joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ffe3
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0
mov dword [ebp - 8], ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
lea eax, [ebp - 4]
pop ecx
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x44001a
or eax, 0xffffffff
jmp 0x44008b
push ebx
push edi
xor edi, edi
test esi, esi
je 0x440086
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp dword [esi + 0x190], ecx
jle 0x440072
lea eax, [edi + ebx]
push eax
movzx eax, byte [esi + ecx + 0x194]
mov ecx, dword [ebp - 8]
push eax
call fcn.0043fd7e
mov eax, dword [esi + 0x190]
lea edx, [edi + 2]
push 0x23
pop ecx
dec eax
cmp dword [ebp + 8], eax
push 0x3a
pop edi
cmovl ecx, edi
lea edi, [edx + 1]
mov byte [edx + ebx], cl
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, dword [esi + 0x190]
jl 0x440032
mov esi, dword [esi]
test esi, esi
jne 0x440025
test edi, edi
jle 0x440086
mov byte [edi + ebx - 1], 0
lea eax, [edi - 1]
jmp 0x440089
or eax, 0xffffffff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x441458
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
mov edi, ecx
call fcn.004ff0c5
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x441480
call fcn.0043ef48
push eax
mov ecx, esi
call fcn.0043dad9
jmp 0x441482
mov esi, ebx
push str.http:__micro.51.com_s_xml.php
mov ecx, esi
call fcn.0043f9ee
push 8
call fcn.004ff0c5
pop ecx
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push 0x44252c
push ebx
mov dword [eax + 4], edi
mov dword [eax], esi
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4414cf
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x505440
call fcn.004ff86f
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
call fcn.00442583
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 2
jb 0x4414fa
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0043dba7
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.00437091
push 5
push esi
push esi
push dword [ebp - 0x2c]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0043f97e
lea ecx, [ebp + 8]
call fcn.0043630e
lea ecx, [ebp + 0xc]
call fcn.00436355
mov al, 1
call fcn.004ff819
ret 0x2c
Function at 0x44267d
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x1c
mov eax, 0x505793
call fcn.004ff83b
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 8]
xor edx, edx
inc edx
mov dword [ebp - 4], edx
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], ecx
jb 0x4426ab
mov eax, dword [edi]
jmp 0x4426ad
mov eax, edi
mov byte [eax], cl
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0x1c], edx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
test ebx, ebx
je 0x442784
push 4
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push 2
push ebx
mov dword [ebp - 0x20], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push esi
push 0x4001000
push esi
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x44277d
mov dword [ebp - 0x14], esi
mov esi, 0x100000
push esi
call fcn.004ffbb1
push esi
push 0
push eax
mov dword [ebp - 0x10], eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44276b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x44276b
lea esi, [eax + 1]
push esi
call fcn.004ffbb1
push esi
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x28]
push dword [ebp - 0x10]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x1c
test esi, esi
je 0x44276b
push esi
call fcn.00437476
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00435bb5
push dword [ebp - 0x10]
call fcn.004ffbba
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0043f97e
mov eax, edi
call fcn.004ff804
ret
Function at 0x442797
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x358]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findfirst64i32]
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x4428df
push 0
call fcn.0044299b
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.00442969
pop ecx
test al, al
jne 0x4428df
push dword [ebp - 0x230]
call fcn.0044294b
add esp, 4
test al, al
lea eax, [ebp - 0x108]
je 0x44287a
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00442909
lea eax, [ebp - 0x108]
push eax
call fcn.00442797
lea eax, [ebp - 0x108]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 0xfffffffe
add esp, 0x14
cmp eax, 0x104
jae 0x442903
cmp dword [ebp - 0x230], 0x14
mov byte [ebp + eax - 0x108], 0
jne 0x442863
push str.This_is_system_file__cant_delete__n
call fcn.0043d606
jmp 0x4428de
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir]
pop ecx
cmp eax, 0xffffffff
jne 0x4428df
push 0
jmp 0x4428d9
push edi
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [ebp - 0x108]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x10
mov ecx, 0x104
dec eax
cmp eax, ecx
jae 0x442903
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x20c]
push eax
push ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4428df
lea eax, [ebp - 0x20c]
push eax
call fcn.0044299b
pop ecx
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findnext64i32]
pop ecx
pop ecx
test eax, eax
je 0x4427e2
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findclose]
jmp 0x4427d1
call fcn.004ff601
int3
Function at 0x444dae
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x1c
mov eax, 0x505f03
call fcn.004ff83b
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 8]
xor edx, edx
inc edx
mov dword [ebp - 4], edx
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], ecx
jb 0x444ddc
mov eax, dword [edi]
jmp 0x444dde
mov eax, edi
mov byte [eax], cl
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0x1c], edx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
test ebx, ebx
je 0x444eb5
push 4
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push 2
push ebx
mov dword [ebp - 0x20], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push esi
push 0x4001000
push esi
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x444eae
mov dword [ebp - 0x14], esi
mov esi, 0x100000
push esi
call fcn.004ffbb1
push esi
push 0
push eax
mov dword [ebp - 0x10], eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x444e9c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x444e9c
lea esi, [eax + 1]
push esi
call fcn.004ffbb1
push esi
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x28]
push dword [ebp - 0x10]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x1c
test esi, esi
je 0x444e9c
push esi
call fcn.00437476
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00435bb5
push dword [ebp - 0x10]
call fcn.004ffbba
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0043f97e
mov eax, edi
call fcn.004ff804
ret
Function at 0x4469b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push edi
mov edi, ecx
jne 0x4469d9
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
call fcn.00448ee6
xor al, al
jmp 0x446a9d
push esi
call fcn.004460a9
or dword [edi + 8], 0xffffffff
xor ebx, ebx
or dword [edi + 4], 0xffffffff
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push ebx
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
add esp, 0x1c
test eax, eax
jg 0x446a1b
push ebx
push ebx
push ebx
push 0xc
jmp 0x446a49
inc eax
push eax
call fcn.004ffbb1
push dword [ebp + 8]
mov esi, eax
push 1
push dword [ebp - 4]
push esi
mov byte [esi], bl
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x446a54
push esi
call fcn.004ffbba
pop ecx
push ebx
push ebx
push ebx
push 2
mov ecx, edi
call fcn.00448ee6
xor al, al
jmp 0x446a9c
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, esi
mov byte [esi + edx], bl
cmp byte [esi], bl
je 0x446a81
mov dl, byte [eax]
mov dword [ebp + 8], eax
cmp dl, 0xd
jne 0x446a79
inc eax
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, dword [ebp + 8]
jmp 0x446a7b
mov byte [ecx], dl
inc eax
inc ecx
cmp byte [eax], bl
jne 0x446a62
push dword [ebp + 0xc]
mov byte [ecx], bl
mov ecx, edi
mov eax, dword [edi]
push ebx
push esi
call dword [eax + 8]
push esi
call fcn.004ffbba
cmp byte [edi + 0x2c], bl
pop ecx
sete al
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44983a
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, 0x104
mov byte [ebp - 0x665], 1
push edi
xor ebx, ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 0x670], xmm0
call sub.VCRUNTIME140.dll_memset
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x250
lea eax, [ebp - 0x664]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
add esp, 0x30
cmp word [ebp + eax*2 - 0x20e], 0x5c
je 0x4498db
lea eax, [ebp - 0x20c]
push 0x51cdac
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x414]
push 0x51cdb4
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44991e
xor eax, eax
jmp 0x4499e4
mov ebx, dword [ebp - 0x66c]
mov esi, dword [ebp - 0x670]
cmp byte [ebp - 0x665], 1
jne 0x4499db
test byte [ebp - 0x664], 0x10
je 0x4499ae
lea eax, [ebp - 0x638]
push 0x51cdb8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
je 0x4499ae
lea eax, [ebp - 0x638]
push 0x51cdbc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
je 0x4499ae
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea eax, [ebp - 0x414]
push eax
call fcn.0044983a
cdq
add esp, 0x14
add esi, eax
adc ebx, edx
jmp 0x4499b7
add esi, dword [ebp - 0x644]
adc ebx, 0
lea eax, [ebp - 0x664]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
push 0
setne byte [ebp - 0x665]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44992a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
Function at 0x450340
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x450365
or esi, 1
push 2
call edi
test ax, ax
jns 0x450371
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x45037d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x450389
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x455fb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x455fdc
cmp esi, dword [edi + 0x108]
je 0x455fdc
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x4560d1
test eax, eax
je 0x456048
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x20], 0x17
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0x108]
