joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4632f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff19c
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
push 0
push 0
mov eax, 0x4adfd0
xor ecx, ecx
mov edx, ebx
call fcn.004590e0
test al, al
jne 0x463331
cmp byte [ebp + 0x14], 0
jne 0x463550
push 1
push 0
mov eax, 0x4adfd0
mov ecx, edi
mov edx, ebx
call fcn.00457b40
cmp eax, 1
je 0x463397
test eax, eax
jne 0x463550
cmp dword [ebp + 8], 1
jne 0x463550
mov edx, 0x498df4
mov eax, ebx
call fcn.0040ad40
test al, al
jne 0x46337e
mov edx, 0x498df8
mov eax, ebx
call fcn.0040ad40
test al, al
je 0x463550
mov eax, 0x1fc
call fcn.00410804
push eax
push ebx
call fcn.0044142c
add esp, 8
jmp 0x463550
cmp byte [ebp + 0xc], 0
je 0x4633b7
lea edx, [ebp - 0x98]
mov eax, 0x4adfd0
call fcn.00459040
cmp byte [ebp - 2], 0
jne 0x463550
cmp byte [ebp + 0x10], 0
je 0x463441
mov eax, 0x4adfd0
call fcn.00459038
test eax, eax
je 0x463441
push 0
push 0
lea ecx, [ebp - 0x498]
mov eax, 0x4adfd0
mov edx, ebx
call fcn.004590e0
lea edx, [ebp - 0x498]
mov eax, ebx
call fcn.0040d81c
test eax, eax
je 0x46340b
lea ecx, [ebp - 0x498]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x463550
mov edx, 0x498dfc
lea eax, [ebp - 0x498]
call fcn.0040ac28
lea edx, [ebp - 0x498]
mov eax, ebx
call fcn.0040d81c
test eax, eax
je 0x463441
lea ecx, [ebp - 0x498]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x463550
push 0xc30
push 0
lea eax, [ebp - 0x10c8]
push eax
call fcn.00482880
add esp, 0xc
lea edx, [ebp - 0x10c8]
mov eax, ebx
call fcn.00409cf4
mov eax, edi
call fcn.0040d7cc
lea edx, [ebp - 0xcc8]
call fcn.00409d3c
mov ecx, dword [0x4ae1d8]
test esi, esi
mov dword [ebp - 0x49c], ecx
jne 0x4634c2
lea eax, [ebp - 0x1150]
call fcn.00411d14
lea eax, [ebp - 0x112c]
call fcn.00411d14
lea eax, [ebp - 0x1108]
call fcn.00411d14
push 0
lea ecx, [ebp - 0x1d64]
mov edx, edi
mov eax, ebx
call fcn.00410f6c
test al, al
je 0x4634c2
lea esi, [ebp - 0x1d64]
test esi, esi
je 0x4634f6
mov eax, dword [esi + 0xc00]
mov dword [ebp - 0x4c8], eax
mov eax, dword [esi + 0xc04]
mov dword [ebp - 0x4c4], eax
mov edx, dword [esi + 0xc90]
mov dword [ebp - 0x4b4], edx
mov edx, dword [esi + 0xc94]
mov dword [ebp - 0x4b0], edx
inc dword [0x4b0558]
mov eax, dword [ebp - 0x4c8]
mov edx, dword [ebp - 0x4c4]
add dword [0x4b0564], eax
adc dword [0x4b0568], edx
lea edx, [ebp - 0x10c8]
mov eax, dword [ebp + 0x18]
call fcn.00460190
mov ebx, eax
mov eax, 0x35c
inc ebx
push ebx
call fcn.00410804
push eax
lea edx, [ebp - 0x1e64]
push edx
call fcn.00486578
add esp, 0xc
lea edx, [ebp - 0x1e64]
mov eax, 0x4adb14
call fcn.00441f48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x463fdf
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.004811dc
pop ecx
mov edi, eax
test edi, edi
jne 0x464002
mov eax, 1
xor edx, edx
jmp 0x464095
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x464059
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x464028
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x464023
push edi
call fcn.00481004
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00489b8c
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x46a9cc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
push eax
push dword [0x4ad5b4]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push esp
push esi
call fcn.004829b4
add esp, 8
test eax, eax
je 0x46aa09
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x46b7e4
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4ad5b4]
test eax, eax
je 0x46b891
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4bc1d4], 8
je 0x46b836
push 0x4bc1d8
lea ecx, [esp + 4]
push ecx
call fcn.004829b4
add esp, 8
test eax, eax
je 0x46b836
push 0x4bc1d8
push dword [0x4ad5b4]
call sub.USER32.DLL_SetWindowTextA
mov eax, dword [0x4bc1d4]
test eax, eax
je 0x46b84e
cmp eax, 1
je 0x46b84e
cmp eax, 2
je 0x46b84e
cmp eax, 8
jne 0x46b873
mov edx, 0x4bc258
mov eax, 0x9c
call fcn.0046a9cc
mov eax, 0x4bc2d8
call fcn.0040a924
mov edx, eax
mov eax, 0x9b
call fcn.0046a9cc
mov edx, 0x64
mov eax, 2
call fcn.004417c0
test al, al
je 0x46b891
push dword [0x4ad5b4]
call sub.USER32.DLL_UpdateWindow
add esp, 0x200
ret
Function at 0x46c5f8
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x46c61e
mov eax, str.comctl32.dll
call fcn.00462b58
mov dword [ebx + 8], eax
mov eax, dword [ebx]
test eax, eax
je 0x46c62a
push eax
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x49edf0]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x46c662
mov ecx, str.ComboBoxEx32
jmp 0x46c667
mov ecx, str.combobox
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x46c6f5
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4bbf94]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.0046ca60
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x46c708
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x46c735
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x46c735
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0046c794
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x46c784
call fcn.00462cf8
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x46c77e
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push str._c:_
push eax
call fcn.00486578
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.0046ca60
inc esi
cmp esi, 0x20
jl 0x46c744
mov eax, ebx
call fcn.0046cbc4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46ca60
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
push 0x408
call fcn.00481038
mov ebx, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebx], eax
mov edx, dword [ebp + 0x1c]
mov eax, edi
mov dword [ebx + 4], edx
call fcn.0040d7bc
push eax
lea edx, [ebx + 8]
push edx
call fcn.00482a00
add esp, 8
cmp byte [esi + 4], 0
je 0x46cb9c
cmp dword [esi + 8], 0x50000
jb 0x46cac4
cmp dword [0x4b0578], 4
jne 0x46cac8
cmp dword [0x4b057c], 0
jne 0x46cac8
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x46cada
cmp dword [ebp + 0x18], 0xffffffff
je 0x46cade
cmp dword [ebp + 0x14], 0
je 0x46cade
xor eax, eax
jmp 0x46cae3
mov eax, 1
test al, al
je 0x46cb28
cmp dword [ebp - 4], 2
mov eax, 0x4201
jne 0x46caf5
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x164]
push edx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
cmp dword [ebp + 0x18], 0xffffffff
jne 0x46cb19
mov ecx, dword [ebp - 0x160]
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0x14], 0
jne 0x46cb28
lea eax, [ebp - 0x158]
mov dword [ebp + 0x14], eax
push 0x24
push 0
lea edx, [ebp - 0x188]
push edx
call fcn.00482880
add esp, 0xc
mov dword [ebp - 0x188], 0x37
cmp dword [ebp + 0x14], 0
je 0x46cb50
mov ecx, dword [ebp + 0x14]
jmp 0x46cb53
or ecx, 0xffffffff
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x168], ebx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x184], eax
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x178], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x174], eax
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x16c], edx
push ecx
push 0
push 0x401
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x46cbba
push edi
push dword [ebp + 0xc]
push 0x14a
push dword [esi]
call sub.USER32.DLL_SendMessageA
push ebx
push eax
push 0x151
push dword [esi]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x46cbc4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbf4
mov esi, eax
mov eax, 0x4ad5bc
call fcn.0045f2a4
mov edi, eax
test edi, edi
je 0x46cc4b
xor eax, eax
mov dword [esp], eax
push esp
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x46cc38
xor ebx, ebx
push 0
push ebx
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x46cc38
mov edx, dword [eax + 4]
test edx, edx
je 0x46cc2f
push edx
push edi
push 0
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x46cc2f
push 0
push ebx
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
jmp 0x46cc38
inc ebx
cmp ebx, 0x80
jl 0x46cbf1
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
jmp 0x46ccef
lea ecx, [esp + 0xc]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov byte [esp + 4], 0
xor edi, edi
push 0
push edi
push 0x150
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46ccc0
cmp dword [ebx], 0
jne 0x46ccb7
movzx ebp, byte [ebx + 8]
push ebp
call fcn.00489668
pop ecx
push eax
xor eax, eax
mov al, byte [esp + 0x10]
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
call fcn.00489668
pop ecx
pop edx
cmp edx, eax
jne 0x46ccb7
push 0
push edi
push 0x14e
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov byte [esp + 4], 1
jmp 0x46ccc0
inc edi
cmp edi, 0x80
jl 0x46cc61
cmp byte [esp + 4], 0
jne 0x46ccd6
lea ecx, [esp + 0xc]
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0046ce98
cmp dword [0x4afc0c], 0
je 0x46cce8
mov eax, esi
call fcn.0046d120
jmp 0x46ccef
mov eax, esi
call fcn.0046d0f8
add esp, 0x40c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46ccfc
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
push dword [ebx]
call sub.USER32.DLL_GetWindowTextA
mov eax, esp
call fcn.00441638
mov edx, esp
push edx
push 0xffffffffffffffff
push 0x158
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp eax, 0xffffffff
je 0x46cd64
push 0
push eax
push 0x14e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov eax, ebx
call fcn.0046cdb8
cmp dword [0x4afc0c], 0
je 0x46cd5b
mov eax, ebx
call fcn.0046d120
jmp 0x46cdae
mov eax, ebx
call fcn.0046d0f8
jmp 0x46cdae
cmp dword [0x4afc0c], 0
je 0x46cd88
mov eax, esp
call fcn.0040b238
test al, al
jne 0x46cd88
mov edx, esp
mov eax, 0x4ad5bc
xor ecx, ecx
call fcn.0045d07c
jmp 0x46cdae
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x46cda7
test al, 0x10
jne 0x46cda7
mov edx, esp
mov eax, 0x4ad5bc
xor ecx, ecx
call fcn.0045cf48
jmp 0x46cdae
mov eax, esp
call fcn.00441a60
add esp, 0x400
pop ebx
ret

Function at 0x46d0f8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov ecx, esp
mov edx, esp
mov eax, ebx
call fcn.0046ce98
add esp, 0x400
pop ebx
ret
Function at 0x46d2b8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
cmp ecx, 0x4e
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
jne 0x46d39b
mov edx, eax
mov ecx, dword [edx + 8]
sub ecx, 0xfffffcdb
je 0x46d2e7
sub ecx, 5
je 0x46d301
jmp 0x46d397
cmp dword [eax + 0x118], 2
jne 0x46d2fa
mov eax, 0x4adb04
call fcn.0046ccfc
xor eax, eax
jmp 0x46d3a6
mov ebx, eax
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x2c]
cmp dword [eax], 4
jne 0x46d313
mov edi, dword [eax + 4]
jmp 0x46d316
lea edi, [eax + 8]
cmp dword [eax], 4
jne 0x46d322
mov eax, 8
jmp 0x46d324
xor eax, eax
test esi, 1
mov dword [ebp - 4], eax
je 0x46d35a
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x164]
or edx, 0x200
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x46d35a
lea eax, [ebp - 0x158]
mov dword [ebx + 0x14], eax
test esi, 6
je 0x46d38c
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x2c4]
or edx, 0x4001
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x2c0]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x1c], eax
or dword [ebx + 0xc], 0x10000000
xor eax, eax
jmp 0x46d3a6
xor eax, eax
jmp 0x46d3a6
push eax
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46e76c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov ebx, eax
lea edi, [esp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x46e78b
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
mov edx, str.ViewSmall
mov eax, str.GeneralToolbar
mov ecx, 1
call fcn.00460c28
test eax, eax
je 0x46e8c4
mov esi, 0x56000944
push 0
push dword [0x49edf0]
push 0xd
push dword [0x4ad5a8]
push 0
push 0
push 0
push 0
push esi
push 0
push str.ToolbarWindow32
push 0
call sub.USER32.DLL_CreateWindowExA
mov ebp, eax
mov dword [ebx + 4], ebp
push 0
push 0x14
push 0x41e
push ebp
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x41f
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x420
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
xor eax, eax
mov ecx, esp
mov dword [esp], eax
mov edx, dword [ebx + 0x1c]
mov dword [esp + 4], edx
push ecx
push 1
push 0x413
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x499b88
push 1
push 0x414
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
mov ecx, edi
mov edx, 2
mov eax, ebx
call fcn.0046e948
mov dword [edi], 0x38
mov dword [edi + 4], 0x173
cmp dword [edi + 8], 0
jne 0x46e866
or dword [edi + 8], 1
or dword [edi + 8], 4
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x34], 2
mov dword [edi + 0x24], edx
push 0x12
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0xc], eax
push 0xf
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0x10], eax
cmp dword [edi + 0x2c], 0
jne 0x46e89d
mov dword [edi + 0x2c], 0x28
mov eax, dword [0x4adb04]
lea edx, [esp + 0x58]
push edx
push eax
call sub.USER32.DLL_GetClientRect
mov ecx, dword [esp + 0x64]
mov dword [edi + 0x28], ecx
push edi
push 0xffffffffffffffff
push 0x401
push dword [ebx + 8]
call sub.USER32.DLL_SendMessageA
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4705d8
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
cmp dword [0x499dbc], 0
je 0x4705e8
mov al, 1
pop esi
pop ebx
ret
push 0
push 1
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov ebx, eax
test ebx, ebx
jne 0x4705fe
xor eax, eax
pop esi
pop ebx
ret
push ebx
push 0x499dc0
call sub.KERNEL32.DLL_InterlockedExchange
mov esi, eax
test esi, esi
je 0x47063e
push esi
push 0x499dc0
call sub.KERNEL32.DLL_InterlockedExchange
push ebx
call sub.KERNEL32.DLL_CloseHandle
push 0xffffffffffffffff
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
push esi
call sub.KERNEL32.DLL_ReleaseMutex
cmp dword [0x499dbc], 0
setne al
and eax, 1
pop esi
pop ebx
ret
push 0x4bd86c
call sub.KERNEL32.DLL_InitializeCriticalSection
push 0x4bd854
call sub.KERNEL32.DLL_InitializeCriticalSection
push 0x124
push 0
push 0x4bd730
call fcn.00482880
add esp, 0xc
call fcn.00470837
mov dword [0x499dbc], 1
push ebx
call sub.KERNEL32.DLL_ReleaseMutex
mov al, 1
pop esi
pop ebx
ret

Function at 0x470cf6
Capabilities:
Get disk information

Disassembly:
push ecx
add al, 0x40
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x2f
mov byte [esp + 3], 0
push esp
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
sete al
and eax, 1
pop edx
ret

Function at 0x470d64
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
cmp dword [0x4bd890], 0
je 0x470d84
push dword [0x4ca0e0]
call fcn.00484510
pop ecx
jmp 0x470e97
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
mov eax, esp
call fcn.00470ca1
push dword [0x4ca0e0]
mov esi, eax
call fcn.00484510
pop ecx
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push 0x4ca0f8
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
mov eax, dword [0x4bdfe8]
mov ebx, dword [eax + 0x14]
cmp byte [0x4a76e4], 0
je 0x470dd3
and ebx, 0xffffffdf
test bl, 0x5f
jne 0x470de1
cmp byte [0x4a76e4], 0
je 0x470df1
mov eax, ebx
and eax, 0x7f
push eax
push 0x4ca0f8
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [0x4ca020]
test eax, eax
je 0x470e0f
movzx ecx, word [0x4ca052]
mov edx, 0x4ca0f8
xchg edx, eax
call fcn.00470c9e
cmp eax, 0x4f
cmp edi, 0xffffffff
jne 0x470e3d
push 0x4ca0f8
mov eax, 0x1f5
call fcn.00410804
push eax
push 0x4a84b8
call fcn.0044142c
add esp, 0xc
mov eax, 0x49e7d8
call fcn.004277c0
jmp 0x470e97
test esi, esi
je 0x470e7a
test esi, 1
je 0x470e4d
mov eax, esp
jmp 0x470e4f
xor eax, eax
test esi, 2
je 0x470e5d
lea edx, [esp + 8]
jmp 0x470e5f
xor edx, edx
test esi, 4
je 0x470e6d
lea ecx, [esp + 0x10]
jmp 0x470e6f
xor ecx, ecx
mov esi, ecx
push eax
push edx
push esi
push edi
call sub.KERNEL32.DLL_SetFileTime
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp byte [0x4a76e4], 0
je 0x470e97
and ebx, 0x7f
push ebx
push 0x4ca0f8
call sub.KERNEL32.DLL_SetFileAttributesA
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x477c0e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.00477d50
push 0xc
push ebx
lea edx, [esp + 8]
push edx
call fcn.00482810
add esp, 0xc
xor ebx, ebx
call fcn.00477cc8
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.00477cec
inc ebx
cmp ebx, 0xc
jl 0x477c2e
mov edx, dword [0x4bdfe8]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x18], 2
je 0x477c67
movzx ecx, word [0x4ca03e]
sar ecx, 8
jmp 0x477c73
mov ecx, dword [0x4ca044]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x477c7f
or eax, 0xffffffff
jmp 0x477cc2
mov edx, dword [0x4c9ffc]
cmp edx, dword [0x4bd8c8]
jle 0x477c95
mov ebx, dword [0x4bd8c8]
jmp 0x477c9b
mov ebx, dword [0x4c9ffc]
mov esi, dword [0x4c9ff8]
jmp 0x477cb7
call fcn.00477cc8
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.00477cec
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x477ca3
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x477cec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4ca200]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4a0728]
xor ecx, edx
mov dword [0x4ca200], ecx
and ecx, 0xff
add dword [0x4ca204], ecx
imul edx, dword [0x4ca204], 0x8088405
inc edx
mov dword [0x4ca204], edx
shr edx, 0x18
mov ecx, dword [0x4ca208]
xor edx, ecx
and edx, 0xff
shr ecx, 8
mov edx, dword [edx*4 + 0x4a0728]
xor edx, ecx
mov dword [0x4ca208], edx
ret

Function at 0x477f34
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x477f48
xor eax, eax
jmp 0x478040
call fcn.00477f2c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x47801d
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x477f59
test edi, edi
je 0x47803b
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x478021
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret