joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54b990
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x54b9ae
mov eax, 0x1000000
pop esi
add esp, 0x50
ret
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x54b9c8
mov eax, 0x200
pop esi
add esp, 0x50
ret
mov eax, dword [esp + 0x20]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
push edi
je 0x54b9dc
mov ebp, 1
test al, 2
je 0x54b9e3
or ebp, 2
test al, 4
je 0x54b9ea
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x54b9f4
or ebp, 0x10
test al, 0x20
je 0x54b9fb
or ebp, 0x20
test ecx, ecx
je 0x54ba07
or ebp, 0x40000000
jmp 0x54ba0d
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x54ba1d
or ebp, 0x800000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x54bacb
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x6c]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x64], 0x54ad
jne 0x54bacb
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x54bacb
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x2c]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x54bac5
cmp eax, 0x454e
je 0x54bac5
cmp eax, 0x454c
je 0x54bac5
cmp eax, 0x4550
jne 0x54bacb
or ebp, 0x400000
mov eax, dword [esp + 0x68]
pop ebx
test eax, eax
je 0x54bad6
mov dword [eax], ebp
mov eax, dword [esp + 0x68]
test eax, eax
je 0x54bae4
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov esi, dword [esp + 0x6c]
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test esi, esi
je 0x54bb4e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
push ecx
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x3c]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
push edx
call edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.0054b8d0
mov edx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.0054b8d0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov dword [esi + 4], eax
call fcn.0054b8d0
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x70]
test esi, esi
je 0x54bb91
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push ecx
call edi
lea edx, [esp + 0x64]
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
and edx, 0xffff
and eax, 0xffff
shl edx, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x54bd70
Capabilities:
Write file on windows

Disassembly:
mov edx, ecx
push ebx
push esi
push edi
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x54bdc0
mov edi, dword [edx + 0x1c]
mov eax, dword [esp + 0x14]
mov esi, dword [edx + 0x20]
lea ecx, [edi + eax]
cmp ecx, esi
jb 0x54bd9c
pop edi
pop esi
mov dword [edx + 0xc], 0x30000
xor eax, eax
pop ebx
ret 8
mov esi, dword [esp + 0x10]
mov ecx, eax
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x1c]
pop edi
add ecx, eax
pop esi
mov dword [edx + 0x1c], ecx
pop ebx
ret 8
mov eax, dword [edx]
test eax, eax
je 0x54bde8
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
mov dword [edx + 0xc], 0x1000000
xor eax, eax
pop ebx
ret 8

Function at 0x54c210
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov edx, dword [ebx + 0x58]
test edx, edx
je 0x54c27a
mov eax, dword [ebx + 0x60]
mov ebp, dword [ebx + 0x5c]
cmp eax, ebp
jae 0x54c2cb
mov ecx, dword [esp + 0x14]
sub ebp, eax
cmp ebp, ecx
jbe 0x54c236
mov ebp, ecx
mov ecx, ebp
lea esi, [eax + edx]
mov eax, dword [esp + 0x10]
mov edx, ecx
push edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x48], ecx
call fcn.0054b6a0
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x54c2c4
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x54c2cb
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x48]
add ecx, eax
push eax
mov eax, dword [ebx + 0x4c]
push esi
push eax
mov dword [ebx + 0x48], ecx
call fcn.0054b6a0
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
ret 8
mov dword [ebx + 0xc], 0x1000000
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x54ed60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x54ed6b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x54ee6e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x786814]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x786814]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x786814]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x786814]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x786814]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x786814]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x786814]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x786814]
xor eax, edx
inc ecx
dec edi
jne 0x54ed86
pop edi
test esi, esi
je 0x54ee90
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x786814]
xor eax, edx
inc ecx
dec esi
jne 0x54ee72
pop esi
pop ebx
not eax
ret

Function at 0x54f810
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x54f851
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x54f846
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x54f864
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x5507a0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x550855
cmp dword [ebp + 4], 0xffffffff
jne 0x550855
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x7bdfa8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x55081d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x55081d
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.0054f5a0
add esp, 0x10
test eax, eax
jne 0x550840
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.0054fae0
add esp, 4
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x550cb0
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x208
test ecx, ecx
je 0x550d78
mov al, byte [ecx]
test al, al
je 0x550d78
push ebx
push esi
push edi
mov ebx, ecx
mov esi, ecx
cmp al, 0x2f
je 0x550cdb
cmp al, 0x5c
jne 0x550cdd
mov ebx, esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x550cd3
mov edi, dword [esp + 0x218]
cmp ebx, ecx
je 0x550d14
mov esi, ebx
lea eax, [esp + 0xc]
sub esi, ecx
push esi
push ecx
push eax
call fcn.00559017
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.00550cb0
add esp, 0x14
inc ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x5534a0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x10
push esi
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, edi
je 0x5534e8
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 8]
push ecx
push 0x553440
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x55350c
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call edi
push 1
mov esi, eax
call edi
push eax
push esi
add eax, 0xffffffec
add esi, 0xffffffd8
push eax
lea edx, [esp + 0x14]
push esi
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 8]
mov ecx, eax
pop edi
pop esi
mov dword [ecx], edx
mov edx, dword [esp + 4]
mov dword [ecx + 4], edx
mov edx, dword [esp + 8]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 0xc], edx
add esp, 0x10
ret 4

Function at 0x558ddf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x558dff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005579ba
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x558e22
test byte [esp + 8], 2
je 0x558e22
call fcn.00557a2d
mov dword [eax], 0xd
call fcn.00557a36
mov dword [eax], 5
jmp 0x558dfb
xor eax, eax
ret

Function at 0x56ada1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x56add9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00568db2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00568d8a
jmp 0x56ade5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x56c619
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x56c65b
call fcn.005730f6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x56c65b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x56c652
xor eax, eax
jmp 0x56c663
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0056c669
pop edi
pop esi
pop ebx
ret 4
Function at 0x573626
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x573654
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x573672
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0057358c
jmp 0x573672
mov eax, dword [esi + 0x14]
test eax, eax
je 0x573672
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0057358c
test edi, edi
mov eax, edi
jne 0x57365c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x575f85
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x575fad
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x575fbe
push 2
call edi
test ax, ax
jge 0x575fbe
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0056a3d6
cmp dword [esi + 0x30], ebx
jne 0x576098
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0056a3d6
cmp eax, dword [esp + 0x34]
jne 0x576098
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x576034
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x576079
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x576098
cmp eax, 0x205
je 0x576098
cmp eax, 0x201
je 0x576098
cmp eax, 0x204
je 0x576098
cmp eax, ebx
jne 0x57605f
cmp dword [esp + 0x1c], 0x1b
je 0x576098
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x82f19c]
jbe 0x57608e
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x575ff1
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4095d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429a10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x464b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, 1
je 0x409611
mov byte [ebp - 0x11], 1
test eax, eax
jne 0x409615
mov byte [ebp - 0x11], 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [ebp + 8]
push 8
push 0x20
call dword [0x42f308]
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x40963e
call dword [0x42f30c]
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
mov ebx, dword [ecx + 4]
shl ebx, 5
add ebx, eax
lea edx, [eax + ecx]
add ebx, ecx
mov eax, dword [edi + 0xc]
add eax, edi
cmp byte [ebp - 0x11], 0
je 0x4096e9
cmp edx, ebx
je 0x4096fb
nop
mov edi, eax
mov esi, edx
add eax, 0x20
add edx, 0x20
push esi
mov ecx, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
call dword [0x42f424]
mov edx, dword [esi + 4]
xor edx, dword [edi + 4]
and edx, 1
xor edx, dword [edi + 4]
mov dword [edi + 4], edx
mov ecx, dword [esi + 4]
xor ecx, edx
and ecx, 2
xor ecx, edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
xor eax, ecx
and eax, 4
xor eax, ecx
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x18]
mov dword [edi + 0x14], ecx
lea ecx, [edi + 0x18]
push eax
call dword [0x42f23c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp edx, ebx
jne 0x409670
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
jmp 0x4096f9
sub ebx, edx
and ebx, 0xffffffe0
push ebx
push edx
push eax
call fcn.00428c12
add esp, 0xc
mov ecx, dword [esi]
mov eax, dword [edi + 8]
xor eax, dword [ecx + 8]
and eax, 0x7fffffff
xor eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov ecx, dword [esi]
mov eax, dword [ecx]
test eax, eax
je 0x409728
cmp eax, 0xffffffff
je 0x40974e
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x40974e
cmp dword [ebp + 8], 0
je 0x409745
cmp byte [ebp - 0x11], 0
jne 0x409745
push 8
push 0x20
push dword [esi]
call dword [0x42f448]
add esp, 0xc
jmp 0x40974e
push dword [esi]
mov ecx, esi
call fcn.00409570
mov dword [esi], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41c030
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push 0
push 0
push 0
push 0
push str.VsyDownload_1.0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0
call dword [0x42fac4]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x41c17d
push esi
push edi
push 0
push 0x84000002
push 0
push 0
push dword [ebp + 8]
push ebx
call dword [0x42fabc]
mov esi, eax
test esi, esi
je 0x41c0a3
mov edi, dword [0x42facc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 0x20000013
push esi
call edi
test eax, eax
jne 0x41c0b5
mov dword [ebp + 8], eax
push ebx
call dword [0x42fac0]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 8], 0xc8
jne 0x41c0a3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000005
push esi
call edi
test eax, eax
jne 0x41c0db
mov dword [ebp - 4], eax
jmp 0x41c0de
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.00423de2
mov ecx, dword [ebp - 4]
mov edi, eax
inc ecx
mov dword [ebp - 0x14], edi
push ecx
push 0
push edi
call fcn.00428c1e
mov eax, dword [ebp + 0xc]
add esp, 0x10
test eax, eax
je 0x41c103
mov dword [eax], edi
mov ebx, dword [ebp - 0x14]
xor edi, edi
nop dword [eax + eax]
push 0
mov dword [ebp - 0x10], 0
call dword [0x42f04c]
mov eax, dword [ebp - 4]
mov ecx, 0x400
sub eax, edi
cmp eax, 0x400
cmovae eax, ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [edi + ebx]
push eax
push esi
call dword [0x42fac8]
mov eax, dword [ebp - 0x10]
add edi, eax
test eax, eax
jne 0x41c110
push esi
mov esi, dword [0x42fac0]
call esi
mov ebx, dword [ebp - 0x18]
push ebx
call esi
cmp dword [ebp + 0xc], 0
jne 0x41c16a
push dword [ebp - 0x14]
call fcn.00423deb
add esp, 4
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4243a7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x42f07c]
test eax, eax
je 0x4243e6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4243e6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4243e6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4243e6
cmp dword [ecx + 0x74], 0xe
jbe 0x4243e6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x411ce7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x654
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00411cb1
mov ecx, 0x4ee6bc
call fcn.0041aeaa
mov esi, esp
sub esp, 0xc
mov ecx, esp
push str.seup_process
call fcn.00411f50
mov ecx, 0x4ee6bc
call fcn.00418e78
mov esp, esi
xor esi, esi
lea edi, [ebp - 0x218]
push 0x208
push esi
push edi
call fcn.0049dcc0
add esp, 0xc
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
dec esi
lea edi, [ebp - 0x634]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, edi
push eax
call fcn.00411fe0
lea ebx, [ebp - 0x420]
mov ecx, ebx
push 0x4d33de
call fcn.00411fe0
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x411d92
mov eax, dword [ebp - 0x41c]
mov ebx, dword [ebp - 0x420]
lea edi, [ebp - 0x63c]
mov ecx, edi
push eax
push ebx
call fcn.0041255c
lea ebx, [ebp - 0x218]
push ebx
call fcn.004b8b3c
add esp, 4
push dword [edi + 4]
push dword [edi]
push eax
push ebx
xor eax, eax
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.00445ff0
add esp, 0x18
cmp byte [ebp - 0x415], 0
jns 0x411de0
push dword [ebp - 0x420]
call fcn.00494236
add esp, 4
movzx eax, byte [ebp - 0x629]
mov ecx, eax
test al, al
jns 0x411df3
mov ecx, dword [ebp - 0x630]
cmp ecx, 4
jb 0x411f28
mov eax, 0x208
xor esi, esi
lea ebx, [ebp - 0x420]
push eax
push esi
push ebx
call fcn.0049dcc0
add esp, 0xc
mov eax, 0x104
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call edi
push ebx
call edi
push str.360base.dll
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
call fcn.0044a860
add esp, 4
xor eax, eax
dec eax
lea ecx, [ebp - 0x654]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ecx], xmm0
call fcn.0045f110
push esi
push esi
call fcn.0045c2d0
add esp, 8
lea ebx, [ebp - 0x628]
mov eax, 0x208
push eax
push esi
push ebx
call fcn.0049dcc0
add esp, 0xc
mov eax, 0x104
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x411ef0
lea esi, [ebp - 0x660]
push 0x8f2
push esi
call fcn.00417c5c
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x411eb1
mov esi, dword [ebp - 0x660]
sub esp, 0x1c
movdqa xmm0, xmmword [0x4d3260]
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], str.Upgrade
call fcn.0044b230
add esp, 0x1c
cmp byte [ebp - 0x655], 0
jns 0x411ef0
push dword [ebp - 0x660]
call fcn.00494236
add esp, 4
call fcn.0045c560
mov ecx, eax
push str.360seup
call fcn.0045cb00
test al, al
je 0x411f10
push dword [ebp + 8]
call fcn.00412c59
add esp, 4
call fcn.004125e5
mov esi, eax
lea ecx, [ebp - 0x654]
call fcn.0045f170
mov al, byte [ebp - 0x629]
test al, al
jns 0x411f3a
push dword [ebp - 0x634]
call fcn.00494236
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10