joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dd60
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494254
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x4b81bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.CECHttpDownloader.0
push edi
call fcn.0042f190
lea eax, [edi + 0x40]
mov byte [ebp - 4], 1
xorps xmm0, xmm0
push 0
movups xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x42ddf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42ddec
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x42ddf4
push eax
call fcn.00404990
mov byte [ebp - 4], 2
lea esi, [edi + 0x58]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00424c00
mov dword [esi], eax
mov dword [edi + 0x60], vtable.ATL::CThreadPool_class_CECHttpDownloader::CDownloadWorker__class_ATL::CRTThreadTraits__class_ATL::Win32WaitTraits_.0
xorps xmm0, xmm0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
movups xmmword [edi + 0x74], xmm0
movq qword [edi + 0x84], xmm0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0x8ca0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0xa0], 0
xor eax, eax
mov byte [ebp - 4], 4
mov dword [edi + 0xa4], 0
mov dword [ebp - 0x14], 0x547
cmp eax, 0x42e210
je 0x42dea6
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0xc]
call fcn.0042f520
mov dword [eax], 0x42e210
xor eax, eax
mov dword [ebp - 0x14], 0x548
cmp eax, 0x42e210
je 0x42dec8
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0xc]
call fcn.0042f520
mov dword [eax], 0x42e210
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x3c]
push eax
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x28]
mov ecx, 1
test eax, eax
cmove eax, ecx
sub esp, 8
mov dword [ebp - 0x28], eax
lea ecx, [edi + 0x60]
add eax, 2
push eax
push edi
call fcn.0042e920
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x42e860
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x42e900
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x42e88a
mov eax, dword [edi + 0x30]
push eax
push 0
mov ecx, edi
call fcn.0042ee00
mov esi, dword [edi + 0xc]
sub esi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
js 0x42e8de
test esi, esi
js 0x42e909
cmp esi, dword [edi + 0xc]
jge 0x42e909
mov eax, dword [edi + 8]
mov ebx, dword [eax + esi*4]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x42e8d0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
sub esi, 1
jns 0x42e8a2
push dword [edi + 0x40]
call ebx
lea esi, [edi + 0x14]
mov dword [edi + 0x40], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x4300f0
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x430110
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x38
and edx, 0x3f
mov eax, 0x78
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovb eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.00430020
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00430020
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x430180
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movups xmmword [ebx], xmm0
pop edi
movups xmmword [ebx + 0x10], xmm0
pop esi
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.00439921
mov esp, ebp
pop ebp
ret 4
Function at 0x430910
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4943eb
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb4], edx
push 0
push 1
push 3
push 0
push 1
push connect
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x430a59
xorps xmm0, xmm0
mov dword [ebp - 0xac], vtable.MD5_CTX.0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xa8], 0x67452301
mov dword [ebp - 0xa4], 0xefcdab89
mov dword [ebp - 0xa0], 0x98badcfe
mov dword [ebp - 0x9c], 0x10325476
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x50], 0x80
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
push 0x4000
mov dword [ebp - 4], 0
call fcn.0043a42c
mov esi, eax
add esp, 4
test esi, esi
je 0x430a3a
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0
push eax
push 0x4000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x430a31
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x430a31
push eax
push esi
lea ecx, [ebp - 0xac]
call fcn.00430020
push 0
lea eax, [ebp - 0xb0]
push eax
push 0x4000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x430a00
push esi
call fcn.00439e2b
add esp, 4
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xac]
call fcn.004300f0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x430a5b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret
Function at 0x4310c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.0046ce30
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.QuanMinData
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004038a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00439921
mov esp, ebp
pop ebp
ret
Function at 0x431b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49463f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4b81bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [edi], vtable.ICloudConfigCenter.0
mov byte [edi + 0x10], 0
and dword [edi + 0x10], 0xfffffeff
mov dword [edi + 0x14], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x18], vtable.CSingletonBase_class_CCloudConfigCenter_.0
lea esi, [edi + 0x1c]
mov dword [edi], vtable.CCloudConfigCenter.1.0
mov dword [edi + 0x18], vtable.CCloudConfigCenter.0
mov dword [ebp - 0x1c], esi
mov dword [esi + 4], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
mov dword [esi], vtable.CHttpDownloadMgrEventPtr_class_CCloudConfigCenter_.0
mov dword [ebp - 0x14], 0
call fcn.00432b70
mov ecx, dword [ebp - 0x14]
mov dword [esi + 4], ecx
push ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 4]
xorps xmm0, xmm0
mov dword [eax + 0x24], edi
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x24]
movups xmmword [ecx + 0x24], xmm0
movq qword [ecx + 0x34], xmm0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x24], eax
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 5
lea esi, [edi + 0x28]
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004095d0
mov dword [esi], eax
lea eax, [edi + 0x30]
mov byte [ebp - 4], 6
xorps xmm0, xmm0
push 0
movups xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x431c37
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x431c2f
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x431c37
push eax
call fcn.00404990
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
call fcn.00403f70
mov ecx, eax
test ecx, ecx
jne 0x431c61
push 0x80004005
call fcn.00404990
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi + 0x54], eax
call fcn.00403f70
mov ecx, eax
test ecx, ecx
jne 0x431c83
push 0x80004005
call fcn.00404990
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi + 0x58], eax
mov eax, dword [edi + 0x20]
mov dword [eax + 0x30], 0x4324f0
mov dword [eax + 0x34], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x431ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494670
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4b81bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0x58]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43201a
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
je 0x43201a
and dword [ebp - 0x18], 0xfffffe00
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
push eax
lea ecx, [esi + 8]
call fcn.00417100
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.00417040
mov ecx, dword [esi + 0x58]
lea edx, [esi + 8]
call fcn.0042a120
test eax, eax
je 0x43201a
mov al, byte [esi + 0x10]
test al, al
je 0x431f74
cmp al, 7
jne 0x43201a
push ecx
push str._settings
lea ecx, [esi + 8]
call fcn.00417700
mov cl, byte [eax + 8]
test cl, cl
je 0x431f92
cmp cl, 7
jne 0x43201a
mov ebx, dword [esi + 0x48]
push ecx
push str.timestamp
mov ecx, eax
call fcn.00417700
lea edx, [esi + 0x48]
mov ecx, eax
call fcn.0042a770
test eax, eax
je 0x43201a
cmp ebx, dword [esi + 0x48]
je 0x432003
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
push ecx
mov ecx, esi
call fcn.00432a80
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x431ffb
mov edx, dword [esi + 0x24]
test edx, edx
je 0x431ffb
mov eax, dword [edx]
push ecx
push edi
push edx
call dword [eax + 0x20]
lea ecx, [ebp - 0x1c]
call fcn.0042ba70
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4330b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
push ecx
mov dword [ebp - 8], edi
call fcn.00433780
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
jne 0x4330dc
test eax, eax
je 0x4330dc
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
nop
mov edx, dword [edi]
mov byte [ecx + edx], cl
inc ecx
cmp ecx, 0x100
jl 0x4330e0
test eax, eax
je 0x433148
xor ecx, ecx
mov dword [ebp - 4], 0
push ebx
mov dword [ebp - 8], ecx
push esi
xor edx, edx
mov esi, dword [edi]
mov eax, ecx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov bl, byte [esi + ecx]
movzx eax, byte [edx + eax]
add eax, dword [ebp - 4]
movzx edx, bl
add edx, eax
and edx, 0x800000ff
jns 0x43312b
dec edx
or edx, 0xffffff00
inc edx
mov ecx, dword [ebp - 8]
mov al, byte [esi + edx]
mov dword [ebp - 4], edx
mov byte [esi + ecx], al
inc ecx
mov byte [esi + edx], bl
mov dword [ebp - 8], ecx
cmp ecx, 0x100
jl 0x433100
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x433160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 0xc]
call fcn.00433700
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp dword [ebp + 0xc], ebx
jbe 0x4331e2
nop dword [eax]
inc esi
and esi, 0x800000ff
jns 0x433191
dec esi
or esi, 0xffffff00
inc esi
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + esi]
movzx eax, dl
add edi, eax
and edi, 0x800000ff
jns 0x4331ac
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [ecx + edi]
mov byte [ecx + esi], al
mov byte [ecx + edi], dl
movzx ecx, byte [ecx + esi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x4331cf
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [ebp - 0xc]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 8]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x433180
lea ecx, [ebp - 0xc]
call fcn.004114c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4333e0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4948b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x4b81bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43342d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0x80
push 3
push 0
push 1
push connect
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x4335ad
test esi, esi
je 0x4335ad
xor edi, edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x48], 0x1524645
mov byte [ebp - 0x44], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov dword [ebp - 0x42], 0x22
mov ecx, 0xff
mov dword [ebp - 0x3e], edi
div ecx
mov eax, dword [0x4a780c]
movups xmm0, xmmword [str._CX_ENCRYPT_FORMAT_]
mov ecx, dword [ebp - 0x10]
inc dl
mov dword [ebp - 0x2a], eax
lea eax, [ebp - 0x48]
push eax
push esi
mov byte [ebp - 0x43], dl
movups xmmword [ebp - 0x3a], xmm0
call fcn.004335d0
test eax, eax
je 0x4335af
push edi
push edi
mov edi, dword [ebp - 0x42]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub ebx, edi
mov dword [ebp - 0x24], vtable.CxAutoArray_unsigned_char_.0
push ebx
mov dword [ebp - 0x14], ebx
call fcn.0043a42c
push ebx
mov edi, eax
push 0
push edi
mov dword [ebp - 0x20], edi
call fcn.0046ce30
add esp, 0x10
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x4335a5
push ebx
push 0
push edi
call fcn.0046ce30
add esp, 0xc
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [ebp - 0x44]
test al, al
jne 0x433539
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov edi, 1
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x4335af
cmp al, 1
jne 0x4335a5
cmp dword [ebp - 0x3e], ebx
mov edi, ebx
mov eax, dword [ebp - 0x10]
cmovb edi, dword [ebp - 0x3e]
push edi
push dword [ebp - 0x20]
mov ecx, dword [eax]
call fcn.00433160
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp - 0x20]
add eax, edi
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.00433160
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ebp - 0x43]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
sub eax, ebx
push eax
mov dword [edi], eax
lea eax, [ebx + ecx]
push eax
push ecx
call fcn.0046b540
mov eax, dword [edi]
push ebx
mov ebx, dword [ebp - 0x20]
add eax, ebx
push 0
push eax
call fcn.0046ce30
mov eax, dword [ebp + 0xc]
add esp, 0x18
mov edi, 1
mov dword [eax], ebx
jmp 0x4335af
lea ecx, [ebp - 0x24]
call fcn.00424600
xor edi, edi
test esi, esi
je 0x4335ba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4335d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4336e9
test esi, esi
je 0x4336e9
mov dword [ebp - 0x28], 0x1524645
mov byte [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov dword [ebp - 0x22], 0x22
mov ecx, 0xff
mov dword [ebp - 0x1e], 0
div ecx
mov eax, dword [0x4a780c]
movups xmm0, xmmword [str._CX_ENCRYPT_FORMAT_]
push 0
mov dword [ebp - 0xa], eax
inc dl
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x23], dl
push eax
push 0x22
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push eax
push edi
movups xmmword [ebp - 0x1a], xmm0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4336e9
cmp dword [ebp - 0x2c], 0x22
jne 0x4336e9
cmp byte [ebp - 0x28], 0x45
jne 0x4336e9
cmp byte [ebp - 0x27], 0x46
jne 0x4336e9
cmp byte [ebp - 0x26], 0x52
jne 0x4336e9
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x22]
cmp eax, edx
jb 0x4336e9
mov ecx, dword [ebp - 0x1e]
add ecx, edx
cmp eax, ecx
jb 0x4336e9
cmp byte [ebp - 0x25], 1
jg 0x4336e9
mov ecx, dword [ebx]
lea eax, [ebp - 0x1a]
push 0x14
push eax
call fcn.00433160
push 0x14
push str._CX_ENCRYPT_FORMAT_
lea eax, [ebp - 0x1a]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNA]
test eax, eax
jne 0x4336e9
movups xmm0, xmmword [ebp - 0x28]
mov ax, word [ebp - 8]
pop edi
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x18]
movups xmmword [esi + 0x10], xmm0
mov word [esi + 0x20], ax
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439921
mov esp, ebp
pop ebp
ret 8
Function at 0x435ca0
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b4098
push 0x46f5e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4b81bc]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x30], ecx
xor edi, edi
mov dword [ebp - 0x24], edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
test edx, edx
je 0x435ce9
mov dword [edx], ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
push 0
push 0x80
push 3
push 0
push 1
push connect
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x34], eax
cmp eax, 0xffffffff
je 0x435d4d
push 0
push 0
push 0
push 0x1000002
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x435d4d
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x2c], eax
test eax, eax
cmovne edi, eax
mov dword [ebp - 0x24], edi
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test edi, edi
je 0x435dfa
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x20], edi
push 0x10
push 1
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x435dca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x435dca
push dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x435dca
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x435dca
movzx esi, word [eax]
cmp esi, dword [ebp - 0x1c]
ja 0x435dc2
mov dword [ebp - 0x1c], esi
add esi, 3
and esi, 0xfffffffc
mov dword [ebp - 0x1c], esi
cmp dword [eax + 0x28], 0xfeef04bd
je 0x435dcf
mov edi, 0xd
mov dword [ebp - 0x20], edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x435dff
mov edi, 0xd
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x435e0d
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
je 0x435e1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
jmp 0x435e22
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
cmp eax, 0xffffffff
je 0x435e2d
push eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x435e51
lea eax, [esi*2 + 4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret