joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475ccc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
cmp ecx, 0x4e
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
jne 0x475dad
mov edx, eax
mov ecx, dword [edx + 8]
sub ecx, 0xfffffcdb
je 0x475cfb
sub ecx, 5
je 0x475d15
jmp 0x475da9
cmp dword [eax + 0x118], 2
jne 0x475d0e
mov eax, 0x4c53d8
call fcn.004755bc
xor eax, eax
jmp 0x475db8
mov ebx, eax
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x2c]
cmp dword [eax], 4
jne 0x475d27
mov edi, dword [eax + 4]
jmp 0x475d2a
lea edi, [eax + 8]
mov edx, 8
cmp dword [eax], 4
je 0x475d37
add edx, 0xfffffff8
test esi, 1
mov dword [ebp - 4], edx
je 0x475d6c
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x164]
or eax, 0x200
push eax
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x475d6c
lea eax, [ebp - 0x158]
mov dword [ebx + 0x14], eax
test esi, 6
je 0x475d9e
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x2c4]
or edx, 0x4001
push edx
push 0x160
push ecx
push 0
push edi
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x2c0]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x1c], eax
or dword [ebx + 0xc], 0x10000000
xor eax, eax
jmp 0x475db8
xor eax, eax
jmp 0x475db8
push eax
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x475ee4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov byte [ebp - 1], cl
push dword [ebp + 8]
mov ebx, edx
call sub.USER32.DLL_GetSysColor
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x475f16
mov edx, ebx
shl edx, 3
sub edx, ebx
mov ecx, dword [edx*8 + 0x4ab63c]
jmp 0x475f24
mov eax, ebx
shl eax, 3
sub eax, ebx
mov ecx, dword [eax*8 + 0x4ab640]
cmp byte [ebp - 1], 0
mov ebx, ecx
jne 0x475f63
push 2
push ebx
push dword [0x4b2148]
call sub.KERNEL32.DLL_FindResourceA
push eax
push dword [0x4b2148]
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x475f51
mov edx, 4
jmp 0x475f55
movzx edx, word [eax + 0xe]
mov eax, edx
cmp eax, 8
je 0x475f63
mov dword [ebp - 0xc], 0x800080
push 1
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [0x4b2148]
call sub.COMCTL32.DLL_CreateMappedBitmap
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x477484
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov ebx, eax
lea edi, [esp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4774a3
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
mov edx, 0x4abca9
mov eax, 0x4abc44
mov ecx, 1
call fcn.0046139c
test eax, eax
je 0x4775f6
mov esi, 0x56000944
push 0
push dword [0x4b214c]
push 0xd
push dword [0x4c4e64]
push 0
push 0
push 0
push 0
push esi
push 0
push 0x4abc76
push 0
call sub.USER32.DLL_CreateWindowExA
mov ebp, eax
mov dword [ebx + 4], ebp
push 0
push 0x14
push 0x41e
push ebp
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x41f
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x100010
push 0
push 0x420
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0
mov edx, 0x4abcb3
mov eax, 0x4c56a4
mov ecx, 0xf
call fcn.0047a574
test eax, eax
jne 0x477544
mov eax, dword [ebx + 0x1c]
xor edx, edx
mov ecx, esp
mov dword [esp], edx
mov dword [esp + 4], eax
push ecx
push 1
push 0x413
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
push 0x4aba98
push 1
push 0x414
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
mov ecx, edi
mov edx, 2
mov eax, ebx
call fcn.0047767c
mov dword [edi], 0x38
mov dword [edi + 4], 0x173
cmp dword [edi + 8], 0
jne 0x477598
or dword [edi + 8], 1
or dword [edi + 8], 4
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x34], 2
mov dword [edi + 0x24], edx
push 0x12
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0xc], eax
push 0xf
call sub.USER32.DLL_GetSysColor
mov dword [edi + 0x10], eax
cmp dword [edi + 0x2c], 0
jne 0x4775cf
mov dword [edi + 0x2c], 0x28
mov eax, dword [0x4c53d8]
lea edx, [esp + 0x58]
push edx
push eax
call sub.USER32.DLL_GetClientRect
mov ecx, dword [esp + 0x64]
mov dword [edi + 0x28], ecx
push edi
push 0xffffffffffffffff
push 0x401
push dword [ebx + 8]
call sub.USER32.DLL_SendMessageA
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47a1f4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov esi, edx
mov ebx, eax
cmp esi, 0xa8
jne 0x47a215
mov eax, ebx
call fcn.0047abb8
mov al, 1
jmp 0x47a326
cmp esi, 0xa9
jne 0x47a241
push 1
push 0x4abe84
push 0
mov eax, 0x4f7
call fcn.004125d0
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, 1
jmp 0x47a326
mov eax, ebx
call fcn.0047a0ac
mov edi, eax
cmp esi, 0xaa
jne 0x47a275
mov dword [ebx + 0x114], 0xffffffff
mov ecx, 0x4abe84
mov edx, 0x4abe85
mov eax, 0x4abe74
call fcn.00460fa8
jmp 0x47a2f8
cmp esi, 0x3e8
jl 0x47a285
cmp esi, 0x468
jl 0x47a28c
xor eax, eax
jmp 0x47a326
push 0x2c
push 0
lea edx, [esp + 8]
push edx
call fcn.00497b00
add esp, 0xc
mov dword [esp], 0x2c
mov dword [esp + 4], 0x20
push esp
push 0
push esi
push edi
call sub.USER32.DLL_GetMenuItemInfoA
test eax, eax
jne 0x47a2be
xor eax, eax
jmp 0x47a326
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x10c]
jb 0x47a2ce
xor eax, eax
jmp 0x47a326
mov ebp, eax
mov dword [ebx + 0x114], ebp
imul eax, ebp, 0x584
add eax, dword [ebx + 0x108]
call fcn.0040bd28
mov ecx, eax
mov edx, 0x4abe85
mov eax, 0x4abe74
call fcn.00460fa8
mov eax, dword [ebx + 0x518]
cmp eax, 0xffffffff
je 0x47a30c
push 0
push eax
push edi
call sub.USER32.DLL_CheckMenuItem
push 8
push esi
push edi
call sub.USER32.DLL_CheckMenuItem
mov dword [ebx + 0x518], esi
xor edx, edx
mov eax, ebx
call fcn.0047a3f4
mov al, 1
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47bc60
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
mov esi, edx
mov ebx, eax
push eax
add esp, 0xfffffbfc
cmp dword [0x4c7804], 0
mov byte [esp], cl
je 0x47bca3
mov edx, 0x4d30f0
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.00457598
mov edx, 0x4d34f0
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.0045756c
jmp 0x47bcb9
push 0x4d30f0
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov byte [0x4d34f0], 0
mov byte [0x4d38f0], 0
push 0
push 0x47ad98
push esi
push 0x4ac114
push dword [0x4b2148]
call sub.USER32.DLL_DialogBoxParamA
test eax, eax
jne 0x47bce0
xor eax, eax
jmp 0x47bd41
cmp byte [esp], 0
je 0x47bd3f
lea edx, [esp + 4]
mov eax, 0x4d30f0
mov ecx, 0x1000000
call fcn.004104b4
lea edx, [esp + 0x804]
mov eax, 0x4d34f0
mov ecx, 0x1000000
call fcn.004104b4
lea edx, [esp + 0x1004]
mov eax, 0x4d38f0
mov ecx, 0x1000000
call fcn.004104b4
lea edx, [esp + 0x1004]
mov eax, ebx
push edx
lea edx, [esp + 8]
lea ecx, [esp + 0x808]
call fcn.0047c0fc
mov al, 1
add esp, 0x1404
pop esi
pop ebx
ret

Function at 0x47c99c
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x47cc4c
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
mov eax, ebx
call fcn.00463bb0
test al, al
jne 0x47cc64
xor eax, eax
jmp 0x47cc9f
push 0
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call fcn.0049a83c
pop ecx
push ebx
lea edx, [esp + 4]
push edx
call fcn.00497c80
add esp, 8
push 0x5c
lea ecx, [esp + 4]
push ecx
call fcn.00497d65
add esp, 8
mov ebx, eax
test eax, eax
je 0x47cc99
mov byte [ebx], 0
push esp
call sub.KERNEL32.DLL_RemoveDirectoryA
add esp, 0x400
pop ebx
ret

Function at 0x47cd04
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
test esi, esi
je 0x47ce06
push esi
call fcn.00497cb0
pop ecx
mov dword [esp], eax
test eax, eax
je 0x47ce06
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
jne 0x47cd37
xor eax, eax
jmp 0x47ce0b
call sub.USER32.DLL_EmptyClipboard
mov edi, dword [esp]
inc edi
push edi
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test eax, eax
je 0x47cd7a
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov ebp, eax
test eax, eax
je 0x47cd7a
mov edx, dword [esp]
inc edx
push edx
push esi
push ebp
call fcn.00497a90
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
push 1
call sub.USER32.DLL_SetClipboardData
push edi
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test eax, eax
je 0x47cdbb
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov ebp, eax
test eax, eax
je 0x47cdbb
mov edx, dword [esp]
inc edx
push edx
push esi
push ebp
call fcn.00497a90
add esp, 0xc
push ebp
push ebp
call sub.USER32.DLL_CharToOemA
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
push 7
call sub.USER32.DLL_SetClipboardData
call fcn.0041043c
test eax, eax
je 0x47ce01
mov ecx, edi
add ecx, ecx
push ecx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test eax, eax
je 0x47ce01
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov ebp, eax
test eax, eax
je 0x47ce01
push edi
push ebp
push 0xffffffffffffffff
push esi
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
push 0xd
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
mov eax, 1
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4827d4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffff79c
mov ebx, eax
lea esi, [esp + 0x464]
push ebx
mov eax, 0x6c
call fcn.004125d0
push eax
lea edx, [esp + 8]
push edx
call fcn.0049abd0
add esp, 0xc
jmp 0x48284d
push 0x400
push esi
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x48282b
push esi
push ebx
call fcn.00497c34
add esp, 8
test eax, eax
je 0x48282b
mov eax, esi
xor edx, edx
call fcn.00463e6c
test al, al
jne 0x48285a
push 0x15
mov eax, 0x66
call fcn.004125d0
push eax
lea edx, [esp + 8]
push edx
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
cmp eax, 2
je 0x482874
xor edx, edx
mov eax, ebx
call fcn.00463e6c
test al, al
je 0x482800
mov eax, 0x4c4e78
call fcn.0045e1b0
test al, al
je 0x482874
mov eax, 0x4c4e78
xor edx, edx
call fcn.00458864
add esp, 0x864
pop esi
pop ebx
ret

Function at 0x482880
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
add esp, 0xfffffe94
mov eax, dword [ebx + 0x2c]
add eax, 0x41
push eax
push 0x4ac719
lea edx, [esp + 8]
push edx
call fcn.0049abd0
add esp, 0xc
push 0x301
push 0x160
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [esp + 0x10]
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test byte [ebx + 0x10], 1
je 0x4828ea
push 0xd
call sub.USER32.DLL_GetSysColor
push eax
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetBkColor
mov edi, eax
push 0xe
call sub.USER32.DLL_GetSysColor
push eax
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetTextColor
mov ebp, eax
push 0
push 0
push 0x4ac718
lea eax, [ebx + 0x1c]
push eax
push 2
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call sub.GDI32.DLL_ExtTextOutA
push 0x31
call sub.USER32.DLL_GetSystemMetrics
mov esi, eax
push 0x32
call sub.USER32.DLL_GetSystemMetrics
push 3
push 0
push 0
push eax
push esi
push dword [esp + 0x20]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call sub.USER32.DLL_DrawIconEx
push dword [esp + 0xc]
call sub.USER32.DLL_DestroyIcon
lea eax, [esp + 0x18]
push eax
call fcn.00497cb0
pop ecx
push eax
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [ebx + 0x20]
add ecx, 2
push ecx
add esi, dword [ebx + 0x1c]
add esi, 7
push esi
push dword [ebx + 0x18]
call sub.GDI32.DLL_TextOutA
test byte [ebx + 0x10], 1
je 0x482979
push edi
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetBkColor
push ebp
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetTextColor
add esp, 0x16c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x483724
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xffffffb0
mov ebp, eax
call fcn.0041043c
test eax, eax
je 0x483749
mov eax, ebp
call fcn.0047daef
jmp 0x483863
xor ebx, ebx
xor esi, esi
mov eax, 0x4c4e78
xor ecx, ecx
xor edx, edx
call fcn.0045dd64
jmp 0x4837aa
lea edx, [esp + 0xc30]
mov eax, esp
call fcn.0040abcc
lea ecx, [esp + 0xc30]
push ecx
call fcn.00497cb0
pop ecx
mov edi, eax
inc edi
lea eax, [edi + esi + 1]
push eax
push ebx
call fcn.00496a64
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x483863
lea edx, [esp + 0xc30]
push edx
lea ecx, [esi + ebx]
push ecx
call fcn.00497c80
add esp, 8
add esi, edi
mov edx, esp
mov eax, 0x4c4e78
xor ecx, ecx
call fcn.0045dd64
test al, al
jne 0x48375d
test esi, esi
jne 0x4837e5
push 0x30
mov eax, 0x65
call fcn.004125d0
push eax
mov eax, 0x14c
call fcn.004125d0
push eax
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
jmp 0x483863
mov byte [ebx + esi], 0
push 0x1e
push 0
lea edx, [esp + 0x1038]
push edx
call fcn.00497b00
add esp, 0xc
mov ecx, dword [0x4c4e64]
mov dword [esp + 0x1030], ecx
mov dword [esp + 0x1034], 3
test ebp, ebp
je 0x483823
mov word [esp + 0x1040], 0x40
mov dword [esp + 0x1038], ebx
lea eax, [esp + 0x1030]
push eax
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete dl
and edx, 1
test ebx, ebx
je 0x48384a
push ebx
call fcn.00496a54
pop ecx
mov eax, 0x4c53a0
call fcn.0045e9a8
mov edx, 0x4ac718
mov eax, 0x4c4e78
call fcn.00458864
add esp, 0x1050
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x487050
Capabilities:
Copy file
Get file attributes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov esi, eax
push eax
add esp, 0xfffff3f8
cmp dword [0x4c780c], 0
jne 0x4872ea
push 0
push 0
push 0xffffffffffffffff
push esi
call sub.SHELL32.DLL_DragQueryFileA
mov edi, eax
cmp edi, 1
jne 0x48724b
mov word [esp + 0x408], 0
push 0x400
lea eax, [esp + 0xc]
push eax
push 0
push esi
call sub.SHELL32.DLL_DragQueryFileA
call fcn.0041043c
test eax, eax
je 0x4870c1
push 0x400
lea edx, [esp + 0x40c]
push edx
push 0
push esi
call sub.SHELL32.DLL_DragQueryFileW
push esp
call sub.USER32.DLL_GetCursorPos
push dword [esp + 4]
push dword [esp + 4]
call sub.USER32.DLL_WindowFromPoint
cmp dword [0x4c7804], 0
je 0x4870ed
cmp eax, dword [0x4c4e78]
je 0x487119
cmp eax, dword [0x4c53a4]
je 0x487119
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
test al, 0x10
jne 0x487119
push 1
lea ecx, [esp + 0x40c]
lea edx, [esp + 0xc]
mov eax, 0x4c4e78
call fcn.0045ba2c
dec eax
je 0x4872ea
push 7
push 0x4ad165
lea eax, [esp + 0x10]
call fcn.0040bd28
push eax
call fcn.00497eb0
add esp, 0xc
test eax, eax
jne 0x48724b
push 0x400
lea edx, [esp + 0xc0c]
push edx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x4ad16d
lea eax, [esp + 0xc0c]
call fcn.0040bd28
push eax
call fcn.00497c80
add esp, 8
push 0
lea edx, [esp + 0xc0c]
push edx
lea ecx, [esp + 0x10]
push ecx
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x4871c1
lea eax, [esp + 0xc08]
call fcn.0046445c
lea eax, [esp + 0xc08]
call fcn.0040c22c
push 0x4ad16d
lea edx, [esp + 0xc0c]
push edx
call fcn.00497ba4
add esp, 8
push 0
lea ecx, [esp + 0xc0c]
push ecx
lea eax, [esp + 0x10]
push eax
call sub.KERNEL32.DLL_CopyFileA
push dword [0x4c4e64]
call sub.USER32.DLL_SetForegroundWindow
push 1
push dword [0x4c4e64]
call sub.USER32.DLL_FlashWindow
mov al, 1
call fcn.0040e988
mov byte [0x4b2124], al
push 0
push dword [0x4c4e64]
call sub.USER32.DLL_FlashWindow
cmp dword [0x4c7804], 0
je 0x487207
mov eax, 0x4c4e78
call fcn.0045a154
jmp 0x487216
mov edx, 0x4ac718
mov eax, 0x4c4e78
call fcn.00458864
cmp byte [0x4b2124], 0
je 0x4872ea
push 0x30
mov eax, 0x368
call fcn.004125d0
push eax
mov eax, 0x367
call fcn.004125d0
push eax
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
jmp 0x4872ea
xor eax, eax
call fcn.00449b0c
cmp dword [0x4c7804], 0
je 0x487265
mov dword [0x4bba80], 1
mov eax, dword [0x4be4b8]
call fcn.0040fbc4
xor ebx, ebx
cmp edi, ebx
jle 0x4872cf
mov word [esp + 0x1408], 0
push 0x400
lea eax, [esp + 0x100c]
push eax
mov ebp, ebx
push ebp
push esi
call sub.SHELL32.DLL_DragQueryFileA
call fcn.0041043c
test eax, eax
je 0x4872b2
push 0x400
lea eax, [esp + 0x140c]
push eax
push ebp
push esi
call sub.SHELL32.DLL_DragQueryFileW
lea ecx, [esp + 0x1408]
lea edx, [esp + 0x1008]
mov eax, dword [0x4be4b8]
call fcn.0040fbfc
inc ebx
cmp edi, ebx
jg 0x487275
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
mov cl, 1
mov edx, eax
xor eax, eax
call fcn.0044a8c4
add esp, 0x1c08
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x487320
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebx
push esi
add esp, 0xfffff2b0
mov byte [esp], al
mov dword [0x4c781c], 1
test dl, dl
je 0x4874b4
lea eax, [esp + 0x10]
mov edx, 0x400
call fcn.00463dbc
lea eax, [esp + 0x10]
call fcn.0040c22c
lea edx, [esp + 0x10]
push edx
push 0x4ad178
lea ecx, [esp + 0x418]
push ecx
call fcn.0049abd0
add esp, 0xc
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemTimeAsFileTime
lea edx, [esp + 0x810]
push edx
lea ecx, [esp + 0x414]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp eax, 0xffffffff
sete al
and eax, 1
jmp 0x48749d
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
sub edx, dword [esp + 0x818]
push eax
cmp edx, 8
lea edx, [esp + 0x954]
setae bl
and ebx, 1
push edx
call fcn.00497c80
add esp, 8
lea ecx, [esp + 0x83c]
push ecx
lea eax, [esp + 0x954]
push eax
call fcn.00497ba4
add esp, 8
test byte [esp + 0x810], 0x10
je 0x48746c
push 6
push 0x4ad180
lea edx, [esp + 0x844]
push edx
call fcn.00497d0c
add esp, 0xc
test eax, eax
jne 0x487411
call fcn.0041043c
cmp eax, 4
jne 0x487415
xor ecx, ecx
jmp 0x48741a
mov ecx, 1
mov byte [esp + 0xc], cl
lea eax, [esp + 0x950]
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
jne 0x487487
test bl, bl
je 0x487439
cmp byte [esp], 0
je 0x487440
cmp byte [esp + 0xc], 0
je 0x487487
lea eax, [esp + 0x950]
call fcn.00463bb0
test al, al
je 0x487487
lea eax, [esp + 0x950]
xor edx, edx
call fcn.0040ab58
lea eax, [esp + 0x950]
call fcn.004633a0
jmp 0x487487
lea eax, [esp + 0x950]
xor edx, edx
call fcn.0040ab58
lea ecx, [esp + 0x950]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [esp + 0x810]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
sete al
and eax, 1
test eax, eax
jne 0x4874ae
cmp dword [0x4c781c], 1
je 0x48739d
push esi
call sub.KERNEL32.DLL_FindClose
cmp byte [esp], 0
jne 0x4874ef
cmp byte [0x4b2124], 0
je 0x4874ef
push 0
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
mov al, 1
call fcn.00487500
mov ebx, eax
mov byte [0x4b2124], bl
test bl, bl
jne 0x4874ef
mov eax, 0x4ad12c
xor edx, edx
call fcn.004431cc
xor ecx, ecx
mov dword [0x4c781c], ecx
add esp, 0xd50
pop esi
pop ebx
ret
Function at 0x48769c
Capabilities:
Copy file

Disassembly:
push ebx
add esp, 0xfffff004
push eax
add esp, 0xfffff7d0
cmp dword [0x4c7804], 0
je 0x487846
mov edx, esp
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.00457598
mov edx, 0x4ad19e
mov eax, 0x4acca5
mov ecx, 1
call fcn.0046139c
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x487705
push 0x4ac718
push 0x400
lea ecx, [esp + 0x40c]
mov edx, 0x4ad1b5
mov eax, 0x4ad1a6
call fcn.004611c4
cmp byte [esp + 0x404], 0
jne 0x48771b
lea eax, [esp + 0x404]
call fcn.00463330
lea edx, [esp + 0x404]
push edx
lea ecx, [esp + 0x808]
push ecx
call fcn.00497c80
add esp, 8
lea eax, [esp + 0x804]
call fcn.0040c22c
mov eax, esp
call fcn.0040bd28
push eax
lea edx, [esp + 0x808]
push edx
call fcn.00497ba4
add esp, 8
push 0
push 1
mov eax, 0x5af
call fcn.004125d0
mov edx, eax
lea ecx, [esp + 0x80c]
mov eax, dword [0x4c4e64]
call fcn.0044d500
test al, al
je 0x487846
lea edx, [esp + 0x404]
lea eax, [esp + 0x804]
mov ecx, 0x400
call fcn.0040c274
test bl, bl
je 0x4877b2
lea ecx, [esp + 0x404]
mov edx, 0x4ad1b5
mov eax, 0x4ad1a6
call fcn.00460fa8
push esp
call fcn.00497cb0
pop ecx
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x804]
push eax
call fcn.00497cb0
pop ecx
mov byte [esp + eax + 0x805], 0
push 0x1e
push 0
lea edx, [esp + 0x1818]
push edx
call fcn.00497b00
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x1814], 2
mov dword [esp + 0x1818], ecx
lea eax, [esp + 0x804]
mov dword [esp + 0x181c], eax
lea edx, [esp + 0x1810]
push edx
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
je 0x487846
push dword [esp + 0x181c]
push dword [esp + 0x181c]
mov eax, 0x5b0
call fcn.004125d0
push eax
call fcn.00486954
add esp, 0xc
mov eax, 0x4b1b14
call fcn.0042d7a8
add esp, 0x1830
pop ebx
ret
Function at 0x48e7ba
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.0048e910
push 0xc
push ebx
lea edx, [esp + 8]
push edx
call fcn.00497a90
add esp, 0xc
xor ebx, ebx
call fcn.0048e888
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.0048e8ac
inc ebx
cmp ebx, 0xc
jl 0x48e7da
mov edx, dword [0x4d5d90]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x28], 2
je 0x48e813
movzx ecx, word [0x4e5df6]
sar ecx, 8
jmp 0x48e81f
mov ecx, dword [0x4e5dfc]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x48e82b
or eax, 0xffffffff
jmp 0x48e87f
mov eax, dword [0x4e5da4]
cdq
cmp edx, dword [0x4d5268]
jne 0x48e844
cmp eax, dword [0x4d5264]
jbe 0x48e850
jmp 0x48e846
jle 0x48e850
mov eax, dword [0x4d5264]
mov ebx, eax
jmp 0x48e858
mov eax, dword [0x4e5da4]
mov ebx, eax
mov esi, dword [0x4e5da0]
jmp 0x48e874
call fcn.0048e888
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0048e8ac
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x48e860
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x48e8ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4e60bc]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4b3a64]
xor ecx, edx
mov dword [0x4e60bc], ecx
and ecx, 0xff
add dword [0x4e60c0], ecx
imul edx, dword [0x4e60c0], 0x8088405
inc edx
mov dword [0x4e60c0], edx
shr edx, 0x18
mov ecx, dword [0x4e60c4]
xor edx, ecx
and edx, 0xff
shr ecx, 8
mov edx, dword [edx*4 + 0x4b3a64]
xor edx, ecx
mov dword [0x4e60c4], edx
ret

Function at 0x48ec31
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4e6140
push ebx
mov ecx, dword [edx]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr ecx, 8
mov ebx, dword [ebx*4 + 0x4b3a64]
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
mov ebx, dword [edx + 8]
xor ecx, ebx
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4b3a64]
xor ecx, ebx
mov dword [edx + 8], ecx
pop ebx
ret

Function at 0x48ed94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x4bb5d0], 0
je 0x48edd9
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x48edd9
call fcn.0048ec10
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.0048ec31
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x48edbd
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00499fc8
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4