joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4734f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, ecx
push edi
mov dword [ebp - 4], eax
mov ebx, 1
cmp dword [eax + 8], 0xffffffff
je 0x473560
xor esi, esi
nop
push 0
push ebx
push dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
jne 0x473547
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x473547
push 0x3e8
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
cmp esi, 2
jl 0x473510
test edi, edi
jle 0x473558
add dword [ebp + 8], edi
sub ebx, edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x473569
je 0x473572
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
jne 0x47359d
test ebx, ebx
je 0x473591
mov eax, dword [ebp - 4]
jmp 0x473507
push str.vsocket.cpp_:_zero_bytes_read3_n
push 4
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call esi
push eax
push str.vsocket.cpp_:_HTTP_socket_error:__d_n
push 4
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4735c0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x118], edx
mov ebx, ecx
mov dword [ebp - 0x114], 0
cmp dword [ebp + 8], edi
jbe 0x4736bc
xor esi, esi
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x10c], ebx
push ecx
push 0
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x110], 1
push ecx
lea eax, [ebx + 1]
mov dword [ebp - 0x120], 1
push 0
push eax
mov dword [ebp - 0x11c], 0
call dword [sym.imp.WS2_32.dll_select]
mov ecx, eax
inc esi
mov al, byte [0x501a96]
test ecx, ecx
jne 0x47365d
test al, al
jne 0x47365d
cmp esi, 0x14
jl 0x4735f5
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
cmp esi, 0x14
jge 0x47364a
test al, al
jne 0x47364a
test ecx, ecx
js 0x47364a
cmp ecx, 1
jg 0x47364a
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov esi, dword [ebp + 8]
test eax, eax
je 0x4736a3
push 0
mov eax, esi
sub eax, edi
push eax
mov eax, dword [ebp - 0x118]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x114], eax
jmp 0x4736a9
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x47364a
cmp eax, 0xffffffff
je 0x47364a
add edi, eax
cmp edi, esi
jb 0x4735f3
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x473b30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
call fcn.004afcf3
add eax, 0x40
push eax
call fcn.004b1021
add esp, 8
mov dword [0x502044], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x473b91
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.004ad400
add esp, 8
mov byte [eax], 0
xor eax, eax
mov cl, byte [ebp + eax - 0x218]
lea eax, [eax + 1]
mov byte [ebp + eax - 0x111], cl
test cl, cl
jne 0x473b93
lea edi, [ebp - 0x110]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x473bb0
mov ax, word [0x4dfc28]
lea ecx, [ebp - 0x110]
mov word [edi], ax
dec ecx
lea ebx, [ebx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x473bd0
mov eax, dword [str.vnclang_server.dll]
mov dword [ecx], eax
mov eax, dword [0x4ea5e8]
mov dword [ecx + 4], eax
mov eax, dword [0x4ea5ec]
mov dword [ecx + 8], eax
mov eax, dword [0x4ea5f0]
mov dword [ecx + 0xc], eax
mov ax, word [0x4ea5f4]
mov word [ecx + 0x10], ax
mov al, byte [0x4ea5f6]
mov byte [ecx + 0x12], al
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
cmove eax, esi
mov dword [0x502044], eax
call fcn.004737b0
call fcn.0045b9b0
mov dword [0x502598], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x501954], eax
lea eax, [ebp - 0x3a8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x473c78
mov ax, word [ebp - 0x3a8]
mov bl, 1
mov word [0x50149c], ax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push 0
push 0x4e38ec
mov edx, 0x501ff0
call fcn.0041b520
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor al, al
pop edi
pop esi
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x4753a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.winvnc.cpp_:__DBG___WinVNCAPPMain_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
push 4
call fcn.004ad3ab
mov edi, eax
add esp, 4
test edi, edi
je 0x4753e2
mov dword [edi], 0
jmp 0x4753e4
xor edi, edi
cmp dword [0x50182c], 0
jne 0x475458
push str.WinVNC_Win32_Instance_Mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
test eax, eax
je 0x47540f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x475458
push 0x501ea0
push str.winvnc.cpp_:__s____exiting_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
cmp dword [0x5016a4], 0
jne 0x475445
push 0
push 0x4e38ec
mov edx, 0x501ea0
call fcn.0041b520
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x858]
call fcn.0046ae60
mov eax, dword [ebp - 0x750]
test eax, eax
je 0x475480
push eax
call fcn.004ae337
add esp, 4
mov dword [ebp - 0x750], 0
push 0x4e38ec
call fcn.004aec27
add esp, 4
mov dword [ebp - 0x750], eax
push str.winvnc.cpp_:_server_created_ok_n
push 0
push 0x4f6c50
call fcn.00414f90
mov eax, dword [0x5016a4]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x2c], eax
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call esi
push str.GlobalSessionEventUltraCad
push 0
push 2
mov dword [0x5016a0], eax
call esi
mov dword [0x502454], eax
mov eax, dword [0x5016a0]
test eax, eax
je 0x4754e8
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.winvnc.cpp_:__SDEvent_created__n
push 0
push 0x4f6c50
call fcn.00414f90
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
cmp byte [0x501a96], 0
mov dword [0x501fa8], 0xffffffff
jne 0x475563
lea eax, [ebp - 0x85c]
push eax
push 0
lea eax, [ebp - 0x858]
push eax
push 0x474f70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x475546
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call ebx
push str.winvnc.cpp_:__Closing_Imp_Thread_n
push 0
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
cmp byte [0x501a96], 0
je 0x475515
test edi, edi
je 0x475581
mov eax, dword [edi]
test eax, eax
je 0x475578
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [edi]
call ebx
push edi
call fcn.004ad35b
add esp, 4
mov eax, dword [0x5016a0]
test eax, eax
je 0x47558d
push eax
call ebx
mov eax, dword [0x502454]
test eax, eax
je 0x475599
push eax
call ebx
push str.winvnc.cpp_:__SHUTING_DOWN_SERVER__n
push 0
push 0x4f6c50
call fcn.00414f90
mov eax, dword [0x501fac]
add esp, 0xc
test eax, eax
je 0x4755c9
push eax
call fcn.004ad334
add esp, 4
mov dword [0x501fac], 0
lea ecx, [ebp - 0x858]
call fcn.0046b260
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x489ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x489cb0
xor eax, eax
pop esi
pop ebp
ret
cmp dword [0x4f6a08], 0
je 0x489cbe
call fcn.0048a230
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not eax
cmp edx, 8
jb 0x489d92
push edi
mov edi, edx
shr edi, 3
movzx ecx, byte [esi]
sub edx, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
movzx ecx, byte [esi + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
movzx ecx, byte [esi + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
movzx ecx, byte [esi + 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
movzx ecx, byte [esi + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
movzx ecx, byte [esi + 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
movzx ecx, byte [esi + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
movzx ecx, byte [esi + 7]
add esi, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
dec edi
jne 0x489cd5
pop edi
test edx, edx
je 0x489db1
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x534310]
dec edx
jne 0x489d96
not eax
pop esi
pop ebp
ret
Function at 0x48bf20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, ebx
mov dword [ebp + 8], edi
test ebx, ebx
je 0x48bfbd
mov edi, edi
cmp dword [esi + 0x108ec], 0
jg 0x48bf87
push 0x2000
push dword [esi + 0x108e4]
push dword [esi + 0x10908]
call fcn.004b1dd1
add esp, 0xc
mov dword [esi + 0x108ec], eax
test eax, eax
je 0x48bfe4
js 0x48bfc6
mov eax, dword [esi + 0x108e4]
add dword [esi + 0x10910], 0x2000
mov dword [esi + 0x108e8], eax
mov eax, dword [ebp - 4]
mov edi, dword [esi + 0x108ec]
cmp ebx, edi
cmovb edi, ebx
push edi
push dword [esi + 0x108e8]
push eax
call fcn.004b6150
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi + 0x108e8], edi
add eax, edi
sub dword [esi + 0x108ec], edi
mov dword [ebp - 4], eax
sub ebx, edi
jne 0x48bf40
mov edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10b54]
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
sub eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48bff0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x109b0], 0
jne 0x48c017
mov eax, dword [esi + 0x90]
test eax, eax
jg 0x48c01c
dec eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x108ec], 0
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 0x108ec], 0
jg 0x48c06b
push 0x2000
push dword [esi + 0x108e4]
push dword [esi + 0x10908]
call fcn.004b1dd1
add esp, 0xc
mov dword [esi + 0x108ec], eax
test eax, eax
je 0x48c00d
js 0x48c0d8
mov eax, dword [esi + 0x108e4]
mov ecx, esi
add dword [esi + 0x10910], 0x2000
mov dword [esi + 0x108e8], eax
call fcn.0048beb0
mov eax, dword [esi + 0x8d8]
test byte [eax + 0x18], 1
je 0x48c0be
push ebx
mov ebx, dword [esi + 0x108ec]
push edi
mov edi, dword [esi + 0x108e8]
test ebx, ebx
je 0x48c0bc
lea esp, [esp]
mov ecx, dword [esi + 0x10b04]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, esi
shr eax, 8
xor byte [edi], al
movzx edx, byte [edi]
call fcn.00498530
lea edi, [edi + 1]
dec ebx
jne 0x48c090
pop edi
pop ebx
mov eax, dword [esi + 0x108e8]
dec dword [esi + 0x108ec]
mov cl, byte [eax]
inc eax
mov dword [esi + 0x108e8], eax
movzx eax, cl
pop esi
ret
mov eax, dword [esi + 0x10b54]
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call eax
push 1
push 0x586200
call fcn.004b4030
int3
Function at 0x48c100
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10914]
add eax, edx
mov esi, eax
and esi, 0x80001fff
jns 0x48c11e
dec esi
or esi, 0xffffe000
inc esi
mov ecx, eax
sub ecx, esi
test eax, eax
jns 0x48c15a
push 1
push str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
push dword [edi + 0x10904]
lea esi, [edi + 0x8dc]
push str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
push esi
call fcn.004ad5d8
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
pop edi
mov eax, 3
pop esi
ret
cmp ecx, dword [edi + 0x10910]
je 0x48c1bc
push 0
push ecx
push dword [edi + 0x10908]
call fcn.004b2e42
push 0x2000
push dword [edi + 0x108e4]
mov dword [edi + 0x10910], eax
push dword [edi + 0x10908]
call fcn.004b1dd1
add esp, 0x18
mov dword [edi + 0x108ec], eax
test eax, eax
jg 0x48c1a1
pop edi
mov eax, 0x33
pop esi
ret
sub eax, esi
mov dword [edi + 0x108ec], eax
mov eax, dword [edi + 0x108e4]
add eax, esi
mov dword [edi + 0x108e8], eax
xor eax, eax
pop edi
pop esi
ret
mov eax, dword [edi + 0x108e8]
mov ecx, dword [edi + 0x108e4]
sub eax, ecx
sub eax, esi
add dword [edi + 0x108ec], eax
lea eax, [ecx + esi]
mov dword [edi + 0x108e8], eax
xor eax, eax
pop edi
pop esi
ret

Function at 0x48d450
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
xor eax, eax
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp ebx, 4
jb 0x48d50f
mov edx, dword [0x4f6a20]
push edi
nop
movzx eax, byte [esi + 3]
shl ax, 8
movzx edi, ax
movzx eax, byte [esi + 2]
or edi, eax
lea eax, [ebx - 4]
cmp edi, eax
ja 0x48d50b
movzx ecx, byte [esi + 1]
movzx eax, byte [esi]
shl cx, 8
or cx, ax
mov eax, 0x4453
cmp cx, ax
jne 0x48d4cb
cmp edx, 0xffffffff
jne 0x48d4e8
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x48d4c3
mov edx, 1
mov dword [0x4f6a20], edx
jmp 0x48d4ec
xor edx, edx
mov dword [0x4f6a20], edx
mov eax, dword [ebp - 4]
mov ecx, 0xfffffffc
add esi, 4
sub ecx, edi
add esi, edi
add ebx, ecx
cmp ebx, 4
jae 0x48d470
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x48d4cb
cmp edi, 5
jb 0x48d4cb
cmp byte [esi + 8], 0
ja 0x48d4cb
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, 1
mov dword [ebp - 4], eax
jmp 0x48d4ce
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d9b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 0x109d8]
call fcn.004af478
add esp, 4
cmp dword [edi + 0x14], 0
jne 0x48dbba
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x14]
call fcn.0048d780
add esp, 8
mov dword [ebp - 0xc], eax
lea esi, [edi + 0x109f0]
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [edi + 0x8d8]
mov ebx, eax
mov ecx, dword [ecx + 0x14]
test cl, 0x5f
je 0x48da57
and ecx, 0x7f
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x48da57
push 1
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nwarning___d_:_could_not_set_file_attributes_n
push esi
call fcn.004ad5d8
add esp, 0xc
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
lea esi, [edi + 0x109f0]
mov ecx, dword [edi + 0x10918]
test ecx, ecx
je 0x48db21
cmp dword [edi + 0x5c], 0
movzx edx, word [edi + 0x10938]
je 0x48db21
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048d450
add esp, 8
test eax, eax
je 0x48db21
push dword [ebp - 4]
mov eax, dword [edi + 0x8d8]
mov edx, esi
push dword [ebp - 8]
mov ecx, edi
push dword [eax + 0x14]
call fcn.0048d320
add esp, 0xc
cmp eax, 0x4f
jne 0x48db21
cmp dword [edi + 0x38], 0
je 0x48dae7
push 1
lea edx, [edi + 0x88dc]
lea ecx, [edi + 0x109f0]
lea esi, [edi + 0x8dc]
call fcn.00493320
push eax
push 0x4ec0a8
push esi
call fcn.004ad5d8
add esp, 0xc
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
cmp dword [edi + 0x38], 0
lea esi, [edi + 0x8dc]
push 1
mov ecx, 0x4d9f42
mov eax, 0x4e0448
cmove eax, ecx
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff5
push eax
push str._compressed_WinNT_security_data_missing___d_bytes__s
push esi
call fcn.004ad5d8
add esp, 0x10
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
cmp ebx, 0xffffffff
jne 0x48db55
push 1
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCreateFile___error__d_when_trying_set_file_time_n
push esi
call fcn.004ad5d8
add esp, 0xc
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x48dbb3
test cl, 1
lea eax, [ebp - 0x14]
mov edx, 0
cmove eax, edx
test cl, 2
push eax
lea eax, [ebp - 0x1c]
cmove eax, edx
test cl, 4
push eax
mov ecx, edx
lea eax, [ebp - 0x24]
cmove eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x48dbb3
push eax
lea esi, [edi + 0x8dc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nSetFileTime_failed:__d_n
push esi
call fcn.004ad5d8
add esp, 0xc
push eax
mov eax, dword [edi + 0x10b54]
push esi
push edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e030
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 2
mov esi, edx
mov ebx, ecx
push 0x4e1394
push esi
call fcn.004ad660
add esp, 0xc
test eax, eax
je 0x48e071
push 2
push 0x4ec184
push esi
call fcn.004ad660
add esp, 0xc
test eax, eax
jne 0x48e092
mov al, byte [esi + 2]
test al, al
je 0x48e092
cmp al, 0x2f
je 0x48e092
cmp al, 0x5c
je 0x48e092
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi]
push eax
call fcn.004aeaeb
add esp, 4
test eax, eax
je 0x48e0a8
cmp byte [esi + 1], 0x3a
je 0x48e0cc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x48e080
lea esi, [ebp - 0x20c]
push edi
push 2
lea edi, [ebx + 0x10b90]
mov dword [ebp - 0x210], esi
push esi
push edi
call fcn.004ad660
add esp, 0xc
test eax, eax
je 0x48e1cc
push 2
push dword [ebp - 0x210]
push edi
call fcn.004ae040
add esp, 0xc
mov word [ebx + 0x10b92], 0x2f
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x48e152
mov byte [edi], al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
mov eax, 0xc
cmp eax, dword [ebp - 0x214]
push 4
sbb eax, eax
inc eax
mov dword [ebx + 0x10b94], eax
lea eax, [ebp - 0x108]
push str.VFAT
push eax
call fcn.004af682
add esp, 4
push eax
call fcn.004ad660
add esp, 0xc
test eax, eax
je 0x48e1c1
push 4
lea eax, [ebp - 0x108]
push str.HPFS
push eax
call fcn.004ad660
add esp, 0xc
test eax, eax
je 0x48e1c1
push 3
lea eax, [ebp - 0x108]
push 0x4ec198
push eax
call fcn.004ad660
add esp, 0xc
test eax, eax
je 0x48e1c1
xor eax, eax
jmp 0x48e1c6
mov eax, 1
mov dword [ebx + 0x10b98], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x498530
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov ebx, edx
mov edx, ecx
push esi
push edi
mov esi, dword [edx + 0x10afc]
mov eax, esi
mov edi, dword [edx + 0x108dc]
xor eax, ebx
and eax, 0xff
shr esi, 8
mov eax, dword [edi + eax*4]
xor eax, esi
mov dword [edx + 0x10afc], eax
movzx eax, al
add eax, dword [edx + 0x10b00]
imul ecx, eax, 0x8088405
mov eax, dword [edx + 0x10b04]
inc ecx
mov dword [edx + 0x10b00], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [edi + ecx*4]
pop edi
mov dword [edx + 0x10b04], eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4985a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, edx
mov dword [esi + 0x10afc], 0x12345678
mov dword [esi + 0x10b00], 0x23456789
mov dword [esi + 0x10b04], 0x34567890
mov cl, byte [ebx]
test cl, cl
je 0x498639
mov eax, dword [esi + 0x10afc]
mov edx, 0x34567890
push edi
mov edi, dword [esi + 0x10b00]
mov ebx, dword [esi + 0x108dc]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ebx + ecx*4]
movzx ecx, al
add ecx, edi
mov dword [esi + 0x10afc], eax
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [esi + 0x10b00], edi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
and ecx, 0xff
xor edx, dword [ebx + ecx*4]
mov ebx, dword [ebp - 4]
inc ebx
mov dword [esi + 0x10b04], edx
mov dword [ebp - 4], ebx
mov cl, byte [ebx]
test cl, cl
jne 0x4985e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498990
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov edx, dword [ebp + 8]
call fcn.004985a0
movq xmm0, qword [edi]
mov eax, dword [edi + 8]
mov edx, dword [esi + 0x10b04]
mov ebx, dword [esi + 0x10afc]
mov edi, dword [esi + 0x10b00]
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4989e0
mov eax, edx
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x10]
shr ecx, 8
and ecx, 0xff
xor ecx, eax
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x10], cl
mov eax, ebx
movzx ecx, cl
xor ecx, ebx
shr eax, 8
mov ebx, dword [esi + 0x108dc]
and ecx, 0xff
mov ebx, dword [ebx + ecx*4]
mov ecx, dword [esi + 0x108dc]
xor ebx, eax
movzx eax, bl
add eax, edi
mov dword [esi + 0x10afc], ebx
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [esi + 0x10b00], edi
shr eax, 0x18
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x14]
inc eax
mov dword [esi + 0x10b04], edx
mov dword [ebp - 0x14], eax
cmp eax, 0xc
jl 0x4989e0
mov eax, dword [esi + 0x8d8]
movzx edx, byte [ebp - 5]
test byte [eax + 0x18], 2
je 0x498a86
movzx ecx, byte [esi + 0x10929]
jmp 0x498a8d
movzx ecx, byte [esi + 0x1092f]
cmp edx, ecx
je 0x498aa5
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 0x108ec]
mov eax, dword [esi + 0x90]
cmp edi, eax
mov ebx, dword [esi + 0x108e8]
cmovg edi, eax
test edi, edi
je 0x498b3b
mov ecx, dword [esi + 0x10b04]
lea ebx, [ebx + 1]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [ebx - 1], al
movzx eax, byte [ebx - 1]
mov ecx, dword [esi + 0x10afc]
xor eax, ecx
mov edx, dword [esi + 0x108dc]
and eax, 0xff
shr ecx, 8
mov eax, dword [edx + eax*4]
xor eax, ecx
mov dword [esi + 0x10afc], eax
movzx eax, al
add eax, dword [esi + 0x10b00]
imul ecx, eax, 0x8088405
mov eax, dword [esi + 0x10b04]
inc ecx
mov dword [esi + 0x10b00], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [edx + ecx*4]
mov dword [esi + 0x10b04], eax
dec edi
jne 0x498ac0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret