joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b6b1
Capabilities:
Copy file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x4fc448]
xor eax, ebp
mov dword [ebp + 0x1e4], eax
mov eax, dword [ebp + 0x1f4]
push ebx
push esi
mov esi, dword [ebp + 0x1f0]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0044b66e
push 0x47eab8
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0044a8b0
and dword [ebp - 0x6c], 0
push 0x24c
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0044f760
add esp, 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x44b7a0
test byte [ebp - 0x6c], 0x10
jne 0x44b786
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.0044a8b0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0044a8b0
add esp, 0x18
push 0
push dword [ebp - 0x74]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004082c2
test bl, bl
je 0x44b779
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x44b779
mov bl, 1
jmp 0x44b77b
xor bl, bl
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
call fcn.004082c2
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44b724
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004082c2
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.004082c2
mov ecx, dword [ebp + 0x1e4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0044f17f
add ebp, 0x1e8
leave
ret

Function at 0x44c739
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x4fc448]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
mov edi, dword [ebp + 0x194]
push 0x206
lea eax, [ebp - 0x7e]
push 0
push eax
call fcn.0044f760
xor eax, eax
add esp, 0xc
mov word [ebp - 0x80], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x80]
push eax
call fcn.0044fb3e
pop ecx
test eax, eax
jle 0x44c7ae
cmp word [ebp + eax*2 - 0x82], 0x5c
je 0x44c7ae
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x80], cx
inc eax
xor ecx, ecx
mov word [ebp + eax*2 - 0x80], cx
sub esi, eax
push str.WinSxs_
lea eax, [ebp + eax*2 - 0x80]
push esi
push eax
call fcn.00451051
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.00406bde
mov ecx, dword [ebp + 0x188]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044f17f
add ebp, 0x18c
leave
ret
Function at 0x44f17f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4fc448]
jne 0x44f189
repz ret
jmp fcn.00455d73

Function at 0x4602b8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00456114
and dword [ebp - 4], 0
cmp dword [0x503a68], 0
mov ebx, eax
jne 0x460369
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46041a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x46041a
push eax
call fcn.004560a2
mov dword [esp], 0x48102c
push edi
mov dword [0x503a68], eax
call esi
push eax
call fcn.004560a2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x503a6c], eax
call esi
push eax
call fcn.004560a2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x503a70], eax
call esi
push eax
call fcn.004560a2
pop ecx
mov dword [0x503a78], eax
test eax, eax
je 0x460369
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004560a2
pop ecx
mov dword [0x503a74], eax
mov eax, dword [0x503a74]
cmp eax, ebx
je 0x4603c1
cmp dword [0x503a78], ebx
je 0x4603c1
push eax
call fcn.0045611d
push dword [0x503a78]
mov esi, eax
call fcn.0045611d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4603c1
test edi, edi
je 0x4603c1
call esi
test eax, eax
je 0x4603b8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4603b8
test byte [ebp - 0xc], 1
jne 0x4603c1
or dword [ebp + 0x10], 0x200000
jmp 0x4603fa
mov eax, dword [0x503a6c]
cmp eax, ebx
je 0x4603fa
push eax
call fcn.0045611d
pop ecx
test eax, eax
je 0x4603fa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4603fa
mov eax, dword [0x503a70]
cmp eax, ebx
je 0x4603fa
push eax
call fcn.0045611d
pop ecx
test eax, eax
je 0x4603fa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x503a68]
call fcn.0045611d
pop ecx
test eax, eax
je 0x46041a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46041c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x468f5d
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x46dcc4
call fcn.0046c010
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x46906f
cmp byte [esi + 0x42], bl
je 0x46906f
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x468f99
xor al, al
jmp 0x469071
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00468f33
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00468d0f
mov ecx, eax
call fcn.004686b6
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00468d0f
mov ecx, eax
call fcn.004686b6
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x469009
dec eax
je 0x46900d
dec eax
dec eax
je 0x46906b
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00408914
mov al, bl
jmp 0x469071
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00468d0f
mov ecx, eax
call fcn.004686b6
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x46904d
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00468d0f
mov ecx, eax
call fcn.004686b6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00450c36
add esp, 0x10
cmp edi, eax
jne 0x468ff7
cmp byte [esi + 0x42], 0
je 0x46906b
test edi, edi
jne 0x468fa7
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00408ddb
jmp 0x468fa7
mov bl, 1
jmp 0x468ff9
mov al, 1
call fcn.0046c05a
ret

Function at 0x469b67
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x503ee4], 0
push esi
jne 0x469ada
call fcn.00469a00
test eax, eax
je 0x469b1d
mov eax, dword [0x503ee4]
cmp eax, 1
jne 0x469afb
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x469b1d
pop esi
ret
push eax
call dword [0x503eec]
test eax, eax
jne 0x469b65
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x469b21
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x503ee4]
call dword [0x503eec]
mov edi, eax
test edi, edi
je 0x469b46
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x469b62
mov edi, esi
add esi, 0xff0
push edi
push dword [0x503ee4]
call dword [0x503ee8]
add edi, 0x10
cmp edi, esi
jb 0x469b4e
mov eax, edi
pop edi
pop esi
ret
jmp 0x469ac7

Function at 0x46b4b7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x401210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fff3e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x44]
push eax
xor ebx, ebx
push ebx
lea ecx, [esi + 0x3c]
mov dword [esi + 0x3c], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x48]
push eax
call fcn.004e4960
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x30]
add esp, 4
push ecx
push ebx
lea ecx, [esi + 0x28]
mov dword [esi + 0x28], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x34]
push eax
call fcn.004e4960
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], bl
mov edx, dword [esi + 0x1c]
add esp, 4
push edx
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e4960
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 8]
add esp, 4
push eax
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov ecx, dword [esi + 0xc]
push ecx
call fcn.004e4960
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403f80
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi], 0
je 0x403fbf
push esi
mov esi, dword [edi + 4]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x403fab
mov ecx, dword [edi + 4]
xor al, al
test al, al
sete al
pop esi
push ecx
mov byte [edi], al
call fcn.004e4960
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete al
mov byte [edi], al
pop esi
mov ecx, dword [edi + 4]
push ecx
call fcn.004e4960
pop ecx
ret

Function at 0x4040a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502115
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0x10
mov dword [edi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov ecx, 1
mov byte [ebp - 4], cl
lea esi, [edi + 0x30]
mov dword [edi + 0x28], ecx
mov byte [edi + 0x2c], al
call fcn.004062a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4058c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffeb2
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x30]
push eax
call fcn.004e4960
mov eax, dword [esi + 0x1c]
add esp, 4
push eax
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e4960
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
add esp, 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
call dword [0x5199e8]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [esi + 8]
push edx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0xc]
push eax
call fcn.004e4960
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4092d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 4
mov dword [esi + 8], vtable.CObjectVector_struct_NArchive::COneMethodInfo_.0
lea eax, [ebp - 0x24]
push eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x32], 1
mov word [esi + 0x36], 0x100
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x10]
or eax, 0xffffffff
mov byte [esi + 0x40], bl
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], bx
mov dword [esi], ecx
mov dword [esi + 0x3c], 5
mov byte [esi + 0x38], 1
mov dword [esi + 4], 4
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501db8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x44]
push eax
xor ebx, ebx
push ebx
lea ecx, [esi + 0x3c]
mov dword [esi + 0x3c], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x48]
push eax
call fcn.004e4960
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x30]
add esp, 4
push ecx
push ebx
lea ecx, [esi + 0x28]
mov dword [esi + 0x28], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x34]
push eax
call fcn.004e4960
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [ebp - 4], bl
mov edx, dword [esi + 0x1c]
add esp, 4
push edx
push ebx
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0x20]
push eax
call fcn.004e4960
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
add esp, 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CCoderInfo_.0
mov dword [ebp - 4], 3
mov eax, dword [esi + 8]
push eax
push ebx
mov ecx, esi
call dword [0x519a0c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov edx, dword [esi + 0xc]
push edx
call fcn.004e4960
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41aca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501b8f
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
lea esi, [ebx + 0x10]
mov dword [ebx + 0xc], edx
mov ecx, 8
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x24], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov ecx, 4
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x38], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov dword [ebx + 0x4c], vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov byte [ebp - 4], 5
mov edi, dword [ebx + 8]
call fcn.00447050
mov edi, dword [ebx + 8]
lea esi, [ebx + 0x38]
call fcn.00447050
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x24]
call fcn.00447050
mov edi, dword [ebx + 0xc]
lea esi, [ebx + 0x4c]
call fcn.00447050
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41fa50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffba0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x34]
push eax
xor ebx, ebx
push ebx
lea ecx, [edi + 0x2c]
mov dword [edi + 0x2c], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [edi + 0x38]
push eax
call fcn.004e4960
lea esi, [edi + 0x18]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CObjectVector_class_CMyComPtr_struct_IInStream__.0
mov byte [ebp - 4], 2
mov ecx, dword [esi + 8]
push ecx
push ebx
mov ecx, esi
call dword [0x51a444]
mov byte [ebp - 4], bl
mov edx, dword [esi + 8]
push edx
push ebx
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
call dword [0x519870]
mov eax, dword [esi + 0xc]
push eax
call fcn.004e4960
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0xc]
push ecx
call fcn.004e4960
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x424600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 0x400000
jbe 0x424612
mov eax, 0x400000
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push edx
push ecx
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
setne al
test ecx, ecx
je 0x424642
mov edx, dword [ebp + 0x10]
mov dword [ecx], edx
test al, al
je 0x42464c
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42465f
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x42466b
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x4247a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push esi
push edi
lea eax, [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4247c9
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x4247e4
mov edx, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
pop ebp
ret 8
call edi
test eax, eax
jne 0x4247f5
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret 8
jle 0x424801
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
ret 8
Function at 0x424850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 0x400000
jbe 0x424862
mov eax, 0x400000
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
mov eax, dword [ebp + 0x10]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x42489b
mov dword [ecx], eax
test dl, dl
je 0x4248a5
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4248b8
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x4248c4
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x424a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x424a31
mov dword [esi], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x424a6a
mov eax, 0x8000
cmp ecx, eax
jae 0x424a43
mov eax, ecx
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x14]
push ecx
push eax
push edx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x424a66
mov ecx, dword [ebp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x424a71
xor eax, eax
pop esi
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x424a85
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
jle 0x424a91
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ebp
ret 0x10
Function at 0x424dd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501888
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], vtable.ICompressSetInStream.0
mov dword [esi + 8], vtable.ISequentialInStream.0
mov dword [esi + 0xc], vtable.ICompressSetOutStream.0
mov dword [esi + 0x10], vtable.ISequentialOutStream.0
mov dword [esi + 0x14], vtable.IOutStreamFlush.0
mov dword [esi + 0x18], vtable.ICryptoSetPassword.0
mov dword [esi + 0x1c], vtable.ICompressSetCoderProperties.0
mov dword [esi + 0x20], vtable.ICompressWriteCoderProperties.0
mov dword [esi + 0x24], vtable.ICryptoResetInitVector.0
mov dword [esi + 0x28], vtable.ICompressSetDecoderProperties2.0
xor edi, edi
mov dword [esi + 0x2c], edi
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
mov dword [esi + 0x34], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
push 4
push 0x1000
push 0x20000
push edi
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x30], eax
cmp eax, edi
jne 0x424edd
push 0x536e60
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 1
call fcn.004ea6cf
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4