joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b670
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5a4dc8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x5e9b88
lea ecx, [esp + 0x14]
xor ebp, ebp
call fcn.004023b0
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
call fcn.00555692
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x44b6cc
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
cmp ebx, ebp
mov byte [esp + 0x24], 1
je 0x44b7a9
lea esp, [esp]
test bl, 1
je 0x44b79c
mov eax, dword [esp + 0x10]
mov esi, dword [eax - 0xc]
test esi, esi
jle 0x44b809
cmp dword [eax - 4], 1
jle 0x44b71e
mov ecx, esi
push ecx
lea ecx, [esp + 0x14]
call fcn.00402030
mov eax, dword [esp + 0x10]
test esi, esi
lea edx, [ebp + 0x41]
mov word [eax], dx
jl 0x44b809
mov eax, dword [esp + 0x10]
cmp esi, dword [eax - 8]
jg 0x44b809
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x10]
mov word [eax + esi*2], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x44b79c
push 2
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
call fcn.00414630
mov byte [esp + 0x24], 2
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.0055d4af
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44b79c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
shr ebx, 1
add ebp, 1
test ebx, ebx
jne 0x44b6f0
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44b7ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44b7f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x80070057
call fcn.00401f90
int3
Function at 0x44b930
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a4d76
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x260], eax
push ebp
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x274]
mov dword fs:[0], eax
mov eax, dword [esp + 0x284]
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
call fcn.004023b0
push 0x5d616c
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x288], 0
call fcn.00401ba0
push esi
push eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x294], 1
call fcn.00401ba0
mov eax, dword [eax]
add esp, 0x18
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44b9de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x27c], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44ba06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x27c], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44ba31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 0xffffffff
je 0x44bade
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x5d2a04
lea eax, [esp + 0x48]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44ba76
test dx, dx
je 0x44ba72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44ba76
add eax, 4
add ecx, 4
test dx, dx
jne 0x44ba50
xor eax, eax
jmp 0x44ba7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44bace
mov ecx, 0x5e0318
lea eax, [esp + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44baae
test dx, dx
je 0x44baaa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44baae
add eax, 4
add ecx, 4
test dx, dx
jne 0x44ba88
xor eax, eax
jmp 0x44bab3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44bace
test byte [esp + 0x1c], 0x10
jne 0x44bace
mov edx, dword [edi + 8]
lea ecx, [esp + 0x48]
push ecx
push edx
mov ecx, edi
call fcn.0055d51b
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
test eax, eax
jne 0x44ba40
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x274]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.00577139
add esp, 0x274
ret
Function at 0x44be90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, eax
mov ecx, edi
call fcn.00402180
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44bf14
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push ebx
push 0xd
call esi
mov ebx, eax
test ebx, ebx
je 0x44bee2
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
cmp esi, ebp
jge 0x44bf0d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
shr esi, 1
sub esi, 1
push esi
push eax
mov ecx, edi
call fcn.004044f0
push ebx
jmp 0x44bf07
push 1
call esi
mov esi, eax
test esi, esi
je 0x44bf0d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, ebp
jge 0x44bf0d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.004047b0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jle 0x44bf38
push 0
push eax
call fcn.0057787c
add esp, 8
test eax, eax
je 0x44bf38
sub eax, dword [edi]
sar eax, 1
js 0x44bf38
mov esi, eax
call fcn.00401d70
pop edi
pop esi
pop ebp
ret

Function at 0x44bf40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
push ebx
je 0x44bfbb
push esi
lea ecx, [eax + eax + 2]
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov eax, dword [edi]
mov edx, dword [eax - 0xc]
add edx, edx
push edx
push eax
push esi
call fcn.0057b7b0
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
mov byte [esi + ecx*2], 0
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
add esp, 0xc
push ebx
mov byte [esi + eax*2 + 1], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop esi
je 0x44bfbb
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x44c5d0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5a4ca0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 8]
xor edi, edi
cmp eax, edi
je 0x44c7cc
lea ecx, [esp + 0x24]
call fcn.0055d17f
lea esi, [esp + 0x24]
mov dword [esp + 0x40], edi
call fcn.0044c3a0
xor esi, esi
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x14], edi
jle 0x44c7bb
mov eax, dword [ebx + 8]
xor edi, edi
test eax, eax
jle 0x44c6a9
test edi, edi
jl 0x44c6e0
cmp edi, eax
jge 0x44c6e0
test esi, esi
mov eax, dword [ebx + 4]
mov ecx, dword [eax + edi*4]
lea eax, [eax + edi*4]
jl 0x44c6e0
cmp esi, dword [esp + 0x2c]
jge 0x44c6e0
test ecx, ecx
mov edx, dword [esp + 0x28]
lea ebp, [edx + esi*4]
je 0x44c689
mov eax, dword [ebp]
cmp dword [eax - 0xc], 0
jl 0x44c689
push ecx
push eax
call fcn.0057781d
add esp, 8
test eax, eax
je 0x44c689
sub eax, dword [ebp]
sar eax, 1
jns 0x44c695
mov eax, dword [ebx + 8]
add edi, 1
cmp edi, eax
jl 0x44c635
jmp 0x44c6a9
push 1
push esi
lea ecx, [esp + 0x2c]
call fcn.0055d420
sub esi, 1
add dword [esp + 0x14], 1
add esi, 1
cmp esi, dword [esp + 0x2c]
jl 0x44c62c
cmp dword [esp + 0x14], 0
jle 0x44c7bb
call fcn.0044c9a0
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44c6e5
push 0x80004005
call fcn.00401f90
jmp fcn.00555520
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x14], ebp
xor esi, esi
mov byte [esp + 0x40], 1
cmp dword [esp + 0x2c], esi
jle 0x44c79a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea esp, [esp]
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x18]
push 0x5e9bdc
push ecx
mov dword [esp + 0x2c], eax
call fcn.00404650
add esp, 0xc
test esi, esi
jl 0x44c6e0
cmp esi, dword [esp + 0x2c]
jge 0x44c6e0
mov eax, dword [esp + 0x28]
mov edx, dword [eax + esi*4]
mov edi, dword [edx - 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0xf003f
push 0
push 0x5d2b58
push 0
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push closesocket
mov esi, edx
mov dword [esp + 0x3c], 0
call ebx
test eax, eax
mov ebp, dword [esp + 0x14]
jne 0x44c78c
mov eax, dword [esp + 0x1c]
lea edx, [edi + edi + 2]
push edx
push esi
push 1
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [esp + 0x20]
cmp esi, dword [esp + 0x2c]
jl 0x44c710
lea eax, [ebp - 0x10]
mov byte [esp + 0x40], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c7bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], 0xffffffff
call fcn.0055d21d
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x44c7e0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5a4c68
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x50]
lea ecx, [esp + 0x18]
call fcn.0055d17f
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0
call fcn.0055d17f
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x54], 1
call fcn.00499f40
mov eax, dword [esp + 0x40]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x44c876
test esi, esi
mov ecx, dword [ebp]
jl 0x44c894
cmp esi, eax
jge 0x44c894
mov edx, dword [esp + 0x30]
mov eax, dword [edx + esi*4]
push ecx
push eax
call fcn.00577334
add esp, 8
test eax, eax
je 0x44c968
mov eax, dword [esp + 0x34]
add esi, 1
cmp esi, eax
jl 0x44c847
mov esi, dword [esp + 0x20]
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44c899
push 0x80004005
call fcn.00401f90
jmp fcn.00555520
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
add esi, 1
push esi
lea ecx, [esp + 0x14]
push 0x5e9bdc
push ecx
mov byte [esp + 0x54], 2
call fcn.00404650
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x44c8f6
test esi, esi
jl 0x44c894
cmp esi, eax
jge 0x44c894
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + esi*4]
push edi
push eax
call fcn.00577334
mov eax, dword [esp + 0x28]
add esi, 1
add esp, 8
cmp esi, eax
jl 0x44c8d2
mov esi, dword [ebp]
mov ebp, dword [esi - 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0x5d2b58
push 0
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push closesocket
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44c947
lea edx, [ebp + ebp + 2]
push edx
push esi
push 1
push eax
mov eax, dword [esp + 0x24]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [edi - 0x10]
mov byte [esp + 0x48], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c968
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 0
call fcn.0055d21d
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0xffffffff
call fcn.0055d21d
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x3c
ret
Function at 0x44c9a0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x59be20
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.0055d17f
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0
call fcn.0055d17f
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x48], 1
call fcn.00499f40
mov eax, dword [esp + 0x20]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x44ca2f
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test esi, esi
jl 0x44ca60
cmp esi, eax
jge 0x44ca60
mov edx, dword [esp + 0x10]
mov eax, dword [edx + esi*4]
push eax
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push closesocket
call edi
mov eax, dword [esp + 0x14]
add esi, 1
cmp esi, eax
jl 0x44ca08
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 0
call fcn.0055d21d
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0055d21d
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret
jmp fcn.00555520

Function at 0x44cd40
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x1c]
call fcn.00402180
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ce03
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push ebp
push edx
call edi
test eax, eax
jne 0x44cded
mov eax, dword [esp + 8]
add eax, 2
push esi
push eax
call fcn.00555176
add esp, 4
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [esp + 0x18]
push edx
push 0
push ebp
push eax
call edi
test eax, eax
jne 0x44cde3
mov ecx, dword [esp + 0xc]
mov byte [esi + ecx], al
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
push esi
mov byte [esi + edx + 1], al
call fcn.004021f0
push esi
call fcn.0055517b
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop ebp
add esp, 0xc
ret
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x452920
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 5
lea eax, [esp + 8]
push eax
push 0
mov word [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x452972
lea eax, [esp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x452956
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00402270
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00577139
add esp, 0x20c
ret

Function at 0x452d30
Capabilities:
Hash data using djb2

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, eax
mov al, byte [edi]
xor ebp, ebp
xor edx, edx
test al, al
mov ecx, 0x1505
mov esi, edi
je 0x452d68
mov bl, al
lea ebx, [ebx]
mov ebp, ecx
shl ebp, 5
add ebp, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
add esi, 1
add ecx, ebp
test bl, bl
jne 0x452d50
mov ebp, edx
test al, al
mov esi, edi
je 0x452d84
mov edi, edi
imul edx, edx, 0x1003f
movsx eax, al
add esi, 1
add edx, eax
mov al, byte [esi]
test al, al
jne 0x452d70
shr ecx, 2
mov eax, ecx
and ecx, 0x3f
shr eax, 4
and eax, 0x3ffffc0
or eax, ecx
mov ecx, eax
shr ecx, 4
and ecx, 0x3ffc00
and eax, 0x3ff
or ecx, eax
mov eax, ecx
and ecx, 0x3fff
shr eax, 4
and eax, 0x3c000
or eax, ecx
mov ecx, eax
and ecx, 0xffffc000
shl ecx, 4
mov esi, eax
and esi, 0x3c00
or ecx, esi
shl ecx, 4
mov esi, eax
and esi, 0x3c0
or ecx, esi
shl ecx, 4
and eax, 0x3c
or ecx, eax
add ecx, ecx
add ecx, ecx
and edx, 0xf0f0f0f
or ecx, edx
xor ebx, ebx
mov edi, ecx
mov eax, 0xcccccccd
mul edi
shr edx, 3
lea eax, [edx + edx*4]
mov esi, edi
add eax, eax
mov edi, edx
mov edx, ebp
sub esi, eax
and edx, 0x80000001
jns 0x452e18
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x452e3e
add esi, esi
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
neg edx
add edx, edx
add edx, edx
add edx, edx
sub edx, eax
add esi, edx
add ebx, esi
add ebp, 1
test edi, edi
jne 0x452df4
mov eax, 0x99999999
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
lea eax, [ebx + eax*2]
test eax, eax
je 0x452e96
mov edx, 0xa
sub edx, eax
and ebp, 0x80000001
mov eax, edx
jns 0x452e78
dec ebp
or ebp, 0xfffffffe
inc ebp
cmp ebp, 1
jne 0x452e96
mov edx, eax
and edx, 0x80000001
jns 0x452e8c
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x452e94
add eax, 9
sar eax, 1
push ecx
add eax, 0x30
push eax
mov eax, dword [esp + 0x20]
push str.7_c_u
push eax
call fcn.00404650
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4530e0
Capabilities:
Get memory capacity

Disassembly:
push 0xffffffffffffffff
push 0x5a4758
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
xor esi, esi
push eax
mov dword [esp + 0x10], 0x1024
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [esp + 0x18], 0x1c9c3800
jae 0x45312f
mov dword [esp + 0xc], 0x256
push str.SYSTEMCurrentControlSetServiceslanmanserver
lea ecx, [esp + 0xc]
call fcn.004023b0
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
mov dword [esp + 0x44], esi
mov edx, dword [esp + 0x14]
push str.Maxworkitems
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004972a0
add esp, 0x14
push 0xb
push str.parameters
lea ecx, [esp + 0x10]
call fcn.004044f0
push 4
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push 4
push str.Maxworkitems
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004972a0
mov esi, eax
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4531b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x453760
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x5a4720
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x18], eax
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push 0
mov eax, 0x17
mov ecx, str.http:__www.baidu.com_s_
mov edx, esi
call fcn.0044d730
add esp, 4
test eax, eax
jne 0x45393e
mov eax, dword [0x63c0b0]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x453820
mov al, 0x15
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0xe
mov dl, 6
mov cl, 0x12
mov byte [esp + 0x17], al
mov byte [esp + 0x19], al
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0xf
mov byte [esp + 0x13], 0x5c
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x1a], 0x3e
mov byte [esp + 0x1b], 5
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1d], 0x61
lea eax, [esp + 0x10]
xor byte [eax], 0x61
add eax, 1
cmp byte [eax], 0x61
jne 0x453803
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x63c0b0
mov byte [eax], 0
call fcn.004047b0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x4538ca
push 0x5ea9c4
push eax
call fcn.0057781d
add esp, 8
test eax, eax
je 0x4538ca
mov ecx, dword [esi]
sub eax, ecx
sar eax, 1
mov edi, eax
test edi, edi
jle 0x4538ca
mov edx, dword [ecx - 0xc]
lea eax, [edi + 4]
test eax, eax
jl 0x453879
cmp eax, edx
jg 0x453879
lea edx, [ecx + eax*2]
push 0x5ea0f4
push edx
call fcn.0057781d
add esp, 8
test eax, eax
je 0x453879
sub eax, dword [esi]
sar eax, 1
test eax, eax
jge 0x45387e
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
sub eax, edi
push eax
push edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00423ae0
mov dword [esp + 0x2c], 0
mov edi, dword [esp + 0xc]
push str.tnbaidusite
push edi
call fcn.00577334
add esp, 8
test eax, eax
jne 0x4538bd
mov edx, dword [0x63c0b0]
add edx, 2
push edx
push edi
push esi
call fcn.00414390
mov dword [esp + 0x2c], 0xffffffff
lea eax, [edi - 0x10]
jmp 0x453925
mov ecx, dword [0x63c0ac]
cmp dword [ecx - 0xc], 0
jne 0x4538e9
mov eax, dword [0x63c0b0]
mov edx, dword [eax - 0xc]
push edx
push eax
mov ecx, esi
call fcn.004044f0
jmp 0x45393e
lea eax, [esp + 8]
push str.tn
push eax
mov ecx, 0x63c0ac
call fcn.00401c80
add esp, 8
mov dword [esp + 0x2c], 1
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, esi
call fcn.004044f0
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45393e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00577139
add esp, 0x28
ret