joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x110]
mov edx, dword [esi + 0x114]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
cmp ecx, 0xffffffff
jne 0x442880
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call fcn.006be508
add esp, 4
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x4428af
mov ecx, 6
mov dword [esi + 0xf0], 6
call fcn.0044c110
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
mov eax, edx
mov ecx, dword [ebp - 4]
and eax, ecx
cmp eax, 0xffffffff
je 0x4428d4
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x28]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 8], eax
jmp 0x4428db
mov dword [ebp - 8], 0
xor ebx, ebx
xor edi, edi
nop
mov eax, edx
and eax, ecx
cmp eax, 0xffffffff
je 0x4428f8
mov eax, edi
xor ecx, ecx
add eax, edx
mov dword [ebp - 0x20], eax
adc ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
push dword [ebp - 8]
mov eax, dword [esi + 0x10c]
lea ecx, [ebp - 0x14]
push ecx
push dword [eax + ebx*8]
push dword [eax + ebx*8 + 4]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x14]
inc ebx
test eax, eax
je 0x44294f
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp ebx, dword [esi + 0x108]
jb 0x4428e0
mov dword [esi + 0x48], edi
cmp edi, 0xffffffff
jne 0x442948
call fcn.006a3906
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.0044c110
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x44292b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [esi + 0xf0], eax
call fcn.0044c110
pop edi
mov dword [esi + 0x48], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442ab0
Capabilities:
Create directory

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xf4]
call fcn.006c0d31
add esp, 4
mov dword [esi + 0x48], eax
cmp eax, 0xffffffff
jne 0x442ade
call fcn.006a3906
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.0044c110
mov dword [esi + 0x48], eax
pop esi
ret
Function at 0x4438b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
push ebx
push esi
mov dword [ebp - 0x18], eax
mov ecx, dword [eax + 0xf4]
mov esi, dword [eax + 0x118]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0x104]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0x110]
mov eax, dword [eax + 0x114]
mov dword [ebp - 0xc], eax
mov eax, 0x10000
cmp esi, eax
mov dword [ebp - 8], ecx
push edi
cmovb eax, esi
xor edi, edi
push eax
mov dword [ebp - 0x10], eax
call fcn.006a66fd
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x443913
mov edx, str.malloc
lea ecx, [edi + 0xe]
call fcn.0044c080
mov eax, dword [ebp - 8]
mov ecx, eax
mov edx, dword [ebp - 0xc]
and ecx, edx
cmp ecx, 0xffffffff
je 0x443938
push 0
push edx
push eax
push dword [ebp - 4]
call fcn.006c213c
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x44397a
test esi, esi
je 0x44397d
nop dword [eax]
mov eax, dword [ebp - 0x10]
cmp esi, eax
cmovb eax, esi
push eax
push ebx
push dword [ebp - 4]
call fcn.006c26e2
add esp, 0xc
test eax, eax
je 0x44397d
cmp eax, 0xffffffff
je 0x44397a
push eax
push ebx
push dword [ebp - 0x14]
sub esi, eax
call fcn.006c3438
add esp, 0xc
cmp eax, 0xffffffff
je 0x44397a
add edi, eax
test esi, esi
jne 0x443940
jmp 0x44397d
or edi, 0xffffffff
push ebx
call fcn.006a389b
mov esi, dword [ebp - 0x18]
add esp, 4
mov dword [esi + 0x48], edi
cmp edi, 0xffffffff
jne 0x4439a6
call fcn.006a3906
