joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
test dword [esi + 0x6c], 0x4000
je 0x432e7b
cmp dword [esi + 0x278], 0
je 0x432e6c
push ebx
push edi
push 0
push esi
call fcn.00442ea0
push esi
call fcn.00446780
and dword [esi + 0x6c], 0xffff7fff
add esp, 0xc
xor bl, bl
mov dword [ebp - 0xc], 0x54414449
mov byte [ebp - 8], bl
mov dword [ebp - 0x14], 0x54416466
mov byte [ebp - 0x10], bl
mov dword [ebp - 0x1c], 0x4c546366
mov byte [ebp - 0x18], bl
mov edi, edi
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.004357b0
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00443620
push esi
mov edi, eax
call fcn.00434e90
push 4
lea eax, [esi + 0x11c]
push eax
push esi
call fcn.00442f70
mov eax, dword [esi + 0x11c]
lea edx, [ebp - 0xc]
add esp, 0x24
cmp eax, dword [edx]
jne 0x432dee
test bl, bl
jne 0x432e86
cmp dword [esi + 0x278], 1
ja 0x432e86
push edi
push esi
call fcn.00442ea0
add esp, 8
jmp 0x432d90
lea edx, [ebp - 0x1c]
cmp eax, dword [edx]
jne 0x432e06
push edi
push dword [ebp - 0x24]
push esi
call fcn.00444120
add esp, 0xc
mov bl, 1
jmp 0x432d90
lea edx, [ebp - 0x14]
cmp eax, dword [edx]
jne 0x432e36
push edi
push esi
call fcn.00443590
add esp, 8
test bl, bl
jne 0x432e50
cmp dword [esi + 0x278], 1
jbe 0x432e50
lea eax, [edi - 4]
push eax
push esi
call fcn.00442ea0
add esp, 8
jmp 0x432d90
push str.Skipped__ignored__a_chunk_between_APNG_chunks
push esi
call fcn.004356f0
push edi
push esi
call fcn.00442ea0
add esp, 0x10
jmp 0x432d90
mov ecx, dword [esi + 0x6c]
test ecx, 0x8000
je 0x432e91
lea eax, [edi - 4]
or ecx, 4
pop edi
mov dword [esi + 0x10c], eax
mov dword [esi + 0x6c], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
push str.attempt_to_png_read_frame_head___but_no_acTL_present
push esi
call fcn.004355b0
push str.png_read_frame_head__:_out_of_place_IDAT
push esi
call fcn.004355b0
push str.png_read_frame_head__:_out_of_place_fdAT
push esi
call fcn.004355b0
int3
Function at 0x43c7b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [ebp - 0x18], esi
jne 0x43c7d6
mov eax, 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x43c7db
xor eax, eax
mov byte [esi + 0x1c], al
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
mov eax, dword [ecx + 8]
push 1
push edi
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [ebp - 0xc], ebx
cmp dword [edi + 0x64], ebx
jle 0x43c8d8
lea esp, [esp]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
je 0x43c82d
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 8], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
mov ecx, dword [ebp - 8]
xor ebx, ebx
xor esi, esi
mov edx, eax
nop
cmp esi, edx
jle 0x43c87c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
imul eax, eax, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
mov eax, ecx
cdq
idiv edi
inc ebx
mov edx, eax
cmp esi, edx
jg 0x43c867
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x10]
imul bl
mov byte [esi + ecx], al
inc esi
cmp esi, 0xff
jle 0x43c850
cmp dword [ebp - 4], 0
je 0x43c8bf
mov ebx, dword [ebp - 8]
mov ecx, 1
lea edx, [ebx - 1]
mov edi, edi
movzx eax, byte [ebx]
mov byte [edx], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
lea edx, [edx - 1]
cmp ecx, 0xff
jle 0x43c8a0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x18]
inc ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
jl 0x43c810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441c40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov al, byte [edi + 8]
mov byte [ebp - 0x15], al
cmp al, 3
je 0x441e1b
xor edx, edx
push ebx
mov ebx, dword [edi]
test al, 2
mov eax, dword [ebp + 0x10]
je 0x441ca3
movzx edx, byte [edi + 9]
movzx eax, byte [eax]
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
movzx eax, byte [eax + 1]
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
movzx eax, byte [eax + 2]
sub edx, eax
mov dword [ebp - 0xc], edx
mov ecx, 3
xor edx, edx
jmp 0x441cb5
movzx eax, byte [eax + 3]
movzx ecx, byte [edi + 9]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, 1
test byte [ebp - 0x15], 4
mov dword [ebp - 0x1c], ecx
je 0x441cd8
mov eax, dword [ebp + 0x10]
movzx ecx, byte [edi + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14], ecx
mov ecx, eax
inc ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
jle case.0x441d1d.3
cmp dword [ebp + eax*4 - 0x14], 0
jg 0x441cf3
mov dword [ebp + eax*4 - 0x14], 0
jmp 0x441cf8
mov edx, 1
inc eax
cmp eax, ecx
jl 0x441ce2
test dx, dx
je case.0x441d1d.3
movzx eax, byte [edi + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x441d1d.3
movzx eax, byte [eax + 0x441e40]
jmp dword [eax*4 + 0x441e2c]
mov ecx, dword [edi + 4]
test ecx, ecx
je case.0x441d1d.3
nop
mov al, byte [esi]
shr al, 1
and al, 0x55
mov byte [esi], al
lea esi, [esi + 1]
dec ecx
jne 0x441d30
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov edx, dword [edi + 4]
mov ebx, 0xf0
sar ebx, cl
mov eax, 0xf
sar eax, cl
and bl, 0xf0
or bl, al
test edx, edx
je case.0x441d1d.3
mov al, byte [esi]
shr al, cl
mov ecx, dword [ebp - 0x14]
lea esi, [esi + 1]
and al, bl
mov byte [esi - 1], al
dec edx
jne 0x441d70
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor edi, edi
test ebx, ebx
je case.0x441d1d.3
mov eax, edi
xor edx, edx
div ecx
inc edi
lea esi, [esi + 1]
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x441da0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
imul ebx, ecx
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
test ebx, ebx
je case.0x441d1d.3
movzx edi, byte [esi]
xor edx, edx
div ecx
mov eax, 0x100
imul di, ax
movzx eax, byte [esi + 1]
add di, ax
lea esi, [esi + 1]
lea esi, [esi + 1]
mov cx, word [ebp + edx*4 - 0x14]
shr di, cl
movzx ecx, di
mov eax, ecx
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [ebp - 0x20]
inc eax
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jb 0x441dd8
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
Function at 0x448de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea ecx, [ecx]
mov edx, dword [edi + 0x3c]
sub edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
sub edx, dword [edi + 0x6c]
add eax, 0xfffffefa
add eax, esi
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x448e6c
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.0048cf60
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
add esp, 0xc
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x448e3f
sub eax, esi
jmp 0x448e41
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x448e30
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x448e5f
sub eax, esi
jmp 0x448e61
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x448e50
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x448f21
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x448e99
xor eax, eax
jmp 0x448ee5
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x448eb6
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0044a9b0
jmp 0x448ec6
cmp eax, 2
jne 0x448ecf
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004491a0
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x30], eax
add esp, 0xc
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.0048cf60
mov eax, dword [ebp + 8]
add dword [ebx], eax
add esp, 0xc
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x448f0d
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x448f21
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x448df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4491a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4491ac
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004491c0
Function at 0x44d0f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adc4e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xa
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xa
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 2
mov word [esi + 0x34], 0
test edi, edi
jne 0x44d19c
xor eax, eax
jmp 0x44d1b0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44d1a1
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, esi
call fcn.004040d0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jle 0x44d1c9
push edi
mov ecx, esi
call fcn.0044e5d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x44fc20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea esp, [esp]
push dword [esi + 0x4ec93c]
lea eax, [ebp - 4]
push edi
push eax
call fcn.00401ea0
add esp, 0xc
push dword [eax]
call dword [0x4b42d0]
mov edx, dword [ebp - 4]
test eax, eax
sete bl
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44fc6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x44fc82
add esi, 4
cmp esi, 0x18
jb 0x44fc30
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450430
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae010
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
or esi, 0xffffffff
or ebx, esi
cmp dword [eax - 0xc], 0
mov dword [ebp - 4], 0
je 0x450578
push eax
call dword [0x4b42d0]
test eax, eax
mov eax, dword [ebp + 8]
je 0x450578
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4504b1
lea edx, [ecx - 1]
test edx, edx
js 0x4505b7
cmp edx, ecx
jg 0x4505b7
cmp word [eax + edx*2], 0x5c
je 0x4504b1
push 0x5c
lea ecx, [ebp + 8]
call fcn.004020b0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.00403cb0
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00401cd0
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4504ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0x414
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1e], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x1a], 0
mov edi, dword [eax - 0xc]
xor ecx, ecx
lea esi, [edi + 2]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048bae7
mov ebx, eax
lea eax, [esi + esi]
push eax
push 0
push ebx
call fcn.0048d890
lea eax, [edi + edi]
push eax
push dword [ebp + 8]
push ebx
call fcn.0048cf60
add esp, 0x1c
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 3
call dword [0x4b42c4]
push ebx
mov esi, eax
call fcn.0048bca1
mov eax, dword [ebp + 8]
add esp, 4
or ebx, 0xffffffff
xor ecx, ecx
test esi, esi
sete cl
lea esi, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
mov dword [ebp - 0x14], ecx
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4505a3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x14]
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402400
int3
Function at 0x4507d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae0b1
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x268], eax
call fcn.0041fd60
push dword [esi]
call dword [0x4b42d0]
test eax, eax
je 0x450975
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00402420
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x264], esi
mov ecx, dword [esi - 0xc]
mov dword [ebp - 4], 0
test ecx, ecx
jle 0x450873
lea eax, [ecx - 1]
test eax, eax
js 0x4509a7
cmp eax, ecx
jg 0x4509a7
cmp word [esi + eax*2], 0x5c
je 0x450873
push 0x5c
lea ecx, [ebp - 0x264]
call fcn.004020b0
mov esi, dword [ebp - 0x264]
push 0x4c6cfc
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00401ea0
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x26c]
mov byte [ebp - 4], 1
call dword [0x4b4254]
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x450934
mov esi, dword [ebp - 0x268]
jmp 0x4508c0
test byte [ebp - 0x260], 0x10
jne 0x450915
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.00401ea0
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00421250
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x450915
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x260]
push eax
push edi
call dword [0x4b40c8]
test eax, eax
jne 0x4508c0
push edi
call dword [0x4b4260]
mov esi, dword [ebp - 0x264]
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x450957
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x450975
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x268]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
xor ecx, ecx
sar eax, 2
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402400
int3
Function at 0x450c50
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae161
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x220]
push eax
call fcn.00452a70
add esp, 4
mov eax, dword [ebp - 0x220]
or esi, 0xffffffff
mov ecx, dword [eax - 0xc]
mov dword [ebp - 4], 0
cmp ecx, 2
jle 0x450d97
cmp ecx, 1
jge 0x450cb8
push 0x80070057
call fcn.00402400
cmp word [eax + 2], 0x3a
je 0x450d97
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.0048d890
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x14
push eax
push 0
call dword [0x4b42c0]
test eax, eax
je 0x450da2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00401930
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 1
call fcn.00418320
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00413e30
add esp, 0x10
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.00401cd0
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x450d6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x450d91
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x220]
push eax
call dword [0x4b42d0]
test eax, eax
jne 0x450da6
xor bl, bl
jmp 0x450dba
lea eax, [ebp - 0x220]
push eax
call fcn.004523b0
add esp, 4
test al, al
sete bl
mov edi, dword [ebp - 0x220]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x450dde
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
Function at 0x4521e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor bl, bl
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x45239c
push eax
call dword [0x4b42d0]
test eax, eax
je 0x45239c
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x45239c
push 0
lea ecx, [ebp - 0x50]
call fcn.0044d0f0
push dword [esi]
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0
call fcn.0044e5d0
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push 0x4b46cc
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x10]
push edx
push ecx
push dword [eax]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0044d8c0
mov eax, dword [ebp - 0x10]
or edi, 0xffffffff
cmp dword [eax - 0xc], 1
jle 0x45236f
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push dword [ebp + 0x14]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00401cd0
lea eax, [ebp + 8]
push eax
call fcn.00418320
mov eax, dword [0x4f2efc]
add esp, 4
mov ecx, 0x4f2efc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00413e30
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00401cd0
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45231b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x14]
push esi
call dword [0x4b42d0]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
add esi, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45234f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45236f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x45238d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.0044d300
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret