joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f3f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbf6e
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
push ebx
mov dword [ebp - 0x34], ebx
call fcn.00453b40
lea edx, [ebx + 0x2120]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, 7
xor eax, eax
mov dword [edx + 0x14], esi
mov dword [edx + 0x10], ecx
mov dword [ebp - 0x3c], edx
mov word [edx], ax
lea eax, [ebx + 0x213c]
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], ecx
mov dword [ebp - 0x30], eax
mov word [eax], cx
lea ecx, [ebx + 0x58]
mov byte [ebp - 4], 2
mov eax, edi
sub ecx, edi
movzx esi, word [eax]
mov word [ecx + eax], si
add eax, 2
test si, si
jne 0x45f463
mov ecx, str.Identify.idn
lea eax, [ebx + 0x1058]
sub eax, ecx
nop
movzx esi, word [ecx]
mov word [eax + ecx], si
add ecx, 2
test si, si
jne 0x45f480
lea eax, [ebx + 0x1120]
mov ecx, edi
sub eax, edi
lea esp, [esp]
movzx esi, word [ecx]
mov word [eax + ecx], si
add ecx, 2
test si, si
jne 0x45f4a0
lea eax, [ebx + 0x1058]
mov esi, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45f4b7
sub eax, esi
lea edi, [ebx + 0x111e]
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x45f4d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x2158], eax
mov dword [ebx + 0x215c], eax
push eax
mov eax, 0x4ddda0
mov esi, edx
call fcn.00403e70
mov esi, dword [ebp - 0x30]
push 0
mov eax, 0x4ddda0
call fcn.00403e70
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebx + 0x58]
push eax
call esi
cmp eax, 0xffffffff
je 0x45f5ea
and eax, 0x10
je 0x45f5ea
lea edi, [ebx + 0x1120]
push edi
call esi
cmp eax, 0xffffffff
je 0x45f5ea
shr eax, 4
not eax
and eax, 1
je 0x45f5ea
xor edx, edx
mov eax, edi
mov word [ebp - 0x2c], dx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
lea edx, [eax + 2]
jmp 0x45f570
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45f570
sub eax, edx
sar eax, 1
push eax
lea eax, [ebx + 0x1120]
lea esi, [ebp - 0x2c]
call fcn.00403e70
mov eax, esi
push eax
push ebx
mov byte [ebp - 4], 3
call fcn.00457650
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 8
movzx esi, al
jb 0x45f5b4
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00490a16
add esp, 4
test esi, esi
je 0x45f5ea
mov esi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x3c]
mov ecx, esi
call fcn.0045f6d0
test eax, eax
je 0x45f5e6
mov ebx, dword [ebp - 0x30]
mov ecx, esi
call fcn.0045f7b0
mov ecx, esi
mov dword [esi + 0x215c], eax
call fcn.0045f890
mov dword [esi + 0x2158], eax
mov eax, esi
jmp 0x45f5ec
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
Function at 0x45f890
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb418
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
cmp dword [ebx + 0x215c], eax
je 0x45f952
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], cx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.004600d0
test eax, eax
jne 0x45f8fa
push 5
mov eax, 0x4e5b64
lea esi, [ebp - 0x2c]
call fcn.00403e70
mov eax, dword [ebp - 0x2c]
mov esi, 8
lea ecx, [ebx + 0x213c]
cmp dword [ebp - 0x18], esi
jae 0x45f910
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.00408eb0
test eax, eax
je 0x45f938
cmp dword [ebp - 0x18], esi
jb 0x45f931
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00490a16
add esp, 4
xor eax, eax
jmp 0x45fa5b
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], esi
jb 0x45f981
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00490a16
add esp, 4
jmp 0x45f981
lea esi, [ebx + 0x213c]
push ebx
mov ecx, esi
call fcn.004600d0
test eax, eax
jne 0x45f970
push 5
mov eax, 0x4e5b64
call fcn.00403e70
mov ecx, ebx
mov dword [ebx + 0x215c], 1
call fcn.0045fb80
xor ecx, ecx
mov edi, 7
push 9
mov eax, str.UDISKSIZE
lea esi, [ebp - 0x48]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], cx
call fcn.00403e70
mov dword [ebp - 4], 1
xor edx, edx
push 9
mov eax, 0x4e2040
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
call fcn.00403e70
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
mov edx, esi
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004570c0
cmp dword [ebp - 0x18], 8
mov esi, eax
jb 0x45f9f2
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00490a16
add esp, 4
xor edx, edx
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
jb 0x45fa14
mov eax, dword [ebp - 0x48]
push eax
call fcn.00490a16
add esp, 4
cmp esi, 0xffffffff
je 0x45f931
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x58]
push eax
add ebx, 0x58
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x45fa3c
or eax, 0xffffffff
jmp 0x45fa49
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
shrd eax, ecx, 0x14
shr ecx, 0x14
sub eax, esi
jns 0x45fa4f
neg eax
xor edx, edx
cmp eax, 0x1f4
setl dl
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
Function at 0x4600d0
Capabilities:
Get disk information via ioctl
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [str._C:]
mov eax, dword [ebp + 8]
push ebx
push 0
push 0
push 3
mov dword [ebp - 0x14], edx
mov edx, dword [0x4e5b78]
push 0
mov dword [ebp - 0x2b8], ecx
mov ecx, dword [0x4e5b74]
mov dword [ebp - 0xc], edx
mov dx, word [eax + 0x58]
push 3
mov dword [ebp - 0x10], ecx
mov cx, word [0x4e5b7c]
push SysReAllocString
lea eax, [ebp - 0x14]
push eax
mov word [ebp - 8], cx
mov word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x460168
push 0
lea ecx, [ebp - 0x2b0]
push ecx
push 0xc
lea edx, [ebp - 0x2ac]
push edx
push 0
push 0
push 0x2d1080
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x46017b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x2a8]
xor eax, eax
push esi
push edi
push ecx
push 0x4e3fe0
lea edx, [ebp - 0x3c]
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], ax
call fcn.0040e460
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x29e]
push eax
mov word [ebp - 0x2a0], dx
call fcn.00497ad0
add esp, 0x14
mov ecx, 0x16
mov esi, str.SYSTEMCurrentControlSetServicesDiskEnum_
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x2b4]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x98]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2b0], 0x208
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4602a2
lea eax, [ebp - 0x2b0]
push eax
mov eax, dword [ebp - 0x2b4]
lea ecx, [ebp - 0x2a0]
push ecx
push 0
push 0
lea edx, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4602a2
lea ecx, [ebp - 0x2a0]
push 0x5c
push ecx
call fcn.00491576
lea edx, [ebp - 0x2a0]
push 0x26
push edx
mov esi, eax
call fcn.00491576
mov edx, dword [ebp - 0x2b8]
xor ecx, ecx
add esp, 0x10
mov word [eax], cx
lea eax, [esi + 2]
push edx
call fcn.00408fb0
mov eax, dword [ebp - 0x2b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00490a21
mov esp, ebp
pop ebp
ret 4
Function at 0x462bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ecx + eax + 0x78]
mov ecx, dword [ecx + eax + 0x7c]
mov esi, dword [edi + eax + 0x1c]
mov edx, dword [edi + eax + 0x24]
mov dword [ebp - 0xe0], ecx
mov ecx, dword [edi + eax + 0x20]
add esi, eax
add ecx, eax
add edx, eax
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], edx
test ebx, 0xffff0000
je 0x462c5e
cmp dword [edi + eax + 0x18], 0
mov dword [ebp - 0xd0], 0
jg 0x462d46
mov ecx, dword [edi + eax + 0x10]
cmp ebx, ecx
jb 0x462dcb
mov edx, dword [edi + eax + 0x14]
lea edx, [edx + ecx - 1]
cmp ebx, edx
ja 0x462dcb
sub ebx, ecx
mov esi, dword [esi + ebx*4]
add esi, eax
lea ecx, [eax + edi]
cmp esi, ecx
jb 0x462db8
add eax, dword [ebp - 0xe0]
add eax, edi
cmp esi, eax
ja 0x462db8
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.00497ad0
push 0x63
lea ecx, [ebp - 0xcb]
push 0
push ecx
mov byte [ebp - 0xcc], 0
call fcn.00497ad0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x18
push esi
lea edx, [ebp - 0x68]
push edx
call edi
lea eax, [ebp - 0x68]
push 0x2e
push eax
call fcn.00495cc0
add esp, 8
test eax, eax
je 0x462db8
mov byte [eax], 0
inc eax
push eax
lea ecx, [ebp - 0xcc]
push ecx
call edi
push 0x4e5c5c
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x462db8
lea ecx, [ebp - 0xcc]
push ecx
push eax
call fcn.00462bf0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ecx + edx*4]
mov esi, ebx
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x462d73
test dl, dl
je 0x462d6f
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x462d73
add ecx, 2
add esi, 2
test dl, dl
jne 0x462d53
xor ecx, ecx
jmp 0x462d78
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x462d9a
mov ecx, dword [ebp - 0xd0]
inc ecx
mov dword [ebp - 0xd0], ecx
cmp ecx, dword [edi + eax + 0x18]
jl 0x462d40
mov esi, dword [ebp - 0xd4]
jmp 0x462c5e
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xd8]
movzx ecx, word [ecx + edx*2]
mov edx, dword [ebp - 0xd4]
mov esi, dword [edx + ecx*4]
jmp 0x462c7f
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00490a21
mov esp, ebp
pop ebp
ret
Function at 0x463b80
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x506360], 0
