joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043851
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x1004387d
test ecx, ecx
jne 0x10043887
test esi, esi
jne 0x10043887
mov eax, edx
jmp 0x100438f8
cmp eax, 0xffffffff
jne 0x10043887
push 0xfffffffffffffffe
pop eax
jmp 0x100438f8
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x100438f8
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x100438bd
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x100438dc
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x100439a5
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x1004391d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10043927
xor ecx, ecx
jmp 0x10043966
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x10043949
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.1007d017
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x10043991
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x100439a5
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x1004385f
pop edi
pop esi
leave
ret
Function at 0x1005fd0d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ecx + 4]
test esi, esi
je 0x1005fd2e
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x1005fd30
xor eax, eax
mov dword [edx], eax
movzx eax, word [ecx + 8]
mov dword [edx + 4], eax
movzx eax, word [ecx + 0xa]
mov dword [edx + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 2]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 6]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 0xa]
mov dword [edx + 0x24], eax
mov eax, dword [edx + 0x20]
imul eax, dword [edx + 0x18]
imul eax, dword [edx + 0x1c]
shl eax, 2
mov dword [edx + 0x28], eax
mov esi, dword [ecx + 0x14]
test esi, esi
je 0x1005fda3
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x1005fda5
xor eax, eax
pop edi
mov dword [edx + 0x2c], eax
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x1007b3c0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebx + 0x1c]
mov eax, dword [eax + 0xf4]
push edx
mov esi, ecx
shl edi, 3
push eax
lea ecx, [edi + edi]
push esi
mov dword [ebp - 8], edi
call fcn.1007b150
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x1007b441
mov ebx, dword [ebp + 8]
mov edx, esi
sub ebx, esi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], eax
mov ecx, dword [ebx + edx]
mov eax, dword [edx]
xor esi, esi
test edi, edi
jbe 0x1007b432
mov edi, edi
movzx edx, byte [eax + 1]
movzx ebx, byte [eax]
add edx, esi
add ebx, edx
sar ebx, 1
mov byte [ecx], bl
inc ecx
xor esi, 1
add eax, 2
dec edi
jne 0x1007b410
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add edx, 4
dec eax
mov dword [ebp - 4], edx
mov dword [ebp + 8], eax
jne 0x1007b403
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1007b500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax + 0x1c]
mov edi, dword [esi + 0x1c]
mov eax, dword [eax + 0xf4]
push edx
mov ebx, ecx
shl edi, 3
push eax
lea ecx, [edi + edi]
push ebx
mov dword [ebp - 0x14], edi
call fcn.1007b150
mov esi, dword [esi + 0xc]
xor ecx, ecx
test esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], esi
jle 0x1007b5b0
mov edx, ebx
mov dword [ebp - 0xc], edx
test edi, edi
mov eax, dword [ebp + 8]
mov esi, dword [eax + ecx*4]
mov eax, dword [edx]
mov dword [ebp - 4], 1
jbe 0x1007b59f
mov ecx, dword [edx + 4]
sub ecx, eax
mov dword [ebp - 8], edi
jmp 0x1007b560
movzx edi, byte [ecx + eax]
movzx edx, byte [ecx + eax + 1]
mov ebx, dword [ebp - 4]
add edx, edi
movzx edi, byte [eax + 1]
add edi, ebx
movzx ebx, byte [eax]
add edi, edx
mov edx, dword [ebp - 8]
add ebx, edi
sar ebx, 2
mov byte [esi], bl
mov ebx, dword [ebp - 4]
xor ebx, 3
inc esi
add eax, 2
dec edx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
jne 0x1007b560
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add edx, 8
inc ecx
cmp ecx, eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jl 0x1007b540
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1007f19f
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov dword [esi + 4], ecx
lea eax, [ecx + eax - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 4], eax
jne 0x1007f1e4
mov ecx, 0x100000
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x100cf6e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100cf751
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x100cf751
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x100cf73a
jmp 0x100cf751
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x100cfde0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1013b060], 0
je 0x100cfdf9
mov eax, dword [0x1013b060]
jmp 0x100cff96
mov dword [0x1013b060], 0x1013b038
push 0x28
push 0
push 0x1013b038
call sub.MSVCR100D.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1013b038], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1013b03c], eax
cmp dword [0x1013b03c], 0
jne 0x100cfe3f
xor eax, eax
jmp 0x100cff96
push str.ImagehlpApiVersionEx
mov eax, dword [0x1013b03c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b040], eax
push str.SymInitialize
mov ecx, dword [0x1013b03c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b044], eax
push str.SymSetOptions
mov edx, dword [0x1013b03c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b048], eax
push str.SymGetOptions
mov eax, dword [0x1013b03c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b04c], eax
push str.SymLoadModule
mov ecx, dword [0x1013b03c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b050], eax
push str.SymGetModuleInfo
mov edx, dword [0x1013b03c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b054], eax
push str.SymGetSymFromName
mov eax, dword [0x1013b03c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b058], eax
push str.BindImage
mov ecx, dword [0x1013b03c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1013b05c], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x1013b040], 0
je 0x100cff1d
lea eax, [ebp - 8]
push eax
call dword [0x1013b040]
cmp dword [0x1013b040], 0
je 0x100cff2f
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x100cff4a
mov edx, dword [0x1013b03c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1013b03c], 0
xor eax, eax
jmp 0x100cff96
cmp dword [0x1013b044], 0
je 0x100cff63
push 0
push 0
mov eax, dword [0x1013b038]
push eax
call dword [0x1013b044]
cmp dword [0x1013b04c], 0
je 0x100cff91
cmp dword [0x1013b048], 0
je 0x100cff91
call dword [0x1013b04c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1013b048]
mov eax, dword [0x1013b060]
mov esp, ebp
pop ebp
ret
Function at 0x100d0710
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123cf8
push 0x100d1c54
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x100d074d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x100d0783
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x100d08e1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x100d07bb
push 0xbf
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
jmp 0x100d08e1
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x100d07e7
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
jmp 0x100d08e1
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x100d080a
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x100d08bb
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
add ecx, eax
push ecx
call sub.MSVCR100D.dll_strcmp
add esp, 8
test eax, eax
jne 0x100d08b6
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
cmp dword [eax + edx + 0xc], 0
je 0x100d0857
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0x10], 0
jne 0x100d0859
jmp 0x100d08bb
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx], 0x30
jb 0x100d0886
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 4], 0x727444
je 0x100d0888
jmp 0x100d08bb
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x100d089c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ecx + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
jmp 0x100d08e1
jmp 0x100d0801
mov dword [ebp - 4], 0xffffffff
jmp 0x100d08d4
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100d1260
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1013620c]
jne 0x100d126a
repz ret
jmp fcn.100d1e60
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push edi
push 0x40
push 0x3000
push 0x163
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov ecx, 0x58
mov esi, 0x403018
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call eax
pop edi
xor eax, eax
pop esi
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x402ee4
pop dword [ebp - 0x3c]
mov eax, 0xc91fc175
add eax, 0x37206d6f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x9660b1fe
sub dword [ebp - 0x4c], 0x480e6cb3
mov dword [ebp - 0x48], 0xafac939a
sub dword [ebp - 0x48], 0x7d794755
mov dword [ebp - 0x44], 0x973b861a
sub dword [ebp - 0x44], 0x4aef41ec
mov dword [ebp - 0x40], 0x35e93dfa
add dword [ebp - 0x40], 0xca16c206
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xe5e4dd2
sub eax, 0xe1dccce
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x48de55ea
add dword [ebp - 0x4c], 0x2b94136c
mov dword [ebp - 0x48], 0xb3c6b31b
sub dword [ebp - 0x48], 0x725a51a6
mov dword [ebp - 0x44], 0x456bd6c9
add dword [ebp - 0x44], 0x1e0395a3
mov dword [ebp - 0x40], 0xf27ab29d
add dword [ebp - 0x40], 0xd854d63
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3825f
push 0
call eax
mov ecx, 0xdb3f141b
add ecx, 0x24c13858
mov ebx, eax
mov esi, 0x638f8d9b
sub esi, 0x6348a99b
add esi, dword [ebp - 0x3c]
mov edx, 0x71ec1e61
sub edx, 0x244422e2
add dword [ebp - 0x2c], 0xbd33d31f
mov edi, dword [esi]
xor dword [ebp - 0x1c], 0x5b56d216
add edi, edx
mov dword [ebx], edi
add dword [ebp - 0x10], eax
add ebx, 0x9ce9f5bb
sub ebx, 0x9ce9f5b7
add esi, 0x254989b7
sub esi, 0x254989b3
loop 0x403001
add eax, 0x7ad1b374
add eax, 0x852f712b
xor ebx, ebx
add ebx, eax
add eax, 0x6323b0d9
add eax, 0x9cdc4f2c
mov ecx, 0x8b9f1417
sub ecx, 0x8b5f1417
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x405170
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5b627c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x10]
push 0x400
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0050fe00
movaps xmm1, xmmword [0x569990]
lea edx, [ebp - 0x3f4]
add esp, 0xc
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], 0
mov ecx, 8
lea eax, [ecx - 8]
movd xmm0, eax
lea edx, [edx + 0x40]
pshufd xmm0, xmm0, 0
lea eax, [ecx - 4]
paddd xmm0, xmm1
movups xmmword [edx - 0x50], xmm0
movd xmm0, eax
lea eax, [ecx + 4]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [edx - 0x40], xmm0
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [edx - 0x30], xmm0
movd xmm0, eax
lea eax, [ecx - 8]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [edx - 0x20], xmm0
cmp eax, 0x100
jl 0x4051d1
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor edx, edx
xor ebx, ebx
xor esi, esi
nop word [eax + eax]
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp + esi*4 - 0x404]
mov al, byte [edx + eax]
add al, bl
add al, cl
movzx ebx, al
mov eax, dword [ebp + ebx*4 - 0x404]
mov dword [ebp + esi*4 - 0x404], eax
lea eax, [edx + 1]
xor edx, edx
mov dword [ebp + ebx*4 - 0x404], ecx
inc esi
cmp eax, edi
cmovl edx, eax
cmp esi, 0x100
jl 0x405240
mov edi, dword [ebp + 0x14]
xor esi, esi
mov edx, dword [ebp - 0x40c]
mov ebx, dword [ebp - 0x408]
test edi, edi
jle 0x4052d5
inc dl
movzx edx, dl
mov ecx, dword [ebp + edx*4 - 0x404]
lea eax, [ebx + ecx]
movzx ebx, al
mov eax, dword [ebp + ebx*4 - 0x404]
mov dword [ebp + edx*4 - 0x404], eax
mov dword [ebp + ebx*4 - 0x404], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp - 0x414]
mov al, byte [ebp + eax*4 - 0x404]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jl 0x405294
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00465d1b
mov esp, ebp
pop ebp
ret
Function at 0x410e10
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556db3
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x5b627c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x50]
push eax
call fcn.00422620
mov ecx, eax
call fcn.004225f0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], 0
mov eax, dword [eax + 0x28]
sub eax, 0x10
push eax
call fcn.0040c650
add eax, 0x10
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
call fcn.0045b430
lea eax, [ebp - 0x48]
push eax
call fcn.00458300
add esp, 0xc
push 0
push dword [ebp - 0x44]
mov byte [ebp - 4], 2
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp - 0x44]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410f75
call fcn.00474150
mov ecx, eax
push 2
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x410f71
push 0x60
push str.d:jenkins.jenkinsworkspaceweiduangamemicrogamemicrogamebox_srcmicrogameboxinst_helper.cc
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.0041c540
push 3
push 0x56bba4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.0041c540
mov byte [ebp - 4], 4
call fcn.00474150
mov edi, eax
lea ecx, [ebp - 0xe8]
push 0x4c0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004066e0
mov esi, eax
push str.InstallHelper::InstallFiles__copy_exe_file_failed__path:
push esi
mov byte [ebp - 4], 5
call fcn.00407a90
mov ecx, dword [ebp - 0x44]
mov edx, 0x56ba88
test ecx, ecx
cmovne edx, ecx
push edx
push esi
call fcn.00405390
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xe8]
call fcn.00407f30
lea ecx, [ebp - 0x28]
call fcn.004070a0
lea ecx, [ebp - 0x40]
call fcn.004070a0
xor edi, edi
jmp 0x410f7a
mov edi, 1
mov edx, dword [ebp - 0x48]
or ebx, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410f9b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x44]
mov eax, ebx
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410fb9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x4c]
test esi, esi
je 0x410fde
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x410fde
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x410fde
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00465d1b
mov esp, ebp
pop ebp
ret
Function at 0x416fa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5576e0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5b627c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00422620
mov ecx, eax
call fcn.004225f0
mov dword [ebp - 4], 0
call fcn.00414250
mov ecx, eax
test ecx, ecx
je 0x417107
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00433910
test al, al
mov eax, dword [ebp - 0x24]
je 0x417033
add eax, 0x3c
push str.cef69
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00407e40
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00407670
mov edx, dword [ebp - 0x14]
jmp 0x417058
add eax, 0x3c
push str.cef
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00407e40
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00407670
mov edx, dword [ebp - 0x18]
or edi, 0xffffffff
mov byte [ebp - 4], 1
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417076
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x5b6094]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00407e40
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x1c]
mov ebx, eax
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4170b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4170ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x4170f3
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4170f3
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4170f3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040c140
int3