joyce8/EMBER2024-capa huggingface dataset:
Function at 0x867b7c
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], sp
pop word [esp]
lea esp, [esp + 2]
jmp 0x867bc6
mov ecx, dword [ecx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
push bp
clc
lea esp, [esp + 2]
jmp 0x867be6
lea esp, [esp + 4]
popal
and ecx, esi
cmc
jmp 0x867bae
mov edi, dword [edi*4 + reloc.KERNEL32.dll_IsBadCodePtr]
push ebx
jmp 0x867c4e
shr edi, 0x10
and edi, esi
clc
pushfd
jmp 0x867bd0
stc
bts edi, esp
mov edi, edx
pushal
jmp 0x867c2d
lea esp, [esp + 3]
cmc
lea esp, [esp + 1]
jmp 0x867c77
lea esp, [esp + 0x14]
and edi, 0xff000000
xor ecx, edi
lea edi, [edi*4]
lea edi, reloc.KERNEL32.dll_IsBadCodePtr
jmp 0x867bef
and edx, esi
mov edx, dword [edx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
shr edi, 0x18
sub esp, 4
jmp 0x867bf8
lea esp, [esp + 8]
and ecx, 0xff0000
sub esp, 0x18
pop dword [esp + 0xa]
jmp 0x867c11
xor ecx, edi
mov di, 0xcb84
bt edi, esp
jmp 0x867e09
movzx edi, byte [edi*4 + 0x83eb70]
push cx
lea esp, [esp + 2]
jmp 0x867c61
mov dl, byte [esp]
mov dh, ah
mov dl, byte [esp]
jmp 0x867cc0
add ebx, 4
bsr edx, ecx
btr edx, edx
mov dword [edi], ecx
jmp 0x867c9d
mov edx, dword [eax + 4]
xor edx, ecx
btc cx, cx
neg cl
jmp 0x867d11
mov dx, word [esp]
xor ecx, dword [eax]
add edx, 0x32d8cd15
lea edx, [esi*4]
lea edx, [edi + edi]
jmp 0x867cb3
lea esp, [esp + 1]
push edx
mov edx, eax
jmp 0x867d38
mov cl, ah
mov dword [eax + 0x14], edx
sub esp, 0x11
pop dword [esp + 5]
ror cx, cl
jmp 0x867cf3
inc dx
or dh, dl
dec edx
jmp 0x867d44
add edx, 8
mov ecx, dword [edx]
pop edx
xor ecx, edx
mov dl, cl
jmp 0x867d22
push esi
mov esi, eax
jmp 0x867dd7
lea esp, [esp + 0x20]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
bswap edx
jmp 0x867cdb
add esi, 0x18
mov dword [esi], ecx
pop esi
mov edx, dword [eax + 0xc]
call fcn.00867d96
push 0xa
mov eax, dword [esp]
bswap ebp
jmp 0x8683ba
pop esi
call fcn.00867ee2
dec edi
retf
and edx, ebp
not di
mov edi, 0xd423bb51
xor ecx, edx
jmp 0x867d5b
lea esp, [esp + 4]
pop edi
mov ebp, dword [esp]
mov bl, bh
bswap esi
not ebp
jmp 0x867df1

Function at 0x868076
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, 0xff
xchg dx, di
lea esp, [esp + 2]
jmp 0x86804d

Function at 0x86814d
Capabilities:
Encrypt data using aes

Disassembly:
push edi
jmp 0x868156
lea esp, [esp + 0x2c]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
bswap ebx
jmp 0x86811a
push dword [esp + 2]
and ebx, ecx
stc
jmp 0x868130
mov edi, esi
add edi, 2
movzx ebx, byte [edi]
pop edi
jmp 0x86819c
and ebx, ecx
cmc
push ebx
jmp 0x868186
sub esp, 0x17
mov dword [esp], eax
lea esp, [esp + 3]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
jmp 0x868161

Function at 0x86826b
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
lea esp, [esp + 2]
mov dword [esi], edi
jmp 0x86822b

Function at 0x8682d6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.KERNEL32.dll_IsBadCodePtr]
and ebx, ecx
jmp 0x868364
Function at 0x86837b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x868398
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
mov bx, si
jmp 0x868ffd
and ebx, ecx
pushfd
jmp 0x86840c
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_IsBadCodePtr]
push cx
lea esp, [esp + 2]
jmp 0x8683cd
movzx ebx, byte [esi + 0xa]
call fcn.00868434
mov byte [0x3acfa83a], al
add byte [edx + 0x3acfa83a], ah
mov byte [eax + 0x19ea8f1f], al
jecxz 0x8683fe
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
mov ebx, dword [esp]
rcr ebx, cl
jmp 0x8683f6
shr edi, 0x18
sub esp, 0x1b
add esp, 0xf
mov edi, dword [edi*4 + reloc.KERNEL32.dll_IsBadCodePtr]
sub esp, 0xc
jmp 0x8683e5
mov edi, edx
sub esp, 0x16
mov byte [esp + 7], bh
lea esp, [esp + 2]
jmp 0x868451
mov dword [esi + 4], edi
lea edi, reloc.KERNEL32.dll_IsBadCodePtr
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
lea edi, [eax + ecx]
jmp 0x8684eb
xor edi, dword [edx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
bswap edx
lea edx, reloc.KERNEL32.dll_IsBadCodePtr
mov edx, eax
mov edx, dword [esi + 8]
jmp 0x8685ae
mov edx, dword [edx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
and edx, ecx
lea esp, [esp + 0x10]
jmp 0x86871b
movzx ebx, byte [esi + 9]
and edx, ecx
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x868863

Function at 0x8685e3
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x8685f0
pop word [esp]
add esp, 0
lea esp, [esp + 2]
jmp 0x8685c6
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
movzx ebx, byte [esi + 0xe]
sub esp, 0x18
jmp 0x868635
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_IsBadCodePtr]
and edx, ecx
stc
jmp 0x86861f

Function at 0x86868e
Capabilities:
Encrypt data using aes

Disassembly:
call 0x868671
mov dword [esi + 0xc], edi
jmp 0x8686df
lea esp, [esp + 4]
jne 0x834000
je 0x833fc9

Function at 0x869033
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x869100
lea esp, [esp + 0x20]
ja 0x868849
cmc
jmp 0x869127
sub esi, 0x47
jmp 0x868833
add bl, al
cmp eax, 0x95eb60f
lea esp, [esp + 4]
cmp al, 0x5a
jmp 0x869078
das
movsd dword es:[edi], dword [esi]
xor eax, 0x5f12af5c
salc
inc esp
and ebx, esi
sbb al, bh
outsb dx, byte [esi]
sub eax, 0x41
jmp 0x86876f
jecxz 0x868ffa
jne 0x86903b
mul cl
movzx eax, al
ja 0x8687b4
jbe 0x869062
xor byte [edx + 0x60a25730], ah
jb 0x869072
ja 0x86909f
loope 0x8690b8
lcall 0x2464, 0x8d17e4f5
add al, 0x6a
aas
jmp 0x868759
and al, 4
idiv edi
jmp [edx + 0x3f]
cmp bl, cl
jns 0x8690a4
or esp, dword [edx - reloc.KERNEL32.dll_IsBadCodePtr]
lea esp, [esp + 4]
movzx esi, bl
jmp 0x869116
cmp bl, 0x5a
pushal
jmp 0x868817
cmp bl, 0x39
ja 0x868812
add esi, 4
jmp 0x868833
sub esi, 0x41
jmp 0x868833
Function at 0x936dba
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
rcl ebp, cl
xchg dword [esp + 4], ebx
sub esp, 0x1e
mov ebx, 0x48e21e31
dec ebx
jmp 0x936e1b
neg ecx
pop word [esp + 4]
bts edx, esp
xchg dword [esp + 0xb], esi
jmp 0x936da4
mov di, bp
pop word [esp + 1]
setg ch
cpuid
cpuid
bswap esi
jmp 0x936de4
cld
pop ax
add esp, 3
inc si
rdtsc
mov bh, byte [esp + 0x23]
jmp 0x936dfa

Function at 0x936fe3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 1], edi
xchg si, ax
push dword [esp]
jmp 0x938296
pop cx
sub esp, 1
xchg al, bl
mov esi, dword [esp + 6]
push cx
call fcn.009371eb
not dh
add al, 0x5e
mov edx, 0xacef1f5b
cpuid
bts cx, cx
jmp 0x937311
mov cx, word [esp]
bsf cx, ax
add esp, 0
mov byte [esp], bl
lea ebx, [esi - 0x3d]
neg ebx
jmp 0x937358
sub esp, 0x13
cld
call fcn.009373a4
retf 0xde48
rdtsc
btr si, cx
mov ebp, eax
sub esp, 0x1e
add esp, 0x12
pushal
jmp 0x937342
dec ax
lea edi, [eax + ebp]
bsr esi, esp
pop dword [esp]
clc
bswap eax
jmp 0x9372d1
xchg dword [esp + 0xb], ebp
pop si
xchg bx, dx
xchg di, ax
inc bh
lea edx, [eax*4]
jmp 0x93742f
lea edx, reloc.KERNEL32.dll_IsBadCodePtr
rdtsc
clc
push dword [esp + 6]
dec dl
xchg di, bp
jmp 0x937496

Function at 0x93700a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xb
bswap esi
xchg word [esp], di
xchg bp, ax
std
pushal
jmp 0x937033
mov al, ch
pop dword [esp + 5]
mov si, bx
jmp 0x936ff2
rdtsc
push word [esp + 1]
add esp, 1
xchg ecx, eax
bswap ebp
sub esp, 0xb
jmp 0x937045
pushal
lea esp, [esp + 0x44]
xchg esi, ebx
push si
btc esi, edx
bts dx, di
jmp 0x937015
mov word [esp + 3], di
mov dword [esp + 1], ebp
lea edx, [ebp*4]
lea esp, [esp + 6]
mov byte [esp + 1], ah
mov bl, byte [esp + 3]
jmp 0x937091
xchg dword [esp + 3], edi
pop dword [esp]
mov di, 0x5afd
bsf bx, si
jmp 0x93707b
Function at 0x9371eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, bx
mov dh, ch
btr ax, di
call fcn.0093700a
push word [esp + 1]
lea esp, [esp + 3]
mov bx, bp
rol bp, 9
jmp 0x9370d7
mov dword [esp + 9], eax
pop dword [esp + 5]
mov dl, byte [esp + 4]
xchg cx, bx
sub esp, 4
mov eax, 0xc6b6e490
jmp 0x93706d
push dword [esp + 1]
xchg edi, edx
not ch
lea eax, [esi*4]
jmp 0x937150
xchg bl, bh
xchg byte [esp + 1], ch
cpuid
not ax
push word [esp]
mov edi, edx
jmp 0x9370c1
mov dword [esp + 0xa], esi
mov bx, cx
xchg word [esp + 6], bx
mov esi, 0xc37a307f
mov cl, ah
bswap ebp
jmp 0x93712c
sub esp, 0xa
mov word [esp + 9], cx
xchg dx, bp
pop word [esp + 0xc]
mov edi, 0xcc5810e6
lea edi, [ebp*4]
jmp 0x9370ea
mov ebx, 0xa25ccdfc
lea esp, [esp + 3]
push word [esp + 0xc]
pop dword [esp + 3]
push word [esp + 0xb]
lea ecx, [ebx + edi]
jmp 0x93717f
mov ebp, dword [esp + 5]
xchg edx, ecx
std
bswap eax
lea edx, [ecx*4]
mov byte [esp + 3], cl
jmp 0x93710e
bsf si, di
mov ecx, ebx
mov cx, word [esp]
mov ebx, edx
mov byte [esp], ch
mov cl, byte [esp]
jmp 0x9371a2
mov dh, 0x9e
pop ecx
bswap ebp
pop esi
lea esp, [esp + 5]
std
jmp 0x937166
shr bh, cl
mov word [esp + 5], di
lea esp, [esp + 0x11]
cmp cx, ax
mov ecx, edx
jmp 0x9371c9
cpuid
xchg byte [esp], dh
rdtsc
inc ebx
mov bp, 0x689c
sub esp, 0x19
jmp 0x93718c
sbb ebx, ebp
invalid
btc edx, ecx
call fcn.0093722f
insd dword es:[edi], dx
cld
xchg edx, eax
cmc
add al, 0xf5
pop ebp
leave
pop ecx
cmp bl, cl
jl 0x9371b0
or eax, dword [ebx + reloc.KERNEL32.dll_IsBadCodePtr]
lea eax, [eax]
add byte [eax], al
add byte [ebx - 0x45], bl
sahf
ror dword [ebp + 4], 0x8d
add al, 4
add esp, 5
lea ebx, [ecx*4]
pop ebx
mov ebx, 0x44dc19e
lea eax, [esp + eax]
rdtsc
jmp 0x9371b3
bswap eax
jmp 0x9370a8

Function at 0x937208
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
xchg byte [esp], bl
inc ch
pop word [esp]
lea ebx, [ecx + esi]
jmp 0x937212
or ch, 0x7e
mov cl, byte [esp + 6]
stc
jmp 0x9371f2
btc edi, ebp
stc
lea ebp, [edi + ebp]
mov di, bp
or bp, 0xbbd5
rdtsc
jmp 0x937299
mov word [esp], dx
call fcn.00937252
mov cx, word [esp + 2]
xchg byte [esp + 7], ch
pop dword [esp + 8]
sub esp, 0x12
jmp 0x9373bc
xchg cl, dl
xchg dh, bl
mov ch, 0x6c
lea ecx, [ebx*4]
lea ebp, [esi + 0x94]
mov cl, byte [esp]
jmp 0x9372e3
bsr ax, ax
add esp, 0xf
cpuid
popal
mov dx, bp
bsf bp, sp
jmp 0x9372f9
mov ebp, dword [esp + 0x1f]
lea esp, [esp]
mov ebp, dword [esp + 0x1a]
xchg bp, cx
sets bl
not bl
jmp 0x93732f
sub esp, 0xc
rdtsc
not esi
neg bp
dec ax
xchg dword [esp + 0x12], edi
jmp 0x937379

Function at 0x937266
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebp, eax
lea esi, [eax + ecx]
jmp 0x9372b8
rdtsc
bsf edx, edi
add esp, 0xb
lea edx, [ebp*4]
std
jmp 0x9372a2
Function at 0x937442
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x938129
not al
mov word [esp], cx
mov esi, 0x3d5bb762
mov dh, 8
xchg bh, ch
mov word [esp], dx
jmp 0x93770f
mov dword [esp + 0xa], esi
lea ebx, reloc.KERNEL32.dll_IsBadCodePtr
xchg dword [esp + 0xc], edx
cpuid
rdtsc
mov edi, dword [esp + 0x1c]
call fcn.009374ac
clc
pushfd
mov edi, dword [esp + 9]
mov al, 0xe9
not ebp
sub esp, 0xf
jmp 0x937545
lea esi, [esp + ecx]
btc bp, bp
rdtsc
neg dl
xchg ch, dl
mov bh, cl
jmp 0x9376db
lea esp, [esp + 0x4c]
mov cl, dl
mov dx, word [esp]
lea esi, reloc.KERNEL32.dll_IsBadCodePtr
lea edx, reloc.KERNEL32.dll_IsBadCodePtr
bswap ebp
jmp 0x93752f
push sp
bswap ebp
mov ebp, esi
mov ebp, dword [esp + 2]
insb byte es:[edi], dx
and al, 2
mov bx, cx
call fcn.009375e7
mov byte [esp + 0x11], ah
call fcn.009376b6
jl 0x93764b
js 0x937682
ljmp 0x9fa:0x9f0f9e5f
mov dword [esp + 0x13], ebp
push si
xor ecx, edx
lea esp, [esp + 8]
mov byte [esp + 0xb], bh
xchg bx, di
jmp 0x937656
fisttp qword [ebp + 0x14]
out 0x51, eax
lodsb al, byte [esi]
mov edi, 0x33303186
bsf edx, eax
push dword [esp + 8]
neg ah
mov ch, byte [esp + 6]
cpuid
not edi
jmp 0x93766c
mov edx, dword [esp]
lea ebx, [edx*4]
rdtsc
mov dl, 0xf7
bswap eax
push si
jmp 0x937644
mov bp, sp
pushal
bt edi, esi
mov dx, word [esp + 0x1c]
sub esi, edx
xchg word [esp + 0xc], si
jmp 0x9374c5
mov ebx, dword [esp + 2]
neg dl
xchg ah, ch
mov byte [esp + 1], ch
lea esp, [esp + 2]
mov byte [esp], bl
jmp 0x937447

Function at 0x9374ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x937566
shr bp, cl
neg cl
lea eax, [esi*4]
xchg cx, ax
push word [esp + 0x34]
bsf ecx, ebx
jmp 0x9374e0
not bx
lea eax, reloc.KERNEL32.dll_IsBadCodePtr
lea edi, [ebp*4]
cpuid
mov dword [esp + 0x25], esi
pop dword [esp + 9]
jmp 0x9374f6
xchg dword [esp + 0x1f], esi
sub esp, 0x15
cmp bp, cx
xchg edx, esi
not bx
mov eax, dword [esp + 0x1a]
jmp 0x937513
Function at 0x937979
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
xchg byte [esp], bl
mov cx, word [esp + 2]
pop bp
and cx, 0x5182
xchg byte [esp], cl
jmp 0x937809
bsr edx, esi
pop edx
mov al, byte [esp + 3]
mov word [esp + 1], ax
bswap esi
xchg byte [esp + 6], ah
jmp 0x93776a
mov dl, 0x96
rdtsc
mov word [esp + 0xe], dx
xchg dword [esp + 0xa], ecx
sete al
pushal
jmp 0x9377e4
mov cl, byte [esp]
mov dl, 0x2b
bts edx, ebp
xchg byte [esp], ch
pop dx
pushal
jmp 0x9377a0
lea ebp, [ebp*4]
push word [esp + 0x1f]
jmp 0x93782e
mov ebx, ecx
mov cx, word [esp + 0x37]
pop dx
rdtsc
xchg dword [esp + 0x2a], esi
rcl ax, cl
jmp 0x9377ce
setle ch
mov word [esp], si
mov ch, al
rcl al, cl
std
inc edi
jmp 0x9377be
not ebx
pushfd
mov bx, word [esp + 2]
mov dl, 0xd9
lea edi, [esp + ecx]
jmp 0x937849
lea ebp, [ebp*4]
lea edx, [ebp*4]
pushal
lea esp, [esp + 0x60]
mov dx, word [esp]
mov ebx, edx
jmp 0x937818
bsr ax, ax
lea eax, [ebp*4]
mov cx, dx
not dl
add esp, 1
setne dh
jmp 0x9378a3
dec ecx
mov ebx, ebp
or edi, esi
xchg al, dl
inc dx
mov ch, bl
jmp 0x93778b
mov ecx, 0x71c02d7c
rdtsc
push word [esp + 2]
cpuid
mov ebp, dword [esp + 0x13]
push dword [esp + 0xd]
jmp 0x9378d6
sub esp, 0x16
mov ah, byte [esp + 0x12]
mov byte [esp + 1], cl
mov dword [esp + 0x10], edx
std
xchg dword [esp + 8], edi
jmp 0x937878
not ebx
pop dword [esp + 0xc]
btc si, bx
mov bp, word [esp + 2]
lea esp, [esp + 0x11]
jmp 0x937949
xchg word [esp + 0x19], dx
xchg dword [esp + 0x1a], eax
cld
pop dword [esp]
mov dword [esp + 1], esp
mov di, 0x86f2
jmp 0x9378b9
xchg byte [esp + 1], bh
rcl eax, 1
lea ebp, [ebx + esi]
mov ebx, ebp
pop si
std
jmp 0x937928
cpuid
inc cl
mov dword [esp], ebp
std
std
bsr ecx, eax
jmp 0x9378ed
mov bp, 0x43db
xchg byte [esp], ch
mov dl, dh
xchg ch, al
jmp 0x937963
lea esi, [eax + ebp]
rol cl, 1
mov dx, 0xff62
rol ch, 6
clc
mov ax, 0x1ec4
jmp 0x937912
lea ebp, [ebp*4]
xchg dh, cl
mov cx, bx
xchg dx, bp
add esp, 2
lea edi, reloc.KERNEL32.dll_IsBadCodePtr
jmp 0x937904
lea ebp, [edi*4]
mov dx, 0xcfd1
push word [esp]
jmp 0x937a01
lea edx, [ecx + esi]
push word [esp + 1]
mov ch, bh
mov dx, si
jmp 0x937868
clc
call fcn.009379b1
inc edx
rol dword [ebx + 0x26], cl
aad 0x31
fcom dword [edx + ecx*8 - 0x53]
pop esp
mov bh, 0x41
ret
cld
popal
sub esp, 0x1e
mov dword [esp + 9], edx
std
lea esp, [esp + 0xb]
jmp 0x93798b
pop ecx
bswap eax
mov eax, dword [esp]
lea ebx, [edx*4]
mov ebx, ecx
btr edi, esp
jmp 0x9379a1
or bx, si
stc
xchg byte [esp], bh
not dx
mov dword [esp], edx
mov edx, 0xb72bbcbf
jmp 0x9379c9

Function at 0x937a9a
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.0093702d
mov eax, dword [eax + 8]
jmp 0x937a82
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x937a62
push eax
jmp 0x937028
push word [esp + 3]
lea esp, [esp + 2]
mov dword [esp], edi
mov eax, dword fs:[0x30]
jmp 0x937a78
Function at 0x4039d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e7de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
call fcn.0040e5b0
add esp, 4
mov eax, dword [esi + 0x14]
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
cmp eax, 8
jb 0x403a20
mov ecx, dword [esi]
test ecx, ecx
je 0x403a4b
mov ecx, esi
cmp eax, 8
jb 0x403a2d
mov ecx, dword [esi]
cmp word [ecx], 0
je 0x403a4b
mov ecx, esi
cmp eax, 8
jb 0x403a3c
mov ecx, dword [esi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403b16
lea eax, [ebp - 0x28]
push eax
call fcn.0040eaa0
add esp, 4
mov ecx, esi
push eax
call fcn.004029c0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x403a99
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x403a8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b27
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov eax, dword [esi + 0x14]
mov ecx, esi
cmp eax, 8
jb 0x403aa5
mov ecx, dword [esi]
test ecx, ecx
je 0x403acc
mov ecx, esi
cmp eax, 8
jb 0x403ab2
mov ecx, dword [esi]
cmp word [ecx], 0
je 0x403acc
mov ecx, esi
cmp eax, 8
jb 0x403ac1
mov ecx, dword [esi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403b16
lea eax, [ebp - 0x28]
push eax
call fcn.00403cb0
add esp, 4
mov ecx, esi
push eax
call fcn.004029c0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x403b16
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x403b0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b2c
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00448ebf
call fcn.00448ebf
int3
Function at 0x4040b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47e86d
push eax
mov dword fs:[0], esp
sub esp, 0x18
call fcn.00430860
test eax, eax
je 0x404198
cmp byte [ebp + 8], 0
je 0x404155
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00430230
add esp, 8
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x404165
cmp edx, 8
jb 0x404155
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40414b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041a8
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp edx, 8
jb 0x404198
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40418e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041a8
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00448ebf
int3

Function at 0x404540
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 1
call fcn.004040b0
add esp, 4
test al, al
jne 0x404557
pop ebp
jmp fcn.00404560
xor eax, eax
pop ebp
ret
Function at 0x404560
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e8b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.004039d0
add esp, 4
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 4], 0
cmp edx, 8
jb 0x4045a2
test ecx, ecx
je 0x404753
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
cmp word [eax], 0
je 0x404753
cmp edx, 8
lea eax, [ebp - 0x3c]
cmovae eax, ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40474d
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov byte [ebp - 4], 1
cmp byte [ebp + 8], al
je 0x4046dd
lea eax, [ebp - 0x6c]
push eax
call fcn.00403ef0
mov ecx, eax
call fcn.00403fd0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
call fcn.00403ef0
mov ecx, eax
call fcn.00403f50
cmp dword [ebp - 0x58], 0x10
lea ecx, [ebp - 0x6c]
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 3
cmovae ecx, dword [ebp - 0x6c]
cmp dword [ebp - 0x40], 0x10
push ecx
cmovae eax, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x84]
push 0x483600
push eax
call fcn.00423af0
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x24]
cmp eax, esi
je 0x4046be
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x40468c
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404682
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404796
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x24], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x14], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x84]
call fcn.004015a0
lea ecx, [ebp - 0x54]
call fcn.00402700
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00402700
push dword [ebp + 0x18]
lea eax, [ebp - 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004047b0
mov edx, dword [ebp - 0x10]
add esp, 0x18
mov esi, eax
cmp edx, 8
jb 0x404731
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404727
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40479b
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
jmp 0x404755
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
xor esi, esi
cmp edx, 8
jb 0x404785
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40477b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40479b
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00448ebf
call fcn.00448ebf
int3
Function at 0x4047b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47e8ed
push eax
mov dword fs:[0], esp
sub esp, 0x60
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
xor edi, edi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4047de
mov ecx, dword [esi]
test ecx, ecx
je 0x404962
mov ecx, esi
cmp eax, 8
jb 0x4047ef
mov ecx, dword [esi]
cmp word [ecx], di
je 0x404962
mov ecx, esi
cmp eax, 8
jb 0x404801
mov ecx, dword [esi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404962
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [edi + 0x10], eax
je 0x4048fa
push esi
lea eax, [ebp - 0x6c]
push 0x4835fc
push eax
call fcn.004024e0
push 0x4835f4
push eax
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 1
push eax
call fcn.00402470
push edi
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push eax
call fcn.00402410
mov edi, eax
add esp, 0x24
lea eax, [ebp - 0x24]
cmp eax, edi
je 0x4048db
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x4048a9
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40489f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404974
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x24], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x14], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ecx, [ebp - 0x3c]
call fcn.004015a0
lea ecx, [ebp - 0x54]
call fcn.004015a0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0
call fcn.004015a0
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x10], 0
je 0x40491b
push dword [ebp + 0x1c]
push 0x1e
push 0x32
push 1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push edi
call fcn.004128c0
add esp, 0x20
jmp 0x40492a
push 5
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00412b50
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp edx, 8
jb 0x404962
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404958
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404979
push edx
push ecx
call fcn.0041a2f9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00448ebf
call fcn.00448ebf
int3