joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050a8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.00434c80
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
neg eax
push 0x10
sbb al, al
and byte [ebp - 0x1004], al
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.004038ee
dec eax
push eax
lea eax, [ebp - 0x1040]
push eax
call fcn.00403189
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
call fcn.00434b58
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40516b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
sete byte [0x49488c]
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [0x494894], eax
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x4059df
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop esi
pop ebp
ret
Function at 0x40702d
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x407053
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x40703f
pop esi
mov eax, ecx
ret

Function at 0x4084ea
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub esp, 0x54
push 0x40
mov eax, 0x459dcc
call fcn.00434ba0
mov ebx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x64]
push dword [ebp + 0x54]
and dword [ebp - 4], 0
lea ecx, [ebp + 0x4c]
push eax
call fcn.00407b45
push dword [ebp + 0x54]
lea eax, [ebp + 0x68]
sub esp, 0x38
mov edi, esp
sub esp, 0x10
mov esi, esp
mov ecx, esi
mov dword [ebp + 0x54], esi
push eax
call fcn.004088f9
push dword [ebp + 0x50]
mov eax, dword [ebp + 0x74]
mov ecx, edi
push dword [ebp + 0x4c]
mov dword [esi + 0xc], eax
call fcn.00407aa5
lea eax, [ebp - 0x4c]
push eax
call fcn.0040e010
add esp, 0x40
push dword [ebp + 0x54]
xor ecx, ecx
mov byte [ebp - 4], 1
sub esp, 0x38
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], 1
lea eax, [ebp]
push eax
call fcn.0040e010
mov ecx, esp
mov dword [ebp + 0x54], esp
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
mov dword [ebp + 0x50], ecx
call fcn.00408932
sub esp, 0x40
mov byte [ebp - 4], 3
mov ecx, esp
lea eax, [ebp - 0x4c]
mov dword [ebp + 0x50], ecx
push eax
call fcn.00408932
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 2
call fcn.0040da8b
lea eax, [ebp + 0x40]
mov ecx, ebx
push eax
call fcn.0040780d
lea ecx, [ebp + 0x40]
call fcn.004073fd
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.00408d8b
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call fcn.00408d8b
lea ecx, [ebp + 0x68]
call fcn.00408ac1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x58]
pop ebp
ret
Function at 0x40df09
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub esp, 0x54
push 0x40
mov eax, 0x459dcc
call fcn.00434ba0
mov ebx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x64]
push dword [ebp + 0x54]
and dword [ebp - 4], 0
lea ecx, [ebp + 0x4c]
push eax
call fcn.00407b45
push dword [ebp + 0x54]
lea eax, [ebp + 0x68]
sub esp, 0x38
mov edi, esp
sub esp, 0x10
mov esi, esp
mov ecx, esi
mov dword [ebp + 0x54], esi
push eax
call fcn.004088f9
push dword [ebp + 0x50]
mov eax, dword [ebp + 0x74]
mov ecx, edi
push dword [ebp + 0x4c]
mov dword [esi + 0xc], eax
call fcn.0040da1a
lea eax, [ebp - 0x4c]
push eax
call fcn.0040e010
add esp, 0x40
push dword [ebp + 0x54]
xor ecx, ecx
mov byte [ebp - 4], 1
sub esp, 0x38
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], 1
lea eax, [ebp]
push eax
call fcn.0040e010
mov ecx, esp
mov dword [ebp + 0x54], esp
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
mov dword [ebp + 0x50], ecx
call fcn.00408932
sub esp, 0x40
mov byte [ebp - 4], 3
mov ecx, esp
lea eax, [ebp - 0x4c]
mov dword [ebp + 0x50], ecx
push eax
call fcn.00408932
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 2
call fcn.0040da8b
lea eax, [ebp + 0x40]
mov ecx, ebx
push eax
call fcn.0040780d
lea ecx, [ebp + 0x40]
call fcn.004073fd
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.00408d8b
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call fcn.00408d8b
lea ecx, [ebp + 0x68]
call fcn.00408ac1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x58]
pop ebp
ret
Function at 0x40ed52
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4596a4
call fcn.00434bd4
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40ee52
cmp byte [ebx + 0x3d], 0
je 0x40ee52
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x40ed8c
xor al, al
jmp 0x40ee54
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0040f4f5
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40edea
sub eax, 1
je 0x40edee
dec eax
sub eax, 1
je 0x40ee40
xor bl, bl
jmp 0x40ee42
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x40ee26
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0043e7cd
add esp, 0x10
cmp esi, eax
jne 0x40ede6
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x40ee40
test esi, esi
jne 0x40edb0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040745e
jmp 0x40edaa
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00404938
mov al, bl
jmp 0x40ee54
mov al, 1
call fcn.00434b7e
ret
Function at 0x416632
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x250
lea ebp, [esp - 4]
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp + 0x250], eax
push 0x18
mov eax, 0x45aa42
call fcn.00434ba0
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x25c]
xor ebx, ebx
push ecx
push dword [eax]
mov dword [ebp - 0x1c], ecx
call fcn.00416f38
mov edi, eax
mov dword [ebp - 0x10], edi
push 0x4765c4
push edi
mov dword [ebp - 4], ebx
call fcn.00416f38
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x20], esi
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004178dd
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.0040665e
push esi
call fcn.0043a29c
or dword [ebp - 4], 0xffffffff
push edi
call fcn.0043a29c
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x416766
push 0x2e
pop ecx
cmp word [ebp + 0x2c], cx
jne 0x4166e9
cmp word [ebp + 0x2e], 0
je 0x416744
cmp word [ebp + 0x2e], cx
jne 0x4166e9
cmp word [ebp + 0x30], 0
je 0x416744
lea eax, [ebp + 0x2c]
push eax
call fcn.004174e0
mov edi, eax
mov dword [ebp - 0x20], edi
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.00416f38
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x24], esi
test byte [ebp], 0x10
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
push esi
je 0x416724
call fcn.00416632
jmp 0x416729
call fcn.0041695a
push esi
mov ebx, eax
call fcn.0043a29c
or dword [ebp - 4], 0xffffffff
push edi
call fcn.0043a29c
pop ecx
pop ecx
test ebx, ebx
jne 0x41675d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
push 0x2e
test eax, eax
mov eax, dword [ebp - 0x10]
pop ecx
jne 0x4166cf
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.00434b58
lea esp, [ebp + 0x254]
pop ebp
ret 4
Function at 0x4167e8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x250
lea ebp, [esp - 4]
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp + 0x250], eax
push 0xc
mov eax, 0x45aa72
call fcn.00434ba0
mov eax, ecx
mov dword [ebp - 0x14], eax
push str.TMP.
push dword [eax]
call fcn.00416f38
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push esi
call fcn.004178dd
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0040665e
push esi
call fcn.0043a29c
pop ecx
cmp ebx, 0xffffffff
je 0x4168bd
push 0x2e
pop eax
cmp word [ebp + 0x2c], ax
jne 0x416871
cmp word [ebp + 0x2e], 0
je 0x4168a4
cmp word [ebp + 0x2e], ax
jne 0x416871
cmp word [ebp + 0x30], 0
je 0x4168a4
test byte [ebp], 0x10
jne 0x4168a4
lea eax, [ebp + 0x2c]
push eax
call fcn.004174e0
mov edi, eax
mov eax, dword [ebp - 0x14]
push edi
push dword [eax]
call fcn.00416f38
mov esi, eax
push esi
call fcn.0041678d
push esi
call fcn.0043a29c
push edi
call fcn.0043a29c
add esp, 0x18
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x416857
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.00434b58
lea esp, [ebp + 0x254]
pop ebp
ret

Function at 0x416a85
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
jne 0x416abf
xor al, al
jmp 0x416ad4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434b58
mov esp, ebp
pop ebp
ret

Function at 0x41718d
Capabilities:
Move file

Disassembly:
sub esp, 0x414
mov eax, dword [0x48d0e4]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
lea ecx, [esp + 0x208]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x428]
mov ebx, 0x104
push ebx
push ecx
push 0xffffffffffffffff
push eax
push 0
mov ebp, 0xfde9
push ebp
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
jne 0x4171d9
xor al, al
jmp 0x41720a
push ebx
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
je 0x4171d5
push 3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x41c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434b58
add esp, 0x414
ret
Function at 0x41739a
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 0x104
push ecx
push 0xffffffffffffffff
push eax
xor edi, edi
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
jne 0x4173db
push 0xa
pop eax
jmp 0x417455
push esi
push edi
push 0x80
push 2
push edi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x417412
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 0x20
neg eax
sbb eax, eax
add eax, 0xe
jmp 0x417454
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x41743d
cmp dword [ebp - 0x210], edi
jne 0x41743d
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x417454
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0xc
pop eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00434b58
mov esp, ebp
pop ebp
ret

Function at 0x41770d
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
xor ebx, ebx
test eax, eax
je 0x41774d
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x41774d
xor al, al
jmp 0x417798
push esi
push 0xd7
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x417749
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x417762
push dword [ebp - 8]
sub ecx, edx
push dword [ebp - 0xc]
sar ecx, 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
lea eax, [esi + ecx*2]
push str.spot__.8X_.8X_.8X_.8X.tmp
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00434b58
mov esp, ebp
pop ebp
ret
Function at 0x4177a8
Capabilities:
Get file size

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
push esi
push edi
push 0x104
mov esi, ecx
xor edi, edi
lea ecx, [ebp - 0x78]
push ecx
push 0xffffffffffffffff
push eax
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
je 0x417848
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x417848
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x417848
cmp dword [ebp - 0x7c], edi
ja 0x417848
jb 0x41782e
cmp eax, 0x7fffffff
ja 0x417848
push edi
push eax
push dword [esi + 8]
mov ecx, esi
call fcn.004175fc
test al, al
je 0x417848
mov ecx, dword [ebp - 0x80]
mov al, 1
mov dword [esi + 0xc], ecx
jmp 0x41784a
xor al, al
mov ecx, dword [ebp + 0x190]
pop edi
xor ecx, ebp
pop esi
call fcn.00434b58
lea esp, [ebp + 0x194]
pop ebp
ret 4

Function at 0x4179e0
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x45ab46
call fcn.00434ba0
mov esi, ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004178dd
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.004178dd
cmp dword [esi], ebx
je 0x417a44
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x417a13
sub ecx, edx
xor ebx, ebx
sar ecx, 1
inc ebx
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0xc]
push ebx
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x417a44
xor ebx, ebx
push dword [ebp + 8]
call fcn.00434b53
push dword [ebp + 0xc]
call fcn.00434b53
pop ecx
pop ecx
mov al, bl
call fcn.00434b69
ret 8
Function at 0x419505
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
push esi
mov esi, dword [esp + 0x20]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x419525
xor eax, eax
jmp 0x41967f
add dword [esp + 0x20], 5
lea ecx, [eax - 4]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
or ebp, 0xffffffff
add ecx, ebx
mov dword [esp + 0x10], ecx
lea edx, [edi + ebx]
jmp 0x41954a
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x41954e
inc edx
cmp edx, ecx
jb 0x419541
mov edi, edx
sub edi, ebx
cmp edx, ecx
jae 0x419661
mov ecx, edi
sub ecx, ebp
cmp ecx, 3
jbe 0x419586
xor esi, esi
mov al, byte [edx + 4]
mov ebp, edi
mov dword [esp + 0x18], ebp
test al, al
je 0x4195c1
cmp al, 0xff
je 0x4195c1
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x41965a
dec ecx
shl esi, cl
and esi, 7
je 0x419565
movzx eax, byte [esi + 0x476614]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x47660c], 0
mov al, byte [ecx + 4]
je 0x4195ad
test al, al
je 0x4195ad
cmp al, 0xff
jne 0x419565
and esi, 3
mov ebp, edi
add esi, esi
or esi, 1
inc edi
mov ecx, dword [esp + 0x10]
jmp 0x41953c
mov ebp, dword [esp + 0x28]
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
shl ebx, 8
or ebx, eax
cmp dword [esp + 0x30], 0
je 0x4195f0
add ebx, edi
add ebx, ebp
jmp 0x4195f4
sub ebx, edi
sub ebx, ebp
mov dword [esp + 0x24], ebx
test esi, esi
je 0x41962e
movzx eax, byte [esi + 0x476614]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [esp + 0x14], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x41961b
cmp al, 0xff
jne 0x41962e
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [esp + 0x14]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [esp + 0x24]
jmp 0x4195e3
mov ebp, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
and al, 1
mov byte [edx + 1], bl
dec al
not al
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [esp + 0x20]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
add edi, eax
jmp 0x4195b8
mov edx, edi
xor eax, eax
sub edx, ebp
pop ebp
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp edx, 3
cmova esi, eax
mov eax, dword [esp + 0x24]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x41d40b
Capabilities:
Check if file exists

Disassembly:
push 0x290
mov eax, 0x45af72
call fcn.00434bd4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.00406562
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41d48c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x41d485
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x2f
je 0x41d485
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x3a
jne 0x41d48c
mov eax, 0x4767f8
jmp 0x41d491
mov eax, 0x4767f0
push eax
mov dword [ebp - 0x294], eax
call fcn.0041c7ca
pop ecx
push eax
push dword [ebp - 0x294]
lea ecx, [ebp - 0x28]
call fcn.0041bb05
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ecx, dword [ebp - 0x298]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x41d4fe
and dword [ecx], 0
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
cmp eax, 2
je 0x41d4f0
call edi
cmp eax, 0x12
je 0x41d4f0
call edi
mov edi, eax
jmp 0x41d4f2
xor edi, edi
call fcn.0041ec0b
mov dword [esi], edi
jmp 0x41d587
lea eax, [ebp - 0x264]
push eax
call fcn.0041c7ca
pop ecx
mov ecx, dword [ebp - 0x29c]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0041bbda
test dword [ebp - 0x290], 0x400
je 0x41d532
and dword [edi], 0
and dword [ebx], 0
jmp 0x41d57f
test byte [ebp - 0x290], 0x10
je 0x41d53f
push 3
jmp 0x41d541
push 2
pop eax
mov dword [edi], eax
lea ecx, [ebp - 0x40]
mov dword [ebx], eax
lea eax, [ebp - 0x264]
push eax
call fcn.0041b72d
push dword [ebp - 0x290]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.0041dbef
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
mov dword [edi + 4], eax
call fcn.0040498b
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
and dword [esi], 0
call fcn.0041ec0b
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [esi + 4], eax
call fcn.0040498b
mov eax, esi
call fcn.00434b7e
ret
Function at 0x41df68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x2c
mov eax, 0x45b1dd
call fcn.00434bd4
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x41df8a
mov eax, dword [edi]
jmp 0x41df8c
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x41dfab
push esi
push edi
push ebx
call fcn.0041de4f
add esp, 0xc
jmp 0x41e07e
test eax, 0x400
je 0x41e041
cmp dword [edi + 0x14], 8
jb 0x41dfc0
mov eax, dword [edi]
jmp 0x41dfc2
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.0041b72d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push 0x2000000
push 3
push ecx
push 7
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0040498b
cmp esi, 0xffffffff
jne 0x41e00a
push dword [ebp - 0x34]
jmp 0x41df9c
push edi
call fcn.0041dacf
pop ecx
test al, al
jne 0x41e033
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.0041dbef
pop ecx
pop ecx
push esi
mov dword [ebx], 9
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x41e07e
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x41e050
and dword [esi], 0
call fcn.0041ec0b
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x41e067
mov dword [ebp - 0x30], 2
call fcn.0041dbef
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
call fcn.00434b7e
ret