joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592fef
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov esi, eax
mov eax, esi
call fcn.004262ef
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, dword [esp]
call fcn.0042667b
mov eax, esi
call fcn.004262ef
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x593136
mov ebx, 1
mov eax, esi
call fcn.004262ef
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x59306e
mov eax, esi
call fcn.004262ef
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
lea edx, [esp + 4]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
call fcn.00424217
jmp 0x593085
lea edx, [esp + 4]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
mov ecx, 3
call fcn.00424217
mov al, byte [esp + 4]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x571998
mov dl, byte [ecx + edx]
mov byte [esp + 7], dl
and al, 3
mov ebp, eax
and ebp, 0xff
shl ebp, 4
mov dl, byte [esp + 5]
mov eax, edx
and al, 0xf0
and eax, 0xff
shr eax, 4
or ebp, eax
mov eax, 0x571998
mov al, byte [eax + ebp]
mov byte [esp + 8], al
and dl, 0xf
mov ebp, edx
and ebp, 0xff
shl ebp, 2
mov al, byte [esp + 6]
mov edx, eax
and dl, 0xc0
and edx, 0xff
shr edx, 6
or ebp, edx
mov edx, 0x571998
mov dl, byte [edx + ebp]
mov byte [esp + 9], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x571998
mov al, byte [edx + eax]
mov byte [esp + 0xa], al
mov eax, dword [esp]
call fcn.00426547
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [esp + 7]
mov ecx, 4
call fcn.00424217
inc ebx
dec edi
jne 0x59303b
mov eax, esi
call fcn.004262ef
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x59317c
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.004262ef
mov ebx, eax
mov eax, dword [esp]
call fcn.00426547
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.004262ef
mov ebx, eax
mov eax, dword [esp]
call fcn.00426547
mov byte [eax + ebx - 1], 0x3d
jmp 0x5931a9
mov eax, esi
call fcn.004262ef
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x5931a9
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.004262ef
mov ebx, eax
mov eax, dword [esp]
call fcn.00426547
mov byte [eax + ebx - 1], 0x3d
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x593a17
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00426073
mov eax, dword [esp]
call fcn.004262ef
mov edi, eax
test edi, edi
jle 0x593a74
mov ebx, 1
mov eax, ebp
call fcn.00426547
mov edx, dword [esp]
mov dl, byte [edx + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x593a40
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x593a7b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
mov edx, edi
call fcn.00426073
mov eax, edi
call fcn.004262ef
mov ebp, eax
test ebp, ebp
jle 0x593ad3
mov ebx, 1
mov eax, dword [esp]
call fcn.00426547
mov dl, byte [edi + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [edi + ebx - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x593aa3
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x59b8bf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [0x5c270c]
xor eax, eax
push ebp
push 0x57a1a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 8]
mov eax, dword [edi + 0x360]
call fcn.00498e3f
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042abcb
mov edx, dword [ebp - 4]
mov eax, dword [esi]
add eax, 0x34
call fcn.00426073
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x5c2874]
mov eax, dword [eax]
mov ecx, 0x57a1c4
mov edx, 0x57a1d4
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5c2874]
mov eax, dword [eax]
mov edx, 0x57a1d4
mov ecx, 0x57a1e4
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 8]
push eax
mov eax, dword [0x5c2874]
mov eax, dword [eax]
mov edx, 0x57a1d4
mov ecx, 0x57a1f4
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x5c2874]
mov eax, dword [eax]
mov edx, 0x57a1d4
mov ecx, 0x57a204
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x34]
push eax
mov eax, dword [0x5c2874]
mov eax, dword [eax]
mov edx, 0x57a1d4
mov ecx, 0x57a214
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
call fcn.00592f73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57a1b0
lea eax, [ebp - 8]
call fcn.0042601f
lea eax, [ebp - 4]
call fcn.0042601f
ret
Function at 0x5ce3db
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
xor ecx, ecx
mov eax, ebx
dec eax
test eax, eax
jl 0x5ce3ee
inc eax
xor cl, byte [edx]
inc edx
dec eax
jne 0x5ce3e8
mov eax, ecx
pop ebx
ret

Function at 0x5d1fcf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5d1fe7
add esp, 0xfffffff0
call fcn.00425533
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x5b0958
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x40], ecx
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x3d], 0
xor eax, eax
mov dword [ebx + 0xc], eax
mov dl, 1
mov eax, dword [0x418d54]
call fcn.0042519f
mov dword [ebx + 0x38], eax
mov byte [ebx + 0x3c], 0
mov eax, ebx
call fcn.005d2d37
mov dl, 1
mov eax, dword [0x418d54]
call fcn.0042519f
mov dword [ebx + 0x2c], eax
mov dl, 1
mov eax, dword [0x5acc08]
call fcn.0042519f
mov edx, dword [ebx + 0x2c]
xchg edx, eax
call fcn.0043cfa3
mov dl, 1
mov eax, dword [0x5af9d4]
call fcn.0042519f
mov edx, dword [ebx + 0x2c]
xchg edx, eax
call fcn.0043cfa3
mov eax, dword [0x5c2a8c]
cmp dword [eax], 0x321
je 0x5d2085
mov dl, 1
mov eax, dword [0x5ae800]
call fcn.0042519f
mov edx, dword [ebx + 0x2c]
xchg edx, eax
call fcn.0043cfa3
mov dl, 1
mov eax, dword [0x5b0404]
call fcn.0042519f
mov edx, dword [ebx + 0x2c]
xchg edx, eax
call fcn.0043cfa3
xor edx, edx
mov eax, 0x5b0988
call fcn.0059427b
dec eax
jne 0x5d20c6
mov dl, 1
mov eax, dword [0x5b47c8]
call fcn.0042519f
mov esi, eax
mov dword [ebx + 0x20], esi
mov edx, esi
mov eax, dword [ebx + 0x2c]
call fcn.0043cfa3
jmp 0x5d20cb
xor eax, eax
mov dword [ebx + 0x20], eax
mov eax, ebx
call fcn.005d21eb
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x5d20f4
inc esi
xor edi, edi
mov eax, dword [ebx + 0x2c]
mov edx, edi
call fcn.0043d14f
mov edx, dword [ebx + 0x40]
mov dword [eax + 4], edx
inc edi
dec esi
jne 0x5d20e0
mov eax, ebx
call fcn.005d263f
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov dl, byte [ebx + 0x28]
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp byte [ebx + 0x28], 0
je 0x5d2153
mov eax, dword [0x5c2160]
push dword [eax]
push 0x5b0998
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x40]
call fcn.005cac67
push dword [ebp - 0xc]
push 0x5b09b0
push 0x5b09bc
lea eax, [ebp - 8]
mov edx, 5
call fcn.004263af
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.0042d277
call fcn.00424483
mov dword [ebx + 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b095f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00426043
ret
Function at 0x406b50
Capabilities:
Create thread

Disassembly:
cmp byte [esi + 0x1c], 0
je 0x406b7f
lea eax, [esi + 0x18]
push eax
push 0
push esi
push 0x406bf0
push 0
push 0
call fcn.0042d226
add esp, 0x18
test eax, eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x1c], 0
mov byte [esi + 0x1d], 0
setne al
ret
cmp byte [esi + 0x1d], 0
je 0x406b9b
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x44529c]
cmp eax, 0xffffffff
jne 0x406b97
xor al, al
ret
mov byte [esi + 0x1d], 0
mov al, 1
ret

Function at 0x4075c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x443d48
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x457640]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor edx, edx
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], edx
lea ecx, [esi + 0x14]
mov byte [ecx + 4], dl
mov dword [esi + 4], edx
mov dword [esi + 8], 4
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edx
mov eax, 0x44a897
mov dword [esp + 0x18], edx
mov dword [esi], 0x44b004
lea edi, [eax + 1]
mov bl, byte [eax]
inc eax
cmp bl, dl
jne 0x407621
sub eax, edi
push eax
push 0x44a897
call fcn.004026a0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x407de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4439b3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x457640]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
xor edx, edx
lea edi, [esi + 0x14]
mov dword [edi + 0x14], edx
mov ecx, 0xf
mov dword [edi + 0x18], ecx
mov byte [edi + 4], dl
mov ebx, 1
mov dword [esi + 4], edx
mov dword [esi + 8], ebx
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edx
mov dword [esp + 0x1c], edx
lea eax, [esi + 0x38]
mov dword [esi], 0x44af90
mov dword [eax], 0x44aff0
mov dword [eax + 0x20], ecx
mov dword [eax + 0x1c], edx
mov byte [eax + 0xc], dl
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x38], edx
mov byte [eax + 0x28], dl
mov dword [eax + 0x44], eax
mov dword [eax + 0x40], eax
mov byte [esp + 0x1c], bl
mov eax, ebp
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], edx
lea ebx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, dl
jne 0x407e70
sub eax, ebx
push eax
push ebp
mov ecx, edi
call fcn.004026a0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x40d030
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40d037
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40d114
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44cc08]
inc ecx
sub edx, 8
sub esi, 1
jne 0x40d050
pop edi
test edx, edx
je 0x40d13b
jmp 0x40d120
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x44cc08]
inc ecx
sub edx, 1
jne 0x40d120
not eax
pop esi
ret

Function at 0x40d140
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x44cc08]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x44cc08]
mov dword [edx + 8], ecx
ret

Function at 0x40d190
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x44cc08]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x44cc08]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x40e750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x40e76e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x40e762
cmp dword [edi + 0x7c], ebx
je 0x40e77d
call fcn.0040eb40
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040e4c0
add esp, 0xc
test eax, eax
je 0x40e7a4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.0042e077
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40e7e5
push 0x4000
call fcn.0042e077
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x40e7f2
push esi
call fcn.0042de9a
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x40e83a
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0040d450
test eax, eax
jne 0x40e83a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x40e864
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x40e86d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x70]
mov dword [esi + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmp ebp, ebx
je 0x40e8a7
mov cl, byte [ebp]
cmp cl, bl
je 0x40e8a7
call fcn.0040d140
add ebp, 1
jne 0x40e896
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x403d00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4849b8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b3014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
lea ecx, [edi + 0x3c]
push dword [edi + 0x44]
mov dword [edi + 0x3c], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x48]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [ebp - 4], 1
lea ecx, [edi + 0x28]
push dword [edi + 0x30]
mov dword [edi + 0x28], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x34]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [ebp - 4], 2
lea ecx, [edi + 0x14]
push dword [edi + 0x1c]
mov dword [edi + 0x14], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x20]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 3
mov ecx, edi
push dword [edi + 8]
mov dword [edi], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0xc]
call fcn.0045f190
add esp, 4
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485036
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b3014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x118]
mov dword [ebp - 4], 0
mov ecx, esi
push dword [esi + 8]
mov dword [esi], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [esi + 0xc]
call fcn.0045f190
add esp, 4
mov dword [esi + 4], 0
lea ecx, [edi + 0xf0]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.004080e0
lea ecx, [edi + 0xc8]
call fcn.004080e0
lea ecx, [edi + 0xa0]
call fcn.004080e0
lea ecx, [edi + 0x78]
call fcn.004080e0
mov dword [ebp - 4], 1
lea ecx, [edi + 0x64]
push dword [edi + 0x6c]
mov dword [edi + 0x64], vtable.CObjectVector_struct_NArchive::N7z::CFileItem_.0
push 0
call fcn.004099f0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x64]
push dword [edi + 0x6c]
mov dword [edi + 0x64], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x70]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [ebp - 4], 3
lea ecx, [edi + 0x50]
push dword [edi + 0x58]
mov dword [edi + 0x50], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x5c]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [ebp - 4], 4
lea ecx, [edi + 0x3c]
push dword [edi + 0x44]
mov dword [edi + 0x3c], vtable.CObjectVector_struct_NArchive::N7z::CFolder_.0
push 0
call fcn.00409aa0
mov byte [ebp - 4], 5
lea ecx, [edi + 0x3c]
push dword [edi + 0x44]
mov dword [edi + 0x3c], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x48]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [ebp - 4], 6
lea ecx, [edi + 0x28]
push dword [edi + 0x30]
mov dword [edi + 0x28], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x34]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [ebp - 4], 7
lea ecx, [edi + 0x14]
push dword [edi + 0x1c]
mov dword [edi + 0x14], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0x20]
call fcn.0045f190
add esp, 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 8
mov ecx, edi
push dword [edi + 8]
mov dword [edi], vtable.CBaseRecordVector.0
push 0
call fcn.0041bc90
push dword [edi + 0xc]
call fcn.0045f190
add esp, 4
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408190
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b3014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [esi + 4], vtable.ISetProperties.0
lea ecx, [esi + 0x10]
mov dword [esi + 8], 0
mov dword [esi], vtable.NArchive::N7z::CHandler.1.0
mov dword [esi + 4], vtable.NArchive::N7z::CHandler.0
mov dword [esi + 0xc], 0
call fcn.00408240
lea eax, [ebp - 0x28]
mov dword [esi + 0x1f0], 0
mov dword [esi + 0x1f4], 0
mov dword [esi + 0x1f8], 0
mov dword [esi + 0x1fc], 8
mov dword [esi + method.CBaseRecordVector.virtual_0], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
push eax
mov dword [esi + 0x1e8], 4
mov byte [esi + 0x1e0], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov dword [esi + 0x1e4], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045f17f
mov esp, ebp
pop ebp
ret
Function at 0x409760
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485280
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4b3014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x30]
xor edi, edi
mov dword [ebx + 0x1e0], eax
mov dword [ebp - 0x48], edi
cmp edi, dword [ebp + 0x14]
jge 0x409927
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov esi, dword [eax + edi*4]
xor edi, edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
cmp word [esi], di
je 0x4097fb
inc edi
cmp word [esi + edi*2], 0
jne 0x4097f3
push edi
lea ecx, [ebp - 0x20]
call fcn.004039c0
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x409810
mov dword [ebp - 0x1c], edi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_CharUpperW]
test edi, edi
jne 0x409845
push ebx
call fcn.0045f190
add esp, 4
mov eax, 0x80070057
jmp 0x409929
mov edi, dword [ebp - 0x48]
lea edx, [ebp - 0x48]
mov esi, edi
lea ecx, [ebp - 0x20]
shl esi, 4
add esi, dword [ebp - 0x4c]
call fcn.00410f10
test eax, eax
jne 0x409907
push 2
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00409d90
mov edx, 0x497a60
mov ecx, dword [eax]
call fcn.0041baf0
push dword [ebp - 0x5c]
test eax, eax
sete bl
call fcn.0045f190
add esp, 4
test bl, bl
je 0x4098f5
push 2
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x20]
call fcn.00409dc0
mov ecx, dword [ebp - 0x50]
mov edx, esi
add ecx, 0x1e0
mov byte [ebp - 4], 2
push ecx
push dword [ebp - 0x30]
mov ecx, eax
call fcn.00410f60
add esp, 8
mov byte [ebp - 4], 1
mov esi, eax
push dword [ebp - 0x68]
call fcn.0045f190
add esp, 4
test esi, esi
je 0x4098e0
push dword [ebp - 0x20]
call fcn.0045f190
add esp, 4
mov eax, esi
jmp 0x409929
mov byte [ebp - 4], 0
push dword [ebp - 0x20]
call fcn.0045f190
add esp, 4
inc edi
jmp 0x4097b6
push dword [ebp - 0x20]
call fcn.0045f190
add esp, 4
mov eax, 0x80070057
jmp 0x409929
push ebx
mov byte [ebp - 4], 0
call fcn.0045f190
add esp, 4
inc edi
jmp 0x4097b6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045f17f
mov esp, ebp
pop ebp
ret 0x10