joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a5ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x4d51bf
call fcn.00477068
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x188]
mov dword [ebp - 4], 0x25
call fcn.004b958e
lea ecx, [esi + 0x184]
mov byte [ebp - 4], 0x24
call fcn.004b958e
lea ecx, [esi + 0x180]
mov byte [ebp - 4], 0x23
call fcn.004b958e
lea ecx, [esi + 0x17c]
mov byte [ebp - 4], 0x22
call fcn.004b958e
lea ecx, [esi + 0x178]
mov byte [ebp - 4], 0x21
call fcn.004b958e
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0x20
call fcn.004b958e
lea ecx, [esi + 0x140]
mov byte [ebp - 4], 0x1f
call fcn.004b958e
lea ecx, [esi + 0x134]
mov byte [ebp - 4], 0x1e
call fcn.004b958e
lea ecx, [esi + 0x130]
mov byte [ebp - 4], 0x1d
call fcn.004b958e
lea ecx, [esi + 0x128]
mov byte [ebp - 4], 0x1c
call fcn.004b958e
lea ecx, [esi + 0x124]
mov byte [ebp - 4], 0x1b
call fcn.004b958e
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0x1a
call fcn.004b958e
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 0x19
call fcn.004b958e
mov byte [ebp - 4], 0x18
lea ecx, [esi + 0x104]
call fcn.004b958e
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 0x17
call fcn.004b958e
lea ecx, [esi + 0xfc]
mov byte [ebp - 4], 0x16
call fcn.004b958e
lea ecx, [esi + 0xf4]
mov byte [ebp - 4], 0x15
call fcn.004b958e
lea ecx, [esi + 0xf0]
mov byte [ebp - 4], 0x14
call fcn.004b958e
lea ecx, [esi + 0xec]
mov byte [ebp - 4], 0x13
call fcn.004b958e
lea ecx, [esi + 0xe8]
mov byte [ebp - 4], 0x12
call fcn.004b958e
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 0x11
call fcn.004b958e
lea ecx, [esi + 0xbc]
mov byte [ebp - 4], 0x10
call fcn.004b958e
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 0xf
call fcn.004b958e
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 0xe
call fcn.004b958e
lea ecx, [esi + 0xb0]
mov byte [ebp - 4], 0xd
call fcn.004b958e
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 0xc
call fcn.004b958e
lea ecx, [esi + 0xa4]
mov byte [ebp - 4], 0xb
call fcn.004b958e
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 0xa
call fcn.004b958e
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 9
call fcn.004b958e
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 8
call fcn.004b958e
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 7
call fcn.004b958e
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.004b958e
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 5
call fcn.004b958e
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 4
call fcn.004b958e
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 3
call fcn.004b958e
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.004b958e
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.004b958e
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.004b958e
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.004b958e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42b01a
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d531e
call fcn.00477068
sub esp, 0x2a0
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00419874
pop ecx
mov eax, dword [eax]
push 1
xor edi, edi
push 1
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.00413491
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004b958e
lea ecx, [ebp - 0xe4]
call fcn.0042ae74
push dword [ebp + 0x2c]
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 3
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.0042aa15
mov esi, eax
cmp esi, edi
je 0x42b0b4
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.004b958e
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4e1114
call fcn.0042d4d8
jmp 0x42b1dd
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b0ea
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.004b958e
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4e1114
call fcn.0042d4d8
or esi, 0xffffffff
jmp 0x42b1dd
push edi
lea ecx, [ebp - 0x2ac]
call fcn.0045e230
push 3
lea ecx, [ebp - 0x2ac]
push dword [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.0045ef20
test al, al
jne 0x42b13e
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x4e0458
call fcn.0045e300
lea ecx, [ebp - 0x2ac]
call fcn.0045e250
mov byte [ebp - 4], 7
or esi, 0xffffffff
jmp 0x42b1c0
cmp dword [ebp + 0x24], edi
jle 0x42b186
cmp dword [ebp + 0x20], edi
jle 0x42b186
lea ecx, [ebp - 0x2ac]
call fcn.0045d370
lea ecx, [ebp - 0x2ac]
mov esi, eax
call fcn.0045d360
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
lea eax, [ebp + 0x18]
push esi
push eax
call fcn.0042be45
push dword [ebp + 0x1c]
lea eax, [ebp - 0x2ac]
push dword [ebp + 0x18]
push eax
call fcn.00414816
add esp, 0x20
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2ac]
push edi
push eax
call fcn.0045e850
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x4e0458
call fcn.0045e300
lea ecx, [ebp - 0x2ac]
call fcn.0045e250
mov byte [ebp - 4], 8
xor esi, esi
lea ecx, [ebp - 0x74]
call fcn.004b958e
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4e1094
call fcn.0042ae01
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004134fe
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42bea8
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d5470
call fcn.00477068
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, 0x57d0d4
push str._sMediaProbe.exe
push edi
call fcn.004b6b21
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x57d0d4]
call esi
test eax, eax
jne 0x42beec
push str.MediaProbe.exe
mov ecx, edi
call fcn.004b9725
push ebx
mov edi, 0x57d0d8
push str._sMediaEncode.exe
push edi
call fcn.004b6b21
add esp, 0xc
push dword [0x57d0d8]
call esi
test eax, eax
jne 0x42bf18
push str.MediaEncode.exe
mov ecx, edi
call fcn.004b9725
push dword [0x57d0d8]
lea eax, [ebp - 0x14]
push eax
call fcn.00413823
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0x50f4e4
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004b9833
push eax
mov ecx, 0x57d0dc
mov byte [ebp - 4], 1
call fcn.004b96d5
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004b958e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004b958e
push ebx
mov edi, 0x57d0e0
push str._sMediaPlay.exe
push edi
call fcn.004b6b21
add esp, 0xc
push dword [0x57d0e0]
call esi
test eax, eax
jne 0x42bf8f
push str.MediaPlay.exe
mov ecx, edi
call fcn.004b9725
cmp dword [0x57d0e4], 0
jne 0x42c093
mov eax, dword [0x5758b8]
mov dword [ebp + 8], eax
push 2
lea eax, [ebp + 8]
pop edi
push ebx
push str._s_avcodec_60.dll
push eax
mov dword [ebp - 4], edi
call fcn.004b6b21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x42bfcf
mov dword [0x57d0e4], 6
cmp dword [0x57d0e4], 0
jne 0x42c087
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_59.dll
push eax
call fcn.004b6b21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x42c001
mov dword [0x57d0e4], 5
cmp dword [0x57d0e4], 0
jne 0x42c087
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_58.dll
push eax
call fcn.004b6b21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x42c02f
mov dword [0x57d0e4], 4
cmp dword [0x57d0e4], 0
jne 0x42c087
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_57.dll
push eax
call fcn.004b6b21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x42c05d
mov dword [0x57d0e4], 3
cmp dword [0x57d0e4], 0
jne 0x42c087
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_56.dll
push eax
call fcn.004b6b21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x42c087
mov dword [0x57d0e4], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004b958e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x57d0e8], 1
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42c0ae
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [0x57d0e0]
call esi
test eax, eax
je 0x42c0ce
xor eax, eax
push eax
push eax
push eax
push dword [0x57d0e0]
jmp 0x42c0fe
push dword [0x57d0d8]
call esi
test eax, eax
je 0x42c0e7
xor eax, eax
push eax
push eax
push eax
push dword [0x57d0d8]
jmp 0x42c0fe
push dword [0x57d0d4]
call esi
test eax, eax
je 0x42c106
xor eax, eax
push eax
push eax
push eax
push dword [0x57d0d4]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
ret

Function at 0x42c329
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x4d54cc
call fcn.00477068
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c367
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00413823
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004b958e
lea eax, [ebp - 0x14]
push eax
call fcn.00419874
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00413491
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b958e
push dword [ebp + 8]
lea edi, [esi + 0x70]
mov ecx, edi
call fcn.004b9725
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x68]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0042c10a
test eax, eax
je 0x42c3be
mov esi, eax
jmp 0x42c3f3
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x28]
test eax, eax
je 0x42c3d8
or esi, 0xffffffff
jmp 0x42c3f3
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x2c]
or esi, 0xffffffff
cmp eax, esi
je 0x42c3f3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004134fe
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x42fd51
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x4d5a18
call fcn.00477068
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 0x57d0cc
lea ecx, [ebp - 0x10]
call fcn.004b9602
xor edi, edi
xor ebx, ebx
cmp dword [esi + 0x14], edi
mov dword [ebp - 4], edi
jle 0x42fddf
cmp ebx, edi
jl 0x42fd7f
cmp ebx, dword [esi + 0x14]
jge 0x42fd7f
mov eax, dword [esi + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x42fd81
xor eax, eax
cmp dword [eax + 0x6c], 0x64
jne 0x42fdd9
cmp dword [eax + 0x74], 0x64
jne 0x42fdd9
push dword [eax + 0x5a0]
lea edi, [eax + 0x5a0]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42fdd7
test ebx, ebx
jle 0x42fdb4
push 0x501ae0
lea ecx, [ebp - 0x10]
call fcn.004b997f
push 0x501adc
lea ecx, [ebp - 0x10]
call fcn.004b997f
push edi
lea ecx, [ebp - 0x10]
call fcn.004b99bb
push 0x501adc
lea ecx, [ebp - 0x10]
call fcn.004b997f
xor edi, edi
inc ebx
cmp ebx, dword [esi + 0x14]
jl 0x42fd6e
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x42fe22
lea eax, [ebp - 0x14]
push eax
call fcn.00401f8b
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push 1
push edi
je 0x42fe0a
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
jmp 0x42fe13
push edi
push dword [ebp - 0x10]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.004b958e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b958e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x433c6c
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d65c7
call fcn.00477068
sub esp, 0xdc
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
call ebx
test eax, eax
je 0x433e34
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, 0xc
je 0x433e31
cmp eax, 0xd
je 0x433e31
push dword [esi]
lea eax, [ebp - 0x10]
push eax
call fcn.00413823
push dword [esi]
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.00413892
push dword [esi]
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
call fcn.004138d7
add esp, 0x18
cmp dword [edi], 0xb
mov byte [ebp - 4], 2
jne 0x433d21
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push eax
call fcn.00413b68
add esp, 0x10
push dword [ebp + 8]
mov byte [ebp - 4], 3
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push str._s_s._s
push esi
call fcn.004b6b21
add esp, 0x14
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.004b958e
jmp 0x433e0d
push dword [esi]
call ebx
test eax, eax
je 0x433e0d
mov ebx, str._s_s._s
push 0
lea ecx, [ebp - 0xe8]
call fcn.0040db82
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x84]
push eax
mov byte [ebp - 4], 4
call fcn.004b96d5
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x80]
push eax
call fcn.004b96d5
lea eax, [ebp + 8]
lea ecx, [ebp - 0x7c]
push eax
call fcn.004b96d5
lea ecx, [ebp - 0xe8]
call fcn.004ba10c
dec eax
je 0x433da6
dec eax
je 0x433df8
dec eax
je 0x433df0
sub eax, 8
je 0x433d8b
dec eax
je 0x433de8
dec eax
je 0x433de0
jmp 0x433dbf
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push ebx
push esi
call fcn.004b6b21
add esp, 0x14
mov dword [edi], 0xb
jmp 0x433dbf
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push ebx
push esi
call fcn.004b6b21
add esp, 0x14
mov dword [edi], 1
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 2
call fcn.0040dc37
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x433d32
jmp 0x433e0d
mov dword [edi], 0xd
jmp 0x433dfe
mov dword [edi], 0xc
jmp 0x433dfe
mov dword [edi], 3
jmp 0x433dfe
mov dword [edi], 2
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 2
call fcn.0040dc37
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004b958e
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b958e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b958e
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x433ec4
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push dword [esp + 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x433f08
xor ebx, ebx
mov esi, 0x3e8
push dword [esp + 0x10]
call fcn.00413754
cmp eax, 0xffffffff
pop ecx
jne 0x433f08
push dword [edi + 0x10]
push esi
call fcn.004156aa
pop ecx
test eax, eax
pop ecx
jne 0x433f0c
add ebx, esi
cmp ebx, 0x2710
jge 0x433f0c
jmp 0x433ede
xor eax, eax
jmp 0x433f0f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret 4
Function at 0x433f15
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
push dword [ebp + 8]
mov ebx, ecx
call esi
test eax, eax
jne 0x433f31
push 0xfffffffffffffffe
pop eax
jmp 0x433f8b
push dword [ebp + 0xc]
call esi
xor edi, edi
test eax, eax
je 0x433f4f
cmp dword [ebp + 0x10], edi
je 0x433f88
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.00433ec4
test eax, eax
jl 0x433f88
mov esi, 0x3e8
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00413778
add esp, 0xc
cmp eax, 0xffffffff
jne 0x433f84
push dword [ebx + 0x10]
push esi
call fcn.004156aa
pop ecx
test eax, eax
pop ecx
jne 0x433f88
add edi, esi
cmp edi, 0x2710
jge 0x433f88
jmp 0x433f54
xor eax, eax
jmp 0x433f8b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x452e09
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4d892a
call fcn.00477068
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004525d8
mov eax, dword [0x5758b8]
lea ecx, [esi + 0x14]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x5758b8]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0x4e2b90
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [0x5758b8]
mov dword [esi + 0x3c], eax
mov eax, dword [0x5758b8]
mov dword [esi + 0x40], eax
mov eax, dword [0x5758b8]
mov dword [esi + 0x44], eax
mov edi, 0x57d0cc
mov byte [ebp - 4], 6
push edi
mov dword [esi], 0x4e2b84
call fcn.004b9725
push edi
lea ecx, [esi + 0x18]
call fcn.004b9725
push edi
lea ecx, [esi + 0x3c]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.004b9725
push edi
lea ecx, [esi + 0x40]
call fcn.004b9725
push edi
lea ecx, [esi + 0x44]
call fcn.004b9725
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45b927
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d90bf
call fcn.00477068
sub esp, 0xe4
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x45ba85
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45ba85
lea ecx, [ebp - 0xf0]
call fcn.004204a5
push ebx
push 0x74
push dword [ebp + 8]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], ebx
push eax
call fcn.0042060e
mov ecx, eax
call fcn.004200c9
test al, al
jne 0x45b98c
or esi, 0xffffffff
jmp 0x45ba57
lea eax, [ebp - 0x10]
push str.MediaFormats
push eax
lea ecx, [ebp - 0xf0]
call fcn.004200e1
lea ecx, [ebp - 0x10]
call fcn.004200c9
test al, al
jne 0x45b984
push 0x57d0cc
lea eax, [ebp - 0x1c]
push 0x5025c8
push eax
lea ecx, [ebp - 0x10]
call fcn.00420128
mov ecx, eax
call fcn.0041ff79
push eax
lea ecx, [ebp - 0x14]
call fcn.004b9602
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [esi + 4]
push dword [ebp - 0x14]
call fcn.00477125
pop ecx
test eax, eax
pop ecx
je 0x45b9ef
push 1
pop esi
jmp 0x45ba4b
lea eax, [ebp - 0x18]
push str.Categories
push eax
lea ecx, [ebp - 0x10]
call fcn.004200e1
lea ecx, [ebp - 0x18]
call fcn.004200c9
test al, al
je 0x45ba11
or esi, 0xffffffff
jmp 0x45ba4b
cmp dword [esi + 0x10], ebx
jle 0x45ba49
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x18]
mov edi, dword [eax + ebx*4]
lea eax, [ebp + 8]
push dword [edi + 8]
push eax
call fcn.004200e1
lea ecx, [ebp + 8]
call fcn.004200c9
test al, al
jne 0x45ba6a
lea eax, [ebp + 8]
push eax
push edi
call fcn.0045ba99
inc ebx
pop ecx
cmp ebx, dword [esi + 0x10]
pop ecx
jl 0x45ba16
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b958e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.004204bc
mov eax, esi
jmp 0x45ba88
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b958e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.004204bc
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x464e80
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.0045d360
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x464eb2
mov dword [esp + 0x2c], 0
jmp 0x464ecd
mov ecx, ebp
call fcn.0045d360
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.0045d360
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.0045d370
cmp eax, esi
jae 0x464f0d
mov ecx, ebp
call fcn.0045d370
mov dword [esp + 0x10], eax
jmp 0x464f11
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.0045d1b0
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x464f7d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x464f78
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.0045d6b0
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x464f6b
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.0045db20
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x464f38
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x464f26
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x470e9a
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x57d460]
cmp dword [eax + 0x224], 0
je 0x470eb3
mov ecx, dword [esp + 4]
mov dword [eax + 0x228], ecx
ret
push ebp
push esi
push edi
push str._nMIRACL_error_from_routine
call fcn.004710ce
pop ecx
mov eax, dword [0x57d460]
mov ecx, dword [eax + 0x1c]
mov ebp, 0x575684
cmp ecx, 0x18
jge 0x470ee0
mov eax, dword [eax + ecx*4 + 0x20]
push dword [eax*4 + 0x5743cc]
jmp 0x470ee1
push ebp
call fcn.004710ce
pop ecx
mov edi, 0x5763e0
push edi
push 0xa
call fcn.0047a029
mov eax, dword [0x57d460]
pop ecx
pop ecx
mov esi, dword [eax + 0x1c]
dec esi
js 0x470f44
push ebx
lea ebx, [esi*4 + 0x20]
push str.______________called_from
call fcn.004710ce
cmp esi, 0x18
pop ecx
jge 0x470f2a
mov eax, dword [0x57d460]
mov eax, dword [ebx + eax]
push dword [eax*4 + 0x5743cc]
jmp 0x470f2b
push ebp
call fcn.004710ce
pop ecx
push edi
push 0xa
call fcn.0047a029
dec esi
pop ecx
sub ebx, 4
pop ecx
test esi, esi
jge 0x470f09
pop ebx
mov eax, dword [esp + 0x10]
pop edi
dec eax
pop esi
cmp eax, 0x1c
pop ebp
ja case.default.0x470f55
jmp dword [eax*4 + 0x47105a]
push str.Number_base_too_big_for_representation_n
jmp 0x47104d
push str.Division_by_zero_attempted_n
jmp 0x47104d
push str.Overflow___Number_too_big_n
jmp 0x47104d
push str.Internal_result_is_negative_n
jmp 0x47104d
push str.Input_format_error_n
jmp 0x47104d
push str.Illegal_number_base_n
jmp 0x47104d
push str.Illegal_parameter_usage_n
jmp 0x47104d
push str.Out_of_space_n
jmp 0x47104d
push str.Even_root_of_a_negative_number_n
jmp 0x47104d
push str.Raising_integer_to_negative_power_n
jmp 0x47104d
push str.Attempt_to_take_illegal_root_n
jmp 0x47104d
push str.Integer_operation_attempted_on_Flash_number_n
jmp 0x47104d
push str.Flash_overflow_n
jmp 0x47104d
push str.Numbers_too_big_n
jmp 0x47104d
push str.Log_of_a_non_positive_number_n
jmp 0x47104d
push str.Flash_to_double_conversion_failure_n
jmp 0x47104d
push str.I_O_buffer_overflow_n
jmp 0x47104d
push str.MIRACL_not_initialised___no_call_to_mirsys___n
jmp 0x47104d
push str.Illegal_modulus__n
jmp 0x47104d
push str.No_modulus_defined_n
jmp 0x47104d
push str.Exponent_too_big_n
jmp 0x47104d
push str.Unsupported_Feature___check_mirdef.h_n
jmp 0x47104d
push str.Specified_double_length_type_isnt_double_length_n
jmp 0x47104d
push str.Specified_basis_is_NOT_irreducible_n
jmp 0x47104d
push str.Unable_to_control_Floating_point_rounding_n
jmp 0x47104d
push str.Base_must_be_binary__MR_ALWAYS_BINARY_defined_in_mirdef.h____n
jmp 0x47104d
push str.No_irreducible_basis_defined_n
jmp 0x47104d
push str.Composite_modulus_n
jmp 0x47104d
push str.Input_output_error_when_reading_from_RNG_device_node_n
jmp 0x47104d
push str.Undefined_error_n
call fcn.004710ce
pop ecx
push 0
call fcn.00477200
pop esp
cmova eax, dword [eax]
cmova ax, word [eax]
jo 4657267
inc edi
add byte [edx + 0xf], bh
inc edi
add byte [edi + ecx + 0xf8e0047], al
inc edi
add byte [eax - 0x5dffb8f1], bl
cmova eax, dword [eax]
lodsb al, byte [esi]
cmova eax, dword [eax]
mov byte [0xac00470f], al
cmova eax, dword [eax]
mov dh, 0xf
inc edi
add al, al
cmova eax, dword [eax]
retf 0x470f
Function at 0x477e06
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x477e26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047ab9e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x477e49
test byte [esp + 8], 2
je 0x477e49
call fcn.0047ac11
mov dword [eax], 0xd
call fcn.0047ac1a
mov dword [eax], 5
jmp 0x477e22
xor eax, eax
ret