joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423de3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x594b5e
call fcn.00561766
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.0042ae6e
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x423e42
call fcn.0042ae6e
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x423e56
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x423e52
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x423e5e
or eax, 0xffffffff
jmp 0x423fb0
mov ecx, edi
call fcn.004243f9
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.0041ca49
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x423eea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x423eea
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x423eea
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.0041c68e
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x423ee7
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x5aba34]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x423ee7
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0042350f
test eax, eax
je 0x423ee7
push 0
mov ecx, esi
call fcn.004232c5
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.0041c6fa
push ebx
call fcn.0041de30
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00423d86
test eax, eax
jne 0x423f33
cmp dword [edi + 0x9c], eax
jne 0x423f33
call fcn.0042ae6e
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0041de30
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00423d86
and dword [edi + 0x9c], 0
jmp 0x423f5e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x423f72
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.004232c5
test esi, esi
je 0x423f7f
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x423f95
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x423f95
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x5aba34]
mov ecx, edi
call esi
mov ecx, edi
call fcn.004243ad
mov eax, dword [edi + 0x68]
call fcn.005616cb
ret
Function at 0x429fcb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x42a021
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x429ffa
call fcn.00419e44
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42a00f
call fcn.00419e44
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x42a021
call fcn.00419e44
call fcn.0042ae6e
cmp dword [eax + 0x3c], 0
je 0x42a036
push esi
mov ecx, ebx
call fcn.00429635
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.0042a220
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x42a05f
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x42a06b
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42b00c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0042336d
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x42b048
call fcn.0042b2cd
mov dword [esi + 0xc], 1
jmp 0x42b04d
call fcn.0042b2cd
cmp dword [esi], 0
je 0x42b098
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x42b073
push edi
call fcn.00412bfb
lea ecx, [edi + 1]
push ecx
jmp 0x42b082
push 0xff
call fcn.00405d1f
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00405fae
pop edi
jmp 0x42b0bc
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x42b0bc
push dword [esi]
push dword [ebp - 4]
call fcn.0046f8f1
pop esi
leave
ret 0xc

Function at 0x42b224
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0042b2cd
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42b26c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00412bfb
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00405fae
jmp 0x42b277
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0046f8f1
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x43270d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x432736
call fcn.0042ae6e
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
je 0x432763
push esi
push eax
mov ecx, 0x635ad8
call fcn.004335d2
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.00432b87
int3

Function at 0x432ed3
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ecx + 0x18], esi
je 0x432ef8
push esi
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx + 0x18]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x432ef8
mov esi, dword [ebp - 4]
mov eax, esi
xor edx, edx
pop esi
leave
ret

Function at 0x43341c
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x40]
cmp dword [edi], ebx
jne 0x433470
push 0x1000
call fcn.0043365b
test eax, eax
je 0x433469
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [edi]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x433516
mov eax, dword [ebp - 4]
lea edx, [esi + 0x40]
mov dword [esi + 0x44], eax
mov dword [esi + 0x3c], ebx
mov dword [ebp - 0xc], edx
jmp 0x433475
xor eax, eax
jmp 0x4334f2
mov edx, edi
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 0x3c]
mov ecx, dword [edi]
mov ebx, dword [ebp + 8]
add ecx, eax
mov dword [ebp - 0x10], eax
mov edi, ebx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp - 8], eax
je 0x4334e3
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x44]
jb 0x4334c0
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [edx]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x433512
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
test eax, eax
je 0x4334f9
mov edx, dword [ebp - 0xc]
and dword [esi + 0x3c], 0
mov ecx, dword [edx]
mov al, byte [ecx]
cmp al, 0xd
je 0x4334cc
mov byte [edi], al
inc edi
dec dword [ebp - 8]
mov eax, dword [esi + 0x3c]
inc eax
mov dword [ebp - 0x10], eax
mov dword [esi + 0x3c], eax
mov al, byte [ecx]
inc ecx
cmp al, 0xa
je 0x4334e3
cmp dword [ebp - 8], 0
jne 0x43348f
push 1
push 0
push edi
call fcn.0056dbc0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
push 1
push 0
push edi
call fcn.0056dbc0
sub edi, ebx
add esp, 0xc
neg edi
sbb edi, edi
and edi, ebx
mov eax, edi
jmp 0x4334f2
push 0
jmp 0x433517
push ebx
push dword [esi + 0x20]
call fcn.00432b87
int3
Function at 0x433718
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 1
je 0x4337bf
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4337bf
cmp dword [esi + 0x34], 0
mov edi, dword [ebp + 0xc]
jne 0x43375c
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4337c3
cmp dword [ebp - 4], edi
jne 0x4337c3
pop edi
pop esi
leave
ret 8
mov edx, dword [esi + 0x30]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x2c]
jb 0x433780
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4337c3
and dword [esi + 0x30], 0
xor edx, edx
mov ecx, dword [esi + 0x2c]
cmp edi, ecx
jb 0x43379e
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x433756
jmp 0x4337c3
lea eax, [edx + edi]
cmp eax, ecx
ja 0x433756
mov eax, dword [esi + 0x34]
sub ecx, edx
push edi
push dword [ebp + 8]
add eax, edx
push ecx
push eax
call fcn.004065d1
add esp, 0x10
add dword [esi + 0x30], edi
jmp 0x433756
push 6
jmp 0x4337c5
push 0
push dword [esi + 0x20]
call fcn.00432b87
int3
Function at 0x4343b2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x595e59
call fcn.005616fd
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x43445a
push dword [ebp + 8]
call fcn.004346cf
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4344e1
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x434443
push ecx
call fcn.0042aa5b
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x434443
xor edi, edi
inc edi
jmp 0x43444d
push dword [ebx]
call fcn.0042aa64
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.0040d543
jmp 0x4344df
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x5aba34]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4344d7
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.0042aa5b
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x4344d1
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.00413c5d
push esi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.00413c5d
mov ecx, dword [ebp + 0x10]
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x43449e
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00405f71
mov eax, edi
call fcn.005616cb
ret 0x10

Function at 0x4344e9
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x43453c
push esi
push dword [ebp + 8]
call fcn.004346cf
mov edi, eax
test edi, edi
je 0x434537
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x434537
mov eax, dword [ebp - 8]
jmp 0x43454e
mov eax, dword [ebp + 0x10]
jmp 0x43454e
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc
Function at 0x434554
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595e86
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.00561270
mov eax, dword [0x60b1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1024], eax
cmp dword [ecx + 0x58], ebx
je 0x434682
push ebx
push edx
call fcn.004346cf
mov ebx, eax
test ebx, ebx
jne 0x4345bc
push esi
jmp 0x4346aa
lea ecx, [ebp - 0x1014]
call fcn.00402201
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x101c], eax
test eax, eax
jne 0x434641
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.00405d1f
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x1024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x101c], eax
call fcn.00405fae
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x101c], 0
jne 0x43466f
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.004034df
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00405f71
jmp 0x4346b1
push esi
mov ecx, edi
call fcn.00402140
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x434668
test esi, esi
jne 0x43468b
mov esi, 0x5abdb0
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.00402140
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005616bd
leave
ret 0x10
Function at 0x4347dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [edi + 0x58], ebx
je 0x434824
push ebx
push dword [ebp + 8]
call fcn.004346cf
mov edi, eax
test edi, edi
je 0x434885
push dword [ebp + 0x14]
push esi
push 3
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x434885
mov eax, dword [ebp + 0x14]
lea eax, [eax*2 + 1]
push eax
call fcn.0042aa5b
mov edx, dword [ebp + 0x14]
mov ebx, eax
pop ecx
xor ecx, ecx
test edx, edx
je 0x43485b
mov al, byte [esi + ecx]
and al, 0xf
add al, 0x41
mov byte [ebx + ecx*2], al
mov al, byte [esi + ecx]
shr al, 4
add al, 0x41
mov byte [ebx + ecx*2 + 1], al
inc ecx
cmp ecx, edx
jb 0x434840
mov byte [ebx + ecx*2], 0
mov eax, dword [edi]
push ebx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5aba34]
mov ecx, edi
call esi
push ebx
mov esi, eax
call fcn.0042aa64
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x44d6f9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, 0x104
mov eax, dword [esi + 4]
cmp eax, ecx
ja 0x44d880
je 0x44d8a7
sub eax, 0xa1
je 0x44d8a7
sub eax, 1
je 0x44d8a7
dec eax
sub eax, 1
je 0x44d8a7
sub eax, 1
je 0x44d8a7
dec eax
sub eax, 1
je 0x44d8a7
sub eax, 1
je 0x44d8a7
sub eax, 0x58
jne 0x44d8e5
cmp dword [edi + 0xc0], 0xffffffff
je 0x44d8a7
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x44d8a7
mov eax, dword [esi + 8]
sub eax, 0x21
je 0x44d7d5
sub eax, 1
jne 0x44d8a7
mov eax, dword [edi + 0xc0]
lea ebx, [eax + 1]
jmp 0x44d7c4
mov eax, ebx
cdq
idiv ecx
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x5aba34]
mov ecx, edi
call esi
test eax, eax
jne 0x44d821
mov eax, dword [edi + 0xc0]
inc ebx
mov ecx, dword [edi + 0xbc]
add eax, ecx
cmp ebx, eax
jl 0x44d79a
jmp 0x44d8ff
mov ecx, dword [edi + 0xc0]
lea ebx, [ecx - 1]
add ebx, dword [edi + 0xbc]
cmp ebx, ecx
jle 0x44d8ff
mov eax, ebx
cdq
idiv dword [edi + 0xbc]
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x5aba34]
mov ecx, edi
call esi
test eax, eax
jne 0x44d821
dec ebx
cmp ebx, dword [edi + 0xc0]
jg 0x44d7ec
jmp 0x44d8ff
mov eax, dword [edi]
push dword [ebp - 4]
mov dword [edi + 0x24c], 1
mov esi, dword [eax + 0x214]
mov ecx, esi
call dword [0x5aba34]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x210]
mov ecx, esi
call dword [0x5aba34]
mov ecx, edi
call esi
mov ecx, eax
call fcn.00423698
mov eax, dword [edi]
push dword [edi + 0xc0]
mov esi, dword [eax + 0x270]
mov ecx, esi
call dword [0x5aba34]
mov ecx, edi
call esi
and dword [edi + 0x24c], 0
jmp 0x44d8ff
sub eax, 0x200
je 0x44d8a7
sub eax, 1
je 0x44d8a7
sub eax, 1
je 0x44d8a7
dec eax
sub eax, 1
je 0x44d8a7
sub eax, 1
je 0x44d8a7
dec eax
sub eax, 1
je 0x44d8a7
sub eax, 1
jne 0x44d8e5
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x44d8c6
cmp dword [eax + 0x20], ebx
je 0x44d8c6
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x44d8e5
cmp dword [eax + 0x20], ebx
je 0x44d8e5
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esi + 4], 0x203
jne 0x44d904
lea eax, [edi + 0x2250]
test eax, eax
je 0x44d8fb
mov ebx, dword [eax + 0x20]
cmp dword [esi], ebx
jne 0x44d904
xor eax, eax
inc eax
jmp 0x44d90c
push esi
mov ecx, edi
call fcn.0044741e
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46d3fb
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
inc eax
push edi
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 4], eax
lea ebx, [ecx + 0xc]
cmp dword [ecx + 8], edi
jle 0x46d477
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x46d43c
mov eax, dword [edx + 0x10]
cmp dword [eax + edi*8 + 4], esi
je 0x46d43c
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x46d46a
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x46d46d
mov eax, dword [ebx]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x46d464
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5aba34]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx]
and dword [eax + edi*4], 0
mov eax, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 8]
jl 0x46d420
test eax, eax
je 0x46d4be
lea esi, [edx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add ecx, 0x14
push edi
call fcn.0046d6ef
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5aba34]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46d741
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x59a64f
call fcn.00561766
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x46d838
cmp edi, dword [ebx + 0xc]
jge 0x46d838
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x46d798
cmp edi, dword [esi + 8]
jl 0x46d826
cmp dword [ebp + 0xc], 0
je 0x46d826
xor edi, edi
jmp 0x46d7ca
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.0046d1eb
mov esi, eax
test esi, esi
je 0x46d7b2
mov dword [esi], vtable.CThreadData.0
jmp 0x46d7b4
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.0041843d
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x46d7e6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x46d7f2
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x46d85f
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.0056dbc0
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x46d838
cmp edi, dword [esi + 8]
jge 0x46d838
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.005616cb
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004170d8
int3

Function at 0x46e907
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x46e931
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46e937
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.00402c25
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0046e4f2
int3

Function at 0x46ec12
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x46ec23
xor eax, eax
jmp 0x46ec3f
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46ec44
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.00402c25
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0046e4f2
int3