joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444650
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4fc
mov ebx, edx
mov edi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.004f5920
add esp, 0xc
mov ecx, esi
push ebx
push 3
push 0
push edi
call fcn.00444950
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.00444ad0
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x4446b7
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x4447b4
mov dword [ebp - 0x508], ebx
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.004f5920
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00444a90
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x4447bc
mov ecx, ebx
call fcn.00444880
test al, al
jne 0x444813
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x44471e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4447b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x444741
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00411560
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00444ad0
lea ecx, [ebp - 0x500]
push ebx
call fcn.00451df0
mov ecx, ebx
call fcn.004bcaf0
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x44477d
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x4446cd
lea ecx, [ebp - 0x500]
call fcn.004bcaf0
lea ecx, [ebp - 0x2a4]
call fcn.00444a20
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
add esp, 0x4fc
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x444787
xor esi, esi
jmp 0x444741
cmp byte [ebp + 8], 0
jne 0x4447ec
lea ecx, [ebp - 0x4f4]
call fcn.00444880
test al, al
je 0x4447e6
lea ecx, [ebp - 0x4f4]
call fcn.00444880
test al, al
je 0x444709
jmp 0x4447b8
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x4447fd
lea ecx, [ebp - 0x500]
jmp 0x444803
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4446fa
xor esi, esi
cmp byte [ebp + 8], 0
je 0x444741
lea ecx, [ebp - 0x500]
mov dword [ebp - 0x504], ecx
mov edx, dword [ebp - 0x508]
push 1
call fcn.00444650
add esp, 4
mov esi, eax
test eax, eax
jne 0x444741
cmp byte [ebp - 0x4f5], 0
jns 0x44485a
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x504], eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x444741
jmp 0x44472d
Function at 0x445f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0xc], edx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [esp + 0xa8], eax
xor ebx, ebx
test ecx, ecx
je 0x44608a
push ebx
push ebx
push ecx
mov dword [esp + 0x1c], ecx
call fcn.0050b189
add esp, 0xc
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x30]
push 0x48
push str....._base_files_file_util.cc
push str.ReadStreamToSpanWithMaxSize
push edi
call fcn.004bbec0
add esp, 0x10
mov ecx, esi
push ebx
push edi
call fcn.004b1470
mov dword [edi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
push dword [esp + 0x10]
call fcn.00503390
add esp, 4
push eax
call fcn.00503b8d
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x4460a2
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x50]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 0xc]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x28]
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea ecx, [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
call dword [0x5bb424]
mov eax, dword [esp + 0x20]
push edi
push eax
push ebx
mov dword [esp + 0x24], ecx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 0x10]
push edi
push 1
push eax
call fcn.0050ae99
add esp, 0x10
test eax, eax
je 0x446048
mov ebx, eax
mov eax, dword [esp + 0xc]
sub eax, esi
cmp eax, ebx
jb 0x4460ac
add ebx, esi
push dword [esp + 0x10]
call fcn.0050a80f
add esp, 4
test eax, eax
je 0x4460b4
mov esi, ebx
push dword [esp + 0x10]
call fcn.0050a83b
add esp, 4
test eax, eax
sete bl
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x5bb424]
mov eax, dword [esp + 0xa4]
lea edx, [esp + 0x20]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.004b14e0
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x445fd2
xor ebx, ebx
mov esi, dword [esp + 0xc]
jmp 0x446059
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x5bb424]
mov eax, dword [esp + 0xa4]
lea esi, [esp + 0x20]
push dword [esp + 0x1c]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov esi, ebx
jmp 0x446012
Function at 0x44d470
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
movsx edi, byte [edx + 0xb]
test edi, edi
jns 0x44d489
mov edi, dword [edx + 4]
mov edx, dword [edx]
mov eax, edi
mov dword [ebp - 0x1c], edx
mov esi, edi
mov dword [ebp - 0x14], edi
cmp edi, 4
jb 0x44d4c6
mov eax, dword [ebp - 0x14]
mov esi, eax
mov edx, dword [ebp - 0x1c]
imul edi, dword [edx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x44d4a0
mov ebx, dword [ebp + 8]
cmp esi, 2
je 0x44d4fb
cmp esi, 3
je 0x44d4f2
cmp esi, 1
mov edi, dword [ebp - 0x14]
je 0x44d507
mov esi, dword [ecx + 4]
xor edx, edx
test esi, esi
jne 0x44d514
mov dword [ebx], edx
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x44d4db
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edx, eax
shr edx, 0xf
xor edx, eax
mov dword [ebp - 0x18], edx
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
mov eax, dword [ebp - 0x18]
ja 0x44d624
lea edx, [esi - 1]
and edx, eax
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x44d61d
mov ecx, dword [eax]
test ecx, ecx
je 0x44d61d
lea eax, [esi - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ecx + 4]
cmp eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
jne 0x44d5f3
movzx eax, byte [ecx + 0x13]
test al, al
mov ecx, dword [ecx + 0xc]
mov edx, eax
cmovs edx, ecx
cmp edx, edi
jne 0x44d610
test al, al
jns 0x44d5d4
push ecx
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
push dword [eax + 8]
call fcn.004f3d1d
add esp, 0xc
test eax, eax
jne 0x44d610
mov edx, dword [ebp - 0x10]
jmp 0x44d4e4
test eax, eax
je 0x44d5cc
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ecx + 8]
mov edi, dword [ebp - 0x1c]
cmp dl, byte [edi + ecx]
mov edi, dword [ebp - 0x14]
jne 0x44d610
inc ecx
cmp eax, ecx
jne 0x44d5da
jmp 0x44d5cc
cmp dword [ebp - 0x28], 1
jbe 0x44d605
cmp eax, esi
jb 0x44d608
xor edx, edx
div esi
mov eax, edx
jmp 0x44d608
and eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x14]
jne 0x44d61d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x44d595
xor edx, edx
jmp 0x44d4e4
mov edx, eax
cmp eax, esi
jb 0x44d575
mov eax, dword [ebp - 0x18]
xor edx, edx
div esi
jmp 0x44d575
Function at 0x44fb70
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call fcn.0044fc30
mov eax, dword [esi]
mov dword [0x5c34bc], eax
test al, 1
jne 0x44fb8c
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [0x5c87ec]
test eax, eax
je 0x44fbb6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5c87ec], 0
cmp dword [0x5c87f0], 0
jne 0x44fbb6
and byte [0x5c34bc], 0xfe
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44fbc4
mov dword [0x5c87ec], eax
jmp 0x44fb87
mov ecx, dword [0x5c87f0]
test ecx, ecx
jne 0x44fbed
push 0xc
call fcn.004f190e
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x5c87f0], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x44fc1b
push eax
call fcn.0043af80
cmp dword [esi + 0xc], 0
jne 0x44fc14
mov eax, dword [0x5c87f0]
cmp byte [eax + 0xb], 0
jns 0x44fc0d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
jmp fcn.0053e690
push str....._third_partylibc_srcinclude_string:2719:_assertion___s___nullptr_failed:_string::assign_received_nullptr_n
push 0x59a9a3
call fcn.00523170
int3
Function at 0x4535e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004ae6f0
mov dword [esi], 0
test eax, eax
je 0x453627
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x453656
lea eax, [ebx + 1]
cmp eax, 2
jb 0x45361d
mov dword [esi], ebx
call fcn.004bbef0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.004bc9c0
lea ecx, [esi + 0x10]
call fcn.004c7080
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004bbef0
push dword [esi]
call fcn.004aaa80
add esp, 4
mov dword [esi], 0
jmp 0x45360e

Function at 0x453880
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x5c1040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movsx ecx, byte [eax + 0xb]
test ecx, ecx
jns 0x4538a4
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test ecx, ecx
js 0x453933
je 0x4538b2
test eax, eax
je 0x45392c
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x1c]
push ecx
push eax
push esi
call fcn.004b2e70
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x4538cc
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x28]
push ebx
push dword [ebp + 8]
push edi
call fcn.004b2e70
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x4538e5
mov edi, dword [ebp - 0x28]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x1d], 0
jns 0x453900
push dword [ebp - 0x28]
call fcn.004f193e
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x453911
push dword [ebp - 0x1c]
call fcn.004f193e
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
jmp 0x453938
push str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
push 0x59a9a3
call fcn.00523170
int3
Function at 0x4539c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.004b2e70
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x4539ee
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x453a0c
push dword [ebp - 0x1c]
call fcn.004f193e
add esp, 4
cmp dword [ebp + 8], 0
je 0x453aa7
test esi, esi
je 0x453aa7
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.004f1973
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, edi
lea edi, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.004b2e70
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x453a4e
mov edi, dword [ebp - 0x1c]
push esi
mov ebx, dword [ebp - 0x20]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x453a6b
push dword [ebp - 0x1c]
call fcn.004f193e
add esp, 4
test ebx, ebx
mov edi, dword [ebp + 8]
je 0x453ac0
push ebx
call fcn.0050d784
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push ebx
push ecx
call fcn.004b2ea0
add esp, 0xc
cmp byte [edi + 0xb], 0
js 0x453acf
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [edi], xmm0
push ebx
call fcn.004f197c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
push 0x59a9a3
call fcn.00523170
push dword [edi]
call fcn.004f193e
add esp, 4
jmp 0x453a8f

Function at 0x454010
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x5c8878]
test ebx, ebx
jne 0x454094
push 0x28
call fcn.004f190e
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.004f190e
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x45409e
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x5c8878], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x4540a5
mov edi, eax
push eax
call fcn.0050d784
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004540c0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
jmp 0x4540aa
push str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
push 0x59a9a3
call fcn.00523170
int3
Function at 0x4540c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x5c1040]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.0043ea50
add esp, 0x10
mov eax, dword [ebx + 4]
test eax, eax
je 0x454211
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x800
mov dword [ebp - 0x24], 0
push eax
push 0x5aa00c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x28], eax
je 0x454243
push 0x5aa05c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x454149
mov ecx, eax
call dword [0x5bb424]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
test esi, esi
je 0x4541b0
mov dword [ebp - 0x2c], edi
cmp esi, 0x15555556
jae 0x45423b
shl esi, 2
lea ebx, [esi + esi*2]
push ebx
call fcn.004f190e
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
add eax, ebx
mov dword [ebp - 0x18], eax
xor ebx, ebx
test edi, edi
je 0x45422c
mov ecx, edi
mov eax, dword [ebp - 0x24]
push dword [eax + ebx]
call fcn.00416000
add edi, 0xc
add ebx, 4
cmp esi, ebx
jne 0x454188
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x2c]
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.00453cf0
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4541d6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x454211
mov edi, dword [ebp - 0x1c]
cmp edi, esi
je 0x454208
add edi, 0xfffffff4
jmp 0x4541fc
push dword [edi]
call fcn.004f193e
add esp, 4
lea eax, [edi - 0xc]
cmp edi, esi
mov edi, eax
je 0x454208
test edi, edi
je 0x454225
cmp byte [edi + 0xb], 0
js 0x4541e9
jmp 0x4541f3
push esi
call fcn.004f193e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
jmp 0x454231
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x59a9a3
call fcn.00523170
lea ecx, [ebp - 0x20]
call fcn.00522240
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x454146
Function at 0x458170
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x458188
cmp dword [ebp + 0x10], 0
jne 0x458184
call fcn.004759e0
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00457c30
Function at 0x4649e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x464b0c
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x5bb424]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x5bb424]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x5bb424]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x464ab1
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x464aa5
push 1
call fcn.004c4830
add esp, 4
bt eax, 0x19
jae 0x464b10
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403500
add esp, 0xc
mov eax, 0x401d10
mov ecx, 0x401180
lea edx, [ebp - 0x20]
mov edi, dword [ebp - 0x44]
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edx]
movups xmmword [edi], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x464af8
bt eax, 9
jae 0x464b31
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00404020
add esp, 0xc
xor eax, eax
mov ecx, 0x4040d0
jmp 0x464add
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00545830
add esp, 0xc
mov eax, 0x545fc0
mov ecx, 0x545740
jmp 0x464add
Function at 0x464d60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x464e3c
cmp dword [esi], 0
jne 0x464e3c
cmp dword [esi + 0xc], 0
jne 0x464e3c
xor eax, eax
cmp dword [esi + 4], 0
jne 0x464e3c
mov ebx, dword [edi]
cmp eax, ebx
je 0x464dc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x464e22
lea eax, [ebx + 1]
cmp eax, 2
jb 0x464db9
mov dword [esi], ebx
call fcn.004bbef0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x464df6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x464e09
lea eax, [ebx + 1]
cmp eax, 2
jb 0x464dec
mov dword [esi + 4], ebx
call fcn.004bbef0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004bbef0
push dword [esi + 4]
call fcn.004aaa80
add esp, 4
mov dword [esi + 4], 0
jmp 0x464ddc
call fcn.004bbef0
push dword [esi]
call fcn.004aaa80
add esp, 4
mov dword [esi], 0
jmp 0x464daa
mov ecx, esi
call fcn.004a6090
lea ecx, [esi + 4]
call fcn.004a6090
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi]
jmp 0x464d94