joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0
push 0
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x2b8]
push 0x1004
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
xor ebp, ebp
test ebx, ebx
mov dword [esp + 0xc], ebx
jg 0x463ef4
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret 8
mov ebx, dword [esp + 0xc]
cmp dword [esp + 0x20], 0
je 0x463f26
mov eax, 0x51eb851f
imul ebp
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
mov ecx, ebp
sub ecx, eax
jne 0x463f26
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x1f4
ja 0x463ee2
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 0xc]
add esi, ebp
cmp esi, ebx
jl 0x463f3b
test byte [eax + 0x10], 0x20
je 0x463ee2
sub esi, ebx
lea ebx, [esp + 0x14]
mov eax, edi
call fcn.00461eb0
test eax, eax
je 0x463f73
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov ecx, dword [eax]
mov eax, dword [edi + 4]
imul eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
add eax, ecx
mov ecx, dword [esp + 0x20]
push ecx
push edx
push eax
push edi
call fcn.004610c0
test eax, eax
jne 0x463f8c
add ebp, 1
cmp ebp, dword [esp + 0xc]
jl 0x463ef0
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret 8
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x4642f0
Capabilities:
Write file on windows

Disassembly:
cmp edi, 5
push ebx
push esi
mov ebx, eax
mov esi, ecx
je 0x464300
cmp edi, 6
jne 0x464309
mov eax, dword [esi]
mov edx, dword [eax + 0x5c]
push edi
push ebx
call edx
cmp edi, 7
jne 0x46431b
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push ebx
mov ecx, esi
call edx
pop esi
pop ebx
ret
cmp edi, 2
jne 0x464334
cmp dword [esi + 0x2fc], 0
je 0x464318
push ebx
xor ebx, ebx
call fcn.00463880
pop esi
pop ebx
ret
cmp edi, 4
jne 0x46434f
cmp dword [esi + 0x2fc], 0
je 0x464318
push 0
push ebx
mov ebx, esi
call fcn.004638f0
pop esi
pop ebx
ret
cmp edi, 3
jne 0x464318
mov dword [esi + 0x2c], 0
mov ecx, esi
pop esi
mov eax, ebx
mov edx, 0x47eae4
pop ebx
jmp fcn.004622a0
Function at 0x464980
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2004
call fcn.0047aea0
push 0x2000
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x48c9d8
push 0x1000
lea ecx, [esp + 8]
push ecx
push 0x47c518
push esi
push 0x48cbe8
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [esp], 0
je 0x4649df
cmp dword [esp + 0x200c], 0
jne 0x4649df
xor eax, eax
add esp, 0x2004
ret
mov edx, dword [esp + 0x2008]
push 0x48c9d8
push edx
push esi
push 0x48cbe8
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
add esp, 0x2004
ret

Function at 0x464a00
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2004
call fcn.0047aea0
push 0x2000
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x2014]
add esp, 0xc
push 0x48c9d8
push 0x1000
lea ecx, [esp + 8]
push ecx
push 0x47c518
push edx
push 0x48cbe8
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [esp], 0
je 0x464a7c
mov edx, dword [esp + 0x200c]
lea eax, [esp]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x464a61
mov eax, 1
add esp, 0x2004
ret
xor eax, eax
add esp, 0x2004
ret

Function at 0x464dd0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push esi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x464eb8
mov edx, 0x48c9d8
mov eax, esi
sub edx, esi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x464df0
xor eax, eax
movzx ecx, word [eax + str.general]
mov word [eax + 0x48cbe8], cx
add eax, 2
test cx, cx
jne 0x464e01
push 0x48c9d8
push 0
push 0x47e300
push 0x48cbe8
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov esi, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push 0x48c9d8
push 0x3f
sub eax, 1
push 0x48cc78
neg eax
push 0x47c518
sbb eax, eax
push str.charset
add eax, 1
push 0x48cbe8
mov dword [0x48cc70], eax
mov word [0x48cc78], 0
call esi
push 0x48c9d8
push 0x3f
push 0x48ccf8
push 0x47c518
push str.TranslatorName
push 0x48cbe8
mov word [0x48ccf8], 0
call esi
push 0x48c9d8
push 0xff
push 0x48cd78
push 0x47c518
push str.TranslatorURL
push 0x48cbe8
mov word [0x48cd78], 0
call esi
pop esi
ret
Function at 0x4662f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push 3
push 0x80000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x466375
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp edi, ebp
mov ebx, eax
je 0x466322
mov dword [edi], ebx
mov edi, dword [esp + 0x14]
call fcn.00465e10
test eax, eax
je 0x466362
push ebp
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov eax, dword [ecx]
push ebx
push eax
push esi
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x466365
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 4
or ebp, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
pop edi
pop esi
pop ebp
ret 4

Function at 0x466780
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esi]
cmp eax, 0xffffffff
push edi
jne 0x4667d4
lea edi, [esi + 4]
mov ecx, edi
movzx eax, word [ecx]
test ax, ax
mov edx, ecx
je 0x4667b2
cmp ax, 0x5c
je 0x4667a3
cmp ax, 0x2f
jne 0x4667a6
lea edx, [ecx + 2]
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x466797
lea eax, [esi + 0x408]
push eax
push edi
mov dword [esi + 0x404], edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov edi, ecx
jmp 0x4667fc
lea edx, [esi + 0x408]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
mov edi, eax
test edi, edi
jne 0x466800
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4667fc
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov dword [esi], 0xffffffff
test edi, edi
je 0x466820
lea ecx, [esi + 0x434]
push 0x1ff
push ecx
lea eax, [esi + 0x658]
lea ecx, [esi + 0xa58]
call fcn.00468830
add esp, 8
mov eax, edi
pop edi
ret
Function at 0x467060
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x254
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push ecx
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x467148
mov edi, dword [sym.imp.KERNEL32.DLL_FindNextFileW]
jmp 0x467090
mov ecx, 0x47e244
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4670c6
test dx, dx
je 0x4670c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4670c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4670a0
xor eax, eax
jmp 0x4670cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x467107
mov ecx, 0x47e23c
lea eax, [esp + 0x3c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4670fe
test dx, dx
je 0x4670fa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4670fe
add eax, 4
add ecx, 4
test dx, dx
jne 0x4670d8
xor eax, eax
jmp 0x467103
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x46712a
lea edx, [esp + 0x10]
push edx
push ebx
call edi
test eax, eax
jne 0x467090
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x254
ret
mov edi, dword [esp + 0x264]
mov ecx, 0x94
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push ebx
mov esi, 1
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x254
ret

Function at 0x4676a0
Capabilities:
Create process on windows

Disassembly:
push 5
push 0x47c518
push 0x47c518
push eax
push 0x47e248
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, 0x20
cmp edx, eax
sbb eax, eax
neg eax
ret

Function at 0x467880
Capabilities:
Get common file path

Disassembly:
cmp word [0x48dd50], 0
jne 0x46789f
push 0x104
push 0x48dd50
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov dword [0x48df5c], eax
mov edx, dword [esp + 4]
mov eax, 0x48dd50
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4678b0
mov eax, dword [0x48df5c]
ret

Function at 0x4678d0
Capabilities:
Get common file path

Disassembly:
cmp word [0x48db40], 0
jne 0x4678ef
push 0x104
push 0x48db40
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x48dd4c], eax
mov edx, dword [esp + 4]
mov eax, 0x48db40
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x467900
mov eax, dword [0x48dd4c]
ret
Function at 0x467c80
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test ebp, ebp
je 0x467cea
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x467c97
push ebx
sub eax, edx
sar eax, 1
push esi
lea ebx, [eax + eax + 2]
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x467ce8
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push ebx
push ebp
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
neg edi
sbb edi, edi
neg edi
pop esi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop ebp
ret

Function at 0x468f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x400
push edi
push 0x3fe
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call sub.msvcrt.dll_memset
push 0x1ff
push str.key4.db
lea eax, [esp + 0x18]
mov ecx, esi
call fcn.00468830
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
call edi
cmp eax, 0xffffffff
je 0x468f56
mov eax, 1
pop edi
add esp, 0x400
ret
push 0x1ff
push str.key3.db
lea eax, [esp + 0xc]
mov ecx, esi
call fcn.00468830
add esp, 8
lea edx, [esp + 4]
push edx
call edi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov eax, ecx
add esp, 0x400
ret
Function at 0x46a570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x404
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push edi
push 0x3fe
mov ebx, eax
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1ff
push str.key4.db
lea eax, [esp + 0x18]
mov ecx, esi
call fcn.00468830
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 8
lea ecx, [esp + 0x10]
push ecx
call edi
cmp eax, 0xffffffff
je 0x46a5e8
push ebp
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.00469f10
test eax, eax
je 0x46a5e8
mov eax, 1
pop edi
pop ebp
pop ebx
add esp, 0x404
ret 4
push 0x1ff
push str.key3.db
lea eax, [esp + 0x18]
mov ecx, esi
call fcn.00468830
add esp, 8
lea eax, [esp + 0x10]
push eax
call edi
cmp eax, 0xffffffff
je 0x46a61a
push ebp
lea eax, [esp + 0x14]
call fcn.00469b90
test eax, eax
jne 0x46a5d7
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x404
ret 4
Function at 0x46b9b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xe54
push ebx
push ebp
mov ebp, dword [esp + 0xe60]
push esi
xor ebx, ebx
push 0x3ff
mov esi, eax
lea eax, [esp + 0xa65]
push ebx
push eax
mov byte [esp + 0xa6c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push 0x3ff
lea ecx, [esp + 0xa6c]
push ecx
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push esi
push 0x47dfe0
call fcn.00460220
add esp, 8
lea edx, [esp + 0xa60]
push edx
lea eax, [ebp + 4]
call fcn.0046a570
test eax, eax
je 0x46bc22
push 0x208
lea eax, [esp + 0x16]
push ebx
push eax
mov word [esp + 0x1c], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea ecx, [esp + 0x226]
push ebx
push ecx
mov word [esp + 0x22c], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea edx, [esp + 0x646]
push ebx
push edx
mov word [esp + 0x64c], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [esp + 0x436]
push ebx
push eax
mov word [esp + 0x43c], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea ecx, [esp + 0x856]
push ebx
push ecx
mov word [esp + 0x85c], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push str.signons.txt
lea eax, [esp + 0x18]
mov ecx, esi
call fcn.00468830
push 0x104
push str.signons2.txt
lea eax, [esp + 0x230]
mov ecx, esi
call fcn.00468830
push 0x104
push str.signons3.txt
lea eax, [esp + 0x658]
mov ecx, esi
call fcn.00468830
push 0x104
push str.signons.sqlite
lea eax, [esp + 0x450]
mov ecx, esi
call fcn.00468830
push 0x104
push str.logins.json
lea eax, [esp + 0x878]
mov ecx, esi
call fcn.00468830
add esp, 0x28
lea edx, [esp + 0x850]
push edx
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bb5f
lea eax, [esp + 0x850]
push eax
push edi
push ebp
call fcn.0046ac80
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xe54
ret 4
lea ecx, [esp + 0x430]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bb8f
lea edx, [esp + 0x430]
push edx
push edi
push ebp
call fcn.0046b2a0
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xe54
ret 4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bbb2
push 0xa
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
mov esi, 1
call fcn.0046a9b0
lea edx, [esp + 0x220]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bbdb
push 0x14
lea eax, [esp + 0x224]
push eax
push edi
push ebp
mov esi, 1
call fcn.0046a9b0
lea ecx, [esp + 0x640]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bc0d
push 0x1e
lea edx, [esp + 0x644]
push edx
push edi
push ebp
call fcn.0046a9b0
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xe54
ret 4
cmp esi, ebx
jne 0x46bc35
mov eax, 3
pop esi
pop ebp
pop ebx
add esp, 0xe54
ret 4
push esi
push str.Failed_to_find_encryption_key_inside_key_file_of_Mozilla_profile:__s
mov esi, 2
call fcn.00460300
add esp, 8
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe54
ret 4
Function at 0x4707b0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4708af
push ebp
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
je 0x4708ae
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
cmp ebx, ebp
jbe 0x4708a6
mov eax, 0x1388
push edi
lea edi, [ebx + 0xa]
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], eax
call fcn.00465e70
mov ecx, dword [esp + 0x10]
push ebp
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x20]
push ebx
push ebp
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
xor eax, eax
mov dword [ebx + ebp], eax
lea edi, [ebx + ebx*2]
lea esi, [esp + 0x24]
mov dword [ebx + ebp + 4], eax
call fcn.00465e70
mov esi, dword [esp + 0x24]
shr edi, 1
push edi
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push edx
push esi
push eax
push ecx
call fcn.00470270
test esi, esi
pop edi
je 0x470895
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
test ebp, ebp
je 0x4708a2
push ebp
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop ebp
pop esi
add esp, 0x20
ret 0xc

Function at 0x470a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x214
push ebx
push ebp
mov ebp, dword [esp + 0x220]
push edi
mov edi, eax
push ebp
mov ecx, esi
call fcn.004708c0
push 0x208
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push str.AppDataRoamingMicrosoftNetworkConnectionsPbk
lea eax, [esp + 0x18]
mov ecx, esi
call fcn.00468830
mov ebx, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 8
lea ecx, [esp + 0x10]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x470ad9
push ebp
lea ecx, [esp + 0x14]
call fcn.004708c0
push 0x104
push str.Application_DataMicrosoftNetworkConnectionsPbk
lea eax, [esp + 0x18]
mov ecx, esi
call fcn.00468830
add esp, 8
lea edx, [esp + 0x10]
push edx
call ebx
cmp eax, 0xffffffff
je 0x470b07
push ebp
lea ecx, [esp + 0x14]
call fcn.004708c0
pop edi
pop ebp
pop ebx
add esp, 0x214
ret 4
Function at 0x4710d0
Capabilities:
Encrypt data using des

Disassembly:
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [0x489a70]
mov eax, dword [esi]
xor eax, ecx
push edi
mov edi, eax
mov ebx, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x489060]
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x489260]
mov ebx, eax
and eax, 0x3f
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x489460]
add esi, 4
xor edi, dword [eax*4 + 0x489660]
add esi, 4
xor dword [edx], edi
ror ecx, 4
xor ecx, dword [esi - 4]
mov dword [0x489a70], esi
mov eax, ecx
shr eax, 0x18
and eax, 0x3f
mov eax, dword [eax*4 + 0x488f60]
mov esi, ecx
shr esi, 0x10
and esi, 0x3f
xor eax, dword [esi*4 + 0x489160]
mov esi, ecx
shr esi, 8
and esi, 0x3f
xor eax, dword [esi*4 + 0x489360]
and ecx, 0x3f
xor eax, dword [ecx*4 + 0x489560]
pop edi
xor dword [edx], eax
pop esi
pop ebx
ret
Function at 0x472650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xf60
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xf74]
xor ebp, ebp
push ecx
lea eax, [esp + 0x120]
push 0x47c634
lea ebx, [esp + 0x120]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x120], 0xffffffff
mov word [esp + 0x124], bp
mov word [esp + 0xb78], bp
mov word [esp + 0x778], bp
mov dword [esp + 0x524], eax
call fcn.00466830
mov esi, ebx
mov word [esp + 0x18], bp
call fcn.00466780
test eax, eax
je 0x47285a
mov edi, dword [esp + 0xf7c]
mov ebx, dword [esp + 0xf78]
test byte [esp + 0x520], 0x10
je 0x4727f3
test dword [esp + 0x520], 0x400
jne 0x4727f3
lea esi, [esp + 0x54c]
call fcn.00467780
test eax, eax
jne 0x4727f3
mov ax, word [esp + 0x54c]
cmp ax, 0x53
je 0x472717
cmp ax, 0x73
jne 0x47275e
cmp word [esp + 0x54e], 0x2d
jne 0x47275e
lea eax, [esp + 0x54c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x472730
sub eax, edx
sar eax, 1
cmp eax, 0x80
jl 0x47274b
mov eax, 0x7f
lea esi, [eax + eax]
push esi
lea edx, [esp + 0x550]
push edx
lea eax, [esp + 0x20]
push eax
jmp 0x47279c
mov eax, dword [esp + 0xf84]
lea edx, [eax + 2]
jmp 0x472770
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x472770
sub eax, edx
sar eax, 1
cmp eax, 0x80
jl 0x47278b
mov eax, 0x7f
mov ecx, dword [esp + 0xf84]
lea esi, [eax + eax]
push esi
push ecx
