joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d78
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x40cc28
push 1
push 0
push 0x40cc38
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402e77
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402ddb
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402ded
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.004071f4
lea eax, [ebp - 0x40c]
call fcn.00405df4
cmp byte [ebp - 0x40c], 0
je 0x402e1e
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x40cc58
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402e6e
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402e65
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402e88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
lea edx, [ebp - 8]
push edx
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402fec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x40d564]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x40c018], 0
jne 0x40304b
mov eax, dword [0x40ee40]
call fcn.00404420
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c099
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x40c018], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x3c], 0x3c
lea edx, [ebp - 0x3c]
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
mov byte [ebp - 0x23], 0
mov dword [ebp - 0x38], 1
test bl, bl
je 0x4030a0
and dword [ebp - 0x34], 0xbfffffff
or dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0xa0
or dword [ebp - 0x38], 0x40000000
lea ecx, [ebp - 0x3c]
push ecx
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
test bl, bl
je 0x4030f4
or dword [ebp - 0x34], 0x40000000
and dword [ebp - 0x34], 0xfffffffe
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c0c0
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403800
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push 0
call sub.OLE32.DLL_OleInitialize
mov eax, 0x40f654
call fcn.00406e7c
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
test ebx, ebx
je 0x403835
mov eax, ebx
call fcn.004039d8
push ebx
push str.sfxcmd
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0x400
push 0x40de38
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x40de38
push str.sfxname
call sub.KERNEL32.DLL_SetEnvironmentVariableA
call fcn.004054bc
test eax, eax
je 0x403871
push 0x400
push 0x40e238
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0x40387a
mov word [0x40e238], 0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
mov dword [0x40d590], eax
push 0x64
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x40ea38], eax
push 0x65
push dword [0x40d590]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x40ea3c], eax
lea eax, [ebp - 8]
call fcn.004055f8
mov edx, 0x40de38
mov eax, 0x40d598
call fcn.00404d38
lea eax, [ebp - 0x20]
call fcn.0040428c
lea eax, [ebp - 0x38]
call fcn.0040428c
push 0
push 0x4010a3
lea edx, [ebp - 0x20]
push 0
mov dword [0x40ee40], edx
lea ecx, [ebp - 0x38]
push str.STARTDLG
push ebx
mov dword [0x40ee44], ecx
call sub.USER32.DLL_DialogBoxParamA
xor eax, eax
xor edx, edx
mov dword [0x40d564], eax
mov dword [0x40ee44], edx
mov dword [0x40ee40], edx
mov edx, 2
lea eax, [ebp - 0x38]
call fcn.004042b0
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004042b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405674
cmp byte [0x40ccd8], 0
je 0x40393e
call fcn.00402881
mov eax, 0x40ddac
mov ecx, 0x80
xor edx, edx
call fcn.00407124
cmp dword [0x40c054], 0
jle 0x403962
mov eax, dword [0x40c048]
call fcn.00406f3c
push dword [0x40ea38]
call sub.GDI32.DLL_DeleteObject
cmp dword [0x40ea3c], 0
je 0x403981
push dword [0x40ea3c]
call sub.GDI32.DLL_DeleteObject
cmp dword [0x40d584], 0
jne 0x4039a2
cmp dword [0x40d56c], 0
je 0x4039a2
mov eax, 0x40d584
mov edx, 0xff
call fcn.00406d24
mov dword [0x40d56c], 2
cmp dword [0x40c05c], 0
je 0x4039bf
mov eax, dword [0x40c05c]
call fcn.00402851
call sub.OLE32.DLL_OleUninitialize
push dword [0x40d584]
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403ba8
Capabilities:
Hide graphical window

Disassembly:
mov dword [0x40d574], 1
cmp dword [0x40d564], 0
je 0x403bd3
mov eax, 0x7d
call fcn.00402b48
push eax
push 1
push dword [0x40d564]
call sub.USER32.DLL_SetDlgItemTextA
xor edx, edx
mov dword [0x40d578], edx
mov dword [0x40d57c], 1
cmp dword [0x40d564], 0
je 0x403c31
push 1
push dword [0x40d564]
call sub.USER32.DLL_ShowWindow
cmp dword [0x40c054], 0
jne 0x403c28
cmp byte [0x40c018], 0
jne 0x403c28
push 0
push 1
push 0x111
push dword [0x40d564]
call sub.USER32.DLL_SendMessageA
jmp 0x403c28
call fcn.00402bc4
cmp dword [0x40d56c], 2
jne 0x403c23
cmp byte [0x40ccd8], 0
je 0x403c3f
call fcn.00402881
ret
Function at 0x4042d8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x4042fd
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x14], 1
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00404438
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
cmp dword [ebx + 4], 0
je 0x404344
push dword [ebx + 4]
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
add eax, 0xfffffffe
push eax
push dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
inc edx
push edx
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx + 4], eax
cmp dword [ebx + 4], 0
