joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2316c4fc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.231539b0
xor eax, eax
push ebp
push 0x2316c6d1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.2316724c
mov edx, 0x2316c6e8
mov eax, dword [ebp - 0x10]
call fcn.23166980
test al, al
jne 0x2316c574
mov edx, 0x2316c6fc
mov eax, dword [ebp - 0x10]
call fcn.23166980
test al, al
jne 0x2316c574
mov eax, dword [ebp - 0x10]
call fcn.231537c0
test eax, eax
jne 0x2316c5b1
push 0x2316c710
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.2316b738
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.23167180
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.231670f0
push dword [ebp - 0x34]
push 0x2316c724
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.23153880
jmp 0x2316c5d6
push 0x2316c710
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.231670f0
push dword [ebp - 0x40]
push 0x2316c724
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.23153880
push 1
lea eax, [ebp - 0x24]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x30], 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.231539c0
push eax
push 0x4021c
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x2316c672
lea eax, [ebp - 0x44]
mov ecx, 0x2316c730
mov edx, dword [ebp - 0xc]
call fcn.2315380c
mov eax, dword [ebp - 0x44]
call fcn.2316778c
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x7fffffff
mov edx, 8
mov eax, dword [ebp - 0xc]
call fcn.23153a18
mov eax, dword [ebp - 0xc]
call fcn.231539c0
push eax
push 0x4021c
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 6
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2316c6a1
lea eax, [ebp - 0x48]
mov ecx, 0x2316c730
mov edx, dword [ebp - 0xc]
call fcn.2315380c
mov eax, dword [ebp - 0x48]
call fcn.2316778c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2316c6d8
lea eax, [ebp - 0x48]
mov edx, 6
call fcn.23153660
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.23153660
lea eax, [ebp - 4]
call fcn.2315363c
ret
Function at 0x2316d9f4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.231539b0
xor eax, eax
push ebp
push 0x2316daf3
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp bl, 1
jne 0x2316da7c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.231671fc
lea eax, [ebp - 0x10]
mov edx, 0x2316db0c
call fcn.231537c8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.23167180
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, dword [0x231749dc]
call fcn.2315380c
push 0
mov eax, dword [ebp - 8]
call fcn.231539c0
push eax
mov eax, dword [ebp - 4]
call fcn.231539c0
push eax
call sub.kernel32.dll_CopyFileA
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.23167ec0
mov esi, eax
cmp bl, 2
jne 0x2316dad8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.231671fc
lea eax, [ebp - 0x18]
mov edx, 0x2316db1c
call fcn.231537c8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.23167180
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [0x231749dc]
call fcn.2315380c
push 0
mov eax, dword [ebp - 8]
call fcn.231539c0
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.231539c0
push eax
call sub.kernel32.dll_CopyFileA
push ebx
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2316dafa
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.23153660
ret
Function at 0x2316f2a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x2316f460
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, dword [0x231731d4]
mov edx, 0x2316f474
call fcn.2315380c
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.2316a7f4
test al, al
jne 0x2316f445
cmp dword [0x231749fc], 0
je 0x2316f445
cmp byte [0x231731e4], 6
jae 0x2316f445
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x2316f445
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x231749fc]
sub eax, dword [edx + 0x208]
cmp eax, 0xea60
jl 0x2316f445
inc byte [0x231731e4]
cmp byte [0x231731e4], 6
jne 0x2316f391
lea edx, [ebp - 8]
mov eax, 0x2316f4b0
call fcn.231669f8
lea eax, [ebp - 8]
mov edx, 0x2316f4c8
call fcn.231537c8
mov eax, dword [ebp - 8]
push eax
call fcn.23170ea8
test al, al
jne 0x2316f445
mov eax, 0x2316f4f0
call fcn.2316687c
test al, al
je 0x2316f37c
call fcn.2316d294
push 0x2316f4f8
mov eax, dword [0x231749f4]
add eax, 0x20c
push eax
call sub.kernel32.dll_lstrcpyA
push 0x2316f504
push dword [0x231749c4]
push 0x2316f510
push dword [0x231749c8]
push 0x2316f51c
push dword [0x231731d4]
push 0x2316f528
push 0x2316f534
mov eax, 0x231749d8
mov edx, 8
call fcn.23153880
push dword [0x231749d8]
push 0x2316f540
lea edx, [ebp - 0x10]
xor eax, eax
mov al, byte [0x231731e4]
call fcn.23167068
push dword [ebp - 0x10]
push 0x2316f55c
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x231749fc]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 0x14]
call fcn.23167068
push dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.23153880
mov eax, dword [ebp - 0xc]
call fcn.2316778c
lea edx, [ebp - 0x18]
mov eax, 0x2316f56c
call fcn.231674dc
mov eax, dword [ebp - 0x18]
push eax
call fcn.23170ea8
mov eax, dword [0x2317336c]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2316f467
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.23153660
ret
Function at 0x2316f578
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x2316f6ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x2316f704
call fcn.2316687c
test al, al
jne 0x2316f6d3
lea eax, [ebp - 4]
mov ecx, dword [0x231731d4]
mov edx, 0x2316f718
call fcn.2315380c
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.2316a7f4
test al, al
jne 0x2316f6d3
cmp dword [0x231749f8], 0
je 0x2316f6d3
cmp byte [0x231731dc], 6
ja 0x2316f6d3
cmp byte [0x231731dc], 6
jne 0x2316f601
push 0x2316f74c
mov eax, dword [0x231749f4]
add eax, 0x20c
push eax
call sub.kernel32.dll_lstrcpyA
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x2316f6d3
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x231749f8]
sub eax, dword [edx + 0x208]
cmp eax, 0xea60
jl 0x2316f6d3
call fcn.2316f2a8
inc byte [0x231731dc]
push 0x2316f758
push dword [0x231749c4]
push 0x2316f764
push dword [0x231749c8]
push 0x2316f770
push dword [0x231731d4]
push 0x2316f77c
push 0x2316f788
mov eax, 0x231749d8
mov edx, 8
call fcn.23153880
push dword [0x231749d8]
push 0x2316f794
lea edx, [ebp - 0xc]
xor eax, eax
mov al, byte [0x231731dc]
call fcn.23167068
push dword [ebp - 0xc]
push 0x2316f7b0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x231749f8]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 0x10]
call fcn.23167068
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 5
call fcn.23153880
mov eax, dword [ebp - 8]
call fcn.2316778c
call fcn.2316ed64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2316f6f5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.23153660
ret

Function at 0x2316f9fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x2316faa1
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x2316fa1d
push 0x493e0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x2316fa13
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x231749f4]
sub eax, dword [edx + 0x208]
cmp eax, 0x493e0
jb 0x2316fa13
push dword [0x231749d8]
push 0x2316fab4
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x231749f4]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 8]
call fcn.23167068
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.23153880
mov eax, dword [ebp - 4]
call fcn.2316778c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2316faa8
lea eax, [ebp - 8]
mov edx, 2
call fcn.23153660
ret
Function at 0x2316fac0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.231539b0
mov eax, dword [ebp - 8]
call fcn.231539b0
xor eax, eax
push ebp
push 0x2316fb5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea ecx, [ebp - 0xc]
mov edx, 0x2316fb74
mov eax, 0x80000002
call fcn.2316a62c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.231667f8
test al, al
je 0x2316fb22
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.231667f8
test al, al
jne 0x2316fb41
push 5
mov eax, dword [ebp - 8]
call fcn.231539c0
push eax
mov eax, dword [ebp - 4]
call fcn.231539c0
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2316fb63
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.23153660
ret
Function at 0x2316fbc4
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x2316fbcc
push ecx
xor eax, eax
push ebp
push 0x2316fe0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x2316fe24
mov eax, 0x80000002
call fcn.2316ac7c
lea eax, [ebp - 0xc]
mov edx, 0x2316fe5c
call fcn.231537c8
jmp 0x2316fcbf
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x2316fe5c
call fcn.23153a58
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.23153a18
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
call fcn.231537c0
mov edx, eax
add edx, 3
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0xc]
call fcn.23153a18
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, 0x2316fe68
call fcn.2315380c
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov eax, 0x80000002
call fcn.2316a588
lea eax, [ebp - 4]
push eax
mov ecx, 2
mov edx, 0x2316fea4
mov eax, dword [ebp - 8]
call fcn.2316786c
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 0x2316fea4
mov eax, dword [ebp - 8]
call fcn.2316786c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.231536d4
mov eax, dword [ebp - 4]
call fcn.23167388
test al, al
je 0x2316fcbf
mov eax, dword [ebp - 8]
call fcn.23167388
test al, al
jne 0x2316fcbf
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.2316fac0
mov eax, dword [ebp - 0xc]
call fcn.231537c0
test eax, eax
jg 0x2316fc06
mov eax, 0x2316feb0
call fcn.2316687c
test al, al
je 0x2316fdf3
lea edx, [ebp - 4]
mov eax, dword [0x231749cc]
call fcn.2316c744
mov eax, dword [ebp - 4]
call fcn.23166db8
push 9
mov eax, dword [ebp - 4]
call fcn.231539c0
push eax
mov eax, dword [0x231749cc]
call fcn.231539c0
push eax
call sub.kernel32.dll_MoveFileExA
mov edx, dword [0x231749cc]
mov eax, dword [ebp - 4]
call fcn.2316fac0
mov eax, 0x2316feb0
call fcn.2316687c
test al, al
je 0x2316fd72
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.2316d110
lea eax, [ebp - 0x1c]
mov edx, 0x2316fec4
call fcn.231537c8
mov eax, dword [ebp - 0x1c]
call fcn.231539c0
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.2316d110
lea eax, [ebp - 0x20]
mov edx, 0x2316fed8
call fcn.231537c8
mov eax, dword [ebp - 0x20]
call fcn.231539c0
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x24]
mov ecx, dword [0x231749c4]
mov edx, 0x2316fe68
call fcn.2315380c
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 8]
mov eax, 0x80000002
call fcn.2316a588
mov edx, dword [ebp - 8]
mov eax, dword [0x231749cc]
call fcn.231667f8
test al, al
jne 0x2316fde6
push dword [0x231749cc]
push 0x2316fea4
push dword [ebp - 4]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.23153880
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
mov ecx, dword [0x231749c4]
mov edx, 0x2316fe68
call fcn.2315380c
mov edx, dword [ebp - 0x2c]
mov eax, 0x80000002
pop ecx
call fcn.2316a2d8
mov eax, 0x231749cc
mov edx, dword [ebp - 4]
call fcn.23153690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2316fe15
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.23153660
ret
Function at 0xb7f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b7f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b7f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b7f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b7f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb7fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb7fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb9187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb7fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb7fc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x11d728ba
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x21a4d38
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, 0x43c1c4
mov dword [ebp - 8], 0
mov eax, dword [ebx]
inc eax
push eax
call fcn.0041f974
mov edi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 4], edi
cmp dword [ebx], eax
jbe 0x401082
lea esp, [esp]
mov ecx, dword [ebx + 4]
mov dl, byte [ecx + eax]
xor dl, byte [ebx - 4]
inc eax
mov byte [eax + edi - 1], dl
cmp eax, dword [ebx]
jb 0x401070
mov byte [eax + edi], 0
mov ecx, dword [0x443b7c]
mov edx, dword [0x443b78]
lea eax, [ebp - 4]
cmp eax, ecx
jae 0x401109
cmp edx, eax
ja 0x401109
mov esi, dword [0x443b80]
mov edi, eax
sub edi, edx
sar edi, 2
cmp ecx, esi
jne 0x4010fe
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40118c
sub esi, edx
inc eax
sar esi, 2
cmp eax, esi
jbe 0x4010fe
mov ecx, esi
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4010df
xor ecx, ecx
jmp 0x4010e1
add ecx, edx
cmp ecx, eax
jae 0x4010e7
mov ecx, eax
push ecx
mov esi, 0x443b78
call fcn.00401200
mov ecx, dword [0x443b7c]
mov edx, dword [0x443b78]
test ecx, ecx
je 0x401165
mov edx, dword [edx + edi*4]
mov dword [ecx], edx
jmp 0x40115f
mov esi, dword [0x443b80]
cmp ecx, esi
jne 0x401159
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40118c
sub esi, edx
mov edx, esi
inc eax
sar edx, 2
cmp eax, edx
jbe 0x401159
mov ecx, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x401140
xor ecx, ecx
jmp 0x401142
add ecx, edx
cmp ecx, eax
jae 0x401148
mov ecx, eax
push ecx
mov esi, 0x443b78
call fcn.00401200
mov ecx, dword [0x443b7c]
test ecx, ecx
je 0x401165
mov dword [ecx], edi
mov ecx, dword [0x443b7c]
mov eax, dword [ebp - 8]
add eax, 0xc
add ecx, 4
add ebx, 0xc
mov dword [0x443b7c], ecx
mov dword [ebp - 8], eax
cmp eax, 0x1e0
jb 0x401055
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.0041f8b9
int3
Function at 0x401300
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.00420d8a
push eax
call fcn.00420c56
add esp, 8
mov ebx, 0x443be0
mov edi, 0x443bc4
lea ecx, [ecx]
mov eax, dword [ebx]
push eax
call fcn.00420d10
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401330
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401340
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041f974
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.00420d10
add esp, 4
push eax
push 0x43c3b4
push esi
call fcn.00420bc7
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40140b
push esi
call fcn.00420c4b
add edi, 4
add esp, 4
cmp edi, 0x443be0
jl 0x401320
add ebx, 4
cmp ebx, 0x443be4
jl 0x401318
call fcn.00420c68
mov ecx, dword [0x443be0]
push ecx
call fcn.00420d10
add esp, 4
mov ebx, eax
call fcn.00420c68
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x443bc4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013d6
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013e6
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f974
push edi
push ebx
mov esi, eax
push 0x43c3b4
push esi
call fcn.00420bc7
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x401420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.00420d8a
push eax
call fcn.00420c56
add esp, 8
push ebx
push esi
mov dword [ebp - 4], 0x443be4
push edi
mov edi, edi
push 0
call fcn.00420d8a
push eax
call fcn.00420c56
add esp, 8
mov ebx, 0x443be0
mov edi, 0x443bc4
lea ebx, [ebx]
mov eax, dword [ebx]
push eax
call fcn.00420d10
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401470
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401480
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041f974
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.00420d10
add esp, 4
push eax
push 0x43c3b4
push esi
call fcn.00420bc7
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40154b
push esi
call fcn.00420c4b
add edi, 4
add esp, 4
cmp edi, 0x443be0
jl 0x401460
add ebx, 4
cmp ebx, 0x443be4
jl 0x401455
call fcn.00420c68
mov ecx, dword [0x443be0]
push ecx
call fcn.00420d10
add esp, 4
mov ebx, eax
call fcn.00420c68
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x443bc4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401516
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401526
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f974
push edi
push ebx
mov esi, eax
push 0x43c3b4
push esi
call fcn.00420bc7
add esp, 0x14
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401550
mov ebx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401563
sub eax, edi
lea eax, [eax + edx + 8]
push eax
call fcn.0041f974
mov ecx, dword [ebx]
push ecx
push esi
mov edi, eax
push 0x43c3b4
push edi
call fcn.00420bc7
push esi
call fcn.00420c4b
add esp, 0x18
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401624
push edi
call fcn.00420c4b
add ebx, 4
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0x443c04
jl 0x401440
call fcn.00401300
mov edi, eax
call fcn.00420c68
and eax, 0x80000007
jns 0x4015d2
dec eax
or eax, 0xfffffff8
inc eax
mov ebx, dword [eax*4 + 0x443be4]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015e0
sub eax, edx
mov edx, eax
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015f0
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f974
push ebx
push edi
mov esi, eax
push 0x43c3b4
push esi
call fcn.00420bc7
push edi
call fcn.00420c4b
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401630
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.00420d8a
push eax
call fcn.00420c56
add esp, 8
push ebx
push esi
mov dword [ebp - 4], 0x443ba8
push edi
mov edi, edi
push 0
call fcn.00420d8a
push eax
call fcn.00420c56
add esp, 8
mov ebx, 0x443be0
mov edi, 0x443bc4
lea ebx, [ebx]
mov eax, dword [ebx]
push eax
call fcn.00420d10
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401680
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401690
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041f974
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.00420d10
add esp, 4
push eax
push 0x43c3b4
push esi
call fcn.00420bc7
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40175b
push esi
call fcn.00420c4b
add edi, 4
add esp, 4
cmp edi, 0x443be0
jl 0x401670
add ebx, 4
cmp ebx, 0x443be4
jl 0x401665
call fcn.00420c68
mov ecx, dword [0x443be0]
push ecx
call fcn.00420d10
add esp, 4
mov ebx, eax
call fcn.00420c68
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x443bc4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401726
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401736
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f974
push edi
push ebx
mov esi, eax
push 0x43c3b4
push esi
call fcn.00420bc7
add esp, 0x14
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401760
mov ebx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401773
sub eax, edi
lea eax, [eax + edx + 8]
push eax
call fcn.0041f974
mov ecx, dword [ebx]
push ecx
push esi
mov edi, eax
push 0x43c3b4
push edi
call fcn.00420bc7
add esp, 0x14
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401834
push esi
call fcn.00420c4b
push edi
call fcn.00420c4b
add ebx, 4
add esp, 8
mov dword [ebp - 4], ebx
cmp ebx, 0x443bc4
jl 0x401650
call fcn.00401300
mov edi, eax
call fcn.00420c68
cdq
mov ecx, 7
idiv ecx
mov eax, edi
mov ebx, dword [edx*4 + 0x443ba8]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4017f0
sub eax, edx
mov edx, eax
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401800
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041f974
push ebx
push edi
mov esi, eax
push 0x43c3b4
push esi
call fcn.00420bc7
push edi
call fcn.00420c4b
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret