joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f24c
Capabilities:
Check if file exists

Disassembly:
push 0x48
mov eax, 0x4c8e4d
call fcn.0044d75c
mov esi, dword [ebp + 8]
xor edi, edi
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call fcn.00410878
push ecx
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x1c], esp
inc ebx
push str.pcmaster.exe
mov dword [ebp - 4], ebx
call fcn.0041217e
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00420283
push esi
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.00418668
push dword [esi]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42f43d
lea ecx, [ebp - 0x3c]
call fcn.00410878
push str.SoftwareRuanMeiPCMaster
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0041217e
mov byte [ebp - 4], 4
call fcn.0040f2b8
test eax, eax
je 0x42f2ef
mov ebx, str.SoftwareWow6432NodeRuanMeiPCMaster
push ebx
call fcn.0044c78e
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.00410ebd
mov eax, dword [ebp - 0x10]
push edi
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esp
mov edi, esp
push eax
call fcn.0040f61d
pop ecx
add eax, 0x10
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x3c]
mov dword [edi], eax
call fcn.004120da
test eax, eax
je 0x42f41f
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov edi, 0x4d02f4
push edi
call fcn.0041217e
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Install_Dir
mov byte [ebp - 4], 5
call fcn.0041217e
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00412518
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.004115eb
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0040f083
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x42f41f
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0041217e
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4d1640
mov byte [ebp - 4], 7
call fcn.0041217e
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00412518
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 8
jne 0x42f3bf
mov ecx, esi
call fcn.0040fc8e
jmp 0x42f414
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x20], esp
mov edi, esp
push eax
call fcn.0040f61d
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esi]
sub eax, 0x10
mov dword [ebp - 0x24], esp
mov edi, esp
push eax
mov byte [ebp - 4], 9
call fcn.0040f61d
add eax, 0x10
mov dword [edi], eax
pop ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 8
call fcn.00418668
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.004115eb
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [ebp - 0x3c]
call fcn.00410276
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [ebp - 0x54]
call fcn.00410276
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, esi
call fcn.0044d834
ret
Function at 0x42fd0c
Capabilities:
Get memory capacity

Disassembly:
push 0x54
mov eax, 0x4c8ff6
call fcn.0044d7c5
xor esi, esi
push 0x502868
mov dword [ebp - 4], esi
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], esi
call fcn.0040fd3c
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x50], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
call fcn.0042fab9
cmp esi, edx
jb 0x42fd61
ja 0x42fd5d
cmp edi, eax
jbe 0x42fd61
mov eax, edi
mov edx, esi
mov ecx, eax
sub ecx, edi
mov ebx, edx
sbb ebx, esi
mov dword [ebp - 0x5c], ebx
jne 0x42fd76
cmp ecx, 0x200
jbe 0x42fd7a
mov eax, edi
mov edx, esi
push edx
push eax
push str._I64d
push dword [ebp - 0x54]
call fcn.0041182d
mov eax, dword [ebp - 0x54]
add esp, 0x10
call fcn.0044d848
ret
Function at 0x430a71
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x4c911d
call fcn.0044d75c
xor ebx, ebx
push ebx
push SysReAllocString
call fcn.00430660
push ebx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov edi, eax
call fcn.00430660
add esp, 0x10
or edi, eax
call fcn.0040f2b8
test eax, eax
je 0x430ab2
push 1
push esi
call fcn.00430660
pop ecx
pop ecx
or edi, eax
lea ecx, [ebp - 0x30]
call fcn.00410878
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Internet_Exploreriexplore.exe
mov dword [ebp - 4], ebx
call fcn.0041217e
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00418346
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.00418668
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
je 0x430b05
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430b05
or edi, 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [ebp - 0x30]
call fcn.00410276
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040f083
mov eax, edi
call fcn.0044d834
ret
Function at 0x436698
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004238e7
push 0
mov ecx, esi
call fcn.0047b727
push dword [esi + 4]
mov ecx, dword [0x504df0]
call fcn.0040f34e
mov ecx, dword [0x50606c]
push dword [esi + 4]
mov eax, dword [ecx]
mov edi, dword [0x504df4]
call dword [eax + 0x10]
push eax
mov ecx, edi
call fcn.0041cd0c
push dword [esi + 4]
mov ecx, dword [0x504dec]
call fcn.004157bf
pop edi
mov ecx, esi
pop esi
jmp fcn.004322ed
Function at 0x43a187
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x64], edi
je 0x43a2a8
push ebx
call fcn.00439e44
push dword [esi + 0x54]
mov dword [esi + 0x64], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x7d0
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 0xc], eax
call ebx
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov dword [ebp - 4], edi
test eax, 0xfffffffc
jle 0x43a228
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x43a218
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0x103
jne 0x43a211
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call fcn.0044b7d8
pop ecx
mov eax, dword [esi + 4]
sub eax, dword [esi]
inc dword [ebp - 4]
sar eax, 2
cmp dword [ebp - 4], eax
jl 0x43a1da
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00439bcc
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call edi
lea eax, [esi + 0x38]
push eax
call ebx
lea ecx, [esi + 0x10]
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push eax
push edx
lea eax, [ebp - 8]
push eax
call fcn.00439c19
lea ebx, [esi + 0x38]
push ebx
call edi
mov eax, dword [esi + 0x50]
xor edi, edi
cmp eax, edi
je 0x43a277
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x50], edi
mov eax, dword [esi + 0x54]
cmp eax, edi
je 0x43a288
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x54], edi
mov eax, dword [esi + 0x58]
cmp eax, edi
je 0x43a299
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x58], edi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call esi
push ebx
call esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x43a3b1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 8], edi
jg 0x43a3c9
xor eax, eax
jmp 0x43a486
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x20]
push eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
call ebx
lea eax, [esi + 0x38]
push eax
call ebx
push edi
push SysReAllocString
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
mov dword [esi + 0x50], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x54], eax
call ebx
mov dword [esi + 0x58], eax
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
cmp eax, edi
jle 0x43a475
mov dword [ebp + 8], eax
push 8
call fcn.0044d250
mov ebx, eax
pop ecx
mov dword [ebp - 4], ebx
cmp ebx, edi
je 0x43a470
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x439eba
push edi
push edi
call fcn.004538c8
add esp, 0x18
mov dword [ebp - 8], eax
cmp eax, edi
je 0x43a469
mov dword [ebx], eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov dword [ebx + 4], esi
call fcn.0043a2ac
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x43a470
push ebx
call fcn.0044b7d8
pop ecx
dec dword [ebp + 8]
jne 0x43a420
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc eax
mov dword [esi + 0x64], eax
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x43a7a8
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 8
lea eax, [esi + 0x10]
push 0
push eax
call fcn.0044d1b0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x43b7a7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], esi
cmp dword [ebp + 8], ebx
jne 0x43b7cb
push ebx
push ebx
push ebx
push 2
call fcn.0043f929
xor al, al
jmp 0x43b95d
push edi
call fcn.0043b669
or dword [esi + 8], 0xffffffff
or dword [esi + 4], 0xffffffff
push 2
push ebx
push dword [ebp + 8]
call fcn.0044e558
push dword [ebp + 8]
call fcn.00453548
push ebx
push ebx
push dword [ebp + 8]
mov edi, eax
call fcn.0044e558
add esp, 0x1c
cmp edi, ebx
jg 0x43b808
push ebx
push ebx
push ebx
push 0xc
mov ecx, esi
jmp 0x43b838
lea eax, [edi + 1]
push eax
call fcn.0044a6f2
push dword [ebp + 8]
mov esi, eax
push 1
push edi
push esi
mov byte [esi], bl
call fcn.0044e83b
add esp, 0x14
cmp eax, 1
je 0x43b844
push esi
call fcn.0044d8a0
pop ecx
mov ecx, dword [ebp - 4]
push ebx
push ebx
push ebx
push 2
call fcn.0043f929
xor al, al
jmp 0x43b95c
cmp dword [ebp + 0xc], 3
je 0x43b860
cmp byte [esi], 0xff
jne 0x43b855
cmp byte [esi + 1], 0xfe
je 0x43b860
mov eax, dword [ebp - 4]
mov byte [eax + 0x75], bl
jmp 0x43b915
mov eax, dword [ebp - 4]
mov byte [eax + 0x75], 1
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
mov dword [ebp + 0xc], ebx
neg ecx
or ecx, eax
push ecx
call fcn.0044a6f2
mov ecx, dword [ebp - 8]
lea ecx, [ecx + ecx + 2]
push ecx
push ebx
push eax
mov dword [ebp + 8], eax
call fcn.0044d1b0
add esp, 0x10
cmp byte [esi], 0xff
jne 0x43b8b3
cmp byte [esi + 1], 0xfe
jne 0x43b8b3
add edi, 0xfffffffe
push edi
lea eax, [esi + 2]
push eax
jmp 0x43b8b5
push edi
push esi
push dword [ebp + 8]
call fcn.0044cad0
add esp, 0xc
push esi
call fcn.0044d8a0
pop ecx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.0044a6f2
mov esi, eax
lea eax, [edi + 1]
push eax
push ebx
push esi
call fcn.0044d1b0
add esp, 0x10
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 8]
call fcn.0044d8a0
pop ecx
mov byte [esi + edi], bl
mov edx, esi
mov eax, esi
cmp byte [esi], bl
je 0x43b93b
mov cl, byte [edx]
cmp cl, 0xd
jne 0x43b933
mov byte [eax], 0xa
inc eax
inc edx
cmp byte [edx], 0xa
jne 0x43b937
jmp 0x43b936
mov byte [eax], cl
inc eax
inc edx
cmp byte [edx], bl
jne 0x43b920
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push ebx
mov byte [eax], bl
mov eax, dword [ecx]
push esi
call dword [eax + 8]
push esi
call fcn.0044d8a0
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp byte [ecx + 0x44], bl
sete al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43b963
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x74], bl
je 0x43b9a4
cmp byte [esi + 0x75], bl
jne 0x43b9a4
push dword [ebp + 8]
push 0xef
call fcn.00453d5d
push dword [ebp + 8]
push 0xbb
call fcn.00453d5d
push dword [ebp + 8]
push 0xbf
call fcn.00453d5d
add esp, 0x18
mov eax, dword [esi]
push ebx
push dword [ebp + 8]
mov ecx, esi
call dword [eax + 4]
cmp byte [esi + 0x75], bl
je 0x43baae
push 2
push ebx
push dword [ebp + 8]
call fcn.0044e558
push dword [ebp + 8]
call fcn.00453548
push ebx
push ebx
push dword [ebp + 8]
mov edi, eax
call fcn.0044e558
add esp, 0x1c
cmp edi, ebx
jg 0x43b9e5
xor al, al
jmp 0x43babc
lea eax, [edi + 1]
push eax
call fcn.0044a6f2
push dword [ebp + 8]
mov esi, eax
push 1
push edi
push esi
mov dword [ebp - 0xc], esi
mov byte [esi], bl
call fcn.0044e83b
add esp, 0x14
mov byte [esi + edi], bl
cmp eax, 1
je 0x43ba19
push esi
call fcn.0044d8a0
xor al, al
jmp 0x43babb
push ebx
push ebx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
mov edi, 0xfde9
push edi
call esi
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044a6f2
mov ecx, dword [ebp - 8]
add ecx, ecx
push ecx
push ebx
push eax
mov dword [ebp - 4], eax
call fcn.0044d1b0
add esp, 0x10
push dword [ebp - 8]
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp - 0xc]
push ebx
push edi
call esi
push dword [ebp - 0xc]
call fcn.0044d8a0
mov esi, dword [ebp + 8]
push ebx
push ebx
push esi
call fcn.0044e558
push esi
push 0xff
call fcn.00453d5d
push esi
push 0xfe
call fcn.00453d5d
push dword [ebp - 4]
call fcn.0044c78e
push esi
push eax
push 2
push dword [ebp - 4]
call fcn.0044e454
push dword [ebp - 4]
call fcn.0044d8a0
add esp, 0x38
push dword [ebp + 8]
call fcn.00453d35
neg eax
sbb eax, eax
inc eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4418df
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4418ed
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x4419a8
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d9400]
add edx, 8
sub edi, 8
dec esi
jne 0x44190b
pop ebx
test edi, edi
je 0x4419c1
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4d9400]
inc edx
dec edi
jne 0x4419ac
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x4419c7
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x4d9400]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4d9400]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x441ea8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x441edc
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441ed7
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x441f04
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x441eed
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0044cad0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret
Function at 0x4430a9
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x502ae0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x4430dd
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4430dd
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx ecx, word [esi]
test cx, cx
je 0x443187
mov eax, esi
mov edx, esi
cmp cx, 0x2f
je 0x4430f9
cmp cx, 0x5c
jne 0x4430fb
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x4430ed
cmp eax, esi
je 0x44313b
sub eax, esi
push edi
sar eax, 1
lea edi, [eax + eax]
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0044cad0
xor eax, eax
mov word [ebp + edi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.004430a9
add esp, 0x14
pop edi
xor eax, eax
mov word [ebp - 0x20c], ax
test ebx, ebx
je 0x443157
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0044da5d
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0044da2c
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x443187
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d74d
leave
ret

Function at 0x4449c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x444a6b
cmp dword [esi + 4], 0xffffffff
jne 0x444a6b
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.0044c78e
movzx eax, word [esi + eax*2 + 0x242]
pop ecx
cmp eax, 0x5c
je 0x444a12
cmp eax, 0x2f
je 0x444a12
push 0x4d159c
push edi
call fcn.0044da2c
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x444a34
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x444a34
mov eax, 0x2000000
jmp 0x444a70
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00441ccd
add esp, 0x10
test eax, eax
jne 0x444a52
mov eax, dword [ebp + 0x10]
jmp 0x444a70
push eax
call fcn.00444495
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x444a70
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x446439
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x446447
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x446502
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4da158]
add edx, 8
sub edi, 8
dec esi
jne 0x446465
pop ebx
test edi, edi
je 0x44651b
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4da158]
inc edx
dec edi
jne 0x446506
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x446521
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x4da158]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4da158]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x446ab4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x446b29
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x446ae0
cmp dword [esi + 0x40], edi
jae 0x446ae0
push eax
call fcn.0044b7d8
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x446af5
lea eax, [edi + edi]
push eax
call fcn.0044d250
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.0044cad0
add esp, 0xc
test edi, edi
je 0x446b26
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.0044658e
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x446b08
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x446b58
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x446b44
mov dword [esi + 0x14], 0x30000
jmp 0x446b7a
push edi
push edx
add eax, ecx
push eax
call fcn.0044cad0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x446b7c
mov eax, dword [esi + 4]
test eax, eax
je 0x446b73
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x446b7c
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x446e6d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x446ec3
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x446eff
sub edi, eax
cmp edi, dword [ebp + 0xc]
jbe 0x446e98
mov edi, dword [ebp + 0xc]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0044cad0
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x78]
call fcn.00446439
add esp, 0x18
mov dword [esi + 0x78], eax
mov eax, edi
jmp 0x446f01
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x446ef8
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x446eff
mov edi, dword [ebp + 0xc]
add dword [esi + 0x74], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x78]
call fcn.00446439
add esp, 0xc
jmp 0x446ebc
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebp
ret 8