joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4607ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x4e6a69
call fcn.004d638a
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x460828
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x460828
call fcn.00403ee6
mov esi, eax
jmp 0x4608ff
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x46084b
call fcn.00403ee6
jmp 0x4608f2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x460841
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x46087b
mov esi, 0x8007000e
jmp 0x4608f4
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0045fb29
jmp 0x4608a1
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x460874
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x460841
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.00460672
mov esi, eax
test edi, edi
je 0x4608ff
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x460918
lea ecx, [ebp - 0x418]
call fcn.0045ff4a
lea ecx, [ebp - 0x428]
call fcn.00403a84
mov eax, esi
call fcn.004d62d7
ret 0x10
Function at 0x461655
Capabilities:
Get common file path

Disassembly:
push 0x2d0
mov eax, 0x4e6b7d
call fcn.004d631c
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
xor eax, eax
mov dword [ebp - 0x2dc], ebx
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x4eed4c
lea ecx, [ebp - 0x2d8]
push esi
call fcn.00401a11
mov edi, eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c0]
push esi
call fcn.00401a11
mov esi, eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00401a11
push 0x4ebfb4
push eax
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 2
push eax
call fcn.004029e1
push esi
push eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
push eax
call fcn.00403119
push 0x4ebfb4
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 4
push eax
call fcn.004029e1
push edi
push eax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 5
push eax
call fcn.00403119
push str..exe
push eax
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 6
push eax
call fcn.004029e1
add esp, 0x3c
lea ecx, [ebp - 0x248]
call fcn.00401f5a
lea ecx, [ebp - 0x260]
call fcn.00401f5a
lea ecx, [ebp - 0x278]
call fcn.00401f5a
lea ecx, [ebp - 0x290]
call fcn.00401f5a
lea ecx, [ebp - 0x2a8]
call fcn.00401f5a
lea ecx, [ebp - 0x2c0]
call fcn.00401f5a
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0xe
call fcn.00401f5a
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004080c5
lea ecx, [ebp - 0x230]
call fcn.00401f5a
mov eax, ebx
call fcn.004d62c6
ret

Function at 0x461d27
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x10], 0
push esi
je 0x461d5a
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
push dword [esi]
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x461d5a
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov al, 1
jmp 0x461d5c
xor al, al
pop esi
leave
ret 8
Function at 0x461f5a
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6c5d
mov eax, dword fs:[0]
push eax
mov eax, 0x20d0
call fcn.004d6520
mov eax, dword [0x566f9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp byte [esi + 0x11], 0
je 0x462046
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x462046
cmp dword [esi + 0xc], edi
je 0x462050
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0x2000
push eax
lea eax, [ebp - 0x2010]
mov ecx, esi
push eax
call fcn.00461d27
test al, al
je 0x46203b
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2028]
call fcn.004019e2
push edi
push dword [ebp - 0x202c]
lea ecx, [ebp - 0x2028]
mov dword [ebp - 4], edi
call fcn.004061a7
cmp dword [esi + 0x14], edi
je 0x46201d
sub esp, 0x18
lea eax, [ebp - 0x2028]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.00404c3c
call dword [esi + 0x14]
add esp, 0x18
lea eax, [ebp - 0x2028]
push eax
lea ecx, [esi + 0x18]
call fcn.00461ef4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
call fcn.00401f34
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x10], 0
jne 0x461fa8
cmp byte [esi + 0x11], 0
je 0x46205f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor esi, esi
lea ecx, [ebp - 0x20dc]
inc esi
push esi
push 3
call fcn.004038fa
lea eax, [ebp - 0x20cc]
mov dword [ebp - 4], esi
push str.Exit_work_loop.
push eax
call fcn.00402f9e
pop ecx
pop ecx
lea eax, [ebp - 0x20dc]
push eax
push str.DataReceiver::run
push 0x7d
push 0x4f8d18
push esi
call fcn.00405a66
mov ecx, eax
call fcn.0040f202
lea ecx, [ebp - 0x2074]
call fcn.00403ad6
lea ecx, [ebp - 0x2074]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d62a0
leave
ret
Function at 0x4631f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x38
mov eax, 0x4e7051
call fcn.004d631c
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push esi
call fcn.004080c5
lea eax, [ebp - 0x34]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0040afc0
or dword [ebp - 4], 0xffffffff
mov bl, al
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00402dce
lea ecx, [ebp - 0x34]
call fcn.00401f5a
test bl, bl
jne 0x463240
xor al, al
jmp 0x463309
push esi
lea ecx, [ebp - 0x34]
call fcn.004080c5
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push eax
call fcn.0040ae6f
pop ecx
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00402dce
lea ecx, [ebp - 0x34]
call fcn.00401f5a
test bl, bl
jne 0x463239
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
jb 0x463280
mov eax, dword [esi]
push edi
push edi
push 0x80
push 3
push 1
push SysReAllocString
push eax
lea ecx, [ebp - 0x3c]
call fcn.004041db
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4632df
lea eax, [ebp - 0x44]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x3c]
movlpd qword [ebp - 0x44], xmm0
call fcn.00409d18
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4632c3
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x40], 0
ja 0x4632cf
cmp dword [ebp - 0x44], 1
jbe 0x4632e2
test eax, eax
je 0x463239
push eax
call edi
jmp 0x463239
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4632e9
push eax
call edi
cmp dword [esi + 0x14], 8
jb 0x4632f1
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x463239
test eax, 0x11111
setne al
call fcn.004d62c6
ret 4

Function at 0x465d8e
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push esi
push 0x465dc5
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
ret

Function at 0x465db3
Capabilities:
Terminate thread

Disassembly:
cmp dword [ecx + 4], 0
je 0x465dc4
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret
Function at 0x471dc1
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x566f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x471df5
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x471df5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x471ead
push esi
mov esi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x471e14
cmp dx, 0x5c
jne 0x471e16
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x471e08
cmp esi, ebx
je 0x471e5e
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp esi, 0x208
jae 0x471ebb
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.00471dc1
pop ecx
pop ecx
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x471e7c
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x471ead
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d62a0
leave
ret
call fcn.004d6691
int3

Function at 0x47245f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x47250d
cmp dword [esi + 4], 0xffffffff
jne 0x47250d
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x4724b4
cmp eax, 0x2f
je 0x4724b4
push 0x4ebfb4
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x4724d6
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4724d6
mov eax, 0x2000000
jmp 0x472512
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00474bb5
add esp, 0x10
test eax, eax
jne 0x4724f4
mov eax, dword [ebp - 4]
jmp 0x472512
push eax
call fcn.00475143
pop ecx
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x472512
mov eax, 0x1000000
pop esi
leave
ret 0xc
Function at 0x4729dc
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4fc370]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x474cb2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x474ce5
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x474ce0
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x474d0f
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x474dbc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x474dca
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x474e89
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
sub edi, 1
jne 0x474de2
pop edi
test esi, esi
je 0x474ea5
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fc370]
inc edx
sub esi, 1
jne 0x474e8d
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x476ff3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x477001
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4770c0
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
sub edi, 1
jne 0x477019
pop edi
test esi, esi
je 0x4770dc
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
inc edx
sub esi, 1
jne 0x4770c4
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4777d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov ecx, ebx
push edi
mov dword [ebp + 8], ecx
mov edi, ebx
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
jmp 0x4779ea
cmp eax, 3
jb 0x477853
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x477890
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x477890
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x47787a
mov dword [esi + 0x6afa0], eax
push ecx
push esi
call fcn.00478366
pop ecx
pop ecx
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x477975
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.00477318
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x47793a
cmp ecx, 3
jb 0x47793a
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x4778d2
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
jmp 0x477970
mov edx, dword [esi + 0x6af84]
add edx, edi
mov edi, ebx
mov dword [esi + 0x6af84], edx
movzx ecx, byte [esi + edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x47799a
movzx eax, byte [esi + ecx + 0x1af70]
push eax
push ebx
push esi
call fcn.00477318
add esp, 0xc
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
test eax, eax
je 0x4779cd
mov ecx, dword [esi + 0x6af74]
lea eax, [esi + 0x1af70]
sub edx, ecx
add eax, ecx
push ebx
push edx
xor edx, edx
test ecx, ecx
cmovs eax, edx
push eax
push esi
call fcn.00477bd6
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x4779e7
push esi
call fcn.00477a8f
mov eax, dword [esi + 0x6af90]
pop ecx
mov ecx, dword [ebp + 8]
test eax, eax
jne 0x4777fc
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x477a04
lea ebx, [esi + 0x1af70]
add ebx, ecx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push ebx
push esi
call fcn.00477bd6
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47823a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x478258
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x47827c
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
movzx eax, word [ebx*8 + 0x4fcc3a]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x4fcc38]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x4fcc3c]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x4fcc3e]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x4782df
mov eax, dword [ebp + 0x10]
or word [eax], 4
jmp 0x4782ea
cmp ebx, 8
jl 0x4782ea
mov eax, dword [ebp + 0x10]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x478351
cmp eax, 0xffffffff
je 0x478351
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x47832c
push esi
call fcn.00477a8f
pop ecx
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x478334
jmp 0x478361
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x479155
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x4791ab
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp eax, esi
jae 0x4791e8
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x78]
call fcn.00476ff3
add esp, 0x18
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x4791ea
cmp dword [edi + 0x7c], 0
je 0x4791e1
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4791e8
mov esi, dword [ebp - 4]
add dword [edi + 0x74], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x78]
call fcn.00476ff3
add esp, 0xc
jmp 0x4791a4
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x479663
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4fcca0]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4fcca0]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x4796ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x479724
mov ecx, dword [esi + 0x3c]
mov eax, ecx
test ecx, ecx
je 0x4796db
cmp dword [esi + 0x40], edi
jae 0x4796db
push ecx
call fcn.004d63cd
and dword [esi + 0x3c], 0
xor eax, eax
pop ecx
test eax, eax
jne 0x4796ef
lea eax, [edi + edi]
push eax
call fcn.004d63c4
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x479721
lea ecx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
push ecx
call fcn.0047977e
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
lea ecx, [esi + 0x30]
cmp ebx, edi
jb 0x479703
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x479753
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x47973f
mov dword [esi + 0x14], 0x30000
jmp 0x479775
push edi
add ecx, edx
push ebx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x479777
mov eax, dword [esi + 4]
test eax, eax
je 0x47976e
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x479777
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8