jne 0x463b98
call fcn.004632c0
mov dword [0x506360], 1
mov eax, dword [0x505fc0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x463bbf
push str.ws2_32.dll
call edi
mov dword [0x505fc0], eax
test eax, eax
je 0x463be8
push 0x4e62d4
push eax
call esi
mov dword [0x50228c], eax
mov dword [0x502290], eax
mov eax, dword [0x505fc0]
push str.send
push eax
call esi
mov dword [0x502294], eax
mov dword [0x502298], eax
mov eax, dword [0x505fc4]
test eax, eax
jne 0x463c01
push str.odbc32.dll
call edi
mov dword [0x505fc4], eax
test eax, eax
je 0x463c13
push str.SQLDrivers
push eax
call esi
mov dword [0x5060dc], eax
mov dword [0x5060e0], eax
mov eax, dword [0x505fc8]
test eax, eax
jne 0x463c2c
push str.dbnetlib.dll
call edi
mov dword [0x505fc8], eax
test eax, eax
je 0x463c56
push str.ConnectionObjectSize
push eax
call esi
mov ecx, dword [0x505fc8]
push str.ConnectionOpen
push ecx
mov dword [0x5022a0], eax
mov dword [0x5060e4], eax
call esi
mov dword [0x5022a4], eax
mov dword [0x5060e8], eax
call fcn.00463c70
pop edi
pop esi
jmp fcn.00463ce0
Function at 0x46ec40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
xor edi, edi
push 0x40
lea eax, [esi + 4]
push edi
mov dword [esi], vtable.CEnc.0
push eax
mov dword [esi + 0x80c], edi
call fcn.00497ad0
add esp, 0xc
push edi
mov ecx, esi
mov dword [esi + 0x804], edi
mov dword [esi + 0x814], edi
call fcn.00472400
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0xc]
shl edx, 5
mov dword [ebp - 4], edi
lea edi, [ebp - 4]
mov dword [esi + 0x818], edx
call fcn.0041af40
mov eax, dword [ebp - 4]
mov dword [esi + 0x80c], eax
mov eax, esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x472270
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9024
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], esi
call fcn.004138b0
mov ecx, eax
mov dword [ebp - 4], esi
mov eax, dword [ecx + 0x10]
mov ebx, 1
push str.B7ZE_91L7_UC05_I27Q_H7PP
lea edi, [esi + 0x18]
mov dword [ebp - 0x38], ebx
call fcn.00408eb0
test eax, eax
jne 0x47230b
mov eax, dword [0x502278]
cmp eax, esi
jne 0x472302
push 0x1e8
call fcn.00490dc4
add esp, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], ebx
cmp eax, esi
je 0x4722fb
mov ecx, eax
call fcn.0040e6a0
jmp 0x4722fd
xor eax, eax
mov dword [0x502278], eax
cmp dword [eax], 0xd
jne 0x47230b
mov bl, 1
jmp 0x47230d
xor bl, bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x472326
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00490a16
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
test bl, bl
je 0x4723b2
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.AcGenral.dll
call esi
test eax, eax
jne 0x47238d
push str.AcLayers.dll
call esi
test eax, eax
jne 0x47238d
push str.AcSpecfc.dll
call esi
test eax, eax
jne 0x47238d
push str.acwow64.dll
call esi
test eax, eax
jne 0x47238d
push str.apihex86.dll
call esi
test eax, eax
jne 0x47238d
push str.AcXtrnal.dll
call esi
test eax, eax
jne 0x47238d
push str.apihex64.dll
call esi
test eax, eax
je 0x4723b0
mov esi, dword [ebp - 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4723ac
mov ecx, dword [ebp - 0x30]
push esi
push ecx
call fcn.00495d7e
add esp, 8
test eax, eax
je 0x4723d3
xor eax, eax
jmp 0x4723d8
xor esi, esi
mov edx, dword [ebp - 0x34]
push 1
push esi
push esi
mov esi, dword [ebp - 0x30]
push edx
push esi
call dword [0x506044]
test eax, eax
jne 0x4723d3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x4723d8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 4
Function at 0x474070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb000
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
lea edx, [ebp + 8]
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0044c970
mov byte [ebp - 4], 1
lea esi, [ebx + 7]
cmp dword [ebp + 0x24], ebx
je 0x4740fe
cmp dword [0x50624c], 8
mov eax, dword [0x506238]
jae 0x4740cc
mov eax, 0x506238
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x474153
shr eax, 4
not eax
and eax, 1
je 0x474153
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
xor eax, eax
push ebx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
mov word [ecx], ax
push 0x506238
jmp 0x474141
cmp dword [0x506268], 8
mov eax, dword [0x506254]
jae 0x474111
mov eax, 0x506254
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x474153
shr eax, 4
not eax
and eax, 1
je 0x474153
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
xor edx, edx
push ebx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
mov word [ecx], dx
push 0x506254
or eax, 0xffffffff
call fcn.00404570
mov ecx, edi
call fcn.00477580
add esp, 0x20
mov edi, 8
cmp dword [ebp - 0x18], edi
jb 0x474169
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00490a16
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
cmp dword [ebp + 0x1c], edi
jb 0x474186
mov edx, dword [ebp + 8]
push edx
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4741b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cafc0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.0044c970
mov byte [ebp - 4], 1
cmp dword [0x50624c], 8
mov eax, dword [0x506238]
jae 0x474202
mov eax, 0x506238
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, 7
cmp eax, 0xffffffff
je 0x47424f
shr eax, 4
not eax
and eax, 1
je 0x47424f
push 1
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [ebp - 0x30], esp
push eax
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], 0
mov word [ecx], ax
push 0x506238
or eax, 0xffffffff
call fcn.00404570
mov ecx, dword [ebp + 0x24]
call fcn.00477580
add esp, 0x20
cmp dword [ebp - 0x18], 8
jb 0x474261
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00490a16
add esp, 4
xor edx, edx
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
jb 0x474283
mov eax, dword [ebp + 8]
push eax
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4742a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caf88
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.0044c970
mov byte [ebp - 4], 1
cmp dword [0x506268], 8
mov eax, dword [0x506254]
jae 0x4742f2
mov eax, 0x506254
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, 7
cmp eax, 0xffffffff
je 0x47434b
shr eax, 4
not eax
and eax, 1
je 0x47434b
lea eax, [ebp - 0x50]
push eax
call fcn.00477a60
sub esp, 0x1c
mov ecx, esp
xor edx, edx
mov dword [ebp - 0x30], esp
mov byte [ebp - 4], 2
push edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], 0
push 0x506254
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00404570
mov eax, dword [ebp + 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.00477d50
cmp dword [ebp - 0x18], 8
jb 0x47435d
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00490a16
add esp, 4
xor edx, edx
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
jb 0x47437f
mov eax, dword [ebp + 8]
push eax
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4743a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caf40
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.0044c970
mov byte [ebp - 4], 1
cmp dword [0x506268], 8
mov eax, dword [0x506254]
jae 0x4743f2
mov eax, 0x506254
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, 7
cmp eax, 0xffffffff
je 0x47443f
shr eax, 4
not eax
and eax, 1
je 0x47443f
push 0
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [ebp - 0x30], esp
push eax
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], 0
mov word [ecx], ax
push 0x506254
or eax, 0xffffffff
call fcn.00404570
mov ecx, dword [ebp + 0x24]
call fcn.00477580
add esp, 0x20
cmp dword [ebp - 0x18], 8
jb 0x474451
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00490a16
add esp, 4
xor edx, edx
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
jb 0x474473
mov eax, dword [ebp + 8]
push eax
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4746d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2d66
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4fad60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
mov dword [ebp - 4], edi
push 0x10
mov dword [esi + 0x224], edi
call fcn.00490dc4
add esp, 4
cmp eax, edi
je 0x4747c8
mov dword [esi + 0x220], eax
mov dword [eax], eax
mov eax, dword [esi + 0x220]
mov dword [eax + 4], eax
xor eax, eax
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
push 0xc8
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x64]
push edi
mov dword [esi + 0x58], eax
push ecx
mov dword [esi + 0x5c], eax
call fcn.00497ad0
push 0xd4
lea edx, [esi + 0x146]
push edi
push edx
call fcn.00497ad0
fldz
xor eax, eax
fstp qword [esi + 0x30]
add esp, 0x18
mov word [esi + 0x2c], ax
push edi
mov eax, 0x4ddda0
mov dword [esi + 0x3c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x21c], edi
mov dword [esi + 0x38], edi
call fcn.00403e70
xor ecx, ecx
mov word [esi + 0x144], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], edi
call fcn.00490ac9
push 0x4e94b0
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.00495f48
int3