je 0x404397
push 5
push dword [ebx + 4]
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x404415
cmp dword [ebx + 4], 0
je 0x4043b0
push dword [ebx + 4]
call sub.USER32.DLL_DestroyWindow
xor ecx, ecx
mov dword [ebx + 4], ecx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 8]
call fcn.00407178
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x100
call fcn.00406f28
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.004071f4
mov edx, edi
mov eax, ebx
call fcn.00404a7c
test al, al
jne 0x4043f1
mov edx, edi
mov eax, ebx
call fcn.00404ab4
mov edx, edi
mov eax, ebx
call fcn.004048ec
mov ebx, eax
mov eax, edi
call fcn.00406f3c
test ebx, ebx
je 0x404415
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.00406f3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404634
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x404698
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x4046ac
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x404698
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [ebp - 0x24]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [ebp - 0x24]
push eax
call sub.USER32.DLL_DispatchMessageA
lea edx, [ebp - 4]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0x48]
test eax, eax
jl 0x404654
cmp dword [ebp - 4], 0
je 0x404654
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x4046f1
lea eax, [ebp - 8]
push eax
push 0x40cc68
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x4046f1
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x4046e8
push edi
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40521c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00405418
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x44]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
inc ecx
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
inc eax
sub eax, dword [ebp - 0x38]
test bl, bl
mov dword [ebp - 0x18], eax
je 0x4052b3
cmp byte [ebp + 8], 0
jne 0x4052b3
mov eax, dword [ebp - 0x3c]
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x10]
cdq
mov edi, 0x64
idiv edi
add ecx, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x4052f1
push 0x400
lea eax, [ebp - 0x444]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x444]
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 4]
call fcn.004050a0
lea edx, [ebp - 0x444]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x18], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov edi, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
jmp 0x4053ff
push 0x400
lea eax, [ebp - 0x844]
push eax
push edi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x844], 0
je 0x405350
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x844]
lea edx, [ebp - 0x844]
mov eax, dword [ebp - 4]
call fcn.004050a0
lea edx, [ebp - 0x844]
push edx
push edi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x4053ef
lea ecx, [ebp - 0x854]
push ecx
push edi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x405378
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x854]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x850]
inc eax
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ecx
push 0
push edi
call sub.USER32.DLL_SetWindowPos
push 2
push edi
call sub.USER32.DLL_GetWindow
mov edi, eax
cmp edi, dword [ebp - 0x1c]
je 0x40540f
inc esi
test edi, edi
je 0x40540f
cmp esi, 0x200
jl 0x40530f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406080
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.004054bc
test eax, eax
je 0x4060a6
test ebx, ebx
je 0x4060a6
cmp word [ebx], 0
je 0x4060a6
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x4060ae
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x4060c1
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.004062cc
xor eax, eax
jmp 0x4060dc
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x4060d0
cmp eax, 3
jne 0x4060d7
mov eax, 2
jmp 0x4060dc
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x406278
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.004054bc
test eax, eax
je 0x4062a3
test ebx, ebx
je 0x4062a3
cmp word [ebx], 0
je 0x4062a3
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x4062cc
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.004054bc
test eax, eax
je 0x4062f9
test ebx, ebx
je 0x4062f9
cmp word [ebx], 0
je 0x4062f9
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x406308
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x406420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x40ee50
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x406440
call fcn.004063e8
mov eax, dword [ebp - 4]
jmp 0x406459
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x406461
test al, 7
jne 0x406445
cmp esi, 8
jb 0x4064ea
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x40646a
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp esi, dword [ebp - 8]
jbe 0x406514
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x4064f4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4065b4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x4065d7
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x4065e8
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x4065f7
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x406604
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.004054bc
test eax, eax
je 0x406631
test esi, esi
je 0x406631
cmp word [esi], 0
je 0x406631
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x406648
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x406661
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x406661
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x4066cb
mov dword [ebx + 4], edi
test esi, esi
je 0x406696
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00406df4
jmp 0x40669f
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x4066b2
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.004071f4
jmp 0x4066c1
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.00406d98
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.004067a8
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406974
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40699e
cmp esi, 0x4e20
jle 0x406994
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4069ee
mov eax, ebx
call fcn.00406b58
test al, al
je 0x4069d5
cmp esi, 0x4e20
jle 0x4069d5
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00406974
jmp 0x4069f1
cmp dword [ebx + 0xc], 1
jne 0x4069e9
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x4069e9
xor eax, eax
jmp 0x4069f1
or eax, 0xffffffff
jmp 0x4069f1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x407420
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040737c
mov esi, eax
mov eax, dword [0x41bef0]
call fcn.00407068
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push 0x41bf08
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov eax, dword [0x40fdf0]
mov eax, dword [eax + 0x10]
test al, 0x5f
je 0x40747a
and eax, 0x7f
push eax
push 0x41bf08
call sub.KERNEL32.DLL_SetFileAttributesA
cmp ebx, 0xffffffff
je 0x4074c1
test esi, esi
je 0x4074bb
test esi, 1
je 0x407490
lea eax, [ebp - 8]
jmp 0x407492
xor eax, eax
test esi, 2
je 0x40749f
lea edx, [ebp - 0x10]
jmp 0x4074a1
xor edx, edx
test esi, 4
je 0x4074ae
lea ecx, [ebp - 0x18]
jmp 0x4074b0
xor ecx, ecx
mov esi, ecx
push eax
push edx
push esi
push ebx
call sub.KERNEL32.DLL_SetFileTime
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409b6c
Capabilities:
Set file attributes

Disassembly:
mov edx, 0x40c7e6
mov eax, 0x41bf08
call fcn.0040700c
mov dword [0x41bef0], eax
test eax, eax
jne 0x409bd5
push 0
push 0x41bf08
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 0x40c7e6
mov eax, 0x41bf08
call fcn.0040700c
mov dword [0x41bef0], eax
test eax, eax
jne 0x409bd5
mov eax, 0x40d584
mov edx, 9
call fcn.00406d24
push 0x41bf08
mov eax, 0x6e
call fcn.00402b48
push eax
call fcn.00403110
add esp, 8
mov eax, 1
ret
xor eax, eax
ret

Function at 0x409d7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
cmp dword [0x40f7cc], 0
jg 0x409d9a
dec dword [0x40f7cc]
xor eax, eax
mov dword [0x41be04], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
cmp dword [0x41be04], 0
jg 0x409def
push dword [0x41be20]
mov ecx, 0x2000
mov edx, 1
mov eax, dword [0x41bdfc]
call fcn.004070b4
mov dword [0x41be04], eax
test eax, eax
jne 0x409dd4
xor edx, edx
or eax, 0xffffffff
mov dword [0x41be04], edx
pop esi
pop ebx
ret
add dword [0x41be28], 0x2000
mov edx, dword [0x41bdfc]
mov dword [0x41be00], edx
call fcn.00409c34
mov ecx, dword [0x40fdf0]
test byte [ecx + 0x14], 1
je 0x409e26
mov esi, dword [0x41be04]
mov ebx, dword [0x41be00]
jmp 0x409e1d
call fcn.0040b0b4
xor byte [ebx], al
mov al, byte [ebx]
and eax, 0xff
call fcn.0040b0d8
inc ebx
mov edx, esi
add esi, 0xffffffff
test edx, edx
jne 0x409e09
dec dword [0x41be04]
mov ecx, dword [0x41be00]
inc dword [0x41be00]
xor eax, eax
mov al, byte [ecx]
pop esi
pop ebx
ret

Function at 0x40aff6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
mov eax, edx
call fcn.0040b154
lea eax, [ebp - 0xc]
mov ecx, 0xc
mov edx, ebx
call fcn.00407138
xor ebx, ebx
call fcn.0040b0b4
xor byte [ebp + ebx - 0xc], al
mov al, byte [ebp + ebx - 0xc]
and eax, 0xff
call fcn.0040b0d8
inc ebx
cmp ebx, 0xc
jl 0x40b018
mov edx, dword [0x40fdf0]
xor eax, eax
mov al, byte [ebp - 1]
test byte [edx + 0x14], 2
je 0x40b052
movzx ecx, word [0x41be4e]
sar ecx, 8
jmp 0x40b05e
mov ecx, dword [0x41be54]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x40b06a
or eax, 0xffffffff
jmp 0x40b0ad
mov edx, dword [0x41be04]
cmp edx, dword [0x40f7cc]
jle 0x40b080
mov ebx, dword [0x40f7cc]
jmp 0x40b086
mov ebx, dword [0x41be04]
mov esi, dword [0x41be00]
jmp 0x40b0a2
call fcn.0040b0b4
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0040b0d8
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x40b08e
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b0d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x41c014]
xor edx, eax
and edx, 0xff
mov ecx, dword [0x41bdf4]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x41c014]
shr ecx, 8
xor edx, ecx
mov dword [0x41c014], edx
mov edx, dword [0x41c014]
and edx, 0xff
add dword [0x41c018], edx
imul ecx, dword [0x41c018], 0x8088405
inc ecx
mov dword [0x41c018], ecx
mov edx, dword [0x41c018]
shr edx, 0x18
xor edx, dword [0x41c01c]
and edx, 0xff
mov ecx, dword [0x41bdf4]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x41c01c]
shr ecx, 8
xor edx, ecx
mov dword [0x41c01c], edx
ret