joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438ec0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
test esi, esi
jbe 0x438f03
test bl, 7
je 0x438eff
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x51e8d0]
shr edx, 8
xor edx, dword [ecx*8 + 0x51e8d4]
dec esi
inc ebx
test esi, esi
ja 0x438ed7
mov dword [esp + 0x1c], esi
mov ecx, esi
shr ecx, 3
lea ecx, [ebx + ecx*8]
mov dword [esp + 0x18], ecx
cmp ebx, ecx
jae 0x438ff1
push ebp
mov ecx, dword [ebx]
xor ecx, eax
mov eax, dword [ebx + 4]
xor eax, edx
mov edx, eax
shr edx, 0x10
movzx esi, dl
mov edi, dword [esi*8 + 0x51f0d0]
mov esi, dword [esi*8 + 0x51f0d4]
mov edx, eax
shr edx, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x51e8d0]
xor esi, dword [edx*8 + 0x51e8d4]
mov edx, eax
shr edx, 8
movzx edx, dl
xor edi, dword [edx*8 + 0x51f8d0]
xor esi, dword [edx*8 + 0x51f8d4]
movzx edx, al
xor edi, dword [edx*8 + 0x5200d0]
xor esi, dword [edx*8 + 0x5200d4]
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x5208d0]
xor esi, dword [edx*8 + 0x5208d4]
shr ebp, 0x18
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x10
movzx edx, dl
xor edi, dword [edx*8 + 0x5210d0]
xor esi, dword [edx*8 + 0x5210d4]
mov edx, ecx
shrd edx, eax, 8
mov dword [esp + 0x18], eax
shr eax, 8
movzx eax, dl
xor edi, dword [eax*8 + 0x5218d0]
xor esi, dword [eax*8 + 0x5218d4]
movzx eax, cl
xor esi, dword [eax*8 + 0x5220d4]
xor edi, dword [eax*8 + 0x5220d0]
add ebx, 8
shr ebp, 0x10
mov eax, edi
mov edx, esi
cmp ebx, dword [esp + 0x1c]
jb 0x438f18
mov esi, dword [esp + 0x20]
pop ebp
and esi, 7
jbe 0x439019
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x51e8d0]
shr edx, 8
xor edx, dword [ecx*8 + 0x51e8d4]
dec esi
inc ebx
test esi, esi
ja 0x438ff6
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x439020
Capabilities:
Encode data using xor

Disassembly:
xor dl, dl
push esi
mov esi, dword [esp + 8]
mov byte [ecx + 0xc02], dl
mov byte [ecx + 0xc01], dl
mov byte [ecx + 0xc00], dl
mov al, byte [esi]
cmp al, dl
je 0x439064
push ebx
mov bl, byte [ecx + 0xc02]
add byte [ecx + 0xc00], al
xor byte [ecx + 0xc01], al
add bl, al
rol bl, 1
inc esi
mov byte [ecx + 0xc02], bl
mov al, byte [esi]
cmp al, dl
jne 0x439040
pop ebx
pop esi
ret 4
Function at 0x439070
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x6f0]
push eax
call fcn.004389f0
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439090
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.00438b40
mov word [esi + 0xc04], ax
shr eax, 0x10
xor ecx, ecx
xor edx, edx
mov word [esi + 0xc06], ax
mov word [esi + 0xc0a], cx
mov word [esi + 0xc08], dx
mov al, byte [edi]
test al, al
je 0x439106
mov edx, edi
lea ecx, [ecx]
movzx ecx, al
mov di, word [esi + ecx*4 + 0x6f0]
lea ecx, [esi + ecx*4 + 0x6f0]
movzx ax, al
xor di, ax
xor word [esi + 0xc08], di
mov cx, word [ecx + 2]
add cx, ax
add word [esi + 0xc0a], cx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x4390d0
pop edi
pop esi
ret 4

Function at 0x439170
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
test edi, edi
je 0x43922a
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x439190
mov ecx, 0x1234
add word [eax + 0xc04], cx
movzx ecx, word [eax + 0xc04]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6f0]
xor word [eax + 0xc06], dx
mov bx, word [eax + 0xc0a]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6f2]
sub word [eax + 0xc08], dx
movzx edx, word [eax + 0xc08]
xor edx, ecx
mov word [eax + 0xc04], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0xc06]
ror bx, cl
movzx ecx, bx
xor word [eax + 0xc04], cx
mov word [eax + 0xc0a], cx
movzx ecx, word [eax + 0xc04]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x439190
pop esi
pop ebx
pop edi
ret 8

Function at 0x439230
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esp + 4]
inc eax
mov edx, 4
push esi
jmp 0x439240
movzx esi, byte [eax - 1]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbf0], esi
movzx esi, byte [eax]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbf4], esi
movzx esi, byte [eax + 1]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbf8], esi
movzx esi, byte [eax + 2]
mov esi, dword [ecx + esi*4 + 0x6f0]
xor dword [ecx + 0xbfc], esi
add eax, 4
sub edx, 1
jne 0x439240
pop esi
ret 4
Function at 0x439720
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1d8
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1d4], eax
mov eax, dword [esp + 0x1ec]
push ebx
mov ebx, dword [esp + 0x1e8]
push esi
mov esi, dword [esp + 0x1e8]
push edi
mov edi, dword [esp + 0x1e8]
mov dword [esp + 0xc], eax
cmp esi, 0x40
jbe 0x439799
lea ecx, [esp + 0xf0]
push ecx
call fcn.00465d80
push esi
push edi
lea edx, [esp + 0xf8]
push edx
call fcn.00466230
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0xf4]
push ecx
call fcn.004662e0
lea edi, [esp + 0x1a0]
mov esi, 0x20
xor eax, eax
test esi, esi
jbe 0x4397c5
push ebp
mov ebp, edi
lea edx, [esp + 0x164]
sub ebp, edx
jmp 0x4397b0
lea ecx, [esp + eax + 0x164]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x4397b0
pop ebp
cmp esi, 0x40
jae 0x4397e4
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x36
push eax
call fcn.004e01d0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call fcn.00465d80
push 0x40
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00466230
mov edx, dword [esp + 0x1f4]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.00466230
lea ecx, [esp + 0x1c0]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004662e0
lea eax, [esp + 0x80]
push eax
call fcn.00465d80
xor eax, eax
test esi, esi
jbe 0x439857
lea ecx, [esp + 0x160]
sub edi, ecx
lea ecx, [esp + eax + 0x160]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x439843
cmp esi, 0x40
jae 0x439876
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x5c
push eax
call fcn.004e01d0
add esp, 0xc
push 0x40
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.00466230
push 0x20
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x88]
push edx
call fcn.00466230
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x84]
push ecx
call fcn.004662e0
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x1d8
ret 0x14
Function at 0x4398d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc8
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0xd4]
push ebx
mov ebx, dword [esp + 0xe4]
push ebp
mov ebp, dword [esp + 0xe4]
push esi
mov esi, dword [esp + 0xe4]
push edi
mov edi, dword [esp + 0xdc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov ecx, esi
cmp esi, 0x40
jb 0x439926
mov ecx, 0x40
push ecx
push eax
lea edx, [esp + 0x78]
push edx
call fcn.004dfe60
mov edx, dword [esp + 0xec]
add esp, 0xc
lea eax, [esp + 0x50]
push eax
mov byte [esp + esi + 0x74], 0
mov byte [esp + esi + 0x75], 0
mov byte [esp + esi + 0x76], 0
mov byte [esp + esi + 0x77], 1
add esi, 4
push esi
lea ecx, [esp + 0x78]
push ecx
push edx
push edi
call fcn.00439720
mov eax, dword [esp + 0xf8]
dec eax
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, 0x10
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
xor ebx, ebx
nop
mov eax, dword [esp + ebx + 0x24]
test eax, eax
jbe 0x439a21
mov ebp, eax
lea ebx, [ebx]
mov ecx, dword [esp + 0xe0]
lea edx, [esp + 0xb4]
push edx
mov edx, dword [esp + 0x18]
push 0x20
lea eax, [esp + 0x58]
push eax
push ecx
push edx
call fcn.00439720
mov ecx, 8
lea esi, [esp + 0xb4]
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x4399f0
movzx ecx, byte [esp + eax + 0x50]
movzx edx, byte [esp + eax + 0x51]
xor byte [esp + eax + 0x30], cl
xor byte [esp + eax + 0x31], dl
movzx ecx, byte [esp + eax + 0x52]
movzx edx, byte [esp + eax + 0x53]
xor byte [esp + eax + 0x32], cl
xor byte [esp + eax + 0x33], dl
add eax, 4
cmp eax, 0x20
jb 0x4399f0
sub ebp, 1
jne 0x4399b0
mov edi, dword [esp + ebx + 0x18]
add ebx, 4
mov ecx, 8
lea esi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
cmp ebx, 0xc
jb 0x4399a0
push 0x44
lea eax, [esp + 0x74]
push eax
call fcn.00463fb0
push 0x20
lea ecx, [esp + 0x34]
push ecx
call fcn.00463fb0
push 0x20
lea edx, [esp + 0x54]
push edx
call fcn.00463fb0
push 0x20
lea eax, [esp + 0xb8]
push eax
call fcn.00463fb0
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0xc8
ret 0x20
Function at 0x43a6f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x38]
cmp dword [edi], 2
jne 0x43a7a1
mov eax, dword [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push 0x20
push ebx
mov dword [esp + 0x20], eax
call fcn.00439720
xor edx, edx
mov dword [edi + 4], edx
mov eax, edx
lea esi, [edx - 2]
push ebp
jmp 0x43a740
movzx ebp, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi - 1]
and ecx, 3
add ecx, ecx
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x15]
add ecx, ecx
shl ebp, cl
mov ecx, esi
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x16]
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi + 1]
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x17]
add ecx, ecx
add ecx, ecx
shl ebp, cl
add edx, 4
add esi, 4
xor eax, ebp
cmp edx, 0x20
jb 0x43a740
mov dword [edi + 4], eax
pop ebp
cmp dword [edi], 3
jne 0x43a7c4
lea eax, [esp + 0x10]
push eax
push 0x20
add edi, 4
push edi
push 0x20
push ebx
call fcn.00439720
mov ecx, 8
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x28
ret 8

Function at 0x43ac30
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push 0xf0000040
push 1
xor esi, esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebp, dword [esp + 0x20]
test eax, eax
je 0x43ac7f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
mov eax, dword [esp + 0xc]
push esi
push eax
sete bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x43ace2
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.00467d70
lea ecx, [esp + 0x14]
call fcn.00467d50
mov esi, eax
mov edi, edx
call fcn.004e2daa
cdq
add esi, eax
adc edi, edx
xor ebx, ebx
test ebp, ebp
jbe 0x43ace1
mov edi, edi
mov ecx, ebx
and ecx, 7
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov eax, esi
mov edx, edi
call fcn.004e23b0
mov edx, dword [esp + 0x20]
mov cl, al
mov eax, dword [0x524d90]
xor cl, bl
add cl, al
mov byte [ebx + edx], cl
inc eax
inc ebx
mov dword [0x524d90], eax
cmp ebx, ebp
jb 0x43acb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x43aed0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov edx, dword [esi]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, edx
jbe 0x43af38
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp edx, ecx
jb 0x43af14
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
lea ebx, [ebx]
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
inc ecx
mov dword [ebx + eax], ebp
add eax, 4
cmp ecx, dword [esi]
jbe 0x43af00
mov ebx, dword [esp + 0x14]
mov eax, dword [edi]
sub eax, dword [esi]
lea edx, [edi + ecx*4]
add eax, eax
add eax, eax
push eax
push edx
lea eax, [ebx + ecx*4]
push eax
call fcn.004dfe60
mov ecx, dword [edi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], ecx
pop ebx
ret 0xc
jae 0x43af88
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp eax, ecx
jb 0x43af64
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
mov ebp, dword [eax + edx]
xor ebp, dword [eax]
inc ecx
mov dword [eax + ebx], ebp
add eax, 4
cmp ecx, dword [edi]
jbe 0x43af50
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
sub edx, dword [edi]
lea eax, [esi + ecx*4]
add edx, edx
add edx, edx
push edx
push eax
lea ecx, [ebx + ecx*4]
push ecx
call fcn.004dfe60
mov edx, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], edx
pop ebx
ret 0xc
test eax, eax
jbe 0x43afa2
mov edx, edi
lea ecx, [esi + eax*4]
sub edx, esi
mov ebx, dword [ecx + edx]
xor ebx, dword [ecx]
jne 0x43afa2
dec eax
sub ecx, 4
test eax, eax
ja 0x43af93
mov edx, dword [esp + 0x14]
mov dword [edx], eax
test eax, eax
jbe 0x43afc3
sub edi, esi
lea ecx, [esi + eax*4]
sub edx, esi
mov esi, dword [ecx + edi]
xor esi, dword [ecx]
dec eax
mov dword [ecx + edx], esi
sub ecx, 4
test eax, eax
ja 0x43afb3
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x43afd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
mov esi, dword [esp + 0x5c]
cmp dword [esi], 0
je 0x43b0fa
mov ebp, dword [esp + 0x60]
mov eax, dword [ebp]
test eax, eax
je 0x43b0fa
mov ecx, ebp
lea edx, [esp + 8]
sub ecx, edx
push edi
lea ebx, [ebx]
mov edi, dword [0x524d98]
lea edx, [ecx + eax*4]
sub eax, 1
mov edx, dword [esp + edx + 0xc]
mov edx, dword [edi + edx*4]
mov dword [esp + eax*4 + 0x10], edx
jne 0x43b000
mov edi, dword [esp + 0x5c]
push ebx
push 0x90
push eax
push edi
call fcn.004e01d0
mov ebx, dword [esi]
add esp, 0xc
test ebx, ebx
je 0x43b0a7
mov ebp, dword [0x524d94]
lea esp, [esp]
mov eax, dword [esi + ebx*4]
mov ecx, dword [0x524d98]
mov esi, dword [ecx + eax*4]
cmp esi, 0x7fff
je 0x43b09a
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
test eax, eax
je 0x43b09a
lea ecx, [ebx + eax]
lea edx, [edi + ecx*4 - 4]
jmp 0x43b070
mov ecx, dword [esp + eax*4 + 0x10]
cmp ecx, 0x7fff
je 0x43b092
add ecx, esi
cmp ecx, 0x7fff
jb 0x43b08c
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
dec eax
sub edx, 4
test eax, eax
jne 0x43b070
sub ebx, 1
mov esi, dword [esp + 0x64]
jne 0x43b040
mov ebp, dword [esp + 0x68]
mov edx, dword [esi]
mov eax, dword [ebp]
lea ecx, [edx + eax - 1]
cmp ecx, 0x11
mov dword [edi], ecx
pop ebx
jle 0x43b0d7
lea eax, [edi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
nop
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], 0
sub eax, 4
sub edx, 1
jne 0x43b0c0
cmp dword [edi], 0x11
jbe 0x43b0f1
mov dword [edi], 0x11
mov eax, dword [edi]
cmp dword [edi + eax*4], 0
jne 0x43b0f1
dec eax
mov dword [edi], eax
test eax, eax
jne 0x43b0e2
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov ecx, dword [esp + 0x58]
pop esi
mov dword [ecx], 0
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x43b110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
xor ebp, ebp
cmp eax, ebp
je 0x43b1f5
mov ecx, dword [edi + eax*4]
push ebx
mov ebx, dword [0x524d98]
