joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ca70
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4eabe4]
cmp dword [eax + 0x30], 0
je 0x45cb1a
cmp dword [ebx + 0x94], 0
jne 0x45cb14
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45ca00
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45cb14
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45cada
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45cb14
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b76c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45cae9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d678
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45d6ad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404718
jmp 0x45d6ba
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040467c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e884
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e8c5
mov eax, esi
call fcn.00444c50
test al, al
je 0x45e8c5
mov eax, dword [ebx + 0x84]
call fcn.0044494c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e8c5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044494c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x464654
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x46467e
cmp dword [ebx + 0x64], 0
jne 0x46467e
cmp dword [ebx + 0x6c], 0
jne 0x46467e
mov esi, edi
jmp 0x464716
cmp esi, 0xffffffff
jne 0x464689
dec esi
jmp 0x464716
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x464716
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.00463b68
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
mov dword [esp], edx
sub dword [esp], 2
mov edx, dword [esp]
movzx edx, word [edx]
cmp edi, edx
ja 0x4646d6
sub dx, di
mov ecx, dword [esp]
mov word [ecx], dx
jmp 0x4646de
mov edx, dword [esp]
mov word [edx], 0
dec eax
test eax, eax
jne 0x4646bd
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
mov dword [esp], edx
sub dword [esp], 2
mov edx, dword [esp]
movzx edx, word [edx]
cmp edi, edx
ja 0x464707
sub dx, di
mov ecx, dword [esp]
mov word [ecx], dx
jmp 0x46470f
mov edx, dword [esp]
mov word [edx], 0
dec eax
test eax, eax
jne 0x4646ee
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x464774
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.00464378
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x46475f
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x464774
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x46465e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46f1a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x46f1bd
add esp, 0xfffffff0
call fcn.00403b34
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x46f280
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0046b324
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a310
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a310
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a310
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a310
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041a338
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f287
lea eax, [ebp - 4]
call fcn.00404628
ret
Function at 0x4735b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4736b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4736cc
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.0040467c
push 0xffffffffffffffff
mov ecx, 0x4736dc
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
mov ecx, 0x4736f8
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0045fab8
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x473714
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0045f9a4
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x473728
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0045f9a4
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x473740
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0045f9a4
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x47375c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0045fab8
mov byte [ebx + 0x44], al
mov ecx, 0x473770
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0046b000
mov byte [ebx + 0x45], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4736bb
lea eax, [ebp - 4]
call fcn.00404628
ret
Function at 0x48530c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48556c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x48536f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00484e24
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d818
cmp al, 1
jne 0x48536f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004850ec
test al, al
je 0x4854fb
cmp dword [ebp - 8], 0
jge 0x48538d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00484e24
mov eax, dword [ebp - 0x210]
call fcn.004048e8
cmp ebx, eax
jge 0x4853d7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00484e24
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4e9824]
and eax, 0xff
bt dword [edx], eax
jae 0x4853d7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4853eb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004852e8
cmp ebx, dword [ebp - 8]
je 0x4854ed
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x485417
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a04
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e6db0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4854da
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a04
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e6db0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044494c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a04
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e6db0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044494c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4854e1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x48554e
cmp dword [ebp - 8], 0
jge 0x485506
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00484e24
mov eax, dword [ebp - 0x218]
call fcn.004048e8
cmp eax, dword [ebp - 8]
jg 0x485540
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00484e24
mov eax, dword [ebp - 0x21c]
call fcn.004048e8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004852e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485573
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040464c
ret
Function at 0x487468
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4874a0]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x48747e
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x48748d
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x48749c
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x487db8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x43a26c]
call fcn.00403994
test al, al
je 0x487dfa
mov eax, dword [0x4e95cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x487dfa
mov edx, dword [0x4e95cc]
xor edx, edx
call fcn.00457074
push 0
mov eax, dword [0x4e95cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4b983c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b9976
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041c4ac
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x4b98b8
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4b98b8
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408ad8
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x4e91b4]
mov ebx, dword [ebx]
mov eax, 0x4b998c
call ebx
dec eax
jne 0x4b98b8
mov ebx, 1
jmp 0x4b98ba
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x4b995b
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.004b934c
test al, al
jne 0x4b994f
mov eax, dword [ebp - 4]
call fcn.004b9830
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.0040467c
xor edx, edx
push ebp
push 0x4b993d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x4b9933
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.004b9c50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b994f
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4b98d2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b997d
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040464c
ret
Function at 0x4bf078
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4bf0a6
mov eax, ebx
call fcn.004bfb2c
cmp dword [ebx + 0x40], 0
je 0x4bf09f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4bf117
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4bf109
cmp dword [ebx + 8], 0
je 0x4bf0c8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4bf0da
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4bf109
cmp dword [ebx + 8], 0
je 0x4bf0bb
cmp eax, 3
je 0x4bf0ed
dec eax
jne 0x4bf0bb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4bf0bb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4bf0bb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4bf135
cmp dword [ebx + 0x14], 0xcc
je 0x4bf135
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004bf140
pop ebx
ret

Function at 0x4d4f58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x4d504e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404628
cmp dword [ebp - 4], 0
je 0x4d4fb4
mov eax, dword [ebp - 4]
call fcn.004dbe68
test al, al
je 0x4d4fb4
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.00409bd4
jmp 0x4d4fc5
lea eax, [ebp - 0x109]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.00409db0
mov eax, dword [ebp - 0x110]
call fcn.004dbe68
test al, al
jne 0x4d5001
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x109]
call fcn.00409db0
mov eax, dword [ebp - 0x114]
call fcn.004dc114
lea eax, [ebp - 0x109]
push eax
push 0
push 0x4d505c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.00409db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5055
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040464c
lea eax, [ebp - 4]
call fcn.00404628
ret
Function at 0x4d77a8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x4d789c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d48d8
test al, al
je 0x4d7870
xor edx, edx
push ebp
push 0x4d7812
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004d5064
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.004095fc
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d781c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d4e58
test al, al
jne 0x4d784a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
push eax
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3200], 0
je 0x4d7886
cmp dword [ebp + 8], 0x20
je 0x4d7886
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404ae8
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4d7886
mov eax, dword [ebp - 4]
add eax, 0x4d8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3208]
call fcn.0040467c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d78a3
lea eax, [ebp - 0xc]
call fcn.00404628
ret

Function at 0x4d7d3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x4d7d68
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x4e9524]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x4d7d42
pop esi
pop ebx
ret

Function at 0x4d8714
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x4d8779
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4d875c
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004dbd54
mov eax, dword [ebp - 8]
call fcn.004dbd04
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x4d875e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8780
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040464c
ret
Function at 0x4d8788
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x4d8854
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d882f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x60]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4d8814
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004dbd54
mov eax, dword [ebp - 0x10]
call fcn.004dbd04
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x4d8818
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8836
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4d8d28
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4d8d41
add esp, 0xfffffff0
call fcn.00403b34
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.00404ad8
mov eax, dword [ebp + 0xc]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x4d8e38
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x5c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x4d8de1
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.004d4f58
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x64]
call fcn.0040467c
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 0xc]
call fcn.0040467c
mov byte [ebx + 0x50], 1
jmp 0x4d8df8
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.0040467c
lea eax, [ebx + 0x54]
call fcn.00404628
mov byte [ebx + 0x50], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x64]
xor edx, edx
mov eax, ebx
call fcn.004dcbb8
mov ax, word [ebp + 8]
mov word [ebx + 0x62], ax
mov byte [ebx + 0x60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8e3f
lea eax, [ebp - 8]
call fcn.00404628
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.0040464c
ret
Function at 0x4dbe68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x4dbeb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ae8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4dbe9d
test al, 0x10
jne 0x4dbea1
xor ebx, ebx
jmp 0x4dbea3
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbec0
lea eax, [ebp - 4]
call fcn.00404628
ret

Function at 0x4dbfb8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4dbfe0
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404898
jmp 0x4dbfe9
mov eax, ebx
xor edx, edx
call fcn.00404c74
add esp, 0x104
pop ebx
ret

Function at 0x4dc54c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x4eca40
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x4e94b0]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x4e94b0]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x4dc66c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4dc695
call fcn.004dc64c
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.004dc54c
inc dword [esi]
dec ebx
jne 0x4dc67e
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4dc69c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4dc6d0
call fcn.004dc64c
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.004dc54c
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x4dc6af
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret