joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3f38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d33a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
lea edi, [ebx + 0xa0]
push esi
call fcn.00429f30
push esi
mov dword [ebp + 8], eax
call fcn.00429f30
push esi
mov dword [ebp - 0x10], eax
call fcn.00429f30
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x28]
mov edi, dword [ebp + 0xc]
push edx
push ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
push edi
push edx
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push ecx
push edx
push eax
push str.FixedProvider::OnBlockComplete__I64d__I64d_result:_d__downsize_I64d
push str.XNet
push 0x10
call fcn.004076e0
add esp, 0x24
mov ecx, esp
mov dword [ebp + 8], esp
push esi
call fcn.00407520
push ebx
call fcn.00415be0
push edi
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push esi
call fcn.00407520
mov ecx, ebx
call fcn.00415c90
lea esi, [ebx + 0x30]
call fcn.00421240
test eax, eax
jne 0x413c50
mov eax, ebx
call fcn.00417c50
test eax, eax
je 0x413c50
mov edi, esi
call fcn.004215f0
mov edi, ebx
call fcn.00418900
call fcn.00421240
test eax, eax
jne 0x413c64
push ebx
call fcn.004144f0
jmp 0x413d2b
mov edx, dword [0x4d2c98]
mov eax, dword [edx + 0xc]
mov ecx, 0x4d2c98
call eax
add eax, 0x10
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
push str.URL_POST_SKIPPED_Due_o_Network_Complete
push ecx
mov byte [ebp - 4], 1
call fcn.00407bb0
mov edx, dword [0x4d2c98]
mov eax, dword [edx + 0xc]
add esp, 8
mov ecx, 0x4d2c98
call eax
add eax, 0x10
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
mov edi, dword [ebp + 8]
push edi
lea ecx, [ebp + 0xc]
push 0x4be71c
push ecx
call fcn.00407bb0
mov edx, dword [ebx]
mov esi, dword [ebp + 0xc]
mov eax, dword [edx + 0x50]
add esp, 0xc
push esi
mov ecx, ebx
call eax
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x44]
mov ecx, ebx
call eax
push eax
push ebx
push str._p_STATE___s___s__s
push str.XNet
push 0x10
call fcn.004076e0
lea eax, [esi - 0x10]
add esp, 0x1c
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d2b
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
push ebx
call fcn.00415d90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416970
Capabilities:
Check for time delay via queryperformancecounter
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x4a3920
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push esi
push edi
mov eax, dword [0x4d33a4]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x14]
cmp eax, 0xb
ja case.0x4169af.10
movzx eax, byte [eax + 0x416bb0]
jmp dword [eax*4 + 0x416ba4]
push 0x1ae
push str.src_asyncfileAsyncFile.cpp
push str.FALSE
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
push 0x350
push str.srcdownworkersprovider_fixedFixedProvider.cpp
push str.m_pFile__GetStatus____AsyncFile::AsyncFileState_None
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
cmp dword [ebp + 8], 0
je 0x416b55
mov eax, dword [esi + 0x2c]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x416a1e
push 0x80004005
call fcn.00407be0
mov ecx, dword [esi + 0x28]
push eax
push ecx
call fcn.0047f5d2
add esp, 8
test eax, eax
je 0x416b78
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x20], str.Util_MoveFile
mov dword [esp + 0x24], str.XNet
mov dword [esp + 0x40], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push eax
push 0x4bf5c0
push ecx
push 0x25
call fcn.004076e0
mov dword [esp + 0x90], 0
mov eax, dword [esi + 0x2c]
add esp, 0xc
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00407c10
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x88], 1
mov eax, dword [esi + 0x28]
sub eax, 0x10
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00407c10
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x88], 0
call fcn.0040bbd0
add esp, 8
test eax, eax
jne 0x416af5
push 0x35b
push str.srcdownworkersprovider_fixedFixedProvider.cpp
push str._L_Move_File_Failed__
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x3c], 0
je 0x416b78
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
sbb ecx, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
fild qword [esp + 0x14]
mov edx, dword [esp + 0x1c]
fild qword [esp + 0x34]
mov eax, dword [esp + 0x20]
sub esp, 8
fdivp st(1)
fstp qword [esp]
push edx
push 0x4bf5dc
push eax
push 0x25
call fcn.004076e0
add esp, 0x18
jmp 0x416b78
mov esi, dword [esi + 0x28]
push ecx
sub esi, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
push esi
call fcn.00407c10
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.0041b240
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
push str.FixedProvider::Complete_success_d
push str.XNet
push 0x10
call fcn.004076e0
add esp, 0x10
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418ce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a30e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d33a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x20], esi
mov eax, dword [0x4d2c98]
mov edx, dword [eax + 0xc]
mov ecx, 0x4d2c98
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], esi
mov eax, dword [ebx + 0x150]
mov ecx, dword [eax]
mov edi, dword [ecx]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
cmp edi, eax
je 0x418dbb
lea ecx, [ecx]
mov esi, dword [edi + 8]
test esi, esi
je 0x418d60
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
test esi, esi
jne 0x418d6b
mov byte [esp + 0x38], 0
jmp 0x418db1
cmp dword [esi + 0x34], 0
jbe 0x418d75
inc dword [esp + 0x1c]
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
test eax, eax
jl 0x418d93
jg 0x418d85
test ecx, ecx
je 0x418d93
inc dword [esp + 0x18]
add dword [esp + 0x24], ecx
adc dword [esp + 0x28], eax
jmp 0x418da3
cmp dword [esi + 0x3c], 0
ja 0x418d9f
cmp dword [esi + 0x2c], 0
jbe 0x418da3
inc dword [esp + 0x14]
mov byte [esp + 0x38], 0
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov edi, dword [edi]
cmp edi, dword [ebx + 0x150]
jne 0x418d50
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [ebx + 0x154]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
dec eax
push eax
lea edx, [esp + 0x38]
push str._r_nP2S:_d_T_d_S_d_F_d__I64d
push edx
call fcn.0040abe0
mov esi, dword [ebp + 8]
add esp, 0x20
push esi
lea edi, [ebx + 0x194]
call fcn.0040e220
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418e25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41baf0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
mov esi, eax
je 0x41bb1e
push 0x19
push str.srcdownworkershttpHttpRequestJob.cpp
push str.result__OK
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
cmp dword [esi + 0x58], 0
mov dword [esi + 0x54], 4
mov ebx, 0xffffd8f0
je 0x41bb50
push 0x21
push str.srcdownworkershttpHttpRequestJob.cpp
push str._m_hSession
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
push 0x10000000
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x58], eax
test eax, eax
jne 0x41bb77
pop esi
mov eax, 0xffffd8f1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x41d980
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
jne 0x41bb95
pop esi
mov eax, 0xffffd8f2
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x58]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [ebp + 8]
push eax
push 2
push ecx
mov dword [ebp + 8], 0x2710
call edi
test eax, eax
jne 0x41bbc3
pop edi
pop esi
mov eax, 0xffffd8f3
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x58]
push 4
lea edx, [ebp + 8]
push edx
push 5
push eax
call edi
test eax, eax
jne 0x41bbe3
pop edi
pop esi
mov eax, 0xffffd8f4
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x18], eax
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
lea eax, [ebp - 4]
push eax
mov ecx, esi
call edx
mov ecx, dword [ebp - 4]
mov edi, dword [eax]
test ecx, ecx
je 0x41bc0c
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
test edi, edi
je 0x41bcb3
cmp dword [esi + 0x5c], 0
lea ebx, [esi + 0x5c]
je 0x41bc3d
push 0x45
push str.srcdownworkershttpHttpRequestJob.cpp
push str._m_hConnect
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
mov eax, dword [esi + 0x6c]
mov dword [eax + 0x14], ebx
mov eax, dword [esi + 0x6c]
movzx edx, word [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
mov eax, dword [esi + 0x58]
push 0
push 3
push 0
push 0
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
xor ecx, ecx
cmp eax, ecx
je 0x41bc81
mov esi, dword [esi + 0x6c]
mov dword [ebx], eax
pop edi
mov dword [esi + 0x14], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x41bca2
mov ecx, dword [esi + 0x6c]
pop edi
pop esi
mov dword [ecx + 0x18], eax
mov eax, 0xffffd8f8
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
pop edi
mov dword [esi + 0x64], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41cb90
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x41cbbc
push 0x1a2
push str.srcdownworkershttpHttpRequestJob.cpp
push str.OK__result
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
mov ecx, dword [esi + 0x6c]
mov dword [esi + 0x54], 0xb
mov eax, dword [ecx + 0x74]
mov edx, dword [ecx + 0x6c]
push ebx
push edi
mov edi, dword [ecx + 0x6c]
mov dword [ecx + 0x70], eax
mov ebx, edx
cmp edx, eax
jl 0x41cbdc
mov ebx, eax
test ebx, ebx
jns 0x41cbe4
xor edx, edx
jmp 0x41cbea
cmp edx, eax
jl 0x41cbea
mov edx, eax
mov dword [ecx + 0x70], edx
mov ecx, dword [ecx + 0x64]
add ecx, edx
cmp eax, edi
jae 0x41cc53
mov edx, edi
sub edx, eax
cmp edx, 0x400
jbe 0x41cc07
mov edx, 0x400
mov edi, dword [esi + 0x6c]
mov dword [edi + 0x60], 0
mov edi, dword [esi + 0x6c]
add edi, 0x60
push edi
push edx
add ecx, eax
mov eax, dword [esi + 0x60]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x41cc53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x41cc48
mov ecx, dword [esi + 0x6c]
pop edi
mov dword [ecx + 0x18], eax
mov eax, 0xffffd8fc
pop ebx
pop ebp
ret 4
pop edi
mov eax, 1
pop ebx
pop ebp
ret 4
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x41ee10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3dd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d33a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call edx
mov dword [ebp - 4], 0
mov ecx, dword [eax]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov edi, dword [esi + 0x6c]
call edx
mov dword [edi + 0x78], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41ee6f
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
cmp ebx, 0xd
jl 0x41ee80
mov eax, dword [esi + 0x6c]
mov dword [eax + 0x7c], 0xe
jmp 0x41ee86
mov ecx, dword [esi + 0x6c]
mov dword [ecx + 0x7c], ebx
mov edx, dword [esi + 0x6c]
mov ecx, dword [ebp + 8]
mov dword [edx + 0x80], ebx
mov eax, dword [esi + 0x6c]
mov dword [eax + 0x84], ecx
mov edx, dword [esi + 0x6c]
mov eax, dword [esi + 0x54]
mov dword [edx + 0x88], eax
mov eax, dword [esi + 0x6c]
mov ecx, dword [eax + 0x18]
mov dword [eax + 0x8c], ecx
mov edx, dword [esi + 0x6c]
cmp dword [edx + 0x7c], 0
je 0x41eee7
mov esi, edx
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0x88]
mov edx, dword [esi + 0x84]
push eax
push ecx
push edx
push str.__d___d___d_
add esi, 0x90
push esi
call fcn.0040abe0
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4204d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push esi
add eax, eax
lea edx, [ebp + 8]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42053f
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x42050e
cmp eax, 2
jne 0x420529
mov eax, dword [ebp - 4]
test esi, esi
je 0x420539
test eax, eax
je 0x420534
test al, 1
jne 0x420529
mov edx, eax
shr edx, 1
cmp word [esi + edx*2 - 2], 0
je 0x420539
mov eax, 0xd
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov word [esi], cx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x425990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2d60
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4d33a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x425adc
mov edx, dword [ebp + 8]
test edx, edx
je 0x425adc
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
push 0
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x18]
push edx
push eax
push ecx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x425a19
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x425a19
push eax
push str.Util_SetFilePointer__d
push str.XNet
push 0x10
call fcn.004076e0
add esp, 0x10
jmp 0x425aff
mov edx, dword [esi + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov esi, dword [ebp + 0x10]
mov eax, dword [eax + 8]
push 0
push esi
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x425ac7
mov eax, dword [0x4d2c98]
mov edx, dword [eax + 0xc]
push ecx
mov edi, esp
mov ecx, 0x4d2c98
mov dword [ebp + 0x10], esp
mov dword [ebp + 0xc], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov eax, str.Util_WriteFile
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x425a88
mov ecx, eax
movzx esi, cx
push 0
push esi
call fcn.00407150
add esp, 8
test eax, eax
je 0x425a96
push esi
push eax
mov ecx, edi
call fcn.004073b0
jmp 0x425a96
push 0xe
push str.Util_WriteFile
mov ecx, edi
call fcn.00407840
lea edx, [ebp + 0x10]
push edx
mov byte [ebp - 4], 0
call fcn.0040b3b0
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x425aff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x425aff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ecx], 0
mov dword [edx + 0x18], 0
jmp 0x425aff
push 0x25d
push str.src_asyncfileAsyncFile.cpp
push str.m_fileHandle__data
push str.ASSERT:_s_FILE:_s_LINE_d
push str.XNet
push 0x40
call fcn.004076e0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x425b14
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42a9d3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00407520
mov esi, str._bdcommon.dll
push esi
call fcn.0047d834
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0041b0e0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x42aa1e
xor bl, bl
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00407c80
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a697c
push edi
call esi
push 0x4a6968
push edi
mov dword [0x4d58c4], eax
call esi
push 0x4a6934
push edi
mov dword [0x4d58c8], eax
call esi
push 0x4a6908
push edi
mov dword [0x4d58c0], eax
call esi
push 0x4a68dc
push edi
mov dword [0x4d58bc], eax
call esi
push 0x4a68bc
push edi
mov dword [0x4d58b8], eax
call esi
push str._InsertStringTable_String_Help__YAJPAY01QB_WI_Z
push edi
mov dword [0x4d58b4], eax
call esi
push str._LoadStringW_String_Help__YAPB_WPB_W_Z
push edi
mov dword [0x4d58b0], eax
call esi
push str._LoadStringW2_String_Help__YAPB_WPB_W_Z
push edi
mov dword [0x4d58ac], eax
call esi
push str._LoadStringFromXml_String_Help__YAJPA_W0_Z
push edi
mov dword [0x4d58a8], eax
call esi
mov dword [0x4d58a4], eax
mov bl, 1
jmp 0x42aa0c

Function at 0x42cc0f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42cc1d
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x42ccd8
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a9280]
add edx, 8
sub edi, 8
dec esi
jne 0x42cc3b
pop ebx
test edi, edi
je 0x42ccf1
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4a9280]
inc edx
dec edi
jne 0x42ccdc
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x42ccf7
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x4a9280]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4a9280]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x42d1be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x42d1f2
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42d1ed
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x42d21a
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x42d203
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0047db00
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x42f543
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x42f5f3
cmp dword [esi + 4], 0xffffffff
jne 0x42f5f3
push ebx
push edi
lea ebx, [esi + 0x244]
push ebx
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
call fcn.0047d834
movzx eax, word [esi + eax*2 + 0x242]
pop ecx
cmp eax, 0x5c
je 0x42f599
cmp eax, 0x2f
je 0x42f599
push 0x4a98ac
push edi
push ebx
call fcn.0047f3d3
add esp, 0xc
cmp dword [ebp + 0x10], 1
pop edi
pop ebx
jne 0x42f5bc
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42f5bc
mov eax, 0x2000000
jmp 0x42f5f8
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042cfe3
add esp, 0x10
test eax, eax
jne 0x42f5da
mov eax, dword [ebp + 0x10]
jmp 0x42f5f8
push eax
call fcn.0042f018
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x42f5f8
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x42f5fd
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov ebx, dword [ebp + 8]
push edi
test ebx, ebx
je 0x42f624
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42f624
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [ebp + 0xc]
movzx ecx, word [edi]
test cx, cx
je 0x42f6da
mov eax, edi
mov edx, edi
cmp cx, 0x2f
je 0x42f643
cmp cx, 0x5c
jne 0x42f645
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x42f637
push esi
cmp eax, edi
je 0x42f684
sub eax, edi
sar eax, 1
lea esi, [eax + eax]
push esi
lea eax, [ebp - 0x410]
push edi
push eax
call fcn.0047db00
xor eax, eax
mov word [ebp + esi - 0x410], ax
lea eax, [ebp - 0x410]
push eax
push ebx
call fcn.0042f5fd
add esp, 0x14
xor eax, eax
mov word [ebp - 0x208], ax
mov esi, 0x104
test ebx, ebx
je 0x42f6a7
push ebx
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0047f243
add esp, 0xc
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0047f3d3
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
cmp eax, 0xffffffff
jne 0x42f6da
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop ebx
leave
ret