joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
je 0x40bb99
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 4]
mov dword [eax + 0x220], 0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x21c], 0
je 0x40bbc2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0xffffffff
je 0x40bc02
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xffffffff
mov ecx, dword [ebp - 4]
add ecx, 0x14
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bc02
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call fcn.00418ac0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x40bda0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x214], ecx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x40bded
xor eax, eax
jmp 0x40be99
push 0
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x214]
mov dword [edx + 8], eax
mov ecx, 0xb
mov esi, str.IIME_STCODETABLE_READ
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x1dc
push 0
lea eax, [ebp - 0x1e0]
push eax
call fcn.0041e4b0
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00419070
add esp, 8
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx + 8]
push edx
push 0
push 2
push 0
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
cmp dword [eax + 4], 0
jne 0x40be94
xor eax, eax
jmp 0x40be99
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret 4
Function at 0x40beb0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x570
push esi
push edi
mov dword [ebp - 8], ecx
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40bef7
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
xor eax, eax
jmp 0x40bf38
mov ecx, 0x159
mov esi, dword [ebp - 4]
lea edi, [ebp - 0x570]
rep movsd dword es:[edi], dword [esi]
movzx edx, word [ebp - 0x4b6]
shl edx, 0xa
shl edx, 0xa
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x40bf24
mov dword [ebp - 0xc], 0x6400000
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bf50
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Iime_stc.map
mov ecx, dword [ebp - 4]
add ecx, 0x14
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bf9b
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
call fcn.00418ac0
add esp, 4
push 0
push 2
push 2
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 4]
add ecx, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0xffffffff
jne 0x40bfcd
xor eax, eax
jmp 0x40c0d3
push str.Iime_STTrie_Codetable
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x788]
push edx
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x21c], 0
jne 0x40c022
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xffffffff
xor eax, eax
jmp 0x40c0d3
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x220], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x220], 0
jne 0x40c08a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0xffffffff
xor eax, eax
jmp 0x40c0d3
mov ecx, dword [ebp - 4]
call fcn.0040c0e0
test eax, eax
jne 0x40c0ce
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0xffffffff
xor eax, eax
jmp 0x40c0d3
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40c0e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
jne 0x40c0fe
xor eax, eax
jmp 0x40c1d4
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40c127
jmp 0x40c19a
mov edi, dword [ebp - 4]
add edi, 0x224
mov ecx, 0x159
mov esi, dword [ebp - 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov dword [eax + 0x790], 0
mov ecx, dword [ebp - 4]
call fcn.0040c1e0
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x40c160
jmp 0x40c19a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2e0]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xc]
cmp edx, dword [ecx + 8]
jae 0x40c193
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040c310
test eax, eax
jne 0x40c191
jmp 0x40c19a
jmp 0x40c16f
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x40c1b1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x40c1d1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40de20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x224], 0
je 0x40de57
push 0x8000
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 4]
mov dword [eax + 0x224], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x220], 0
je 0x40de89
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x220], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x21c], 0
je 0x40deb2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x21c], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0xffffffff
je 0x40def2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40def2
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
call fcn.00418ac0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x78c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x794], 0
mov esp, ebp
pop ebp
ret
Function at 0x4104d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x214], ecx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x41051d
xor eax, eax
jmp 0x4105c9
push 0
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x214]
mov dword [edx + 8], eax
mov ecx, 0xa
mov esi, 0x430800
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
push 0
lea eax, [ebp - 0x1e4]
push eax
call fcn.0041e4b0
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00419070
add esp, 8
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx + 8]
push edx
push 0
push 2
push 0
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
cmp dword [eax + 4], 0
jne 0x4105c4
xor eax, eax
jmp 0x4105c9
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret 4

Function at 0x4105e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x570
push esi
push edi
mov dword [ebp - 8], ecx
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410627
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
xor eax, eax
jmp 0x41069d
mov ecx, 0x159
mov esi, dword [ebp - 0xc]
lea edi, [ebp - 0x570]
rep movsd dword es:[edi], dword [esi]
movzx edx, word [ebp - 0x4b6]
shl edx, 0xa
shl edx, 0xa
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x410654
mov dword [ebp - 4], 0x5000000
mov eax, dword [ebp - 8]
cmp dword [eax + 0x79c], 1
je 0x41067d
movzx ecx, word [ebp - 0x4aa]
shl ecx, 0xa
shl ecx, 0xa
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x41067d
mov dword [ebp - 4], 0x7800000
mov edx, dword [ebp - 4]
add edx, 0x200000
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410920
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x220], 0
jne 0x41093e
xor eax, eax
jmp 0x410aa1
mov dword [ebp - 0x14], 0
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41096d
jmp 0x410a53
mov edi, dword [ebp - 4]
add edi, 0x228
mov ecx, 0x159
mov esi, dword [ebp - 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2e4], 0x564
jbe 0x4109f1
mov dword [ebp - 0x10], 0x564
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2e4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
push 4
push 0x3000
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x224], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x224], 0
jne 0x4109d4
jmp 0x410a53
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x224]
push eax
call fcn.0041df30
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x794], 0
mov ecx, dword [ebp - 4]
call fcn.004129c0
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x410a17
jmp 0x410a53
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xbc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0xc]
cmp eax, dword [edx + 8]
jae 0x410a4c
push 1
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00410f00
test eax, eax
jne 0x410a4a
jmp 0x410a53
jmp 0x410a26
mov dword [ebp - 0x14], 1
cmp dword [ebp - 8], 0
je 0x410a6a
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x410a8a
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410ab0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x210], ecx
mov eax, dword [ebp - 0x210]
cmp dword [eax + 0x220], 0
jne 0x410ae1
xor eax, eax
jmp 0x410cbc
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
jne 0x410b13
xor eax, eax
jmp 0x410cbc
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 0
push 0
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 8], eax
mov ecx, 0xa
mov esi, str.IIME_CODETABLE_READ
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
push 0
lea edx, [ebp - 0x1e4]
push edx
call fcn.0041e4b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00419070
add esp, 8
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 8]
push ecx
push 0
push 2
push 0
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x210]
cmp dword [edx + 4], 0
jne 0x410bb7
jmp 0x410c33
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x410be2
jmp 0x410c33
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0xbc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
mov ecx, dword [edx + 0xc]
cmp ecx, dword [eax + 8]
jae 0x410c29
push 0
mov edx, dword [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0x210]
call fcn.00410f00
test eax, eax
jne 0x410c27
jmp 0x410c33
jmp 0x410bf7
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x214], 0
je 0x410c53
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp - 0x210]
cmp dword [ecx + 4], 0
je 0x410c7c
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 4], 0
cmp dword [ebp - 0x218], 0xffffffff
je 0x410c9c
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x210]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 8], 0
mov eax, dword [ebp - 0x21c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret 4
Function at 0x4164c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0041e4b0
add esp, 0xc
push 9
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00418830
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41651a
xor eax, eax
jmp 0x4166ae
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
call fcn.00416a10
test eax, eax
jne 0x416537
xor eax, eax
jmp 0x4166ae
mov ecx, dword [ebp - 0x210]
call fcn.00416b20
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 0x78c], eax
mov edx, dword [ebp - 0x210]
cmp dword [edx + 0x78c], 0
jne 0x416564
xor eax, eax
jmp 0x4166ae
mov ecx, dword [ebp - 0x210]
call fcn.00416bb0
test eax, eax
jne 0x41661d
mov eax, dword [ebp - 0x210]
cmp dword [eax + 0x224], 0
je 0x4165a1
mov ecx, dword [ebp - 0x210]
cmp dword [ecx + 0x220], 0
je 0x4165a1
mov edx, dword [ebp - 0x210]
cmp dword [edx + 0x14], 0xffffffff
jne 0x4165b3
mov ecx, dword [ebp - 0x210]
call fcn.004166c0
xor eax, eax
jmp 0x4166ae
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 0x78c]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
mov ecx, dword [edx + 0x794]
cmp ecx, dword [eax + 0x790]
jb 0x4165fb
imul eax, dword [ebp - 0x214], 0x19
xor edx, edx
mov ecx, 0x64
div ecx
add eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x210]
call fcn.004166c0
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x214]
mov dword [edx + 0x78c], eax
jmp 0x416564
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 0x794]
mov dword [ecx + 0x2e8], eax
mov ecx, dword [ebp - 0x210]
movzx edx, word [ecx + 0x2e2]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 0x2e8]
shr ecx, 0x14
add ecx, 1
movzx eax, cx
cmp edx, eax
je 0x4166a9
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 0x2e8]
shr edx, 0x14
add edx, 1
mov eax, dword [ebp - 0x210]
mov word [eax + 0x2e2], dx
push 0
mov esi, dword [ebp - 0x210]
add esi, 0x228
sub esp, 0x564
mov ecx, 0x159
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00417df0
add esp, 0x56c
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret
Function at 0x4166c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x224], 0
je 0x4166fa
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 4]
mov dword [eax + 0x224], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x220], 0
je 0x416723
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x220], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0xffffffff
je 0x416763
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
add ecx, 0x18
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416763
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
call fcn.00418ac0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x416a10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x214], ecx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x416a5d
xor eax, eax
jmp 0x416b09
push 0
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x214]
mov dword [edx + 0xc], eax
mov ecx, 0xb
mov esi, str.IIME_ENCODETABLE_READ
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x1dc
push 0
lea eax, [ebp - 0x1e0]
push eax
call fcn.0041e4b0
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00419070
add esp, 8
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx + 0xc]
push edx
push 0
push 2
push 0
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
cmp dword [eax + 8], 0
jne 0x416b04
xor eax, eax
jmp 0x416b09
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cba0
mov esp, ebp
pop ebp
ret 4
Function at 0x416b20
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x570
push esi
push edi
mov dword [ebp - 8], ecx
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x416b67
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
xor eax, eax
jmp 0x416ba8
mov ecx, 0x159
mov esi, dword [ebp - 4]
lea edi, [ebp - 0x570]
rep movsd dword es:[edi], dword [esi]
movzx edx, word [ebp - 0x4b6]
shl edx, 0xa
shl edx, 0xa
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x416b94
mov dword [ebp - 0xc], 0x5000000
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret