joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a9f1
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x610ec0]
call fcn.004547db
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x43aaf1
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x43aa47
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x43aa3f
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x43aa87
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x43aac9
push 0x22
pop edx
cmp cx, dx
je 0x43aa79
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x43aa69
xor ecx, ecx
cmp word [eax], cx
je 0x43aac9
mov ecx, eax
add eax, 2
jmp 0x43aacb
test dx, dx
je 0x43aad1
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x43aa79
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x43aabf
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x43aac9
cmp cx, dx
je 0x43aabc
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x43aaac
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x43aa91
jmp 0x43aa79
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x43aad3
xor edx, edx
cmp dword [ebp], ebx
jne 0x43aadc
test edi, edi
jne 0x43aaf9
test edx, edx
je 0x43aae1
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x43aa35
test edi, edi
jne 0x43ab0a
mov eax, ebx
jmp 0x43ab0e
test esi, esi
je 0x43ab0a
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x43ab0e
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x43b2df
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, eax
cmp dword [esp + 0x24], 0x18
je 0x43b38e
cmp dword [esp + 0x24], 2
je 0x43b38e
push 0x2000
push edi
push dword [0x60aa40]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x43b361
cmp dword [esp + 0x18], 2
jne 0x43b379
test ebx, ebx
jne 0x43b34a
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x60aa40]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x43b379
cmp ax, 0xd
je 0x43b361
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x43b321
push dword [esp + 0x28]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00540280
jmp 0x43b414
push eax
push 0
push dword [0x60aa40]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x43b3e0
cmp dword [esp + 0x18], 1
jne 0x43b3f8
test ebx, ebx
jne 0x43b3cf
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x60aa40]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x43b3f8
cmp al, 0xd
je 0x43b3e0
mov byte [esi + edi], al
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x43b3a7
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x28]
mov byte [esi + edi], 0
push esi
jne 0x43b40f
call fcn.005402d0
jmp 0x43b414
call fcn.00540220
push esi
push 0
push dword [0x60aa40]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x43bde4
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x43bd33
push 0x10
push 0x2c
call fcn.00454a1f
push 0
push 0
push 8
mov dword [0x60b6c4], eax
call fcn.00454846
cmp word [0x60b6bc], 0
mov dword [0x610ee8], eax
jne 0x43bec9
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x43be3c
mov word [0x60b6bc], di
jmp 0x43be44
xor eax, eax
mov word [0x60b6bc], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x60b6d8], eax
test eax, eax
je 0x43bec8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x60b6d8]
mov dword [0x60b6c8], eax
call esi
push str.getnameinfo
push dword [0x60b6d8]
mov dword [0x60b6cc], eax
call esi
push str.WSAStringToAddressA
push dword [0x60b6d8]
mov dword [0x60b6d0], eax
call esi
cmp dword [0x60b6c8], 0
mov dword [0x60b6d4], eax
pop esi
je 0x43bec8
cmp dword [0x60b6cc], 0
je 0x43bec8
cmp dword [0x60b6d0], 0
je 0x43bec8
test eax, eax
je 0x43bec8
mov dword [0x60b6c0], edi
pop edi
add esp, 0x190
ret

Function at 0x43c930
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x60b6e0], 0
jne 0x43c93e
call fcn.0043c8d0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x60b6e4]
call esi
test eax, eax
jne 0x43c961
call fcn.0043c8d0
push dword [0x60b6e4]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x43c970
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x43c9d0
mov ebx, 0x10
test edi, edi
jns 0x43c9d9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x43c9a2
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x43da20
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x43da5c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x43dff0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x610f00]
call fcn.0045494c
mov esi, eax
test esi, esi
je 0x43e06f
cmp dword [esi + 4], 0
je 0x43e040
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.0043e640
test eax, eax
je 0x43e034
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43e07a
cmp dword [esp + 8], 0
je 0x43e07a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x43e3f0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x43e4f8
cmp word [edx], 0
je 0x43e4f8
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x43e41e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x43e47d
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x43e450
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e430
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.0043e530
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e450
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.0043ec10
mov edi, eax
test edi, edi
je 0x43e473
cmp dword [esi + 4], 0
je 0x43e4cb
push dword [esp + 0x14]
push edi
push esi
call fcn.0043e530
push edi
push 0
push dword [0x60aa40]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x60aa40]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x43e530
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x43e637
cmp dword [esi + 0x14], 1
jne 0x43e57b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x43e5f8
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x43e5e3
dec eax
je 0x43e5cc
sub eax, 2
je 0x43e5b7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.0043da20
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x43e625
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x43e5a1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x43e640
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x43e661
push esi
call fcn.0043da20
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x43e6d5
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x43e6c2
dec ecx
je 0x43e6ad
sub ecx, 2
je 0x43e69a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x43e71a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x43e73b
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x43e760
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x60aa40]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x43e8e4
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x43e7ae
test ebp, ebp
je 0x43e850
dec ebp
cmp dword [ebx + 4], 0
je 0x43e7c7
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0043e640
mov dword [esp + 0x14], eax
jmp 0x43e7e1
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x43e850
test cl, cl
je 0x43e7f5
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x43e830
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x60aa40]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x43e850
cmp dword [esp + 0x2c], 0
jne 0x43e7a0
cmp cl, 0xd
je 0x43e857
cmp cl, 0xa
jne 0x43e7a0
dec esi
jmp 0x43e8c7
cmp dword [esp + 0x2c], 0
jne 0x43e8c7
cmp cl, 0xa
jne 0x43e85f
dec esi
jmp 0x43e8c7
cmp cl, 0xd
jne 0x43e8c7
dec esi
cmp dword [ebx + 4], 0
je 0x43e87e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0043e640
mov dword [esp + 0x14], eax
jmp 0x43e894
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x43e8c7
cmp dword [ebx + 4], 0
je 0x43e8a6
inc dword [ebx + 0xc]
jmp 0x43e8c7
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x43e8f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x60aa40]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x43ea9d
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x43e944
test ebp, ebp
je 0x43e9fd
dec ebp
cmp dword [ebx + 4], 0
je 0x43e95d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0043e640
mov dword [esp + 0x14], eax
jmp 0x43e977
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x43e9fd
test ax, ax
je 0x43e991
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x43e9d8
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x60aa40]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x43e9fd
cmp dword [esp + 0x30], 0
jne 0x43e936
cmp ax, 0xd
je 0x43ea04
cmp ax, 0xa
jne 0x43e936
sub edi, 2
jmp 0x43ea7c
cmp dword [esp + 0x30], 0
jne 0x43ea7c
cmp ax, 0xa
jne 0x43ea0f
sub edi, 2
jmp 0x43ea7c
cmp ax, 0xd
jne 0x43ea7c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x43ea31
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0043e640
mov dword [esp + 0x14], eax
jmp 0x43ea47
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x43ea7c
cmp dword [ebx + 4], 0
je 0x43ea5b
add dword [ebx + 0xc], 2
jmp 0x43ea7c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x43eab0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x60aa40]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x43ec00
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x43eafc
test edi, edi
je 0x43eb6d
dec edi
push esi
push ebp
call fcn.0043ec80
mov dword [esp + 0x20], eax
test eax, eax
jne 0x43eb0f
xor cl, cl
jmp 0x43eb11
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x43eb54
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x60aa40]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x43eb6d
test eax, eax
jne 0x43eaf2
cmp cl, 0xd
je 0x43eb71
cmp cl, 0xa
jne 0x43eaf2
dec esi
jmp 0x43ebe3
test eax, eax
jne 0x43ebe3
cmp cl, 0xa
jne 0x43eb79
dec esi
jmp 0x43ebe3
cmp cl, 0xd
jne 0x43ebe3
dec esi
cmp dword [ebp + 4], 0
je 0x43eb98
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.0043e640
mov dword [esp + 0x20], eax
jmp 0x43ebaf
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x43ebe3
cmp dword [ebp + 4], 0
je 0x43ebc1
inc dword [ebp + 0xc]
jmp 0x43ebe3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x43ec80
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x43eca7
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0043e640
mov dword [esp + 4], eax
jmp 0x43ecc1
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x43eccd
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x43ece9
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x43ecf9
mov esi, 2
jmp 0x43ed15
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x43ed08
mov esi, 3
jmp 0x43ed15
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x43ed72
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x43ed44
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.0043e640
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
Function at 0x43fc3c
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
push edi
mov ebx, esi
call fcn.004486f2
mov edi, eax
test edi, edi
je 0x43fd32
cmp dword [edi + 0x14], esi
je 0x43fd32
cmp dword [edi], 0xf
jne 0x43fd32
push dword [edi + 0x18]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x43fd32
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x43fd27
push dword [edi + 0x18]
push dword [edi + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push esi
push 0xffffffffffffffff
push ebp
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jle 0x43fd27
lea ebx, [edi - 1]
mov eax, esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
push esi
push esi
push eax
push ebp
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
add ebx, eax
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, edi
jl 0x43fcc4
push dword [esp + 0x20]
mov dword [esp + 0x1c], ebx
push ebx
call fcn.00455720
mov edi, eax
cmp dword [esp + 0x14], esi
jle 0x43fd21
lea eax, [ebx + 1]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push eax
push edi
push esi
push ebp
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
push 0xa
lea edi, [edi + eax*2]
pop eax
mov word [edi], ax
add edi, 2
mov eax, dword [esp + 0x10]
inc esi
cmp esi, ebx
jl 0x43fcfe
mov ebx, dword [esp + 0x18]
xor eax, eax
mov word [edi - 2], ax
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
jne 0x43fd3e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp fcn.00455aa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4