joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4323e0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.0053ca90
push 0x2454
push 0
push esi
call fcn.0053ca90
lea eax, [esi + 8]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], eax
add esp, 0x18
lea eax, [esi + 0x2148]
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x1048]
mov dword [ebp - 8], eax
lea eax, [esi + 0x2348]
mov dword [ebp - 0x20], eax
lea eax, [esi + 0x2048]
mov dword [ebp - 0x18], eax
mov eax, edi
mov dword [ebp - 0x28], 0x100
mov dword [ebp - 0xc], 0x800
mov dword [ebp - 4], 0x800
mov dword [ebp - 0x1c], 0x80
lea edx, [eax + 2]
mov dword [ebp - 0x14], 0x80
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432470
lea ecx, [ebp - 0x3c]
sub eax, edx
push ecx
push dword [ebp + 8]
sar eax, 1
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4324d7
mov ecx, dword [ebp - 0x30]
cmp ecx, 3
je 0x4324a4
cmp ecx, 4
je 0x4324a4
cmp ecx, 1
jne 0x4324d7
mov ax, word [ebp - 0x24]
mov word [esi], ax
mov eax, 1
pop edi
mov dword [esi + 0x2448], 0
mov dword [esi + 0x244c], 0
mov dword [esi + 4], ecx
mov dword [esi + 0x2450], 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4324e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
je 0x4324f8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0x5d540]
push str.MetalinkFile
push edi
call fcn.0053d3af
add esp, 8
test eax, eax
je 0x432527
xor ecx, ecx
mov word [eax], cx
add eax, 0x1a
push eax
call fcn.0053c015
add esp, 4
mov dword [esi + 0x2698], eax
mov ecx, dword [esi + 0x62f00]
mov eax, 0xe1800e19
sub ecx, dword [esi + 0x62efc]
imul ecx
add edx, ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x43255a
push eax
lea edx, [esi + 0x10]
mov ecx, edi
call fcn.004323e0
add esp, 4
test eax, eax
je 0x4324f0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2464], eax
test eax, eax
je 0x4325b8
cmp dword [esi + 0x2480], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x5d108], 8
jne 0x4325b2
lea eax, [ebp - 4]
push eax
push 0
push esi
push fcn.00432970
push 0
push 0
call fcn.0054273b
mov dword [esi + 0xc], eax
add esp, 0x18
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.00432970
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4335b0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0x26e8]
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 2
cmp dword [eax + 4], 1
je 0x433638
cmp dword [edi + 0x2484], 0
je 0x433613
push dword [esi + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2488]
push dword [edi + 0x2484]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x43361f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x433668
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp dword [esi], 0
jne 0x433653
mov eax, dword [esi + 4]
test eax, eax
je 0x433653
mov dword [esi + 0x18], eax
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
push 1
push ecx
mov ecx, edi
mov dword [esi + 0x28], 0
call fcn.00434d80
test eax, eax
jne 0x433613
pop edi
xor eax, eax
pop esi
pop ecx
pop ebp
ret 4
Function at 0x433e50
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x26e8]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 6
cmp dword [eax + 4], 1
je 0x433edc
cmp dword [edi + 0x2484], 0
je 0x433f12
push dword [esi + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2488]
push dword [edi + 0x2484]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x433ec3
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x3e5
sete cl
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp dword [esi], 0
jne 0x433ef7
mov eax, dword [esi + 4]
test eax, eax
je 0x433ef7
mov dword [esi + 0x18], eax
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 1
push ebx
mov dword [esi + 0x28], 4
call fcn.00434d80
test eax, eax
jne 0x433f12
push ebx
mov ecx, edi
call fcn.004347c0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x434040
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x26e8]
mov edi, dword [eax + ebx*4]
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
je 0x4341e1
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4340a1
lea ecx, [ebp - 4]
mov dword [ebp + 8], 0
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 8], 4
push ecx
push 0x20000013
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4340a1
mov eax, dword [ebp + 8]
jmp 0x4340a3
xor eax, eax
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x4340b0
mov dword [ecx + 0x2450], eax
cmp dword [edi], 0
jne 0x43416c
cmp eax, 0xce
jne 0x43416c
cmp dword [esi + 0x5d110], 0xffffffff
jne 0x4340da
cmp dword [esi + 0x5d114], 0xffffffff
je 0x434188
push edi
mov ecx, esi
call fcn.004354d0
test eax, eax
je 0x434199
cmp dword [edi + 0x38], 0xffffffff
mov edx, dword [edi + 0x3c]
jne 0x4340fc
cmp edx, 0xffffffff
je 0x434199
mov eax, dword [edi + 0x8040]
mov ecx, dword [eax + 8]
add ecx, dword [edi + 0x38]
mov eax, dword [eax + 0xc]
adc eax, edx
cmp dword [esi + 0x5d118], 0
mov edx, dword [esi + 0x5d11c]
jne 0x434120
test edx, edx
je 0x43412c
cmp dword [esi + 0x5d118], ecx
jne 0x434141
cmp edx, eax
jne 0x434141
cmp dword [esi + 0x5d110], ecx
jne 0x434199
cmp dword [esi + 0x5d114], eax
jne 0x434199
jmp 0x4341f0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x434152
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.004347c0
push 4
mov ecx, esi
call fcn.00432f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x1f4
jne 0x4341af
mov ecx, esi
push 1
push ebx
mov dword [edi + 0x28], 4
call fcn.00434d80
test eax, eax
jne 0x4341a1
cmp dword [esi + 0x2700], 0
je 0x434199
push ecx
mov ecx, esi
call fcn.00436a80
push ebx
mov ecx, esi
call fcn.004347c0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x194
jne 0x434188
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4341c7
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.004347c0
push 4
mov ecx, esi
call fcn.00432f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
jne 0x434175
mov eax, dword [edi + 4]
test eax, eax
je 0x434175
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x20]
cmp dword [eax + 0x2448], 0xffffffff
jne 0x43420e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x20]
sub eax, dword [edi + 8]
mov dword [ecx + 0x2448], eax
cmp dword [esi + 0x2700], 0
je 0x43422f
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x4e20
push eax
push 6
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [edi + 0x8040]
cmp dword [eax + 4], 0
jne 0x434199
mov dword [eax + 4], 1
mov eax, 1
mov dword [edi + 0x28], 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x434260
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xorps xmm0, xmm0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push 0x8000
mov eax, dword [ebx + 0x26e8]
push 0
mov edi, dword [eax + edi*4]
movdqu xmmword [edi + 0x8044], xmm0
lea esi, [edi + 0x40]
movdqu xmmword [edi + 0x8054], xmm0
push esi
movq qword [edi + 0x8064], xmm0
mov dword [edi + 0x8044], 0x28
call fcn.0053ca90
mov edx, dword [edi + 0x8040]
add esp, 0xc
mov dword [edi + 0x8058], esi
lea esi, [edi + 0x805c]
mov dword [esi], 0x8000
test edx, edx
je 0x434303
mov eax, dword [edx + 0x10]
sub eax, dword [edx + 0x18]
mov ecx, dword [edx + 0x14]
sbb ecx, dword [edx + 0x1c]
sub eax, dword [edx + 8]
sbb ecx, dword [edx + 0xc]
add eax, 1
adc ecx, 0
test ecx, ecx
jb 0x4342fe
ja 0x4342f0
cmp eax, 0x8000
jbe 0x4342fe
mov eax, 0x8000
mov dword [ebp - 4], 0
jmp 0x434342
mov dword [ebp - 4], ecx
jmp 0x434342
mov eax, dword [ebx + 0x5d110]
mov ecx, dword [ebx + 0x5d114]
cmp eax, 0xffffffff
jne 0x434318
cmp ecx, eax
je 0x434344
sub eax, dword [ebx + 0x5d120]
sbb ecx, dword [ebx + 0x5d124]
test ecx, ecx
jb 0x43433f
ja 0x434331
cmp eax, 0x8000
jbe 0x43433f
mov eax, 0x8000
mov dword [ebp - 4], 0
jmp 0x434342
mov dword [ebp - 4], ecx
mov dword [esi], eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [edi + 0x20]
mov dword [edi + 0x28], 9
cmp dword [eax + 4], 1
je 0x4343a6
push edi
push 1
lea eax, [edi + 0x8044]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
je 0x43438b
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4343c9
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push dword [esi]
push dword [edi + 0x8058]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x434374
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x43437d
push dword [ebp + 8]
mov ecx, ebx
call fcn.004347c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4348f0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x868], esi
cmp cx, word [ebx + 0x61a68]
je 0x434929
lea edi, [ebx + 0x61a68]
jmp 0x434a07
xor eax, eax
cmp ax, word [0x5c2840]
jne 0x434a02
push 0x823
push eax
mov byte [ebp - 0x834], al
lea eax, [ebp - 0x833]
push eax
call fcn.0053ca90
add esp, 0xc
mov dword [ebp - 0x86c], 0x823
lea eax, [ebp - 0x86c]
lea edx, [ebp - 0x834]
push eax
call fcn.00431ca0
add esp, 4
test eax, eax
jne 0x4349f7
lea edx, [ebp - 0x834]
lea ecx, [ebp - 0x84c]
call fcn.004145d0
cmp dword [ebp - 0x838], 8
lea esi, [ebp - 0x84c]
mov ecx, 0x5c2840
mov edx, 0x824
cmovae esi, dword [ebp - 0x84c]
sub esi, ecx
jmp 0x4349b0
lea eax, [edx + 0x7ffff7da]
test eax, eax
je 0x4349ce
movzx eax, word [esi + ecx]
test ax, ax
je 0x4349ce
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x4349b0
jmp 0x4349d2
test edx, edx
jne 0x4349d5
sub ecx, 2
xor eax, eax
cmp dword [ebp - 0x838], 8
mov word [ecx], ax
jb 0x4349f1
push dword [ebp - 0x84c]
call fcn.0053ba8c
add esp, 4
mov esi, dword [ebp - 0x868]
xor eax, eax
cmp ax, word [0x5c2840]
je 0x434a07
mov edi, 0x5c2840
push 0x10000000
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, eax
mov dword [esi + 0x14], ecx
test ecx, ecx
je 0x434b68
mov eax, dword [ebp - 0x868]
xor esi, esi
xor edi, edi
mov edx, dword [eax + 0x20]
cmp word [edx + 0x2348], si
lea eax, [edx + 0x2348]
cmovne edi, eax
cmp word [edx + 0x2048], si
lea eax, [edx + 0x2048]
cmovne esi, eax
test edi, edi
jne 0x434a67
cmp word [ebx + 0x60618], di
lea eax, [ebx + 0x60618]
cmovne edi, eax
test esi, esi
jne 0x434a7b
cmp word [ebx + 0x60718], si
lea eax, [ebx + 0x60718]
cmovne esi, eax
cmp dword [edx + 4], 1
mov eax, 3
mov edx, 1
push 0x432a90
cmove eax, edx
push ecx
mov dword [ebp - 0x86c], eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov edx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x86c]
push edx
push dword [ebx + 0x26e4]
mov ecx, dword [edx + 0x20]
push eax
push esi
push edi
movzx eax, word [ecx]
push eax
lea eax, [ecx + 0x2148]
push eax
push dword [edx + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, dword [ebp - 0x868]
mov dword [esi + 0x18], eax
test eax, eax
je 0x434b68
cmp word [ebx + 0x60a20], 0
lea edx, [ebx + 0x60a20]
je 0x434b50
lea ecx, [ebp - 0x864]
call fcn.00414370
cmp dword [ebp - 0x850], 0x10
lea eax, [ebp - 0x864]
push 0xc
cmovae eax, dword [ebp - 0x864]
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x840]
push eax
push 0x26
push dword [esi + 0x14]
mov dword [ebp - 0x840], 3
mov dword [ebp - 0x838], 0x58e9fd
call dword [sym.imp.WININET.dll_InternetSetOptionA]
cmp dword [ebp - 0x850], 0x10
jb 0x434b50
push dword [ebp - 0x864]
call fcn.0053ba8c
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 4
Function at 0x434b80
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0053e720
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x1020], 0x598330
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x59831c
cmp dword [ebx + 0x2484], 0
mov esi, str.POST
push 0xffe
cmove esi, eax
mov dword [ebp - 0x101c], 0
xor eax, eax
push eax
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x100a]
push eax
call fcn.0053ca90
mov ecx, dword [edi + 0x20]
add esp, 0xc
lea eax, [ecx + 0x1048]
push eax
lea eax, [ecx + 0x48]
push eax
push 0x598338
lea eax, [ebp - 0x100c]
push 0x7ff
push eax
call fcn.00544ed3
add esp, 0x14
mov eax, 0x8408c300
cmp dword [ebx + 0x62ecc], 0
mov ecx, 0x8400c300
cmovne ecx, eax
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 4
jne 0x434c2f
or ecx, 0x803000
push edi
push ecx
lea eax, [ebp - 0x1020]
push eax
push 0
push str.HTTP_1.1
lea eax, [ebp - 0x100c]
push eax
push esi
push dword [edi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x434d5e
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea ecx, [ebp - 0x1018]
push 4
push ecx
push 2
push eax
mov dword [ebp - 0x1018], 0x3a98
call esi
push 4
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], 1
push eax
push 0x41
push dword [edi + 0x1c]
call esi
mov dword [ebp - 0x1010], eax
xor ecx, ecx
mov eax, 0x5168
mov edx, 2
mul edx
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x1048], xmm0
movdqu xmmword [ebp - 0x1038], xmm0
mov dword [ebp - 0x1048], 0x28
movq qword [ebp - 0x1028], xmm0
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00520986
mov esi, eax
add esp, 4
test esi, esi
je 0x434d25
push 0xa2d0
push 0
push esi
call fcn.0053ca90
add esp, 0xc
push dword [ebp - 0x1010]
push ecx
push esi
push edi
mov ecx, ebx
call fcn.00434e80
mov ecx, esi
mov dword [ebp - 0x1040], esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434d10
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x103c], ecx
push edi
push 1
push 0
lea eax, [ebp - 0x1048]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov edi, eax
test esi, esi
je 0x434d49
push esi
call fcn.0053c06b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e21c
mov esp, ebp
pop ebp
ret 4
Function at 0x4357e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
jne 0x435969
xorps xmm0, xmm0
lea edi, [esi + 0x5d130]
push edi
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
mov dword [ebp - 0xa], 0x5c003a
mov word [ebp - 0xc], ax
xor eax, eax
push eax
push eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x435994
mov ecx, dword [esi + 0x5d110]
mov eax, dword [esi + 0x5d114]
cmp ecx, 0xffffffff
jne 0x435854
cmp eax, ecx
je 0x43587c
cmp dword [ebp - 0x1c], eax
ja 0x43587c
jb 0x435860
cmp dword [ebp - 0x20], ecx
ja 0x43587c
mov dword [esi + 0x2470], 2
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret
push 0
push 0x20
push 4
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x43597e
cmp dword [esi + 0x2700], 0
je 0x435969
mov eax, dword [esi + 0x26f4]
mov ecx, esi
mov dword [esi + 0x26f8], eax
call fcn.00435c70
test eax, eax
jne 0x435969
cmp dword [esi + 0x2468], eax
ja 0x4358d8
mov dword [esi + 0x2468], 5
cmp dword [esi + 0x2468], 0xa
jbe 0x4358eb
mov dword [esi + 0x2468], 0xa
mov dword [esi + 0x5cfd0], 0
lea ecx, [esi + 0x26f4]
mov dword [esi + 0x5cfd4], 0
mov edx, dword [esi + 0x5d110]
mov eax, dword [esi + 0x5d114]
add edx, 0xffffffff
mov dword [esi + 0x5cfd8], edx
adc eax, 0xffffffff
mov dword [esi + 0x5cfdc], eax
lea eax, [esi + 0x5cfc8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004377f0
mov eax, dword [esi + 0x5d110]
mov cl, 0x20
mov edx, dword [esi + 0x5d114]
call fcn.00570440
