joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448150
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [esi], ebx
mov dword [esi + 0x18], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x448191
xor al, al
jmp 0x4481a5
lea ecx, [ebp - 4]
push ecx
push edi
mov dword [ebp - 4], ebx
call eax
test eax, eax
je 0x44818d
cmp dword [ebp - 4], ebx
setne al
push 0x118
mov byte [esi + 0x20], al
lea eax, [ebp - 0x148]
push ebx
push eax
mov dword [ebp - 0x14c], 0x11c
call fcn.00486640
add esp, 0xc
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x148]
cmp eax, 5
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x140]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
jne 0x44821b
cmp ecx, ebx
jle 0x44823d
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
jmp 0x44823d
push 6
pop edx
cmp eax, edx
jne 0x448239
sub ecx, ebx
je 0x448231
dec ecx
jne 0x44823d
mov dword [esi], 4
jmp 0x44823d
mov dword [esi], 3
jmp 0x44823d
jle 0x44823d
mov dword [esi], edx
movzx eax, word [ebp - 0x38]
mov dword [esi + 0x10], eax
movzx eax, word [ebp - 0x36]
mov dword [esi + 0x14], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x448256
cmp eax, 6
jne 0x448287
lea esi, [ebp - 8]
lea edi, [ebp - 0xc]
lea ebx, [ebp - 4]
call fcn.0044836d
test eax, eax
mov esi, dword [ebp + 8]
jne 0x448285
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
push eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call fcn.00448402
mov dword [esi], eax
xor ebx, ebx
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x4482ae
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x4482b4
lea ecx, [ebp - 0x30]
push ecx
call eax
movzx eax, word [ebp - 0x30]
cmp eax, ebx
je 0x4482e6
cmp eax, 6
je 0x4482dd
cmp eax, 9
je 0x4482d4
cmp eax, 0xc
jne 0x4482e9
mov dword [esi + 0x18], 4
jmp 0x4482e9
mov dword [esi + 0x18], 1
jmp 0x4482e9
mov dword [esi + 0x18], 2
jmp 0x4482e9
mov dword [esi + 0x18], ebx
mov eax, dword [ebp - 0x1c]
mov ebx, esi
mov dword [esi + 0x1c], eax
call fcn.004484e6
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x4488af
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
mov esi, eax
cmp dword [esi + 0x14], 0x104
push edi
jb 0x4488cc
xor al, al
jmp 0x44895a
and word [ebp - 0x230], 0
push 0x208
lea eax, [ebp - 0x22e]
push 0
push eax
call fcn.00486640
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x4488f5
mov esi, dword [esi + 4]
jmp 0x4488f8
add esi, 4
push esi
lea eax, [ebp - 0x230]
push 0x105
push eax
call fcn.0048633c
and dword [ebp - 0x20], 0
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0xe], 0
jne 0x4488c5
test eax, eax
je 0x448957
cmp eax, 2
je 0x448957
cmp eax, 0x402
je 0x448957
xor eax, eax
jmp 0x44895a
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x44899c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b9fe2
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
push esi
push edi
mov esi, ecx
jne 0x4489dd
xor eax, eax
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x448a05
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x448a05
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x4489c9
mov eax, dword [esi + 0x4c]
cmp eax, edi
jne 0x448a11
or eax, 0xffffffff
jmp 0x4489c9
cmp dword [esi + 0x3c], edi
jne 0x448a25
push eax
push ebx
call fcn.00448875
test al, al
pop ecx
pop ecx
je 0x448a0c
jmp 0x448a01
push edi
push 8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x18], bl
call fcn.0044901d
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x70], edi
call fcn.00449043
mov ecx, eax
call fcn.00449304
mov edi, dword [esp + 0x58]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.00449043
mov ecx, eax
call fcn.00449304
lea edx, [esp + 0x18]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x448b35
cmp eax, 1
jg 0x448b5d
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
call fcn.00449043
mov ecx, eax
call fcn.00449304
mov edi, dword [esp + 0x18]
sub edi, eax
je 0x448aca
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
call fcn.00449043
mov ecx, eax
call fcn.00449304
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0048b5e8
add esp, 0x10
cmp edi, eax
jne 0x448b74
lea eax, [esp + 0x10]
cmp dword [esp + 0x1c], eax
mov byte [esi + 0x41], 1
jne 0x448b8b
test edi, edi
ja 0x448af8
cmp dword [esp + 0x58], 0x20
jae 0x448b74
push 0
push 8
lea ecx, [esp + 0x4c]
call fcn.0043e918
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.00449043
mov ecx, eax
call fcn.00449304
mov edi, dword [esp + 0x58]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.00449043
mov ecx, eax
call fcn.00449304
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x21]
push edx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x448a78
jmp 0x448b74
cmp eax, 3
jne 0x448b74
push dword [esi + 0x4c]
push dword [esp + 0x14]
call fcn.00448875
test al, al
pop ecx
pop ecx
jne 0x448b8b
or esi, 0xffffffff
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.00410be3
mov eax, esi
jmp 0x4489c9
mov esi, dword [ebp + 8]
jmp 0x448b77
Function at 0x449114
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4ba562
call fcn.004b89d0
sub esp, 0x48
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x449224
cmp byte [esi + 0x41], 0
je 0x449224
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x44914e
xor al, al
jmp 0x449226
push edi
push 8
lea ecx, [ebp - 0x54]
call fcn.0044901d
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x54]
call fcn.00449043
mov ecx, eax
call fcn.00449304
mov edi, dword [ebp - 0x40]
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x54]
call fcn.00449043
mov ecx, eax
call fcn.00449304
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
add edi, ebx
push edi
push dword [ebp - 0x14]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x4491be
dec eax
je 0x4491c2
dec eax
dec eax
je 0x449220
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.00410be3
mov al, bl
jmp 0x449226
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x54]
call fcn.00449043
mov ecx, eax
call fcn.00449304
mov edi, dword [ebp - 0x18]
sub edi, eax
je 0x449202
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x54]
call fcn.00449043
mov ecx, eax
call fcn.00449304
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0048b5e8
add esp, 0x10
cmp edi, eax
jne 0x4491ac
cmp byte [esi + 0x41], 0
je 0x449220
test edi, edi
jne 0x44915c
push edi
push 8
lea ecx, [ebp - 0x54]
call fcn.0043e918
jmp 0x44915c
mov bl, 1
jmp 0x4491ae
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x44dbc1
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
push 0x40
xor esi, esi
lea eax, [ebp - 0x9c]
push esi
push eax
call fcn.00486640
add esp, 0xc
push 0x58
lea eax, [ebp - 0x5c]
push esi
push eax
mov byte [ebp - 0x9c], 0x80
call fcn.00486640
mov eax, dword [ebp + 0x10]
add esp, 0xc
push dword [ebp + 0xc]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
lea esi, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.0044d40c
push dword [ebp + 8]
lea eax, [ebp - 0x9c]
push eax
mov eax, esi
call fcn.0044d4a3
pop esi
leave
ret

Function at 0x44de6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4bc013
call fcn.004b89d0
mov eax, 0x1020
call fcn.0049be80
push esi
lea eax, [ebp - 0x20]
xor esi, esi
push eax
mov dword [ebp - 0x24], esi
call fcn.0044dc39
mov eax, 0x1000
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x102c]
push esi
push eax
mov dword [ebp - 0x2c], esi
call fcn.00486640
sub dword [ebp - 0x28], 2
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x14]
or eax, 0x2001f
push eax
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44df05
cmp dword [ebp - 0x20], esi
setne al
cmp eax, esi
je 0x44df05
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push 0x4ced40
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44df05
lea eax, [ebp - 0x102c]
push eax
jmp 0x44df0a
push 0x4c6d78
push edi
call fcn.004279af
cmp dword [ebp - 0x20], esi
je 0x44df1e
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040dae8
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x44e0e6
Capabilities:
Get hostname

Disassembly:
mov eax, 0x4bc106
call fcn.004b89d0
sub esp, 0x134
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x103
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x13f]
push ebx
mov dword [ebp - 0x10], ebx
push eax
mov byte [ebp - 0x140], bl
call fcn.00486640
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x140]
push eax
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 7
xor eax, eax
mov byte [ebp - 0x34], bl
pop ecx
lea edi, [ebp - 0x33]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x140]
push eax
call fcn.004858d0
pop ecx
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0044dbc1
add esp, 0xc
mov ecx, 0x4ed5f0
call fcn.00425728
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
movzx eax, byte [ebp + ebx - 0x34]
push eax
push str._02x
mov ecx, esi
call fcn.0040c1e6
inc ebx
cmp ebx, 0x10
pop ecx
pop ecx
jl 0x44e17c
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x44e1a7
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, 0x4ba52e
call fcn.004b89d0
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x206
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x21e]
push ebx
mov dword [ebp - 0x18], ebx
push eax
mov word [ebp - 0x220], bx
call fcn.00486640
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, 0x4ed5f0
call fcn.00425728
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
mov eax, esi
push str._010lu
mov dword [ebp - 0x18], 1
call fcn.0042781d
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44e80e
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x4bcb25
call fcn.004b89d0
sub esp, 0x2c
mov eax, dword [0x4ed5f0]
push ebx
push esi
mov ecx, 0x4ed5f0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c], str.wq.cloud.duba.net
mov dword [ebp - 0x18], str.221.228.204.36:80
mov dword [ebp - 0x14], str.122.193.207.36:80
mov dword [ebp - 0x20], 0xf
call fcn.00410c2e
mov byte [ebp - 4], 1
xor esi, esi
push str.http:__
lea eax, [ebp - 0x10]
push eax
call fcn.00427868
push dword [ebp + esi*4 - 0x1c]
lea eax, [ebp - 0x10]
push eax
call fcn.00427541
push 0x2f
lea eax, [ebp - 0x10]
call fcn.0043a928
push str.cityinfo
lea eax, [ebp - 0x10]
push eax
call fcn.00427541
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push eax
push 0x1c
push dword [ebp + 8]
push ebx
call fcn.00445151
add esp, 0x10
cmp dword [ebp - 0x24], 0
jne 0x44e8b9
inc esi
cmp esi, 3
jb 0x44e860
or esi, 0xffffffff
jmp 0x44e8d3
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x44e8c5
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0041d0bc
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.00410be3
lea eax, [ebx - 0x10]
call fcn.0040dae8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x450a28
Capabilities:
Terminate process

Disassembly:
push ebx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x450a3c
push ebx
call fcn.00459850
test eax, eax
pop ecx
jne 0x450a7e
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x450a50
push edi
call fcn.00459850
test eax, eax
pop ecx
jne 0x450a7d
mov eax, ebx
call fcn.00459835
mov eax, edi
call fcn.00459835
lea eax, [esi + 0xc]
cmp dword [eax], 0
mov byte [esi + 0x10], 0
je 0x450a6e
xor eax, eax
jmp 0x450a7d
push esi
push 0x4509fe
push eax
call fcn.004597b3
add esp, 0xc
pop edi
pop ebx
ret
Function at 0x450e6a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4b915a
call fcn.004b89d0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi], eax
mov dword [ebp - 4], eax
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0xc], ecx
lea esi, [edi + 0x10]
push 8
pop edx
mov ecx, vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edx
mov dword [esi], ecx
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], edx
mov dword [edi + 0x24], ecx
push 4
pop edx
mov ecx, vtable.CRecordVector_unsigned_long_long_unsigned___int64__const__.0
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], edx
mov dword [edi + 0x38], ecx
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], edx
mov dword [edi + 0x4c], ecx
mov byte [ebp - 4], 5
mov ebx, dword [edi + 8]
call fcn.004599e3
mov ebx, dword [edi + 8]
lea esi, [edi + 0x38]
call fcn.004599e3
mov ebx, dword [edi + 0xc]
lea esi, [edi + 0x24]
call fcn.004599e3
mov ebx, dword [edi + 0xc]
lea esi, [edi + 0x4c]
call fcn.004599e3
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x454a02
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
je 0x454a0e
xor eax, eax
pop ebp
ret
lea eax, [esi + 0x30]
push eax
call fcn.004598ab
test eax, eax
pop ecx
je 0x454a21
push 0xc
pop eax
pop ebp
ret
push edi
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.00459850
test eax, eax
pop ecx
jne 0x454a95
lea eax, [esi + 0x18]
push eax
call fcn.00459850
test eax, eax
pop ecx
jne 0x454a95
lea eax, [esi + 0x1c]
push eax
call fcn.00459850
test eax, eax
pop ecx
jne 0x454a95
push dword [ebp + 0x10]
lea eax, [esi + 0x20]
push dword [ebp + 0x10]
push eax
call fcn.00459861
add esp, 0xc
test eax, eax
jne 0x454a95
push dword [ebp + 0x10]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.00459861
add esp, 0xc
test eax, eax
jne 0x454a95
push dword [ebp + 0xc]
lea eax, [esi + 0x10]
push dword [ebp + 8]
mov dword [esi + 4], edi
push eax
call fcn.004597b3
add esp, 0xc
test eax, eax
je 0x454a9a
push 0xc
pop eax
jmp 0x454a9e
mov dword [esi], edi
xor eax, eax
pop edi
pop ebp
ret

Function at 0x457109
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, 0x100
push edi
mov ebx, eax
or esi, eax
shl dword [ebp + 0x10], 1
mov eax, esi
shr eax, 7
and eax, 1
push eax
mov eax, ebx
and eax, dword [ebp + 0x10]
mov ecx, esi
add eax, ebx
shr ecx, 8
add ecx, eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + ecx*2]
mov eax, dword [ebp + 8]
call fcn.00457083
add esi, esi
mov eax, esi
xor eax, dword [ebp + 0x10]
pop ecx
not eax
and ebx, eax
cmp esi, 0x10000
jb 0x45711a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45715b
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
or ecx, 0x100
push esi
mov esi, dword [esp + 8]
mov edx, ecx
shr edx, 8
movzx edx, word [esi + edx*2]
mov esi, ecx
shr esi, 7
and esi, 1
neg esi
sar esi, 4
and esi, 0x7f
shr edx, 4
xor edx, esi
mov esi, dword [esp + 0xc]
add eax, dword [esi + edx*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x457164
pop esi
ret

Function at 0x457199
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x100
push esi
xor eax, eax
or edx, ecx
push edi
shl dword [ebp + 0xc], 1
mov esi, ecx
and esi, dword [ebp + 0xc]
mov edi, edx
add esi, ecx
shr edi, 8
add edi, esi
mov esi, dword [ebp + 8]
movzx esi, word [esi + edi*2]
mov edi, edx
shr edi, 7
and edi, 1
neg edi
shr esi, 4
sar edi, 4
and edi, 0x7f
xor esi, edi
mov edi, dword [ebp + 0x10]
add eax, dword [edi + esi*4]
add edx, edx
mov esi, edx
xor esi, dword [ebp + 0xc]
not esi
and ecx, esi
cmp edx, 0x10000
jb 0x4571a7
pop edi
pop esi
pop ebp
ret

Function at 0x45729f
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
push esi
mov esi, eax
xor eax, eax
inc edx
test esi, esi
je 0x4572df
push ebx
push edi
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx edi, word [edi + edx*2]
shr dword [esp + 0x14], 1
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [esp + 0x18]
add eax, dword [ebx + edi*4]
add edx, edx
or edx, ecx
dec esi
jne 0x4572ad
pop edi
pop ebx
pop esi
ret
Function at 0x458c27
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor edx, edx
lea ecx, [esi + 0x19c]
mov dword [esi + 0x3bcd4], edx
mov dword [esi + 0x3bcd0], edx
push ebx
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
mov dword [ebp - 4], edx
lea eax, [ecx + 0x70]
push edi
mov edi, dword [ebp - 4]
mov dword [ebp - 8], 8
mov ebx, edi
and ebx, 1
dec ebx
not ebx
and ebx, 0xedb88320
shr edi, 1
xor edi, ebx
dec dword [ebp - 8]
jne 0x458c74
inc dword [ebp - 4]
mov dword [eax], edi
add eax, 4
cmp dword [ebp - 4], 0x100
jb 0x458c6a
mov dword [esi + 0x118], edx
lea eax, [esi + 0x148]
mov dword [eax], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x74], edx
mov dword [esi + 0x78], edx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x70], edx
lea eax, [ebp - 0x38]
mov dword [esi + 0x198], ecx
call fcn.00456d79
mov ebx, esi
call fcn.00456e7c
push 2
pop edi
mov byte [esi + 0x306a0], 0
mov byte [esi + 0x306a1], 1
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
xor ebx, ebx
sar ecx, 1
dec ecx
inc ebx
shl ebx, cl
test ebx, ebx
jbe 0x458d2b
push ebx
push dword [ebp - 4]
lea eax, [edi + esi + 0x306a0]
push eax
call fcn.00486640
add esp, 0xc
add edi, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x16
jl 0x458d06
push 8
pop edi
mov edx, 0x10000
push 4
mov eax, edi
xor ecx, ecx
pop ebx
imul eax, eax
add ecx, ecx
jmp 0x458d4d
shr eax, 1
inc ecx
cmp eax, edx
jae 0x458d4a
dec ebx
jne 0x458d43
mov eax, 0xa1
sub eax, ecx
mov ecx, edi
shr ecx, 4
add edi, 0x10
cmp edi, 0x800
mov dword [esi + ecx*4 + 0x30ea0], eax
jb 0x458d3c
and dword [esi + 0x325ac], ebx
and dword [esi + 0x3bd14], ebx
pop edi
pop ebx
leave
ret

Function at 0x4597b3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.00487b55
mov ecx, dword [ebp + 8]
add esp, 0x18
test eax, eax
mov dword [ecx], eax
je 0x4597dc
xor eax, eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4597e7
inc eax
leave
ret
Function at 0x45cdd4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4b9631
call fcn.004b89d0
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov byte [ebp - 4], 1
mov byte [esi + 0x2c], al
lea eax, [esi + 0x30]
mov dword [esi + 0x28], 1
call fcn.0044edf7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4659a7
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ba2a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x258]
push dword [esi + 8]
mov eax, dword [esi]
xor ebx, ebx
push ebx
mov ecx, esi
call dword [eax + 4]
lea eax, [esp + 0xc]
add edi, 0x1c8
push eax
call fcn.00451cd5
push 0xe
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ebx
call fcn.00465923
pop ecx
push 0xf
lea ecx, [esp + 0x10]
call fcn.00465923
pop ecx
push 0x11
push esi
lea edi, [esp + 0x14]
call fcn.004658df
push 0x10
push esi
call fcn.004658df
push 9
push esi
call fcn.004658df
push 6
push esi
call fcn.004658df
push 0x12
push esi
call fcn.004658df
push 0x14
push esi
call fcn.004658df
push 0x13
push esi
call fcn.004658df
push 0x15
push esi
call fcn.004658df
add esp, 0x40
push 0xa
push esi
call fcn.004658df
push 0x16
push esi
call fcn.004658df
add esp, 0x10
mov eax, esi
call fcn.00451f6c
push ebx
push 0x61
call fcn.00450f1b
push ebx
push 0x62
call fcn.00450f1b
push ebx
push 0x63
call fcn.00450f1b
push 0x14
mov eax, esi
call fcn.00465959
pop ecx
push 6
mov eax, esi
call fcn.00465959
pop ecx
push 9
mov eax, esi
call fcn.00465959
pop ecx
push 0x11
mov eax, esi
call fcn.00465959
or dword [esp + 0x30], 0xffffffff
pop ecx
mov ecx, edi
call fcn.00459983
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret