joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dcd0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4fc
mov ebx, edx
mov edi, ecx
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.004eac00
add esp, 0xc
mov ecx, esi
push ebx
push 3
push 0
push edi
call fcn.0045dfd0
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.0045e150
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x45dd37
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x45de34
mov dword [ebp - 0x508], ebx
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.004eac00
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0045e110
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x45de3c
mov ecx, ebx
call fcn.0045df00
test al, al
jne 0x45de93
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x45dd9e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45de38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x45ddc1
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00411560
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0045e150
lea ecx, [ebp - 0x500]
push ebx
call fcn.0046a1e0
mov ecx, ebx
call fcn.004b73c0
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x45ddfd
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x45dd4d
lea ecx, [ebp - 0x500]
call fcn.004b73c0
lea ecx, [ebp - 0x2a4]
call fcn.0045e0a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
add esp, 0x4fc
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x45de07
xor esi, esi
jmp 0x45ddc1
cmp byte [ebp + 8], 0
jne 0x45de6c
lea ecx, [ebp - 0x4f4]
call fcn.0045df00
test al, al
je 0x45de66
lea ecx, [ebp - 0x4f4]
call fcn.0045df00
test al, al
je 0x45dd89
jmp 0x45de38
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x45de7d
lea ecx, [ebp - 0x500]
jmp 0x45de83
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x45dd7a
xor esi, esi
cmp byte [ebp + 8], 0
je 0x45ddc1
lea ecx, [ebp - 0x500]
mov dword [ebp - 0x504], ecx
mov edx, dword [ebp - 0x508]
push 1
call fcn.0045dcd0
add esp, 4
mov esi, eax
test eax, eax
jne 0x45ddc1
cmp byte [ebp - 0x4f5], 0
jns 0x45deda
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x504], eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x45ddc1
jmp 0x45ddad
Function at 0x45f4b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0xc], edx
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [esp + 0xa8], eax
xor ebx, ebx
test ecx, ecx
je 0x45f62a
push ebx
push ebx
push ecx
mov dword [esp + 0x1c], ecx
call fcn.004ffe59
add esp, 0xc
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x30]
push 0x48
push str....._base_files_file_util.cc
push str.ReadStreamToSpanWithMaxSize
push edi
call fcn.004b6790
add esp, 0x10
mov ecx, esi
push ebx
push edi
call fcn.004aabe0
mov dword [edi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
push dword [esp + 0x10]
call fcn.004f8de6
add esp, 4
push eax
call fcn.004f8e3a
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x45f642
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x50]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 0xc]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x28]
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea ecx, [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
call dword [0x5798d8]
mov eax, dword [esp + 0x20]
push edi
push eax
push ebx
mov dword [esp + 0x24], ecx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 0x10]
push edi
push 1
push eax
call fcn.004ffb69
add esp, 0x10
test eax, eax
je 0x45f5e8
mov ebx, eax
mov eax, dword [esp + 0xc]
sub eax, esi
cmp eax, ebx
jb 0x45f64c
add ebx, esi
push dword [esp + 0x10]
call fcn.004ff4df
add esp, 4
test eax, eax
je 0x45f654
mov esi, ebx
push dword [esp + 0x10]
call fcn.004ff50b
add esp, 4
test eax, eax
sete bl
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x5798d8]
mov eax, dword [esp + 0xa4]
lea edx, [esp + 0x20]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.004aac50
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.004e71b0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x45f572
xor ebx, ebx
mov esi, dword [esp + 0xc]
jmp 0x45f5f9
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x5798d8]
mov eax, dword [esp + 0xa4]
lea esi, [esp + 0x20]
push dword [esp + 0x1c]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov esi, ebx
jmp 0x45f5b2
Function at 0x465ad0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
movsx edi, byte [edx + 0xb]
test edi, edi
jns 0x465ae9
mov edi, dword [edx + 4]
mov edx, dword [edx]
mov eax, edi
mov dword [ebp - 0x1c], edx
mov esi, edi
mov dword [ebp - 0x14], edi
cmp edi, 4
jb 0x465b26
mov eax, dword [ebp - 0x14]
mov esi, eax
mov edx, dword [ebp - 0x1c]
imul edi, dword [edx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x465b00
mov ebx, dword [ebp + 8]
cmp esi, 2
je 0x465b5b
cmp esi, 3
je 0x465b52
cmp esi, 1
mov edi, dword [ebp - 0x14]
je 0x465b67
mov esi, dword [ecx + 4]
xor edx, edx
test esi, esi
jne 0x465b74
mov dword [ebx], edx
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x465b3b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edx, eax
shr edx, 0xf
xor edx, eax
mov dword [ebp - 0x18], edx
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
mov eax, dword [ebp - 0x18]
ja 0x465c84
lea edx, [esi - 1]
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x465c7d
mov ecx, dword [eax]
test ecx, ecx
je 0x465c7d
lea eax, [esi - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ecx + 4]
cmp eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
jne 0x465c53
movzx eax, byte [ecx + 0x13]
test al, al
mov ecx, dword [ecx + 0xc]
mov edx, eax
cmovs edx, ecx
cmp edx, edi
jne 0x465c70
test al, al
jns 0x465c34
push ecx
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
push dword [eax + 8]
call fcn.004e8ffd
add esp, 0xc
test eax, eax
jne 0x465c70
mov edx, dword [ebp - 0x10]
jmp 0x465b44
test eax, eax
je 0x465c2c
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ecx + 8]
mov edi, dword [ebp - 0x1c]
cmp dl, byte [edi + ecx]
mov edi, dword [ebp - 0x14]
jne 0x465c70
inc ecx
cmp eax, ecx
jne 0x465c3a
jmp 0x465c2c
cmp dword [ebp - 0x28], 1
jbe 0x465c65
cmp eax, esi
jb 0x465c68
xor edx, edx
div esi
mov eax, edx
jmp 0x465c68
and eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x14]
jne 0x465c7d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x465bf5
xor edx, edx
jmp 0x465b44
mov edx, eax
cmp eax, esi
jb 0x465bd5
mov eax, dword [ebp - 0x18]
xor edx, edx
div esi
jmp 0x465bd5
Function at 0x468130
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call fcn.004681f0
mov eax, dword [esi]
mov dword [0x581198], eax
test al, 1
jne 0x46814c
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [0x58608c]
test eax, eax
je 0x468176
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x58608c], 0
cmp dword [0x586090], 0
jne 0x468176
and byte [0x581198], 0xfe
mov eax, dword [esi + 0x10]
test eax, eax
je 0x468184
mov dword [0x58608c], eax
jmp 0x468147
mov ecx, dword [0x586090]
test ecx, ecx
jne 0x4681ad
push 0xc
call fcn.004e6c0e
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x586090], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4681db
push eax
call fcn.004543a0
cmp dword [esi + 0xc], 0
jne 0x4681d4
mov eax, dword [0x586090]
cmp byte [eax + 0xb], 0
jns 0x4681cd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
jmp fcn.00537430
push str....._third_partylibc_srcinclude_string:2719:_assertion___s___nullptr_failed:_string::assign_received_nullptr_n
push 0x55eb93
call fcn.00516c70
int3
Function at 0x46c090
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.004ad0f0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x46c0be
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x46c0dc
push dword [ebp - 0x1c]
call fcn.004e6c3e
add esp, 4
cmp dword [ebp + 8], 0
je 0x46c177
test esi, esi
je 0x46c177
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.004e6c73
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, edi
lea edi, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.004ad0f0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x46c11e
mov edi, dword [ebp - 0x1c]
push esi
mov ebx, dword [ebp - 0x20]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x46c13b
push dword [ebp - 0x1c]
call fcn.004e6c3e
add esp, 4
test ebx, ebx
mov edi, dword [ebp + 8]
je 0x46c190
push ebx
call fcn.00502114
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push ebx
push ecx
call fcn.004ad120
add esp, 0xc
cmp byte [edi + 0xb], 0
js 0x46c19f
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [edi], xmm0
push ebx
call fcn.004e6c7c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
push 0x55eb93
call fcn.00516c70
push dword [edi]
call fcn.004e6c3e
add esp, 4
jmp 0x46c15f

Function at 0x46c580
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x58611c]
test ebx, ebx
jne 0x46c604
push 0x28
call fcn.004e6c0e
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.004e6c0e
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x46c60e
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x58611c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x46c615
mov edi, eax
push eax
call fcn.00502114
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0046c630
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
jmp 0x46c61a
push str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
push 0x55eb93
call fcn.00516c70
int3
Function at 0x46c630
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x57f040]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.00459520
add esp, 0x10
mov eax, dword [ebx + 4]
test eax, eax
je 0x46c781
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x800
mov dword [ebp - 0x24], 0
push eax
push 0x57046c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x28], eax
je 0x46c7b3
push 0x5704bc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46c6b9
mov ecx, eax
call dword [0x5798d8]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
test esi, esi
je 0x46c720
mov dword [ebp - 0x2c], edi
cmp esi, 0x15555556
jae 0x46c7ab
shl esi, 2
lea ebx, [esi + esi*2]
push ebx
call fcn.004e6c0e
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
add eax, ebx
mov dword [ebp - 0x18], eax
xor ebx, ebx
test edi, edi
je 0x46c79c
mov ecx, edi
mov eax, dword [ebp - 0x24]
push dword [eax + ebx]
call fcn.00412a10
add edi, 0xc
add ebx, 4
cmp esi, ebx
jne 0x46c6f8
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x2c]
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.0046c3b0
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x46c746
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x46c781
mov edi, dword [ebp - 0x1c]
cmp edi, esi
je 0x46c778
add edi, 0xfffffff4
jmp 0x46c76c
push dword [edi]
call fcn.004e6c3e
add esp, 4
lea eax, [edi - 0xc]
cmp edi, esi
mov edi, eax
je 0x46c778
test edi, edi
je 0x46c795
cmp byte [edi + 0xb], 0
js 0x46c759
jmp 0x46c763
push esi
call fcn.004e6c3e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
jmp 0x46c7a1
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x55eb93
call fcn.00516c70
lea ecx, [ebp - 0x20]
call fcn.005161e0
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x46c6b6
Function at 0x471110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x47123c
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x5798d8]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x5798d8]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x5798d8]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x4711e1
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x4711d5
push 1
call fcn.004bc550
add esp, 4
bt eax, 0x19
jae 0x471240
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403500
add esp, 0xc
mov eax, 0x401d10
mov ecx, 0x401180
lea edx, [ebp - 0x20]
mov edi, dword [ebp - 0x44]
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edx]
movups xmmword [edi], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x471228
bt eax, 9
jae 0x471261
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00404020
add esp, 0xc
xor eax, eax
mov ecx, 0x4040d0
jmp 0x47120d
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.0053c580
add esp, 0xc
mov eax, 0x53cd10
mov ecx, 0x53c490
jmp 0x47120d
Function at 0x471490
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x47156c
cmp dword [esi], 0
jne 0x47156c
cmp dword [esi + 0xc], 0
jne 0x47156c
xor eax, eax
cmp dword [esi + 4], 0
jne 0x47156c
mov ebx, dword [edi]
cmp eax, ebx
je 0x4714f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x471552
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4714e9
mov dword [esi], ebx
call fcn.004b67c0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x471526
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x471539
lea eax, [ebx + 1]
cmp eax, 2
jb 0x47151c
mov dword [esi + 4], ebx
call fcn.004b67c0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004b67c0
push dword [esi + 4]
call fcn.004a4410
add esp, 4
mov dword [esi + 4], 0
jmp 0x47150c
call fcn.004b67c0
push dword [esi]
call fcn.004a4410
add esp, 4
mov dword [esi], 0
jmp 0x4714da
mov ecx, esi
call fcn.0049fdd0
lea ecx, [esi + 4]
call fcn.0049fdd0
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi]
jmp 0x4714c4
Function at 0x481380
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x57f040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x4813b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x4814c0
push 0
push eax
push 0x481360
push 0x59205c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4814b8
cmp dword [0x592060], 0
jne 0x48139c
push dword [0x592064]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48139c
mov esi, eax
mov eax, 0x592068
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x59206c]
mov ebx, dword [0x592070]
mov eax, dword [0x592074]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x592078]
mov dword [ebp - 0x20], eax
mov eax, dword [0x59207c]
mov dword [ebp - 0x24], eax
mov eax, 0x592068
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x48149e
test ebx, ebx
jne 0x48148b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x481456
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x481467
test ebx, ebx
jne 0x481478
push esi
call fcn.004ba990
add esp, 4
jmp 0x48139c
mov edi, dword [esi + 8]
call dword [0x5798d8]
push edi
call ecx
add esp, 4
jmp 0x48143a
mov edi, dword [esi + 0xc]
call dword [0x5798d8]
push edi
call ecx
add esp, 4
jmp 0x481444
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x5798d8]
push edi
call ebx
add esp, 4
jmp 0x481448
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x5798d8]
push edi
call ebx
add esp, 4
jmp 0x481433
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x5798d8]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x48142f
call fcn.004fb0c0
int3
Function at 0x4814e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x57f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x4814c0
push 0
push eax
push 0x481360
push 0x59205c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4815a8
mov esi, dword [ebp + 0xc]
cmp dword [0x592060], 0
jne 0x4815b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x592064]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x48156b
push 0x14
push 1
call fcn.004baa30
add esp, 8
test eax, eax
je 0x4815b6
mov edi, eax
push eax
push dword [0x592064]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4815ad
mov ebx, dword [ebp + 8]
mov esi, 0x592068
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x59206c], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e71b0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004fb0c0
push edi
call fcn.004ba990
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x5798d8]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x481594