joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a3d0
Capabilities:
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, str.:2_
mov edi, 0x528279
mov ebp, 0x52827a
mov edx, 0x52827b
sub esi, eax
sub edi, eax
sub ebp, eax
sub edx, eax
mov dword [esp + 0x10], 0x10
lea esp, [esp]
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [eax + ebp]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
sub dword [esp + 0x10], 1
jne 0x49a400
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x49a440
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, 0x5282bc
sub ebx, eax
push edi
mov dword [esp + 0x14], ebx
mov esi, 0x5282b8
mov edi, 0x5282b9
mov ebp, 0x5282ba
mov edx, 0x5282bb
mov ebx, 0x5282bd
sub esi, eax
sub edi, eax
sub ebp, eax
sub edx, eax
sub ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 8
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [eax + ebp]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
mov ebx, dword [esp + 0x14]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 4], bl
mov ebx, dword [esp + 0x18]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 5], bl
add eax, 6
sub dword [esp + 0x10], 1
jne 0x49a481
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x49a5d0
Capabilities:
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x5284e8
mov edi, 0x5284e9
mov ebp, 0x5284ea
mov edx, 0x5284eb
sub esi, eax
sub edi, eax
sub ebp, eax
sub edx, eax
mov dword [esp + 0x10], 8
lea esp, [esp]
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [eax + ebp]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
sub dword [esp + 0x10], 1
jne 0x49a600
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x49ede9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x549950]
xor eax, ebp
mov dword [ebp + 0x94], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49ee2a
cmp dword [ebp - 0x7c], 5
jbe 0x49ee2a
cmp dword [ebp - 0x78], 4
jae 0x49ee2a
xor eax, eax
inc eax
jmp 0x49ee2c
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.004df2ac
add ebp, 0x98
leave
ret
Function at 0x49ef4e
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x549950]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x30
mov eax, 0x514247
call fcn.004e56df
xor esi, esi
inc esi
xor edi, edi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x814], edi
je 0x49efdb
push ecx
lea eax, [ebp + 0x810]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00403020
call fcn.004a1391
pop ecx
cmp eax, edi
je 0x49efdb
mov edi, esi
lea ecx, [ebp + 0x80c]
call fcn.00403040
lea ecx, [ebp + 0x810]
call fcn.00403040
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.004df2ac
add ebp, 0x804
leave
ret
push edi
push edi
push edi
push edi
push esi
push edi
lea ecx, [ebp - 0x38]
call fcn.004c1d4a
mov ecx, 0x522878
lea esi, [ebp + 0x80c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
call fcn.00402690
test eax, eax
jge 0x49f011
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004c253e
jmp 0x49efa0
lea ecx, [ebp - 0x18]
call fcn.00402450
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp + 0x80c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00403020
lea eax, [ebp - 0x1c]
push eax
call fcn.0049eece
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00403060
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00403040
mov esi, dword [ebp - 0x18]
cmp dword [esi - 0xc], edi
je 0x49f06e
push dword [ebp + 0x80c]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 4
lea eax, [ebp - 0x1c]
push eax
push 2
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c], 0x7d0
call fcn.004c14d7
push edi
push edi
push 0x80400002
push edi
push dword [ebp + 0x80c]
lea ecx, [ebp - 0x38]
call fcn.004c29db
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x20], esi
call fcn.0049ee88
cmp eax, edi
je 0x49f0b9
lea ecx, [ebp - 0x18]
call fcn.00403040
jmp 0x49f003
push edi
push 0x80
push 2
push edi
push 2
push 0xc0000000
push dword [ebp + 0x810]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x49f0ac
mov dword [ebp - 0x24], edi
mov eax, dword [esi]
push 0x400
lea ecx, [ebp]
push ecx
mov ecx, esi
call dword [eax + 0x34]
mov ebx, eax
push edi
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebx, edi
jg 0x49f0e0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x20], edi
call fcn.004c23c8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.00403040
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004c253e
lea ecx, [ebp + 0x80c]
call fcn.00403040
xor edi, edi
inc edi
jmp 0x49efab
Function at 0x49f1cd
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x5136ee
call fcn.004e56ac
push 1
xor esi, esi
push esi
push esi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [eax - 0x1c]
cmp ecx, 2
jbe 0x49f291
cmp eax, 0x20
ja 0x49f291
lea eax, [ebp - 0x14]
push 0x26
push eax
call fcn.0049ed16
push str.Internet_Exploreriexplore.exe
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00402970
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00403040
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.00403020
call fcn.004a1391
pop ecx
cmp eax, esi
je 0x49f289
push 0x3c
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004e57c0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x48], 0x522a50
mov dword [ebp - 0x38], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 0x10]
call fcn.00403040
lea ecx, [ebp + 8]
call fcn.00403040
call fcn.004e5784
ret
Function at 0x4a1062
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x4a114c
test edi, edi
jle 0x4a114c
cmp edi, 3
jl 0x4a10f4
mov eax, edi
push 3
xor edx, edx
pop edi
div edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
imul eax, eax, 0xfffffffd
add edi, eax
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x528198]
mov byte [ecx], al
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
and eax, 3
shl eax, 4
shr edx, 4
or eax, edx
mov al, byte [eax + 0x528198]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx edx, byte [esi + 2]
and eax, 0xf
shl eax, 2
shr edx, 6
or eax, edx
mov al, byte [eax + 0x528198]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + 0x528198]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec dword [ebp - 4]
jne 0x4a1096
test edi, edi
jle 0x4a1145
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x528198]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x4a111b
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov al, byte [eax + 0x528198]
mov byte [ecx], al
inc ecx
cmp edi, 2
jge 0x4a1130
mov al, 0x3d
jmp 0x4a113e
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + 0x528198]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0
mov al, 1
jmp 0x4a114e
xor al, al
pop edi
pop esi
leave
ret 4
Function at 0x4a11ef
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xc
mov eax, 0x5141fe
call fcn.004e56ac
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 8], ebx
je 0x4a1370
cmp dword [ebp + 0xc], ebx
je 0x4a1370
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x14]
push eax
push 0x521658
push 1
push ebx
push 0x521858
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4a134c
mov eax, dword [ebp - 0x14]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp eax, ebx
jl 0x4a134c
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00402480
push 0x5c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004026c0
push eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402800
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00403060
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.00403040
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jge 0x4a12a7
or dword [ebp - 4], 0xffffffff
jmp 0x4a1344
or esi, 0xffffffff
cmp dword [ebp + 0x10], ebx
je 0x4a1302
lea ecx, [ebp + 8]
call fcn.00402450
mov eax, 0x104
push eax
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004032f0
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push esi
lea ecx, [ebp + 8]
call fcn.00402d10
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x14]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
cmp eax, ebx
lea ecx, [ebp + 8]
jge 0x4a12fa
call fcn.00403040
jmp 0x4a1341
mov byte [ebp - 4], bl
call fcn.00403040
cmp dword [ebp + 0x18], ebx
je 0x4a1317
mov eax, dword [ebp - 0x14]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp eax, ebx
jl 0x4a1341
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 0x5217e8
push eax
call dword [ecx]
cmp eax, ebx
jl 0x4a1341
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push 1
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x18]
cmp eax, ebx
jl 0x4a1341
xor edi, edi
inc edi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x10]
call fcn.00403040
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x4a1359
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4a1366
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
jmp 0x4a1372
xor eax, eax
call fcn.004e5784
ret

Function at 0x4a1391
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0
mov eax, 0x512d75
call fcn.004e56ac
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00407120
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push 0xffffffffffffffff
mov esi, ecx
lea ecx, [ebp + 8]
call fcn.00402d10
lea ecx, [ebp + 8]
call fcn.00403040
mov eax, esi
call fcn.004e5784
ret
Function at 0x4a18e1
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x2ea8]
mov eax, 0x2f28
call fcn.004e5f20
mov eax, dword [0x549950]
xor eax, ebp
mov dword [ebp + 0x2ea4], eax
cmp dword [ecx + 0x18], 8
mov eax, dword [ebp + 0x2eb0]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2eb4]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x794]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x26d4]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x1f04]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0xf64]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x1734]
mov dword [ebp - 0x4c], eax
mov eax, 0x3e8
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], eax
jb 0x4a196e
mov ecx, dword [ecx + 4]
jmp 0x4a1971
add ecx, 4
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov edx, dword [ebp - 0x70]
push ebx
call fcn.00404a30
mov ax, word [ebp - 0x68]
push dword [ebp - 0x40]
mov edx, dword [ebp - 0x54]
mov word [esi], ax
call fcn.00404a30
push dword [ebp - 0x44]
mov edx, dword [ebp - 0x4c]
call fcn.00404a30
mov ecx, dword [ebp + 0x2ea4]
mov eax, dword [ebp - 0x74]
xor ecx, ebp
mov dword [edi], eax
call fcn.004df2ac
add ebp, 0x2ea8
leave
ret 8
Function at 0x4a33d7
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [edi]
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x4a33e4
xor al, al
pop ebx
ret
cmp dword [eax + 4], ebx
je 0x4a33e0
push esi
lea ecx, [eax + 0xc]
push ecx
push 4
push eax
push 0x4a333a
push ebx
push ebx
call fcn.004e1bd9
mov ecx, dword [edi]
mov dword [ecx + 0x10], eax
mov eax, dword [edi]
add esp, 0x18
cmp dword [eax + 0x10], ebx
jne 0x4a341b
or dword [eax + 0x10], 0xffffffff
mov esi, dword [edi]
call fcn.004a337d
xor al, al
jmp 0x4a343d
mov byte [eax + 8], 1
mov eax, dword [edi]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4a343b
mov esi, dword [edi]
call fcn.004a337d
mov eax, dword [edi]
mov byte [eax + 8], bl
mov al, 1
pop esi
pop ebx
ret

Function at 0x4a4bf7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x4a4c02
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x4a4cb4
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x527d98]
inc ecx
sub edi, 8
dec esi
jne 0x4a4c19
pop ebx
test edi, edi
je 0x4a4ccd
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x527d98]
inc ecx
dec edi
jne 0x4a4cb8
pop esi
not eax
pop edi
ret

Function at 0x4a4cd2
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x527d98]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x527d98]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x4a53d1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4a5401
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a53fc
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4a5429
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4a5412
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.004e9720
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x4a608d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x4a6120
cmp dword [ebx + 4], 0xffffffff
jne 0x4a6120
lea esi, [ebx + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a60b9
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp ax, 0x5c
je 0x4a60f0
cmp ax, 0x2f
je 0x4a60f0
dec esi
dec esi
mov ax, word [esi + 2]
inc esi
inc esi
test ax, ax
jne 0x4a60dd
mov edi, esi
mov esi, 0x5227e0
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.004a52c7
pop ecx
pop ecx
test eax, eax
jne 0x4a6107
mov eax, dword [ebp + 8]
jmp 0x4a6125
push eax
call fcn.004a564a
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x4a6125
mov eax, 0x1000000
pop edi
pop esi
pop ecx
pop ebp
ret 4

Function at 0x4a66ce
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x549950]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a6702
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a6702
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx ecx, word [esi]
test cx, cx
je 0x4a67da
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x4a6721
cmp cx, 0x5c
jne 0x4a6723
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4a6715
cmp eax, esi
je 0x4a6763
sub eax, esi
sar eax, 1
push ebx
add eax, eax
mov ebx, eax
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004e9720
xor eax, eax
mov word [ebp + ebx - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.004a66ce
add esp, 0x14
pop ebx
xor eax, eax
mov word [ebp - 0x20c], ax
test edi, edi
je 0x4a6788
lea edx, [ebp - 0x20c]
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4a677a
mov eax, esi
mov edx, esi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a678c
sub eax, edx
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4a67a0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x20c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a67da
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004df2ac
leave
ret
Function at 0x4a7179
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x5265a8]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x5265a8]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x4a71e9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x4a725c
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x4a7215
cmp dword [esi + 0x40], edi
jae 0x4a7215
push eax
call fcn.004c0153
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x4a722a
lea eax, [edi + edi]
push eax
call fcn.004c0124
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.004e9720
add esp, 0xc
test edi, edi
jbe 0x4a7259
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
lea ecx, [esi + 0x30]
call fcn.004a71bf
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x4a723d
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4a728b
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4a7277
mov dword [esi + 0x14], 0x30000
jmp 0x4a72ad
push edi
push edx
add eax, ecx
push eax
call fcn.004e9720
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x4a72af
mov eax, dword [esi + 4]
test eax, eax
je 0x4a72a6
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x4a72af
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4aae1f
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x4aae2d
xor eax, eax
jmp 0x4aae65
push edi
call fcn.004e272e
push dword [esp + 0x10]
and dword [eax], 0
push dword [esp + 0x10]
push dword [esi + 4]
call fcn.004e2ff0
mov edi, eax
add esp, 0xc
cmp edi, dword [esp + 0x10]
jge 0x4aae62
call fcn.004e272e
cmp dword [eax], 0
je 0x4aae62
mov eax, esi
call fcn.004aaba9
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4af8dc
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push edi
mov edi, ecx
cmp dword [esp + 0x10], esi
jbe 0x4af917
mov eax, dword [edi + 0xc]
mov ecx, dword [esp + 0xc]
lea edx, [esi + ecx]
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
sar ecx, 8
xor byte [edx], cl
mov dl, byte [edx]
mov ecx, edi
call fcn.004b229f
inc esi
cmp esi, dword [esp + 0x10]
jb 0x4af8e8
pop edi
pop esi
ret 8