joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4780fd
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4ca394
push ebx
push esi
mov esi, dword [0x515994]
mov ecx, dword [edx]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr ecx, 8
mov ebx, dword [esi + ebx*4]
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
mov ebx, dword [edx + 8]
xor ecx, ebx
mov esi, dword [0x515994]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov dword [edx + 8], ecx
pop esi
pop ebx
ret

Function at 0x47818c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov ebp, ecx
inc dword [0x49a76c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [0x49a76c]
cmp eax, 1
jne 0x4781c4
push 0
call fcn.0048e580
pop ecx
mov ebx, eax
call fcn.0048c76c
xor ebx, eax
push ebx
call fcn.0048a440
pop ecx
mov eax, dword [esp]
call fcn.00478156
xor ebx, ebx
call fcn.0048a46c
mov esi, eax
sar esi, 7
and esi, 0xff
mov ecx, esi
and ecx, 3
mov eax, dword [esi*4 + 0x4a0728]
shr eax, cl
xor eax, esi
and eax, 0xff
mov esi, eax
call fcn.004780dc
mov edi, eax
mov eax, esi
call fcn.004780fd
mov edx, edi
mov ecx, esi
xor dl, cl
mov byte [esp + ebx + 8], dl
inc ebx
cmp ebx, 0xa
jl 0x4781ce
mov eax, dword [esp]
call fcn.00478156
xor ebx, ebx
call fcn.004780dc
mov edi, eax
xor eax, eax
mov al, byte [esp + ebx + 8]
call fcn.004780fd
xor eax, eax
mov al, byte [esp + ebx + 8]
xor eax, edi
inc dword [ebp + 8]
jns 0x478246
mov edx, dword [ebp]
inc dword [ebp]
mov byte [edx], al
jmp 0x478250
push ebp
push eax
call fcn.0048428c
add esp, 8
inc ebx
cmp ebx, 0xa
jl 0x47821d
call fcn.004780dc
mov edi, eax
mov ebx, dword [esp + 4]
shr ebx, 0x10
mov eax, ebx
and eax, 0xff
call fcn.004780fd
mov eax, ebx
and eax, 0xff
xor eax, edi
inc dword [ebp + 8]
jns 0x478288
mov edx, dword [ebp]
inc dword [ebp]
mov byte [edx], al
jmp 0x478292
push ebp
push eax
call fcn.0048428c
add esp, 8
call fcn.004780dc
mov edi, eax
mov ebx, dword [esp + 4]
shr ebx, 0x18
mov eax, ebx
and eax, 0xff
call fcn.004780fd
mov eax, ebx
and eax, 0xff
xor eax, edi
inc dword [ebp + 8]
jns 0x4782c4
mov edx, dword [ebp]
inc dword [ebp]
mov byte [edx], al
jmp 0x4782ce
push ebp
push eax
call fcn.0048428c
add esp, 8
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4782d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [0x49a868], 0
je 0x47831d
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x47831d
call fcn.004780dc
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.004780fd
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x478301
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00484eac
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x478466
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4fa3b4
mov edi, 0x4fa3ac
xor ebx, ebx
mov dword [0x4fa3b0], 2
jmp 0x4785dc
mov eax, dword [esi]
mov edx, dword [edi]
shl edx, 5
xor ecx, ecx
mov cl, byte [eax + 0x4ca3a2]
and eax, 0x7fff
xor edx, ecx
and edx, 0x7fff
mov dword [edi], edx
mov edx, dword [edi]
movzx ebp, word [edx*2 + 0x4ea3a0]
mov word [eax*2 + 0x4da3a0], bp
test ebp, ebp
mov dx, word [esi]
mov eax, dword [edi]
mov word [eax*2 + 0x4ea3a0], dx
je 0x4784e6
mov ecx, dword [esi]
sub ecx, ebp
cmp ecx, 0x7efa
ja 0x4784e6
mov eax, ebp
call fcn.00478754
mov ebx, eax
mov eax, dword [0x4fa3c0]
cmp ebx, eax
jbe 0x4784e6
mov ebx, eax
cmp ebx, 3
jb 0x47857f
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4fa3b8]
call fcn.0047abd0
sub dword [0x4fa3c0], ebx
cmp ebx, dword [0x4fa3c8]
ja 0x478558
dec ebx
inc dword [esi]
mov edx, dword [esi]
mov ecx, dword [edi]
shl ecx, 5
movzx edx, byte [edx + 0x4ca3a2]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [edi]
mov edx, dword [esi]
and edx, 0x7fff
dec ebx
movzx ebp, word [ecx*2 + 0x4ea3a0]
mov word [edx*2 + 0x4da3a0], bp
mov dx, word [esi]
mov ecx, dword [edi]
mov word [ecx*2 + 0x4ea3a0], dx
jne 0x478510
inc dword [esi]
jmp 0x478598
add dword [esi], ebx
xor ebx, ebx
mov edx, dword [esi]
movzx edx, byte [edx + 0x4ca3a0]
mov dword [edi], edx
shl edx, 5
mov ecx, dword [esi]
movzx ecx, byte [ecx + 0x4ca3a1]
xor edx, ecx
and edx, 0x7fff
mov dword [edi], edx
jmp 0x478598
mov eax, dword [esi]
xor edx, edx
mov dl, byte [eax + 0x4ca3a0]
xor eax, eax
call fcn.0047abd0
dec dword [0x4fa3c0]
inc dword [esi]
test eax, eax
je 0x4785cb
mov edx, dword [esi]
sub edx, dword [0x4fa3a4]
cmp dword [0x4fa3a4], 0
jl 0x4785ba
mov eax, 0x4ca3a0
add eax, dword [0x4fa3a4]
jmp 0x4785bc
xor eax, eax
xor ecx, ecx
call fcn.0047a9f4
mov edx, dword [esi]
mov dword [0x4fa3a4], edx
cmp dword [0x4fa3c0], 0x106
jae 0x4785dc
call fcn.0047833c
cmp dword [0x4fa3c0], 0
jne 0x478485
mov edx, dword [esi]
sub edx, dword [0x4fa3a4]
cmp dword [0x4fa3a4], 0
jl 0x478607
mov eax, 0x4ca3a0
add eax, dword [0x4fa3a4]
jmp 0x478609
xor eax, eax
mov ecx, 1
call fcn.0047a9f4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x478618
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov esi, 0x4fa3ac
cmp ebx, 1
jl 0x47862e
cmp ebx, 9
jle 0x478638
mov eax, 0x49a7c0
call fcn.0047da40
xor edx, edx
mov dword [0x4fa3a8], edx
cmp dword [0x4fa3a0], 0
jne 0x47865d
mov dword [0x4fa3a8], 1
mov dword [0x4fa3a0], 0x10000
mov word [0x4fa39e], 0
push 0xfffe
push 0
push 0x4ea3a0
call fcn.00482880
movzx ecx, word [ebx*8 + 0x49a772]
mov dword [0x4fa3c8], ecx
add esp, 0xc
movzx eax, word [ebx*8 + 0x49a770]
mov dword [0x4fa3cc], eax
cmp ebx, 2
movzx edx, word [ebx*8 + 0x49a774]
mov dword [0x4fa3d0], edx
movzx ecx, word [ebx*8 + 0x49a776]
mov dword [0x4fa3c4], ecx
jg 0x4786bc
or word [edi], 4
jmp 0x4786c5
cmp ebx, 8
jl 0x4786c5
or word [edi], 2
xor eax, eax
xor edx, edx
mov dword [0x4fa3b4], eax
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4fa3a4], edx
mov edx, ebx
mov eax, 0x4ca3a0
call dword [0x49abf8]
mov dword [0x4fa3c0], eax
mov eax, dword [0x4fa3c0]
test eax, eax
je 0x4786fb
cmp eax, 0xffffffff
jne 0x47870f
mov dword [0x4fa3bc], 1
xor edx, edx
mov dword [0x4fa3c0], edx
jmp 0x47874a
xor ecx, ecx
mov dword [0x4fa3bc], ecx
cmp dword [0x4fa3c0], 0x106
jae 0x478728
call fcn.0047833c
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov eax, dword [esi]
xor edx, edx
shl eax, 5
mov dl, byte [ebx + 0x4ca3a0]
xor eax, edx
inc ebx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x47872e
pop edi
pop esi
pop ebx
ret
Function at 0x47889c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, 0x4fa3b4
mov ebp, 0x4fa3b0
xor eax, eax
mov dword [esp + 4], eax
mov ebx, 2
cmp dword [0x49a83c], 3
jg 0x478aea
call fcn.00478466
jmp 0x478b39
mov eax, dword [esi]
mov edx, dword [0x4fa3ac]
shl edx, 5
xor ecx, ecx
mov cl, byte [eax + 0x4ca3a2]
and eax, 0x7fff
xor edx, ecx
and edx, 0x7fff
mov dword [0x4fa3ac], edx
mov edx, dword [0x4fa3ac]
movzx edi, word [edx*2 + 0x4ea3a0]
mov word [eax*2 + 0x4da3a0], di
test edi, edi
mov dx, word [esi]
mov eax, dword [0x4fa3ac]
