joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444a10
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x444aeb
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x444a44
cmp dword [esi + 0x40], edi
jae 0x444a44
push eax
call fcn.0046165a
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x444a5b
lea eax, [edi + edi]
push eax
call fcn.00461620
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0048db60
add esp, 0xc
cmp edi, ebp
jbe 0x444ae7
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c6ea8]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4c6ea8]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x444a70
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x444b24
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x444b0c
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0048db60
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x444b45
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x445270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b4a78
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4e7950]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push edi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov esi, ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0042d2d0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0
call fcn.0042d2d0
lea edi, [esp + 0x28]
call fcn.00444da0
lea edi, [esp + 0xc]
call fcn.00444da0
mov ecx, edi
call fcn.00402750
push eax
mov ecx, edi
call fcn.00404280
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00431f70
mov ecx, edi
mov esi, eax
call fcn.00402710
lea ecx, [esp + 0x28]
call fcn.00402710
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00480723
add esp, 0x48
ret
Function at 0x447670
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x447683
pop esi
xor eax, eax
pop ebx
ret 8
push edi
call fcn.00482eee
mov dword [eax], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
push esi
push eax
push ecx
call fcn.004838d0
mov edi, eax
add esp, 0xc
cmp edi, esi
jge 0x4476b8
call fcn.00482eee
cmp dword [eax], 0
je 0x4476b8
mov ecx, ebx
call fcn.00447360
mov eax, edi
pop edi
pop esi
pop ebx
ret 8

Function at 0x447710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b5a7b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x40]
mov ecx, esi
call fcn.00480828
lea ebx, [esi + 0xc]
mov dword [esp + 0x38], 0
mov ecx, ebx
mov dword [esi], vtable.CZipException.0
call fcn.0042c6f0
mov eax, dword [esp + 0x44]
mov byte [esp + 0x38], 1
mov dword [esi + 0x28], eax
test edi, edi
je 0x44778f
lea ecx, [esp + 0x14]
push ecx
call fcn.0043b450
lea edx, [esp + 0x14]
push edx
mov ecx, ebx
mov byte [esp + 0x3c], 2
call fcn.0042d7a0
lea ecx, [esp + 0x14]
call fcn.0042bdc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 8
Function at 0x44c8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8070
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4e7950]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
push esi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
lea edx, [esp + 0x10]
push edx
call eax
mov dword [esp + 0x38], 0
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
sub esp, 0x1c
mov ebp, esp
mov dword [esp + 0x28], esp
mov ecx, ebp
mov dword [esp + 0x28], ebp
call fcn.0042c6f0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebp
mov byte [esp + 0x58], 1
call fcn.0042d800
push 0
push 0
mov byte [esp + 0x5c], 0
call fcn.0044d230
mov edx, dword [esi + 0x40]
add edx, 4
push edx
push edi
call fcn.0043b3f0
lea ecx, [esp + 0x10]
call fcn.0042bdc0
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00480723
add esp, 0x30
ret

Function at 0x44c9a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4b8e51
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
xor esi, esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x20], esi
movzx eax, word [edi + 0x24]
cmp eax, dword [edi + 8]
mov edx, ebp
sete bl
mov cl, bl
mov eax, edi
mov dword [esp + 0x24], ebp
call fcn.0044bfd0
mov dword [esp + 0x4c], esi
mov dword [esp + 0x20], 1
cmp dword [edi + 0x40], esi
je 0x44cad1
movzx ebx, bl
neg ebx
sbb ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
mov ecx, esi
mov dword [esp + 0x38], esi
call fcn.0042c6f0
push ebp
mov ecx, esi
mov dword [esp + 0x6c], 1
call fcn.0042d800
mov ecx, dword [esp + 0x30]
push ecx
push ebx
mov esi, edi
mov byte [esp + 0x70], 0
call fcn.0044d230
mov ecx, dword [edi + 0x40]
add ecx, 4
call fcn.00402730
push 1
mov ecx, eax
lea esi, [esp + 0x2c]
call fcn.0044b320
add esp, 4
mov ecx, eax
call fcn.00402730
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, esi
mov ebx, eax
call fcn.0042bdc0
cmp ebx, 0xffffffff
je 0x44ca91
test bl, 0x10
mov eax, 0
sete al
lea eax, [eax + eax - 1]
test eax, eax
jne 0x44caa2
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], 5
jmp 0x44ca11
mov eax, dword [edi + 0x40]
add eax, 4
push eax
mov ecx, ebp
call fcn.0042d7a0
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
mov ecx, ebp
call fcn.00402730
mov ecx, eax
call fcn.0044ebb0
test eax, eax
jne 0x44cab0
mov ecx, ebp
call fcn.00402730
push 0xd9
mov ecx, eax
call fcn.0043b9a0
int3
Function at 0x44cb00
Capabilities:
Check if file exists
Get file attributes
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b9358
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4e7950]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
mov esi, edx
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x20], esi
call eax
mov cl, 1
lea edx, [esp + 0x3c]
mov eax, edi
mov dword [esp + 0x80], ebx
call fcn.0044bfd0
mov byte [esp + 0x80], 1
cmp dword [edi + 0x40], ebx
je 0x44cc1c
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, 1
nop
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
mov ecx, esi
mov dword [esp + 0x34], esi
call fcn.0042c6f0
lea ecx, [esp + 0x58]
push ecx
mov ecx, esi
mov byte [esp + 0xa0], 2
call fcn.0042d800
push ebx
push 0xffffffffffffffff
mov esi, edi
mov byte [esp + 0xa4], 1
call fcn.0044d230
mov edx, dword [edi + 0x40]
add edx, 4
push edx
lea ecx, [esp + 0x40]
call fcn.0042d7a0
lea ecx, [esp + 0x3c]
call fcn.00402730
push 1
mov ecx, eax
lea esi, [esp + 0x24]
call fcn.0044b320
add esp, 4
mov ecx, eax
call fcn.00402730
push eax
call ebp
mov ecx, esi
mov ebx, eax
call fcn.0042bdc0
cmp ebx, 0xffffffff
je 0x44cc18
test bl, 0x10
mov eax, 0
sete al
lea eax, [eax + eax - 1]
test eax, eax
je 0x44cc18
mov ebx, 2
jmp 0x44cb80
mov esi, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
lea ecx, [esp + 0x3c]
call fcn.00402730
push eax
lea ecx, [esp + 0x5c]
call fcn.00447820
test eax, eax
jne 0x44cc4e
lea eax, [esp + 0x3c]
push eax
jmp 0x44cca3
cmp dword [edi + 0x40], 0
jne 0x44cc7f
lea ecx, [esp + 0x3c]
call fcn.00402730
mov ecx, eax
call fcn.0044ebb0
test eax, eax
je 0x44cc7f
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.00402730
mov ecx, eax
call fcn.0044ee20
add esp, 8
lea ecx, [esp + 0x3c]
call fcn.00402730
lea ecx, [esp + 0x58]
mov edi, eax
call fcn.00402730
push eax
mov ecx, edi
call fcn.0044f1a0
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
push esi
call fcn.0043b3f0
lea ecx, [esp + 0x3c]
call fcn.0042bdc0
lea ecx, [esp + 0x58]
call fcn.0042bdc0
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00480723
add esp, 0x70
ret
Function at 0x44e500
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
jbe 0x44e57a
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + 0xc]
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
sar edx, 8
xor byte [esi + edi], dl
mov dl, byte [esi + edi]
mov eax, dword [ecx + 4]
movsx edx, dl
xor edx, eax
shr eax, 8
and edx, 0xff
mov edx, dword [edx*4 + 0x4c4d10]
xor edx, eax
movzx eax, dl
add eax, dword [ecx + 8]
mov dword [ecx + 4], edx
mov edx, dword [ecx + 0xc]
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 8], eax
shr eax, 0x18
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x4c4d10]
inc esi
mov dword [ecx + 0xc], edx
cmp esi, ebp
jb 0x44e511
pop edi
pop esi
pop ebp
ret 8

Function at 0x44e580
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 0xc], edi
jbe 0x44e5fc
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
movsx edx, byte [edi + ebx]
mov ebp, dword [ecx + 4]
xor edx, ebp
and edx, 0xff
mov edx, dword [edx*4 + 0x4c4d10]
mov eax, dword [ecx + 0xc]
shr ebp, 8
xor edx, ebp
mov dword [ecx + 4], edx
movzx edx, dl
add edx, dword [ecx + 8]
mov esi, eax
