joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dcbd1
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
je 0x5dcbbb
jne 0x5dcbbb
lcall 0x749a, 0x3eb037c
sti
jl 0x5dcbc0
jmp 0x5dcbc2
je 0x5dcbbd
pushf
push 0xa
jae 0x5dcbcf
jmp 0x5dcbca
call 0x5dcbd1
jae 0x5dcbca
add esp, 4
jmp 0x5dcbd6
dec dword [esp]
jno 0x5dcbdb
jns 0x5dcbc6
jp 0x5dcbdf
add esp, 4
popf
jmp 0x5dcbe6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5dcbff
inc edx
lcall 0x50e8, 0x1750374
je 0x5dcc04
jne 0x5dcc04
call 0x101dff58
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5dcc1e
jne 0x5dcc1d
call 0x8361bca5
rol byte [ebx + eax*4], 0xf0
add eax, 0xf445c7
add byte [eax], al
add byte [eax + 0x11], ch
leave
jl 0x5dcc40
xor eax, 3
add eax, 4
xor eax, 5
mov dword [ebp - 0xc], 0
push 0xd7cc911
lea ecx, [ebp - 0x29]
call fcn.005d1cc0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
clc
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x29]
call fcn.005d8320
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
push 0
call sub.WTSAPI32.dll_WTSSendMessageA
cmp dword [ebp + 0xc], 1
jne 0x5dcca8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
je 0x5dccad
jne 0x5dccad
test byte [ebx + eax - 0x15], bh
add eax, dword [esp + esi*2 + 0x6a9c66fb]
or dh, byte [ebx + 7]
jl 0x5dccb2
jmp 0x5dccb4
je 0x5dccaf
pushf
push 0xa
jae 0x5dccc1
jmp 0x5dccbc
call 0x5dccc3
jae 0x5dccbc
add esp, 4
jmp 0x5dccc8
dec dword [esp]
jno 0x5dcccd
jns 0x5dccb8
jp 0x5dccd1
add esp, 4
popf
jmp 0x5dccd8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5dccf1
movsd dword es:[edi], dword [esi]
test byte [ebx + eax + 0x75], dh
add eax, ebp
je 0x5dccf6
jne 0x5dccf6
call 0x101e004a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5dcd10
jne 0x5dcd0f
call 0x8361bd97
rol byte [ebx + eax*4], 0xf0
add eax, 0xc35de58b
int3
xor eax, 3
add eax, 4
xor eax, 5
mov esp, ebp
pop ebp
ret
Function at 0x40452b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040348c
and dword [ebp - 0x14], 0
cmp dword [0x40b924], 0
mov dword [ebp - 0x18], eax
jne 0x4045de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404686
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404686
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b924], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b928], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b92c], eax
call edi
push eax
call esi
mov dword [0x40b934], eax
test eax, eax
je 0x4045de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b930], eax
mov eax, dword [0x40b930]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x404637
cmp dword [0x40b934], ecx
je 0x404637
push eax
call esi
push dword [0x40b934]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404637
test ebx, ebx
je 0x404637
call edi
test eax, eax
je 0x40462e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40462e
test byte [ebp - 8], 1
jne 0x404637
or dword [ebp + 0x10], 0x200000
jmp 0x40466a
mov eax, dword [0x40b928]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40466a
mov eax, dword [0x40b92c]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b924]
call esi
test eax, eax
je 0x404686
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404688
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404896
leave
ret

Function at 0x404896
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a700]
jne 0x4048a0
repz ret
jmp fcn.00405a36

Function at 0x4015d4
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x10
sub ecx, edx
pop esi
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
dec esi
jne 0x4015da
pop esi
ret

Function at 0x4015e5
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor edi, edi
movzx eax, byte [edi + ecx]
mov esi, edi
shl esi, 8
xor esi, eax
xor esi, edx
mov al, byte [esi + 0x402230]
mov byte [edi + ecx], al
inc edi
cmp edi, 0x10
jb 0x4015e9
pop edi
pop esi
ret
Function at 0x401170
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xea0
mov esi, esp
mov dword [esi + 0xe88], ebp
lea eax, [esi + 0xe90]
mov edi, ecx
mov dword [esi + 0x80], edx
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x456c70
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword fs:[0], eax
call fcn.004011bd
Function at 0x41109f
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
cmp byte [esp + 0x40], 0
mov esi, ecx
je 0x4110c5
mov ecx, esi
push 5
push str._re_2Ke__25he__25lC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fconsole_0.15.5_src_term.rs
call fcn.00410286
add esp, 0x34
jmp 0x411178
xor eax, eax
cmp byte [edx + 0x20], 0
sete al
or eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, eax
lea ebx, [esp + 0x14]
xor eax, eax
xorps xmm0, xmm0
mov dword [ebx + 0xe], eax
mov dword [ebx + 0x12], eax
movups xmmword [ebx], xmm0
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x411172
movzx eax, word [esp + 0x1c]
movzx ebp, word [esp + 0x1a]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x22]
sub ax, word [esp + 0x1e]
mov dword [esp + 0x14], 0
movsx ecx, ax
xor eax, eax
mov word [esp], ax
mov dword [esp + 0xc], ecx
mov word [esp + 2], bp
mov eax, dword [esp]
push ebx
push eax
push ecx
push 0x20
push edi
call dword [sym.imp.kernel32.dll_FillConsoleOutputCharacterA]
xor eax, eax
mov word [esp + 4], ax
mov word [esp + 6], bp
mov eax, dword [esp + 4]
push ebx
push eax
push dword [esp + 0x14]
push dword [esp + 0x1c]
push edi
call dword [sym.imp.kernel32.dll_FillConsoleOutputAttribute]
xor eax, eax
mov word [esp + 8], ax
mov word [esp + 0xa], bp
mov eax, dword [esp + 8]
push eax
push edi
call dword [sym.imp.kernel32.dll_SetConsoleCursorPosition]
mov byte [esi], 4
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x411272
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov ebp, dword [esp + 0x5c]
mov ebx, dword [esp + 0x58]
cmp byte [esp + 0x54], 0
mov edi, edx
mov esi, ecx
je 0x411305
inc ebx
lea ecx, [esp + 8]
lea eax, [esp + 4]
mov edx, fcn.00411e00
inc ebp
mov dword [ecx], ebx
lea ebx, [esp + 0x30]
mov dword [eax], ebp
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
lea edx, [esp + 0x18]
mov dword [edx], 0x469544
mov dword [edx + 4], 3
mov dword [edx + 0x10], 0
mov dword [edx + 8], ebx
lea ebx, [esp + 0xc]
mov dword [edx + 0xc], 2
mov ecx, ebx
call fcn.0040e430
mov ebp, dword [ebx]
mov ecx, esi
mov esi, dword [ebx + 4]
mov edx, edi
push dword [ebx + 8]
push ebp
call fcn.00410286
add esp, 8
test esi, esi
je 0x41134f
push ebp
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x41134f
xor eax, eax
cmp byte [edi + 0x20], 0
sete al
or eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, eax
lea ecx, [esp + 0x18]
xor eax, eax
xorps xmm0, xmm0
mov dword [ecx + 0xe], eax
mov dword [ecx + 0x12], eax
movups xmmword [ecx], xmm0
push ecx
push edi
call dword [sym.imp.kernel32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x41134c
mov word [esp], bx
mov word [esp + 2], bp
mov eax, dword [esp]
push eax
push edi
call dword [sym.imp.kernel32.dll_SetConsoleCursorPosition]
mov byte [esi], 4
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4146b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x414700
cmp esi, edi
ja 0x414768
cmp edi, dword [esp + 0x1c]
ja 0x41477b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x414702
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4146f0
jmp 0x41475f
ja 0x414708
cmp eax, edx
mov esi, edi
jne 0x4146c3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x414740
mov ebp, esi
sub ecx, edx
jns 0x414757
jmp 0x414761
cmp esi, edi
je 0x414790
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x414761
xor al, 1
cmp ebp, edi
jne 0x414720
jmp 0x414761
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x469e20
call fcn.00465f10
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x469e20
call fcn.00465d00
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x469e10
call fcn.00465d70
add esp, 4
ud2
Function at 0x418378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [esp + 0x78]
mov esi, ecx
mov dword [esp + 0x44], edx
cmp eax, 3
mov dword [esp + 0x48], eax
je 0x4183b7
cmp eax, 4
je 0x4183ec
cmp eax, 5
jne 0x418404
mov eax, 0x67726163
movzx ecx, byte [edx + 4]
xor eax, dword [edx]
xor ecx, 0x6f
or ecx, eax
jne 0x418404
mov byte [esi + 4], 0
jmp 0x41858d
movzx eax, word [edx]
movzx ecx, byte [edx + 2]
xor eax, 0x706e
xor ecx, 0x6d
or cx, ax
je 0x41857d
movzx eax, word [edx]
movzx ecx, byte [edx + 2]
xor eax, 0x7562
xor ecx, 0x6e
or cx, ax
jne 0x418404
mov byte [esi + 4], 4
jmp 0x41858d
cmp dword [edx], 0x6d706e70
je 0x418583
cmp dword [edx], 0x6e726179
je 0x418589
mov ecx, 5
call fcn.0041602c
cmp edx, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], 0
mov dword [esp + 4], esi
jbe 0x41859b
xor edx, edx
lea ecx, [edx + edx*2]
add edx, 5
mov esi, 0xffffffc4
mov ebp, 0x470390
mov ebx, 3
lea edi, [eax + ecx*4]
mov dword [esp], edx
mov eax, 0x4175e0
lea ecx, [esp + 0x40]
mov dword [esp + 8], 0x46fec4
mov dword [esp + 0x4c], 0x471380
mov dword [esp + 0x50], ebx
mov dword [esp + 0x5c], 0
lea edx, [esp + 0x4c]
mov dword [esp + 0x40], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0x415c31
mov dword [esp + 0x18], 0x4b0598
mov dword [esp + 0x1c], eax
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], ebx
call fcn.0040e430
mov eax, dword [esp + 0x3c]
inc ebp
mov dword [edi + esi + 0x44], eax
movsd xmm0, qword [esp + 0x34]
movsd qword [edi + esi + 0x3c], xmm0
add esi, 0xc
jne 0x418448
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
lea edi, [esp + 0x34]
mov ecx, edi
mov edx, ebx
push 0x4b19fd
mov esi, dword [esp + 4]
push esi
call fcn.004173a3
add esp, 8
mov eax, 0x4175e0
lea ecx, [esp + 0x44]
mov dword [esp + 8], 0x46feb4
lea edx, [esp + 0x4c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x4b0598
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x20], edi
mov dword [edx], str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_src_sliceiter.rs
mov dword [edx + 4], 5
mov dword [edx + 0x10], 0
mov dword [esp + 0x24], 0x40ac70
mov dword [edx + 8], eax
mov dword [edx + 0xc], 4
call fcn.0040e430
cmp dword [esp + 0x38], 0
je 0x41855f
push dword [esp + 0x34]
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, ebx
mov edx, esi
call fcn.0043aac2
test ebp, ebp
je 0x418593
push ebx
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x418593
mov byte [esi + 4], 3
jmp 0x41858d
mov byte [esi + 4], 1
jmp 0x41858d
mov byte [esi + 4], 2
mov dword [esi], 0
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esp + 0x28]
xor edx, edx
mov ecx, edi
push 5
call fcn.00466218
add esp, 4
mov eax, dword [edi]
mov edx, dword [edi + 8]
jmp 0x41842d
Function at 0x43ba00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4bf048]
test eax, eax
je 0x43bab8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x43ba2c
cmp dword [eax + 4], 0
mov edi, eax
je 0x43ba2c
add edi, 8
jmp 0x43bab3
mov eax, dword [0x4bf048]
test eax, eax
je 0x43bac7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43bab1
mov esi, eax
test eax, eax
jne 0x43ba87
movzx eax, byte [0x4c0890]
mov ecx, 0xc
mov edx, 4
call fcn.0040de10
test eax, eax
je 0x43bae2
mov dword [eax], 0x4bf048
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4bf048]
test eax, eax
je 0x43bad6
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x43bab3
test ecx, ecx
je 0x43bab3
lock dec dword [ecx]
jne 0x43bab3
call fcn.0043b700
jmp 0x43bab3
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x4bf048
call fcn.004676d0
jmp 0x43ba10
mov ecx, 0x4bf048
call fcn.004676d0
jmp 0x43ba3a
mov ecx, 0x4bf048
call fcn.004676d0
jmp 0x43ba7f
mov ecx, 4
mov edx, 0xc
call fcn.00465940
ud2

Function at 0x43c030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x4bf058]
test eax, eax
je 0x43c0b4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x43c04f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x43c0a9
mov eax, dword [0x4bf058]
test eax, eax
je 0x43c0c3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43c0ae
mov esi, eax
test eax, eax
jne 0x43c0a3
movzx eax, byte [0x4c0890]
mov ecx, 8
mov edx, 4
call fcn.0040de10
test eax, eax
je 0x43c0db
mov dword [eax], 0x4bf058
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x4bf058]
test eax, eax
je 0x43c0cf
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x43c0b0
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x4bf058
call fcn.004676d0
jmp 0x43c03b
mov ecx, 0x4bf058
call fcn.004676d0
jmp 0x43c059
mov ecx, 0x4bf058
call fcn.004676d0
jmp 0x43c09b
mov ecx, 4
mov edx, 8
call fcn.00465940
ud2
Function at 0x43c7f0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x43c844
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x43c867
test eax, eax
js 0x43c853
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x43c85f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x4b3c78
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0043b1a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0043b300
mov ecx, 7
int 0x29
ud2
Function at 0x43ce30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x4bf038]
test eax, eax
je 0x43cec8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x43ce56
cmp dword [eax + 4], 0
je 0x43ce56
add eax, 8
pop esi
ret
mov eax, dword [0x4bf038]
test eax, eax
je 0x43ced7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43cec4
mov esi, eax
test eax, eax
jne 0x43cead
movzx eax, byte [0x4c0890]
mov ecx, 0x10
mov edx, 4
call fcn.0040de10
test eax, eax
je 0x43cef2
mov dword [eax], 0x4bf038
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4bf038]
test eax, eax
je 0x43cee6
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x4bf038
call fcn.004676d0
jmp 0x43ce3f
mov ecx, 0x4bf038
call fcn.004676d0
jmp 0x43ce60
mov ecx, 0x4bf038
call fcn.004676d0
jmp 0x43cea5
mov ecx, 4
mov edx, 0x10
call fcn.00465940
ud2
Function at 0x43ee10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x456ec0
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x43eea0
jmp 0x43ee8e
jbe 0x43ef2c
cmp esi, 0x201
jae 0x43eea0
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x43eedb
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x43eecc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.00467960
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x43eefb
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x43ef64
cmp esi, edi
jne 0x43ee80
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43efa3
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x43ee8e
jmp 0x43eea0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x43efc3
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.0043f8b0
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x43ef77
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x43ef8f
push dword [ebp - 0x24]
push 0
push dword [0x4c0838]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x4b43e8
call fcn.00465d70
add esp, 4
jmp 0x43efd2
mov ecx, esi
push 0x4b43d8
call fcn.00465d00
add esp, 4
ud2
Function at 0x443120
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x44316d
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x44317d
mov dword [esi + 4], 0
jmp 0x44318f
cmp eax, 0x103
je 0x4431a7
test eax, eax
js 0x443198
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x443192
mov eax, esp
mov dword [esp + 0x1c], 0x4b3c78
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0043b1a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0043b300
mov ecx, 7
int 0x29
ud2