joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454430
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx]
mov eax, dword [eax]
cmp edx, 3
ja case.default.0x454442
jmp dword [edx*4 + 0x454498]
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00453ef0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00453c30
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00454640
push str.TFTP_finished
push 0x50ce08
push eax
call fcn.00438d40
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x51029c
push eax
call fcn.00438c60
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x457710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5470bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004ebf29
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x457774
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x457774
lea eax, [ebp - 0x108]
push eax
call dword [0x5470fc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004264c2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004264c2
mov esp, ebp
pop ebp
ret

Function at 0x457790
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00457710

Function at 0x4604f0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x460522
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x4606a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4606d3
push 0x2e
push edi
call fcn.004d7a40
add esp, 8
test eax, eax
je 0x4606d1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4618e0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4618f0
sub esi, ecx
cmp esi, 0x7fffffff
jbe 0x46190c
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
push edi
test esi, esi
je 0x46191d
lea eax, [esi + esi]
push eax
call dword [0x5470f0]
jmp 0x461928
push 0x5328b4
call dword [0x5470fc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x46193b
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
push edi
call fcn.00461bc0
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x4619b9
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4619ae
push 0
lea eax, [esi + esi]
mov dword [ebp - 0xc], 0x10
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x5470f4]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461c30
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5470bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x461cc7
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
push edi
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.00461d30
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.004635e0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x461cd9
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004264c2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004264c2
mov esp, ebp
pop ebp
ret
Function at 0x462400
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x462520
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5470bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x128], edi
mov eax, dword [edi + 8]
mov dword [ebp - 0x108], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x24]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0xc]
add eax, 2
nop
movzx edx, byte [eax - 2]
lea eax, [eax + 4]
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 3]
shl edx, 8
or edx, ecx
mov dword [ebp + esi*4 - 0x104], edx
inc esi
cmp esi, 0x10
jl 0x462590
lea ebx, [ebp - 0xcc]
mov edi, 0x30
nop word [eax + eax]
mov ecx, dword [ebx - 0x34]
lea ebx, [ebx + 4]
mov edx, dword [ebx - 4]
mov esi, ecx
mov eax, ecx
rol esi, 0xe
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x4625d0
mov edi, dword [ebp - 0x128]
xor ebx, ebx
mov ecx, dword [ebp - 0x11c]
nop dword [eax]
mov esi, dword [ebp - 0x108]
mov edx, ecx
mov eax, ecx
ror edx, 0xb
rol eax, 7
xor edx, eax
mov eax, ecx
ror eax, 6
xor edx, eax
mov eax, dword [ebp - 0x114]
xor eax, dword [ebp - 0x118]
and eax, ecx
mov ecx, esi
xor eax, dword [ebp - 0x118]
add edx, eax
ror ecx, 0xd
add edx, dword [ebx + 0x5152c8]
mov eax, esi
add edx, dword [ebp + ebx - 0x104]
add ebx, 4
add edx, dword [ebp - 0x124]
add dword [ebp - 0x10c], edx
rol eax, 0xa
xor ecx, eax
mov eax, esi
ror eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x120]
mov esi, eax
add ecx, edx
and eax, dword [ebp - 0x108]
or esi, dword [ebp - 0x108]
and esi, dword [ebp - 0x110]
mov edx, dword [ebp - 0x108]
or esi, eax
mov eax, dword [ebp - 0x118]
add esi, ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x108], esi
cmp ebx, 0x100
jl 0x462620
add dword [edi + 8], esi
add dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10c]
add dword [edi + 0x14], eax
mov eax, dword [ebp - 0x114]
add dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x118]
add dword [edi + 0x20], eax
add dword [edi + 0x18], ecx
mov eax, dword [ebp - 0x124]
add dword [edi + 0x24], eax
xor eax, eax
add dword [edi + 0xc], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004264c2
mov esp, ebp
pop ebp
ret
Function at 0x4634d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x5470f0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4634fd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x463544
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x46354a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4635ab
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x463570
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4635d7
mov eax, dword [esi + 4]
push 1
push 0x5154c6
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5154c7
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4635b0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4660b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x4660d5
or esi, 1
push 2
call edi
test ax, ax
jns 0x4660e1
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4660ed
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4660f9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4698b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [edi + 0x40c]
call fcn.004ce9d0
mov ebx, dword [ebp + 8]
test eax, eax
jle 0x46990b
nop
push esi
lea ecx, [edi + 0x40c]
mov byte [ebp + 0xb], 0
call fcn.0046c6f0
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push ebx
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x469aa6
lea ecx, [edi + 0x40c]
inc esi
call fcn.004ce9d0
cmp esi, eax
jl 0x4698d0
sub ebx, 0x100
je 0x4699e2
sub ebx, 4
je 0x469977
sub ebx, 2
jne 0x4699d7
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.004e6a56
mov ecx, dword [edi + 0x104]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push reloc.WS2_32.dll_select
push edx
push 0x46b740
call dword [eax + 0x128]
mov esi, eax
test esi, esi
je 0x4699d7
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x11c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 0x108], 0
je 0x4699d7