mov ecx, edi
call fcn.004556e0
mov dword [edi + 0x108], 0
test esi, esi
je 0x4560d1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x4560d1
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xf4]
call eax
test al, al
je 0x4560d1
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x4560d1
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 4], 0
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0x108]
mov ecx, edi
call fcn.004556e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4584c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x458505
cmp byte [ebp + 8], 0
je 0x4584f9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x4590f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5075c2
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xfffffffffffffff0
call fcn.004575c0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, edi
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.004575c0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [edi]
lea ebx, [edi + 0x30]
mov ecx, edi
call dword [eax + 0x30]
push eax
push dword [edi + 4]
mov ecx, ebx
call fcn.0044fe30
mov ecx, edi
lea eax, [edi + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, ebx
call fcn.0044e3d0
lea ecx, [ebp - 0x2e8]
call fcn.00489410
mov eax, dword [edi]
lea ecx, [ebp - 0x118]
push ecx
mov ecx, edi
mov dword [ebp - 4], 0
call dword [eax + 0x28]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.0044bf60
lea ecx, [ebp - 0x94]
test al, al
mov eax, dword [edi]
push ecx
mov ecx, edi
jne 0x459204
call dword [eax + 0x2c]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0044bc50
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
add esp, 4
movzx esi, ax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0044af90
mov ecx, edi
lea eax, [edi + 0x28]
neg ecx
push 0
sbb ecx, ecx
and ecx, eax
push ebx
push ecx
lea ecx, [ebp - 0x118]
call fcn.0044b260
push eax
push esi
lea ecx, [ebp - 0x2e8]
call fcn.0048a5a0
mov esi, eax
jmp 0x459244
call dword [eax + 0x2c]
mov edx, edi
mov byte [ebp - 4], 3
neg edx
lea ecx, [edi + 0x28]
push 0
sbb edx, edx
push ebx
and edx, ecx
mov ecx, eax
push edx
push 0
call fcn.0044bc50
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x2e8]
call fcn.0048a5a0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
mov esi, eax
call fcn.0044af90
test esi, esi
jne 0x4592ad
push 0xffffffffffffffff
push 0x51f048
lea ecx, [ebp - 0x94]
call fcn.0044ad90
mov eax, dword [edi]
lea ecx, [ebp - 0x19c]
push ecx
mov ecx, edi
mov byte [ebp - 4], 4
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.0044b4c0
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 4
call fcn.0044af90
push 0x10
push str.Duilib
lea ecx, [ebp - 0x94]
call fcn.0044b260
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov ecx, ebx
call fcn.0044e700
mov edx, edi
lea eax, [edi + 0x20]
neg edx
mov ecx, ebx
sbb edx, edx
and edx, eax
push edx
call fcn.0044e2c0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x118]
call fcn.0044af90
lea ecx, [ebp - 0x2e8]
call fcn.00487d40
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x461ca0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x461cd4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x461cd4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x461dbc
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x461cf1
cmp ax, 0x5c
jne 0x461cf3
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x461ce5
cmp edi, ebx
je 0x461d3f
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x208
jae 0x461dcc
xor eax, eax
mov word [ebp + edi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.00461ca0
add esp, 8
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x461d64
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x461d54
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x461d66
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x461d80
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x461dbc
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
call fcn.004ff601
int3

Function at 0x4627e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4628ad
cmp dword [esi + 4], 0xffffffff
jne 0x4628ad
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x462811
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x462848
cmp eax, 0x2f
je 0x462848
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x462835
mov eax, dword [0x51cdac]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x46286e
push edi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46286e
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004659c0
add esp, 0x10
test eax, eax
jne 0x46288e
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.004663d0
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov edx, 0x200
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x4633c0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x51fdc8]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x51fdc8]
mov dword [edx + 8], ecx
pop ebp
ret