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 8], edx
shr edx, 0x18
xor edx, eax
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x4c4d10]
and esi, 0xfffd
mov dword [ecx + 0xc], eax
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
sar eax, 8
xor byte [edi + ebx], al
inc edi
cmp edi, dword [esp + 0x18]
jb 0x44e590
pop esi
pop ebp
pop ebx
pop edi
ret 8
Function at 0x44e690
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4b8da6
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x4e7950]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0xe4]
mov dword fs:[0], eax
mov eax, dword [esp + 0xf4]
xor ebp, ebp
push eax
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.0043bcd0
lea esi, [esp + 0x30]
lea eax, [esp + 0x4c]
mov dword [esp + 0xec], ebp
call fcn.0044e670
mov ecx, esi
mov byte [esp + 0xec], 1
call fcn.00402730
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x44e7e7
push 0x4d176c
call fcn.00401550
add esp, 4
push 0x4d176c
mov edi, eax
mov ebx, esi
call fcn.0043e880
mov esi, eax
cmp esi, 0xffffffff
jne 0x44e763
push eax
push ebp
mov ecx, ebx
call fcn.00404410
push 0xffffffffffffffff
inc esi
push esi
lea ecx, [esp + 0x38]
call fcn.00404410
push 0x5c
lea esi, [esp + 0x34]
call fcn.0043b560
mov ecx, esi
call fcn.00402730
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x44e7e7
mov ecx, esi
call fcn.0042bdc0
lea ecx, [esp + 0xc0]
mov dword [esp + 0x4c], vtable.CZipPathComponent.0
call fcn.0042bdc0
lea ecx, [esp + 0xa4]
call fcn.0042bdc0
lea ecx, [esp + 0x88]
call fcn.0042bdc0
lea ecx, [esp + 0x6c]
call fcn.0042bdc0
lea ecx, [esp + 0x50]
call fcn.0042bdc0
xor eax, eax
xor edx, edx
jmp 0x44e83a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x30]
call fcn.0042bdc0
lea ecx, [esp + 0xc0]
mov dword [esp + 0x4c], vtable.CZipPathComponent.0
call fcn.0042bdc0
lea ecx, [esp + 0xa4]
call fcn.0042bdc0
lea ecx, [esp + 0x88]
call fcn.0042bdc0
lea ecx, [esp + 0x6c]
call fcn.0042bdc0
lea ecx, [esp + 0x50]
call fcn.0042bdc0
mov eax, esi
mov edx, edi
mov ecx, dword [esp + 0xe4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00480723
add esp, 0xdc
ret

Function at 0x44e870
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x20
push ebx
push esi
push 1
lea esi, [esp + 0x10]
call fcn.0044b320
add esp, 4
mov ecx, eax
call fcn.00402730
mov ecx, dword [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
mov ecx, esi
setne bl
call fcn.0042bdc0
pop esi
mov al, bl
pop ebx
add esp, 0x20
ret
Function at 0x44ebb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
push ebx
push esi
push 1
lea esi, [esp + 0xc]
call fcn.0044b320
add esp, 4
mov ecx, eax
call fcn.00402730
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, esi
mov ebx, eax
call fcn.0042bdc0
cmp ebx, 0xffffffff
jne 0x44ebe7
xor eax, eax
pop esi
pop ebx
add esp, 0x1c
ret
test bl, 0x10
mov eax, 0
sete al
pop esi
pop ebx
lea eax, [eax + eax - 1]
add esp, 0x1c
ret

Function at 0x44ec00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b8d5b
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x4e7950]
xor eax, esp
mov dword [esp + 0xb4], eax
push ebx
push esi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0043bcd0
lea esi, [esp + 0x10]
lea eax, [esp + 0x2c]
mov dword [esp + 0xd0], 0
call fcn.0044e670
mov ecx, eax
call fcn.00402730
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
mov ecx, esi
sete bl
call fcn.0042bdc0
lea ecx, [esp + 0xa0]
mov dword [esp + 0x2c], vtable.CZipPathComponent.0
call fcn.0042bdc0
lea ecx, [esp + 0x84]
call fcn.0042bdc0
lea ecx, [esp + 0x68]
call fcn.0042bdc0
lea ecx, [esp + 0x4c]
call fcn.0042bdc0
lea ecx, [esp + 0x30]
call fcn.0042bdc0
mov al, bl
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00480723
mov esp, ebp
pop ebp
ret
Function at 0x44f1a0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4b8cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5c]
push 0
lea esi, [esp + 0x34]
call fcn.0044b320
add esp, 4
mov edi, eax
push 0
mov ecx, ebp
lea esi, [esp + 0x18]
mov dword [esp + 0x58], 0
call fcn.0044b320
add esp, 4
mov ecx, edi
mov esi, eax
call fcn.00402730
mov ecx, esi
mov edi, eax
call fcn.00402730
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call fcn.0042bdc0
lea ecx, [esp + 0x30]
mov dword [esp + 0x54], 0xffffffff
call fcn.0042bdc0
test bl, bl
je 0x44f23c
push 0xdb
mov ecx, ebp
call fcn.0043b9a0
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x450b60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b9233
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x4e7950]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [esp + 0x30]
xor esi, esi
push eax
mov dword [esp + 0x14], esi
call fcn.0043b450
lea ecx, [esp + 0x10]
mov dword [esp + 0xf0], esi
push ecx
lea edi, [esi + 1]
lea ebx, [esp + 0x34]
mov dword [esp + 0x14], 0x5c
call fcn.0043e880
mov esi, eax
cmp esi, 0xffffffff
jne 0x450be4
push eax
push 0
mov ecx, ebx
call fcn.00404410
push 0xffffffffffffffff
inc esi
push esi
lea ecx, [esp + 0x38]
call fcn.00404410
lea ecx, [esp + 0x30]
call fcn.00402730
push eax
lea edx, [esp + 0x50]
push edx
call fcn.0043bcd0
lea ebx, [esp + 0x14]
lea ecx, [esp + 0x4c]
mov byte [esp + 0xf0], 1
call fcn.0043c000
mov esi, eax
mov byte [esp + 0xf0], 2
lea ecx, [esp + 0x30]
mov dword [esp + 0x10], 1
call fcn.00402730
mov edi, eax
push edi
call fcn.00401550
add esp, 4
push eax
mov eax, dword [esi + 0x14]
mov edx, edi
mov ecx, esi
call fcn.0043a890
test eax, eax
je 0x450c6a
lea ecx, [esp + 0x30]
call fcn.00402730
mov ecx, eax
call fcn.0044ebb0
cmp eax, 0xffffffff
je 0x450c6a
xor bl, bl
jmp 0x450c6c
mov bl, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0xf0], 1
call fcn.0042bdc0
test bl, bl
je 0x450cc7
lea ecx, [esp + 0xc0]
mov dword [esp + 0x4c], vtable.CZipPathComponent.0
call fcn.0042bdc0
lea ecx, [esp + 0xa4]
call fcn.0042bdc0
lea ecx, [esp + 0x88]
call fcn.0042bdc0
lea ecx, [esp + 0x6c]
call fcn.0042bdc0
lea ecx, [esp + 0x50]
call fcn.0042bdc0
jmp 0x450d93
lea ebx, [esp + 0x14]
lea ecx, [esp + 0x4c]
call fcn.0043c000
mov ecx, eax
mov byte [esp + 0xf0], 3
call fcn.00402730
push eax
call fcn.00450b60
add esp, 4
test al, al
lea ecx, [esp + 0x14]
sete bl
mov byte [esp + 0xf0], 1
call fcn.0042bdc0
test bl, bl
je 0x450d51
lea ecx, [esp + 0xc0]
mov dword [esp + 0x4c], vtable.CZipPathComponent.0
call fcn.0042bdc0
lea ecx, [esp + 0xa4]
call fcn.0042bdc0
lea ecx, [esp + 0x88]
call fcn.0042bdc0
lea ecx, [esp + 0x6c]
call fcn.0042bdc0
lea ecx, [esp + 0x50]
call fcn.0042bdc0
lea ecx, [esp + 0x30]
call fcn.0042bdc0
xor al, al
jmp 0x450d9e
lea ecx, [esp + 0x30]
call fcn.00402730
push 1
mov ecx, eax
lea esi, [esp + 0x18]
call fcn.0044b320
add esp, 4
mov ecx, eax
call fcn.00402730
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov ecx, esi
setne bl
call fcn.0042bdc0
lea ecx, [esp + 0x4c]
call fcn.0044b200
test bl, bl
je 0x450d44
lea ecx, [esp + 0x30]
call fcn.0042bdc0
mov al, 1
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd0]
xor ecx, esp
call fcn.00480723
mov esp, ebp
pop ebp
ret
Function at 0x452980
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push 0xffffffffffffffff
push 0x4b93c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e7950]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x30]
mov edx, esi
call fcn.00452cd0
mov ebx, 0xc
push ebx
mov dword [esp + 0x18], vtable.CZipAutoBuffer.0
call fcn.00461620
mov ebp, eax
add esp, 4
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x38]
push 0
push ebp
mov dword [esp + 0x30], 0
call fcn.0044c320
xor ebx, ebx
lea ebx, [ebx]
mov ecx, dword [esi + 0xc]
mov edi, dword [esi + 4]
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
sar eax, 8
xor al, byte [ebx + ebp]
inc ebx
movsx edx, al
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x4c4d10]
shr edi, 8
xor edx, edi
mov dword [esi + 4], edx
movzx edx, dl
add edx, dword [esi + 8]
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 8], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4c4d10]
cmp ebx, 0xc
mov dword [esi + 0xc], ecx
jl 0x4529f0
cmp byte [esp + 0x3c], 0
jne 0x452a86
mov ecx, dword [esp + 0x34]
mov dl, byte [ecx + 0xc]
shr dl, 3
test dl, 1
je 0x452a74
xor edx, edx
cmp byte [ecx + 0x11], al
jmp 0x452a79
xor edx, edx
cmp byte [ecx + 0x17], al
sete dl
mov eax, edx
test eax, eax
jne 0x452a86
xor bl, bl
jmp 0x452a88
mov bl, 1
test ebp, ebp
je 0x452a95
push ebp
call fcn.0046165a
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10