joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407074
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00403dbd
xor ebx, ebx
cmp dword [0x40e8ec], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40714a
push 0x401980
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40722a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401974
push edi
call esi
cmp eax, ebx
je 0x40722a
push eax
call fcn.00403d4f
mov dword [esp], 0x401964
push edi
mov dword [0x40e8ec], eax
call esi
push eax
call fcn.00403d4f
mov dword [esp], 0x401950
push edi
mov dword [0x40e8f0], eax
call esi
push eax
call fcn.00403d4f
mov dword [0x40e8f4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040303b
test eax, eax
pop ecx
pop ecx
je 0x407118
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004051b8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40714a
push 0x401934
push edi
call esi
push eax
call fcn.00403d4f
cmp eax, ebx
pop ecx
mov dword [0x40e8fc], eax
je 0x40714a
push 0x40191c
push edi
call esi
push eax
call fcn.00403d4f
pop ecx
mov dword [0x40e8f8], eax
mov eax, dword [0x40e8f8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4071cf
cmp dword [0x40e8fc], ecx
je 0x4071cf
push eax
call fcn.00403dc6
push dword [0x40e8fc]
mov esi, eax
call fcn.00403dc6
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4071cf
cmp edi, ebx
je 0x4071cf
call esi
cmp eax, ebx
je 0x40719c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40719c
test byte [ebp - 0x18], 1
jne 0x4071cf
lea eax, [ebp - 0x10]
push eax
call fcn.00403072
test eax, eax
pop ecx
je 0x4071b7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004051b8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4071c6
or dword [ebp + 0x10], 0x200000
jmp 0x40720a
or dword [ebp + 0x10], 0x40000
jmp 0x40720a
mov eax, dword [0x40e8f0]
cmp eax, dword [ebp - 8]
je 0x40720a
push eax
call fcn.00403dc6
cmp eax, ebx
pop ecx
je 0x40720a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40720a
mov eax, dword [0x40e8f4]
cmp eax, dword [ebp - 8]
je 0x40720a
push eax
call fcn.00403dc6
cmp eax, ebx
pop ecx
je 0x40720a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e8ec]
call fcn.00403dc6
cmp eax, ebx
pop ecx
je 0x40722a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40722c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401950
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x401a44
cmp dword [ebx + 0x2000], 0
jle 0x401a44
push esi
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00449450
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x22c], 0x22c
mov dword [ebp + 8], esi
cmp esi, 0xffffffff
je 0x401a1f
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401a18
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x401a18
nop dword [eax]
xor edi, edi
cmp dword [ebx + 0x2000], edi
jle 0x401a05
mov esi, ebx
nop dword [eax]
test esi, esi
je 0x4019f6
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401a2a
inc edi
sub esi, 0xffffff80
cmp edi, dword [ebx + 0x2000]
jl 0x4019e0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4019d0
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405290
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481797
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
call fcn.0040fe80
add esp, 4
mov eax, dword [esi + 0x14]
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
cmp eax, 8
jb 0x4052e0
mov ecx, dword [esi]
test ecx, ecx
je 0x40530b
mov ecx, esi
cmp eax, 8
jb 0x4052ed
mov ecx, dword [esi]
cmp word [ecx], 0
je 0x40530b
mov ecx, esi
cmp eax, 8
jb 0x4052fc
mov ecx, dword [esi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x405422
lea eax, [ebp - 0x28]
push eax
call fcn.0040fef0
add esp, 4
mov ecx, esi
push eax
call fcn.004037e0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x405359
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40534f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405433
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov eax, dword [esi + 0x14]
mov ecx, esi
cmp eax, 8
jb 0x405365
mov ecx, dword [esi]
test ecx, ecx
je 0x405390
mov ecx, esi
cmp eax, 8
jb 0x405372
mov ecx, dword [esi]
cmp word [ecx], 0
je 0x405390
mov ecx, esi
cmp eax, 8
jb 0x405381
mov ecx, dword [esi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x405422
push str.SOFTWAREMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push SysReAllocString
push eax
call fcn.00405600
add esp, 0xc
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x18], 0
jne 0x4053e1
push str.SOFTWAREMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
lea eax, [ebp - 0x40]
push SysReAllocString
push eax
call fcn.00405600
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.004037e0
lea ecx, [ebp - 0x40]
call fcn.004011d0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004037e0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x405422
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405418
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405438
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
call fcn.0044be7f
int3
Function at 0x405a00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48182d
push eax
mov dword fs:[0], esp
sub esp, 0x18
call fcn.0042f160
test eax, eax
je 0x405ae8
cmp byte [ebp + 8], 0
je 0x405aa5
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042eb30
add esp, 8
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x405ab5
cmp edx, 8
jb 0x405aa5
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405a9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405af8
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp edx, 8
jb 0x405ae8
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405ade
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405af8
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
int3

Function at 0x405de0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 1
call fcn.00405a00
add esp, 4
test al, al
jne 0x405df7
pop ebp
jmp fcn.00405e00
xor eax, eax
pop ebp
ret
Function at 0x405e00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481865
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00405290
add esp, 4
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 4], 0
cmp edx, 8
jb 0x405e42
test ecx, ecx
je 0x405f13
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
cmp word [eax], 0
je 0x405f13
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405f0d
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov byte [ebp - 4], 1
cmp byte [ebp + 8], al
je 0x405e9d
lea eax, [ebp - 0x24]
push eax
call fcn.00404ce0
add esp, 4
push dword [ebp + 0x18]
lea eax, [ebp - 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00405f60
mov edx, dword [ebp - 0x10]
add esp, 0x18
mov esi, eax
cmp edx, 8
jb 0x405ef1
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405ee7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405f56
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
jmp 0x405f15
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
xor esi, esi
cmp edx, 8
jb 0x405f45
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405f3b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405f56
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
int3
Function at 0x405f60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48189d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x10], 0
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x405f92
mov ecx, dword [esi]
test ecx, ecx
je 0x406155
mov ecx, esi
cmp eax, 8
jb 0x405fa3
mov ecx, dword [esi]
cmp word [ecx], 0
je 0x406155
mov ecx, esi
cmp eax, 8
jb 0x405fb6
mov ecx, dword [esi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406155
xor eax, eax
mov dword [ebp - 0x28], 0
push edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [edi + 0x10], eax
je 0x4060b8
push esi
lea eax, [ebp - 0x70]
push 0x486724
push eax
call fcn.00402fd0
push 0x48671c
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
call fcn.00402f60
push edi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.00402f00
mov edi, eax
add esp, 0x24
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x406099
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x406067
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40605d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406167
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ecx, [ebp - 0x40]
call fcn.004011d0
lea ecx, [ebp - 0x58]
call fcn.004011d0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.004011d0
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x10], 0
je 0x4060dc
push dword [ebp + 0x1c]
push 0x1e
push 0x32
push 1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push edi
call fcn.00413b30
add esp, 0x20
mov dword [ebp - 0x10], eax
jmp 0x40611e
push 0
call fcn.0040b8b0
add esp, 4
test al, al
lea eax, [ebp - 0x28]
je 0x4060fe
push 5
push eax
push esi
call fcn.00413dc0
add esp, 0xc
mov dword [ebp - 0x10], eax
jmp 0x40611e
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x40610e
mov esi, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
push 5
push eax
push esi
call fcn.004240a0
add esp, 0x10
mov edx, dword [ebp - 0x14]
pop edi
cmp edx, 8
jb 0x406155
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40614b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40616c
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
call fcn.0044be7f
int3
Function at 0x406180
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4818cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x24], 0
push ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.004260c0
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call fcn.00424f80
mov edx, dword [ebp - 0x10]
add esp, 8
test eax, eax
mov dword [ebp - 4], 0xffffffff
setne bl
cmp edx, 8
jb 0x40621d
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406213
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4063b4
push edx
push ecx
call fcn.0041b36a
add esp, 8
test bl, bl
pop ebx
je 0x4063a4
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0040fe80
add esp, 4
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 4], 1
cmp edx, 8
jb 0x40624d
test ecx, ecx
je 0x406361
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
cmp word [eax], 0
je 0x406361
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40635b
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov byte [ebp - 4], 2
cmp byte [ebp + 8], al
je 0x4062a8
lea eax, [ebp - 0x24]
push eax
call fcn.00404ce0
add esp, 4
push dword [ebp + 0x18]
lea eax, [ebp - 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00405f60
mov edx, dword [ebp - 0x10]
add esp, 0x18
mov esi, eax
cmp edx, 8
jb 0x406300
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4062f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4063b9
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x406393
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406340
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4063b9
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x406391
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406387
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4063b9
push edx
push ecx
call fcn.0041b36a
add esp, 8
xor esi, esi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
call fcn.0044be7f
int3
Function at 0x409ed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481865
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x3c], 0
push ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00408130
add esp, 8
cmp dword [ebp - 0x28], 8
jb 0x409f3b
cmp dword [ebp - 0x3c], 0
je 0x409fa0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
cmovae eax, ecx
cmp word [eax], 0
je 0x409fa0
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x409fa6
cmp edx, 8
jb 0x409f73
test ecx, ecx
je 0x409fa6
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
cmp word [eax], 0
je 0x409fa6
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x409fa6
mov bl, 1
jmp 0x409fa8
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor bl, bl
cmp edx, 8
jb 0x409fd8
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409fce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a033
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x40a022
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a018
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a033
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
int3

Function at 0x40a040
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00408600
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40a062
test ecx, ecx
je 0x40a08f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x40a08f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x40a08f
mov bl, 1
jmp 0x40a091
xor bl, bl
cmp edx, 8
jb 0x40a0c1
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a0b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a0c8
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
int3

Function at 0x40a5e0
Capabilities:
Check if file exists

Disassembly:
call fcn.0040a0d0
call fcn.0040a270
jmp fcn.00409d60
Function at 0x40a9d0
Capabilities:
Check if file exists

Disassembly:
call fcn.0040a5f0
call fcn.0040a7e0
jmp fcn.00409ed0

Function at 0x40b080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.0040a9e0
lea eax, [ebp - 0x18]
push eax
call fcn.00408600
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40b0a6
test ecx, ecx
je 0x40b0dd
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x40b0dd
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b0d7
lea ecx, [ebp - 0x18]
call fcn.004011d0
mov al, 1
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40b10d
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b103
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b113
push edx
push ecx
call fcn.0041b36a
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
int3
Function at 0x40b670
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481df5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov byte [ebp - 0xd], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x40b885
cmp word [eax], 0
je 0x40b885
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x40b6b5
mov ecx, dword [esi]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ecx, eax
test ecx, ecx
je 0x40b873
mov eax, dword [esi + 0x10]
lea ecx, [ecx + eax*2]
movzx eax, word [ecx]
mov dword [ebp - 0x14], ecx
cmp eax, 0x20
je 0x40b6fd
cmp eax, 9
je 0x40b6fd
cmp eax, 0xd
je 0x40b6fd
cmp eax, 0xa
je 0x40b6fd
test ax, ax
je 0x40b6fd
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
xor esi, esi
mov byte [ebp - 0xd], 1
xor ebx, ebx
mov dword [ebp - 0x20], 0
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
test edi, edi
je 0x40b871
movzx eax, word [ecx]
cmp eax, 0x20
je 0x40b739
cmp eax, 9
je 0x40b739
cmp eax, 0xd
je 0x40b739
cmp eax, 0xa
jne 0x40b73e
add ecx, 2
jmp 0x40b722
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push eax
push ecx
lea eax, [ebp - 0x38]
push eax
call fcn.0040b540
add esp, 0xc
cmp dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
je 0x40b7cd
lea eax, [ebp - 0x38]
push eax
cmp esi, ebx
je 0x40b773
mov ecx, esi
call fcn.00401840
add esi, 0x18
mov dword [ebp - 0x1c], esi
jmp 0x40b782
push esi
lea ecx, [ebp - 0x20]
call fcn.00401620
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x40b7c0
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b7b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b896
push edx
push ecx
call fcn.0041b36a
add esp, 8
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x40b722
jmp 0x40b80b
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x40b80b
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b801
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b896
push edx
push ecx
call fcn.0041b36a
add esp, 8
lea eax, [ebp - 0x20]
cmp edi, eax
mov edi, dword [ebp - 0x20]
je 0x40b822
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push esi
push edi
call fcn.0040b370
test edi, edi
je 0x40b871
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call fcn.004015b0
sub ebx, edi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, edi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40b867
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b89b
push ecx
push edi
call fcn.0041b36a
add esp, 8
pop edi
pop ebx
mov al, byte [ebp - 0xd]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0044be7f
call fcn.0044be7f
int3