joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42326c]
jne 0x4148e1
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x424d00], eax
mov dword [0x424cfc], ecx
mov dword [0x424cf8], edx
mov dword [0x424cf4], ebx
mov dword [0x424cf0], esi
mov dword [0x424cec], edi
mov word [0x424d18], ss
mov word [0x424d0c], cs
mov word [0x424ce8], ds
mov word [0x424ce4], es
mov word [0x424ce0], fs
mov word [0x424cdc], gs
pushfd
pop dword [0x424d10]
mov eax, dword [ebp]
mov dword [0x424d04], eax
mov eax, dword [ebp + 4]
mov dword [0x424d08], eax
lea eax, [ebp + 8]
mov dword [0x424d14], eax
mov eax, dword [ebp - 0x320]
mov dword [0x424c50], 0x10001
mov eax, dword [0x424d08]
mov dword [0x424c04], eax
mov dword [0x424bf8], 0xc0000409
mov dword [0x424bfc], 1
mov eax, dword [0x42326c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x423270]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x424c48], eax
push 1
call fcn.00419129
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x40279c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x424c48], 0
jne 0x4149cd
push 1
call fcn.00419129
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0xcab5f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0xcb14cc]
cmp dword [eax + 0x28], 0
jne 0xcab608
xor eax, eax
jmp 0xcab737
mov ecx, dword [0xcb143c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0xcb1430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0xcb142c], eax
push 0
call dword [0xcaf138]
mov dword [ebp - 0x10], eax
push 1
call dword [0xcaf138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0xcb1430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0xcb142c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0xcb14b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0xcaf680
push 0xcaf6d0
push 0x88
call dword [0xcaf134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0xcb1428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0xcaf10c]
push eax
call fcn.00cab530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0xcaf148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0xcaf12c]
push 0xcab5c0
mov edx, dword [0xcb14cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0xcaf13c]
mov dword [0xcb1434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0xcaf130]
test eax, eax
je 0xcab737
cmp dword [ebp - 0x38], 0x12
jne 0xcab72b
mov dword [0xcb1444], 0
call fcn.00cab740
xor eax, eax
jmp 0xcab737
lea edx, [ebp - 0x3c]
push edx
call dword [0xcaf140]
jmp 0xcab6fc
mov esp, ebp
pop ebp
ret 4

Function at 0xcacb00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.00caf0dc]
call dword [fcn.00caf124]
call dword [fcn.00caf128]
call dword [fcn.00caf094]
call dword [fcn.00caf0fc]
call dword [fcn.00caf0f4]
call dword [fcn.00caf150]
call dword [fcn.00caf00c]
call dword [fcn.00caf000]
call dword [fcn.00caf160]
call fcn.00cae644
mov eax, 1
pop ebp
ret 4
Function at 0xcad69c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0xcaf168
sub eax, eax
test esi, esi
je 0xcad774
sub eax, 1
test ecx, ecx
je 0xcad772
test esi, 3
je 0xcad6da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0xcad6bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0xcad759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0xcad6e4
mov ecx, edx
test ecx, ecx
je 0xcad772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0xcad75f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0xcad77c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00cad7ff
jae 0xcad78a
xor ecx, ecx
call fcn.00cad7ff
jae 0xcad7b9
xor eax, eax
call fcn.00cad7ff
jae 0xcad7c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00cad7ff
adc al, al
jae 0xcad7ab
jne 0xcad7f5
stosb byte es:[edi], al
jmp 0xcad78d
call fcn.00cad80b
sub ecx, ebx
jne 0xcad7d2
call fcn.00cad809
jmp 0xcad7f1
lodsb al, byte [esi]
shr eax, 1
je 0xcad81b
adc ecx, ecx
jmp 0xcad7ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00cad809
cmp eax, 0x7d00
jae 0xcad7ee
cmp ah, 5
jae 0xcad7ef
cmp eax, 0x7f
ja 0xcad7f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcad78d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0xcae14c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xcb1000]
jne 0xcae156
repz ret
jmp fcn.00cae3fd
Function at 0x401950
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x401a44
cmp dword [ebx + 0x2000], 0
jle 0x401a44
push esi
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00435120
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x22c], 0x22c
mov dword [ebp + 8], esi
cmp esi, 0xffffffff
je 0x401a1f
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401a18
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x401a18
nop dword [eax]
xor edi, edi
cmp dword [ebx + 0x2000], edi
jle 0x401a05
mov esi, ebx
nop dword [eax]
test esi, esi
je 0x4019f6
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401a2a
inc edi
sub esi, 0xffffff80
cmp edi, dword [ebx + 0x2000]
jl 0x4019e0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4019d0
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x403730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4654fd
push eax
mov dword fs:[0], esp
sub esp, 0x18
call fcn.004248d0
test eax, eax
je 0x403818
cmp byte [ebp + 8], 0
je 0x4037d5
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00424650
add esp, 8
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x4037e5
cmp edx, 8
jb 0x4037d5
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4037cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403828
push edx
push ecx
call fcn.00418590
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp edx, 8
jb 0x403818
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40380e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403828
push edx
push ecx
call fcn.00418590
add esp, 8
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00437b4f
int3
Function at 0x405930
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465695
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x3c], 0
push ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004040e0
add esp, 8
cmp dword [ebp - 0x28], 8
jb 0x40599b
cmp dword [ebp - 0x3c], 0
je 0x405a00
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
cmovae eax, ecx
cmp word [eax], 0
je 0x405a00
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x405a06
cmp edx, 8
jb 0x4059d3
test ecx, ecx
je 0x405a06
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
cmp word [eax], 0
je 0x405a06
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x405a06
mov bl, 1
jmp 0x405a08
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor bl, bl
cmp edx, 8
jb 0x405a38
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405a2e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a93
push edx
push ecx
call fcn.00418590
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x405a82
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405a78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a93
push edx
push ecx
call fcn.00418590
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00437b4f
int3
Function at 0x405aa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465695
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x3c], 0
push ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004045b0
add esp, 8
cmp dword [ebp - 0x28], 8
jb 0x405b0b
cmp dword [ebp - 0x3c], 0
je 0x405b70
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
cmovae eax, ecx
cmp word [eax], 0
je 0x405b70
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x405b76
cmp edx, 8
jb 0x405b43
test ecx, ecx
je 0x405b76
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
cmp word [eax], 0
je 0x405b76
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x405b76
mov bl, 1
jmp 0x405b78
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor bl, bl
cmp edx, 8
jb 0x405ba8
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405b9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405c03
push edx
push ecx
call fcn.00418590
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x405bf2
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405be8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405c03
push edx
push ecx
call fcn.00418590
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00437b4f
int3

Function at 0x405c10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00404a80
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x405c32
test ecx, ecx
je 0x405c5f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x405c5f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x405c5f
mov bl, 1
jmp 0x405c61
xor bl, bl
cmp edx, 8
jb 0x405c91
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405c87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405c98
push edx
push ecx
call fcn.00418590
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00437b4f
int3

Function at 0x4061b0
Capabilities:
Check if file exists

Disassembly:
call fcn.00405ca0
call fcn.00405e40
jmp fcn.00405930
Function at 0x4065a0
Capabilities:
Check if file exists

Disassembly:
call fcn.004061c0
call fcn.004063b0
jmp fcn.00405aa0

Function at 0x406c50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.004065b0
lea eax, [ebp - 0x18]
push eax
call fcn.00404a80
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x406c76
test ecx, ecx
je 0x406cad
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x406cad
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406ca7
lea ecx, [ebp - 0x18]
call fcn.004011d0
mov al, 1
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x406cdd
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406cd3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ce3
push edx
push ecx
call fcn.00418590
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret
call fcn.00437b4f
int3
Function at 0x407240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465885
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov byte [ebp - 0xd], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x407455
cmp word [eax], 0
je 0x407455
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x407285
mov ecx, dword [esi]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ecx, eax
test ecx, ecx
je 0x407443
mov eax, dword [esi + 0x10]
lea ecx, [ecx + eax*2]
movzx eax, word [ecx]
mov dword [ebp - 0x14], ecx
cmp eax, 0x20
je 0x4072cd
cmp eax, 9
je 0x4072cd
cmp eax, 0xd
je 0x4072cd
cmp eax, 0xa
je 0x4072cd
test ax, ax
je 0x4072cd
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
xor esi, esi
mov byte [ebp - 0xd], 1
xor ebx, ebx
mov dword [ebp - 0x20], 0
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
test edi, edi
je 0x407441
movzx eax, word [ecx]
cmp eax, 0x20
je 0x407309
cmp eax, 9
je 0x407309
cmp eax, 0xd
je 0x407309
cmp eax, 0xa
jne 0x40730e
add ecx, 2
jmp 0x4072f2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push eax
push ecx
lea eax, [ebp - 0x38]
push eax
call fcn.00407110
add esp, 0xc
cmp dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
je 0x40739d
lea eax, [ebp - 0x38]
push eax
cmp esi, ebx
je 0x407343
mov ecx, esi
call fcn.00401840
add esi, 0x18
mov dword [ebp - 0x1c], esi
jmp 0x407352
push esi
lea ecx, [ebp - 0x20]
call fcn.00401620
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x407390
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407386
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407466
push edx
push ecx
call fcn.00418590
add esp, 8
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4072f2
jmp 0x4073db
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x4073db
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4073d1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407466
push edx
push ecx
call fcn.00418590
add esp, 8
lea eax, [ebp - 0x20]
cmp edi, eax
mov edi, dword [ebp - 0x20]
je 0x4073f2
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push esi
push edi
call fcn.00406f40
test edi, edi
je 0x407441
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call fcn.004015b0
sub ebx, edi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, edi
shl ecx, 3
cmp ecx, 0x1000
jb 0x407437
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40746b
push ecx
push edi
call fcn.00418590
add esp, 8
pop edi
pop ebx
mov al, byte [ebp - 0xd]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00437b4f
call fcn.00437b4f
int3
Function at 0x40b4c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x18
mov ecx, dword [0x48da7c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x48d9bc]
cmp eax, dword [ecx + 4]
jg 0x40b60c
mov edx, dword [0x48c04c]
mov ecx, dword [0x48c038]
push esi
cmp edx, 8
jb 0x40b4fc
test ecx, ecx
je 0x40b527
cmp edx, 8
mov eax, 0x48c038
cmovae eax, ecx
cmp word [eax], 0
je 0x40b527
cmp edx, 8
mov eax, 0x48c038
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b5f7
lea eax, [ebp - 0x18]
push eax
call fcn.0040d230
mov esi, eax
add esp, 4
cmp esi, 0x48c038
je 0x40b5c1
mov edx, dword [0x48c04c]
cmp edx, 8
jb 0x40b581
mov ecx, dword [0x48c038]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b577
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b642
push edx
push ecx
call fcn.00418590
add esp, 8
mov dword [0x48c048], 0
xor eax, eax
mov dword [0x48c04c], 7
mov word [0x48c038], ax
movups xmm0, xmmword [esi]
movups xmmword [0x48c038], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x48c048], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 4]
cmp edx, 8
jb 0x40b5f7
mov ecx, dword [ebp - 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b5ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b642
push edx
push ecx
call fcn.00418590
add esp, 8
mov ecx, dword [ebp + 8]
push 0x48c038
call fcn.00401840
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x48d9bc
call fcn.0041895b
add esp, 4
cmp dword [0x48d9bc], 0xffffffff
jne 0x40b4e6
push 0x467db0
call fcn.00418837
push 0x48d9bc
call fcn.00418911
add esp, 8
jmp 0x40b4e6
call fcn.00437b4f
int3
Function at 0x40b650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x18
mov ecx, dword [0x48da7c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x48d9c0]
cmp eax, dword [ecx + 4]
jg 0x40b79c
mov edx, dword [0x48c064]
mov ecx, dword [0x48c050]
push esi
cmp edx, 8
jb 0x40b68c
test ecx, ecx
je 0x40b6b7
cmp edx, 8
mov eax, 0x48c050
cmovae eax, ecx
cmp word [eax], 0
je 0x40b6b7
cmp edx, 8
mov eax, 0x48c050
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b787
lea eax, [ebp - 0x18]
push eax
call fcn.0040d480
mov esi, eax
add esp, 4
cmp esi, 0x48c050
je 0x40b751
mov edx, dword [0x48c064]
cmp edx, 8
jb 0x40b711
mov ecx, dword [0x48c050]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b707
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b7d2
push edx
push ecx
call fcn.00418590
add esp, 8
mov dword [0x48c060], 0
xor eax, eax
mov dword [0x48c064], 7
mov word [0x48c050], ax
movups xmm0, xmmword [esi]
movups xmmword [0x48c050], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x48c060], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 4]
cmp edx, 8
jb 0x40b787
mov ecx, dword [ebp - 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b77d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b7d2
push edx
push ecx
call fcn.00418590
add esp, 8
mov ecx, dword [ebp + 8]
push 0x48c050
call fcn.00401840
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x48d9c0
call fcn.0041895b
add esp, 4
cmp dword [0x48d9c0], 0xffffffff
jne 0x40b676
push 0x467e10
call fcn.00418837
push 0x48d9c0
call fcn.00418911
add esp, 8
jmp 0x40b676
call fcn.00437b4f
int3

Function at 0x40c260
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040b4c0
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40c282
test ecx, ecx
je 0x40c2af
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x40c2af
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x40c2af
mov bl, 1
jmp 0x40c2b1
xor bl, bl
cmp edx, 8
jb 0x40c2e1
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c2d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2e8
push edx
push ecx
call fcn.00418590
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00437b4f
int3