joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435e23
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x435f6b
xor ecx, ecx
cmp word [eax], cx
je 0x435f6b
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x435e7c
cmp eax, 3
jne 0x435eb6
cmp word [esp + 0xa], 0x3a
jne 0x435eb6
cmp eax, 2
jne 0x435e9a
lea eax, [esp + 8]
push 0x441304
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x435f6b
push 0xfffffffffffffffe
pop edi
jmp 0x435f6b
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x435ecb
cmp ax, bx
jne 0x435ed5
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x435ebe
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x435f14
test byte [esp + 0x21c], 0x10
je 0x435efb
push 0xfffffffffffffffe
pop edi
jmp 0x435f0b
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x435f69
cmp word [esp + 0x10], bp
jne 0x435f22
cmp word [esp + 0x12], bp
je 0x435f41
cmp word [esp + 0x10], bx
jne 0x435f30
cmp word [esp + 0x12], bx
je 0x435f41
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x435f69
cmp word [esp + 0x12], ax
jne 0x435f69
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x435f56
test al, 0x10
je 0x435f69
jmp 0x435f66
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x435f69
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x4360fa
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x44bd04]
push esi
test eax, eax
jne 0x43610b
push fcn.00436213
push 0x10
push 0x258
call fcn.0043e27d
mov dword [0x44bd04], eax
push dword [esp + 0xc]
push eax
call fcn.0043e1e9
mov esi, eax
test esi, esi
je 0x43620c
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x43612d
mov edi, 0x441070
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x43613d
xor eax, eax
cmp word [ebx], ax
jne 0x436142
mov ebx, 0x441310
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x44a308]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4361f3
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x4361a3
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x4361a7
push 0x441304
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x4361a7
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4361cb
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x4361e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4361df
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x44a308]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x43620a
cmp dword [esp + 0x14], 0xffffffff
je 0x4361fe
mov esi, dword [esp + 0x14]
push esi
push dword [0x44bd04]
call fcn.0043e15b
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x436289
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x43629f
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4362a2
or eax, 0xffffffff
ret 4
Function at 0x4366a2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x43671a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x4366fb
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x4366f8
cmp ecx, 0x5c
je 0x4366f8
cmp ecx, 0x2f
jne 0x436705
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x4366e5
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x43671c
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x436880
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4368bc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x436b00
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x44bee4]
call fcn.0043e1aa
test eax, eax
je case.0x436b2e.3
mov ecx, dword [esp + 8]
add ecx, 0xfffffffe
cmp ecx, 0x17
ja case.0x436b2e.3
movzx ecx, byte [ecx + 0x436c38]
jmp dword [ecx*4 + 0x436c20]
cmp dword [eax + 4], 0
je 0x436b4b
push 2
push 0x441728
push eax
call fcn.00436d90
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x441728
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x436b7a
push 3
push 0x4410e0
push eax
call fcn.00436d90
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 3
push 0x4410e0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x436ba9
push 2
push 0x44172c
push eax
call fcn.00436d90
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x44172c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x436bd8
push 4
push 0x441730
push eax
call fcn.00436d90
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x441730
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x436c07
push 4
push 0x441738
push eax
call fcn.00436d90
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x441738
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
Function at 0x436c50
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x436d58
cmp word [edx], 0
je 0x436d58
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x436c7e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x436cdd
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x436cb0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436c90
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00436d90
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436cb0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00436ea0
mov edi, eax
test edi, edi
je 0x436cd3
cmp dword [esi + 4], 0
je 0x436d2b
push dword [esp + 0x14]
push edi
push esi
call fcn.00436d90
push edi
push 0
push dword [0x44a308]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x44a308]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x436d90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x436e97
cmp dword [esi + 0x14], 1
jne 0x436ddb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x436e58
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x436e43
dec eax
je 0x436e2c
sub eax, 2
je 0x436e17
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00436880
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x436e85
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x436e01
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x439f20
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x439f52
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x439f4d
cmp dword [esp + 0xc], esi
je 0x439f69
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x43e00b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x44bd6c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x43e06c
push esi
push dword [0x44bd68]
push 8
push dword [0x44a308]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x44bd6c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x44bd64]
jmp 0x43e05c
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x43e05a
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x43e04a
push edi
push 0x43dfa9
call fcn.0043f96e
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4
Function at 0x43e076
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x43e08c
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x44bd68]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x43e0c3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x44a308]
mov dword [0x44bd6c], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x44bd6c]
call ebx
mov eax, dword [0x44bd68]
mov edi, eax
add eax, esi
push eax
push dword [0x44bd6c]
mov dword [0x44bd68], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x44a308]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x44bd6c]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x43e103
test ebx, ebx
je 0x43e124
push 0x14
push 0x44bd64
call fcn.0043e98f
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x43e124
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x43eae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x43eb26
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x44c024]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x43eb47
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x44c024]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0043f230
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x43eb70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43ebe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x43ed60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x43edc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x43eef0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x43ef14
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x43ef64
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x44c024]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43efac
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x43efac
cmp dword [ebp - 8], 0x100000
jge 0x43ef80
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x44c024]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x43efd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x43f180
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x43f1be
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x43f1be
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x43f1c0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x43f200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x43f630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x447e4c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x43f96e
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x44bdb0], 0
push ebx
push esi
mov esi, 0x44bdb8
jne 0x43f99a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x44bdd0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x44bdb0], 1
push dword [0x44bdd0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x43fa37
push 0x14
push 8
push dword [0x44a308]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x43fa61
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44bdb4]
test eax, eax
je 0x43f9dc
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x44bdb4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x43fa66
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x44bdd0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x44a308]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x43fa61
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x4025a0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x4c
mov dword [esp + 4], 0x8000
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll__open
cmp eax, 0xffffffff
mov ebx, eax
je 0x402680
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__fstati64]
cmp eax, 0xffffffff
je 0x402658
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
test eax, eax
mov dword [esi], ebp
mov dword [esi + 4], eax
js 0x402665
mov dword [esp], ebp
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x402665
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll__read
mov edx, dword [esi + 4]
mov ecx, eax
xor eax, dword [esi]
sar ecx, 0x1f
xor edx, ecx
or edx, eax
jne 0x402630
mov dword [esp], ebx
call sub.msvcrt.dll__close
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov ebp, dword [eax]
mov dword [esp], ebx
call sub.msvcrt.dll__close
mov dword [esp], edi
call sub.msvcrt.dll_free
call esi
mov dword [eax], ebp
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov ebp, dword [eax]
mov dword [esp], ebx
call sub.msvcrt.dll__close
jmp 0x40264a
xor eax, eax
jmp 0x402625

Function at 0x402690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x220
lea ebx, [ebp - 0x210]
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub eax, 1
sub esp, 8
cmp eax, 0x102
ja 0x402700
lea esi, [ebp - 0x10c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.fastboot
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x402716
mov dword [esp], esi
mov dword [esp + 4], str.wbTD
call sub.msvcrt.dll_fopen
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.GetTempPath_failed__error__ld
mov dword [esp + 4], eax
call fcn.00408fc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.GetTempFileName_failed__error__ld
mov dword [esp + 4], eax
call fcn.00408fc0
lea esi, [esi]
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov edx, dword [edx]
mov dword [esp + 8], edx
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00401df0
add esp, 0x1c
ret