joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483bf4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x483c06
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
cmp edx, dword [eax]
jne 0x483c02
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x483c5d
xor eax, eax
push ebp
push 0x483c56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483c5d
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x488bcb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x488c23
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x488c19
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x488c27
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4b70dc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.0040b4a0
add esp, 0x100
pop ebx
ret

Function at 0x4b7e28
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.0040b4a0
add esp, 0x100
pop ebx
ret

Function at 0x4bb3e8
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov ebp, edx
mov esi, eax
push esi
mov esi, 0x4bb4a0
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop esi
cmp dword [esi + 0x1c0], 0
jne 0x4bb428
push 0xff
lea eax, [esp + 4]
push eax
mov eax, dword [0x5107f8]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
jmp 0x4bb435
mov eax, esp
mov edx, dword [esi + 0x1c0]
call fcn.0040b274
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4bb463
mov eax, ebp
mov edx, 0x4bb5a8
call fcn.004052d8
jmp 0x4bb495
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [esp + 0x100], edi
fild dword [esp + 0x100]
add esp, 0xfffffff4
fstp xword [esp]
wait
mov edx, ebp
mov eax, dword [esi + 0x1c8]
call fcn.0040c9e8
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bb618
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bb7d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
je 0x4bb65b
mov eax, dword [ebp - 8]
mov edx, 0x4bb7e8
call fcn.004052d8
jmp 0x4bb780
mov esi, 0x4bb7fc
lea edi, [ebp - 0x110]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c0], 0
jne 0x4bb692
push 0xff
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x5107f8]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
jmp 0x4bb6a6
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1c0]
lea eax, [ebp - 0x110]
call fcn.0040b274
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4bb6ce
mov eax, dword [ebp - 8]
mov edx, 0x4bb904
call fcn.004052d8
jmp 0x4bb780
lea eax, [ebx + 1]
call fcn.0040b4b4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bb779
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4bb70d
mov eax, dword [ebp - 8]
mov edx, 0x4bb924
call fcn.004052d8
jmp 0x4bb763
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1a8]
sub al, 9
je 0x4bb725
sub al, 2
je 0x4bb738
dec al
je 0x4bb745
jmp 0x4bb752
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004bad28
jmp 0x4bb763
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bb1d0
jmp 0x4bb763
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bb3e8
jmp 0x4bb763
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004baedc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb780
mov eax, dword [ebp - 0x10]
call fcn.0040b500
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1b0], 0
je 0x4bb7b7
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.004bba28
push dword [ebp - 0x114]
push 0x4bb950
mov eax, dword [ebp - 8]
push dword [eax]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00405608
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb7d7
lea eax, [ebp - 0x114]
call fcn.00405284
ret

Function at 0x4bc6a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, byte [0x4bc6e4]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4bc6bf
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4bc6ce
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4bc6dd
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x4bdac0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x50d35c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4bdae6
push 0
mov eax, dword [0x50d35c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4be4c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4be5b0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x4be503
bt edi, eax
jae 0x4be58b
mov ebx, esi
add bl, 0x61
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.0040546c
lea eax, [ebp - 0x14]
mov edx, 0x4be5c8
call fcn.00405550
mov eax, dword [ebp - 0x14]
call fcn.00405748
push eax
call sub.kernel32.dll_GetDriveTypeA
mov byte [ebp - 0xd], al
mov eax, ebx
call fcn.004033b0
mov ebx, eax
movzx eax, byte [ebp - 0xd]
add al, 0xfd
sub al, 4
jae 0x4be58b
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x20]
call fcn.00403878
mov edx, 0x4be5cc
lea eax, [ebp - 0x20]
mov cl, 2
call fcn.00403848
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x18]
call fcn.004054e8
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bf048
inc esi
cmp esi, 0x1a
jne 0x4be4f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be5b7
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004052a8
ret
Function at 0x4c033c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0x4a
je 0x4c0365
mov eax, 0xfffffffa
jmp 0x4c051c
cmp dword [esi + 0x24], 0
jne 0x4c0378
mov eax, 0x4c8a1c
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x2c], eax
cmp dword [esi + 0x28], 0
jne 0x4c0386
mov eax, 0x4c8a28
mov dword [esi + 0x28], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4c0393
mov dword [ebp - 4], 6
test edi, edi
jge 0x4c03a0
mov dword [ebp - 0xc], 1
neg edi
cmp dword [ebp + 0x10], 1
jl 0x4c03d4
cmp dword [ebp + 0x10], 9
jg 0x4c03d4
cmp dword [ebp - 8], 8
jne 0x4c03d4
cmp edi, 8
jl 0x4c03d4
cmp edi, 0xf
jg 0x4c03d4
cmp dword [ebp - 4], 0
jl 0x4c03d4
cmp dword [ebp - 4], 9
jg 0x4c03d4
cmp dword [ebp + 0xc], 0
jl 0x4c03d4
cmp dword [ebp + 0xc], 2
jle 0x4c03de
mov eax, 0xfffffffe
jmp 0x4c051c
mov eax, esi
mov ecx, 0x16bc
mov edx, 1
call fcn.004c009c
mov ebx, eax
test ebx, ebx
jne 0x4c03ff
mov eax, 0xfffffffc
jmp 0x4c051c
mov dword [esi + 0x20], ebx
mov dword [ebx], esi
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov eax, edi
mov dword [ebx + 0x28], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x24], edx
dec edx
mov dword [ebx + 0x2c], edx
mov eax, dword [ebp + 0x10]
add eax, 7
mov dword [ebx + 0x48], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x44], edx
dec edx
mov dword [ebx + 0x4c], edx
mov eax, dword [ebx + 0x48]
add eax, 3
dec eax
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x50], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x24]
call fcn.004c009c
mov dword [ebx + 0x30], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x24]
call fcn.004c009c
mov dword [ebx + 0x38], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x44]
call fcn.004c009c
mov dword [ebx + 0x3c], eax
mov ecx, dword [ebp + 0x10]
add ecx, 6
mov edi, 1
shl edi, cl
mov dword [ebx + 0x1690], edi
mov eax, esi
mov ecx, 4
mov edx, edi
call fcn.004c009c
mov dword [ebx + 8], eax
mov edx, dword [ebx + 0x1690]
add edx, edx
add edx, edx
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0x30], 0
je 0x4c04c9
cmp dword [ebx + 0x38], 0
je 0x4c04c9
cmp dword [ebx + 0x3c], 0
je 0x4c04c9
cmp dword [ebx + 8], 0
jne 0x4c04d7
mov eax, esi
call fcn.004c0230
mov eax, 0xfffffffc
jmp 0x4c051c
mov edx, dword [ebx + 0x1690]
sar edx, 1
jns 0x4c04e4
adc edx, 0
lea eax, [eax + edx*2]
mov dword [ebx + 0x1698], eax
mov eax, dword [ebx + 0x1690]
lea eax, [eax + eax*2]
mov edx, dword [ebx + 8]
lea eax, [edx + eax]
mov dword [ebx + 0x168c], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x78], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x7c], eax
movzx eax, byte [ebp - 8]
mov byte [ebx + 0x1d], al
mov eax, esi
call fcn.004c02ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c08bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov eax, dword [esi + 0x45]
cmp byte [eax], 0
jne 0x4c08db
cmp dword [esi + 0x20], 0
je 0x4c08db
cmp edi, 4
jg 0x4c08db
test edi, edi
jge 0x4c08e5
mov eax, 0xfffffffe
jmp 0x4c0b14
mov ebx, dword [esi + 0x20]
cmp dword [esi + 0x10], 0
je 0x4c0907
cmp dword [esi], 0
jne 0x4c08f9
cmp dword [esi + 4], 0
jne 0x4c0907
cmp dword [ebx + 4], 0x29a
jne 0x4c0911
cmp edi, 4
je 0x4c0911
mov eax, 0xfffffffe
jmp 0x4c0b14
cmp dword [esi + 0x14], 0
jne 0x4c0921
mov eax, 0xfffffffb
jmp 0x4c0b14
mov dword [ebx], esi
mov ebp, dword [ebx + 0x20]
mov dword [ebx + 0x20], edi
cmp dword [ebx + 4], 0x2a
jne 0x4c09b7
movzx ecx, word [ebx + 0x28]
sub cx, 8
shl ecx, 4
add cx, 8
shl ecx, 8
mov eax, dword [ebx + 0x78]
dec eax
shr eax, 1
cmp ax, 3
jbe 0x4c0955
mov ax, 3
shl eax, 6
or cx, ax
cmp dword [ebx + 0x64], 0
je 0x4c0965
or cx, 0x20
movzx eax, cx
push ecx
mov ecx, 0x1f
xor edx, edx
div ecx
pop ecx
mov ax, 0x1f
sub ax, dx
add cx, ax
mov dword [ebx + 4], 0x71
mov eax, ebx
mov edx, ecx
call fcn.004c0544
cmp dword [ebx + 0x64], 0
je 0x4c09b0
mov edx, dword [esi + 0x34]
shr edx, 0x10
mov eax, ebx
call fcn.004c0544
movzx edx, word [esi + 0x34]
and dx, 0xffff
mov eax, ebx
call fcn.004c0544
mov dword [esi + 0x34], 1
cmp dword [ebx + 0x14], 0
je 0x4c09d8
mov eax, esi
call fcn.004c0570
cmp dword [esi + 0x14], 0
jne 0x4c09f1
mov dword [ebx + 0x20], 0xffffffff
xor eax, eax
jmp 0x4c0b14
cmp dword [esi + 4], 0
jne 0x4c09f1
cmp ebp, edi
jl 0x4c09f1
cmp edi, 4
je 0x4c09f1
mov eax, 0xfffffffb
jmp 0x4c0b14
cmp dword [ebx + 4], 0x29a
jne 0x4c0a0a
cmp dword [esi + 4], 0
je 0x4c0a0a
mov eax, 0xfffffffb
jmp 0x4c0b14
cmp dword [esi + 4], 0
jne 0x4c0a2b
cmp dword [ebx + 0x6c], 0
jne 0x4c0a2b
test edi, edi
je 0x4c0ac2
cmp dword [ebx + 4], 0x29a
je 0x4c0ac2
mov eax, dword [ebx + 0x78]
lea eax, [eax + eax*2]
mov ebp, dword [eax*4 + 0x50af70]
mov eax, ebx
mov edx, edi
call ebp
cmp al, 2
je 0x4c0a46
cmp al, 3
jne 0x4c0a4d
mov dword [ebx + 4], 0x29a
test al, al
je 0x4c0a55
cmp al, 2
jne 0x4c0a69
cmp dword [esi + 0x14], 0
jne 0x4c0a62
mov dword [ebx + 0x20], 0xffffffff
xor eax, eax
jmp 0x4c0b14
cmp al, 1
jne 0x4c0ac2
cmp edi, 1
jne 0x4c0a7b
mov eax, ebx
call fcn.004c06d4
jmp 0x4c0aaa
push 0
mov eax, ebx
xor ecx, ecx
xor edx, edx
call fcn.004c0860
cmp edi, 3
jne 0x4c0aaa
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x44]
mov word [eax + edx*2 - 2], 0
mov eax, dword [ebx + 0x44]
dec eax
mov edx, eax
add edx, edx
mov eax, dword [ebx + 0x3c]
call fcn.004c08b4
mov eax, esi
call fcn.004c0570
cmp dword [esi + 0x14], 0
jne 0x4c0ac2
mov dword [ebx + 0x20], 0xffffffff
xor eax, eax
jmp 0x4c0b14
cmp edi, 4
je 0x4c0acb
xor eax, eax
jmp 0x4c0b14
cmp dword [ebx + 0x18], 0
je 0x4c0ad8
mov eax, 1
jmp 0x4c0b14
mov edx, dword [esi + 0x34]
shr edx, 0x10
mov edi, ebx
mov eax, edi
call fcn.004c0544
movzx edx, word [esi + 0x34]
and dx, 0xffff
mov eax, edi
call fcn.004c0544
mov eax, esi
call fcn.004c0570
mov dword [ebx + 0x18], 0xffffffff
cmp dword [ebx + 0x14], 0
je 0x4c0b0f
xor eax, eax
jmp 0x4c0b14
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c0dc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x4c0ded
cmp dword [ebx + 0x64], 0
jne 0x4c0ded
cmp dword [ebx + 0x6c], 0
jne 0x4c0ded
mov esi, edi
jmp 0x4c0e7b
cmp esi, 0xffffffff
jne 0x4c0df8
dec esi
jmp 0x4c0e7b
mov eax, dword [ebx + 0x64]
mov edx, edi
sub edx, 0x106
add edx, edi
cmp eax, edx
jl 0x4c0e7b
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ecx, edi
xchg edx, eax
call fcn.004cb03c
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], edi
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
jg 0x4c0e43
movzx ecx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x4c0e48
mov word [edx], 0
dec eax
test eax, eax
jne 0x4c0e29
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
jg 0x4c0e6f
movzx ecx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x4c0e74
mov word [edx], 0
dec eax
test eax, eax
jne 0x4c0e55
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x4c0ed9
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.004c0b1c
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jl 0x4c0ec4
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jge 0x4c0ed9
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4c0dcd
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4c2958
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4c2971
add esp, 0xfffffff0
call fcn.00404760
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.00405738
mov eax, dword [ebp + 0xc]
call fcn.00405738
xor eax, eax
push ebp
push 0x4c2a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x40], esi
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov eax, esi
mov dword [ebx + 0x5c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0x9c]
mov dword [ebx + 0x58], edx
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x60], 0x4d0790
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x68], 0x4d09ac
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x50], 0x4d09c8
movzx eax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x4c2a09
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.004cedec
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x70]
call fcn.004052d8
lea eax, [ebx + 0x3c]
mov edx, dword [ebp + 0xc]
call fcn.004052d8
mov byte [ebx + 0x38], 1
jmp 0x4c2a20
lea eax, [ebx + 0x70]
mov edx, dword [ebp + 0xc]
call fcn.004052d8
lea eax, [ebx + 0x3c]
call fcn.00405284
mov byte [ebx + 0x38], 0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x70]
xor edx, edx
mov eax, ebx
call fcn.004c88e0
movzx eax, word [ebp + 8]
mov word [ebx + 0x4a], ax
mov byte [ebx + 0x48], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2a67
lea eax, [ebp - 8]
call fcn.00405284
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004052a8
ret

Function at 0x4c9b3c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x5128f4
movzx eax, al
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x50d224]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x50d224]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x4c9c64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4c9c8e
call fcn.004c9c40
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
movzx eax, byte [eax]
call fcn.004c9b3c
inc dword [esi]
dec ebx
jne 0x4c9c76
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c9c94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4c9cc4
call fcn.004c9c40
movzx esi, al
mov eax, dword [edi]
movzx eax, byte [eax]
call fcn.004c9b3c
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x4c9ca7
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c9dac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00405738
xor eax, eax
push ebp
push 0x4c9e56
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x4c9e40
mov eax, dword [ebp + 8]
call fcn.004c9ba0
test eax, eax
jne 0x4c9e40
xor ebx, ebx
call fcn.004c9c40
movzx edx, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
call fcn.004c9b3c
movzx eax, bl
movzx edx, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x4c9de8
movzx eax, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x4c9e31
mov edx, dword [ebp - 4]
shr edx, 0x10
movzx edx, dx
shr edx, 8
cmp al, dl
sete bl
jmp 0x4c9e40
movzx eax, al
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9e5d
lea eax, [ebp + 8]
call fcn.00405284
ret

Function at 0x4ca714
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405738
xor eax, eax
push ebp
push 0x4ca765
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405748
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4ca749
test al, 0x10
jne 0x4ca74d
xor ebx, ebx
jmp 0x4ca74f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca76c
lea eax, [ebp - 4]
call fcn.00405284
ret

Function at 0x4caa2c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4caa54
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.004054f4
jmp 0x4caa5d
mov eax, ebx
xor edx, edx
call fcn.004059d0
add esp, 0x104
pop ebx
ret

Function at 0x4cac54
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405738
xor eax, eax
push ebp
push 0x4cacac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405748
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 0x10
jne 0x4cac90
test al, 1
jne 0x4cac90
test al, 4
jne 0x4cac90
test al, 2
je 0x4cac94
xor ebx, ebx
jmp 0x4cac96
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cacb3
lea eax, [ebp - 4]
call fcn.00405284
ret

Function at 0x4cb018
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405748
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4cb031
test al, 0x10
jne 0x4cb035
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret