joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435180
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4351bc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x435580
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x4b27d4]
call fcn.0043ca45
mov esi, eax
test esi, esi
je 0x4355ff
cmp dword [esi + 4], 0
je 0x4355d0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00435820
test eax, eax
je 0x4355c4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43560a
cmp dword [esp + 8], 0
je 0x43560a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x435710
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x43580e
cmp word [edx], 0
je 0x43580e
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x43573e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x435794
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435750
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x435776
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00435e30
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
push edx
xor edx, edx
mov eax, 0xfde9
cmp ecx, 2
cmovne eax, edx
push eax
call fcn.00435f50
mov edi, eax
test edi, edi
je 0x43578a
cmp dword [esi + 4], 0
je 0x4357e1
push dword [esp + 0x14]
push edi
push esi
call fcn.00435e30
push edi
push 0
push dword [0x4b0774]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x4b0774]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x435820
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0
jne 0x435843
push ebx
call fcn.00435180
mov dword [ebx + 0x14], 1
mov dword [ebx + 0xc], 0
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
mov ebp, dword [esp + 0x20]
sub eax, esi
add eax, dword [ebx + 4]
mov dword [esp + 0x10], esi
cmp esi, ebp
jl 0x4358c7
mov ecx, ebp
sub ecx, 1
je 0x4358b2
sub ecx, 1
je 0x43589b
sub ecx, 2
je 0x435886
push ebp
push eax
push dword [esp + 0x24]
call fcn.004229f0
add esp, 0xc
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], ecx
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov word [eax], cx
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
mov dl, byte [eax]
mov eax, ebp
pop edi
pop esi
mov byte [ecx], dl
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
push esi
push eax
mov eax, dword [esp + 0x24]
push eax
call fcn.004229f0
mov eax, dword [esp + 0x28]
add esp, 0xc
mov edx, dword [ebx + 8]
add eax, esi
mov ecx, dword [ebx]
sub ebp, esi
mov dword [esp + 0x1c], eax
push 0
cmp ebp, edx
jl 0x435910
lea edx, [esp + 0x1c]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
pop edi
add eax, esi
mov dword [ebx + 0xc], 0
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
lea eax, [esp + 0x1c]
push eax
push edx
push dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esp + 0x18]
cmp ebp, esi
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
cmovle esi, ebp
push esi
push dword [ebx + 4]
push eax
call fcn.004229f0
sub dword [ebx + 0xc], esi
add esp, 0xc
mov eax, dword [esp + 0x10]
add eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x435960
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push 0x1000
push 0
push dword [0x4b0774]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x435af0
mov cl, byte [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov esi, edx
nop
cmp ebp, 0xffffffff
je 0x4359ae
test ebp, ebp
je 0x435a56
dec ebp
cmp dword [ebx + 4], 0
lea edi, [ebx + 4]
je 0x4359ca
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00435820
mov dword [esp + 0x10], eax
jmp 0x4359e4
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x24]
cmp eax, 1
jne 0x435a59
test cl, cl
je 0x4359f8
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x24]
mov eax, dword [esp + 0x14]
mov edi, esi
mov edx, dword [esp + 0x1c]
dec eax
sub edi, edx
cmp edi, eax
jle 0x435a33
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4b0774]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x24]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [edi + edx]
test cl, cl
je 0x435a56
cmp dword [esp + 0x28], 0
jne 0x4359a0
cmp cl, 0xd
je 0x435a62
cmp cl, 0xa
jne 0x4359a0
dec esi
jmp 0x435ad3
lea edi, [ebx + 4]
cmp dword [esp + 0x28], 0
jne 0x435ad3
jmp 0x435a65
lea edi, [ebx + 4]
cmp cl, 0xa
jne 0x435a6d
dec esi
jmp 0x435ad3
cmp cl, 0xd
jne 0x435ad3
dec esi
cmp dword [edi], 0
je 0x435a8b
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00435820
mov dword [esp + 0x10], eax
jmp 0x435aa1
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x24], 0xa
je 0x435ad3
cmp dword [edi], 0
je 0x435ab2
inc dword [ebx + 0xc]
jmp 0x435ad3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x30]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
Function at 0x435b00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push 0x1000
push 0
push dword [0x4b0774]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 8], edx
test edx, edx
je 0x435cbf
mov ax, word [esp + 0x1c]
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x18], 0x7ff
mov ecx, dword [esp + 0x30]
cmp ecx, 0xffffffff
je 0x435b59
test ecx, ecx
je 0x435c1c
dec ecx
mov dword [esp + 0x30], ecx
cmp dword [ebx + 4], 0
lea ebp, [ebx + 4]
je 0x435b75
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.00435820
mov dword [esp + 0x10], eax
jmp 0x435b8f
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, 2
mov ax, word [esp + 0x28]
jne 0x435c1f
test ax, ax
je 0x435bad
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, edi
mov ecx, dword [esp + 0x18]
sub esi, edx
sar esi, 1
cmp esi, ecx
jle 0x435bf4
mov eax, dword [esp + 0x1c]
add ecx, 0x800
add eax, 0x1000
mov dword [esp + 0x18], ecx
push eax
push edx
push 8
push dword [0x4b0774]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
mov ax, word [esp + 0x28]
mov dword [esp + 0x14], edx
lea edi, [edx + esi*2]
test ax, ax
je 0x435c1f
cmp dword [esp + 0x2c], 0
jne 0x435b43
cmp ax, 0xd
je 0x435c26
cmp ax, 0xa
jne 0x435b43
sub edi, 2
jmp 0x435c9e
lea ebp, [ebx + 4]
cmp dword [esp + 0x2c], 0
jne 0x435c9e
cmp ax, 0xa
jne 0x435c31
sub edi, 2
jmp 0x435c9e
cmp ax, 0xd
jne 0x435c9e
sub edi, 2
cmp dword [ebp], 0
je 0x435c53
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.00435820
mov dword [esp + 0x10], eax
jmp 0x435c69
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x28], 0xa
je 0x435c9e
cmp dword [ebp], 0
je 0x435c7d
add dword [ebx + 0xc], 2
jmp 0x435c9e
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, dword [esp + 0x14]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x435cd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4b0774]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x435e20
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x435d1c
test edi, edi
je 0x435d8d
dec edi
push esi
push ebp
call fcn.00435fc0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x435d2f
xor cl, cl
jmp 0x435d31
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x435d74
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4b0774]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x435d8d
test eax, eax
jne 0x435d12
cmp cl, 0xd
je 0x435d91
cmp cl, 0xa
jne 0x435d12
dec esi
jmp 0x435e03
test eax, eax
jne 0x435e03
cmp cl, 0xa
jne 0x435d99
dec esi
jmp 0x435e03
cmp cl, 0xd
jne 0x435e03
dec esi
cmp dword [ebp + 4], 0
je 0x435db8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00435820
mov dword [esp + 0x20], eax
jmp 0x435dcf
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x435e03
cmp dword [ebp + 4], 0
je 0x435de1
inc dword [ebp + 0xc]
jmp 0x435e03
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x435e30
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x1c], 0
jne 0x435f47
cmp dword [edi + 0x14], 1
push ebx
push ebp
jne 0x435e7d
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x10]
push 1
neg eax
cdq
push ecx
push eax
push dword [edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [esp + 0x24]
cmp eax, esi
jle 0x435f06
mov ecx, dword [edi + 4]
sub ecx, eax
mov eax, esi
add ecx, dword [edi + 8]
sub eax, 1
je 0x435eef
sub eax, 1
je 0x435ed6
sub eax, 2
je 0x435ebf
push esi
push dword [esp + 0x24]
push ecx
call fcn.004229f0
add esp, 0xc
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov ax, word [eax]
mov word [ecx], ax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov al, byte [eax]
mov byte [ecx], al
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call fcn.00435180
mov eax, dword [edi + 8]
cmp esi, eax
jl 0x435f35
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov ecx, dword [edi + 4]
sub ecx, dword [edi + 0xc]
push esi
push dword [esp + 0x24]
add ecx, eax
jmp 0x435ea7
xor eax, eax
pop edi
add esp, 8
ret 0xc
Function at 0x435fc0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x435fe7
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00435820
mov dword [esp + 4], eax
jmp 0x436001
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x4360b4
mov cl, byte [esp + 0xc]
test cl, cl
js 0x436026
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x436036
mov esi, 2
jmp 0x436052
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x436045
mov esi, 3
jmp 0x436052
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x4360a0
mov esi, 4
mov eax, dword [esp + 0x14]
push ebx
lea ebx, [esi - 1]
mov byte [eax], cl
inc eax
cmp dword [edi + 4], 0
je 0x43607b
push ebx
push eax
push edi
call fcn.00435820
xor ecx, ecx
cmp eax, ebx
pop ebx
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, ebx
pop ebx
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
xor eax, eax
pop edi
pop ecx
ret 8
Function at 0x437dd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebp
xor ebp, ebp
cmp dword [0x4b2624], ebp
je 0x437fba
push ebx
mov ebx, dword [esp + 0x60]
push edi
test ebx, ebx
je 0x437df4
mov edi, ebx
jmp 0x437e06
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x437fb8
lea eax, [esp + 0x18]
push eax
push 0x18
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x437fad
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push esi
mov esi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.0041f270
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], esi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x437fac
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push esi
push 0
push dword [esp + 0x78]
push edi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul esi, dword [esp + 0x14]
test esi, esi
jle 0x437fac
cmp dword [esp + 0x6c], 0
je 0x437f59
mov ebp, dword [esp + 0x10]
push 0xa
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
lea eax, [eax + ecx*2]
movzx ecx, byte [ebp]
imul eax, eax, 3
add eax, ecx
div ebx
mov cl, al
cmp cl, 0x40
jae 0x437eed
movzx eax, cl
sub eax, 0x40
imul eax, eax, 7
cdq
idiv ebx
lea ecx, [eax + 0x40]
jmp 0x437f03
cmp cl, 0xc0
jbe 0x437f03
movzx eax, cl
sub eax, 0xc0
imul eax, eax, 7
cdq
idiv ebx
lea ecx, [eax - 0x40]
movzx eax, byte [ebp + 3]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movzx eax, cl
movd xmm0, eax
divss xmm1, dword [0x49006c]
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm0
cvttss2si ecx, xmm1
mov byte [ebp], cl
mov eax, dword [esp + 0x10]
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, 4
mov dword [esp + 0x10], ebp
sub esi, 1
jne 0x437ebd
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
jmp 0x437fac
mov edx, dword [esp + 0x10]
mov al, byte [edx + 3]
cmp al, 0xff
jae 0x437fa0
movzx ecx, al
movzx eax, byte [edx]
imul ecx, eax
shr ecx, 8
mov byte [edx], cl
mov edx, dword [esp + 0x10]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 3]
imul ecx, eax
shr ecx, 8
mov byte [edx + 1], cl
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
imul ecx, eax
shr ecx, 8
mov byte [edx + 2], cl
mov edx, dword [esp + 0x10]
add edx, 4
mov dword [esp + 0x10], edx
sub esi, 1
jne 0x437f5d
pop esi
test ebx, ebx
jne 0x437fb8
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x50
ret 0xc
Function at 0x439160
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x439198
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x439193
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.004229f0
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
Function at 0x43c8d3
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x4b2658]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x43c934
push esi
push dword [0x4b2654]
push 8
push dword [0x4b0774]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x4b2658]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x4b2650]
jmp 0x43c924
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x43c922
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x43c912
push edi
push 0x43c871
call fcn.004592a8
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x43c93e
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x43c954
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x4b2654]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x43c98d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x4b0774]
mov dword [0x4b2658], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x4b2658]
call ebx
mov esi, dword [0x4b2654]
lea eax, [edi + esi]
push eax
push dword [0x4b2658]
mov dword [0x4b2654], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x4b0774]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x4b2658]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x43c9cc
test ebx, ebx
je 0x43c9ed
push 0x14
push 0x4b2650
call fcn.0043d1f3
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x43c9ed
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x43d2f0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret

Function at 0x43d310
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x43d349
push ecx
push dword [0x4b2918]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x43d358
push ecx
push 0
push dword [0x4b2918]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.0043d730
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x43d570
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x43d58e
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x43d5b2
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x43d5cd
cmp edx, 0x100000
jle 0x43d5e0
cmp ecx, 0x100000
jge 0x43d5c7
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x4b2918]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x43d600
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4

Function at 0x43d640
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [esp + 4]
mov edx, dword [ecx]
cmp eax, edx
jb 0x43d667
mov ecx, dword [ecx + 8]
add ecx, edx
cmp eax, ecx
ja 0x43d667
sub eax, edx
inc eax
ret 4
xor eax, eax
ret 4

Function at 0x43d670
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
dec eax
add eax, ecx
ret 4

Function at 0x43d690
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
add eax, dword [esp + 4]
ret 4

Function at 0x43d770
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x4aeb34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4

Function at 0x4464f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x446510
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x446510
mov eax, dword [eax + 0x44]
test eax, eax
je 0x446510
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]