joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x645293f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5ce350f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3eed309b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2b97c7a
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x5852de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x5852fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5852ec
add dl, dl
jne 0x585306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x585352
xor eax, eax
add dl, dl
jne 0x585313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5853ef
add dl, dl
jne 0x585322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x58532d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x585338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x585343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x58534d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x5852f2
mov eax, 1
add dl, dl
jne 0x585360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x58536b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x585357
sub eax, 2
jne 0x58539a
mov ecx, 1
add dl, dl
jne 0x585380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x58538b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x585377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5852f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x5853b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5853bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5853a8
cmp eax, 0x7d00
jae 0x5853df
cmp eax, 0x500
jb 0x5853da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5852f2
cmp eax, 0x7f
ja 0x5853e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5852f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x58540b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5852f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x4046a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46b15d
push eax
mov dword fs:[0], esp
sub esp, 0x18
call fcn.0042c9a0
test eax, eax
je 0x404788
cmp byte [ebp + 8], 0
je 0x404745
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042c720
add esp, 8
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x404755
cmp edx, 8
jb 0x404745
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40473b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404798
push edx
push ecx
call fcn.00419c67
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp edx, 8
jb 0x404788
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40477e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404798
push edx
push ecx
call fcn.00419c67
add esp, 8
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
int3
Function at 0x4068a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b2f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x3c], 0
push ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00405050
add esp, 8
cmp dword [ebp - 0x28], 8
jb 0x40690b
cmp dword [ebp - 0x3c], 0
je 0x406970
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
cmovae eax, ecx
cmp word [eax], 0
je 0x406970
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406976
cmp edx, 8
jb 0x406943
test ecx, ecx
je 0x406976
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
cmp word [eax], 0
je 0x406976
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406976
mov bl, 1
jmp 0x406978
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor bl, bl
cmp edx, 8
jb 0x4069a8
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40699e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406a03
push edx
push ecx
call fcn.00419c67
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x4069f2
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4069e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406a03
push edx
push ecx
call fcn.00419c67
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
int3
Function at 0x406a10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b2f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x3c], 0
push ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00405520
add esp, 8
cmp dword [ebp - 0x28], 8
jb 0x406a7b
cmp dword [ebp - 0x3c], 0
je 0x406ae0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
cmovae eax, ecx
cmp word [eax], 0
je 0x406ae0
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406ae6
cmp edx, 8
jb 0x406ab3
test ecx, ecx
je 0x406ae6
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
cmp word [eax], 0
je 0x406ae6
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406ae6
mov bl, 1
jmp 0x406ae8
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor bl, bl
cmp edx, 8
jb 0x406b18
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406b0e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406b73
push edx
push ecx
call fcn.00419c67
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x406b62
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406b58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406b73
push edx
push ecx
call fcn.00419c67
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
int3

Function at 0x406b80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.004059f0
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x406ba2
test ecx, ecx
je 0x406bcf
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x406bcf
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x406bcf
mov bl, 1
jmp 0x406bd1
xor bl, bl
cmp edx, 8
jb 0x406c01
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406bf7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406c08
push edx
push ecx
call fcn.00419c67
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
int3

Function at 0x407120
Capabilities:
Check if file exists

Disassembly:
call fcn.00406c10
call fcn.00406db0
jmp fcn.004068a0
Function at 0x407510
Capabilities:
Check if file exists

