecx
mov edx, 0x1000
call fcn.00403b50
push 0
lea eax, [esi + 0x74]
push eax
lea eax, [esi + 0x8c]
push eax
mov eax, dword [esi + 0x88]
push eax
cmp byte [esi + 0x6c], 1
cmc
sbb eax, eax
push eax
push 0x1000
lea eax, [esi + 0x90]
push eax
mov eax, dword [esi + 0x44]
push eax
call sub.kernel32.dll_ReadDirectoryChangesW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x487f84
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x487fe2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.00488060
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x487fca
lea eax, [ebp - 4]
call fcn.00488060
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x487fcc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487fe9
lea eax, [ebp - 4]
call fcn.0040543c
ret

Function at 0x487ff0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x488054
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00488060
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48805b
lea eax, [ebp - 4]
call fcn.0040543c
ret
Function at 0x488614
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x48870d
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.00487d14
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ae20
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00488fe4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ace0
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0048905c
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488714
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405460
ret
Function at 0x48871c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x488825
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00487d14
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4887eb
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ae20
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00488fe4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ace0
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0048905c
jmp 0x4887fd
xor edx, edx
mov eax, ebx
call fcn.00488fe4
xor edx, edx
mov eax, ebx
call fcn.0048905c
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48882c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405460
ret

Function at 0x48f114
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.0048f350
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.0048f350
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x48f188
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x48f1ae
inc esi
mov eax, edi
call fcn.0048f16c
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.0048f114
inc ebx
dec esi
jne 0x48f197
pop edi
pop esi
pop ebx
ret
Function at 0x48f244
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004058bc
xor eax, eax
push ebp
push 0x48f2ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0048f1b4
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0048f16c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0048f114
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x48f284
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f2c1
lea eax, [ebp - 4]
call fcn.0040543c
ret