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movq qword [ebp - 0xc], xmm0
mov word [ebp - 0xc], ax
mov eax, dword [edi + 0x11c]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x120]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.004660b0
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4699d7
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x469a40
mov eax, dword [ecx]
mov eax, dword [eax + 0xf4]
call eax
test al, al
je 0x469a40
mov ecx, dword [edi + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x469a40
mov ecx, dword [edi + 0x108]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004da683
add esp, 8
test eax, eax
je 0x469a40
mov ecx, dword [edi + 0x108]
call fcn.00491140
test al, al
jne 0x4699d7
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x469a8d
mov eax, dword [ecx]
mov eax, dword [eax + 0xf4]
call eax
test al, al
je 0x469a8d
mov ecx, dword [edi + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x469a8d
mov ecx, dword [edi + 0x108]
push str.WkeWebkitUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004da683
add esp, 8
test eax, eax
jne 0x4699d7
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, edi
setns al
movzx eax, al
push eax
call fcn.0046af10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46ab40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x46ab6c
cmp esi, dword [edi + 0x108]
je 0x46ab6c
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x46ac61
test eax, eax
je 0x46abd8
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x20], 0x17
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0x108]
mov ecx, edi
call fcn.0046a620
mov dword [edi + 0x108], 0
test esi, esi
je 0x46ac61
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x46ac61
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xf4]
call eax
test al, al
je 0x46ac61
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x46ac61
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 4], 0
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0x108]
mov ecx, edi
call fcn.0046a620
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46c170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46c1b5
cmp byte [ebp + 8], 0
je 0x46c1a9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x46f9e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503a62
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x5470bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xfffffffffffffff0
call fcn.004ce9d0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, edi
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.004ce9d0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [edi]
lea ebx, [edi + 0x30]
mov ecx, edi
call dword [eax + 0x30]
push eax
push dword [edi + 4]
mov ecx, ebx
call fcn.00465c50
mov ecx, edi
lea eax, [edi + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, ebx
call fcn.00464c90
lea ecx, [ebp - 0x2e8]
call fcn.00499e80
mov eax, dword [edi]
lea ecx, [ebp - 0x118]
push ecx
mov ecx, edi
mov dword [ebp - 4], 0
call dword [eax + 0x28]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.0046cf90
lea ecx, [ebp - 0x94]
test al, al
mov eax, dword [edi]
push ecx
mov ecx, edi
jne 0x46faf3
call dword [eax + 0x2c]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0046cd10
push eax
call fcn.004eb784
add esp, 4
movzx esi, ax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0046c5c0
mov ecx, edi
lea eax, [edi + 0x28]
neg ecx
push 0
sbb ecx, ecx
and ecx, eax
push ebx
push ecx
lea ecx, [ebp - 0x118]
call fcn.0046cd10
push eax
push esi
lea ecx, [ebp - 0x2e8]
call fcn.0049b060
mov esi, eax
jmp 0x46fb33
call dword [eax + 0x2c]
mov edx, edi
mov byte [ebp - 4], 3
neg edx
lea ecx, [edi + 0x28]
push 0
sbb edx, edx
push ebx
and edx, ecx
mov ecx, eax
push edx
push 0
call fcn.0046cd10
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x2e8]
call fcn.0049b060
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
mov esi, eax
call fcn.0046c5c0
test esi, esi
jne 0x46fb9c
push 0xffffffffffffffff
push 0x516158
lea ecx, [ebp - 0x94]
call fcn.0046c460
mov eax, dword [edi]
lea ecx, [ebp - 0x19c]
push ecx
mov ecx, edi
mov byte [ebp - 4], 4
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.0046c750
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 4
call fcn.0046c5c0
push 0x10
push str.Duilib
lea ecx, [ebp - 0x94]
call fcn.0046cd10
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov ecx, ebx
call fcn.00464d60
mov edx, edi
lea eax, [edi + 0x20]
neg edx
mov ecx, ebx
sbb edx, edx
and edx, eax
push edx
call fcn.00464b80
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x118]
call fcn.0046c5c0
lea ecx, [ebp - 0x2e8]
call fcn.00498c60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004264c2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x474930
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5470bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x474964
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x474964
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x474a4c
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x474981
cmp ax, 0x5c
jne 0x474983
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x474975
cmp edi, ebx
je 0x4749cf
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.004d7fb0
add esp, 0xc
cmp edi, 0x208
jae 0x474a5c
xor eax, eax
mov word [ebp + edi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.00474930
add esp, 8
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x4749f4
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4749e4
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4749f6
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x474a10
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x474a4c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004264c2
mov esp, ebp
pop ebp
ret
call fcn.00427113
int3

Function at 0x4751a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x47526d
cmp dword [esi + 4], 0xffffffff
jne 0x47526d
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4751d1
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x475208
cmp eax, 0x2f
je 0x475208
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4751f5
mov eax, dword [0x532988]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x47522e
push edi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x47522e
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00477e00
add esp, 0x10
test eax, eax
jne 0x47524e
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00478660
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov edx, 0x200
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x475860
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x517d98]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x517d98]
mov dword [edx + 8], ecx
pop ebp
ret