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x5d110]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053e21c
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x2470], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x2474], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0053e21c
mov esp, ebp
pop ebp
ret
Function at 0x435a70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 0x210], 0
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov esi, ecx
lea eax, [ebp - 0x20a]
mov dword [ebp - 0x214], 0
push eax
call fcn.0053ca90
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
push 2
push 0
push 0xffffff4a
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 0x210]
push eax
push 0xb6
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x210], 0xb6
jne 0x435b7e
mov ecx, str._JZSTART_1E222D06_2CB2_4220_AF52_E0B7E800F5C1_CBA04DEF_39E0_45e4_854F_B3EA272DE745_JZEND_
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x435b2c
test dx, dx
je 0x435b28
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x435b2c
add eax, 4
add ecx, 4
test dx, dx
jne 0x435b06
xor eax, eax
jmp 0x435b31
sbb eax, eax
or eax, 1
test eax, eax
jne 0x435b7e
push 1
push eax
push 0xffffff46
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 0x210]
push eax
push 4
lea eax, [ebp - 0x214]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x210]
push 1
push 0
neg eax
push eax
push dword [esi + 8]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053e21c
mov esp, ebp
pop ebp
ret

Function at 0x435b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push 2
push 0
push 0
mov eax, dword [esi + 0x26f8]
sub eax, dword [esi + 0x26f4]
push dword [esi + 8]
sar eax, 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 4], 0
je 0x435c62
push ebx
push edi
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26f8]
xor edi, edi
sub eax, dword [esi + 0x26f4]
mov ebx, 4
sar eax, 2
test eax, eax
je 0x435c31
lea esp, [esp]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x26f4]
push 0x20
push dword [eax + edi*4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26f8]
inc edi
sub eax, dword [esi + 0x26f4]
add ebx, 0x20
sar eax, 2
cmp edi, eax
jb 0x435c00
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call ebx
push 0
lea eax, [ebp - 8]
push eax
push 0xb6
push str._JZSTART_1E222D06_2CB2_4220_AF52_E0B7E800F5C1_CBA04DEF_39E0_45e4_854F_B3EA272DE745_JZEND_
push dword [esi + 8]
call ebx
pop edi
pop ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x435f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi + 0x20]
mov ebx, dword [edi + 0x805c]
cmp dword [eax + 4], 1
jne 0x435f5f
mov ebx, dword [edi]
cmp dword [esi + 0x2700], 0
je 0x436017
call fcn.00435a70
mov eax, dword [edi + 0x8040]
mov dword [ebp - 8], eax
push 0
mov edx, dword [eax + 8]
add edx, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 0x1c]
mov eax, ecx
mov dword [ebp - 4], ecx
sar eax, 0x1f
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x435fb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x436061
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x436061
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jne 0x436061
mov eax, dword [ebp - 8]
add dword [eax + 0x18], ecx
mov ecx, esi
adc dword [eax + 0x1c], 0
mov eax, dword [ebp + 8]
add dword [esi + 0x5d120], eax
push eax
adc dword [esi + 0x5d124], 0
push edi
call fcn.00436070
mov ecx, esi
call fcn.00435b90
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x436061
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x436061
add dword [esi + 0x5d120], eax
mov ecx, esi
push eax
adc dword [esi + 0x5d124], 0
push edi
call fcn.00436070
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4