joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432720
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5470dd
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x432865
mov ecx, edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432761
sub ecx, edx
push ebx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.0041ffd0
cmp dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
sete bl
cmp edx, 8
jb 0x4327bc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4327b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432880
push edx
push ecx
call fcn.004b9160
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
test bl, bl
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
pop ebx
je 0x4327df
push str.Attempt_to_delete_an_empty_key
jmp 0x43286a
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jle 0x4327f7
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x432856
cmp byte [0x5cc2dc], 0
je 0x432856
push esi
push 0
push eax
mov dword [ebp + 0xc], 0x75d3dc
lea eax, [ebp - 0x10]
mov esi, dword [ebp + 0xc]
push eax
sub esi, 0x203fa0
call fcn.004359c0
push dword [eax]
movzx eax, word [0x5cc2dc]
push edi
push esi
push eax
mov dword [ebp - 4], 0
call fcn.004bad80
mov edx, dword [ebp - 0x10]
add esp, 0x1c
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
pop esi
test eax, eax
jg 0x432856
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.Attempt_to_delete_a_null_key
lea ecx, [ebp - 0x1c]
call fcn.00415fb0
push 0x5bd8e4
lea eax, [ebp - 0x1c]
push eax
call fcn.00518295
call fcn.0051bb5f
int3
Function at 0x432eb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5471ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x80
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432f1d
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x432f05
cmp eax, 2
jne 0x432f1d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x432f2d
test al, 1
jne 0x432f1d
shr eax, 1
cmp word [ebp + eax*2 - 0xc6], 0
je 0x432f36
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 0xc4], ax
xor eax, eax
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
lea edx, [ecx + 2]
mov word [ebp - 0x2c], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432f60
sub ecx, edx
lea eax, [ebp - 0xc4]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ffd0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004b9890
mov ecx, dword [ebp + 0x10]
add esp, 8
push eax
call fcn.00417170
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jb 0x432fcf
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x432fc5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433027
push edx
push ecx
call fcn.004b9160
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 8
jb 0x433017
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43300d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433027
push edx
push ecx
call fcn.004b9160
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0051bb5f
int3
Function at 0x4345f0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 8]
push 0xffffffffffffffff
push 0x5473d5
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
test edx, edx
je 0x4347a8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4347a8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434630
sub ecx, edi
sar ecx, 1
je 0x4347a8
mov ecx, esi
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434650
sub ecx, edi
sar ecx, 1
je 0x4347a8
push ebx
push esi
push edx
lea eax, [ebp - 0x24]
push 0x5594a4
push eax
call fcn.004b99e0
add esp, 0x10
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x434755
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x434755
cmp byte [0x5cc2e0], 0
je 0x434738
mov dword [ebp + 8], 0x7c204c
lea eax, [ebp - 0x3c]
mov esi, dword [ebp + 8]
push eax
sub esi, 0x268b70
call fcn.004351f0
add esp, 4
mov ecx, eax
cmp dword [ecx + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4346e0
mov ecx, dword [ecx]
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push ecx
cmovae eax, dword [ebp - 0x24]
push eax
movzx eax, word [0x5cc2e0]
push esi
push eax
call fcn.004bad80
mov edx, dword [ebp - 0x28]
add esp, 0x10
cmp edx, 8
jb 0x434738
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43472e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4347e5
push edx
push ecx
call fcn.004b9160
add esp, 8
lea ecx, [ebp - 0x24]
xor bl, bl
call fcn.00416700
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp byte [0x5cc2dc], 0
je 0x43478b
mov dword [ebp + 8], 0x7b5b90
lea eax, [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub ecx, 0x25c6e0
cmp dword [ebp - 0x10], 8
cmovae eax, dword [ebp - 0x24]
push eax
movzx eax, word [0x5cc2dc]
push ecx
push eax
call fcn.004bad80
add esp, 0xc
lea ecx, [ebp - 0x24]
mov bl, 1
call fcn.00416700
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp byte [0x5cc2e0], 0
je 0x4347d3
mov dword [ebp + 8], 0x7a4818
mov eax, dword [ebp + 8]
sub eax, 0x24b3b0
push 0
push eax
movzx eax, word [0x5cc2e0]
push eax
call fcn.004babc0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0051bb5f
int3
Function at 0x4347f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x547405
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp byte [0x5cc2dc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
je 0x43483a
mov dword [ebp - 0x10], 0xc14430
mov eax, dword [ebp - 0x10]
sub eax, 0x6ba610
push esi
push eax
movzx eax, word [0x5cc2dc]
push eax
call fcn.004bad80
add esp, 0xc
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push 6
push eax
call fcn.0042fb90
add esp, 0x14
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
je 0x434918
mov byte [ebp - 4], 1
call fcn.00413290
mov ecx, eax
test ecx, ecx
je 0x434962
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push esi
cmovae eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push str._s_s.lnk
push eax
call fcn.00432890
mov esi, dword [ebp - 0x10]
push esi
call fcn.0042e210
add esp, 0x14
test al, al
je 0x434900
cmp byte [0x5cc2dc], 0
je 0x4348d9
mov dword [ebp - 0x14], 0xc2cd50
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
sub eax, 0x6d2f30
push esi
push eax
movzx eax, word [0x5cc2dc]
push eax
call fcn.004bad80
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
sete bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43491a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x43491a
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x434918
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor bl, bl
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x434950
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x434946
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43496c
push edx
push ecx
call fcn.004b9160
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004178c0
call fcn.0051bb5f
int3
Function at 0x434980
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x547435
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp byte [0x5cc2dc], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x4349c9
mov dword [ebp - 0x10], 0xc42f4c
mov eax, dword [ebp - 0x10]
sub eax, 0x6e9100
push esi
push eax
movzx eax, word [0x5cc2dc]
push eax
call fcn.004bad80
add esp, 0xc
movzx eax, byte [ebp + 8]
push 1
push 0
xor eax, 1
add eax, 3
push 0
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042fb90
add esp, 0x14
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x434a90
mov byte [ebp - 4], 1
call fcn.00413290
mov ecx, eax
test ecx, ecx
je 0x434ad5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push str._s_s.lnk
push eax
call fcn.00432890
mov esi, dword [ebp + 8]
push esi
call fcn.0042e210
add esp, 0x14
test al, al
je 0x434a78
cmp byte [0x5cc2dc], 0
je 0x434a71
mov dword [ebp - 0x10], 0xc6070c
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
sub eax, 0x7068c0
push esi
push eax
movzx eax, word [0x5cc2dc]
push eax
call fcn.004bad80
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x434a90
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
pop esi
cmp edx, 8
jb 0x434ac7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x434abd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434adf
push edx
push ecx
call fcn.004b9160
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004178c0
call fcn.0051bb5f
int3
Function at 0x435000
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea eax, [ebp - 0x28]
push eax
call fcn.00435e80
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x435027
mov eax, dword [eax]
push dword [ebp - 0x10]
push eax
push str._sRBX__08X
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.00437ef0
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 8
jb 0x43507e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x435074
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43512c
push edx
push ecx
call fcn.004b9160
add esp, 8
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4350be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4350be
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push eax
push str._s_s
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.00437ef0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x438]
add esp, 0x14
lea edx, [ecx + 2]
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435107
sub ecx, edx
lea eax, [ebp - 0x438]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0041ffd0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0051bb5f
int3

Function at 0x435e80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x20c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x435eea
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
xor eax, eax
lea edx, [ecx + 2]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435ec5
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0041ffd0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push str.GetTempPath_in_simple_logger::getTempFileName_failed
lea ecx, [ebp - 0xc]
call fcn.00415fb0
push 0x5bd8e4
lea eax, [ebp - 0xc]
push eax
call fcn.00518295
int3
Function at 0x436ac0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 3
mov eax, dword [edi]
push 0
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, 0xffffffff
jne 0x436afd
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [edi]
mov ebx, eax
mov eax, dword [edi + 4]
mov ecx, eax
sub ecx, edx
mov dword [ebp + 0xc], eax
cmp ebx, ecx
jae 0x436b1e
lea eax, [edx + ebx]
jmp 0x436b51
jbe 0x436b54
mov eax, dword [edi + 8]
sub eax, edx
cmp ebx, eax
jbe 0x436b37
lea eax, [ebp + 0xf]
mov ecx, edi
push eax
push ebx
call fcn.00431960
jmp 0x436b54
mov esi, ebx
sub esi, ecx
push esi
push 0
push dword [ebp + 0xc]
call fcn.00518890
mov eax, dword [ebp + 0xc]
add esp, 0xc
add eax, esi
mov esi, dword [ebp - 4]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 8]
push eax
push ebx
push dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x436b80
cmp dword [ebp - 8], ebx
jne 0x436b80
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
xor bl, bl
push esi
mov dword [edi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437b10
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54786d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push edi
push 1
push esi
push eax
call fcn.00436ba0
add esp, 0xc
mov edi, dword [ebp + 8]
push 0
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x437cdd
cmp byte [0x5cc2e0], al
je 0x437bf6
mov dword [ebp - 0x10], 0x829474
lea eax, [ebp - 0x40]
mov ebx, dword [ebp - 0x10]
push eax
sub ebx, 0x2cfe90
call fcn.004351f0
add esp, 4
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 1
jb 0x437b90
mov eax, dword [eax]
push eax
movzx eax, word [0x5cc2e0]
push esi
push edi
push ebx
push eax
call fcn.004bad80
mov edx, dword [ebp - 0x2c]
add esp, 0x14
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x437be2
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437bd8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x437d36
push edx
push ecx
call fcn.004b9160
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp dword [ebp - 0x18], 0
je 0x437cd9
cmp byte [0x5cc2dc], 0
je 0x437c37
mov dword [ebp - 0x10], 0x830a9c
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
sub ecx, 0x2d7480
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push eax
movzx eax, word [0x5cc2dc]
push ecx
push eax
call fcn.004bad80
add esp, 0x10
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x437cd9
cmp byte [0x5cc2dc], al
je 0x437cd9
mov dword [ebp - 0x10], 0x83a810
lea eax, [ebp - 0x58]
mov edi, dword [ebp - 0x10]
push eax
sub edi, 0x2e11c0
call fcn.004351f0
add esp, 4
mov ecx, eax
cmp dword [ecx + 0x14], 8
mov byte [ebp - 4], 2
jb 0x437c84
mov ecx, dword [ecx]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push esi
push eax
movzx eax, word [0x5cc2dc]
push edi
push eax
call fcn.004bad80
mov edx, dword [ebp - 0x44]
add esp, 0x14
cmp edx, 8
jb 0x437cd9
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437ccf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x437d3b
push edx
push ecx
call fcn.004b9160
add esp, 8
xor bl, bl
jmp 0x437ced
push str.:Zone.Identifier:_DATA
push esi
call fcn.004345f0
add esp, 8
mov bl, al
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x437d23
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437d19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x437d40
push edx
push ecx
call fcn.004b9160
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0051bb5f
call fcn.0051bb5f
call fcn.0051bb5f
int3
Function at 0x438140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x43815e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x438184
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x438170
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00413a90
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4381a4
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x438610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp edx, eax
je 0x43878c
cmp dword [edx + 0x1c], 0x10
lea ecx, [ebx + 4]
mov eax, dword [ecx]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ebx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], ecx
jb 0x438653
mov edi, dword [edi]
xor edx, edx
mov ebx, 0x811c9dc5
test eax, eax
je 0x438674
mov ecx, eax
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x438660
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, ebx
lea eax, [edx + eax*8]
mov edx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.00414180
push 0x60
push edi
call fcn.004b9160
mov ecx, dword [ebp - 4]
add esp, 0x10
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x4386df
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x438690
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x438782
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x4386f1
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x4386f4
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x438782
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x438710
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x438731
nop dword [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x438720
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
nop dword [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.00414180
push 0x60
push edi
call fcn.004b9160
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp + 0xc]
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x438793
cmp esi, eax
jne 0x438750
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x438702
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x439b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x547a55
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x439b3d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x439b62
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x439b50
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00413a90
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x439b92
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x439cfc
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.004b9130
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004152a0
mov dword [edi + 0x20], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x557d40]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x557d40]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x439c9b
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.005243c0
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.00514240
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x439c7f
cmp eax, 0x200
jae 0x439c7d
shl eax, 3
cmp eax, ecx
jae 0x439c7f
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0041f380
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00413a90
mov edx, dword [eax]
jmp 0x439c9e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x439cca
mov dword [ecx + eax*8], edi
jmp 0x439cdc
cmp esi, edx
jne 0x439cd3
mov dword [ecx + eax*8], edi
jmp 0x439ce0
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x439ce0
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00515695
int3