joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a859
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x4c54e8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov ebx, ecx
mov esi, dword [ebx + 0x1c]
test esi, esi
push edi
mov edi, dword [esp + 0x54]
je 0x44a88e
mov ecx, esi
call fcn.004485e9
push esi
call fcn.00475c61
add esp, 4
mov dword [ebx + 0x1c], 0
push 0x4a063c
push edi
call fcn.00477def
mov edi, eax
add esp, 8
test edi, edi
je 0x44a99e
push edi
push 1
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.00478118
add esp, 0x10
test eax, eax
je 0x44a964
lea ecx, [esp + 0xc]
push edi
push ecx
call fcn.00461139
add esp, 8
mov eax, 0x20
lea ecx, [esp + 0xc]
lea edx, [esp + 0x2c]
push ebp
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x44a8f4
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x44a8dc
test eax, eax
je 0x44a951
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x44a943
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x44a951
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x44a943
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x44a951
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x44a943
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x44a951
movzx esi, byte [edx]
movzx edx, byte [ecx]
sub esi, edx
je 0x44a951
test esi, esi
mov eax, 1
jg 0x44a953
or eax, 0xffffffff
jmp 0x44a953
xor eax, eax
test eax, eax
pop ebp
jne 0x44a995
push eax
push 0x20
push edi
call fcn.004776d4
add esp, 0xc
push edi
mov ecx, ebx
call fcn.00447019
test eax, eax
push edi
je 0x44a996
lea eax, [ebx + 0x1c]
push eax
call fcn.00449d29
add esp, 8
test al, al
jne 0x44a9b4
mov ecx, dword [0x4c7aac]
test ecx, ecx
je 0x44a995
push 0x4a44e8
call fcn.004500d9
push edi
call fcn.004777cb
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004761ea
add esp, 0x44
ret 4
push edi
mov ecx, ebx
call fcn.004496e9
test eax, eax
jne 0x44a9d1
mov ecx, dword [0x4c7aac]
test ecx, ecx
je 0x44a995
push 0x4a44cc
jmp 0x44a990
push edi
call fcn.004777cb
add esp, 4
mov ecx, ebx
call fcn.00448b49
mov ecx, ebx
call fcn.0044a129
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004761ea
add esp, 0x44
ret 4

Function at 0x450219
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
push edi
je 0x450228
push ebx
call dword [fcn.0049f1e8]
mov eax, dword [ebx + 0x824]
test eax, eax
mov edi, dword [esp + 0xc]
je 0x450240
push edi
push 3
push eax
call dword [0x49f048]
cmp byte [ebx + 0x828], 0
je 0x45029d
push esi
push 0x4a4684
push 0x4a4668
call fcn.00477def
mov esi, eax
mov eax, edi
add esp, 8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x450269
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.004775cb
push esi
push 1
push 1
push 0x4a1c5c
call fcn.004775cb
push esi
call fcn.00477410
push esi
call fcn.004777cb
add esp, 0x28
pop esi
push ebx
call dword [fcn.0049f1e4]
pop edi
pop ebx
ret 4
Function at 0x4502a9
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x4502b7
push esi
call dword [fcn.0049f1e8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebp
push edi
push eax
push ecx
lea ebp, [esi + 0x19]
call dword [fcn.0049f254]
push eax
push 0x4a468c
push 0x800
push ebp
call fcn.0047b218
mov edi, eax
add esp, 0x18
test edi, edi
jle 0x45038b
mov eax, dword [esi + 0x820]
test eax, eax
je 0x450310
cmp dword [esp + 0x1c], 0
push ebp
jne 0x450300
push 3
jmp 0x450309
add dword [esi + 0x81c], 1
push 1
push eax
call dword [0x49f048]
cmp byte [esi + 0x828], 0
je 0x45038b
cmp dword [0x4c3b50], 0
je 0x45033f
push 0x4a4688
push 0x4a4668
call fcn.00477def
push eax
mov dword [0x4c3b50], eax
call fcn.004777cb
add esp, 0xc
push 0x4a4684
push 0x4a4668
call fcn.00477def
push eax
push edi
push 1
push ebp
mov dword [0x4c3b50], eax
mov byte [edi + esi + 0x18], 0xa
mov byte [edi + esi + 0x19], 0
call fcn.004775cb
mov edx, dword [0x4c3b50]
push edx
call fcn.00477410
mov eax, dword [0x4c3b50]
push eax
call fcn.004777cb
add esp, 0x20
mov dword [0x4c3b50], 0
test esi, esi
pop edi
pop ebp
je 0x450398
push esi
call dword [fcn.0049f1e4]
pop esi
ret 0x10

Function at 0x450829
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
shr eax, 2
test eax, eax
push esi
jle 0x450868
mov esi, eax
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
add ecx, 4
push eax
mov eax, dword [esp + 0x10]
ror eax, 0x13
xor eax, 0x2a886ae
mov dword [esp + 0x10], eax
pop eax
mov eax, dword [esp + 0xc]
mov dword [edx], eax
add edx, 4
sub esi, 1
jne 0x45083f
pop esi
ret

Function at 0x450879
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
shr eax, 2
test eax, eax
push esi
jle 0x4508b8
mov esi, eax
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
add ecx, 4
push eax
mov eax, dword [esp + 0x10]
xor eax, 0x2a886ae
rol eax, 0x13
mov dword [esp + 0x10], eax
pop eax
mov eax, dword [esp + 0xc]
mov dword [edx], eax
add edx, 4
sub esi, 1
jne 0x45088f
pop esi
ret
Function at 0x4593f9
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x4e0]
push edi
call dword [fcn.0049f1e8]
cmp byte [esi + 0x4f8], 0
jne 0x459480
cmp byte [esi + 0x480], 0
jne 0x459480
cmp dword [esi + 0x47c], 0
jne 0x459480
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x455c70
push 0
push 0
mov byte [esi + 0x480], 1
call fcn.004787a9
add esp, 0x18
test eax, eax
mov dword [esi + 0x47c], eax
jne 0x459480
mov eax, dword [0x4c7aac]
test eax, eax
je 0x45946c
push 0x800
push 0x4a49b4
push eax
call fcn.00450159
add esp, 0xc
push edi
mov byte [esi + 0x480], 0
call dword [fcn.0049f1e4]
pop edi
xor al, al
pop esi
pop ecx
ret
push edi
call dword [fcn.0049f1e4]
pop edi
mov al, 1
pop esi
pop ecx
ret

Function at 0x4597b9
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4597ea
test cl, 3
jne 0x4597ea
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
xor edx, 0xa9f4d3e2
shr ecx, 2
je 0x4597e5
xor dword [eax], edx
sub ecx, 1
add eax, 4
test ecx, ecx
jne 0x4597d9
mov al, 1
ret 0xc
mov ecx, dword [0x4c7aac]
test ecx, ecx
je 0x4597fe
push 0x4a4a24
call fcn.004500d9
xor al, al
ret 0xc
Function at 0x45f6b9
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
push edi
je 0x45f6f4
push 0x64
push eax
call dword [fcn.0049f1dc]
test eax, eax
jne 0x45f6d7
mov eax, dword [esi + 8]
push eax
jmp 0x45f6e7
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [fcn.0049f214]
mov edx, dword [esi + 8]
push edx
call dword [fcn.0049f1f8]
mov dword [esi + 8], 0
mov edx, dword [esp + 0x10]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x45f6fd
sub eax, edi
push eax
push edx
lea ecx, [esi + 0x40]
call fcn.00404829
mov eax, dword [esp + 0xc]
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x45c440
push 0
push 0
mov dword [esi + 0xc], eax
call fcn.004787a9
add esp, 0x18
pop edi
mov dword [esi + 8], eax
pop esi
ret 8
Function at 0x461139
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x46c
mov eax, dword [0x4c54e8]
xor eax, esp
mov dword [esp + 0x468], eax
push esi
mov esi, dword [esp + 0x478]
push edi
mov edi, dword [esp + 0x478]
lea eax, [esp + 8]
push eax
call fcn.0042e409
push esi
push 0x400
lea ecx, [esp + 0x7c]
push 1
push ecx
call fcn.00478118
add esp, 0x14
test eax, eax
je 0x4611ac
push eax
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x10]
push eax
call fcn.00430e09
push esi
push 0x400
lea ecx, [esp + 0x84]
push 1
push ecx
call fcn.00478118
add esp, 0x1c
test eax, eax
jne 0x461180
lea edx, [esp + 8]
push edi
push edx
call fcn.00430ea9
mov ecx, dword [esp + 0x478]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.004761ea
add esp, 0x46c
ret

Function at 0x461bd9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49d1a3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x28]
mov dword [ebp], 0x4a5470
mov eax, dword [ebx + 4]
mov dword [ebp + 4], eax
mov ecx, dword [ebx + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ebx + 0x10]
mov dword [ebp + 0x10], eax
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
xor esi, esi
lea eax, [ebx + 0x14]
push esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], esi
push eax
mov byte [ecx + 4], 0
call fcn.00404749
push 0xffffffffffffffff
lea edi, [ebp + 0x30]
mov dword [esp + 0x24], esi
push 0
lea esi, [ebx + 0x30]
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
push esi
mov ecx, edi
mov byte [edi + 4], 0
call fcn.00404749
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x1c], ecx
add esi, 0x20
add edi, 0x20
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
push 0xffffffffffffffff
lea edi, [ebp + 0x70]
push 0
add ebx, 0x70
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
push ebx
mov ecx, edi
mov byte [esp + 0x2c], 1
mov byte [edi + 4], 0
call fcn.00404749
mov edx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], edx
lea esi, [ebx + 0x20]
add edi, 0x20
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x461ec9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49d1f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov dword [esi], 0x4a5470
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
lea eax, [edi + 0x14]
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00404749
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], 0
call fcn.00461bd9
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x463cd9
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push edi
mov edi, ecx
jne 0x463cea
xor al, al
pop edi
ret 4
push esi
push 0x4a222c
push eax
call fcn.00477def
mov esi, eax
add esp, 8
test esi, esi
jne 0x463d06
pop esi
xor al, al
pop edi
ret 4
push esi
push 1
lea eax, [edi + 4]
push 4
push eax
call fcn.004775cb
push esi
push 1
lea ecx, [edi + 8]
push 4
push ecx
call fcn.004775cb
push esi
push 1
lea edx, [edi + 0xc]
push 4
push edx
call fcn.004775cb
push esi
push 1
push 4
add edi, 0x10
push edi
call fcn.004775cb
add esp, 0x40
push esi
call fcn.004777cb
add esp, 4
pop esi
mov al, 1
pop edi
ret 4

Function at 0x465de9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49d6fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x50], ecx
mov dword [esi + 0x4c], eax
mov byte [esi + 0x3c], al
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], eax
mov byte [esi + 0x58], al
mov dword [esi + 0x88], ecx
mov dword [esi + 0x84], eax
mov byte [esi + 0x74], al
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xa4], eax
mov byte [esi + 0x94], al
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xc0], eax
mov byte [esi + 0xb0], al
mov dword [esi + 0xe0], ecx
mov dword [esi + 0xdc], eax
mov byte [esi + 0xcc], al
mov ecx, esi
mov byte [esp + 0x14], 7
call fcn.00465d69
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4687c9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49da5b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x4a5778
xor eax, eax
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], eax
mov byte [esi + 0x18], al
mov dword [esp + 0x30], eax
mov byte [esi + 0xc], al
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [esp + 0xc]
push eax
call fcn.00468199
cmp dword [esp + 0x24], 0x10
jb 0x468833
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00475c61
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x469019
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x46902b
mov eax, 0x70000005
pop edi
ret 8
xor edx, edx
cmp dword [edi + 8], edx
jle 0x46904e
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
mov cl, byte [esi]
xor byte [eax], cl
add edx, 1
add esi, 1
add eax, 1
cmp edx, dword [edi + 8]
jl 0x46903b
pop esi
mov eax, 0x6fffffff
pop edi
ret 8
Function at 0x46c289
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x46c2b8
test cl, 3
jne 0x46c2b8
shr ecx, 2
mov eax, dword [esp + 4]
je 0x46c2b5
mov edx, dword [esp + 0xc]
lea ebx, [ebx]
xor dword [eax], edx
sub ecx, 1
add eax, 4
test ecx, ecx
jne 0x46c2a9
mov al, 1
ret
xor al, al
ret

Function at 0x46c9c9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49dcbb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0xc], ecx
mov dword [ecx], 0x4a96dc
mov eax, dword [ecx + 8]
lea esi, [ecx + 4]
mov ecx, dword [eax + 4]
push ecx
xor edi, edi
mov ecx, esi
mov dword [esp + 0x20], edi
call fcn.0045a319
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], edi
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
push esi
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.0045a919
mov eax, dword [esi + 4]
push eax
call fcn.00475c61
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x46ede9
Capabilities:
Create thread

Disassembly:
sub esp, 0x3f4
push esi
lea eax, [esp + 8]
push eax
push 4
mov esi, ecx
push esi
push 0x46bba0
push 0
push 0
mov byte [esi + 0x24], 1
call fcn.004787a9
add esp, 0x18
test eax, eax
je 0x46ee36
cmp eax, 1
je 0x46ee36
push 2
push eax
mov dword [esi + 0x1c], eax
call dword [fcn.0049f198]
mov ecx, dword [esi + 0x1c]
push ecx
call dword [fcn.0049f19c]
pop esi
add esp, 0x3f4
ret
lea edx, [esp + 4]
push edx
call fcn.00478685
mov ecx, dword [esp + 8]
add esp, 4
cmp ecx, 0xb
je 0x46ee7c
cmp ecx, 0x16
je 0x46ee6b
mov eax, dword [0x4c7aac]
test eax, eax
je 0x46ee90
push ecx
push 0x4a98bc
push eax
call fcn.004501b9
add esp, 0xc
jmp 0x46ee90
mov ecx, dword [0x4c7aac]
test ecx, ecx
je 0x46ee90
push 0x4a9890
jmp 0x46ee8b
mov ecx, dword [0x4c7aac]
test ecx, ecx
je 0x46ee90
push 0x4a9850
call fcn.004500d9
push 0x4a9824
lea ecx, [esp + 0x10]
mov dword [esi + 0x1c], 0
call fcn.0046f0b9
push 0x4c0450
lea eax, [esp + 0x10]
push eax
call fcn.00475dbf
int3
Function at 0x477e7c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x477eb9
cmp dword [ebp + 0x14], edi
je 0x477eb9
cmp ecx, edi
jne 0x477ec0
call fcn.00478641
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004767e3
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x477ed4
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x477ef5
cmp ebx, 0xffffffff
je 0x477ee4
push ebx
push edi
push ecx
call fcn.00476209
add esp, 0xc
cmp esi, edi
je 0x477ea1
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x477ea1
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x477f11
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x477f18
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x478009
test word [esi + 0xc], 0x10c
je 0x477f6c
mov eax, dword [esi + 4]
test eax, eax
je 0x477f6c
jl 0x47806a
cmp ebx, eax
mov edi, ebx
jb 0x477f3d
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x478011
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00475c66
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x478001
cmp ebx, dword [ebp - 0xc]
jb 0x477fd9
cmp dword [ebp - 0xc], 0
je 0x477f96
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x477f8b
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x477f92
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x477fa1
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x477fa1
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x47803d
push eax
push dword [ebp - 8]
push esi
call fcn.00478971
pop ecx
push eax
call fcn.00485735
add esp, 0xc
test eax, eax
je 0x47807c
cmp eax, 0xffffffff
je 0x47806a
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x478001
push esi
call fcn.00483808
cmp eax, 0xffffffff
pop ecx
je 0x47806e
cmp dword [ebp - 4], 0
je 0x47803d
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x477f20
mov eax, dword [ebp + 0x14]
jmp 0x477ebb
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x478028
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00476209
add esp, 0xc
call fcn.00478641
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x477eb1
cmp dword [ebp + 0xc], 0xffffffff
je 0x478053
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00476209
add esp, 0xc
call fcn.00478641
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x477eb1
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x477ebb
or dword [esi + 0xc], 0x10
jmp 0x47806e
Function at 0x40771f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40772a
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4077e6
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
sub edi, 1
jne 0x40773f
pop edi
test esi, esi
je 0x407802
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
inc edx
sub esi, 1
jne 0x4077ea
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x407809
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
movsx eax, dl
mov ecx, dword [esi]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4964b8]
movzx eax, cl
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
mov dword [esi], ecx
mov ecx, dword [esi + 8]
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4964b8]
mov dword [esi + 8], ecx
pop esi
ret

Function at 0x407f31
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x49d094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov ebx, edx
mov dword [ebp - 8], eax
mov ecx, ebx
imul ecx, dword [ebp + 8]
cmp byte [edi], 0
je 0x407f75
push 0
lea edx, [ebp - 8]
push edx
push ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407f70
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x407f9f
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.0045a350
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
mov ecx, dword [ebp - 4]
xor edx, edx
div ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.004582a0
leave
ret