Disassembly:
call fcn.00407130
call fcn.00407320
jmp fcn.00406a10

Function at 0x407bc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00407520
lea eax, [ebp - 0x18]
push eax
call fcn.004059f0
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x407be6
test ecx, ecx
je 0x407c1d
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x407c1d
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407c17
lea ecx, [ebp - 0x18]
call fcn.004011d0
mov al, 1
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x407c4d
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407c43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407c53
push edx
push ecx
call fcn.00419c67
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
int3
Function at 0x4081b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b4e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov byte [ebp - 0xd], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x4083c5
cmp word [eax], 0
je 0x4083c5
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x4081f5
mov ecx, dword [esi]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ecx, eax
test ecx, ecx
je 0x4083b3
mov eax, dword [esi + 0x10]
lea ecx, [ecx + eax*2]
movzx eax, word [ecx]
mov dword [ebp - 0x14], ecx
cmp eax, 0x20
je 0x40823d
cmp eax, 9
je 0x40823d
cmp eax, 0xd
je 0x40823d
cmp eax, 0xa
je 0x40823d
test ax, ax
je 0x40823d
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
xor esi, esi
mov byte [ebp - 0xd], 1
xor ebx, ebx
mov dword [ebp - 0x20], 0
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
test edi, edi
je 0x4083b1
movzx eax, word [ecx]
cmp eax, 0x20
je 0x408279
cmp eax, 9
je 0x408279
cmp eax, 0xd
je 0x408279
cmp eax, 0xa
jne 0x40827e
add ecx, 2
jmp 0x408262
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push eax
push ecx
lea eax, [ebp - 0x38]
push eax
call fcn.00408080
add esp, 0xc
cmp dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
je 0x40830d
lea eax, [ebp - 0x38]
push eax
cmp esi, ebx
je 0x4082b3
mov ecx, esi
call fcn.00401840
add esi, 0x18
mov dword [ebp - 0x1c], esi
jmp 0x4082c2
push esi
lea ecx, [ebp - 0x20]
call fcn.00401620
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x408300
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4082f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083d6
push edx
push ecx
call fcn.00419c67
add esp, 8
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x408262
jmp 0x40834b
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x40834b
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408341
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083d6
push edx
push ecx
call fcn.00419c67
add esp, 8
lea eax, [ebp - 0x20]
cmp edi, eax
mov edi, dword [ebp - 0x20]
je 0x408362
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push esi
push edi
call fcn.00407eb0
test edi, edi
je 0x4083b1
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call fcn.004015b0
sub ebx, edi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, edi
shl ecx, 3
cmp ecx, 0x1000
jb 0x4083a7
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4083db
push ecx
push edi
call fcn.00419c67
add esp, 8
pop edi
pop ebx
mov al, byte [ebp - 0xd]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
call fcn.0043d73f
int3
Function at 0x40c6a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x18
mov ecx, dword [0x494adc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x494a18]
cmp eax, dword [ecx + 4]
jg 0x40c7ec
mov edx, dword [0x49306c]
mov ecx, dword [0x493058]
push esi
cmp edx, 8
jb 0x40c6dc
test ecx, ecx
je 0x40c707
cmp edx, 8
mov eax, 0x493058
cmovae eax, ecx
cmp word [eax], 0
je 0x40c707
cmp edx, 8
mov eax, 0x493058
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c7d7
lea eax, [ebp - 0x18]
push eax
call fcn.0040e480
mov esi, eax
add esp, 4
cmp esi, 0x493058
je 0x40c7a1
mov edx, dword [0x49306c]
cmp edx, 8
jb 0x40c761
mov ecx, dword [0x493058]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c757
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c822
push edx
push ecx
call fcn.00419c67
add esp, 8
mov dword [0x493068], 0
xor eax, eax
mov dword [0x49306c], 7
mov word [0x493058], ax
movups xmm0, xmmword [esi]
movups xmmword [0x493058], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x493068], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 4]
cmp edx, 8
jb 0x40c7d7
mov ecx, dword [ebp - 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c7cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c822
push edx
push ecx
call fcn.00419c67
add esp, 8
mov ecx, dword [ebp + 8]
push 0x493058
call fcn.00401840
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x494a18
call fcn.0041a02e
add esp, 4
cmp dword [0x494a18], 0xffffffff
jne 0x40c6c6
push 0x46dd70
call fcn.00419f07
push 0x494a18
call fcn.00419fe4
add esp, 8
jmp 0x40c6c6
call fcn.0043d73f
int3
Function at 0x40c830
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x18
mov ecx, dword [0x494adc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x494a1c]
cmp eax, dword [ecx + 4]
jg 0x40c97c
mov edx, dword [0x493084]
mov ecx, dword [0x493070]
push esi
cmp edx, 8
jb 0x40c86c
test ecx, ecx
je 0x40c897
cmp edx, 8
mov eax, 0x493070
cmovae eax, ecx
cmp word [eax], 0
je 0x40c897
cmp edx, 8
mov eax, 0x493070
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c967
lea eax, [ebp - 0x18]
push eax
call fcn.0040e720
mov esi, eax
add esp, 4
cmp esi, 0x493070
je 0x40c931
mov edx, dword [0x493084]
cmp edx, 8
jb 0x40c8f1
mov ecx, dword [0x493070]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c8e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c9b2
push edx
push ecx
call fcn.00419c67
add esp, 8
mov dword [0x493080], 0
xor eax, eax
mov dword [0x493084], 7
mov word [0x493070], ax
movups xmm0, xmmword [esi]
movups xmmword [0x493070], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x493080], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 4]
cmp edx, 8
jb 0x40c967
mov ecx, dword [ebp - 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c95d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c9b2
push edx
push ecx
call fcn.00419c67
add esp, 8
mov ecx, dword [ebp + 8]
push 0x493070
call fcn.00401840
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x494a1c
call fcn.0041a02e
add esp, 4
cmp dword [0x494a1c], 0xffffffff
jne 0x40c856
push 0x46ddd0
call fcn.00419f07
push 0x494a1c
call fcn.00419fe4
add esp, 8
jmp 0x40c856
call fcn.0043d73f
int3

Function at 0x40d440
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040c6a0
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40d462
test ecx, ecx
je 0x40d48f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x40d48f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x40d48f
mov bl, 1
jmp 0x40d491
xor bl, bl
cmp edx, 8
jb 0x40d4c1
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d4b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d4c8
push edx
push ecx
call fcn.00419c67
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
int3
Function at 0x40d4d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040c830
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40d4f2
test ecx, ecx
je 0x40d51f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x40d51f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x40d51f
mov bl, 1
jmp 0x40d521
xor bl, bl
cmp edx, 8
jb 0x40d551
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d547
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d558
push edx
push ecx
call fcn.00419c67
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d73f
int3