mov ecx, dword [ebx + ecx*4]
push esi
cmp ecx, 0x7fff
je 0x43b15b
add ecx, ecx
cmp ecx, 0x7fff
jb 0x43b148
add ecx, 0xffff8001
mov edx, dword [0x524d94]
mov ecx, dword [edx + ecx*4]
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ecx
jmp 0x43b163
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ebp
mov ecx, dword [edi]
sub ecx, 1
je 0x43b1a8
lea edx, [esi + ecx*8 - 4]
mov edi, edi
mov dword [edx + 4], ebp
mov eax, dword [edi + ecx*4]
mov eax, dword [ebx + eax*4]
cmp eax, 0x7fff
je 0x43b19e
add eax, eax
cmp eax, 0x7fff
jb 0x43b18e
add eax, 0xffff8001
mov ebp, dword [0x524d94]
mov eax, dword [ebp + eax*4]
mov dword [edx], eax
xor ebp, ebp
jmp 0x43b1a0
mov dword [edx], ebp
dec ecx
sub edx, 8
cmp ecx, ebp
jne 0x43b170
mov eax, dword [edi]
lea ecx, [eax + eax - 1]
cmp ecx, 0x11
mov dword [esi], ecx
jle 0x43b1d3
lea eax, [esi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
lea esp, [esp]
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], ebp
sub eax, 4
sub edx, 1
jne 0x43b1c0
cmp dword [esi], 0x11
jbe 0x43b1ee
mov dword [esi], 0x11
mov edi, edi
mov eax, dword [esi]
cmp dword [esi + eax*4], ebp
jne 0x43b1ee
dec eax
mov dword [esi], eax
cmp eax, ebp
jne 0x43b1e0
pop esi
pop ebx
pop edi
pop ebp
ret 8
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], ebp
pop ebp
ret 8
Function at 0x441a20
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4f4f6b
mov eax, dword fs:[0]
push eax
mov eax, 0x5028
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x5024], eax
push ebx
push esi
push edi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x5038]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5048]
push 0x800
lea eax, [esp + 0x2038]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x441c32
cmp eax, 0x800
jae 0x441c32
push 0x800
lea ecx, [esp + 0x3038]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x441c32
cmp eax, 0x800
jae 0x441c32
lea edx, [esp + 0x2034]
push edx
call fcn.00450f20
mov ebx, eax
lea eax, [esp + 0x3034]
push eax
call fcn.00450f20
mov esi, eax
cmp word [esi], 0
je 0x441c32
push esi
push ebx
call fcn.00469c20
test eax, eax
je 0x441c32
push esi
push edi
call fcn.00450f20
push eax
call fcn.00469c20
test eax, eax
jne 0x441c32
mov word [esp + 0x1034], ax
xor esi, esi
lea esp, [esp]
test ax, ax
jne 0x441b82
push 0x800
push edi
lea ecx, [esp + 0x103c]
push ecx
call fcn.00466930
push esi
push str.rtmp_d
lea edx, [esp + 0x103c]
push edx
call fcn.00450f20
push eax
mov edx, 0x800
call fcn.00493540
add esp, 0xc
lea eax, [esp + 0x1034]
push eax
call fcn.004432f0
test al, al
je 0x441b66
xor eax, eax
mov word [esp + 0x1034], ax
jmp 0x441b6e
mov ax, word [esp + 0x1034]
add esi, 0x7b
cmp esi, 0x2710
jl 0x441b10
test ax, ax
je 0x441c32
push 0x800
push edi
lea ecx, [esp + 0x403c]
push ecx
call fcn.00466930
push 0x800
push ebx
lea edx, [esp + 0x403c]
push edx
call fcn.004510f0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [esp + 0x1034]
push eax
lea ecx, [esp + 0x4038]
push ecx
call esi
test eax, eax
je 0x441c32
lea ecx, [esp + 0x10]
call fcn.00441d50
mov dword [esp + 0x5040], 0
push edi
xor bl, bl
call fcn.004432f0
test al, al
jne 0x441bf2
push 0xa
push edi
lea ecx, [esp + 0x18]
call fcn.00441f60
mov bl, al
lea edx, [esp + 0x4034]
push edx
lea eax, [esp + 0x1038]
push eax
call esi
test bl, bl
je 0x441c1a
lea ecx, [esp + 0x10]
call fcn.00442080
lea ecx, [esp + 0x10]
call fcn.004420e0
mov dword [esp + 0x5040], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00442480
mov al, 1
jmp 0x441c34
xor al, al
mov ecx, dword [esp + 0x5038]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5024]
xor ecx, esp
call fcn.004df2c4
add esp, 0x5034
ret 4
Function at 0x441dd0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1010
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1014]
mov edx, dword [esp + 0x1018]
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
push edi
mov dword [esp + 0x18], eax
mov dword [esi + 0x1020], 0
jne 0x441e19
test dl, 4
jne 0x441e19
xor cl, cl
jmp 0x441e1b
mov cl, 1
mov ebx, edx
shr ebx, 1
and bl, 1
movzx ebp, bl
neg ebp
sbb ebp, ebp
and ebp, 0xc0000000
add ebp, 0x80000000
test dl, 1
je 0x441e40
or ebp, 0x40000000
mov dword [esp + 0x10], 1
test cl, cl
je 0x441e54
mov dword [esp + 0x10], 3
mov ecx, dword [esp + 0x10]
xor ebx, ebx
cmp byte [esi + 0x15], bl
push 0
setne bl
dec ebx
and ebx, 0x8000000
push ebx
push 3
push 0
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x441edf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x800
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.00451950
test al, al
je 0x441ece
mov ecx, dword [esp + 0x10]
push 0
push ebx
push 3
push 0
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x441ec9
mov dword [esp + 0x14], eax
cmp edi, 0xffffffff
jne 0x441edf
cmp dword [esp + 0x14], 2
jne 0x441edf
mov dword [esi + 0x1020], 1
cmp edi, 0xffffffff
setne bl
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
test bl, bl
je 0x441f0e
mov eax, dword [esp + 0x18]
push 0x800
mov dword [esi + 4], edi
push eax
add esi, 0x1e
push esi
call fcn.00466930
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x1010
ret 8
Function at 0x442180
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x442325
cmp dword [esi + 0xc], 1
jne 0x4421a4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x4421c0
mov ebx, dword [esp + 0x34]
jmp 0x4421c0
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x442214
xor edi, edi
test ebx, ebx
jbe 0x442239
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x4421e4
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x442239
add edi, 0x4000
cmp edi, ebx
jb 0x4421d4
jmp 0x442231
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x44231f
cmp byte [esi + 0x14], 0
je 0x44231f
cmp dword [esi + 0xc], 0
jne 0x44231f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ebx, eax
lea eax, [esi + 0x1e]
push eax
mov dword [esp + 0x24], edx
call fcn.00442b90
push edi
mov dword [esp + 0x18], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x4422c4
ja 0x44228c
cmp dword [esp + 0x14], ebp
jbe 0x4422c4
mov edi, dword [esp + 0x20]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x4422c4
jl 0x4422a3
cmp edx, 0xffffffff
ja 0x4422c4
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x28], eax
js 0x4422c4
jg 0x4422b6
cmp ecx, 0xffffffff
jbe 0x4422c4
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x5275b8
call fcn.0043d670
push 0
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x5275b8
call fcn.0043d6d0
test al, al
je 0x44230f
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x4421b0
test eax, eax
jbe 0x4421b0
mov edi, dword [esi]
mov edx, dword [edi + 0x10]
push 0
mov ecx, esi
call edx
mov ecx, dword [esp + 0x14]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
mov edx, dword [edi + 0xc]
push eax
mov ecx, esi
call edx
jmp 0x4421b0
lea eax, [esi + 0x1e]
push eax
push 0
mov ecx, 0x5275b8
call fcn.0043d910
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8