joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cbf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ffb1
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
push 0x84
push 0
push eax
call fcn.004b95f0
mov eax, dword [esi]
lea ecx, [ebp - 0x94]
add esp, 0xc
push ecx
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0
cmp esi, dword [edi + 0x760]
je 0x42cc6a
push str.Cancal
lea ecx, [ebp - 0x94]
call fcn.0044daaf
test al, al
je 0x42cc78
push 0
mov ecx, edi
call fcn.0044555f
jmp 0x42cdbf
push str.Apply
lea ecx, [ebp - 0x94]
call fcn.0044daaf
test al, al
je 0x42cca1
mov ecx, edi
call fcn.0042c9d0
push 1
mov ecx, edi
call fcn.0044555f
jmp 0x42cdbf
push str.ChoiceDir
lea ecx, [ebp - 0x94]
call fcn.0044daaf
test al, al
je 0x42ccc1
mov ecx, edi
call fcn.0042c870
jmp 0x42cdbf
push str.OpenSpace
lea ecx, [ebp - 0x94]
call fcn.0044daaf
test al, al
je 0x42cdbf
mov ecx, dword [edi + 0x764]
lea edx, [ebp - 0x154]
push edx
mov ebx, 0x6d7750
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0044df26
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.0044d9e9
test esi, esi
jle 0x42cd3a
mov ecx, dword [edi + 0x764]
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0044daf7
lea ecx, [ebp - 0x154]
mov ebx, eax
call fcn.0044d9e9
movaps xmm0, xmmword [0x6db6d0]
lea eax, [ebp - 0xd0]
push eax
mov dword [ebp - 0xd0], 0x3c
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0x6d9a9c
mov dword [ebp - 0xc0], ebx
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 0x94]
call fcn.0044d9e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret 4
Function at 0x42ef00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640362
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x6fe224]
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x6d9a9c
test eax, eax
jne 0x42ef80
push 0x3e0
call fcn.004a14a7
mov esi, eax
mov dword [ebp - 0x50], esi
push 0x3e0
push 0
push esi
mov dword [ebp - 4], 0
call fcn.004b95f0
add esp, 0x10
mov ecx, esi
call fcn.004358e0
mov dword [0x6fe224], eax
movaps xmm0, xmmword [0x6db6d0]
add eax, 0x14
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
push eax
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret

Function at 0x432490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640a38
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push 0xa
xor eax, eax
mov dword [ebp - 0x18], 0
push str.__select_
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00402400
mov ecx, esi
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4324f0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402550
push 0x3c
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
mov dword [ebp - 0x64], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x54], str.explorer
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x58], 0x6d9a9c
mov dword [ebp - 0x48], 0xa
mov dword [ebp - 0x4c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43258a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x432580
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4325a6
push edx
push ecx
call fcn.004a14d7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret 4
call fcn.004bd1a9
int3
Function at 0x4350d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640efc
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 3
lea ecx, [ebp - 0x28]
call fcn.0041ab00
mov dword [ebp - 4], 0
mov eax, dword [0x6fe22c]
test eax, eax
jne 0x435152
push 0x8a0
call fcn.004a14a7
mov esi, eax
mov dword [ebp - 0x2c], esi
push 0x8a0
push 0
push esi
mov byte [ebp - 4], 1
call fcn.004b95f0
add esp, 0x10
mov ecx, esi
call fcn.0042d5e0
mov byte [ebp - 4], 0
mov dword [0x6fe22c], eax
mov ecx, eax
call fcn.004453d3
sub esp, 0x18
mov esi, eax
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00404260
mov ecx, esi
call fcn.0040f350
add esp, 0x18
cmp eax, 1
jne 0x43525a
mov ecx, dword [edi + 0x14]
push str.OrderList
call fcn.004475d8
mov dword [ebp - 0x38], eax
test eax, eax
je 0x43525a
mov edx, dword [eax + 0x550]
lea ecx, [eax + 0x550]
call dword [edx + 0x20]
mov eax, dword [0x6fe224]
test eax, eax
jne 0x4351df
push 0x3e0
call fcn.004a14a7
mov esi, eax
mov dword [ebp - 0x2c], esi
push 0x3e0
push 0
push esi
mov byte [ebp - 4], 2
call fcn.004b95f0
add esp, 0x10
mov ecx, esi
call fcn.004358e0
mov byte [ebp - 4], 0
mov dword [0x6fe224], eax
mov ecx, dword [eax + 0x374]
sub ecx, dword [eax + 0x370]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x43525a
mov bl, 1
call fcn.00417d40
mov esi, dword [eax + 0x370]
mov eax, dword [eax + 0x374]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x43525a
nop word [eax + eax]
xor bl, 1
cmp dword [esi + 0x68], 0x3e7
mov byte [ebp - 0x34], bl
sete byte [ebp - 0x30]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
sub esp, 0xe4
mov ecx, esp
push esi
call fcn.0041f2f0
push dword [ebp - 0x38]
mov ecx, edi
call fcn.00435300
add esi, 0xe4
cmp esi, dword [ebp - 0x2c]
jne 0x435220
mov ecx, dword [edi + 0x14]
push str.OrderList
call fcn.004475d8
mov ebx, eax
test ebx, ebx
je 0x4352a7
mov ecx, dword [edi + 0x14]
push str.SellFrame
call fcn.004475d8
mov edx, dword [ebx + 0x550]
lea ecx, [ebx + 0x550]
mov esi, eax
call dword [edx + 0xc]
test eax, eax
jle 0x435297
test esi, esi
je 0x4352a7
push 0
jmp 0x43529d
test esi, esi
je 0x4352a7
push 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x210]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4352d7
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4352cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4352f3
push edx
push ecx
call fcn.004a14d7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret
call fcn.004bd1a9
int3
Function at 0x436310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push edi
push eax
push 0x20019
push 0
push str.SoftwareGameHole2
mov edi, ecx
mov dword [ebp - 0x218], 0
push reloc.gdiplus.dll_Ordinal_1
mov dword [ebp - 0x214], edi
call esi
test eax, eax
jne 0x436480
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push 0x20019
push 0
push str.SoftwareGameHole2
push reloc.gdiplus.dll_Ordinal_1
call esi
test eax, eax
jne 0x436492
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x214]
push eax
lea eax, [edi + 0x10]
mov dword [ebp - 0x214], 4
push eax
push 0
push 0
push str.Close
push dword [ebp - 0x218]
call esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 4
push eax
lea eax, [edi + 0xc]
push eax
push 0
push 0
push str.Desktop
push dword [ebp - 0x218]
call esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 4
push eax
lea eax, [edi + 8]
push eax
push 0
push 0
push str.AutoRun
push dword [ebp - 0x218]
call esi
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
mov dword [ebp - 0x214], 0x208
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push str.SaveDir
push dword [ebp - 0x218]
call esi
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x214]
mov dword [edi + 4], 1
call fcn.004364b0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a1496
mov esp, ebp
pop ebp
ret
Function at 0x4364b0
Capabilities:
Check if file exists
Create directory
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareGameHole2
push reloc.gdiplus.dll_Ordinal_1
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4366a1
mov ecx, dword [esi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
movsx eax, word [ecx + 0x28a]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
add eax, 0x10
push eax
push 4
push 0
push str.Close
push dword [ebp - 0x214]
call ebx
mov ecx, dword [esi]
push 4
movsx eax, word [ecx + 0x28e]
mov dword [ecx + 0xc], eax
mov eax, dword [esi]
add eax, 0xc
push eax
push 4
push 0
push str.Desktop
push dword [ebp - 0x214]
call ebx
mov ecx, dword [esi]
push 4
movsx eax, word [ecx + 0x28c]
mov dword [ecx + 8], eax
mov eax, dword [esi]
add eax, 8
push eax
push 4
push 0
push str.AutoRun
push dword [ebp - 0x214]
call ebx
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004b95f0
mov ecx, dword [esi]
add esp, 0xc
call fcn.00436050
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
test eax, eax
je 0x4365f8
mov eax, dword [esi]
add eax, 0x228
cmp dword [eax + 0x14], 8
jb 0x4365aa
mov eax, dword [eax]
push eax
push str._sGameHole
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00435810
add esp, 0x10
lea eax, [ebp - 0x210]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4365f8
push 0x104
lea eax, [ebp - 0x210]
push eax
mov eax, dword [esi]
add eax, 0x14
push eax
call ebx
mov eax, dword [esi]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x436656
push 0x208
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x436642
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
lea eax, [ebp - 0x210]
push eax
mov eax, dword [esi]
add eax, 0x14
push eax
call ebx
mov eax, dword [esi]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
mov eax, dword [esi]
add eax, 0x14
push eax
push 1
push 0
push str.SaveDir
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1496
mov esp, ebp
pop ebp
ret
Function at 0x436920
Capabilities:
Check if file exists
Create shortcut via ishelllink
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x6dad48
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x6dad60
lea ecx, [ebp - 0x20c]
call fcn.004357a0
push 0x6dad80
lea ecx, [ebp - 0x20c]
call fcn.004357a0
push str.GameHole2.exe
lea ecx, [ebp - 0x20c]
call fcn.004357a0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436b07
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x436b07
lea eax, [ebp - 0x620]
push eax
push 0x655b90
push 1
push 0
push 0x655bd0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x436b01
mov eax, dword [ebp - 0x620]
lea edx, [ebp - 0x20c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov edx, 0x104
push SysReAllocString
push eax
push ecx
lea ecx, [ebp - 0x61c]
call fcn.00435890
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x620]
lea edx, [ebp - 0x61c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x620]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x6dacf4
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x436a6c
mov eax, dword [ebp - 0x620]
push 0x6dacf4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov ecx, dword [ebp - 0x620]
lea edx, [ebp - 0x624]
push edx
push 0x655bf0
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x436af5
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x6dadb4
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..lnk
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
mov eax, dword [ebp - 0x624]
lea edx, [ebp - 0x414]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x624]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x620]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret
Function at 0x43d7a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x641a3b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xb8
xor esi, esi
lea eax, [ebp - 0xc8]
push esi
push eax
call fcn.004b95f0
push edi
lea ecx, [ebp - 0xc8]
call fcn.0043ea20
mov dword [ebp - 4], esi
cmp dword [ebp - 0x6c], esi
je 0x43d897
push 0x1000
call fcn.004a150d
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xbc], 1
jne 0x43d883
nop
push 0
push 0x1000
push ebx
lea ecx, [ebp - 0xc8]
mov dword [ebx], 0
call fcn.00404f80
mov eax, dword [ebp - 0xc0]
xor edx, edx
add eax, ebx
mov ecx, ebx
mov edi, eax
not esi
sub edi, ebx
cmp ebx, eax
cmova edi, edx
test edi, edi
je 0x43d86e
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
xor eax, esi
inc edx
movzx eax, al
shr esi, 8
xor esi, dword [eax*4 + 0x6d71b0]
cmp edx, edi
jb 0x43d854
mov eax, dword [ebp - 0xc8]
not esi
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xbc], 1
je 0x43d820
push ebx
call fcn.004a1508
add esp, 4
lea ecx, [ebp - 0xc8]
call fcn.00404330
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc8], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xcc], eax
lea ecx, [ebp - 0xb8]
call fcn.00404eb0
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc8], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc8]
mov edx, dword [eax + 4]
lea ecx, [edx - 0x18]
mov dword [ebp + edx - 0xcc], ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.0049ea6e
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1496
mov esp, ebp
pop ebp
ret
Function at 0x440280
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [edi], vtable.DownEngine::CDownWrapper.0
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x6db204
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x6db204
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XL_Init
push eax
mov dword [edi + 4], eax
call esi
push str.XL_UnInit
push dword [edi + 4]
mov dword [edi + 8], eax
call esi
push str.XL_CreateTask
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.XL_DeleteTask
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.XL_StartTask
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push str.XL_StopTask
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
push str.XL_ForceStopTask
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
push str.XL_QueryTaskInfo
push dword [edi + 4]
mov dword [edi + 0x20], eax
call esi
push str.XL_QueryTaskInfoEx
push dword [edi + 4]
mov dword [edi + 0x24], eax
call esi
push str.XL_DelTempFile
push dword [edi + 4]
mov dword [edi + 0x28], eax
call esi
push str.XL_SetSpeedLimit
push dword [edi + 4]
mov dword [edi + 0x2c], eax
call esi
push str.XL_SetUploadSpeedLimit
push dword [edi + 4]
mov dword [edi + 0x30], eax
call esi
push str.XL_SetProxy
push dword [edi + 4]
mov dword [edi + 0x34], eax
call esi
push str.XL_SetUserAgent
push dword [edi + 4]
mov dword [edi + 0x38], eax
call esi
push str.XL_ParseThunderPrivateUrl
push dword [edi + 4]
mov dword [edi + 0x3c], eax
call esi
push str.XL_GetFileSizeWithUrl
push dword [edi + 4]
mov dword [edi + 0x40], eax
call esi
push str.XL_SetFileIdAndSize
push dword [edi + 4]
mov dword [edi + 0x44], eax
call esi
push str.XL_SetAdditionInfo
push dword [edi + 4]
mov dword [edi + 0x48], eax
call esi
push str.XL_CreateTaskByURL
push dword [edi + 4]
mov dword [edi + 0x4c], eax
call esi
push str.XL_CreateTaskByThunder
push dword [edi + 4]
mov dword [edi + 0x50], eax
call esi
push str.XL_CreateBTTaskByThunder
push dword [edi + 4]
mov dword [edi + 0x54], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [edi + 0x58], eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
call fcn.004a1496
mov esp, ebp
pop ebp
ret
Function at 0x443a40
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37cc
call fcn.004a2410
mov eax, dword [0x6f1114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
push esi
push edi
mov dword [ebp - 0x37cc], eax
xor edi, edi
nop word [eax + eax]
push edi
push str..PhysicalDrive_d
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.004086c0
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x443c30
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37bc], 0
push 0
push eax
mov dword [ebp - 0x37c0], 0
mov dword [ebp - 0x37c8], 0
mov dword [ebp - 0x37c4], 0
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x37bc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c8]
push eax
push 0x2d1400
push esi
call ebx
test eax, eax
je 0x443c29
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0xcc0]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.00443ee0
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0x8d8]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.00443ee0
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push 0
lea ecx, [ebp - 0x37b8]
call fcn.00443ee0
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.00443ee0
add esp, 0x20
cmp byte [0x6fe248], 0
jne 0x443bf2
movsx eax, byte [ebp - 0x4f0]
push eax
call fcn.004c38ac
add esp, 4
test eax, eax
jne 0x443bb6
movsx eax, byte [ebp - 0x4dd]
push eax
call fcn.004c38ac
add esp, 4
test eax, eax
je 0x443bf2
lea eax, [ebp - 0x4f0]
push eax
push 0x400
push 0x6fe248
call fcn.004cb7fb
add esp, 0xc
lea eax, [ebp - 0x8d8]
push eax
push 0x400
push 0x6fe648
call fcn.004cb7fb
add esp, 0xc
mov dword [ebp - 0x37cc], 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call fcn.004b95f0
add esp, 0xc
lea eax, [ebp - 0x37bc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x443a70
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x37cc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a1496
mov esp, ebp
pop ebp
ret