mov word [eax*2 + 0x4ea3a0], dx
mov dword [ebp], ebx
mov ecx, dword [0x4fa3b8]
mov ebx, 2
mov dword [esp], ecx
je 0x478974
mov eax, dword [ebp]
cmp eax, dword [0x4fa3c8]
jae 0x478974
mov edx, dword [esi]
sub edx, edi
cmp edx, 0x7efa
ja 0x478974
mov eax, edi
call fcn.00478754
mov ebx, eax
mov eax, dword [0x4fa3c0]
cmp ebx, eax
jbe 0x47895b
mov ebx, eax
cmp ebx, 3
jne 0x478974
mov eax, dword [esi]
sub eax, dword [0x4fa3b8]
cmp eax, 0x1000
jbe 0x478974
mov ebx, 2
cmp dword [ebp], 3
jb 0x478a74
cmp ebx, dword [ebp]
jbe 0x4789ba
mov eax, ebx
sub eax, dword [ebp]
cmp eax, 1
jne 0x478a74
mov edx, dword [esi]
sub edx, dword [0x4fa3b8]
cmp edx, 0x4000
jbe 0x478a74
mov ecx, dword [0x4fa3b8]
add ecx, 0x5dc
cmp ecx, dword [esp]
jae 0x478a74
mov edx, dword [ebp]
mov eax, dword [esi]
sub edx, 3
dec eax
sub eax, dword [esp]
call fcn.0047abd0
mov ecx, dword [ebp]
dec ecx
sub dword [0x4fa3c0], ecx
sub dword [ebp], 2
inc dword [esi]
xor ebx, ebx
mov edx, dword [esi]
mov ecx, dword [0x4fa3ac]
shl ecx, 5
mov bl, byte [edx + 0x4ca3a2]
xor ecx, ebx
and edx, 0x7fff
and ecx, 0x7fff
mov dword [0x4fa3ac], ecx
mov ecx, dword [0x4fa3ac]
movzx edi, word [ecx*2 + 0x4ea3a0]
mov word [edx*2 + 0x4da3a0], di
mov cx, word [esi]
mov edx, dword [0x4fa3ac]
mov word [edx*2 + 0x4ea3a0], cx
dec dword [ebp]
jne 0x4789d9
xor edx, edx
mov dword [esp + 4], edx
mov ebx, 2
inc dword [esi]
test eax, eax
je 0x478ad9
mov edx, dword [esi]
sub edx, dword [0x4fa3a4]
cmp dword [0x4fa3a4], 0
jl 0x478a61
mov eax, 0x4ca3a0
add eax, dword [0x4fa3a4]
jmp 0x478a63
xor eax, eax
xor ecx, ecx
call fcn.0047a9f4
mov edx, dword [esi]
mov dword [0x4fa3a4], edx
jmp 0x478ad9
cmp dword [esp + 4], 0
je 0x478ac9
mov eax, dword [esi]
xor edx, edx
mov dl, byte [eax + 0x4ca39f]
xor eax, eax
call fcn.0047abd0
test eax, eax
je 0x478abf
mov edx, dword [esi]
sub edx, dword [0x4fa3a4]
cmp dword [0x4fa3a4], 0
jl 0x478aae
mov eax, 0x4ca3a0
add eax, dword [0x4fa3a4]
jmp 0x478ab0
xor eax, eax
xor ecx, ecx
call fcn.0047a9f4
mov edx, dword [esi]
mov dword [0x4fa3a4], edx
inc dword [esi]
dec dword [0x4fa3c0]
jmp 0x478ad9
mov dword [esp + 4], 1
inc dword [esi]
dec dword [0x4fa3c0]
cmp dword [0x4fa3c0], 0x106
jae 0x478aea
call fcn.0047833c
cmp dword [0x4fa3c0], 0
jne 0x4788cf
cmp dword [esp + 4], 0
je 0x478b0f
mov eax, dword [esi]
xor edx, edx
mov dl, byte [eax + 0x4ca39f]
xor eax, eax
call fcn.0047abd0
mov edx, dword [esi]
sub edx, dword [0x4fa3a4]
cmp dword [0x4fa3a4], 0
jl 0x478b2d
mov eax, 0x4ca3a0
add eax, dword [0x4fa3a4]
jmp 0x478b2f
xor eax, eax
mov ecx, 1
call fcn.0047a9f4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x479710
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
cmp dword [0x49a8a8], 0
je 0x479723
mov eax, 1
pop esi
pop ebx
ret
push 0
push 1
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov ebx, eax
test ebx, ebx
jne 0x479739
xor eax, eax
pop esi
pop ebx
ret
push ebx
push 0x49a8ac
call sub.KERNEL32.DLL_InterlockedExchange
mov esi, eax
test esi, esi
je 0x479771
push esi
push 0x49a8ac
call sub.KERNEL32.DLL_InterlockedExchange
push ebx
call sub.KERNEL32.DLL_CloseHandle
push 0xffffffffffffffff
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
push esi
call sub.KERNEL32.DLL_ReleaseMutex
mov eax, dword [0x49a8a8]
pop esi
pop ebx
ret
push 0x4bd854
call sub.KERNEL32.DLL_InitializeCriticalSection
push 0x124
push 0
push 0x4bd730
call fcn.00482880
add esp, 0xc
call fcn.00479865
mov dword [0x49a8a8], 1
push ebx
call sub.KERNEL32.DLL_ReleaseMutex
mov eax, 1
pop esi
pop ebx
ret
Function at 0x479920
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
xor ebx, ebx
mov edi, 1
mov dword [esp + 4], ecx
mov dword [esp], edx
cmp dword [0x49a8a8], 0
mov esi, eax
jne 0x479952
call fcn.00479710
test eax, eax
jne 0x479952
xor eax, eax
jmp 0x479b58
test esi, esi
je 0x479a20
cmp byte [esi], 0
je 0x479a20
push esi
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
cmp ebx, 0x104
jbe 0x47997a
xor eax, eax
jmp 0x479b58
xor eax, eax
cmp ebx, eax
jb 0x47999c
mov dl, byte [esi + eax]
xor ecx, ecx
mov cl, dl
cmp ecx, 0x2f
jne 0x479993
mov byte [esp + eax + 0x10], 0x5c
jmp 0x479997
mov byte [esp + eax + 0x10], dl
inc eax
cmp ebx, eax
jae 0x479980
xor eax, eax
mov al, byte [esp + 0x10]
cmp eax, 0x5c
jne 0x4799fd
xor edx, edx
mov dl, byte [esp + 0x11]
cmp edx, 0x5c
jne 0x4799fd
xor edx, edx
mov eax, 2
cmp ebx, eax
jbe 0x4799dd
xor ecx, ecx
mov cl, byte [esp + eax + 0x10]
cmp ecx, 0x5c
jne 0x4799d8
inc edx
cmp edx, 2
jne 0x4799d8
inc eax
mov byte [esp + eax + 0x10], 0
mov ebx, eax
jmp 0x4799dd
inc eax
cmp ebx, eax
ja 0x4799bd
cmp edx, 1
jne 0x479a20
xor eax, eax
mov al, byte [esp + ebx + 0x10]
cmp eax, 0x5c
je 0x479a20
mov dl, byte [esp + 0x10]
mov byte [esp + ebx + 0x10], dl
mov byte [esp + ebx + 0x11], 0
inc ebx
jmp 0x479a20
xor ecx, ecx
mov cl, byte [esp + 0x11]
cmp ecx, 0x3a
jne 0x479a19
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0
mov ebx, 3
jmp 0x479a20
mov byte [esp + 0x10], 0
xor ebx, ebx
push 0x4bd854
call sub.KERNEL32.DLL_EnterCriticalSection
cmp dword [0x4bd730], 0
je 0x479a4a
lea eax, [esp + 0x10]
push eax
push 0x4bd74c
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x479b0e
xor edx, edx
mov dword [esp + 0xc], edx
xor esi, esi
push 0x4bd854
call sub.KERNEL32.DLL_LeaveCriticalSection
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push 0
cmp byte [esp + 0x2c], 0
jne 0x479a78
xor edx, edx
jmp 0x479a7c
lea edx, [esp + 0x2c]
push edx
call sub.KERNEL32.DLL_GetVolumeInformationA
mov edi, eax
test edi, edi
je 0x479ac4
test byte [esp + 8], 8
je 0x479ac4
mov eax, dword [esp + 4]
cmp dword [eax + 8], 0
je 0x479ac4
cmp byte [esp + 0x10], 0
jne 0x479aa4
xor edx, edx
jmp 0x479aa8
lea edx, [esp + 0x10]
push edx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 4
jne 0x479ac4
mov esi, 1
lea edx, [esp + 0xc]
mov eax, dword [esp]
call fcn.004797ac
push 0x4bd854
call sub.KERNEL32.DLL_EnterCriticalSection
test edi, edi
je 0x479b0e
inc ebx
push ebx
lea eax, [esp + 0x14]
push eax
push 0x4bd74c
call sub.KERNEL32.DLL_lstrcpynA
xor edx, edx
mov ecx, dword [esp + 8]
mov dword [0x4bd734], edx
mov dword [0x4bd73c], ecx
mov dword [0x4bd740], esi
mov eax, dword [esp + 0xc]
mov dword [0x4bd744], eax
mov dword [0x4bd730], 1
test edi, edi
je 0x479b44
mov edx, dword [esp + 4]
mov eax, dword [esp + 4]
mov ecx, dword [edx + 8]
mov dword [0x4bd738], ecx
mov edx, dword [eax + 0x18]
push 0x124
push 0x4bd730
mov dword [0x4bd748], edx
push dword [esp + 0xc]
call fcn.00482810
add esp, 0xc
jmp 0x479b4c
xor ecx, ecx
mov dword [0x4bd730], ecx
push 0x4bd854
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, edi
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x47af54
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef0
mov edi, eax
mov ebx, 0x80
mov esi, 0x80
push 3
push edi
lea eax, [esp + 8]
push eax
call fcn.00482c50