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.0044c110
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4439b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xf4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4439dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [esi + 0xf0], eax
call fcn.0044c110
mov dword [esi + 0x48], eax
pop esi
ret
test byte [esi + 0xec], 2
je 0x443a02
test al, 0x11
je 0x443a02
mov ecx, 0xfffff030
mov dword [esi + 0xf0], 0xfffff030
call fcn.0044c110
mov dword [esi + 0x48], eax
pop esi
ret
mov dword [esi + 0x48], 0
pop esi
ret
Function at 0x445fa0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x130], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov edi, eax
mov dword [ebp - 0x12c], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x44601b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
cmp dword [ebp - 0x124], edi
je 0x44600e
lea eax, [ebp - 0x12c]
push eax
push esi
call ebx
test eax, eax
jne 0x445ff6
jmp 0x44601a
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x130], eax
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x130]
xor ecx, ebp
pop edi
pop esi
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x44d600
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x410]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44d637
mov edx, str.WSAStartup
mov ecx, eax
call fcn.0044c080
xorps xmm0, xmm0
mov eax, 2
movups xmmword [0xac3460], xmm0
push 0
mov word [0xac3460], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, 0xac3464
mov word [0xac3462], ax
mov ecx, str.0.0.0.0
call fcn.0044bb70
test eax, eax
jne 0x44d84c
push 0xac3480
xor edx, edx
mov ecx, 0x7709c0
call fcn.0042c6f0
add esp, 4
test eax, eax
jne 0x44d851
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x44d738
push 0x274
lea eax, [ebp - 0x280]
push 0
push eax
call fcn.00689b00
add esp, 0xc
mov dword [ebp - 0x414], 0x274
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x280]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x44d707
call esi
mov edx, str.getsockopt
mov ecx, eax
call fcn.0044c080
mov dword [0xac34a0], 1
jmp 0x44d723
test dword [ebp - 0x280], 0x20000
mov ecx, 1
mov eax, dword [0xac34a0]
cmove eax, ecx
mov dword [0xac34a0], eax
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x44d76a
call esi
mov edx, str.closesocket
jmp 0x44d763
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x273b
je 0x44d76a
cmp eax, 0x273c
je 0x44d76a
cmp eax, 0x273e
je 0x44d76a
cmp eax, 0x273f
je 0x44d76a
call esi
mov edx, str.socket
mov ecx, eax
call fcn.0044c080
push 0
push 1
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x44d810
push 0x274
lea eax, [ebp - 0x280]
push 0
push eax
call fcn.00689b00
add esp, 0xc
mov dword [ebp - 0x414], 0x274
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x280]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x44d7df
call esi
mov edx, str.getsockopt
mov ecx, eax
call fcn.0044c080
mov dword [0xac349c], 1
jmp 0x44d7fb
test dword [ebp - 0x280], 0x20000
mov ecx, 1
mov eax, dword [0xac349c]
cmove eax, ecx
mov dword [0xac349c], eax
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x44d83c
call esi
mov edx, str.closesocket
jmp 0x44d835
call esi
cmp eax, 0x273b
je 0x44d83c
cmp eax, 0x273c
je 0x44d83c
cmp eax, 0x273e
je 0x44d83c
cmp eax, 0x273f
je 0x44d83c
call esi
mov edx, str.socket
mov ecx, eax
call fcn.0044c080
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00682c16
mov esp, ebp
pop ebp
ret
call fcn.006bd90b
call fcn.006bd90b
int3
Function at 0x44e430
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
push ebx
mov dword [ebp - 0x48], ecx
or ebx, 0xffffffff
mov ecx, dword [ebp + 0xc]
mov eax, ecx
and eax, 0x10
push esi
push edi
mov edi, eax
mov dword [ebp - 0x4c], eax
neg edi
mov esi, edx
sbb edi, edi
and edi, 0x80000100
neg eax
sbb eax, eax
and eax, 3
and ecx, 0x20
mov dword [ebp + 0xc], ecx
je 0x44e480
or eax, 1
or edi, 0x40000080
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x48]
push eax
call fcn.004395c0
add esp, 0xc
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x44e53b
push eax
mov dword [ebp - 0x58], eax
mov eax, dword [esi + 0x90]
neg eax
mov dword [ebp - 0x5c], 0xc
mov dword [ebp - 0x54], 1
sbb eax, eax
and eax, 0x40000000
push eax
push 3
lea eax, [ebp - 0x5c]
push eax
push 0
push edi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44e4e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x44e53e
push 0
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x44e509
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x217
je 0x44e509
call edi
mov edi, eax
jmp 0x44e53e
cmp dword [ebp - 0x4c], 0
je 0x44e516
or dword [esi + 0x2c], 0x10000
cmp dword [ebp + 0xc], 0
je 0x44e523
or dword [esi + 0x2c], 0x8000
mov eax, dword [ebp - 0x50]
pop edi
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00682c16
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x48]
cmp dword [esi + 0x94], 0xffffffff
je 0x44e54e
mov edx, esi
call fcn.0043a120
cmp ebx, 0xffffffff
je 0x44e55a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x44f43c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [0xac12e8]
inc ebx
push edi
test esi, esi
jne 0x44f4d4
push 0x274
push ebx
call fcn.006af1ed
pop ecx
pop ecx
mov edx, eax
mov dword [0xac12e8], eax
mov ecx, ebx
call fcn.0044f0cc
test eax, eax
jne 0x44f4ca
push dword [0xac12e8]
call fcn.006a389b
or dword [0xac12e8], 0xffffffff
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0044eef7
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 6
push ebx
push 2
push str.CreateNonLSPSocket___GetBaseProviderInfo_fail__af_d__type_d__protocol_d__Protocol_List:_n_s_n
push 0x6a
push str.arkhttp
push 0x7d0
call fcn.0041c482
add esp, 0x20
lea ecx, [ebp - 0x1c]
push esi
push ebx
call fcn.004191aa
mov esi, dword [0xac12e8]
test esi, esi
je 0x44f4d9
cmp esi, 0xffffffff
jne 0x44f4db
xor esi, esi
push ebx
push 0
push esi
push 6
push ebx
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44f586
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
push eax
push esi
push 6
push 1
push 2
push str.CreateNonLSPSocket__WSASocket_fail__af_d__type_d__protocol_d__info0x_p__err_d
push 0x75
push str.arkhttp
push 0x7d0
call fcn.0041c482
mov esi, dword [sym.imp.WS2_32.dll_socket]
add esp, 0x24
push 6
push 1
push 2
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x44f586
call ebx
push eax
push 6
push 1
push 2
push str.CreateNonLSPSocket__socket_fail__af_d__type_d__protocol_d__err_d
push 0x7a
push str.arkhttp
push 0x7d0
call fcn.0041c482
add esp, 0x20
push 0
push 1
push 2
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x44f586
call ebx
push eax
push 0
push 1
push 2
push str.CreateNonLSPSocket__socket_fail__af_d__type_d__protocol_d__err_d
push 0x7f
push str.arkhttp
push 0x7d0
call fcn.0041c482
add esp, 0x20
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x44f9e3
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov bl, dl
mov esi, ecx
push edi
cmp bl, 0x20
je 0x44fbe8
cmp bl, 0xd
je 0x44fbe8
cmp bl, 0xa
je 0x44fbe8
cmp bl, 9
je 0x44fbe8
cmp bl, 0xc
je 0x44fbe8
xor edi, edi
lea eax, [esi - 0x14]
inc edi
cmp eax, 0xb
ja case.default.0x44fa26
jmp dword [eax*4 + 0x44fbef]
cmp bl, 0x2f
je 0x44fa4a
cmp bl, 0x2a
je 0x44fa4a
or bl, 0x20
sub bl, 0x61
cmp bl, 0x19
ja case.default.0x44fa26
push 0x15
jmp 0x44fa4c
push 0x1b
pop eax
jmp 0x44fbeb
mov al, bl
or al, 0x20
sub al, 0x61
cmp al, 0x19
ja 0x44fa63
mov eax, esi
jmp 0x44fbeb
cmp bl, 0x3a
jne case.default.0x44fa26
push 0x16
jmp 0x44fa4c
cmp bl, 0x2f
jne case.default.0x44fa26
push 0x17
jmp 0x44fa4c
cmp bl, 0x2f
jne case.default.0x44fa26
push 0x18
jmp 0x44fa4c
cmp bl, 0x40
je 0x44fbe8
cmp bl, 0x2f
je 0x44fa4a
cmp bl, 0x3f
jne 0x44faa1
push 0x1c
jmp 0x44fa4c
cmp bl, 0x40
jne 0x44faaa
push 0x1a
jmp 0x44fa4c
mov al, bl
or al, 0x20
cmp al, 0x61
jb 0x44fab6
cmp al, 0x7a
jbe 0x44fb23
cmp bl, 0x30
jl 0x44fac0
cmp bl, 0x39
jle 0x44fb23
cmp bl, 0x2d
je 0x44fb23
cmp bl, 0x5f
je 0x44fb23
cmp bl, 0x2e
je 0x44fb23
cmp bl, 0x21
je 0x44fb23
cmp bl, 0x7e
je 0x44fb23
cmp bl, 0x2a
je 0x44fb23
cmp bl, 0x27
je 0x44fb23
cmp bl, 0x28
je 0x44fb23
cmp bl, 0x29
je 0x44fb23
cmp bl, 0x25
je 0x44fb23
cmp bl, 0x3b
je 0x44fb23
cmp bl, 0x3a
je 0x44fb23
cmp bl, 0x26
je 0x44fb23
cmp bl, 0x3d
je 0x44fb23
cmp bl, 0x2b
je 0x44fb23
cmp bl, 0x24
je 0x44fb23
cmp bl, 0x2c
je 0x44fb23
cmp bl, 0x5b
je 0x44fb23
cmp bl, 0x5d
jne case.default.0x44fa26
push 0x19
jmp 0x44fa4c
movzx edx, bl
mov eax, edi
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x765500], al
jne 0x44fa5c
cmp bl, 0x23
je 0x44fb58
cmp bl, 0x3f
jne case.default.0x44fa26
jmp 0x44fa9d
push 0x1e
jmp 0x44fa4c
movzx edx, bl
mov eax, edi
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x765500], al
je 0x44fb7d
push 0x1d
jmp 0x44fa4c
cmp bl, 0x23
je 0x44fb58
cmp bl, 0x3f
jne case.default.0x44fa26
jmp 0x44fb76
movzx edx, bl
mov eax, edi
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x765500], al
je 0x44fba7
push 0x1f
jmp 0x44fa4c
cmp bl, 0x23
je 0x44fa5c
cmp bl, 0x3f
jne case.default.0x44fa26
jmp 0x44fba0
movzx edx, bl
mov eax, edi
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + 0x765500], al
jne 0x44fa5c
cmp bl, 0x23
je 0x44fa5c
cmp bl, 0x3f
je 0x44fa5c
mov eax, edi
jmp 0x44fbeb
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x451adc
Capabilities:
Parse credit card information

Disassembly:
lea eax, [ecx - 2]
cmp eax, 0xa
ja case.default.0x451ae8
jmp dword [eax*4 + 0x451c4c]
cmp dl, 0x40
jne 0x451af8
push 4
pop eax
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x451b04
cmp al, 0x7a
jbe 0x451b67
cmp dl, 0x30
jl 0x451b0e
cmp dl, 0x39
jle 0x451b67
cmp dl, 0x2d
je 0x451b67
cmp dl, 0x5f
je 0x451b67
cmp dl, 0x2e
je 0x451b67
cmp dl, 0x21
je 0x451b67
cmp dl, 0x7e
je 0x451b67
cmp dl, 0x2a
je 0x451b67
cmp dl, 0x27
je 0x451b67
cmp dl, 0x28
je 0x451b67
cmp dl, 0x29
je 0x451b67
cmp dl, 0x25
je 0x451b67
cmp dl, 0x3b
je 0x451b67
cmp dl, 0x3a
je 0x451b67
cmp dl, 0x26
je 0x451b67
cmp dl, 0x3d
je 0x451b67
cmp dl, 0x2b
je 0x451b67
cmp dl, 0x24
je 0x451b67
cmp dl, 0x2c
jne case.default.0x451ae8
push 3
pop eax
ret
cmp dl, 0x5b
jne 0x451b74
push 5
pop eax
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x451b80
cmp al, 0x7a
jbe 0x451b98
cmp dl, 0x30
jl 0x451b8a
cmp dl, 0x39
jle 0x451b98
cmp dl, 0x2e
je 0x451b98
cmp dl, 0x2d
jne case.default.0x451ae8
push 6
pop eax
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x451ba8
cmp al, 0x7a
jbe 0x451b98
cmp dl, 0x30
jl 0x451bb2
cmp dl, 0x39
jle 0x451b98
cmp dl, 0x2e
je 0x451b98
cmp dl, 0x2d
je 0x451b98
cmp dl, 0x3a
jne case.default.0x451ae8
push 0xb
pop eax
ret
cmp dl, 0x5d
jne case.0x451ae8.5
push 8
pop eax
ret
cmp dl, 0x30
jl 0x451bdc
cmp dl, 0x39
jle 0x451c00
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x451be8
cmp al, 0x66
jbe 0x451c00
cmp dl, 0x3a
je 0x451c00
cmp dl, 0x2e
je 0x451c00
cmp ecx, 7
jne case.default.0x451ae8
cmp dl, 0x25
jne case.default.0x451ae8
push 9
pop eax
ret
push 7
pop eax
ret
cmp dl, 0x5d
je 0x451bce
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x451c15
cmp al, 0x7a
jbe 0x451c38
cmp dl, 0x30
jl 0x451c1f
cmp dl, 0x39
jle 0x451c38
cmp dl, 0x25
je 0x451c38
cmp dl, 0x2e
je 0x451c38
cmp dl, 0x2d
je 0x451c38
cmp dl, 0x5f
je 0x451c38
cmp dl, 0x7e
jne case.default.0x451ae8
push 0xa
pop eax
ret
sub dl, 0x30
cmp dl, 9
ja case.default.0x451ae8
push 0xc
pop eax
ret
xor eax, eax
inc eax
ret
Function at 0x452e30
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e0cd6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7b088c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x118]
mov dword [ebp - 4], 0
mov ecx, esi
push dword [esi + 8]
mov dword [esi], vtable.CBaseRecordVector.0
push 0
call fcn.0045cde0
push dword [esi + 0xc]
call fcn.00682d6d
add esp, 4
mov dword [esi + 4], 0
lea ecx, [edi + 0xf0]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.00453140
lea ecx, [edi + 0xc8]
call fcn.00453140
lea ecx, [edi + 0xa0]
call fcn.00453140
lea ecx, [edi + 0x78]
call fcn.00453140
mov dword [ebp - 4], 1
lea ecx, [edi + 0x64]
push dword [edi + 0x6c]
mov dword [edi + 0x64], vtable.CObjectVector_struct_NArchive::N7z::CFileItem_.0
push 0
call fcn.00454cc0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x64]
push dword [edi + 0x6c]
mov dword [edi + 0x64], vtable.CBaseRecordVector.0
push 0
call fcn.0045cde0
push dword [edi + 0x70]
call fcn.00682d6d
add esp, 4
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [ebp - 4], 3
lea ecx, [edi + 0x50]
push dword [edi + 0x58]
mov dword [edi + 0x50], vtable.CBaseRecordVector.0
push 0
call fcn.0045cde0
push dword [edi + 0x5c]
call fcn.00682d6d
add esp, 4
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [ebp - 4], 4
lea ecx, [edi + 0x3c]
push dword [edi + 0x44]
mov dword [edi + 0x3c], vtable.CObjectVector_struct_NArchive::N7z::CFolder_.0
push 0
call fcn.00454e30
mov byte [ebp - 4], 5
lea ecx, [edi + 0x3c]
push dword [edi + 0x44]
mov dword [edi + 0x3c], vtable.CBaseRecordVector.0
push 0
call fcn.0045cde0
push dword [edi + 0x48]
call fcn.00682d6d
add esp, 4
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [ebp - 4], 6
lea ecx, [edi + 0x28]
push dword [edi + 0x30]
mov dword [edi + 0x28], vtable.CBaseRecordVector.0
push 0
call fcn.0045cde0
push dword [edi + 0x34]
call fcn.00682d6d
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [ebp - 4], 7
lea ecx, [edi + 0x14]
push dword [edi + 0x1c]
mov dword [edi + 0x14], vtable.CBaseRecordVector.0
push 0
call fcn.0045cde0
push dword [edi + 0x20]
call fcn.00682d6d
add esp, 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 8
mov ecx, edi
push dword [edi + 8]
mov dword [edi], vtable.CBaseRecordVector.0
push 0
call fcn.0045cde0
push dword [edi + 0xc]
call fcn.00682d6d
add esp, 4
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4531f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e0db4
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x7b088c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.ISetProperties.0
mov dword [esi + 8], 0
mov dword [esi], vtable.NArchive::N7z::CHandler.1.0
mov dword [esi + 4], vtable.NArchive::N7z::CHandler.0
mov dword [esi + 0xc], 0
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.004532f0
mov dword [esi + 0x1ec], 0
mov dword [esi + 0x1f0], 0
mov dword [esi + 0x1f4], 0
mov dword [esi + 0x1f8], 8
mov dword [esi + method.CRecordVector_unsigned_long_long_unsigned___int64__.virtual_0], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
mov dword [esi + 0x1e4], 4
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x1e0], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x454880
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e0fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x7b088c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x4c]
mov dword [ecx + 0x1dc], eax
xor eax, eax
mov edx, 2
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp + 0x14]
jge 0x454a33
mov ecx, dword [ebp + 0xc]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov ebx, dword [ecx + eax*4]
cmp word [ebx], si
je 0x4548fa
inc esi
cmp word [ebx + esi*2], di
jne 0x4548f3
lea eax, [esi + 1]
test eax, eax
je 0x454925
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00682d64
mov edi, eax
add esp, 4
xor eax, eax
mov dword [ebp - 0x24], edi
mov word [edi], ax
lea eax, [esi + 1]
mov dword [ebp - 0x1c], eax
mov ecx, edi
sub ebx, edi
nop dword [eax]
movzx eax, word [ebx + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
test ax, ax
jne 0x454930
mov dword [ebp - 0x20], esi
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_CharUpperW]
test esi, esi
jne 0x454974
push edi
call fcn.00682d6d
add esp, 4
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
shl esi, 4
lea ecx, [ebp - 0x24]
add esi, dword [ebp + 0x10]
call fcn.0045d170
test eax, eax
jne 0x454a1d
push 2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x24]
call fcn.00455220
mov edx, 0x771548
mov ecx, dword [eax]
call fcn.0045d3b0
push dword [ebp - 0x30]
test eax, eax
sete bl
call fcn.00682d6d
add esp, 4
test bl, bl
je 0x454952
push 2
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00455250
mov ecx, dword [ebp + 8]
mov edx, esi
add ecx, 0x1dc
mov byte [ebp - 4], 2
push ecx
push dword [ebp - 0x4c]
mov ecx, eax
call fcn.0045d1c0
add esp, 8
mov byte [ebp - 4], 1
mov esi, eax
push dword [ebp - 0x3c]
call fcn.00682d6d
add esp, 4
push edi
test esi, esi
je 0x454a1e
call fcn.00682d6d
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
mov byte [ebp - 4], 0
call fcn.00682d6d
mov eax, dword [ebp - 0x14]
add esp, 4
inc eax
jmp 0x4548ca
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10