joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e260
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45e277
add esp, 0xfffffff0
call fcn.00403bc8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041efd0
mov eax, dword [0x4b91e4]
cmp word [eax + 2], 0
jne 0x45e29f
mov eax, dword [0x4b91e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f8ac
mov eax, dword [0x4b92c8]
cmp word [eax + 2], 0
jne 0x45e2b9
mov eax, dword [0x4b92c8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045faa4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4143d0]
call fcn.00403834
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4143d0]
call fcn.00403834
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x421480]
call fcn.00428938
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45e440
mov eax, dword [0x4b90a8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00428d08
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x460014
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4b90a8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d5e4
test eax, eax
je 0x45e3ae
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004097f4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d60c
test eax, eax
je 0x45e3c2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404900
mov eax, dword [0x4b8ec0]
cmp byte [eax], 0
jne 0x45e3f6
mov eax, ebx
call fcn.0045e568
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004601f0
mov eax, ebx
call fcn.00460b30
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45e436
call fcn.00403c20
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e7dc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4bac34]
cmp dword [eax + 0x30], 0
je 0x45e886
cmp dword [ebx + 0x94], 0
jne 0x45e880
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45e76c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e880
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45e846
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e880
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00416c5c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e855
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45f364
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45f399
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404788
jmp 0x45f3a6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046ec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4603cc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46040d
mov eax, esi
call fcn.0044633c
test al, al
je 0x46040d
mov eax, dword [ebx + 0x84]
call fcn.00446038
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46040d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00446038
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x475b40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b38
xor eax, eax
push ebp
push 0x475bd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00476114
test al, al
jne 0x475b87
lea eax, [ebp - 0x20c]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
jmp 0x475b95
lea eax, [ebp - 0x20c]
mov edx, dword [ebp - 4]
call fcn.00409850
lea eax, [ebp - 0x108]
push eax
xor bl, 1
xor eax, eax
mov al, bl
push eax
push 0x475be8
lea eax, [ebp - 0x20c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, esi
lea eax, [ebp - 0x108]
call fcn.004099d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475bdf
lea eax, [ebp - 4]
call fcn.00404698
ret

Function at 0x475c58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475ce5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040959c
xor ebx, ebx
mov edx, dword [ebp - 0xc]
mov eax, 0x475cfc
call fcn.00404c8c
mov esi, eax
test esi, esi
jle 0x475ccf
mov eax, dword [ebp - 0xc]
call fcn.00404950
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
lea eax, [ebp - 0xc]
call fcn.00404be8
mov eax, dword [ebp - 0xc]
call fcn.00404950
mov ecx, eax
lea eax, [ebp - 5]
mov edx, dword [ebp - 0xc]
call fcn.00409874
lea eax, [ebp - 5]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475cec
lea eax, [ebp - 0xc]
call fcn.00404698
ret

Function at 0x475d00
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x11c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475de6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x11c]
mov eax, ebx
call fcn.00409488
lea eax, [ebp - 0x11c]
mov edx, 0x475e04
call fcn.00404958
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00409850
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x475dcd
xor eax, eax
push ebp
push 0x475da9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
imul dword [ebp - 0xc]
imul dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475dcd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475ded
lea eax, [ebp - 0x11c]
call fcn.00404698
ret
Function at 0x475f3c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4760ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00409488
cmp dword [ebp - 0xc], 0
jne 0x475f8c
lea eax, [ebp - 0x10]
call fcn.004097ac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409488
lea eax, [ebp - 0xc]
mov edx, 0x476104
call fcn.00404958
mov eax, ebx
call fcn.004765e0
sub al, 2
jb 0x475fab
je 0x475fbe
jmp case.default.0x476013
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x476013
mov edx, ebx
mov eax, 0x476110
call fcn.00404c8c
dec eax
jne 0x475ffc
call fcn.00475ee0
test al, al
je 0x475fe9
mov eax, dword [ebp - 0xc]
call fcn.00475e08
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x476013
mov dword [ebp - 8], 0x7fffffff
mov dword [ebp - 4], 0
jmp case.default.0x476013
mov eax, dword [ebp - 0xc]
call fcn.00404b48
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x476013
jmp dword [eax*4 + 0x47601a]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x476013
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x476013
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x476013
mov eax, dword [ebp - 0xc]
call fcn.00475d00
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x476013
mov eax, dword [ebp - 0xc]
call fcn.00475ecc
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x476013
mov eax, dword [ebp - 0xc]
call fcn.00475d00
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x476013
mov eax, dword [ebp - 0xc]
call fcn.00475e08
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xffffffff
jne 0x4760b3
cmp dword [ebp - 8], 0xffffffff
jb 0x4760c8
jmp 0x4760b5
jl 0x4760c8
cmp dword [ebp - 4], 0
jne 0x4760c6
cmp dword [ebp - 8], 0x7fffffff
jbe 0x4760cf
jmp 0x4760c8
jle 0x4760cf
mov ebx, 0x7fffffff
jmp 0x4760d2
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4760f4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004046bc
ret

