joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471b30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x471b63
push esi
call fcn.0047fef0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x471b5c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x471be9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x471bd2
mov eax, dword [esi + 8]
test eax, eax
je 0x471b87
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x471bce
cmp eax, 2
je 0x471bd2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x471b7a
cmp eax, 3
je 0x471bad
cmp eax, 1
jne 0x471b7a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x471b7a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x471b7a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00471c10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x471bf8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00471c10
add esp, 4
pop esi
ret

Function at 0x472490
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4724b1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4724b1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4724b1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x48cae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x48cb46
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x48cb46
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x48cb27
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x48ced0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x48cf08
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x48db30
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x48db79
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x48dff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8f00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0048dba0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0048dc20
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0048dc20
lea ecx, [esi + 0xc]
call fcn.004aa8d1
lea ecx, [esi + 0x10]
call fcn.004aa8d1
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0048f1b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0048f1b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0048f1b0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004aa946
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004aa946
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4accfd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4acd35
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004aada1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004aad79
jmp 0x4acd41
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ae3ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ae431
call fcn.004b402e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4ae431
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4ae428
xor eax, eax
jmp 0x4ae439
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ae43f
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b455e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b458c
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4b45aa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b44c4
jmp 0x4b45aa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b45aa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b44c4
test edi, edi
mov eax, edi
jne 0x4b4594
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x406e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e6d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
cmp dword [ebp - 0x10], 0
jne 0x406e82
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x406f32
cmp dword [ebp - 0x10], 0x70000000
jb 0x406e90
call fcn.00405874
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call int.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406e36
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406ee0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406eeb
dec esi
test esi, esi
je 0x406ef9
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406eea
cmp dword [ebp - 0xc], 7
jne 0x406f04
test esi, esi
je 0x406f04
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x406f25
test esi, esi
je 0x406f25
lea eax, [ebp - 0x14]
call int.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f4f
lea eax, [ebp - 0x14]
call fcn.00403198
ret

Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x4078db
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.00407890
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c84
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404650
call fcn.00405880
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x4094d8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409532
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094fe
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40950c
cmp edi, 1
jle 0x40950c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408fbc
test eax, eax
jne 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409532
inc edi
dec esi
jne 0x4094ee
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x40953c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409589
xor ebx, ebx
jmp 0x40957e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404c30
test eax, eax
jne 0x40957d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40955f
mov al, byte [ebp - 1]
sub al, 1
jb 0x409594
je 0x40959d
jmp 0x4095a6
call fcn.00407024
mov edi, eax
jmp 0x4095a8
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4095a8
xor edi, edi
test di, di
je 0x409639
xor ebx, ebx
jmp 0x4095e4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095e3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095d8
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095e3
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095b5
xor ebx, ebx
jmp 0x40962e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40962d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409622
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40962d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095f3
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x401000
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
push 0
call fcn.004209f8
push eax
call fcn.004208c4
add esp, 8
mov ebx, 0x443ae8
mov edi, 0x443acc
lea ecx, [ecx]
mov eax, dword [ebx]
push eax
call fcn.0042097e
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401030
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401040
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041fbf7
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.0042097e
add esp, 4
push eax
push 0x43b244
push esi
call fcn.00420835
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40110b
push esi
call fcn.004208b9
add edi, 4
add esp, 4
cmp edi, 0x443ae8
jl 0x401020
add ebx, 4
cmp ebx, 0x443aec
jl 0x401018
call fcn.004208d6
mov ecx, dword [0x443ae8]
push ecx
call fcn.0042097e
add esp, 4
mov ebx, eax
call fcn.004208d6
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x443acc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4010d6
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4010e6
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041fbf7
push edi
push ebx
mov esi, eax
push 0x43b244
push esi
call fcn.00420835
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x401120
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.004209f8
push eax
call fcn.004208c4
add esp, 8
push ebx
push esi
mov dword [ebp - 4], 0x443aec
push edi
mov edi, edi
push 0
call fcn.004209f8
push eax
call fcn.004208c4
add esp, 8
mov ebx, 0x443ae8
mov edi, 0x443acc
lea ebx, [ebx]
mov eax, dword [ebx]
push eax
call fcn.0042097e
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401170
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401180
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041fbf7
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.0042097e
add esp, 4
push eax
push 0x43b244
push esi
call fcn.00420835
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40124b
push esi
call fcn.004208b9
add edi, 4
add esp, 4
cmp edi, 0x443ae8
jl 0x401160
add ebx, 4
cmp ebx, 0x443aec
jl 0x401155
call fcn.004208d6
mov ecx, dword [0x443ae8]
push ecx
call fcn.0042097e
add esp, 4
mov ebx, eax
call fcn.004208d6
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x443acc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401216
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401226
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041fbf7
push edi
push ebx
mov esi, eax
push 0x43b244
push esi
call fcn.00420835
add esp, 0x14
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401250
mov ebx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401263
sub eax, edi
lea eax, [eax + edx + 8]
push eax
call fcn.0041fbf7
mov ecx, dword [ebx]
push ecx
push esi
mov edi, eax
push 0x43b244
push edi
call fcn.00420835
push esi
call fcn.004208b9
add esp, 0x18
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401324
push edi
call fcn.004208b9
add ebx, 4
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0x443b0c
jl 0x401140
call fcn.00401000
mov edi, eax
call fcn.004208d6
and eax, 0x80000007
jns 0x4012d2
dec eax
or eax, 0xfffffff8
inc eax
mov ebx, dword [eax*4 + 0x443aec]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4012e0
sub eax, edx
mov edx, eax
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4012f0
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041fbf7
push ebx
push edi
mov esi, eax
push 0x43b244
push esi
call fcn.00420835
push edi
call fcn.004208b9
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401330
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.004209f8
push eax
call fcn.004208c4
add esp, 8
push ebx
push esi
mov dword [ebp - 4], 0x443ab0
push edi
mov edi, edi
push 0
call fcn.004209f8
push eax
call fcn.004208c4
add esp, 8
mov ebx, 0x443ae8
mov edi, 0x443acc
lea ebx, [ebx]
mov eax, dword [ebx]
push eax
call fcn.0042097e
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401380
sub eax, edx
mov edx, eax
mov eax, dword [edi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401390
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041fbf7
mov edx, dword [edi]
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push edx
push eax
call fcn.0042097e
add esp, 4
push eax
push 0x43b244
push esi
call fcn.00420835
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40145b
push esi
call fcn.004208b9
add edi, 4
add esp, 4
cmp edi, 0x443ae8
jl 0x401370
add ebx, 4
cmp ebx, 0x443aec
jl 0x401365
call fcn.004208d6
mov ecx, dword [0x443ae8]
push ecx
call fcn.0042097e
add esp, 4
mov ebx, eax
call fcn.004208d6
cdq
mov ecx, 7
idiv ecx
mov eax, ebx
mov edi, dword [edx*4 + 0x443acc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401426
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401436
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041fbf7
push edi
push ebx
mov esi, eax
push 0x43b244
push esi
call fcn.00420835
add esp, 0x14
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401460
mov ebx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401473
sub eax, edi
lea eax, [eax + edx + 8]
push eax
call fcn.0041fbf7
mov ecx, dword [ebx]
push ecx
push esi
mov edi, eax
push 0x43b244
push edi
call fcn.00420835
add esp, 0x14
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401534
push esi
call fcn.004208b9
push edi
call fcn.004208b9
add ebx, 4
add esp, 8
mov dword [ebp - 4], ebx
cmp ebx, 0x443acc
jl 0x401350
call fcn.00401000
mov edi, eax
call fcn.004208d6
cdq
mov ecx, 7
idiv ecx
mov eax, edi
mov ebx, dword [edx*4 + 0x443ab0]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4014f0
sub eax, edx
mov edx, eax
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401500
sub eax, esi
lea edx, [eax + edx + 8]
push edx
call fcn.0041fbf7
push ebx
push edi
mov esi, eax
push 0x43b244
push esi
call fcn.00420835
push edi
call fcn.004208b9
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret