joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6aa0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
test edi, edi
je 0x4a6c2b
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, dword [0x4f1c80]
je 0x4a6ad9
mov esi, edi
call fcn.004a7ae0
test al, al
jne 0x4a6c2b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x4a6afc
push eax
push 0x4dab18
call fcn.0049be50
add esp, 4
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4a6b10
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, esi
jne 0x4a6b1e
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp byte [0x4f0cfa], 0
jne 0x4a6b38
push esi
call fcn.004a6a40
add esp, 4
test eax, eax
jne 0x4a6c2d
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x4a6b93
push 0
push esi
call ebx
mov ebx, eax
test ebx, ebx
je 0x4a6b97
cmp dword [0x4f1c80], ebx
je 0x4a6b78
call fcn.004a7ae0
test al, al
jne 0x4a6b78
mov eax, dword [0x4f1c80]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x4a6b97
cmp ebx, ebp
je 0x4a6b97
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
jmp 0x4a6b97
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], 0
nop
push esi
call fcn.004a6a40
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4a6bea
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x4a6ba0
push 0xffc3d44d
push ebp
push ebp
push ebp
push 0x12
push 2
call fcn.0040fd20
push 0xffc3d44d
push ebp
push ebp
push ebp
push 0x12
push 2
call fcn.0040fd20
push esi
call fcn.004a6a40
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x4a6c01
mov ecx, dword [0x4f1c80]
push 0
push ebx
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x4a6c16
mov edx, dword [esp + 0x18]
push 0
push edx
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x4a6c2b
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4a6d20
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x4a6d30
mov eax, esi
call fcn.004518c0
jmp 0x4a6d3d
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 4]
test eax, eax
js 0x4a6d98
je 0x4a6d98
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.00401910
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x4a6d95
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4a6d95
push 1
push 0x8000012f
call fcn.00401910
add esp, 8
push esi
call ebx
test eax, eax
jne 0x4a6d74
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x4a6f70
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e60
call fcn.004c6f60
mov eax, dword [esp + 0x8e68]
push ebx
push ebp
mov ebp, dword [esp + 0x8e6c]
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
cmp cl, 0x41
je 0x4a6f9b
cmp cl, 0x61
jne 0x4a6fec
cmp byte [edx + 1], bl
jne 0x4a6fec
cmp byte [edi], bl
jne 0x4a6fec
cmp byte [eax], bl
jne 0x4a6fec
cmp byte [esi], bl
jne 0x4a6fec
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x4a6fcd
cmp byte [ebp + 0xca], bl
jne 0x4a6fcd
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a6fcd
xor esi, esi
cmp byte [esp + 0x8e7c], bl
je 0x4a6fe0
cmp esi, ebx
je 0x4a6fe0
mov dword [ebp + 0xa4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
cmp cl, bl
jne 0x4a700d
cmp byte [edi], bl
jne 0x4a700d
cmp byte [eax], bl
jne 0x4a700d
cmp byte [esi], bl
jne 0x4a700d
mov eax, ebp
call fcn.004a7160
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x828], 0x4d6959
mov byte [esp + 0xc45], bl
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
mov dword [esp + 0xc54], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov dword [esp + 0xc68], ebx
mov dword [esp + 0xc6c], ebx
call fcn.004a7c70
test eax, eax
je 0x4a711e
test byte [esp + 0xc], 2
mov al, byte [esp + 0x8e78]
mov ecx, dword [esp + 0x8e80]
mov edx, dword [esp + 0x8e84]
mov byte [esp + 0xc35], al
mov dword [esp + 0xc44], ecx
mov dword [esp + 0xc48], edx
je 0x4a712a
mov eax, dword [esp + 0x828]
cmp eax, 0xffff
je 0x4a70f6
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a711e
cmp byte [ebp + 0xca], bl
jne 0x4a70ef
mov eax, dword [esp + 0x828]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a70ef
mov ecx, dword [esp + 0x828]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x4a711e
mov eax, dword [esp + 0x828]
cmp dword [esp + 0xc5c], eax
je 0x4a710f
lea esi, [esp + 0xc]
mov dword [esp + 0xc5c], eax
call fcn.004a80b0
push ebx
lea edx, [esp + 0x10]
push edx
call fcn.004a8170
test eax, eax
jne 0x4a713a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
lea eax, [esp + 0xc]
push eax
push 0x4a71d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc3c]
cmp byte [esp + 0x8e7c], bl
je 0x4a7154
cmp eax, ebx
je 0x4a7154
mov dword [ebp + 0xa4], eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
Function at 0x4a7340
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.004c6f60
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x4a7369
mov ecx, edi
call fcn.0041a480
cmp dword [esp + 0x8038], 0
jne 0x4a737e
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x4a7393
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x4a739d
mov ebp, 1
test esi, esi
je 0x4a756a
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x4a756a
cmp ebp, dword [esp + 0x20]
jg 0x4a756a
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.004a4350
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x4a7563
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x4a7410
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x4a7487
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x4a74de
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x4a7487
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4a74d9
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.004a6900
test al, al
jne 0x4a7504
cmp dword [esp + 0x802c], 0
jne 0x4a74e8
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a7537
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x4a74be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4a751c
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.00401910
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x4a7410
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x4a7537
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.004a5c20
mov esi, eax
jmp 0x4a753c
mov eax, dword [0x4f13d8]
push 1
push 0
push 0xffffffffffffffff
push 0x4d69c8
push eax
call fcn.004a5c20
jmp 0x4a74de
mov ecx, dword [0x4f13d8]
push 1
push 0
push 0xffffffffffffffff
push 0x4d9220
push ecx
call fcn.004a5c20
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x4d9220
test edi, edi
jne 0x4a7578
mov eax, 0x4d9598
mov ecx, dword [0x4ec48c]
test byte [ecx + 0xe0], 1
jne 0x4a75a5
mov edx, dword [0x4f13d8]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.004a5c20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ecx, dword [0x4f2048]
push 0x4d6959
push 0
push eax
call fcn.0042d070
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x4a80b0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x4a8167
mov eax, dword [esi]
test eax, eax
je 0x4a8167
push edi
test al, 1
jne 0x4a80d9
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x4a80f2
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x4a80f2
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x4a810d
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x4a8148
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x4a8148
movzx edx, byte [esi + 0xc28]
push edx
mov edx, dword [esp + 8]
lea ecx, [esi + 0x8d58]
call fcn.0044d860
add esp, 4
test eax, eax
jne 0x4a8148
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x4a8167
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x4a88f0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.004c6f60
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4a899e
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x4a9040
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x4d6959
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov word [esp + 0xc50], cx
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x4a899e
mov ecx, dword [0x4ec48c]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x4a899e
push 1
push eax
call fcn.00401910
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x4a89b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x4a89cc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4ec48c]
push eax
push esi
mov ecx, edi
call fcn.004a8e70
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x4a8a03
test eax, eax
jne 0x4a8a07
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.004a8ac0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x4a8a86
test esi, esi
je 0x4a8a86
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401910
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x4a8a65
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x4a8a65
push 1
push 0x8000012f
call fcn.00401910
add esp, 8
push esi
call edi
test eax, eax
jne 0x4a8a40
mov edx, dword [0x4ec48c]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x4a8a7e
push 1
push eax
call fcn.00401910
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x4a8aa0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.004a8ac0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.004a8c40
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4a8c40
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.004c6f60
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x4a8dc0
xor cl, cl
mov eax, edi
call fcn.004a8de0
test eax, eax
jne 0x4a8c75
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4ec48c]
push eax
push ebp
mov ecx, edi
call fcn.004a8e70
test eax, eax
je 0x4a8c98
xor eax, eax
mov dword [0x4f1c74], eax
jmp 0x4a8c9d
mov eax, dword [0x4f1c74]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x4d6959
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x4a8ce3
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x4a8ceb
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4f1c70]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x4a8f40
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x4a8d98
lea ecx, [esp + 0x10]
push ecx
push 0x4a7a30
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x4a8d55
mov edx, dword [esp + 0xc48]
call fcn.004a8600
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.004a6aa0
mov edx, dword [esp + 0xc48]
call fcn.004a8600
mov edx, dword [0x4ec48c]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x4a8dc0
push 1
push eax
call fcn.00401910
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4f1c74]
cmp eax, ebx
je 0x4a8dc0
cmp eax, 1
setg al
mov dword [0x4f1c74], ebx
cmp al, bl
je 0x4a8dc0
mov edx, ebp
call fcn.004a8600
push ebx
mov ecx, edi
call fcn.004a8c40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x4abba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4abba7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x4abc7d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4e0058]
add ecx, 8
sub edx, 8
dec esi
jne 0x4abbc0
pop edi
test edx, edx
je 0x4abc9a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4e0058]
inc ecx
dec edx
jne 0x4abc81
not eax
pop esi
ret

Function at 0x4abca0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e0058]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4e0058]
mov dword [edx + 8], ecx
ret
Function at 0x4abe30
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x4abe5a
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor edi, edi
and edx, 1
je 0x4abe73
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x14]
test al, 2
je 0x4abe7a
or edi, 2
test al, 4
je 0x4abe81
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x4abe8b
or edi, 0x10
test al, 0x20
je 0x4abe92
or edi, 0x20
test ecx, ecx
je 0x4abe9e
or edi, 0x40000000
jmp 0x4abea4
or edi, 0x80000000
or edi, 0x1000000
mov dword [esp + 0x14], edi
test edx, edx
jne 0x4abebc
or edi, 0x800000
mov dword [esp + 0x14], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
cmp eax, 0x28
jbe 0x4abf70
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x4abf6c
mov eax, dword [esp + 0x20]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x1c], ecx
jbe 0x4abf6c
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x4abf64
cmp eax, 0x454e
je 0x4abf64
cmp eax, 0x454c
je 0x4abf64
cmp eax, 0x4550
jne 0x4abf6c
or dword [esp + 0x14], 0x400000
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4abf7a
mov dword [eax], edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4abf88
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
test ebp, ebp
je 0x4ac006
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.004c9150
mov dword [ebp + 4], edx
push 0
mov ecx, edi
sub ecx, 0xd53e8000
mov edx, esi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebp], eax
call fcn.004c9150
mov ecx, dword [esp + 0x30]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x2c]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [ebp + 0xc], edx
call fcn.004c9150
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x4ac033
push esi
push edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004abdc0
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x24]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [ebx], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x4ac1f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x4ac2cb
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x4ac224
cmp dword [esi + 0x40], edi
jae 0x4ac224
push eax
call fcn.004bb5ab
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x4ac23b
lea eax, [edi + edi]
push eax
call fcn.004bb279
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.004c3030
add esp, 0xc
cmp edi, ebp
jbe 0x4ac2c7
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e0058]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e0058]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x4ac250
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x4ac304
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4ac2ec
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.004c3030
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4ac325
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x4ac780
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x4ac7ce
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x4ac80b
sub edi, eax
cmp edi, edx
jbe 0x4ac7a4
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.004c3030
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.004abba0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x4ac804
push 0
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ac80b
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.004abba0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
pop ecx
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ecx
ret