joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401950
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x401a44
cmp dword [ebx + 0x2000], 0
jle 0x401a44
push esi
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0043ad10
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x22c], 0x22c
mov dword [ebp + 8], esi
cmp esi, 0xffffffff
je 0x401a1f
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401a18
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x401a18
nop dword [eax]
xor edi, edi
cmp dword [ebx + 0x2000], edi
jle 0x401a05
mov esi, ebx
nop dword [eax]
test esi, esi
je 0x4019f6
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401a2a
inc edi
sub esi, 0xffffff80
cmp edi, dword [ebx + 0x2000]
jl 0x4019e0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4019d0
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404a80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46b16d
push eax
mov dword fs:[0], esp
sub esp, 0x18
call fcn.0042d3a0
test eax, eax
je 0x404b68
cmp byte [ebp + 8], 0
je 0x404b25
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042d120
add esp, 8
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x404b35
cmp edx, 8
jb 0x404b25
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404b1b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404b78
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp edx, 8
jb 0x404b68
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404b5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404b78
push edx
push ecx
call fcn.00419c57
add esp, 8
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3
Function at 0x406bf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b305
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x3c], 0
push ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004053a0
add esp, 8
cmp dword [ebp - 0x28], 8
jb 0x406c5b
cmp dword [ebp - 0x3c], 0
je 0x406cc0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
cmovae eax, ecx
cmp word [eax], 0
je 0x406cc0
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406cc6
cmp edx, 8
jb 0x406c93
test ecx, ecx
je 0x406cc6
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
cmp word [eax], 0
je 0x406cc6
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406cc6
mov bl, 1
jmp 0x406cc8
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor bl, bl
cmp edx, 8
jb 0x406cf8
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406cee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406d53
push edx
push ecx
call fcn.00419c57
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x406d42
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406d38
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406d53
push edx
push ecx
call fcn.00419c57
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3
Function at 0x406d60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b305
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x3c], 0
push ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00405870
add esp, 8
cmp dword [ebp - 0x28], 8
jb 0x406dcb
cmp dword [ebp - 0x3c], 0
je 0x406e30
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
cmovae eax, ecx
cmp word [eax], 0
je 0x406e30
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406e36
cmp edx, 8
jb 0x406e03
test ecx, ecx
je 0x406e36
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
cmp word [eax], 0
je 0x406e36
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
test eax, eax
je 0x406e36
mov bl, 1
jmp 0x406e38
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
xor bl, bl
cmp edx, 8
jb 0x406e68
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406e5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ec3
push edx
push ecx
call fcn.00419c57
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 8
jb 0x406eb2
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ea8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ec3
push edx
push ecx
call fcn.00419c57
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3

Function at 0x406ed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00405d40
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x406ef2
test ecx, ecx
je 0x406f1f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x406f1f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x406f1f
mov bl, 1
jmp 0x406f21
xor bl, bl
cmp edx, 8
jb 0x406f51
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406f47
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406f58
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3

Function at 0x407470
Capabilities:
Check if file exists

Disassembly:
call fcn.00406f60
call fcn.00407100
jmp fcn.00406bf0
Function at 0x407860
Capabilities:
Check if file exists

Disassembly:
call fcn.00407480
call fcn.00407670
jmp fcn.00406d60

Function at 0x407f10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00407870
lea eax, [ebp - 0x18]
push eax
call fcn.00405d40
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x407f36
test ecx, ecx
je 0x407f6d
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x407f6d
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407f67
lea ecx, [ebp - 0x18]
call fcn.004011d0
mov al, 1
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x407f9d
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407f93
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407fa3
push edx
push ecx
call fcn.00419c57
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3
Function at 0x408500
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b4f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov byte [ebp - 0xd], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x408715
cmp word [eax], 0
je 0x408715
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x408545
mov ecx, dword [esi]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ecx, eax
test ecx, ecx
je 0x408703
mov eax, dword [esi + 0x10]
lea ecx, [ecx + eax*2]
movzx eax, word [ecx]
mov dword [ebp - 0x14], ecx
cmp eax, 0x20
je 0x40858d
cmp eax, 9
je 0x40858d
cmp eax, 0xd
je 0x40858d
cmp eax, 0xa
je 0x40858d
test ax, ax
je 0x40858d
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
xor esi, esi
mov byte [ebp - 0xd], 1
xor ebx, ebx
mov dword [ebp - 0x20], 0
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
test edi, edi
je 0x408701
movzx eax, word [ecx]
cmp eax, 0x20
je 0x4085c9
cmp eax, 9
je 0x4085c9
cmp eax, 0xd
je 0x4085c9
cmp eax, 0xa
jne 0x4085ce
add ecx, 2
jmp 0x4085b2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push eax
push ecx
lea eax, [ebp - 0x38]
push eax
call fcn.004083d0
add esp, 0xc
cmp dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
je 0x40865d
lea eax, [ebp - 0x38]
push eax
cmp esi, ebx
je 0x408603
mov ecx, esi
call fcn.00401840
add esi, 0x18
mov dword [ebp - 0x1c], esi
jmp 0x408612
push esi
lea ecx, [ebp - 0x20]
call fcn.00401620
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x408650
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408646
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408726
push edx
push ecx
call fcn.00419c57
add esp, 8
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4085b2
jmp 0x40869b
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x40869b
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408691
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408726
push edx
push ecx
call fcn.00419c57
add esp, 8
lea eax, [ebp - 0x20]
cmp edi, eax
mov edi, dword [ebp - 0x20]
je 0x4086b2
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push esi
push edi
call fcn.00408200
test edi, edi
je 0x408701
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call fcn.004015b0
sub ebx, edi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, edi
shl ecx, 3
cmp ecx, 0x1000
jb 0x4086f7
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40872b
push ecx
push edi
call fcn.00419c57
add esp, 8
pop edi
pop ebx
mov al, byte [ebp - 0xd]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
call fcn.0043d74f
int3
Function at 0x40c8c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x18
mov ecx, dword [0x494adc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x494a18]
cmp eax, dword [ecx + 4]
jg 0x40ca0c
mov edx, dword [0x49306c]
mov ecx, dword [0x493058]
push esi
cmp edx, 8
jb 0x40c8fc
test ecx, ecx
je 0x40c927
cmp edx, 8
mov eax, 0x493058
cmovae eax, ecx
cmp word [eax], 0
je 0x40c927
cmp edx, 8
mov eax, 0x493058
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c9f7
lea eax, [ebp - 0x18]
push eax
call fcn.0040e6a0
mov esi, eax
add esp, 4
cmp esi, 0x493058
je 0x40c9c1
mov edx, dword [0x49306c]
cmp edx, 8
jb 0x40c981
mov ecx, dword [0x493058]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c977
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ca42
push edx
push ecx
call fcn.00419c57
add esp, 8
mov dword [0x493068], 0
xor eax, eax
mov dword [0x49306c], 7
mov word [0x493058], ax
movups xmm0, xmmword [esi]
movups xmmword [0x493058], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x493068], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 4]
cmp edx, 8
jb 0x40c9f7
mov ecx, dword [ebp - 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c9ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ca42
push edx
push ecx
call fcn.00419c57
add esp, 8
mov ecx, dword [ebp + 8]
push 0x493058
call fcn.00401840
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x494a18
call fcn.0041a01b
add esp, 4
cmp dword [0x494a18], 0xffffffff
jne 0x40c8e6
push 0x46dd80
call fcn.00419ef7
push 0x494a18
call fcn.00419fd1
add esp, 8
jmp 0x40c8e6
call fcn.0043d74f
int3
Function at 0x40ca50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x18
mov ecx, dword [0x494adc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x494a1c]
cmp eax, dword [ecx + 4]
jg 0x40cb9c
mov edx, dword [0x493084]
mov ecx, dword [0x493070]
push esi
cmp edx, 8
jb 0x40ca8c
test ecx, ecx
je 0x40cab7
cmp edx, 8
mov eax, 0x493070
cmovae eax, ecx
cmp word [eax], 0
je 0x40cab7
cmp edx, 8
mov eax, 0x493070
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cb87
lea eax, [ebp - 0x18]
push eax
call fcn.0040e940
mov esi, eax
add esp, 4
cmp esi, 0x493070
je 0x40cb51
mov edx, dword [0x493084]
cmp edx, 8
jb 0x40cb11
mov ecx, dword [0x493070]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40cb07
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cbd2
push edx
push ecx
call fcn.00419c57
add esp, 8
mov dword [0x493080], 0
xor eax, eax
mov dword [0x493084], 7
mov word [0x493070], ax
movups xmm0, xmmword [esi]
movups xmmword [0x493070], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x493080], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 4]
cmp edx, 8
jb 0x40cb87
mov ecx, dword [ebp - 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40cb7d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cbd2
push edx
push ecx
call fcn.00419c57
add esp, 8
mov ecx, dword [ebp + 8]
push 0x493070
call fcn.00401840
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
push 0x494a1c
call fcn.0041a01b
add esp, 4
cmp dword [0x494a1c], 0xffffffff
jne 0x40ca76
push 0x46dde0
call fcn.00419ef7
push 0x494a1c
call fcn.00419fd1
add esp, 8
jmp 0x40ca76
call fcn.0043d74f
int3

Function at 0x40d660
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040c8c0
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40d682
test ecx, ecx
je 0x40d6af
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x40d6af
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x40d6af
mov bl, 1
jmp 0x40d6b1
xor bl, bl
cmp edx, 8
jb 0x40d6e1
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d6d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d6e8
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3
Function at 0x40d6f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040ca50
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x40d712
test ecx, ecx
je 0x40d73f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x40d73f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x40d73f
mov bl, 1
jmp 0x40d741
xor bl, bl
cmp edx, 8
jb 0x40d771
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d767
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d778
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3
Function at 0x4101e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040ebe0
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x410202
test ecx, ecx
je 0x41022f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x41022f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x41022f
mov bl, 1
jmp 0x410231
xor bl, bl
cmp edx, 8
jb 0x410261
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410257
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410268
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3

Function at 0x410270
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040ee20
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x410292
test ecx, ecx
je 0x4102bf
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x4102bf
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x4102bf
mov bl, 1
jmp 0x4102c1
xor bl, bl
cmp edx, 8
jb 0x4102f1
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4102e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4102f8
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3

Function at 0x410300
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040f060
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x410322
test ecx, ecx
je 0x41034f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x41034f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x41034f
mov bl, 1
jmp 0x410351
xor bl, bl
cmp edx, 8
jb 0x410381
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410377
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410388
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3
Function at 0x410390
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040f4e0
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4103b2
test ecx, ecx
je 0x4103df
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x4103df
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x4103df
mov bl, 1
jmp 0x4103e1
xor bl, bl
cmp edx, 8
jb 0x410411
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410407
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410418
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3

Function at 0x410420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040f720
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x410442
test ecx, ecx
je 0x41046f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x41046f
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x41046f
mov bl, 1
jmp 0x410471
xor bl, bl
cmp edx, 8
jb 0x4104a1
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410497
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4104a8
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3

Function at 0x4104b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0040f960
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4104d2
test ecx, ecx
je 0x4104ff
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
cmp word [eax], 0
je 0x4104ff
cmp edx, 8
lea eax, [ebp - 0x18]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x4104ff
mov bl, 1
jmp 0x410501
xor bl, bl
cmp edx, 8
jb 0x410531
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410527
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410538
push edx
push ecx
call fcn.00419c57
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043d74f
int3