add esp, 0xc
xor edx, edx
mov dl, byte [esp]
push edx
call fcn.004878c4
pop ecx
test eax, eax
je 0x47afb2
xor ecx, ecx
mov cl, byte [esp + 1]
cmp ecx, 0x3a
jne 0x47afb2
xor eax, eax
mov al, byte [edi]
and eax, 0xff
mov dl, byte [eax + 0x515788]
mov byte [esp], dl
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
jmp 0x47afbb
mov byte [esp], 0x5c
mov byte [esp + 1], 0
push esi
lea ecx, [esp + 0x94]
push ecx
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push ecx
push ebx
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x1c]
push edx
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
jne 0x47afeb
xor eax, eax
jmp 0x47aff6
cmp dword [esp + 8], 0xc
setbe al
and eax, 1
add esp, 0x110
pop edi
pop esi
pop ebx
ret

Function at 0x47b000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x47b011
mov eax, 0x20
ret
test al, 1
je 0x47b01c
mov edx, 1
jmp 0x47b01e
xor edx, edx
test al, 2
je 0x47b029
mov ecx, 2
jmp 0x47b02b
xor ecx, ecx
or edx, ecx
test al, 4
je 0x47b038
mov ecx, 4
jmp 0x47b03a
xor ecx, ecx
or edx, ecx
test al, 0x10
je 0x47b047
mov ecx, 0x10
jmp 0x47b049
xor ecx, ecx
or edx, ecx
test al, 0x20
je 0x47b056
mov eax, 0x20
jmp 0x47b058
xor eax, eax
or edx, eax
mov eax, edx
ret
Function at 0x48223c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x483d04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00484ef4
test byte [ebp + 0xd], 0xc0
jne 0x483d28
mov eax, dword [0x49b750]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x483d35
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x483d62
je 0x483d74
sub ecx, 0x100
je 0x483d82
sub ecx, 0x100
je 0x483d89
sub ecx, 0x100
je 0x483d7b
jmp 0x483d90
sub ecx, 0x600
je 0x483d89
sub ecx, 0x100
je 0x483d74
jmp 0x483d90
mov edi, 1
jmp 0x483d95
mov edi, 2
jmp 0x483d95
mov edi, 4
jmp 0x483d95
mov edi, 5
jmp 0x483d95
mov edi, 3
test byte [ebp + 0xd], 1
je 0x483dbc
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x49b1c8]
test al, 0x80
je 0x483db5
mov ebx, 0x80
jmp 0x483dce
mov ebx, 1
jmp 0x483dce
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x483dce
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x483de0
je 0x483de9
dec eax
je 0x483df2
jmp 0x483dfb
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x483e0a
mov dword [ebp - 4], 0x40000000
jmp 0x483e0a
mov dword [ebp - 4], 0xc0000000
jmp 0x483e0a
push 1
call fcn.004852cc
pop ecx
mov ebx, eax
jmp 0x483efa
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x483e26
sub eax, 0x10
je 0x483e2d
sub eax, 0x10
je 0x483e36
sub eax, 0x10
je 0x483e3f
jmp 0x483e3f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x483e46
mov dword [ebp - 8], 1
jmp 0x483e46
mov dword [ebp - 8], 2
jmp 0x483e46
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x483eb3
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x483ea8
test byte [ebp + 0xd], 1
je 0x483ea3
mov ebx, 0x50
jmp 0x483ea8
mov ebx, 2
push ebx
call fcn.004852cc
pop ecx
mov ebx, eax
jmp 0x483efa
mov edi, esi
push edi
call fcn.00483c68
pop ecx
test eax, eax
je 0x483ec7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x483ed3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00484ff4
add esp, 8
mov ebx, eax
inc eax
jne 0x483efa
push 4
call fcn.004852cc
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00484f28
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484424
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x484440
call fcn.00485338
jmp 0x4844af
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x48445c
call fcn.00485338
jmp 0x4844af
cmp dword [0x516508], 1
je 0x4844ad
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0048c0f8
pop ecx
cmp al, 0x41
jl 0x4844ad
cmp al, 0x5a
jg 0x4844ad
cmp byte [ebp - 0x107], 0x3a
jne 0x4844ad
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x4844ad
call fcn.00485338
jmp 0x4844af
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4844b4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4844d0
call fcn.00485338
jmp 0x4844f1
test byte [ebp + 0xc], 0x80
jne 0x4844db
or ebx, 1
jmp 0x4844de
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
dec eax
je 0x4844ef
call fcn.00485338
jmp 0x4844f1
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x484dd8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.00481790
pop ecx
mov ebx, eax
test eax, eax
jne 0x484dfc
xor eax, eax
jmp 0x484ea5
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x484e1d
cmp esi, 0x104
jb 0x484e28
push ebx
call fcn.004817a0
pop ecx
xor eax, eax
jmp 0x484ea5
cmp byte [ebx + 1], 0x3a
jne 0x484e58
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x484e58
push ebx
call fcn.004817a0
pop ecx
xor eax, eax
jmp 0x484ea5
inc esi
test edi, edi
je 0x484e9b
cmp esi, dword [ebp + 0x10]
jbe 0x484e6d
push ebx
call fcn.004817a0
pop ecx
xor eax, eax
jmp 0x484ea5
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.004817a0
pop ecx
mov eax, edi
jmp 0x484ea5
push esi
push ebx
call fcn.004817b0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x488b9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00482924
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00482a30
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.00482a30
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x49c46d
lea ecx, [ebp - 0x200]
push ecx
call fcn.00482924
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.00482a30
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00489d8c
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x488cad
push esi
call fcn.00482a30
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00482a30
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00481790
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x488c84
xor eax, eax
jmp 0x488d34
push esi
call fcn.00482a30
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00482a30
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00482880
add esp, 0xc
jmp 0x488ced
mov edi, dword [ebx + 0x24]
push edi
call fcn.00482a30
pop ecx
push eax
push esi
call fcn.00482a30
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00482a30
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004817b0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x488ced
xor eax, eax
jmp 0x488d34
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00482924
add esp, 8
push 0x49c46f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00482924
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00482924
add esp, 8
push 0x49c471
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00482924
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48c1bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x48c21e
call fcn.0048c16c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00482a30
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00482a30
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret