joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445a80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x445a8b
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
not eax
cmp esi, 8
jb 0x445b4c
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
sub edi, 1
jne 0x445aa5
pop edi
test esi, esi
je 0x445b6a
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
sub esi, 1
jne 0x445b50
not eax
pop esi
ret

Function at 0x445b70
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], 0xc
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov cl, byte [eax]
mov dword [esp + 0x10], eax
test cl, cl
je 0x445ba4
cmp byte [eax + 1], 0x3a
jne 0x445ba4
mov cl, byte [eax + 2]
add eax, 2
mov dl, cl
cmp cl, 0x5c
jne 0x445bae
mov dl, byte [eax + 1]
push ebx
push ebp
push esi
lea esi, [eax + 1]
cmovne esi, eax
push edi
test dl, dl
je 0x445c0a
mov al, byte [esi]
mov edi, dword [esp + 0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, al
je 0x445bde
cmp al, 0x5c
je 0x445c17
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x445bd2
xor esi, esi
test edi, edi
je 0x445c0a
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
call ebp
test eax, eax
jne 0x445bfc
call ebx
cmp eax, 0xb7
jne 0x445c1c
test esi, esi
je 0x445c0a
mov byte [esi], 0x5c
inc esi
mov al, byte [esi]
test al, al
jne 0x445bd2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov byte [esi], 0
jmp 0x445be4
test esi, esi
je 0x445c23
mov byte [esi], 0x5c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x445c30
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
movzx edx, word [eax]
mov ebp, eax
mov dword [esp + 0xc], 0xc
mov ecx, edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 1
push edi
test dx, dx
je 0x445c6d
cmp word [eax + 2], 0x3a
jne 0x445c6d
movzx ecx, word [eax + 4]
add eax, 4
movzx edi, cx
movzx edx, cx
cmp cx, 0x5c
jne 0x445c7d
movzx edx, word [eax + 2]
cmp edi, 0x5c
lea esi, [eax + 2]
cmovne esi, eax
test dx, dx
je 0x445cea
movzx ecx, word [esi]
mov edi, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, cx
test ax, ax
je 0x445cb2
cmp ax, 0x5c
je 0x445cf7
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x445ca0
xor esi, esi
test edi, edi
je 0x445cea
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x445cd1
call ebx
cmp eax, 0xb7
jne 0x445cfe
test esi, esi
je 0x445cea
mov eax, 0x5c
mov word [esi], ax
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x445c98
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
xor eax, eax
mov word [esi], ax
jmp 0x445cb8
test esi, esi
je 0x445d0a
mov eax, 0x5c
mov word [esi], ax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x44a840
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp dword [esi], 0
lea ebx, [edi + 0x48]
jge 0x44a89b
push 0x8b1f
push esi
call fcn.0044bd30
push 0x808
push esi
call fcn.0044bd30
push dword [edi + 4]
push esi
call fcn.0044bd30
movzx eax, word [edi + 6]
push eax
push esi
call fcn.0044bd30
push 0xb02
push esi
call fcn.0044bd30
mov eax, dword [edi + 0x20]
inc eax
push eax
push ebx
push esi
call fcn.0044be00
add esp, 0x34
pop edi
pop esi
pop ebx
ret
push 0x4034b50
push esi
call fcn.0044bd30
push 0x403
push esi
call fcn.0044bd30
push 0x2d
push esi
call fcn.0044bd30
movzx eax, word [edi + 0x30]
push eax
push esi
call fcn.0044bd30
movzx eax, word [edi + 2]
push eax
push esi
call fcn.0044bd30
push dword [edi + 4]
push esi
call fcn.0044bd30
movzx eax, word [edi + 6]
push eax
push esi
call fcn.0044bd30
push dword [edi + 8]
push esi
call fcn.0044bd30
movzx eax, word [edi + 0xa]
add esp, 0x40
push eax
push esi
call fcn.0044bd30
push 0xffffffffffffffff
push esi
call fcn.0044bd30
push 0xffffffffffffffff
push esi
call fcn.0044bd30
push 0xffffffffffffffff
push esi
call fcn.0044bd30
push 0xffffffffffffffff
push esi
call fcn.0044bd30
push dword [edi + 0x20]
push esi
call fcn.0044bd30
mov eax, dword [edi + 0x24]
add eax, 0x14
push eax
push esi
call fcn.0044bd30
push dword [edi + 0x20]
push ebx
push esi
call fcn.0044be00
add esp, 0x44
push 1
push esi
call fcn.0044bd30
push 0x10
push esi
call fcn.0044bd30
push dword [edi + 0x18]
push esi
call fcn.0044bd30
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
shrd ecx, eax, 0x10
push ecx
push esi
call fcn.0044bd30
mov eax, dword [edi + 0x18]
add esp, 0x20
mov edx, dword [edi + 0x1c]
mov cl, 0x20
call fcn.004ec600
push eax
push esi
call fcn.0044bd30
movzx eax, word [edi + 0x1e]
push eax
push esi
call fcn.0044bd30
push dword [edi + 0x10]
push esi
call fcn.0044bd30
mov ecx, dword [edi + 0x10]
mov eax, dword [edi + 0x14]
shrd ecx, eax, 0x10
push ecx
push esi
call fcn.0044bd30
mov eax, dword [edi + 0x10]
add esp, 0x20
mov edx, dword [edi + 0x14]
mov cl, 0x20
call fcn.004ec600
push eax
push esi
call fcn.0044bd30
movzx eax, word [edi + 0x16]
push eax
push esi
call fcn.0044bd30
mov eax, dword [edi + 0x24]
add esp, 0x10
test eax, eax
je 0x44a9dc
push eax
push dword [edi + 0x40]
push esi
call fcn.0044be00
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x44ade0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi]
test eax, 0x40000000
je 0x44adfd
pop edi
mov dword [esi + 0x20], 0x14
xor eax, eax
pop esi
pop ebx
ret
test al, al
jns 0x44ae4c
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x70]
mov edi, dword [esi + 0x68]
cmp eax, dword [esi + 0x6c]
ja 0x44ae70
jb 0x44ae15
cmp ecx, edi
jae 0x44ae70
mov eax, dword [esp + 0x18]
sub edi, ecx
mov dword [esp + 0x10], edi
push ebp
mov ebp, edi
cmp edi, eax
jbe 0x44ae2e
mov edi, eax
mov ebp, eax
mov dword [esp + 0x14], edi
mov eax, dword [esi + 0x64]
mov ebx, dword [esp + 0x18]
add eax, ecx
push ebp
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0x70], ebp
adc dword [esi + 0x74], 0
pop ebp
jmp 0x44ae7a
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
push dword [esp + 0x20]
push ebx
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44ae76
mov dword [esi + 0x20], 7
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edi, dword [esp + 0x10]
add dword [esi + 0x58], edi
push edi
adc dword [esi + 0x5c], 0
push ebx
push dword [esi + 0x60]
call fcn.00445a80
add esp, 0xc
mov dword [esi + 0x60], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x44aea0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test byte [esi], 1
jne 0x44aed5
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44aecf
mov dword [esi + 8], 7
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret
mov edx, dword [esi + 0x18]
xor eax, eax
mov ecx, dword [esi + 0x10]
push ebx
push edi
mov edi, dword [esp + 0x18]
mov ebx, edi
add ebx, edx
adc eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x14]
jb 0x44aef9
ja 0x44aef5
cmp ebx, ecx
jbe 0x44aef9
mov edi, ecx
sub edi, edx
mov ecx, dword [esi + 4]
push edi
add ecx, edx
push ecx
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, edi
add dword [esi + 0x18], edi
adc dword [esi + 0x1c], 0
pop edi
pop ebx
pop esi
ret
Function at 0x44b990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
not eax
push esi
mov esi, dword [esp + 0x10]
cmp esi, 8
jb 0x44ba57
push edi
mov edi, esi
shr edi, 3
nop
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
sub edi, 1
jne 0x44b9b0
pop edi
test esi, esi
je 0x44ba7a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4fb5b8]
sub esi, 1
jne 0x44ba60
not eax
pop esi
ret
Function at 0x44ba80
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x44bc9c
mov eax, dword [esi + 0x30]
and eax, dword [esi + 0x34]
cmp eax, 0xffffffff
je 0x44bc9c
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [esi + 8], 0
push ebp
push edi
mov edi, dword [esp + 0x20]
test bl, 1
je 0x44bb31
cmp word [esi + 0x70], 0
jne 0x44bae1
push edi
push esi
call fcn.00449ba0
add esp, 8
cmp dword [esi + 8], 0
jne 0x44bc8a
mov eax, 1
mov word [esi + 0x70], ax
push dword [edi + 0x2c]
push dword [edi + 0x28]
push dword [esp + 0x24]
push esi
call fcn.0044a9e0
add esp, 0x10
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], edx
cmp dword [esi + 8], 0
jne 0x44bb19
mov eax, dword [esi + 0xe8]
or eax, dword [esi + 0xec]
je 0x44bb19
pop edi
pop ebp
pop ebx
mov eax, 5
pop esi
pop ecx
ret
xor eax, eax
push esi
mov word [esi + 0x70], ax
call fcn.00445750
mov eax, dword [esi + 8]
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
test byte [edi + 8], 0x10
je 0x44bb65
test bl, 2
je 0x44bb5d
push 1
push dword [esp + 0x20]
test ebx, ebx
jns 0x44bb4d
call fcn.00445c30
jmp 0x44bb52
call fcn.00445b70
add esp, 8
test eax, eax
je 0x44bc83
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
cmp ebx, 4
jne 0x44bb70
mov ebp, dword [esp + 0x1c]
jmp 0x44bbc0
mov edi, dword [esp + 0x1c]
push 0
push edi
test ebx, ebx
jns 0x44bb82
call fcn.00445c30
jmp 0x44bb87
call fcn.00445b70
add esp, 8
test eax, eax
je 0x44bc83
mov eax, dword [esp + 0x20]
push 0
mov eax, dword [eax + 8]
push eax
push 2
push 0
push 0
push 0x40000000
push edi
test ebx, ebx
jns 0x44bbb4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x44bbba
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [esp + 0x20]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44bc83
push edi
push esi
call fcn.00449ba0
add esp, 8
cmp dword [esi + 8], 0
jne 0x44bc65
cmp dword [esi + 0x4c], 0
jne 0x44bbfe
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 0x4c], eax
test eax, eax
jne 0x44bbfe
mov dword [esi + 8], 2
cmp dword [esi + 8], 0
jne 0x44bc65
push 0
push 0x4000
push dword [esi + 0x4c]
push esi
call fcn.0044a9e0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x44bc48
push 0
lea eax, [esp + 0x14]
push eax
push edi
push dword [esi + 0x4c]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44bc41
cmp dword [esp + 0x10], edi
jne 0x44bc41
cmp dword [esi + 8], 0
je 0x44bc04
jmp 0x44bc48
mov dword [esi + 8], 3
cmp dword [esi + 8], 0
mov edi, dword [esp + 0x20]
jne 0x44bc65
lea eax, [edi + 0x1c]
push eax
lea eax, [edi + 0xc]
push eax
lea eax, [edi + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp ebx, 4
je 0x44bc8a
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00445750
mov eax, dword [esi + 8]
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
mov dword [esi + 8], 1
push esi
call fcn.00445750
mov eax, dword [esi + 8]
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
mov eax, 9
pop esi
pop ecx
ret
Function at 0x44bd30
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x20], 0
jne 0x44bdf5
mov eax, dword [esp + 0x14]
mov byte [esp + 4], al
shr eax, 8
mov byte [esp + 5], al
mov eax, dword [edi]
test al, 0x10
je 0x44bd7d
push esi
push dword [esp + 8]
lea esi, [edi + 0x38]
push esi
call fcn.0044bf80
push dword [esp + 0x11]
mov byte [esp + 0x14], al
push esi
call fcn.0044bf80
add esp, 0x10
mov byte [esp + 9], al
mov eax, dword [edi]
pop esi
test al, 1
je 0x44bdbd
mov edx, dword [edi + 0x28]
mov ecx, edx
mov eax, dword [edi + 0x2c]
add ecx, 2
adc eax, 0
cmp eax, dword [edi + 0x34]
jb 0x44bda7
ja 0x44bd9b
cmp ecx, dword [edi + 0x30]
jb 0x44bda7
mov dword [edi + 0x20], 0xb
pop edi
add esp, 8
ret
mov ecx, dword [edi + 4]
mov ax, word [esp + 4]
mov word [edx + ecx], ax
add dword [edi + 0x28], 2
adc dword [edi + 0x2c], 0
jmp 0x44bde6
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44bddf
cmp dword [esp + 0x10], 2
je 0x44bde6
mov dword [edi + 0x20], 3
test dword [edi], 0x40000000
je 0x44bdf5
mov dword [edi + 0x20], 0x14
pop edi
add esp, 8
ret
Function at 0x44be00
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x44bf76
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x20], 0
jne 0x44bf75
test byte [esi], 0x10
push edi
je 0x44befe
mov ecx, dword [esi + 0x44]
mov eax, ecx
test ecx, ecx
je 0x44be44
cmp dword [esi + 0x48], ebp
jae 0x44be44
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0x44], 0
jmp 0x44be48
test eax, eax
jne 0x44be6e
lea eax, [ebp*2]
push eax
push 0
mov dword [esi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 0x44], eax
test eax, eax
jne 0x44be6e
mov dword [esi + 0x20], 2
jmp 0x44bf65
push ebp
push dword [esp + 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
add esp, 0xc
mov dword [esp + 0x18], edx
test ebp, ebp
je 0x44bef9
push ebx
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x38]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x40]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4fb5b8]
movzx eax, cl
add eax, dword [esi + 0x3c]
imul eax, eax, 0x8088405
mov dword [esi + 0x38], ecx
mov ecx, edi
xor ecx, 1
imul ecx, edi
inc eax
mov dword [esi + 0x3c], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x4fb5b8]
mov dword [esi + 0x40], edx
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x44]
mov byte [edx + eax], cl
inc edx
mov dword [esp + 0x1c], edx
cmp edx, ebp
jb 0x44be87
pop ebx
mov ecx, dword [esi + 0x44]
jmp 0x44bf02
mov ecx, dword [esp + 0x14]
test byte [esi], 1
je 0x44bf42
mov edi, dword [esi + 0x28]
mov edx, edi
mov eax, dword [esi + 0x2c]
add edx, ebp
adc eax, 0
cmp eax, dword [esi + 0x34]
jb 0x44bf29
ja 0x44bf20
cmp edx, dword [esi + 0x30]
jb 0x44bf29
mov dword [esi + 0x20], 0xb
jmp 0x44bf65
mov eax, dword [esi + 4]
push ebp
push ecx
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0x28], ebp
adc dword [esi + 0x2c], 0
jmp 0x44bf65
push 0
lea eax, [esp + 0x1c]
push eax
push ebp
push ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44bf5e
cmp dword [esp + 0x18], ebp
je 0x44bf65
mov dword [esi + 0x20], 3
test dword [esi], 0x40000000
pop edi
je 0x44bf75
mov dword [esi + 0x20], 0x14
pop esi
pop ebp
ret

Function at 0x44bf80
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
movsx edx, byte [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edi]
mov eax, ecx
mov esi, dword [edi + 8]
xor eax, edx
movzx eax, al
mov ebx, esi
shr ecx, 8
and ebx, 0xfffd
or ebx, 2
xor ecx, dword [eax*4 + 0x4fb5b8]
movzx eax, cl
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
mov dword [edi], ecx
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x4fb5b8]
mov eax, ebx
xor eax, 1
mov dword [edi + 8], esi
imul eax, ebx
pop edi
pop esi
pop ebx
shr eax, 8
xor al, dl
ret
Function at 0x44ce10
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x526b24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x44cfa4
cmp dword [ebx + 0x18], 0
jne 0x44cfa4
cmp dword [ebx + 0x3c], 0
je 0x44cfa4
cmp dword [ebx + 0x1c], 0
je 0x44cfa4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ce55
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
lea ecx, [eax + 8]
cmp eax, ecx
sbb eax, eax
test ecx, eax
je 0x44cf02
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ce80
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
lea ecx, [eax + 8]
cmp eax, ecx
sbb edx, edx
and edx, ecx
mov ecx, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44cea4
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
lea ecx, [eax + 8]
cmp edx, 0x400
ja 0x44cee1
cmp eax, ecx
sbb eax, eax
and eax, ecx
call fcn.004ec520
mov esi, esp
test esi, esi
je 0x44cf04
mov dword [esi], 0xcccc
add esi, 8
jmp 0x44cf04
cmp eax, ecx
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x44cf04
mov dword [esi], 0xdddd
add esi, 8
jmp 0x44cf04
xor esi, esi
mov edx, esi
mov ecx, edi
sub edx, edi
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x44cf10
mov ecx, dword [ebp + 0xc]
mov edx, edi
sub edx, ecx
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x44cf30
push 0
push 0
push 0
push dword [ebx + 0x3c]
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ebx, eax
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
sub edi, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x44cf65
test esi, esi
je 0x44cf8e
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x44cf8e
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, ebx
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ebadf
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ebadf
mov esp, ebp
pop ebp
ret
Function at 0x44d9b0
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push esi
mov cl, byte [edx]
test cl, cl
je 0x44d9c5
cmp cl, 0x90
je 0x44d9c5
cmp cl, 0xcc
jne 0x44d9e3
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x44d9dc
cmp byte [eax + edx], cl
jne 0x44d9e3
inc eax
cmp eax, esi
jb 0x44d9d2
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x44dd90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
shl ecx, 0x1f
sar ecx, 0x1f
test ecx, ecx
lea edi, [eax - 5]
cmove edi, eax
xor ebx, ebx
test ecx, ecx
lea eax, [esp + 0x10]
push eax
setne bl
push 0x40
lea ebx, [ebx*2 + 5]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x44dddb
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x44ddf6
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x44ddfc
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x460030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x10008
call fcn.004ebaf0
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x10004], eax
mov eax, dword [esp + 0x10014]
mov ecx, dword [esp + 0x10010]
push ebx
push esi
mov esi, dword [esp + 0x10014]
push eax
push ecx
push 0x500b9c
lea eax, [esp + 0x14]
push 0x8001
push eax
call fcn.004e6440
add esp, 0x14
mov ebx, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4600ee
test al, 0x10
je 0x4600ee
mov eax, dword [0x62271c]
mov ecx, dword fs:[0x2c]
push edi
lea edi, [eax*4]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4600ba
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
mov ecx, dword [eax + 0x260]
lea eax, [ebx*2 + 0x204]
push eax
call fcn.004df760
lea ecx, [ebx*2 + 2]
mov dword [esi], eax
push ecx
lea ecx, [esp + 0x10]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 4], ebx
pop edi
jmp 0x4600f4
mov dword [esi], 0x4f5b70
mov ecx, dword [esp + 0x1000c]
pop esi
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x10008
ret 0xc