joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ec70
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xdc], 8
lea esi, [edi + 0xc8]
jb 0x42ec8b
mov eax, dword [esi]
jmp 0x42ec8d
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42ed20
cmp dword [esi + 0x14], 8
jb 0x42eca5
mov esi, dword [esi]
push 0
push 0
push 3
push 0
push 0
push connect
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ecca
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xa8]
test eax, eax
je 0x42ece7
push eax
call fcn.0045862f
add esp, 4
mov dword [edi + 0xa8], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [edi + 0xac], eax
call fcn.00458626
add esp, 4
mov dword [edi + 0xa8], eax
lea ecx, [ebp - 4]
push 0
push ecx
push dword [edi + 0xac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ed30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov eax, dword [edi + 0xa0]
test eax, eax
jne 0x42ed4a
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edi + 0x48]
call eax
mov eax, dword [ebp - 4]
add esp, 8
test eax, eax
je 0x42ed43
push eax
mov eax, dword [edi + 0x50]
call eax
add esp, 4
test al, al
jne 0x42ed72
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x54]
push esi
push dword [edi + 0xa0]
call eax
add esp, 4
test eax, eax
je 0x42edd1
mov eax, dword [edi + 0xa8]
test eax, eax
je 0x42eda2
push eax
call fcn.0045862f
add esp, 4
mov dword [edi + 0xa8], 0
mov eax, dword [edi + 0x58]
lea esi, [edi + 0xac]
push 0
push esi
push 0
push dword [ebp - 4]
call eax
push dword [esi]
call fcn.00458626
push 1
push esi
push eax
push dword [ebp - 4]
mov dword [edi + 0xa8], eax
mov eax, dword [edi + 0x58]
call eax
add esp, 0x24
cmp dword [edi + 0xa8], 0
je 0x42ee30
cmp dword [edi + 0xdc], 8
lea eax, [edi + 0xc8]
jb 0x42edeb
mov eax, dword [eax]
push 0
push 2
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ee10
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push dword [edi + 0xac]
push dword [edi + 0xa8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x430570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x43067a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
lea esi, [ecx + 2]
sub ecx, eax
lea edx, [eax + 2]
add ecx, 0xfffffffe
lea eax, [edi - 1]
mov dword [ebp + 0x14], edx
shr eax, 3
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
push ecx
push dword [ebp - 0xc]
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
call fcn.0042f810
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [ebp + 0x14]
add esp, 0xc
movzx eax, byte [ecx + 0x100]
mov ecx, dword [ebp - 8]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x14], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [ebp - 4], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [ebp - 8]
jne 0x4305b0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x438e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f931e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7ca418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi], vtable.CRunSoftUpd.0
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
lea ecx, [esi + 0x38]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x438eeb
mov eax, dword [ecx]
jmp 0x438eed
mov eax, ecx
mov byte [eax], 0
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x438f09
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edx
cmp dword [eax + 0x14], 8
jb 0x438f23
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0x80]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edx
cmp dword [eax + 0x14], 8
jb 0x438f40
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0x98]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edx
cmp dword [eax + 0x14], 8
jb 0x438f5d
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0xb0]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edx
cmp dword [eax + 0x14], 8
jb 0x438f7a
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
push edx
xorps xmm0, xmm0
mov byte [ebp - 4], 7
push 0x797c43
mov dword [esi + 0xcc], 1
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edx
movsd qword [esi + 0x10], xmm0
call fcn.0042f450
mov dword [esi + 0xd0], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43ab50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f95d8
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x1c], 8
lea eax, [ebp - 0x158]
push eax
lea edx, [ebp + 8]
mov dword [ebp - 0x158], 0
cmovae edx, dword [ebp + 8]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [edx], ax
jne 0x43abc2
xor ecx, ecx
jmp 0x43abd6
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43abc7
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00420aa0
call fcn.00470904
push dword [ebp - 0x158]
mov ebx, eax
call fcn.00458626
push dword [ebp - 0x158]
mov edi, eax
push 0
push edi
call fcn.004ea000
push 0x3c
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.004ea000
add esp, 0x38
lea ecx, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
lea edx, [ebp - 0x4c]
cmovae ecx, dword [ebp + 0x20]
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x43ac20
lea eax, [ebp - 0x4c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x154]
movq qword [ebp - 0x54], xmm0
push eax
call fcn.00430680
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
push edi
push ebx
push eax
call fcn.00430570
add esp, 0x18
mov dword [ebp - 0x15c], 0
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x158]
push edi
call fcn.004526e0
mov esi, eax
test esi, esi
je 0x43aced
cmp dword [ebp + 0x50], 0
je 0x43ac91
cmp byte [esi], 0x4d
je 0x43ac91
cmp byte [esi + 1], 0x5a
jne 0x43aced
test ebx, ebx
je 0x43ac9e
push ebx
call fcn.0045862f
add esp, 4
test edi, edi
je 0x43acab
push edi
call fcn.0045862f
add esp, 4
cmp dword [ebp + 0x4c], 8
lea eax, [ebp + 0x38]
cmovae eax, dword [ebp + 0x38]
push eax
call fcn.004701a5
push dword [ebp - 0x15c]
cmp dword [ebp + 0x4c], 8
lea eax, [ebp + 0x38]
push esi
cmovae eax, dword [ebp + 0x38]
push eax
call fcn.0047127f
add esp, 0x10
lea eax, [ebp + 0x38]
cmp dword [ebp + 0x4c], 8
cmovae eax, dword [ebp + 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
jmp 0x43acef
xor esi, esi
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x43ad04
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00420ba0
xor eax, eax
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
cmp eax, 0x10
jb 0x43ad2d
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.0042f550
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x34], 0xf
mov dword [ebp + 0x30], 0
mov byte [ebp + 0x20], 0
cmp eax, 8
jb 0x43ad54
inc eax
lea ecx, [ebp + 0x38]
push eax
push dword [ebp + 0x38]
call fcn.00420ba0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret 0x4c
Function at 0x43d2a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x43d450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
pop esi
ret
Function at 0x43d870
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f99f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xd0], 0
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x7943cc
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00420aa0
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.0046e9e6
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43da4a
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push 0
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43d970
push 0x7943cc
mov ecx, esi
call fcn.00420940
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x43d949
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00420ba0
mov ecx, dword [ebp + 0x20]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp ecx, 8
jb 0x43daa6
inc ecx
push ecx
jmp 0x43da9b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc8], eax
inc eax
push eax
mov dword [ebp - 0xcc], eax
call fcn.00458626
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x43d9b6
push 0x7943cc
mov ecx, esi
call fcn.00420940
lea ecx, [ebp - 0x28]
call fcn.00420900
lea ecx, [ebp + 0xc]
call fcn.00420900
jmp 0x43daa6
push dword [ebp - 0xcc]
push 0
push ebx
call fcn.004ea000
add esp, 0xc
lea eax, [ebp - 0xd4]
push 0
push eax
push dword [ebp - 0xc8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xc4]
push ebx
call fcn.0046f433
push ebx
call fcn.0045862f
add esp, 4
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0046ec81
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.0045f147
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0042d5d0
cmp dword [ebp - 0x30], 0
jbe 0x43da42
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00420cf0
lea ecx, [ebp - 0x40]
call fcn.00420900
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x28]
push eax
call fcn.004226a0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x43da7d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00420ba0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x43daa6
inc eax
push eax
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00420ba0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x43f110
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f187
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x43f187

Function at 0x43f1a0
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004584a2
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004602f9
test al, al
je 0x43f1c1
ja 0x43f15d
mov eax, dword [ecx + 0x7e]
mov eax, 0x7536b85e
dec ecx
pop ss
mov al, 0x8c
invalid
mov esi, dword [ebp + 8]
mov dword [0x7e3dc8], esi
call fcn.00464524
mov eax, dword [0x7e3cd0]
test eax, eax
jne 0x43f1f9
push 0x120
call fcn.00458642
add esp, 4
test eax, eax
je 0x43f1f2
mov ecx, eax
call fcn.004334a0
jmp 0x43f1f4
xor eax, eax
mov dword [0x7e3cd0], eax
push esi
mov ecx, eax
call fcn.00433510
mov eax, dword [0x7e3d4c]
test eax, eax
jne 0x43f22b
push 0xac
call fcn.00458642
add esp, 4
test eax, eax
je 0x43f224
mov ecx, eax
call fcn.00430950
jmp 0x43f226
xor eax, eax
mov dword [0x7e3d4c], eax
push 1
mov ecx, eax
call fcn.00431d30
call fcn.004602b4
test al, al
je 0x43f24e
mov esi, dword [esi - 0x5116b7de]
mov al, 0x2d
add al, 0xd7
ljmp 0x8fa7
call fcn.0046015b
test al, al
je 0x43f274
push es
and bh, ah
xor ebp, dword [ecx - 0x2291adb6]
cmp bh, ah
stosd dword es:[edi], eax
add al, 0xc2
dec ecx
sahf
dec esi
ljmp 0xfd47
call fcn.0045ffbd
test al, al
je 0x43f297
sub ecx, esi
sub al, 0xd3
push ss
rcl dword [esi], cl
push ebx
dec edi
jmp 0x43f263
lea ecx, [ebp - 1]
call fcn.00421120
push dword [ebp + 0x10]
lea ecx, [ebp - 1]
call fcn.0046ddd4
call fcn.0046451f
push edx
add al, byte [eax]
call fcn.0045ff33
test al, al
je 0x43f2d7
sbb al, 0xe5
or al, dh
sub ebp, esi
xchg ebx, eax
dec eax
sbb byte [edi], cl
mov eax, 0x6e78c7a2
xor byte [eax - 0x7b], bl
cmc
jns 0x43f280
in eax, 8
invalid
xor al, 0xc3
invalid
call fcn.0046026f
test al, al
je 0x43f2f7
push esp
sbb cl, byte [edi - 0x26]
push ss
jne 0x43f2b9
cmp dword [eax], edx
salc
jns 0x43f2ac
sub al, 0x8f
arpl word [ebp + 0x1008fe8a], sp
movsb byte es:[edi], byte [esi]
sbb esi, dword [eax - 0x18]
adc al, 0xfe
invalid
call fcn.0043f110
lea ecx, [ebp - 1]
call fcn.0046dd75
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44f460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x44f484
cmp dword [esi + 8], edi
jge 0x44f47c
push esi
call fcn.0044c484
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x44f4ad
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x44f490
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x44f4c7
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x44f4b8
xor dl, dl
jmp 0x44f4bd
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x44f4af
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x44f4fb
mov dword [0x7e4120], str.zlib_corrupt
xor eax, eax
jmp 0x44f53d
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x44f510
mov dword [0x7e4120], str.read_past_buffer
jmp 0x44f4f7
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x44f527
push edi
push esi
call fcn.00451983
pop ecx
pop ecx
test eax, eax
je 0x44f4f7
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004e9970
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x4550c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x7fd620], ecx
inc eax
cmp eax, 0x100
jb 0x4550c2
cmp eax, 0x800
jae 0x455193
nop
mov edx, dword [eax*4 + 0x7fd220]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x7fd620]
mov dword [eax*4 + 0x7fd620], edx
inc eax
cmp eax, 0x800
jb 0x455170
mov dword [0x7e4294], 0x455f30
call fcn.00455d60
mov ecx, dword [0x7e4294]
test eax, eax
mov edx, 0x455fd0
cmove ecx, edx
mov dword [0x7e4294], ecx
ret
Function at 0x4562b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x4562d0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x456302
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4562ff
inc esi
cmp esi, edx
jb 0x4562f0
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x45642c
cmp ecx, 3
jbe 0x456342
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x456380
cmp cl, 0xff
je 0x456380
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x4562e4
dec ecx
shl eax, cl
and eax, 7
je 0x45631a
movzx ecx, byte [eax + 0x71151c]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x711514], 0
mov cl, byte [edx + 4]
je 0x45636a
test cl, cl
je 0x45636a
cmp cl, 0xff
jne 0x45631a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x4562e4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x4563ae
lea edx, [edi + ebx]
add edx, esi
jmp 0x4563b4
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x4563f2
movzx edi, byte [eax + 0x71151c]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x4563de
cmp cl, 0xff
jne 0x4563f2
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x4563a1
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x4562e4
pop edi
pop esi
cmp ecx, 3
jbe 0x456441
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4594c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fa973
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7ca418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x7e45f4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x7e45f4
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x797c43
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0045d050
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x460ca6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004ea000
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0046033e
test al, al
je 0x460d16
adc eax, 0xbb36c9ba
adc eax, 0x60833736
invalid
call fcn.0045ff33
test al, al
je 0x460d37
mov cl, 0xaf
leave
adc al, 0x37
ror eax, 0xe0
mov ebx, 0x80b34937
push esi
mov dl, 1
jno 0x460d7f
sbb eax, ebx
aad 0xda
lcall 0xfffe, 0xe4858b50
dec dword [ecx - 0x1237b]
dec dword [ebx - 0x1177b]
dec dword [ecx - 0x1277b]
invalid
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x128], eax
call fcn.0046026f
test al, al
je 0x460d6c
rcr byte [ecx + esi*4], 0x67
ja 0x460d97
jecxz 0x460d7a
invalid
call fcn.00460047
test al, al
je 0x460d90
xchg ebx, eax
cmp byte [ebx - 0x377f2fba], dl
inc esp
adc eax, 0x3bc4962d
rol byte [eax + 0x2d1544c8], 1
xchg esi, eax
les edi, [ebx]
sub eax, 0xa73bc496
cmpsd dword [esi], dword es:[edi]
cmp dword [edi], edi
xchg ebx, eax
pushal
into
cwde
daa
jg 0x460dad
invalid
call fcn.00460383
test al, al
je 0x460db5
cmpsb byte [esi], byte es:[edi]
std
sub al, cl
sub eax, 0x9ee6f73e
invalid
adc al, 0x43
cmp dword [ebp + 0x16c66d43], ebp
cmp dword [ebp - 0x124], 5
jg 0x460dcc
cmp dword [ebp - 0x128], 2
jg 0x460dcc
xor eax, eax
inc eax
jmp 0x460dce
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004584a2
mov esp, ebp
pop ebp
ret