Function at 0x476114
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
xor ebx, ebx
mov edx, esi
mov eax, 0x476170
call fcn.00404c8c
test eax, eax
jne 0x47615a
mov edx, esi
mov eax, 0x47617c
call fcn.00404c8c
test eax, eax
jne 0x47615a
mov eax, esp
mov edx, esi
call fcn.00409850
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47615a
test al, 0x10
je 0x47615a
mov bl, 1
mov eax, ebx
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x477030
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [eax]
movzx ecx, cx
dec ecx
test ecx, ecx
jl 0x47705f
inc ecx
mov ebx, esi
xor bl, byte [edx]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4b8328]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov esi, ebx
inc edx
dec ecx
jne 0x47703d
mov dword [eax], esi
pop esi
pop ebx
ret

Function at 0x477eb8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
sub ecx, 1
jno 0x477ec9
call fcn.004037a4
test ecx, ecx
jl 0x477eee
inc ecx
mov ebx, edx
xor bl, byte [esi]
and ebx, 0xff
mov edi, dword [0x4b8eb8]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
add esi, 1
dec ecx
jne 0x477ece
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x47839c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
cmp eax, dword [esp]
jge 0x4783cb
mov ecx, 0xd4
mov edx, 0x4784ec
mov eax, 0x47852c
call fcn.004045f4
mov eax, dword [esp + 4]
cmp eax, dword [esp]
je 0x4783f2
mov eax, dword [esp]
dec eax
cmp eax, dword [esp + 4]
je 0x4783f2
mov ecx, 0xd6
mov edx, 0x4784ec
mov eax, 0x478574
call fcn.004045f4
mov eax, dword [ebx + 0x28]
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jle 0x4783ff
inc eax
mov edx, dword [ebx + 0x18]
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x47843f
inc esi
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, eax
and edi, dword [ebx + 0x58]
mov ebp, dword [esp + 8]
lea ebp, [ebp + edi*4]
mov edi, dword [ecx + edx*4]
mov dword [ebp], edi
mov dword [ecx + edx*4], eax
inc eax
dec esi
jne 0x478416
mov esi, dword [esp + 8]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x478478
mov eax, dword [esp]
add dword [ebx + 0x44], eax
mov eax, dword [esp]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x478492
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x478492
mov eax, ebx
call fcn.004788fc
jmp 0x478492
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x5c]
jl 0x478492
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x5c]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x4784ca
mov eax, dword [esp]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x4784ca
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
fmul dword [0x4785b0]
fild dword [ebx + 0x50]
fdivp st(1)
call fcn.00402be8
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x4784d9
mov eax, ebx
call fcn.004788fc
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x479428
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x479457
mov ecx, 0xae
mov edx, 0x4794f4
mov eax, 0x479534
call fcn.004045f4
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
dec esi
test esi, esi
jl 0x4794c8
inc esi
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
mov dl, byte [ebx]
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
mov edx, dword [edi]
mov al, byte [ebx]
call fcn.00477064
mov ebp, eax
mov dword [edi], ebp
and ebp, 0xff
add dword [edi + 4], ebp
imul ebp, dword [edi + 4], 0x8088405
inc ebp
mov dword [edi + 4], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.00477064
mov dword [edi + 8], eax
inc ebx
dec esi
jne 0x479477
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47957c
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x4795a4
mov ecx, 0xde
mov edx, 0x47962c
mov eax, 0x47966c
call fcn.004045f4
mov edx, esi
mov eax, ebx
call fcn.004796a0
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
mov al, byte [esi]
call fcn.00477064
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00477064
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x4795ba
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4796a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.00404950
mov esi, eax
test esi, esi
jle 0x47970e
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.00477064
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00477064
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x4796d2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4799a8
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
cmp dword [ebp - 8], 0
jne 0x4799d3
mov ecx, 0x172
mov edx, 0x479b98
mov eax, 0x479bd8
call fcn.004045f4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00479d5c
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.00403114
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.00477064
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00477064
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4799e7
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00479d5c
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov al, byte [edi]
mov edx, dword [ebx + 8]
call fcn.00477064
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00477064
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x479a62
mov al, byte [ebp + 0xa]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.00477064
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00477064
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.00477064
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00477064
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x479c0c
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x479c3b
mov ecx, 0x1dd
mov edx, 0x479cdc
mov eax, 0x479d1c
call fcn.004045f4
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
mov esi, ebx
dec ebp
test ebp, ebp
jl 0x479caf
inc ebp
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
mov bl, byte [esi]
mov edx, ebx
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [esi], dl
mov edx, dword [edi]
mov eax, ebx
call fcn.00477064
mov dword [edi], eax
mov eax, dword [edi]
and eax, 0xff
add dword [edi + 4], eax
imul ebx, dword [edi + 4], 0x8088405
inc ebx
mov dword [edi + 4], ebx
mov eax, ebx
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.00477064
mov dword [edi + 8], eax
inc esi
dec ebp
jne 0x479c5d
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x479d5c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.00404950
mov esi, eax
test esi, esi
jle 0x479dca
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.00477064
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00477064
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x479d8e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47fe90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x47feac
add esp, 0xfffffff0
call fcn.00403bc8
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00404b38
xor eax, eax
push ebp
push 0x47ffa1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403834
mov byte [ebx + 8], 0
mov eax, dword [ebp - 8]
call fcn.00475c58
test al, al
je 0x47ff01
push esi
push 0
mov eax, dword [ebx + 0x28]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x47e4b4]
call fcn.0047ea70
mov dword [ebx + 4], eax
jmp 0x47ff1a
push esi
push 1
mov eax, dword [ebx + 0x28]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x47e4b4]
call fcn.0047ea70
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
mov dword [eax + 0x34], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0x64]
mov dword [eax + 0x30], edx
mov dword [eax + 0x3c], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
mov dword [eax + 0x38], edx
xor eax, eax
mov dword [ebx + 0x38], eax
mov byte [ebx + 0x3e], 1
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 8]
call fcn.004046ec
mov dword [ebx + 0x94], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0x34]
mov dword [ebx + 0x90], eax
mov byte [ebx + 0x44], 0
mov word [ebx + 0x3c], si
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402b50
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409454
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00481478
mov eax, ebx
call fcn.00480cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ffa8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004046bc
ret

Function at 0x48158c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x481640
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x34], dl
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x4815b8
call fcn.00403864
xor eax, eax
mov dword [ebx + 0x38], eax
cmp byte [ebx + 0x34], 0
je 0x48162a
cmp dword [ebx + 0x30], 0
je 0x48162a
xor eax, eax
push ebp
push 0x4815ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebx + 0x30]
mov dl, 1
mov eax, dword [0x414c34]
call fcn.004195f0
mov dword [ebx + 0x38], eax
mov edx, dword [ebx + 0xc]
mov cl, 6
mov eax, ebx
call fcn.00480d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48162a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481647
lea eax, [ebp - 4]
call fcn.00404698
ret