joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
mov dword [edi], 0x4a8d18
call fcn.00412840
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
cmp edx, ecx
je 0x42bb1a
cmp dword [edx], edi
je 0x42baef
add edx, 4
cmp edx, ecx
jne 0x42bae4
cmp edx, ecx
je 0x42bb1a
cmp dword [esi + 0x64], 0
je 0x42bb01
mov dword [edx], 0
jmp 0x42bb1a
mov eax, ecx
lea ecx, [edx + 4]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push edx
call fcn.0046ee30
add esp, 0xc
add dword [esi + 0x5c], 0xfffffffc
mov esi, dword [edi + 0x10]
test esi, esi
je 0x42bb85
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
cmp ecx, 0xffffffff
jne 0x42bb3e
cmp edx, 0x7fffffff
jne 0x42bb3e
movsd xmm0, qword [0x4b5678]
jmp 0x42bb4b
call fcn.00494f3f
divsd xmm0, qword [0x4a9600]
movd xmm1, esi
cvtdq2pd xmm1, xmm1
divsd xmm0, xmm1
movsd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov ecx, edi
lea eax, [esp + 0x10]
push eax
sub esp, 0xc
push 0
call fcn.0042bc30
add esp, 4
mov edx, esi
mov ecx, eax
call fcn.00431940
add esp, 0xc
mov esi, dword [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 8], 0
je 0x42bbc0
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x204]
cmp dword [edi + 0x20], eax
jne 0x42bbc0
mov eax, dword [edi + 4]
mov edx, dword [edi + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov eax, esp
mov dword [edi + 8], 0
mov dword [eax], edx
mov eax, dword [ecx]
push dword [edi + 0xc]
call dword [eax + 8]
call fcn.00412840
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [edi + 4]
mov dword [esp + 0xc], eax
add ecx, 0x1d0
lea eax, [esp + 0xc]
push eax
call fcn.0042f680
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [edi + 4]
push 0
push dword [eax + 0x1c4]
call fcn.0041da10
mov esi, dword [edi + 8]
add esp, 8
test esi, esi
je 0x42bc15
mov ecx, esi
call fcn.00430700
push esi
call fcn.0046ec0e
add esp, 4
mov dword [edi], method.std::_Facet_base.virtual_4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e670
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
jne 0x42e695
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [edi + 0x1c4]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x42e6ea
push dword [edi + 0x1c4]
call esi
mov ebx, eax
mov esi, dword [ebx + 8]
test esi, esi
je 0x42e6ea
mov edx, dword [ebp + 0xc]
cmp edx, dword [esi + 0x1808]
jne 0x42e6ed
mov ecx, dword [ebp + 0x10]
movzx eax, cx
cmp eax, dword [ebx + 0xc]
jne 0x42e6ed
mov eax, dword [ebp + 0x12]
movzx eax, ax
lea eax, [eax + eax*2]
shl eax, 5
add eax, 8
add eax, esi
je 0x42e6ed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
je 0x42e709
cmp byte [esi + 4], 0
jne 0x42e709
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp + 0xc]
mov byte [esi + 4], 1
mov ecx, dword [edi + 0x1f0]
test ecx, ecx
je 0x42e747
mov eax, dword [ebp + 0x10]
movzx eax, ax
cmp eax, dword [edi + 0x1f4]
jne 0x42e747
cmp edx, dword [ecx + 0x1808]
jne 0x42e68a
mov eax, dword [ebp + 0x12]
movzx eax, ax
lea eax, [eax + eax*2]
shl eax, 5
add eax, 8
add eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x3c]
push dword [ebp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4302c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x4bb37c]
mov dword [esp], 0
push esi
test eax, 0xfffffffe
jne 0x43033c
mov ecx, 1
mov edx, 0x4bb37c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x430318
mov eax, dword [0x4bb37c]
cmp eax, 1
jne 0x43033c
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
mov eax, dword [0x4bb37c]
cmp eax, 1
je 0x430300
mov eax, dword [0x4bb37c]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x4bb380], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4bb380], eax
cmp eax, 0xffffffff
je 0x430346
mov dword [0x4bb37c], 0x4bb380
mov eax, dword [0x4bb37c]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0040c210
int3

Function at 0x430d60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x430d73
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x430d91
mov edi, edi
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x430d80
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.00472a78
imul ecx, eax, 0xb14
add esp, 8
imul edx, edx, 0x41a7
sub edx, ecx
lea eax, [edx + 0x7fffffff]
js 0x430dbd
mov eax, edx
pop edi
pop esi
pop ebp
ret 4
Function at 0x435940
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x4b5870]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [0x4b6c5c]
mov dword [esp + 4], 0
mov dword [esp + 4], ebx
push esi
push edi
cmp ebx, 0xffffffff
jne 0x4359ad
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x435a15
mov ecx, ebx
mov edx, 0x4b6c5c
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x4359ad
push ebx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov ebx, dword [0x4b6c5c]
mov dword [esp + 0xc], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x435a15
push 0x400
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00470210
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x400
call fcn.0046df36
add esp, 4
lea esi, [esp + 0x10]
mov ebx, eax
mov ecx, 0x100
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046f685
mov esp, ebp
pop ebp
ret
call fcn.0040c210
int3

Function at 0x435a20
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x4b5870]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x4b6c5c]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.0046f65a
add esp, 4
mov edi, 0x100
jmp 0x435a80
mov esi, dword [0x4bb790]
xor dl, dl
test esi, esi
jle 0x435ab8
lea esp, [esp]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x435ab3
mov eax, dword [esi*4 + 0x4bb390]
test eax, eax
je 0x435ab3
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x435a90
dec edi
test edi, edi
jle 0x435ac1
test dl, dl
jne 0x435a80
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046f685
mov esp, ebp
pop ebp
ret
Function at 0x435bb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov dword [esp + 0xc], 0
cmp dword [ebp + 0xc], 0
push edi
mov edi, ecx
je 0x435cb0
cmp dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
jne 0x435c85
lea eax, [ebp + 0xc]
push eax
push ecx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0x18]
call fcn.00435ea0
add esp, 4
lea ecx, [esp + 0x14]
push eax
call fcn.00435f50
add esp, 8
lea ecx, [edi + 4]
push eax
call fcn.00413460
mov ecx, dword [esp + 0x10]
or esi, 0xffffffff
test ecx, ecx
je 0x435c33
add ecx, 4
mov eax, esi
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x435c33
test ecx, ecx
je 0x435c33
add ecx, 0xfffffffc
je 0x435c33
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x435c54
lock xadd dword [ecx], esi
dec esi
setne al
test al, al
jne 0x435c54
test ecx, ecx
je 0x435c54
push ecx
call fcn.0046ec0e
add esp, 4
mov esi, dword [ebp + 8]
mov dword [edi + 0xc], esi
call fcn.00412840
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xc
push 0xffffffffffffffff
push edi
push 0x435d50
push esi
push ebx
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x435c90
mov dword [edi + 0xc], eax
mov dword [ebx], eax
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00412840
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.004111e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040c210
int3

Function at 0x435cc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x435ce0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
test eax, eax
je 0x435cd9
mov eax, dword [esi + 0x18]
test eax, eax
je 0x435d1e
mov byte [eax + 5], 0
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x435d1e
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x435d1e
push ecx
call fcn.0046ec0e
add esp, 4
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.00412840
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.00411220
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436210
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
cmp dword [edi + 0x14], 8
jb 0x436222
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x436239
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 1
push ebx
call fcn.004730ee
mov esi, eax
add esp, 8
test esi, esi
je 0x4362b2
push esi
push ebx
push dword [ebp - 8]
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4362a9
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4362a9
cmp dword [ebp - 4], 0
je 0x4362a9
push 0x14
call fcn.0046ebbd
add esp, 4
test eax, eax
je 0x4362b2
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 2]
push ecx
movzx ecx, word [edx]
push ecx
push esi
mov ecx, eax
call fcn.00436040
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.0046edf3
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436510
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov edi, ecx
mov dword [ebp - 0x224], eax
movzx eax, word [edi + 8]
mov word [ebp - 0x14], ax
movzx eax, word [edi + 0xc]
mov word [ebp - 0x12], ax
call esi
mov word [ebp - 0x10], ax
movzx eax, word [edi + 0xc]
mov word [ebp - 0xe], ax
movzx eax, word [edi + 8]
mov word [ebp - 0xc], ax
mov eax, 0x4e4
mov word [ebp - 0xa], ax
call esi
mov word [ebp - 8], ax
xor esi, esi
mov eax, 0x4e4
mov word [ebp - 6], ax
lea ebx, [ebx]
movzx eax, word [ebp + esi*2 - 0x12]
movzx ecx, word [ebp + esi*2 - 0x14]
add esi, 2
push ebx
push eax
push ecx
push str.StringFileInfo_04x_04x_ls
push 0x104
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00472639
add esp, 0x1c
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [edi + 4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4365e4
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x4365fe
cmp esi, 8
jb 0x436580
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f685
mov esp, ebp
pop ebp
ret 8
cmp word [edx], 0
jne 0x436628
mov ecx, dword [ebp - 0x224]
xor eax, eax
push eax
push edx
call fcn.00402920
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f685
mov esp, ebp
pop ebp
ret 8
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x436630
mov ecx, dword [ebp - 0x224]
sub eax, esi
sar eax, 1
push eax
push edx
call fcn.00402920
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret 8
Function at 0x4374c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0
mov dword [ebp - 0x208], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [0x4bb794]
mov esi, eax
test edx, edx
movzx ecx, di
push str.BINDATA
cmovne esi, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x437577
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x437571
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x437571
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
push 0x10
mov edi, eax
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x437561
lea ecx, [esi + 4]
mov dword [esi], vtable.Gdiplus::Image.0
and dword [ecx], 0
push ecx
push edi
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x437563
xor esi, esi
test edi, edi
je 0x43756d
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
mov eax, esi
jmp 0x4375cd
mov edi, dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4375cb
xor eax, eax
push 0x1fc
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.00470210
push esi
push edi
lea eax, [ebp - 0x204]
push str.Function:__s__image_id:_d__Last_error:__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x204]
push 0
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret
Function at 0x4399d7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push 0
push 0x402
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x43b700
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0x2c], 0
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x28], 0
test ecx, ecx
je 0x43b739
add ecx, 4
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x43b739
test ecx, ecx
je 0x43b739
add ecx, 0xfffffffc
je 0x43b739
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x24], 0
lea ecx, [esi + 4]
pop esi
jmp fcn.00435cc0

Function at 0x43bf51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0x50
jbe 0x43bf93
cmp dword [esi], 0x424b4c48
jne 0x43bf93
mov ecx, dword [edi + 4]
mov dword [ebp + 8], ecx
mov edx, dword [ecx + 0x24]
cmp edx, dword [edi + 0xc]
jae 0x43bfec
mov ebx, dword [ecx + 0x28]
lea eax, [ebx + edx]
cmp eax, dword [edi + 0xc]
ja 0x43bfec
cmp dword [ecx + 0x2c], 1
jne 0x43bfb8
cmp byte [ecx + 0x30], 0
jne 0x43bfb8
add esi, edx
push ebx
push esi
push dword [edi + 0x20]
call fcn.0043c35a
add esp, 0xc
test eax, eax
jne 0x43bfae
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], 1
mov al, byte [edi + 0x1c]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp byte [ebp + 0x10], 0
jne 0x43bfec
cmp dword [ecx + 0x2c], 1
jne 0x43bfec
mov al, byte [ecx + 0x30]
add edx, ecx
mov byte [ebp + 0x13], al
xor eax, eax
test ebx, ebx
jle 0x43bfe0
mov cl, byte [ebp + 0x13]
xor byte [eax + edx], cl
inc eax
cmp eax, ebx
jl 0x43bfd5
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x30], 0
add esi, dword [ecx + 0x24]
mov ebx, dword [ecx + 0x28]
jmp 0x43bf93
xor al, al
jmp 0x43bfb1
Function at 0x43bff0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push ebx
mov esi, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x43c1af
cmp edi, 0x40000000
ja 0x43c1af
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], eax
mov byte [esi + 8], cl
cmp eax, 2
jne 0x43c076
push ecx
push edi
push ecx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x43c06e
push edi
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x24]
jmp 0x43c187
cmp eax, 3
jne 0x43c150
xor eax, eax
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
call fcn.0043be62
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
pop ecx
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
push edi
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x43c13b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0
push 0
cmp eax, 0xb7
push 6
push ebx
sete byte [ebp - 0x1d]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov dword [esi + 4], eax
test edi, edi
je 0x43c0f8
mov eax, dword [esi + 4]
mov byte [ecx + eax], 0
add ecx, 0x1000
cmp ecx, edi
jb 0x43c0e7
cmp dword [esi + 4], 0
je 0x43c134
cmp byte [ebp - 0x1d], 0
jne 0x43c12a
push edi
push dword [esi + 4]
mov ecx, esi
push dword [ebp - 0x24]
call fcn.0043c1c4
test al, al
jne 0x43c12a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [esi + 4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 4], 0
je 0x43c134
mov dword [esi], ebx
jmp 0x43c13b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x1c]
mov byte [esi + 8], 0
call fcn.00403940
mov ebx, dword [ebp - 0x24]
jmp 0x43c18b
cmp eax, 1
jne 0x43c184
push edi
call fcn.00470362
mov dword [esi + 4], eax
pop ecx
test eax, eax
je 0x43c17e
push edi
push eax
push ebx
mov ecx, esi
call fcn.0043c1c4
test al, al
jne 0x43c17e
push dword [esi + 4]
call fcn.0046edf3
and dword [esi + 4], 0
pop ecx
mov byte [esi + 8], 0
jmp 0x43c18b
mov dword [esi + 4], ecx
mov byte [esi + 8], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 4], 0
je 0x43c1aa
movzx ecx, byte [esi + 8]
push ecx
push dword [esi + 0xc]
mov ecx, esi
push dword [esi + 4]
call fcn.0043bf51
mov al, byte [esi + 0x1c]
jmp 0x43c1b1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43c1c4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, 0x10000
mov dword [ebp - 4], ecx
push eax
xor esi, esi
call fcn.00470362
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x43c1e5
xor al, al
jmp 0x43c23d
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x43c230
and dword [ebp + 0x10], 0
mov eax, edi
sub eax, esi
mov ecx, 0x10000
cmp eax, ecx
push 0
cmova eax, ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43c230
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push ebx
mov eax, dword [eax + 4]
add eax, esi
push eax
call fcn.0046fbc0
add esi, dword [ebp + 0x10]
add esp, 0xc
cmp esi, edi
jb 0x43c1ed
push ebx
call fcn.0046edf3
cmp esi, edi
pop ecx
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43c706
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
mov edi, ecx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00470210
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00471b6c
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x68], eax
test eax, eax
je 0x43c869
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call esi
push str.WinHttpConnect
push dword [edi + 0x68]
mov dword [edi + 4], eax
call esi
push str.WinHttpOpenRequest
push dword [edi + 0x68]
mov dword [edi + 8], eax
call esi
push str.WinHttpAddRequestHeaders
push dword [edi + 0x68]
mov dword [edi + 0xc], eax
call esi
push str.WinHttpSendRequest
push dword [edi + 0x68]
mov dword [edi + 0x10], eax
call esi
push str.WinHttpReceiveResponse
push dword [edi + 0x68]
mov dword [edi + 0x14], eax
call esi
push str.WinHttpQueryHeaders
push dword [edi + 0x68]
mov dword [edi + 0x18], eax
call esi
push str.WinHttpReadData
push dword [edi + 0x68]
mov dword [edi + 0x1c], eax
call esi
push str.WinHttpCloseHandle
push dword [edi + 0x68]
mov dword [edi + 0x20], eax
call esi
push str.WinHttpCrackUrl
push dword [edi + 0x68]
mov dword [edi + 0x24], eax
call esi
push str.WinHttpSetOption
push dword [edi + 0x68]
mov dword [edi + 0x28], eax
call esi
push str.WinHttpQueryDataAvailable
push dword [edi + 0x68]
mov dword [edi + 0x2c], eax
call esi
push str.WinHttpSetTimeouts
push dword [edi + 0x68]
mov dword [edi + 0x34], eax
call esi
mov dword [edi + 0x30], eax
cmp dword [edi + 4], ebx
je 0x43c867
cmp dword [edi + 0x10], ebx
je 0x43c867
cmp dword [edi + 0x24], ebx
je 0x43c867
cmp dword [edi + 8], ebx
je 0x43c867
cmp dword [edi + 0xc], ebx
je 0x43c867
cmp dword [edi + 0x1c], ebx
je 0x43c867
cmp dword [edi + 0x20], ebx
je 0x43c867
cmp dword [edi + 0x18], ebx
je 0x43c867
cmp dword [edi + 0x14], ebx
je 0x43c867
cmp dword [edi + 0x28], ebx
je 0x43c867
cmp dword [edi + 0x2c], ebx
je 0x43c867
test eax, eax
je 0x43c867
inc ebx
mov dword [edi], ebx
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret