joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402178
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x4021c6
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4021a0
cmp edx, 1
je 0x4021e7
cmp edx, 2
je 0x4021de
cmp edx, 3
jne 0x4021f2
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x405d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0047d9dd
add esp, 0x10
cmp eax, esi
jne 0x405df0
cmp ebx, 1
je 0x405d99
cmp ebx, 2
mov esi, 0xffffffff
je 0x405df3
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.0047cab3
add esp, 4
neg eax
sbb esi, esi
jmp 0x405df3
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d81
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x405e34
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.0047d9dd
add esp, 0x14
jmp 0x405e63
test esi, esi
jle 0x405e5c
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x405e5e
inc edi
cmp esi, edi
mov eax, ebx
jne 0x405e3d
mov edi, esi
jmp 0x405e5e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x405e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0xffffffff
je 0x405eb3
mov esi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x405ecb
xor edi, edi
inc edi
lea eax, [ebp - 0x19]
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.0047d9dd
add esp, 0x10
cmp eax, edi
je 0x405eb5
xor ebx, ebx
dec ebx
jmp 0x405eb5
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d81
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea ebx, [ebp - 0x19]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x405eae
mov edi, eax
cmp eax, 3
je 0x405f2c
cmp edi, 1
ja 0x405eae
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.0047d9dd
add esp, 0x10
cmp eax, ebx
jne 0x405eae
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x405ed6
jmp 0x405f45
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.0047d9dd
add esp, 0x10
cmp eax, edi
jne 0x405eae
mov ebx, dword [ebp + 8]
jmp 0x405eb5

Function at 0x405f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x405fa4
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.0047d9dd
add esp, 0x14
jmp 0x405fd4
test esi, esi
jle 0x405fcd
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x405fcf
inc edi
cmp esi, edi
mov eax, ebx
jne 0x405fad
mov edi, esi
jmp 0x405fcf
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x405fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp si, 0xffff
je 0x406026
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x40603e
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.0047d9dd
add esp, 0x10
cmp eax, 1
je 0x406028
xor esi, esi
dec esi
jmp 0x406028
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d81
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x406021
mov ebx, eax
cmp eax, 3
je 0x40609f
cmp ebx, 1
ja 0x406021
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0047d9dd
add esp, 0x10
cmp eax, esi
jne 0x406021
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x406049
jmp 0x4060b8
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.0047d9dd
add esp, 0x10
cmp eax, ebx
jne 0x406021
movzx esi, word [ebp + 8]
jmp 0x406028

Function at 0x406250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x40627f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x406261
pop esi
pop edi
pop ebp
ret 8

Function at 0x406390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x4063c1
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x4063a1
pop esi
pop edi
pop ebp
ret 8
Function at 0x40f924
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004185e4
mov ebx, eax
test esi, esi
je 0x40f95d
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x40f94a
movzx eax, word [eax]
jmp 0x40f951
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x40f95d
test bl, bl
jne 0x40f963
jmp 0x40f9c0
xor esi, esi
test bl, bl
jne 0x40f9b1
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x40f972
movzx eax, word [eax]
jmp 0x40f977
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x40f9a2
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x40f99b
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x40f930
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x40f930
mov ecx, edi
call fcn.004185e4
mov ebx, eax
test esi, esi
jne 0x40f9c9
jmp 0x40f9ba
mov ecx, edi
call fcn.004185e4
mov ebx, eax
test bl, bl
jne 0x40f9e8
jmp 0x40f9ee
mov ecx, edi
call fcn.004185e4
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x40f9d6
movzx eax, word [eax]
jmp 0x40f9dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x40f9ee
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x41b640
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [0x4c8608]
test edi, edi
jne 0x41b6e6
push 0x24
call fcn.00468d16
add esp, 4
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
push 0xc
call fcn.00468d16
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x4c8608], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
test eax, eax
je 0x41b6dd
cmp word [eax], 0
je 0x41b6dd
xor ecx, ecx
nop dword [eax + eax]
lea edx, [ecx + 1]
cmp word [eax + ecx*2 + 2], 0
mov ecx, edx
jne 0x41b6d0
mov ecx, esi
push edx
push eax
call fcn.0041b6f0
test edi, edi
sete al
pop esi
pop edi
pop ebp
ret
Function at 0x41b6f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x4c6f50]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.004233d0
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41b8eb
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x41b76a
push 0x49574a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41b779
mov ecx, eax
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x41b775
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
jmp 0x41b77b
xor esi, esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test eax, eax
je 0x41b881
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
cmp eax, 0x15555556
jae 0x41b90b
shl eax, 2
mov dword [ebp - 0x30], eax
lea esi, [eax + eax*2]
push esi
call fcn.00468d16
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
add eax, esi
mov dword [ebp - 0x18], eax
xor eax, eax
mov esi, dword [ebp - 0x24]
jmp 0x41b815
mov byte [edi + 0xb], bl
mov eax, edi
test ebx, ebx
je 0x41b801
mov ecx, ebx
add ecx, ebx
push ecx
push dword [ebp - 0x34]
push eax
mov esi, eax
call fcn.0046c040
mov eax, esi
mov esi, dword [ebp - 0x24]
add esp, 0xc
mov word [eax + ebx*2], 0
add edi, 0xc
mov eax, dword [ebp - 0x38]
add eax, 4
cmp dword [ebp - 0x30], eax
je 0x41b878
mov dword [ebp - 0x38], eax
mov eax, dword [esi + eax]
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
mov dword [ebp - 0x34], eax
push eax
call fcn.0047f79d
add esp, 4
cmp eax, 0x7ffffff0
jae 0x41b8ff
mov ebx, eax
cmp eax, 5
jb 0x41b7e0
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x41b906
lea eax, [esi + esi]
push eax
call fcn.00468d16
add esp, 4
mov dword [edi], eax
or esi, 0x80000000
mov dword [edi + 8], esi
mov dword [edi + 4], ebx
jmp 0x41b7e9
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x28]
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.0041b4b0
mov dword [edi], 0
mov dword [edi + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41b8ab
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x41b8eb
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jne 0x41b8c6
mov eax, esi
jmp 0x41b8df
mov eax, edi
cmp esi, edi
je 0x41b8dc
lea edi, [eax - 0xc]
cmp byte [eax - 1], 0
jns 0x41b8c0
push dword [eax - 0xc]
call fcn.00468d46
add esp, 4
jmp 0x41b8c0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
push eax
call fcn.00468d46
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d81
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, edi
call fcn.00419244
call fcn.004790d4
lea ecx, [ebp - 0x20]
call fcn.0041ab5c
int3
Function at 0x41c910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, ecx
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x1c], edx
movzx ecx, byte [0x4c860c]
xor ecx, 3
xor eax, eax
mov dword [esp + 0x10], ecx
mov ebx, dword [eax*8 + 0x4956d8]
mov dword [esp + 0x14], eax
mov eax, dword [eax*8 + 0x4956d4]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x2b], bl
lea ecx, [ebx + ebx]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0046c040
add esp, 0xc
mov word [esp + ebx*2 + 0x20], 0
movzx eax, byte [esp + 0x2b]
test al, al
mov ecx, dword [esp + 0x24]
mov edx, eax
mov dword [esp + 0xc], ecx
cmovs edx, ecx
cmp edx, dword [esp + 8]
jbe 0x41c9b0
test al, al
js 0x41c9f0
mov ecx, dword [esp + 0x10]
jmp 0x41ca06
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
test edx, edx
je 0x41ca1a
test al, al
lea esi, [esp + 0x20]
cmovs esi, dword [esp + 4]
xor ebx, ebx
nop dword [eax]
movzx ecx, word [edi + ebx*2]
cmp cx, word [esi + ebx*2]
jne 0x41c9a6
add ebx, 1
cmp edx, ebx
jne 0x41c9d0
jmp 0x41ca1a
push dword [esp + 0x20]
call fcn.00468d46
add esp, 4
movzx ecx, byte [0x4c860c]
xor ecx, 3
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, ecx
jb 0x41c941
jmp 0x41caa6
test al, al
js 0x41ca28
mov ecx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x41ca3e
push dword [esp + 4]
call fcn.00468d46
add esp, 4
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
xor ebx, ebx
test ecx, ecx
je 0x41caac
cmp ecx, dword [esp + 8]
je 0x41caac
lea eax, [esp + 0x18]
push 0
push 0x49578c
push eax
mov ebx, ecx
call fcn.00421ac0
mov edx, ebx
add esp, 0xc
sub eax, ebx
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
cmovb edx, ecx
sub ecx, edx
cmp ecx, eax
cmovae ecx, eax
cmp ecx, esi
jne 0x41caa6
test esi, esi
je 0x41caaa
add edx, edx
add edx, dword [esp + 0x18]
xor eax, eax
nop word cs:[eax + eax]
nop
movzx ecx, word [edx + eax*2]
cmp cx, word [edi + eax*2]
sete bl
jne 0x41caac
add eax, 1
cmp esi, eax
jne 0x41ca90
jmp 0x41caac
xor ebx, ebx
jmp 0x41caac
mov bl, 1
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00468d81
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41f660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [esp + 0xa8], eax
test ecx, ecx
je 0x41f69f
cmp byte [ecx + 0xb], 0
js 0x41f693
mov byte [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x41f69f
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
push 0
push 0
mov edi, dword [ebp + 8]
push edi
call fcn.0047d1aa
add esp, 0xc
lea esi, [esp + 0x20]
push 0x9e
push str..._.._base_files_file_util.cc
push str.ReadStreamToStringWithMaxSize
push esi
call fcn.0041fa10
add esp, 0x10
lea ecx, [esp + 0x60]
push 0
push esi
call fcn.004248f0
xorps xmm0, xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x50], 0
push edi
call fcn.00476ad0
add esp, 4
push eax
call fcn.00476b2a
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor esi, esi
test eax, eax
je 0x41f73a
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
xor eax, eax
mov edi, edx
neg edi
mov edi, 0
sbb edi, ecx
cmovl eax, ecx
mov ebx, 0xffff
cmovl ebx, edx
jmp 0x41f741
mov ebx, 0xffff
xor eax, eax
mov edx, dword [ebp + 0xc]
cmp edx, ebx
mov ecx, 0
sbb ecx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
cmovb ebx, edx
add ebx, 1
lea edi, [esp + 0x10]
mov ecx, edi
push 0
push ebx
call fcn.0041945c
cmp byte [esp + 0x1b], 0
jns 0x41f784
mov edi, dword [esp + 0x10]
push dword [ebp + 8]
push ebx
push 1
push edi
call fcn.0047cfa7
add esp, 0x10
test eax, eax
je 0x41f7f5
xor esi, esi
lea edi, [esp + 0x10]
jmp 0x41f7b5
add eax, esi
push dword [ebp + 8]
push ebx
push 1
push eax
call fcn.0047cfa7
add esp, 0x10
test eax, eax
je 0x41f7f5
mov ecx, dword [ebp + 0xc]
sub ecx, esi
cmp ecx, eax
jb 0x41f80b
test esi, esi
mov ecx, 0x10000
cmove ebx, ecx
add esi, eax
push dword [ebp + 8]
call fcn.0047ca5b
add esp, 4
test eax, eax
jne 0x41f7f5
lea eax, [esi + ebx]
mov ecx, edi
push 0
push eax
call fcn.0041945c
cmp byte [esp + 0x1b], 0
mov eax, edi
jns 0x41f7a0
mov eax, dword [esp + 0x10]
jmp 0x41f7a0
push dword [ebp + 8]
call fcn.0047ca87
add esp, 4
test eax, eax
sete bl
mov dword [esp + 0xc], esi
jmp 0x41f80d
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41f861
mov eax, dword [ecx + 8]
mov dword [esp + 0xa0], eax
movsd xmm0, qword [ecx]
movsd qword [esp + 0x98], xmm0
mov eax, dword [esp + 0x18]
mov dword [ecx + 8], eax
movsd xmm0, qword [esp + 0x10]
movsd qword [ecx], xmm0
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x18], eax
movsd xmm0, qword [esp + 0x98]
movsd qword [esp + 0x10], xmm0
push 0
push dword [esp + 0x10]
call fcn.0041945c
cmp byte [esp + 0x1b], 0
jns 0x41f874
push dword [esp + 0x10]
call fcn.00468d46
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00424a10
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.00468d81
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41fa50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.0041b920
mov esi, eax
mov ecx, eax
push 0x497150
call fcn.0041bd40
test al, al
jne 0x41fa8e
mov ecx, esi
push str.vmodule
call fcn.0041bd40
test al, al
je 0x41fb20
cmp dword [0x4c8610], 0
jne 0x41fbeb
mov eax, dword [0x4c8614]
mov dword [0x4c8610], eax
push 0x10
call fcn.00468d16
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], str.vmodule
push str.vmodule
call fcn.0047ee90
add esp, 4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push edx
call fcn.0041bdb0
mov dword [ebp - 0x38], 0x497150
push 0x497150
call fcn.0047ee90
add esp, 4
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
lea ebx, [ebp - 0x30]
mov ecx, esi
push eax
push ebx
call fcn.0041bdb0
mov ecx, edi
push 0x4c8618
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.0042d6d0
mov dword [0x4c8614], edi
cmp byte [ebp - 0x25], 0
js 0x41fb61
cmp byte [ebp - 0x11], 0
js 0x41fb72
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x4c6100], eax
mov bl, 1
test al, 1
je 0x41fbd7
mov eax, dword [0x4c862c]
test eax, eax
je 0x41fb7f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c862c], 0
mov ecx, dword [0x4c861c]
test ecx, ecx
jne 0x41fbae
and byte [0x4c6100], 0xfe
jmp 0x41fb89
push dword [ebp - 0x30]
call fcn.00468d46
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x41fb20
push dword [ebp - 0x1c]
call fcn.00468d46
add esp, 4
jmp 0x41fb20
mov ecx, dword [0x4c861c]
test ecx, ecx
jne 0x41fbae
push 0xc
call fcn.00468d16
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x4c861c], eax
push dword [esi + 4]
call fcn.0041a336
cmp dword [esi + 0xc], 0
jne 0x41fbd0
mov eax, dword [0x4c861c]
cmp byte [eax + 0xb], 0
jns 0x41fbc9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0041fbf0
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d81
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x41fbf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x4c6f50]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x4c862c], 0
jne 0x41fe1a
mov esi, dword [0x4c861c]
test esi, esi
je 0x41fc31
test byte [0x4c6100], 1
jne 0x41fd18
jmp 0x41fe1a
push 0xc
call fcn.00468d16
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push edi
call fcn.0047f79d
add esp, 4
cmp eax, 0x7ffffff0
jae 0x41fe31
mov ebx, eax
cmp eax, 5
jae 0x41fc8b
mov byte [esi + 0xb], bl
mov eax, esi
test ebx, ebx
jne 0x41fcb7
jmp 0x41fcca
lea edi, [ebx + 8]
and edi, 0xfffffff8
js 0x41fe38
lea eax, [edi + edi]
push eax
call fcn.00468d16
add esp, 4
mov dword [esi], eax
or edi, 0x80000000
mov dword [esi + 8], edi
mov dword [esi + 4], ebx
lea edi, [ebp - 0x218]
mov ecx, ebx
add ecx, ebx
push ecx
push edi
push eax
mov edi, eax
call fcn.0046c040
mov eax, edi
add esp, 0xc
mov word [eax + ebx*2], 0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x41fcdb
mov eax, dword [esi + 4]
mov ecx, esi
push eax
push 0x5c
call fcn.0041a62e
cmp eax, 0xffffffff
mov bl, 1
je 0x41fcf9
add eax, 1
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.0041a550
mov ecx, esi
push 0x495900
call fcn.0041a1b2
mov dword [0x4c861c], esi
test byte [0x4c6100], 1
je 0x41fe1a
cmp byte [esi + 0xb], 0
jns 0x41fd20
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x495870]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4c862c], eax
add eax, 1
cmp eax, 1
ja 0x41fe1a
mov word [ebp - 0x218], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x41fe18
cmp eax, 0x104
ja 0x41fe18
mov ecx, dword [0x4c861c]
push esi
call fcn.0041a336
mov ecx, dword [0x4c861c]
movzx eax, byte [ecx + 0xb]
test al, al
js 0x41fda5
mov edx, ecx
jmp 0x41fdaa
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x41fdc2
push 0x4958fc
call fcn.0041a1b2
mov ecx, dword [0x4c861c]
push 0x495900
call fcn.0041a1b2
mov eax, dword [0x4c861c]
cmp byte [eax + 0xb], 0
jns 0x41fdd9
mov eax, dword [eax]
movaps xmm0, xmmword [0x495870]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4c862c], eax
add eax, 1
cmp eax, 1
ja 0x41fe1a
mov dword [0x4c862c], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d81
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00419244
call fcn.004790d4
int3