lea edx, [esp + 0x20]
push edx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0xf8c]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push edi
push ebx
lea edx, [esp + 0x780]
push edx
mov word [esp + esi + 0x2c], bp
call fcn.00472650
test eax, eax
jne 0x472809
push 0x104
push ebx
mov eax, edi
lea ecx, [esp + 0x778]
call fcn.00468830
add esp, 8
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x472813
mov word [edi], bp
lea esi, [esp + 0x118]
call fcn.00466780
test eax, eax
jne 0x4726d0
jmp 0x47285a
mov dword [esp + 0x10], 1
jmp 0x47285a
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x472822
sub eax, edx
sar eax, 1
cmp eax, 0x80
jl 0x47283d
mov eax, 0x7f
mov edi, dword [esp + 0xf80]
lea esi, [eax + eax]
push esi
lea eax, [esp + 0x1c]
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov word [esi + edi], bp
mov eax, dword [esp + 0x118]
cmp eax, 0xffffffff
je 0x47286d
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf60
ret 0x14
Function at 0x472df0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push eax
mov eax, dword [esp + 0x20]
mov esi, ecx
push esi
mov edi, ebp
call fcn.00472a50
test eax, eax
je 0x472e80
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x472e7e
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
lea edi, [ebp + 4]
mov esi, eax
call fcn.00465e10
cmp esi, 0x32
mov dword [esp + 0x18], 0
jbe 0x472e6b
mov eax, dword [edi]
push 0
lea ecx, [esp + 0x1c]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov esi, dword [edi]
lea edi, [ebp + 0x18]
mov ecx, 0x28
mov dword [esp + 0x18], eax
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x472e90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x300
push ebx
push ebp
push edi
mov edi, ecx
mov ebx, eax
mov ebp, 0x14
call fcn.00472950
cmp esi, ebp
jae 0x472ead
mov ebp, esi
push 0xff
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call sub.msvcrt.dll_memset
push 0xff
lea ecx, [esp + 0x11d]
push 0
push ecx
mov byte [esp + 0x124], 0
call sub.msvcrt.dll_memset
push 0xff
lea edx, [esp + 0x229]
push 0
push edx
mov byte [esp + 0x230], 0
call sub.msvcrt.dll_memset
push ebp
lea eax, [esp + 0x34]
push ebx
push eax
call sub.msvcrt.dll_memcpy
push ebp
lea ecx, [esp + 0x140]
push ebx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0x3c
xor eax, eax
test esi, esi
jbe 0x472f34
nop
xor byte [esp + eax + 0xc], 0x5c
xor byte [esp + eax + 0x10c], 0x36
add eax, 1
cmp eax, esi
jb 0x472f20
mov eax, dword [esp + 0x318]
mov ecx, dword [esp + 0x314]
mov ebx, dword [esp + 0x310]
lea edx, [esp + 0x20c]
push edx
push eax
push ecx
push esi
lea edx, [esp + 0x11c]
push edx
push ebx
mov eax, edi
call fcn.00472be0
cmp ebx, 0x8003
jne 0x472f73
mov eax, 0x10
jmp 0x472fa3
cmp ebx, 0x8002
je 0x472f6c
cmp ebx, 0x8004
je 0x472f9e
cmp ebx, 0x8009
je 0x472f9e
xor eax, eax
cmp ebx, 0x800e
setne al
sub eax, 1
and eax, 0x40
jmp 0x472fa3
mov eax, 0x14
mov ecx, dword [esp + 0x31c]
push ecx
push eax
lea edx, [esp + 0x214]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
mov eax, edi
call fcn.00472b20
pop edi
pop ebp
pop ebx
add esp, 0x300
ret 0x10