joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428620
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, eax
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax]
cmp dword [ecx + ebx*4], 0
mov dword [esp + 4], ecx
jne 0x42877f
cmp dword [eax + 8], 8
push ebp
jge 0x4286ea
mov edx, dword [edi + 0xc]
mov eax, dword [edx + esi*4]
mov eax, dword [eax + 0xc]
mov ebp, dword [eax + 8]
inc ebp
push 0xc
mov dword [eax + 8], ebp
call fcn.00445619
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx + esi*4]
mov ecx, dword [edx + 0xc]
mov edx, dword [ecx]
mov dword [edx + ebx*4], eax
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
imul edx, dword [0x4f9790]
push edx
call fcn.00445619
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx + esi*4]
mov ecx, dword [edx + 0xc]
mov edx, dword [ecx]
mov ecx, dword [edx + ebx*4]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + ebx*4]
mov ecx, dword [eax]
add esp, 8
test ecx, ecx
jne 0x4286c2
push str.Internal_error:_not_enough_memory_for_cache_page._Aborting..._n
push 0x4a63f8
call fcn.004485a9
add esp, 8
push 0xffffffffffffffff
call fcn.00446a15
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx + esi*4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + ebx*4]
mov dword [edx + 4], 0
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ebx, dword [eax + ebx*4]
jmp 0x428777
push ebx
push esi
mov edx, edi
call fcn.004280f0
mov ecx, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [ecx + ebp*4]
add esp, 8
test eax, eax
je 0x42870e
mov edx, dword [eax]
and edx, 1
mov dword [esp + 8], edx
jne 0x42871a
push ebp
push esi
mov eax, edi
call fcn.00428480
add esp, 8
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + ebp*4]
mov dword [eax + ebx*4], ecx
mov edx, dword [edi + 0xc]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [edx + ebp*4], 0
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + ebx*4]
mov dword [ecx + 4], 0
mov edx, dword [edi + 0xc]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + ebx*4]
mov ecx, dword [0x4f9794]
mov dword [eax + 8], ecx
mov edx, dword [edi + 0xc]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov ebx, dword [edx + ebx*4]
test ebx, ebx
je 0x42877e
or dword [ebx], 1
pop ebp
pop ebx
pop ecx
ret
Function at 0x428db0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [0x4f9794]
lea eax, [esp + 4]
inc esi
push eax
mov dword [0x4f9794], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 8]
cmp eax, 0x100
mov dword [0x4f9790], eax
jge 0x428de6
mov dword [0x4f9790], 0x100
push 0x10
call fcn.00445619
mov esi, eax
add esp, 4
test esi, esi
jne 0x428dfb
pop esi
add esp, 0x24
ret
push edi
mov edi, dword [esp + 0x30]
mov eax, edi
mov word [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428e12
sub eax, edx
add eax, 8
push eax
call fcn.00445619
add esp, 4
test eax, eax
mov dword [esi + 4], eax
jne 0x428e36
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret
mov ecx, edi
mov edx, eax
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x428e40
test byte [0x4a44dc], 2
je 0x428e5a
push 0x489694
jmp 0x428e5f
push 0x4847ac
push edi
call fcn.00447f7a
add esp, 8
test eax, eax
mov dword [esi], eax
je 0x428e2e
call fcn.00428c50
xor ecx, ecx
test eax, eax
setl cl
pop edi
dec ecx
and ecx, esi
mov eax, ecx
pop esi
add esp, 0x24
ret

Function at 0x429710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x469f9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x20]
mov dword [esp + 8], esi
mov dword [esi], vtable._STL::ios_base.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
call fcn.0042bd80
lea ecx, [esi + 0x48]
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
call fcn.00403ae8
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4298c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469ff9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x30]
push edi
lea eax, [esp + 0x34]
push eax
mov esi, ecx
call fcn.00429370
mov ecx, dword [esi + 0x58]
test ecx, ecx
mov dword [esp + 0x24], 1
je 0x429916
push edi
lea edx, [esp + 0xc]
push edx
call fcn.00429190
lea ecx, [esp + 8]
call fcn.0042bdc0
push 0x4a4780
mov ecx, edi
call fcn.0042be10
push 0x4a478c
mov ecx, edi
mov dword [esi + 0x40], eax
call fcn.0042be10
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
mov dword [esi + 0x44], eax
call fcn.00433080
lea ecx, [esi + 0x48]
cmp eax, ecx
mov byte [esp + 0x24], 2
je 0x42995d
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea esi, [esp + 0x30]
push esi
push edx
push eax
call fcn.00402191
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub eax, ecx
test ecx, ecx
mov byte [esp + 0x24], 1
mov esi, ecx
je 0x4299ab
cmp eax, 0x80
jbe 0x429981
push ecx
call fcn.0045606b
jmp 0x4299a8
lea edi, [eax - 1]
shr edi, 3
push 0x4f97ac
lea edi, [edi*4 + 0x4f97b0]
call fcn.00429420
mov edx, dword [edi]
mov dword [esi], edx
mov dword [edi], esi
mov dword [0x4f97ac], 0
add esp, 4
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.0042bda0
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.0042bdc0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x429b80
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], 0xffffffff
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
cmp dword [0x4a4580], ebx
jne 0x429bb5
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0xc]
mov dword [0x4a4580], ecx
mov dword [esi + 4], ebx
cmp dword [0x4a4580], ebx
mov eax, esi
ja 0x429bcc
mov dword [0x4a4580], 0x1000
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x429be0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [ecx]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x429c0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x429c09
xor eax, eax
add esp, 8
ret
mov eax, dword [esp]
add esp, 8
ret
Function at 0x429e50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push edi
push 0
mov edi, ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test byte [edi + 8], 4
mov eax, dword [esp + 0xc]
jne 0x429f3d
test eax, eax
je 0x429f3d
push ebp
lea ebp, [eax + ebx - 1]
cmp ebx, ebp
mov ecx, ebx
push esi
mov esi, ebx
mov dword [esp + 0x10], ecx
ja 0x429f37
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ecx]
cmp al, 0x1a
je 0x429f22
cmp al, 0xd
je 0x429eb2
mov byte [esi], al
inc esi
jmp 0x429f07
cmp ecx, ebp
jae 0x429ec2
cmp byte [ecx + 1], 0xa
je 0x429f07
mov byte [esi], 0xd
inc esi
jmp 0x429f07
mov edx, dword [edi]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x30]
push ecx
push edx
mov byte [esp + 0x38], 0x20
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x429f03
cmp byte [esp + 0x24], 0xa
push 1
push 0
je 0x429efc
mov byte [esi], 0xd
mov eax, dword [edi]
push 0xffffffffffffffff
inc esi
push eax
jmp 0x429f01
mov ecx, dword [edi]
push 0xfffffffffffffffe
push ecx
call ebx
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, ebp
mov dword [esp + 0x10], ecx
jbe 0x429ea3
mov ebx, dword [esp + 0x20]
sub esi, ebx
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret 8
cmp ecx, ebp
ja 0x429f33
mov edx, dword [edi]
push 1
sub ebp, ecx
push 0
inc ebp
push ebp
push edx
call ebx
mov ebx, dword [esp + 0x20]
sub esi, ebx
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret 8

Function at 0x429f50
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
dec eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
je 0x429fac
dec eax
je 0x429fa5
sub eax, 2
jne 0x429fdc
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x429f96
call ebx
test eax, eax
je 0x429f92
xor eax, eax
jmp 0x429f96
mov eax, dword [esp + 0x14]
mov edx, edi
neg edx
cmp edx, eax
jg 0x429fdc
mov ecx, 2
jmp 0x429fb2
mov ecx, 1
jmp 0x429fb2
test edi, edi
jl 0x429fdc
xor ecx, ecx
push ecx
mov eax, edi
cdq
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], edx
mov edx, dword [esi]
push eax
push edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x429fec
call ebx
test eax, eax
je 0x429fe8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x42a340
Capabilities:
Read file via mapping

Disassembly:
sub esp, 8
push edi
push 0
push 0
push 0
push 2
mov edi, ecx
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
test ecx, ecx
mov dword [edi + 4], ecx
je 0x42a3e6
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x1c]
push ebx
push esi
mov eax, esi
cdq
push edx
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
test ebp, ebp
je 0x42a3c9
lea eax, [esi + ebx]
test eax, eax
jl 0x42a3c2
cdq
push 0
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], edx
mov edx, dword [edi]
push eax
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x42a3be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42a3c2
mov eax, dword [esp + 0x10]
test eax, eax
jge 0x42a3ef
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [edi + 4]
test eax, eax
je 0x42a3d7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword [edi + 4], eax
pop edi
add esp, 8
ret 8
xor eax, eax
pop edi
add esp, 8
ret 8
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 8
ret 8
Function at 0x42b635
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x44]
push edi
mov edi, dword [esi + 0x50]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x4c]
cmp edi, eax
jbe 0x42b669
jne 0x42b655
mov eax, ecx
mov dword [esi + 0x50], eax
jmp 0x42b66c
sub edi, eax
push edi
push eax
push ecx
call fcn.00445c80
add esp, 0xc
add eax, edi
mov dword [esi + 0x50], eax
jmp 0x42b66c
mov dword [esi + 0x50], ecx
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x48]
sub edx, eax
push edx
lea ecx, [esi + 0x24]
push eax
call fcn.00429e50
test eax, eax
jle 0x42b78d
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x50]
mov edi, dword [esi + 0x3c]
add ecx, eax
lea ebp, [esp + 0x14]
push ebp
push edx
push edi
mov eax, ecx
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x50], ecx
mov ecx, dword [esi + 0x58]
push eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x70]
mov ebx, dword [ecx]
lea eax, [esp + 0x28]
push eax
call dword [ebx + 8]
cmp eax, 3
je 0x42b731
cmp eax, 2
je 0x42b756
mov eax, dword [esi + 0x3c]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
mov edx, dword [esp + 0x18]
je 0x42b6dd
cmp edx, dword [esi + 0x44]
je 0x42b756
xor ebx, ebx
cmp byte [esi + 0x34], bl
je 0x42b6f7
mov edi, ecx
sub edi, eax
sar edi, 1
imul edi, dword [esi + 0x74]
mov ebp, edx
sub ebp, dword [esi + 0x44]
cmp edi, ebp
jne 0x42b758
cmp ecx, eax
jne 0x42b73c
mov ebp, dword [esi + 0x44]
mov edi, edx
sub edi, ebp
cmp edi, dword [esi + 0x78]
jge 0x42b758
cmp ecx, eax
jne 0x42b73c
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
sub ecx, eax
push ecx
push eax
lea ecx, [esi + 0x24]
call fcn.00429e50
cmp eax, ebx
jg 0x42b686
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
mov eax, dword [esi + 0x3c]
pop edi
mov dword [esi + 0x4c], edx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ax, word [eax]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor ebx, ebx
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x42b777
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x42b774
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x28], ebx
mov byte [esi + 0x37], bl
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x38], bl
mov byte [esi + 0x39], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0xc
ret
push esi
mov esi, ecx
mov al, byte [esi + 0x37]
test al, al
jne 0x42b96a
call fcn.0042b580
test al, al
jne 0x42b990
mov eax, 0xffff
pop esi
ret
mov al, byte [esi + 0x3a]
test al, al
je 0x42b990
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x6c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x68]
cmp eax, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov byte [esi + 0x3a], 0
je 0x42b990
mov ax, word [eax]
pop esi
ret
mov ecx, esi
pop esi
jmp 0x42b630
Function at 0x42b950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x44]
push edi
mov edi, dword [esi + 0x50]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x4c]
cmp edi, eax
jbe 0x42b669
jne 0x42b655
mov eax, ecx
mov dword [esi + 0x50], eax
jmp 0x42b66c
sub edi, eax
push edi
push eax
push ecx
call fcn.00445c80
add esp, 0xc
add eax, edi
mov dword [esi + 0x50], eax
jmp 0x42b66c
mov dword [esi + 0x50], ecx
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x48]
sub edx, eax
push edx
lea ecx, [esi + 0x24]
push eax
call fcn.00429e50
test eax, eax
jle 0x42b78d
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x50]
mov edi, dword [esi + 0x3c]
add ecx, eax
lea ebp, [esp + 0x14]
push ebp
push edx
push edi
mov eax, ecx
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x50], ecx
mov ecx, dword [esi + 0x58]
push eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x70]
mov ebx, dword [ecx]
lea eax, [esp + 0x28]
push eax
call dword [ebx + 8]
cmp eax, 3
je 0x42b731
cmp eax, 2
je 0x42b756
mov eax, dword [esi + 0x3c]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
mov edx, dword [esp + 0x18]
je 0x42b6dd
cmp edx, dword [esi + 0x44]
je 0x42b756
xor ebx, ebx
cmp byte [esi + 0x34], bl
je 0x42b6f7
mov edi, ecx
sub edi, eax
sar edi, 1
imul edi, dword [esi + 0x74]
mov ebp, edx
sub ebp, dword [esi + 0x44]
cmp edi, ebp
jne 0x42b758
cmp ecx, eax
jne 0x42b73c
mov ebp, dword [esi + 0x44]
mov edi, edx
sub edi, ebp
cmp edi, dword [esi + 0x78]
jge 0x42b758
cmp ecx, eax
jne 0x42b73c
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
sub ecx, eax
push ecx
push eax
lea ecx, [esi + 0x24]
call fcn.00429e50
cmp eax, ebx
jg 0x42b686
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
mov eax, dword [esi + 0x3c]
pop edi
mov dword [esi + 0x4c], edx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ax, word [eax]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor ebx, ebx
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x42b777
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x42b774
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x28], ebx
mov byte [esi + 0x37], bl
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x38], bl
mov byte [esi + 0x39], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 0xc
ret
push esi
mov esi, ecx
mov al, byte [esi + 0x37]
test al, al
jne 0x42b96a
call fcn.0042b580
test al, al
jne 0x42b990
mov eax, 0xffff
pop esi
ret
mov al, byte [esi + 0x3a]
test al, al
je 0x42b990
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x6c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x68]
cmp eax, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov byte [esi + 0x3a], 0
je 0x42b990
mov ax, word [eax]
pop esi
ret
mov ecx, esi
pop esi
jmp 0x42b630
Function at 0x430350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push edi
lea ecx, [esp + 0xc]
call fcn.00403ae8
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xb]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x30]
push 0x20
push 0
push 0
push edx
push 0xa
push eax
push ecx
mov dword [esp + 0x44], 0
mov byte [esp + 0x2f], 0
call fcn.00430420
mov ecx, dword [esp + 0x30]
mov bl, al
mov eax, dword [esp + 0x38]
add esp, 0x24
sub eax, ecx
test ecx, ecx
mov edi, ecx
je 0x43040a
cmp eax, 0x80
jbe 0x4303de
push ecx
call fcn.0045606b
add esp, 4
pop edi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push esi
lea esi, [eax - 1]
shr esi, 3
push 0x4f97ac
lea esi, [esi*4 + 0x4f97b0]
call fcn.00429420
mov edx, dword [esi]
mov dword [edi], edx
add esp, 4
mov dword [esi], edi
mov dword [0x4f97ac], 0
pop esi
mov ecx, dword [esp + 0x18]
pop edi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x432230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push edi
lea ecx, [esp + 0xc]
call fcn.00403ae8
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xb]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x30]
push 0x20
push 0
push 0
push edx
push 0xa
push eax
push ecx
mov dword [esp + 0x44], 0
mov byte [esp + 0x2f], 0
call fcn.00432300
mov ecx, dword [esp + 0x30]
mov bl, al
mov eax, dword [esp + 0x38]
add esp, 0x24
sub eax, ecx
test ecx, ecx
mov edi, ecx
je 0x4322ea
cmp eax, 0x80
jbe 0x4322be
push ecx
call fcn.0045606b
add esp, 4
pop edi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push esi
lea esi, [eax - 1]
shr esi, 3
push 0x4f97ac
lea esi, [esi*4 + 0x4f97b0]
call fcn.00429420
mov edx, dword [esi]
mov dword [edi], edx
add esp, 4
mov dword [esi], edi
mov dword [0x4f97ac], 0
pop esi
mov ecx, dword [esp + 0x18]
pop edi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x43c3fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x43c450
call fcn.0045f481
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x43c450
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x43c446
xor eax, eax
jmp 0x43c569
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x43c480
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x43c480
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x43c566
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x43c4ad
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0043da30
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x43c566
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43c4f6
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x43c4f6
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x43c4f0
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0043da30
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x43c556
and dword [ebp + 0xc], 0
jmp 0x43c556
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x43c556
push 0xc
call fcn.0045603b
mov esi, eax
test esi, esi
pop ecx
je 0x43c538
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x43c53a
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x43c551
push dword [ebp - 8]
call fcn.00454ddd
jmp 0x43c556
call fcn.00454db4
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x43c4bb
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc