joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d0f0
Capabilities:
Read file via mapping

Disassembly:
push edi
mov edi, eax
call fcn.10014bb7
mov dword [eax], 0
test edi, edi
je 0x1000d14f
push esi
push 0
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x1000d135
push edi
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1000d14a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.10014bb7
mov dword [eax], esi
pop esi
or eax, 0xffffffff
pop edi
ret
pop esi
mov eax, edi
pop edi
ret
call fcn.10014bb7
mov dword [eax], 0x16
or eax, 0xffffffff
pop edi
ret

Function at 0x1000d15f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003e500]
jne 0x1000d169
repz ret
jmp fcn.1001524c

Function at 0x10010b8e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10010bb5
call fcn.10014bca
mov dword [eax], esi
call fcn.10014bb7
push 0x16
pop esi
mov dword [eax], esi
call fcn.10016554
mov eax, esi
jmp 0x10010c0a
test dword [ebp + 0xc], 0xfffffff9
jne 0x10010b9b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10010be2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10014bdd
pop ecx
call fcn.10014bb7
mov eax, dword [eax]
jmp 0x10010c0a
test al, 0x10
jne 0x10010c08
test al, 1
je 0x10010c08
test byte [ebp + 0xc], 2
je 0x10010c08
call fcn.10014bca
mov dword [eax], 5
call fcn.10014bb7
mov dword [eax], 0xd
jmp 0x10010bd9
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1001968d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
inc esp
or byte [eax], bl

Function at 0x10019c1d
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x10019bf2
cmp dword [eax + 0xc], ebx
je fcn.10019c95
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1001964d
outsd dx, dword [esi]
or eax, 0x5d39372a
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
sbb eax, dword [edx]
add byte [eax], al
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x10019c35
mov dword [ebp + 0x10], edi
jmp 0x10019c3a
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.1001964d
cmp ebx, esi
xchg edi, eax
lahf
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x10019c83
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x10019c5e
and eax, 0xffff
push eax
jmp 0x10019c62
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10019612
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x10019e3c
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x10019c43
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
invalid
dec edi
Function at 0x1001a5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1001962b
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
Function at 0x1001b255
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.100195be
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x1001b5c5
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.1001964d
loop 0x1001b631
mov al, 7
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1001b630
lea eax, [ebp - 0x714]
push eax
call fcn.1001965d
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10019612
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x1001b630
jmp 0x1001afef
cmp dword [ebp - 0x37c], 0
je 0x1001b63e
mov ebp, 0xfffffc84
add byte [ebp + eax - 0x17], dh
mov ch, 0
add byte [eax], al
jmp 0x1001b6f3
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x1001b697
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1001b69c
jmp 0x1001afef
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1001b6e3
lea eax, [ebp - 0x714]
push eax
call fcn.1001965d
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10019612
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1001b6ee
jmp 0x1001b6f3
jmp 0x1001afef
cmp dword [ebp - 0x37c], 0
jne 0x1001b79d
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10019829
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x1001b789
lea eax, [ebp - 0x714]
push eax
call fcn.1001965d
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.100196f2
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
Function at 0x1001d272
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003e500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10016f81
and dword [ebp - 0x14], 0
cmp dword [0x10040300], 0
mov dword [ebp - 0x18], eax
jne 0x1001d325
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1001d3cd
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1001d3cd
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10040300], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10040304], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10040308], eax
call edi
push eax
call esi
mov dword [0x10040310], eax
test eax, eax
je 0x1001d325
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1004030c], eax
mov eax, dword [0x1004030c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1001d37e
cmp dword [0x10040310], ecx
je 0x1001d37e
push eax
call esi
push dword [0x10040310]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1001d37e
test ebx, ebx
je 0x1001d37e
call edi
test eax, eax
je 0x1001d375
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1001d375
test byte [ebp - 8], 1
jne 0x1001d37e
or dword [ebp + 0x10], 0x200000
jmp 0x1001d3b1
mov eax, dword [0x10040304]
cmp eax, dword [ebp - 0x18]
je 0x1001d3b1
push eax
call esi
test eax, eax
je 0x1001d3b1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001d3b1
mov eax, dword [0x10040308]
cmp eax, dword [ebp - 0x18]
je 0x1001d3b1
push eax
call esi
test eax, eax
je 0x1001d3b1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10040300]
call esi
test eax, eax
je 0x1001d3cd
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1001d3cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d15f
leave
ret
Function at 0x40167e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2d13054]
sub esp, 0x400
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x2d12a4c]
test esi, esi
je 0x4016c9
cmp eax, 0x959
jne 0x4016b5
push 0
lea eax, [ebp - 0x400]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.00401481
add edi, 8
dec esi
je 0x4016c9
mov eax, dword [0x2d13054]
jmp 0x40169d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40d7a6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404d65
mov dword [ebp - 0x14], eax
cmp dword [0x43a168], esi
jne 0x40d899
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d826
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d979
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d979
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d979
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43a168], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43a16c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43a170], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43a178], eax
test eax, eax
je 0x40d896
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43a174], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d8be
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d8b1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d8d3
push 4
pop eax
jmp 0x40d97b
cmp dword [ebp - 0x14], esi
je 0x40d8d3
push dword [0x43a168]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d8b8
mov eax, dword [0x43a174]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d931
cmp dword [0x43a178], edi
je 0x40d931
push eax
call ebx
push dword [0x43a178]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d931
test eax, eax
je 0x40d931
call ecx
test eax, eax
je 0x40d926
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d926
test byte [ebp - 8], 1
jne 0x40d931
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d961
mov eax, dword [0x43a16c]
cmp eax, edi
je 0x40d95e
push eax
call ebx
test eax, eax
je 0x40d95e
call eax
mov esi, eax
test esi, esi
je 0x40d95e
mov eax, dword [0x43a170]
cmp eax, edi
je 0x40d95e
push eax
call ebx
test eax, eax
je 0x40d95e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43a168]
call ebx
test eax, eax
je 0x40d979
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d97b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fd7
mov esp, ebp
pop ebp
ret
Function at 0x55e5d8
Capabilities:
Encode data using xor

Disassembly:
xor edi, dword [ebp + 0x74]
and bl, bl
inc ebp
or esi, dword [ecx + 1]
invalid

Function at 0x5e1c18
Capabilities:
Encode data using xor

Disassembly:
push edx
aam 0x73
fld qword [ebx + 0x52b518c1]
sub dh, al
dec esp
mov dh, 0x28
push ebx
mov ebx, 0xad9bd195
wait
lodsd eax, dword [esi]
imul esi, edi, 0xffffff94
push esi
arpl word [edi - 0x417bf39e], bx
inc ebp
std
xor al, 0x31
rol byte [ebx + 0x1a], 0xab
jo 0x5e1c2a
push ds
sub bl, byte [edi]
ja 0x5e1c98
inc ebx
jg 0x5e1c73
mov dword [0xd05b08c9], eax
leave
or byte [ebx - 0x30], bl
fsub st(1), st(0)
fist dword [ebp + 0x4b]
cmp edi, dword [eax + 0x1222dbdb]
hlt
mov esi, 0xf255532b
sbb dword [ebx + ebx*8 - 0x6e], 0x53
mov edx, 0x3c6bfbd3
mov bh, 0x25
arpl word [ebp - 0x1d], cx
in al, 0x87
invalid
and bh, ah
xor al, 0x2c
mov bl, 0xd2
mov esi, 0xa3ab3c3c
aad 0xc8
rcl bl, cl
shr byte [edx + ecx*8 + 0x57], 0x38
mov esp, 0x1d8fc3a3
jno 0x5e1cbf
cmp al, 0xab
mov dword [0xd2c8d53e], eax
rol eax, cl
insb byte es:[edi], dx
retf 0x3857
outsd dx, dword [esi]
outsd dx, dword [esi]
dec ebp
int 0x20
jl 0x5e1c4b
sub eax, 0xed6cad26
in eax, dx
outsd dx, dword [esi]
xlatb
imul ebx, dword [ebp - 0x20], 0x63bad116
pop ecx
and ebx, dword [ebp - 0x657b43c9]
adc dl, byte [ebx - 0x3e]
dec edi
int 0x13
test ch, bh
sub bh, ch
jno 0x5e1ca0
pushfd
fxch st(6)
lea esp, [ebx + 0x3b5e312e]
xchg ebx, eax
salc
pop ds
jge 0x5e1c9e
jmp 0x5e1c9e
Function at 0x402e00
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7db0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x19
xor eax, eax
mov dword [ebp - 0x3c], 0
push str.RCMainFrameWndPicDesigner
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
call fcn.004036d0
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
lea ecx, [ebp - 0x34]
push dword [ebp - 0x3c]
cmovae eax, dword [ebp - 0x4c]
push eax
call fcn.004036d0
lea eax, [ebp - 0x34]
push eax
push 0x402fc0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x18]
xor esi, esi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x402ed6
mov edi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0
push 0xbb8
push 3
push 0
push 0
push 0x10
push dword [ecx + esi*4]
call edi
mov eax, dword [ebp - 0x18]
inc esi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x402eb2
test ecx, ecx
je 0x402f1f
mov edx, dword [ebp - 0x14]
mov eax, ecx
sub edx, ecx
and edx, 0xfffffffc
cmp edx, 0x1000
jb 0x402f00
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402fa6
push edx
push ecx
call fcn.00494840
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x402f55
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402f4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402fab
push edx
push ecx
call fcn.00494840
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x402f8b
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402f81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402fb0
push edx
push ecx
call fcn.00494840
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004947ff
mov esp, ebp
pop ebp
ret
call fcn.00498949
call fcn.00498949
call fcn.00498949
int3
Function at 0x405700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7f68
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00403350
test al, al
je 0x405740
xor al, al
jmp 0x405876
push esi
lea ecx, [ebp - 0x2c]
call fcn.00403500
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push 4
push eax
call fcn.00408990
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00403360
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x405863
lea ecx, [ebp - 0x44]
call fcn.004034e0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040fd60
test al, al
je 0x4057a2
lea ecx, [ebp - 0x44]
call fcn.00403360
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00403400
cmp esi, 0xffffffff
jne 0x405863
lea ecx, [ebp - 0x2c]
call fcn.004036c0
cmp eax, 2
jbe 0x40585f
lea ecx, [ebp - 0x2c]
call fcn.004036c0
lea ecx, [ebp - 0x2c]
lea ebx, [eax - 1]
call fcn.00403630
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x4057e7
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x405806
lea ecx, [ebp - 0x2c]
call fcn.004036c0
cmp dword [esi + 0x14], 8
jb 0x4057fe
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x40585f
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.00408990
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00403360
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x405863
lea ecx, [ebp - 0x44]
call fcn.004034e0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040fd60
test al, al
je 0x40584e
lea ecx, [ebp - 0x44]
call fcn.00403360
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00403400
cmp esi, 0xffffffff
jne 0x405863
xor bl, bl
jmp 0x405865
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004947ff
mov esp, ebp
pop ebp
ret
Function at 0x4058a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7f68
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00403350
test al, al
je 0x4058e0
xor al, al
jmp 0x405a1c
push esi
lea ecx, [ebp - 0x2c]
call fcn.00403500
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push 4
push eax
call fcn.00408990
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00403360
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40594f
lea ecx, [ebp - 0x44]
call fcn.004034e0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040fd60
test al, al
je 0x40593e
lea ecx, [ebp - 0x44]
call fcn.00403360
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00403400
cmp ebx, 0xffffffff
je 0x405958
test bl, 0x10
je 0x405a09
lea ecx, [ebp - 0x2c]
call fcn.004036c0
cmp eax, 2
jbe 0x405a05
lea ecx, [ebp - 0x2c]
call fcn.004036c0
lea ecx, [ebp - 0x2c]
lea ebx, [eax - 1]
call fcn.00403630
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x405988
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x4059a7
lea ecx, [ebp - 0x2c]
call fcn.004036c0
cmp dword [esi + 0x14], 8
jb 0x40599f
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x405a05
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.00408990
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00403360
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x405a00
lea ecx, [ebp - 0x44]
call fcn.004034e0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040fd60
test al, al
je 0x4059ef
lea ecx, [ebp - 0x44]
call fcn.00403360
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00403400
cmp ebx, 0xffffffff
je 0x405a05
test bl, 0x10
je 0x405a09
xor bl, bl
jmp 0x405a0b
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004947ff
mov esp, ebp
pop ebp
ret
Function at 0x405a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00403350
test al, al
je 0x405a7f
xor al, al
jmp 0x405b0a
push esi
lea ecx, [ebp - 0x28]
call fcn.00403500
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 4
push eax
call fcn.00408990
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.00403360
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x405aee
lea ecx, [ebp - 0x40]
call fcn.004034e0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040fd60
test al, al
je 0x405add
lea ecx, [ebp - 0x40]
call fcn.00403360
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00403400
cmp ebx, 0xffffffff
je 0x405af7
test bl, 0x10
je 0x405af7
mov bl, 1
jmp 0x405af9
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004947ff
mov esp, ebp
pop ebp
ret