joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ae40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
test esi, esi
jbe 0x43ae83
test bl, 7
je 0x43ae7f
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x528930]
shr edx, 8
xor edx, dword [ecx*8 + 0x528934]
dec esi
inc ebx
test esi, esi
ja 0x43ae57
mov dword [esp + 0x1c], esi
mov ecx, esi
shr ecx, 3
lea ecx, [ebx + ecx*8]
mov dword [esp + 0x18], ecx
cmp ebx, ecx
jae 0x43af71
push ebp
mov ecx, dword [ebx]
xor ecx, eax
mov eax, dword [ebx + 4]
xor eax, edx
mov edx, eax
shr edx, 0x10
movzx esi, dl
mov edi, dword [esi*8 + 0x529130]
mov esi, dword [esi*8 + 0x529134]
mov edx, eax
shr edx, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x528930]
xor esi, dword [edx*8 + 0x528934]
mov edx, eax
shr edx, 8
movzx edx, dl
xor edi, dword [edx*8 + 0x529930]
xor esi, dword [edx*8 + 0x529934]
movzx edx, al
xor edi, dword [edx*8 + 0x52a130]
xor esi, dword [edx*8 + 0x52a134]
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x52a930]
xor esi, dword [edx*8 + 0x52a934]
shr ebp, 0x18
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x10
movzx edx, dl
xor edi, dword [edx*8 + 0x52b130]
xor esi, dword [edx*8 + 0x52b134]
mov edx, ecx
shrd edx, eax, 8
mov dword [esp + 0x18], eax
shr eax, 8
movzx eax, dl
xor edi, dword [eax*8 + 0x52b930]
xor esi, dword [eax*8 + 0x52b934]
movzx eax, cl
xor esi, dword [eax*8 + 0x52c134]
xor edi, dword [eax*8 + 0x52c130]
add ebx, 8
shr ebp, 0x10
mov eax, edi
mov edx, esi
cmp ebx, dword [esp + 0x1c]
jb 0x43ae98
mov esi, dword [esp + 0x20]
pop ebp
and esi, 7
jbe 0x43af99
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x528930]
shr edx, 8
xor edx, dword [ecx*8 + 0x528934]
dec esi
inc ebx
test esi, esi
ja 0x43af76
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x43afa0
Capabilities:
Encode data using xor

Disassembly:
xor dl, dl
push esi
mov esi, dword [esp + 8]
mov byte [ecx + 0x10b6], dl
mov byte [ecx + 0x10b5], dl
mov byte [ecx + 0x10b4], dl
mov al, byte [esi]
cmp al, dl
je 0x43afe4
push ebx
mov bl, byte [ecx + 0x10b6]
add byte [ecx + 0x10b4], al
xor byte [ecx + 0x10b5], al
add bl, al
rol bl, 1
inc esi
mov byte [ecx + 0x10b6], bl
mov al, byte [esi]
cmp al, dl
jne 0x43afc0
pop ebx
pop esi
ret 4
Function at 0x43aff0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xba4]
push eax
call fcn.0043a970
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b010
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.0043aac0
mov word [esi + 0x10b8], ax
shr eax, 0x10
xor ecx, ecx
xor edx, edx
mov word [esi + 0x10ba], ax
mov word [esi + 0x10be], cx
mov word [esi + 0x10bc], dx
mov al, byte [edi]
test al, al
je 0x43b086
mov edx, edi
lea ecx, [ecx]
movzx ecx, al
mov di, word [esi + ecx*4 + 0xba4]
lea ecx, [esi + ecx*4 + 0xba4]
movzx ax, al
xor di, ax
xor word [esi + 0x10bc], di
mov cx, word [ecx + 2]
add cx, ax
add word [esi + 0x10be], cx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x43b050
pop edi
pop esi
ret 4

Function at 0x43b0f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
test edi, edi
je 0x43b1aa
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x43b110
mov ecx, 0x1234
add word [eax + 0x10b8], cx
movzx ecx, word [eax + 0x10b8]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0xba4]
xor word [eax + 0x10ba], dx
mov bx, word [eax + 0x10be]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0xba6]
sub word [eax + 0x10bc], dx
movzx edx, word [eax + 0x10bc]
xor edx, ecx
mov word [eax + 0x10b8], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0x10ba]
ror bx, cl
movzx ecx, bx
xor word [eax + 0x10b8], cx
mov word [eax + 0x10be], cx
movzx ecx, word [eax + 0x10b8]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x43b110
pop esi
pop ebx
pop edi
ret 8

Function at 0x43b1b0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esp + 4]
inc eax
mov edx, 4
push esi
jmp 0x43b1c0
movzx esi, byte [eax - 1]
mov esi, dword [ecx + esi*4 + 0xba4]
xor dword [ecx + 0x10a4], esi
movzx esi, byte [eax]
mov esi, dword [ecx + esi*4 + 0xba4]
xor dword [ecx + 0x10a8], esi
movzx esi, byte [eax + 1]
mov esi, dword [ecx + esi*4 + 0xba4]
xor dword [ecx + 0x10ac], esi
movzx esi, byte [eax + 2]
mov esi, dword [ecx + esi*4 + 0xba4]
xor dword [ecx + 0x10b0], esi
add eax, 4
sub edx, 1
jne 0x43b1c0
pop esi
ret 4
Function at 0x43b5f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1d8
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1d4], eax
mov eax, dword [esp + 0x1ec]
push ebx
mov ebx, dword [esp + 0x1e8]
push esi
mov esi, dword [esp + 0x1e8]
push edi
mov edi, dword [esp + 0x1e8]
mov dword [esp + 0xc], eax
cmp esi, 0x40
jbe 0x43b669
lea ecx, [esp + 0xf0]
push ecx
call fcn.00468700
push esi
push edi
lea edx, [esp + 0xf8]
push edx
call fcn.00468bb0
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0xf4]
push ecx
call fcn.00468c60
lea edi, [esp + 0x1a0]
mov esi, 0x20
xor eax, eax
test esi, esi
jbe 0x43b695
push ebp
mov ebp, edi
lea edx, [esp + 0x164]
sub ebp, edx
jmp 0x43b680
lea ecx, [esp + eax + 0x164]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x43b680
pop ebp
cmp esi, 0x40
jae 0x43b6b4
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x36
push eax
call fcn.004e7df0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call fcn.00468700
push 0x40
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00468bb0
mov edx, dword [esp + 0x1f4]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.00468bb0
lea ecx, [esp + 0x1c0]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00468c60
lea eax, [esp + 0x80]
push eax
call fcn.00468700
xor eax, eax
test esi, esi
jbe 0x43b727
lea ecx, [esp + 0x160]
sub edi, ecx
lea ecx, [esp + eax + 0x160]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x43b713
cmp esi, 0x40
jae 0x43b746
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x5c
push eax
call fcn.004e7df0
add esp, 0xc
push 0x40
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.00468bb0
push 0x20
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x88]
push edx
call fcn.00468bb0
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x84]
push ecx
call fcn.00468c60
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1d8
ret 0x14
Function at 0x43b7a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc8
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0xd4]
push ebx
mov ebx, dword [esp + 0xe4]
push ebp
mov ebp, dword [esp + 0xe4]
push esi
mov esi, dword [esp + 0xe4]
push edi
mov edi, dword [esp + 0xdc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov ecx, esi
cmp esi, 0x40
jb 0x43b7f6
mov ecx, 0x40
push ecx
push eax
lea edx, [esp + 0x78]
push edx
call fcn.004e7a80
mov edx, dword [esp + 0xec]
add esp, 0xc
lea eax, [esp + 0x50]
push eax
mov byte [esp + esi + 0x74], 0
mov byte [esp + esi + 0x75], 0
mov byte [esp + esi + 0x76], 0
mov byte [esp + esi + 0x77], 1
add esi, 4
push esi
lea ecx, [esp + 0x78]
push ecx
push edx
push edi
call fcn.0043b5f0
mov eax, dword [esp + 0xf8]
dec eax
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, 0x10
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
xor ebx, ebx
nop
mov eax, dword [esp + ebx + 0x24]
test eax, eax
jbe 0x43b8f1
mov ebp, eax
lea ebx, [ebx]
mov ecx, dword [esp + 0xe0]
lea edx, [esp + 0xb4]
push edx
mov edx, dword [esp + 0x18]
push 0x20
lea eax, [esp + 0x58]
push eax
push ecx
push edx
call fcn.0043b5f0
mov ecx, 8
lea esi, [esp + 0xb4]
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x43b8c0
movzx ecx, byte [esp + eax + 0x50]
movzx edx, byte [esp + eax + 0x51]
xor byte [esp + eax + 0x30], cl
xor byte [esp + eax + 0x31], dl
movzx ecx, byte [esp + eax + 0x52]
movzx edx, byte [esp + eax + 0x53]
xor byte [esp + eax + 0x32], cl
xor byte [esp + eax + 0x33], dl
add eax, 4
cmp eax, 0x20
jb 0x43b8c0
sub ebp, 1
jne 0x43b880
mov edi, dword [esp + ebx + 0x18]
add ebx, 4
mov ecx, 8
lea esi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
cmp ebx, 0xc
jb 0x43b870
push 0x44
lea eax, [esp + 0x74]
push eax
call fcn.00466920
push 0x20
lea ecx, [esp + 0x34]
push ecx
call fcn.00466920
push 0x20
lea edx, [esp + 0x54]
push edx
call fcn.00466920
push 0x20
lea eax, [esp + 0xb8]
push eax
call fcn.00466920
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0xc8
ret 0x20
Function at 0x43c650
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x38]
cmp dword [edi], 2
jne 0x43c701
mov eax, dword [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push 0x20
push ebx
mov dword [esp + 0x20], eax
call fcn.0043b5f0
xor edx, edx
mov dword [edi + 4], edx
mov eax, edx
lea esi, [edx - 2]
push ebp
jmp 0x43c6a0
movzx ebp, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi - 1]
and ecx, 3
add ecx, ecx
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x15]
add ecx, ecx
shl ebp, cl
mov ecx, esi
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x16]
add ecx, ecx
add ecx, ecx
shl ebp, cl
lea ecx, [esi + 1]
and ecx, 3
add ecx, ecx
xor eax, ebp
movzx ebp, byte [esp + edx + 0x17]
add ecx, ecx
add ecx, ecx
shl ebp, cl
add edx, 4
add esi, 4
xor eax, ebp
cmp edx, 0x20
jb 0x43c6a0
mov dword [edi + 4], eax
pop ebp
cmp dword [edi], 3
jne 0x43c724
lea eax, [esp + 0x10]
push eax
push 0x20
add edi, 4
push edi
push 0x20
push ebx
call fcn.0043b5f0
mov ecx, 8
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x28
ret 8

Function at 0x43cbb0
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push 0xf0000040
push 1
xor esi, esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebp, dword [esp + 0x20]
test eax, eax
je 0x43cbff
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
mov eax, dword [esp + 0xc]
push esi
push eax
sete bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x43cc62
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.0046ab50
lea ecx, [esp + 0x14]
call fcn.0046ab30
mov esi, eax
mov edi, edx
call fcn.004ea4fa
cdq
add esi, eax
adc edi, edx
xor ebx, ebx
test ebp, ebp
jbe 0x43cc61
mov edi, edi
mov ecx, ebx
and ecx, 7
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov eax, esi
mov edx, edi
call fcn.004e9600
mov edx, dword [esp + 0x20]
mov cl, al
mov eax, dword [0x52e934]
xor cl, bl
add cl, al
mov byte [ebx + edx], cl
inc eax
inc ebx
mov dword [0x52e934], eax
cmp ebx, ebp
jb 0x43cc30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x43ce50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov edx, dword [esi]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, edx
jbe 0x43ceb8
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp edx, ecx
jb 0x43ce94
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
lea ebx, [ebx]
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
inc ecx
mov dword [ebx + eax], ebp
add eax, 4
cmp ecx, dword [esi]
jbe 0x43ce80
mov ebx, dword [esp + 0x14]
mov eax, dword [edi]
sub eax, dword [esi]
lea edx, [edi + ecx*4]
add eax, eax
add eax, eax
push eax
push edx
lea eax, [ebx + ecx*4]
push eax
call fcn.004e7a80
mov ecx, dword [edi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], ecx
pop ebx
ret 0xc
jae 0x43cf08
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp eax, ecx
jb 0x43cee4
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
mov ebp, dword [eax + edx]
xor ebp, dword [eax]
inc ecx
mov dword [eax + ebx], ebp
add eax, 4
cmp ecx, dword [edi]
jbe 0x43ced0
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
sub edx, dword [edi]
lea eax, [esi + ecx*4]
add edx, edx
add edx, edx
push edx
push eax
lea ecx, [ebx + ecx*4]
push ecx
call fcn.004e7a80
mov edx, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], edx
pop ebx
ret 0xc
test eax, eax
jbe 0x43cf22
mov edx, edi
lea ecx, [esi + eax*4]
sub edx, esi
mov ebx, dword [ecx + edx]
xor ebx, dword [ecx]
jne 0x43cf22
dec eax
sub ecx, 4
test eax, eax
ja 0x43cf13
mov edx, dword [esp + 0x14]
mov dword [edx], eax
test eax, eax
jbe 0x43cf43
sub edi, esi
lea ecx, [esi + eax*4]
sub edx, esi
mov esi, dword [ecx + edi]
xor esi, dword [ecx]
dec eax
mov dword [ecx + edx], esi
sub ecx, 4
test eax, eax
ja 0x43cf33
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x43cf50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
mov esi, dword [esp + 0x5c]
cmp dword [esi], 0
je 0x43d07a
mov ebp, dword [esp + 0x60]
mov eax, dword [ebp]
test eax, eax
je 0x43d07a
mov ecx, ebp
lea edx, [esp + 8]
sub ecx, edx
push edi
lea ebx, [ebx]
mov edi, dword [0x52e93c]
lea edx, [ecx + eax*4]
sub eax, 1
mov edx, dword [esp + edx + 0xc]
mov edx, dword [edi + edx*4]
mov dword [esp + eax*4 + 0x10], edx
jne 0x43cf80
mov edi, dword [esp + 0x5c]
push ebx
push 0x90
push eax
push edi
call fcn.004e7df0
mov ebx, dword [esi]
add esp, 0xc
test ebx, ebx
je 0x43d027
mov ebp, dword [0x52e938]
lea esp, [esp]
mov eax, dword [esi + ebx*4]
mov ecx, dword [0x52e93c]
mov esi, dword [ecx + eax*4]
cmp esi, 0x7fff
je 0x43d01a
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
test eax, eax
je 0x43d01a
lea ecx, [ebx + eax]
lea edx, [edi + ecx*4 - 4]
jmp 0x43cff0
mov ecx, dword [esp + eax*4 + 0x10]
cmp ecx, 0x7fff
je 0x43d012
add ecx, esi
cmp ecx, 0x7fff
jb 0x43d00c
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
dec eax
sub edx, 4
test eax, eax
jne 0x43cff0
sub ebx, 1
mov esi, dword [esp + 0x64]
jne 0x43cfc0
mov ebp, dword [esp + 0x68]
mov edx, dword [esi]
mov eax, dword [ebp]
lea ecx, [edx + eax - 1]
cmp ecx, 0x11
mov dword [edi], ecx
pop ebx
jle 0x43d057
lea eax, [edi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
nop
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], 0
sub eax, 4
sub edx, 1
jne 0x43d040
cmp dword [edi], 0x11
jbe 0x43d071
mov dword [edi], 0x11
mov eax, dword [edi]
cmp dword [edi + eax*4], 0
jne 0x43d071
dec eax
mov dword [edi], eax
test eax, eax
jne 0x43d062
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov ecx, dword [esp + 0x58]
pop esi
mov dword [ecx], 0
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x43d090
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
xor ebp, ebp
cmp eax, ebp
je 0x43d175
mov ecx, dword [edi + eax*4]
push ebx
mov ebx, dword [0x52e93c]
mov ecx, dword [ebx + ecx*4]
push esi
cmp ecx, 0x7fff
je 0x43d0db
add ecx, ecx
cmp ecx, 0x7fff
jb 0x43d0c8
add ecx, 0xffff8001
mov edx, dword [0x52e938]
mov ecx, dword [edx + ecx*4]
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ecx
jmp 0x43d0e3
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ebp
mov ecx, dword [edi]
sub ecx, 1
je 0x43d128
lea edx, [esi + ecx*8 - 4]
mov edi, edi
mov dword [edx + 4], ebp
mov eax, dword [edi + ecx*4]
mov eax, dword [ebx + eax*4]
cmp eax, 0x7fff
je 0x43d11e
add eax, eax
cmp eax, 0x7fff
jb 0x43d10e
add eax, 0xffff8001
mov ebp, dword [0x52e938]
mov eax, dword [ebp + eax*4]
mov dword [edx], eax
xor ebp, ebp
jmp 0x43d120
mov dword [edx], ebp
dec ecx
sub edx, 8
cmp ecx, ebp
jne 0x43d0f0
mov eax, dword [edi]
lea ecx, [eax + eax - 1]
cmp ecx, 0x11
mov dword [esi], ecx
jle 0x43d153
lea eax, [esi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
lea esp, [esp]
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], ebp
sub eax, 4
sub edx, 1
jne 0x43d140
cmp dword [esi], 0x11
jbe 0x43d16e
mov dword [esi], 0x11
mov edi, edi
mov eax, dword [esi]
cmp dword [esi + eax*4], ebp
jne 0x43d16e
dec eax
mov dword [esi], eax
cmp eax, ebp
jne 0x43d160
pop esi
pop ebx
pop edi
pop ebp
ret 8
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], ebp
pop ebp
ret 8
Function at 0x443b20
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4fc95b
mov eax, dword fs:[0]
push eax
mov eax, 0x5028
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x5024], eax
push ebx
push esi
push edi
mov eax, dword [0x519bc0]
xor eax, esp
push eax
lea eax, [esp + 0x5038]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5048]
push 0x800
lea eax, [esp + 0x2038]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x443d32
cmp eax, 0x800
jae 0x443d32
push 0x800
lea ecx, [esp + 0x3038]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x443d32
cmp eax, 0x800
jae 0x443d32
lea edx, [esp + 0x2034]
push edx
call fcn.004534c0
mov ebx, eax
lea eax, [esp + 0x3034]
push eax
call fcn.004534c0
mov esi, eax
cmp word [esi], 0
je 0x443d32
push esi
push ebx
call fcn.0046cb00
test eax, eax
je 0x443d32
push esi
push edi
call fcn.004534c0
push eax
call fcn.0046cb00
test eax, eax
jne 0x443d32
mov word [esp + 0x1034], ax
xor esi, esi
lea esp, [esp]
test ax, ax
jne 0x443c82
push 0x800
push edi
lea ecx, [esp + 0x103c]
push ecx
call fcn.004694b0
push esi
push str.rtmp_d
lea edx, [esp + 0x103c]
push edx
call fcn.004534c0
push eax
mov edx, 0x800
call fcn.004a63e0
add esp, 0xc
lea eax, [esp + 0x1034]
push eax
call fcn.00445470
test al, al
je 0x443c66
xor eax, eax
mov word [esp + 0x1034], ax
jmp 0x443c6e
mov ax, word [esp + 0x1034]
add esi, 0x7b
cmp esi, 0x2710
jl 0x443c10
test ax, ax
je 0x443d32
push 0x800
push edi
lea ecx, [esp + 0x403c]
push ecx
call fcn.004694b0
push 0x800
push ebx
lea edx, [esp + 0x403c]
push edx
call fcn.00453690
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [esp + 0x1034]
push eax
lea ecx, [esp + 0x4038]
push ecx
call esi
test eax, eax
je 0x443d32
lea ecx, [esp + 0x10]
call fcn.00443e50
mov dword [esp + 0x5040], 0
push edi
xor bl, bl
call fcn.00445470
test al, al
jne 0x443cf2
push 0x12
push edi
lea ecx, [esp + 0x18]
call fcn.00444060
mov bl, al
lea edx, [esp + 0x4034]
push edx
lea eax, [esp + 0x1038]
push eax
call esi
test bl, bl
je 0x443d1a
lea ecx, [esp + 0x10]
call fcn.004441a0
lea ecx, [esp + 0x10]
call fcn.00444200
mov dword [esp + 0x5040], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004445b0
mov al, 1
jmp 0x443d34
xor al, al
mov ecx, dword [esp + 0x5038]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5024]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x5034
ret 4
Function at 0x443ed0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1010
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1018]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1020]
push edi
mov edi, ecx
cmp byte [edi + 0x1c], 0
mov dword [esp + 0x14], esi
mov dword [edi + 0x1020], 0
jne 0x443f18
test al, 4
jne 0x443f18
xor cl, cl
jmp 0x443f1a
mov cl, 1
mov edx, eax
shr edx, 1
and dl, 1
movzx ebp, dl
neg ebp
sbb ebp, ebp
and ebp, 0xc0000000
add ebp, 0x80000000
test al, 1
je 0x443f3e
or ebp, 0x40000000
shr eax, 3
not eax
and eax, 1
mov dword [esp + 0x18], eax
test cl, cl
je 0x443f55
or eax, 2
mov dword [esp + 0x18], eax
xor ebx, ebx
cmp byte [edi + 0x15], bl
push 0
setne bl
dec ebx
and ebx, 0x8000000
push ebx
push 3
push 0
push eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x443fdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push 0x800
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.004531f0
test al, al
je 0x443fcb
mov edx, dword [esp + 0x18]
push 0
push ebx
push 3
push 0
push edx
push ebp
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x443fc6
mov dword [esp + 0x10], eax
cmp esi, 0xffffffff
jne 0x443fdc
cmp dword [esp + 0x10], 2
jne 0x443fdc
mov dword [edi + 0x1020], 1
cmp esi, 0xffffffff
setne bl
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
test bl, bl
je 0x44400b
mov ecx, dword [esp + 0x14]
push 0x800
mov dword [edi + 4], esi
push ecx
add edi, 0x1e
push edi
call fcn.004694b0
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1010
ret 8
Function at 0x4442a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, ecx
test ebp, ebp
jne 0x4442b9
pop esi
mov al, 1
pop ebp
add esp, 0x1c
ret 8
cmp dword [esi + 0xc], 1
jne 0x4442ca
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
push edi
jmp 0x4442d4
mov ebp, dword [esp + 0x34]
xor edi, edi
xor bl, bl
mov dword [esp + 0x10], edi
cmp dword [esi + 0xc], edi
je 0x444325
test ebp, ebp
jbe 0x444349
mov eax, ebp
sub eax, edi
cmp eax, 0x4000
jb 0x4442f5
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bl
test bl, bl
je 0x444349
add edi, 0x4000
cmp edi, ebp
jb 0x4442e5
jmp 0x444341
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push edi
lea edx, [esp + 0x14]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bl
test bl, bl
jne 0x44443b
cmp byte [esi + 0x14], 0
je 0x44443b
cmp dword [esi + 0xc], 0
jne 0x44443b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov dword [esp + 0x14], eax
lea eax, [esi + 0x1e]
push eax
mov dword [esp + 0x1c], edx
call fcn.00444d00
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
jb 0x4443de
ja 0x44439e
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x34]
jbe 0x4443de
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, edi
sub edx, dword [esp + 0x34]
mov ecx, ebp
sbb ecx, eax
test ecx, ecx
jg 0x4443de
jl 0x4443bb
cmp edx, 0xffffffff
ja 0x4443de
mov ecx, dword [esp + 0x34]
add ecx, edi
adc eax, ebp
mov dword [esp + 0x28], eax
js 0x4443de
jg 0x4443d0
cmp ecx, 0xffffffff
jbe 0x4443de
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x531158
call fcn.0043f600
push 0
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x531158
call fcn.0043f660
test al, al
je 0x44442b
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x34]
jae 0x4442d0
test eax, eax
jbe 0x4442d0
mov edi, dword [esi]
mov edx, dword [edi + 0x10]
push 0
mov ecx, esi
call edx
mov ecx, dword [esp + 0x14]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
mov edx, dword [edi + 0xc]
push eax
mov ecx, esi
call edx
jmp 0x4442d0
lea eax, [esi + 0x1e]
push eax
push 0
mov ecx, 0x531158
call fcn.0043f8b0
pop edi
mov al, bl
pop ebx
mov byte [esi + 8], 1
pop esi
pop ebp
add esp, 0x1c
ret 8