joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4447e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x444805
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004493d0
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x44482a
test byte [esp + 8], 2
je 0x44482a
mov dword [0x457070], 0xd
mov dword [0x457074], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x444900
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x486900], edx
push ebx
push esi
push edi
push ebp
jbe 0x444b07
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x486800
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x444b07
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x444969
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x44497a
push 2
push 0
push edx
call fcn.00444370
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x444a16
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x444a4f
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x4449dd
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x4449cb
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x4449b2
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x444a45
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x44499d
jmp 0x444a4f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x444a45
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x444a4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x444af6
cmp dword [esp + 0x10], 0
je 0x444aa8
cmp dword [esp + 0x10], 5
jne 0x444a8b
mov dword [0x457070], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x457074], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.004493d0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x444ad2
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x444ad2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x457070], 0x1c
mov dword [0x457074], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x457070], 9
mov dword [0x457074], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x445290
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.00443c90
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0x486900], esi
jbe 0x4453dd
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0x486800]
test byte [edx + ecx*8 + 4], 1
je 0x4453dd
push 1
push ebx
push esi
call fcn.00444370
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x4453cd
push 2
push ebx
push esi
call fcn.00444370
add esp, 0xc
cmp eax, 0xffffffff
je 0x4453cd
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x445373
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.00444db0
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x445336
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00444900
add esp, 0xc
cmp eax, 0xffffffff
je 0x445352
sub ebp, eax
test ebp, ebp
jg 0x44532b
jmp 0x445367
cmp dword [0x457074], 5
jne 0x445365
mov dword [0x457070], 0xd
mov ebx, eax
push edi
push esi
call fcn.00444db0
add esp, 8
jmp 0x4453b0
jge 0x4453b0
push 0
push ecx
push esi
call fcn.00444370
add esp, 0xc
push esi
call fcn.00444790
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x4453b0
mov dword [0x457070], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x457074], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.00444370
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x457070], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x446330
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x4576f0], ebx
jne 0x44637f
call esi
cmp eax, ebx
mov edi, eax
je 0x44635d
mov dword [0x4576f0], 1
jmp 0x44637f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x446375
mov dword [0x4576f0], 2
jmp 0x44637f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4576f0], 1
jne 0x44642e
test edi, edi
jne 0x4463a2
call esi
mov edi, eax
test edi, edi
jne 0x4463a2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x4463bc
add esi, 2
cmp word [esi], 0
jne 0x4463aa
add esi, 2
cmp word [esi], 0
jne 0x4463aa
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x44641d
push ebp
call fcn.00442650
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x44641d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x44640c
push ebx
call fcn.00442600
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4576f0], 2
jne 0x4464b2
test ebx, ebx
jne 0x446451
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x446451
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x446466
inc ebp
cmp byte [ebp], 0
jne 0x446458
inc ebp
cmp byte [ebp], 0
jne 0x446458
sub ebp, ebx
inc ebp
push ebp
call fcn.00442650
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x44648b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x44b7c0
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
cmp dword [esp + 8], 0
push ebx
push esi
push edi
push ebp
je 0x44b9fe
mov edx, dword [esp + 0x18]
push 0x3d
push edx
call fcn.0044cbf0
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x44b9fe
cmp ebp, dword [esp + 0x18]
je 0x44b9fe
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x457098]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x45709c], ecx
jne 0x44b81d
push ecx
call fcn.0044ba70
add esp, 4
mov dword [0x457098], eax
cmp dword [0x457098], 0
jne 0x44b8cd
cmp dword [esp + 0x1c], 0
je 0x44b854
cmp dword [0x4570a0], 0
je 0x44b854
call fcn.004489b0
test eax, eax
je 0x44b8cd
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [esp + 0x10], 0
je 0x44b865
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x457098], 0
jne 0x44b899
push 4
call fcn.00442650
add esp, 4
mov dword [0x457098], eax
test eax, eax
jne 0x44b88e
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x457098]
mov dword [eax], 0
cmp dword [0x4570a0], 0
jne 0x44b8cd
push 4
call fcn.00442650
add esp, 4
mov dword [0x4570a0], eax
test eax, eax
jne 0x44b8c2
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x4570a0]
mov dword [eax], 0
mov esi, dword [0x457098]
sub ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.0044ba10
add esp, 8
mov edi, eax
test edi, edi
jl 0x44b935
cmp dword [esi], 0
je 0x44b935
cmp dword [esp + 0x10], 0
je 0x44b92c
lea ebx, [esi + edi*4]
mov eax, dword [ebx]
push eax
call fcn.00442600
add esp, 4
cmp dword [ebx], 0
je 0x44b919
mov eax, dword [ebx + 4]
add ebx, 4
inc edi
mov dword [ebx - 4], eax
cmp dword [ebx], 0
jne 0x44b90a
shl edi, 2
push edi
push esi
call fcn.00442d80
add esp, 8
test eax, eax
je 0x44b97d
jmp 0x44b978
mov edx, dword [esp + 0x18]
mov dword [esi + edi*4], edx
jmp 0x44b97d
cmp dword [esp + 0x10], 0
jne 0x44b9f4
test edi, edi
jge 0x44b946
neg edi
lea eax, [edi*4 + 8]
push eax
push esi
call fcn.00442d80
add esp, 8
test eax, eax
jne 0x44b968
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
lea ecx, [eax + edi*4]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov dword [0x457098], eax
cmp dword [esp + 0x1c], 0
je 0x44b9ea
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00442650
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x44b9ea
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00442600
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x44e340
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
test ebx, ebx
je 0x44e3b3
push ebx
call fcn.0044e470
add esp, 4
test eax, eax
jne 0x44e381
xor eax, eax
pop edi
mov dword [0x457074], 0xf
mov dword [0x457070], 0xd
pop esi
pop ebx
add esp, 0x10c
ret
add bl, 0x40
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea ecx, [esp + 0x18]
lea ebx, [esp + 0x10]
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x44e3c3
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x44e462
inc eax
cmp eax, 0x104
ja 0x44e462
mov edx, dword [esp + 0x120]
test edx, edx
jne 0x44e414
mov ecx, dword [esp + 0x124]
cmp ecx, eax
jg 0x44e3ef
mov ecx, eax
push ecx
call fcn.00442650
add esp, 4
mov edx, eax
test edx, edx
jne 0x44e433
xor eax, eax
pop edi
mov dword [0x457070], 0xc
pop esi
pop ebx
add esp, 0x10c
ret
cmp dword [esp + 0x124], eax
jge 0x44e433
xor eax, eax
pop edi
mov dword [0x457070], 0x22
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x44e470
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
test eax, eax
jne 0x44e484
mov eax, 1
add esp, 4
ret
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
add al, 0x40
mov byte [esp], al
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x44e4b6
cmp eax, 1
je 0x44e4b6
mov eax, 1
add esp, 4
ret
xor eax, eax
add esp, 4
ret

Function at 0x44e7e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x44e816
cmp byte [esp + 5], 0x3a
jne 0x44e816
xor eax, eax
mov al, byte [esp + 4]
push eax
call fcn.004433a0
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
add esp, 0x104
ret
Function at 0x1800cd8d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jle 0x1800cea9
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edi, 2
jle 0x1800ce0c
sub edx, 4
js 0x1800cea9
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, dword [ebp + 0x10]
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 2]
movzx ecx, byte [ebx + 1]
shr eax, 6
and ecx, 0xf
add eax, dword [ebp + 0x10]
mov al, byte [eax + ecx*4]
mov ecx, dword [ebp + 0x10]
mov byte [esi + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
sub edi, 3
jmp 0x1800cda8
sub edi, 1
je 0x1800ce6c
sub edi, 1
jne 0x1800cea2
sub edx, 3
js 0x1800cea9
movzx eax, byte [ebx]
mov edi, dword [ebp + 0x10]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, edi
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [edi + eax*4]
mov byte [esi + 2], al
add esi, 3
cmp byte [ebp + 0x14], 0
je 0x1800cea2
lea eax, [edx - 1]
test eax, eax
js 0x1800cea9
mov byte [esi], 0x3d
inc esi
jmp 0x1800cea2
sub edx, 2
js 0x1800cea9
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [ebx]
and eax, 3
add eax, eax
mov al, byte [ecx + eax*8]
mov byte [esi + 1], al
add esi, 2
cmp byte [ebp + 0x14], 0
je 0x1800cea2
lea eax, [edx - 2]
test eax, eax
js 0x1800cea9
mov word [esi], 0x3d3d
add esi, 2
sub esi, dword [ebp + 8]
mov eax, esi
jmp 0x1800ceab
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x18010a17
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x18], esi
call dword [0x18175274]
lea ecx, [ebp - 0x18]
push ecx
push 0x28
push eax
call dword [0x18175138]
test eax, eax
je 0x18010a8d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], esi
push eax
push str.SeDebugPrivilege
push esi
mov dword [ebp - 0x1c], esi
call dword [0x181750b8]
test eax, eax
je 0x18010a8d
mov eax, dword [ebp - 0x20]
push esi
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [0x18175034]
test eax, eax
jne 0x18010a94
call fcn.18013e1e
mov esi, eax
cmp dword [ebp - 0x18], 0
je 0x18010aa3
push dword [ebp - 0x18]
call dword [0x1817524c]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.18145fe4
leave
ret
Function at 0x180e78b9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
call fcn.180d7147
dec eax
xor ebx, ebx
push 0xf
pop edi
cmp eax, 9
ja case.default.0x180e78e1
jmp dword [eax*4 + 0x180e7a6d]
push 0xb
push 0x181c0c54
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], 0x181c0038
mov dword [ebp - 0x20], 0x11f
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov byte [ebp - 0x1c], bl
call fcn.1804d05e
lea eax, [ebp - 0x28]
push eax
call fcn.180cb9c3
lea ecx, [ebp - 0x1c]
call fcn.1800e44a
push edi
push 0x181c00f4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], 0x181c0038
mov dword [ebp - 0x20], 0x137
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov byte [ebp - 0x1c], bl
call fcn.1804d05e
lea eax, [ebp - 0x28]
push eax
call fcn.180cb9c3
lea ecx, [ebp - 0x1c]
call fcn.1800e44a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18145fe4
leave
ret 4
mov ecx, esi
call fcn.180d7644
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x180e7988
mov eax, dword [eax]
push ecx
push eax
push 0x811c9dc5
call fcn.18030657
add esp, 0xc
jmp 0x180e7965
mov ecx, esi
call fcn.180d71d1
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov edx, 0x811c9dc5
movzx eax, byte [ebp + ecx - 0x30]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x180e79ad
mov eax, edx
jmp 0x180e7965
mov ecx, esi
call fcn.180d739d
mov ecx, esi
call fcn.180d739d
mov dword [ebp - 0x2c], eax
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x2c]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x180e79dc
jmp 0x180e79c0
mov ecx, esi
call fcn.180d72b7
mov ecx, esi
call fcn.180d72b7
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov edx, 0x811c9dc5
movzx eax, byte [ebp + ecx - 0x30]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x180e7a0c
jmp 0x180e79c0
mov ecx, esi
call fcn.180d7480
mov ecx, esi
call fcn.180d7480
mov dword [ebp - 0x2c], eax
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x2c]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x180e7a39
jmp 0x180e79c0
mov ecx, esi
call fcn.180d7561
movzx eax, al
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
jmp 0x180e7965
Function at 0x18142e95
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov byte [ebp - 4], dl
push 1
lea edx, [ebp - 4]
mov ecx, dword [esi]
not ecx
call fcn.1813d695
mov ecx, dword [esi + 8]
lea edx, [ebp - 4]
not eax
not ecx
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
call fcn.1813d695
pop ecx
not eax
pop ecx
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x18142ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
xor edx, edx
mov dword [ebp - 0xc], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jb 0x18142f74
ja 0x18142f04
cmp dword [ebp + 0xc], edx
jbe 0x18142f74
test eax, eax
je 0x18142f52
mov eax, dword [ebp + 8]
mov bl, byte [edi + eax]
mov ax, word [ecx + 8]
mov dl, bl
or ax, 2
movzx esi, ax
call fcn.18142e95
mov eax, esi
mov ecx, esi
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0xc]
shr ecx, 8
xor cl, bl
mov byte [edi + eax], cl
add edi, 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x18142f08
ja 0x18142f74
cmp edi, dword [ebp + 0xc]
jb 0x18142f08
jmp 0x18142f74
mov ebx, dword [ebp + 8]
mov esi, edx
mov dl, byte [esi + ebx]
call fcn.18142e95
mov ecx, dword [ebp - 4]
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x18142f57
ja 0x18142f74
cmp esi, dword [ebp + 0xc]
jb 0x18142f57
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18172a62
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.181728d3
Function at 0x44201091
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x44201099
mov dword [ecx*4 + 0x442bf600], eax
inc ecx
cmp ecx, 0x100
jb 0x44201094
mov edx, 0x800
jmp 0x442010e6
mov eax, dword [ecx*4 + 0x442bf200]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x442bf600]
inc ecx
mov dword [ecx*4 + 0x442bf5fc], eax
cmp ecx, edx
jb 0x442010c5
mov dword [0x442bd140], 0x44201109
call fcn.442050df
pop esi
test eax, eax
jne 0x44201108
mov dword [0x442bd140], 0x442011a5
ret

Function at 0x442019de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [esi]
test edi, edi
je 0x44201a29
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x442019fa
mov eax, edi
and dword [ebp + 0x10], 0
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x44201a2f
test ecx, ecx
je 0x44201a29
test edi, edi
ja 0x442019ef
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x44201a38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [esi]
test edi, edi
je 0x44201a83
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x44201a54
mov eax, edi
and dword [ebp + 0x10], 0
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x44201a89
test ecx, ecx
je 0x44201a83
test edi, edi
ja 0x44201a49
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]