joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421e40
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00421e50

Function at 0x4220b0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.00421e50

Function at 0x4220c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x20b
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.00462b20
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00466980
cmp byte [edi + 0xb], 0
jns 0x42211c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004669f0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x422150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x214
push str....._base_files_file_util_win.cc
push str.PathHasAccess
push esi
call fcn.00462b20
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00466980
cmp byte [edi + 0xb], 0
jns 0x4221b1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x422247
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x42220a
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x422243
call fcn.00462b50
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x422225
call fcn.00462b50
push esi
call fcn.0045db70
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004669f0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x422203
xor ebx, ebx
jmp 0x422225
Function at 0x422250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x233
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.00462b20
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00466980
cmp byte [edi + 0xb], 0
jns 0x4222ac
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004669f0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4222e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.0049e890
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x422363
push ebx
call fcn.004b3661
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00462d80
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00427280
mov ecx, dword [ebp + 8]
push ebx
call fcn.00426280
mov ecx, ebx
call fcn.00462e80
mov ecx, edi
call fcn.00462e80
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x422390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.0049e890
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x526fa0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x42240c
cmp word [ebp - 0x214], 0
je 0x42240c
push edi
call fcn.004b3661
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00462d80
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0049b483
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00462d20
push edi
call fcn.004222e0
add esp, 4
mov ecx, esi
test al, al
jne 0x422441
push 3
push 0x527018
call fcn.00462d80
jmp 0x422447
push edi
call fcn.004261f0
lea ecx, [ebp - 0x220]
call fcn.00462e80
jmp 0x4223f6
Function at 0x422460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x541b40], 0
jne 0x422684
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2b9
push str....._base_files_file_util_win.cc
push str.GetSecureSystemTemp
push ebx
call fcn.00462b20
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00466980
cmp dword [ebp + 8], 0
je 0x422688
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
call fcn.00462d20
push esi
push 0x65
call fcn.00423cd0
add esp, 8
test al, al
je 0x42257a
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push str.SystemTemp
push ebx
call fcn.00427120
mov ecx, esi
push ebx
call fcn.00426280
mov ecx, ebx
call fcn.00462e80
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x40]
push 0x20b
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.00462b20
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.00466980
cmp byte [esi + 0xb], 0
jns 0x422561
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.004669f0
cmp esi, 0xffffffff
jne 0x42262f
lea ecx, [esp + 4]
call fcn.00462e80
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ebx, [esp + 4]
mov ecx, ebx
call fcn.00462d20
push ebx
push 0x67
call fcn.00423cd0
add esp, 8
test al, al
je 0x422622
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x20b
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.00462b20
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.00466980
cmp byte [esp + 0xf], 0
jns 0x4225f3
mov ebx, dword [esp + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.004669f0
cmp ebx, 0xffffffff
je 0x422622
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00422150
add esp, 4
test al, al
jne 0x42264d
lea ecx, [esp + 4]
call fcn.00462e80
xor ebx, ebx
jmp 0x422663
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00422150
add esp, 4
test al, al
je 0x42257a
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.00426220
mov ecx, esi
call fcn.00462e80
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.004669f0
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x42266c
int3
Function at 0x422a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x427
push str....._base_files_file_util_win.cc
push 0x527083
push ebx
call fcn.00462b20
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00466980
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.0049e890
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x422b36
push ebx
call fcn.004b3661
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.00462d80
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.00427280
mov ecx, dword [ebp + 8]
push ebx
call fcn.00426280
mov ecx, ebx
call fcn.00462e80
mov ecx, edi
call fcn.00462e80
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.004669f0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422ef0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.0049e890
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.00423320
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.004234e0
movzx eax, byte [edi + 0xb]
test al, al
js 0x422f5c
and eax, 0x7f
jmp 0x422f62
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x423062
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.0049e890
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004234a0
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x4230b9
mov ecx, ebx
call fcn.00423270
test al, al
jne 0x423066
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x422fc3
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42305e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x422fe6
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.004106c0
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004234e0
lea ecx, [ebp - 0x500]
push ebx
call fcn.00426280
mov ecx, ebx
call fcn.00462e80
movzx eax, byte [ebp - 0x4f5]
test al, al
js 0x423021
and eax, 0x7f
jmp 0x423027
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x422f72
lea ecx, [ebp - 0x500]
call fcn.00462e80
lea ecx, [ebp - 0x2a4]
call fcn.00423430
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x422fe6
xor esi, esi
jmp 0x423031
xor esi, esi
cmp byte [ebp + 8], 0
je 0x422fe6
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.00422ef0
add esp, 4
test eax, eax
jne 0x422fe4
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4230a5
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x422fe6
jmp 0x422fd2
cmp byte [ebp + 8], 0
jne 0x4230ec
lea ecx, [ebp - 0x4f4]
call fcn.00423270
test al, al
je 0x4230e6
lea ecx, [ebp - 0x4f4]
call fcn.00423270
test al, al
je 0x422fae
jmp 0x42305e
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x4230fd
lea ecx, [ebp - 0x500]
jmp 0x423103
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x422f9f
Function at 0x425240
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call fcn.00425300
mov eax, dword [esi]
mov dword [0x53ec34], eax
test al, 1
jne 0x42525c
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [0x541b64]
test eax, eax
jne 0x425271
mov ecx, dword [0x541b50]
test ecx, ecx
je 0x425293
jmp 0x4252af
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x541b64], 0
mov ecx, dword [0x541b50]
test ecx, ecx
jne 0x4252af
and byte [0x53ec34], 0xfe
push 0xc
call fcn.0049a900
add esp, 4
mov ecx, eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
mov dword [0x541b50], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4252dd
push eax
call fcn.0041fe30
cmp dword [esi + 0xc], 0
jne 0x4252d6
mov eax, dword [0x541b50]
cmp byte [eax + 0xb], 0
jns 0x4252cf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
jmp fcn.004dafc0
push str.string::assign_received_nullptr
push str.__s___nullptr
push 0xa51
push str....._third_partylibc_srcinclude_string
push str._s:_d:_assertion__s_failed:__s_n
call fcn.004c59e0
int3
Function at 0x427a90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x541b8c]
test ebx, ebx
jne 0x427b12
push 0x28
call fcn.0049a900
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.0049a900
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x427b1c
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 8], edi
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x541b8c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x427b2f
mov edi, eax
push eax
call fcn.004b3661
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00427b50
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x28
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
jmp 0x427b43
push str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
push str.__s___nullptr
push 0x109
push str....._third_partylibc_srcinclude_string_view
push str._s:_d:_assertion__s_failed:__s_n
call fcn.004c59e0
int3
Function at 0x427b50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x53d010]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea esi, [ebp - 0x20]
push 3
push ecx
push eax
push esi
call fcn.0042f410
add esp, 0x10
mov eax, dword [esi + 4]
test eax, eax
je 0x427cb0
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x800
mov dword [ebp - 0x24], 0
push eax
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
je 0x427cf5
push 0x52757e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x427bdc
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov edi, 0
mov dword [ebp - 0x28], 0
test ebx, ebx
je 0x427c4c
cmp ebx, 0x15555556
jae 0x427ced
shl ebx, 2
lea esi, [ebx + ebx*2]
push esi
call fcn.0049a900
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
add esi, eax
mov dword [ebp - 0x18], esi
xor esi, esi
xor edi, edi
mov ecx, dword [ebp - 0x28]
add ecx, esi
je 0x427cd2
mov eax, dword [ebp - 0x24]
push dword [eax + edi]
call fcn.004c45b0
add edi, 4
add esi, 0xc
cmp ebx, edi
jne 0x427c24
mov edi, dword [ebp - 0x28]
add edi, esi
mov dword [ebp - 0x1c], edi
mov esi, dword [ebp - 0x30]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
call fcn.004278a0
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x427c78
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x427cb0
cmp edi, esi
je 0x427ca7
add edi, 0xfffffff4
jmp 0x427c9b
push dword [edi]
call fcn.0049a930
add esp, 4
lea eax, [edi - 0xc]
cmp edi, esi
mov edi, eax
je 0x427ca7
test edi, edi
je 0x427cc4
cmp byte [edi + 0xb], 0
jns 0x427c92
jmp 0x427c88
push esi
call fcn.0049a930
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x44
jmp 0x427cde
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x28
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.004c59e0
lea ecx, [ebp - 0x20]
call fcn.004c45a0
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x427bd9
Function at 0x42a520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, dword [ebp + 8]
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x216]
push 0x206
push 0xff
push edi
call fcn.0049e890
add esp, 0xc
mov word [edi - 2], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
dec eax
cmp eax, 0x102
ja 0x42a5ab
cmp word [ebp + edi*2 - 0x21a], 0x5c
je 0x42a678
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x42a592
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004af4c1
add esp, 0xc
test eax, eax
je 0x42a695
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
dec eax
cmp eax, 0x102
ja 0x42a607
cmp word [ebp + edi*2 - 0x21a], 0x5c
je 0x42a684
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x42a5ee
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004af4c1
add esp, 0xc
test eax, eax
je 0x42a6bf
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
dec eax
cmp eax, 0x102
ja 0x42a65f
cmp word [ebp + edi*2 - 0x21a], 0x5c
je 0x42a690
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x42a646
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004af4c1
add esp, 0xc
test eax, eax
je 0x42a6ec
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
dec edi
jne 0x42a579
jmp 0x42a5ab
dec edi
jne 0x42a5d5
jmp 0x42a607
dec edi
jne 0x42a631
jmp 0x42a65f
movzx eax, byte [esi + 0xb]
test al, al
js 0x42a6a2
and eax, 0x7f
jmp 0x42a6a5
mov eax, dword [esi + 4]
mov bl, 1
cmp eax, edi
je 0x42a661
mov ecx, esi
push edi
call fcn.004c68e0
cmp word [eax], 0x5c
jne 0x42a5ab
jmp 0x42a661
movzx eax, byte [esi + 0xb]
test al, al
js 0x42a6cc
and eax, 0x7f
jmp 0x42a6cf
mov eax, dword [esi + 4]
mov bl, 1
cmp eax, edi
je 0x42a661
mov ecx, esi
push edi
call fcn.004c68e0
cmp word [eax], 0x5c
jne 0x42a607
jmp 0x42a661
movzx eax, byte [esi + 0xb]
test al, al
js 0x42a6f9
and eax, 0x7f
jmp 0x42a6fc
mov eax, dword [esi + 4]
mov bl, 1
cmp eax, edi
je 0x42a661
mov ecx, esi
push edi
call fcn.004c68e0
cmp word [eax], 0x5c
jne 0x42a65f
jmp 0x42a661
Function at 0x42cb00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x42cb18
cmp dword [ebp + 0x10], 0
jne 0x42cb14
call fcn.00435110
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0042c5c0

Function at 0x42d760
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x541bdc]
mov ecx, dword [0x540070]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42d7ad
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, 0x541bd8
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x541bdc
call fcn.0049a9a7
add esp, 4
cmp dword [0x541bdc], 0xffffffff
jne 0x42d793
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.0049e890
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0049a900
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x541c0c]
mov ecx, dword [0x540070]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42d856
mov ecx, esi
push ebx
push 0x541be8
push edi
call fcn.0042d950
mov dword [0x541bd8], esi
push 0x541bdc
call fcn.0049aa1d
add esp, 4
jmp 0x42d793
push 0x541c0c
call fcn.0049a9a7
add esp, 4
cmp dword [0x541c0c], 0xffffffff
jne 0x42d830
xorps xmm0, xmm0
movups xmmword [0x541bf8], xmm0
movups xmmword [0x541be8], xmm0
mov dword [0x541c08], 0
push 0x541be8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x541c0c
call fcn.0049aa1d
add esp, 4
jmp 0x42d830

Function at 0x42d8b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x541c0c]
mov ecx, dword [0x540070]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42d8e1
movzx eax, word [0x541be8]
cmp eax, 9
jne 0x42d92c
xor eax, eax
inc eax
pop ebp
ret
push 0x541c0c
call fcn.0049a9a7
add esp, 4
cmp dword [0x541c0c], 0xffffffff
jne 0x42d8d0
xorps xmm0, xmm0
movups xmmword [0x541bf8], xmm0
movups xmmword [0x541be8], xmm0
mov dword [0x541c08], 0
push 0x541be8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x541c0c
call fcn.0049aa1d
add esp, 4
jmp 0x42d8d0
test eax, eax
je 0x42d8df
cmp eax, 6
jne 0x42d93c
mov eax, 2
jmp 0x42d8df
cmp eax, 0xc
jne 0x42d948
mov eax, 3
jmp 0x42d8df
mov eax, 4
jmp 0x42d8df
Function at 0x42edf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x42eec9
cmp dword [esi], 0
jne 0x42eec9
cmp dword [esi + 0xc], 0
jne 0x42eec9
xor eax, eax
cmp dword [esi + 4], 0
jne 0x42eec9
mov ebx, dword [edi]
cmp eax, ebx
je 0x42ee53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x42ee99
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42ee49
mov dword [esi], ebx
call fcn.00462b50
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x42ee86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x42eeb0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42ee7c
mov dword [esi + 4], ebx
call fcn.00462b50
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00462b50
push dword [esi]
call fcn.0045db70
add esp, 4
mov dword [esi], 0
jmp 0x42ee3a
call fcn.00462b50
push dword [esi + 4]
call fcn.0045db70
add esp, 4
mov dword [esi + 4], 0
jmp 0x42ee6c
mov ecx, esi
call fcn.004df4a0
mov eax, dword [esi]
jmp 0x42ee24