joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433720
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x2c]
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0x1ec]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x43373d
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0040f280
push edx
push eax
call fcn.0040f2b0
mov ecx, eax
mov eax, edx
mov dword [esp + 0x24], eax
mov eax, esi
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov ecx, dword [esp + 0x14]
mov esi, edx
sbb esi, ecx
cmp dword [ebx + 0x1e0], 0
je 0x4337aa
mov edx, dword [ebp + 0x184]
mov eax, dword [ebp + 0x180]
push edx
push eax
call fcn.0040f280
push edx
push eax
call fcn.0040f2b0
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov ebp, edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, ebp
cmp esi, edx
jl 0x4337aa
jg 0x4337ae
cmp edi, eax
jae 0x4337ae
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x434a90
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x434ac2
push 0x2e
push esi
call fcn.00531c40
add esp, 8
test eax, eax
je 0x434ac0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x434ba0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x5b6354]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x30]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x434c4a
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea esi, [esp + 0x20]
mov eax, ebp
mov byte [esp + 0x14], 8
mov byte [esp + 0x15], 2
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.00434b10
mov ecx, esi
push 8
push ecx
call fcn.00439bf0
mov ecx, dword [esp + 0x10]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x434c5c
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00530f1f
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00530f1f
add esp, 0x24
ret
Function at 0x434de0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434df0
sub eax, edx
mov esi, eax
lea ebp, [esi + esi]
push ebp
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x434e19
pop edi
pop esi
pop ebp
lea eax, [ebx + 0x1b]
pop ebx
add esp, 0xc
ret
mov ecx, ebx
call fcn.00434db0
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [esp + 0x28]
test eax, eax
je 0x434e9f
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x8002
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x434e92
mov eax, dword [esp + 0x10]
push 0
push ebp
push ebx
push eax
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x1c]
push ecx
push esi
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [esi + 0x10], eax
push ebx
mov byte [esi + 0x14], al
call dword [0x5b2004]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x437600
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x437622
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x437616
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x437652
cmp dword [esi + 8], 0
jne 0x437645
mov ecx, dword [eax + 8]
push 0x5630d0
push ecx
call fcn.0052fcbe
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x437645
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.0053033b
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x437674
mov eax, dword [esi + 8]
test eax, eax
je 0x43766e
push eax
call fcn.0052fd42
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x43a860
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x43a885
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x43a8cc
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x43a8d0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x43a92e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x43a8f3
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x43a971
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x56d695
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x56d696
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x43a940
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x440ed9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x440f20
call fcn.00450a08
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x440f20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x440f3c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004409de
mov esi, eax
test edi, edi
je 0x440f3a
test ebx, ebx
je 0x440f3a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x441371
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x55a473
call fcn.00534aa5
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x441396
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4413e8
call fcn.00442bf7
push eax
lea ecx, [ebp - 0x10]
call fcn.00401086
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00534ec1
push eax
call fcn.00440f43
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010c2
mov eax, esi
call fcn.00534b7d
ret 8

Function at 0x44431f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00450a08
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x444358
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00443f61
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4443b6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4443da
cmp dword [edi + 0x74], 0
jne 0x4443da
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00450a08
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00444377
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x468cba
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0046895d
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x468d04
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0043edbf
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0043d45a
jmp 0x468d0f
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00450a8b
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x468d15
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00441011
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x468d52
call fcn.0046895d
mov dword [esi + 0xc], 1
jmp 0x468d57
call fcn.0046895d
cmp dword [esi], 0
je 0x468da0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x468d78
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0043edbf
jmp 0x468d8a
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004011ca
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0043d45a
jmp 0x468dc4
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x468dc4
push dword [esi]
push dword [ebp + 8]
call fcn.00450a8b
pop esi
pop ebp
ret 0xc

Function at 0x47045f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004d1e8a
call fcn.00450439
cmp dword [eax + 0x14], 0
jne 0x47047c
mov ecx, esi
pop esi
jmp fcn.0046ff46
pop esi
ret

Function at 0x473b82
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004c92aa
call fcn.00450439
cmp dword [eax + 0x14], 0
jne 0x473b9f
mov ecx, esi
pop esi
jmp fcn.00473555
pop esi
ret

Function at 0x49d89d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x49d8b7
call fcn.00450a08
mov esi, dword [eax + 0xc]
push dword [0x5bb97c]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x49d8d5
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x49d8cd
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x49d902
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x49d8cf
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0049d7cb
mov esi, eax
jmp 0x49d8f4
Function at 0x515d9b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x515db3
mov edi, dword [esi + 0xc]
jmp 0x515df3
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x515dcc
call fcn.0044173b
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x515de1
call fcn.0044173b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x515df3
call fcn.0044173b
call fcn.00450a08
cmp dword [eax + 0x3c], 0
je 0x515e08
push edi
mov ecx, ebx
call fcn.00514bd7
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00515cb5
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x515e26
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x515e32
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x530f1f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5b6354]
jne 0x530f29
repz ret
jmp fcn.0053fce6
Function at 0x548424
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b6354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0053c63b
and dword [ebp - 0x14], 0
cmp dword [0x5be2d0], 0
mov dword [ebp - 0x18], eax
jne 0x5484d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x54857f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x54857f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x593dec
push ebx
mov dword [0x5be2d0], eax
call edi
push eax
call esi
push 0x593dd8
push ebx
mov dword [0x5be2d4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5be2d8], eax
call edi
push eax
call esi
mov dword [0x5be2e0], eax
test eax, eax
je 0x5484d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5be2dc], eax
mov eax, dword [0x5be2dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x548530
cmp dword [0x5be2e0], ecx
je 0x548530
push eax
call esi
push dword [0x5be2e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x548530
test ebx, ebx
je 0x548530
call edi
test eax, eax
je 0x548527
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x548527
test byte [ebp - 8], 1
jne 0x548530
or dword [ebp + 0x10], 0x200000
jmp 0x548563
mov eax, dword [0x5be2d4]
cmp eax, dword [ebp - 0x18]
je 0x548563
push eax
call esi
test eax, eax
je 0x548563
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x548563
mov eax, dword [0x5be2d8]
cmp eax, dword [ebp - 0x18]
je 0x548563
push eax
call esi
test eax, eax
je 0x548563
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5be2d0]
call esi
test eax, eax
je 0x54857f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x548581
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00530f1f
leave
ret

Function at 0x54f58c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x54f5b3
call fcn.005310c6
mov dword [eax], esi
call fcn.005310b3
push 0x16
pop esi
mov dword [eax], esi
call fcn.005395ce
mov eax, esi
jmp 0x54f608
test dword [ebp + 0xc], 0xfffffff9
jne 0x54f599
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x54f5e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005310d9
pop ecx
call fcn.005310b3
mov eax, dword [eax]
jmp 0x54f608
test al, 0x10
jne 0x54f606
test al, 1
je 0x54f606
test byte [ebp + 0xc], 2
je 0x54f606
call fcn.005310c6
mov dword [eax], 5
call fcn.005310b3
mov dword [eax], 0xd
jmp 0x54f5d7
xor eax, eax
pop esi
pop ebp
ret
Function at 0x54f9da
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 8]
push edi
test ebx, ebx
je 0x54fa01
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x54fa01
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
test al, al
je 0x54fabd
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x54fa1b
cmp al, 0x5c
jne 0x54fa1d
mov esi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x54fa13
cmp esi, edi
je 0x54fa50
sub esi, edi
push esi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.00531100
lea eax, [ebp - 0x208]
push eax
push ebx
mov byte [ebp + esi - 0x208], 0
call fcn.0054f9da
add esp, 0x14
mov byte [ebp - 0x104], 0
test ebx, ebx
je 0x54fa6f
lea edx, [ebp - 0x104]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x54fa65
mov eax, edi
mov edx, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54fa73
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x54fa83
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
jne 0x54fabd
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebx
leave
ret

Function at 0x54fc29
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x54fc59
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x54fc54
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x54fc81
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x54fc6a
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00531100
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x54ff15
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x596ad8]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x596ad8]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x54ff5b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x54ff66
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x55001a
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x596ad8]
add ecx, 8
sub edi, 8
dec esi
jne 0x54ff7d
pop ebx
test edi, edi
je 0x550033
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x596ad8]
inc ecx
dec edi
jne 0x55001e
pop esi
not eax
pop edi
ret

Function at 0x552c52
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x552cd1
cmp dword [ebx + 4], 0xffffffff
jne 0x552cd1
lea esi, [ebx + 0x140]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x552c7b
sub eax, edi
mov al, byte [eax + ebx + 0x13f]
cmp al, 0x5c
je 0x552ca5
cmp al, 0x2f
je 0x552ca5
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x552c94
mov edi, esi
mov esi, 0x596f70
movsw word es:[edi], word [esi]
lea eax, [ebp - 4]
push eax
call fcn.0054fd3e
pop ecx
test eax, eax
jne 0x552cb8
mov eax, dword [ebp - 4]
jmp 0x552cd6
push eax
call fcn.0055268c
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x552cd6
mov eax, 0x1000000
pop edi
pop esi
leave
ret