joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48eff0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 1
jne 0x48f008
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 8], eax
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
mov ebp, dword [esp + 0x18]
push 0
push eax
push ebx
push ebp
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48f0b4
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x48f060
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x48f043
cmp eax, 3
jne 0x48f060
cmp ebx, 0x4e20
jbe 0x48f060
push 0x4e20
push ebp
mov ecx, esi
call fcn.0048eff0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esi + 0x10], 1
jne 0x48f07b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x48f07b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0x10], 0
jne 0x48f0a9
cmp ebx, 0x8000
jbe 0x48f0a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x48f0a9
push 0x8000
push ebp
mov ecx, esi
call fcn.0048eff0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x48f200
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1010
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
mov ebx, dword [esp + 0x101c]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1020]
mov dword [esp + 0xc], ecx
cmp byte [esi + 0x30], 0
mov dword [esi + 0x1034], 0
jne 0x48f248
test bl, 4
jne 0x48f248
xor al, al
jmp 0x48f24a
mov al, 1
push edi
mov edi, ebx
shr edi, 1
not edi
and edi, 1
inc edi
shl edi, 0x1e
test bl, 1
je 0x48f263
or edi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test al, al
je 0x48f272
or ebx, 2
cmp byte [esi + 0x24], 0
je 0x48f27e
or edi, 0x100
push 0
push 0x8000000
push 3
push 0
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x48f2e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x18]
call fcn.004a21d0
test al, al
je 0x48f2f2
push 0
push 0x8000000
push 3
push 0
push ebx
push edi
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x48f2ed
mov dword [esp + 0x14], eax
jmp 0x48f2ed
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x48f303
cmp dword [esp + 0x14], 2
jne 0x48f303
mov dword [esi + 0x1034], 1
cmp byte [esi + 0x24], 0
pop edi
je 0x48f342
cmp ebp, 0xffffffff
je 0x48f342
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0xffffffff
push eax
push 0
push ebp
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov byte [esi + 0x1c], 0
mov bl, 1
mov dword [esi + 0x10], 0
mov byte [esi + 0x15], 0
jmp 0x48f359
cmp ebp, 0xffffffff
mov byte [esi + 0x1c], 0
mov dword [esi + 0x10], 0
mov byte [esi + 0x15], 0
setne bl
je 0x48f372
push 0x800
push dword [esp + 0x10]
lea ecx, [esi + 0x32]
mov dword [esi + 8], ebp
push ecx
call fcn.004bd090
mov byte [esi + 0x25], 0
mov ecx, dword [esp + 0x1018]
mov al, bl
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x1010
ret 8
Function at 0x48fd00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x48fd19
pop ebp
mov al, 1
pop ebx
add esp, 0x1c
ret 8
cmp dword [ebp + 0x10], 1
push esi
push edi
lea edi, [ebp + 8]
mov dword [esp + 0x18], edi
jne 0x48fd34
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi], eax
jmp 0x48fd40
mov dword [esp + 0x18], edi
jmp 0x48fd40
cmp dword [ebp + 0x10], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0
je 0x48fd9f
xor esi, esi
test ebx, ebx
je 0x48fdc5
lea esp, [esp]
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x48fd70
mov eax, 0x4000
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x3c]
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
mov byte [esp + 0x13], cl
jne 0x48fdbd
add esi, 0x4000
cmp esi, ebx
jb 0x48fd60
jmp 0x48fdbd
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push dword [esp + 0x3c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
mov byte [esp + 0x13], cl
test cl, cl
jne 0x48fecb
cmp byte [ebp + 0x1e], 0
je 0x48fecb
cmp dword [ebp + 0x10], 0
jne 0x48fecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x55670c]
mov ecx, ebp
call esi
mov dword [esp + 0x20], eax
lea eax, [ebp + 0x32]
push eax
mov dword [esp + 0x28], edx
call fcn.00490d80
push edi
mov dword [esp + 0x20], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x48fe5d
ja 0x48fe1f
cmp dword [esp + 0x1c], ebx
jbe 0x48fe5d
mov esi, dword [esp + 0x20]
mov edx, esi
mov edi, dword [esp + 0x24]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x48fe5d
jl 0x48fe3a
cmp edx, 0xffffffff
ja 0x48fe5d
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x28], ecx
js 0x48fe5d
jg 0x48fe4d
cmp eax, 0xffffffff
jbe 0x48fe5d
lea esi, [ebp + 0x32]
mov ecx, 0x5d281c
push esi
call fcn.00488090
jmp 0x48fe60
lea esi, [ebp + 0x32]
push 0
push esi
mov ecx, 0x5d281c
call fcn.00487110
test al, al
je 0x48febe
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp eax, ebx
jae 0x48fd40
test eax, eax
je 0x48fd40
mov edi, dword [ebp]
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x55670c]
mov ecx, ebp
call esi
sub eax, dword [esp + 0x14]
mov esi, dword [edi + 0x10]
mov ecx, esi
push 0
sbb edx, 0
push edx
push eax
call dword [0x55670c]
mov ecx, ebp
call esi
mov edi, dword [esp + 0x18]
jmp 0x48fd40
push esi
push 0
mov ecx, 0x5d281c
call fcn.00487fc0
mov al, byte [esp + 0x13]
pop edi
pop esi
mov byte [ebp + 0xc], 1
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x490630
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x490687
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x490687
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x490689
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 4

Function at 0x4906b0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x490707
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x490707
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x490709
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 4
Function at 0x490c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x490c83
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004a21d0
test al, al
je 0x490c80
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
mov ecx, dword [esp + 0x1008]
setne al
pop edi
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 4

Function at 0x490ca0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
cmp dword [ecx + 0x10], 0
jbe 0x490d03
mov eax, 0x54
mov dword [ecx + 0x10], 0
mov word [esp + 0x10], ax
mov eax, dword [ecx]
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x16], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret

Function at 0x490d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x490d62
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004a21d0
test al, al
je 0x490d60
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x490d62
mov eax, esi
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 4

Function at 0x490d80
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
lea ecx, [esp + 0x18]
push 0x800
push ecx
push eax
call fcn.004a1dd0
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 8]
push eax
movzx eax, word [esp + 0x24]
lea ecx, [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x490e11
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0xc]
ja 0x490e11
xor eax, eax
add eax, dword [esp]
adc edx, 0
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.0052f708
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x1018]
xor eax, eax
xor ecx, esp
xor edx, edx
call fcn.0052f708
add esp, 0x101c
ret 4
Function at 0x491000
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
lea ecx, [esp + 0x20c]
push 0x800
push ecx
push eax
call fcn.004a1e60
push 0x105
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4910e8
mov ecx, 0x567398
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49108a
test dx, dx
je 0x491086
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49108a
add eax, 4
add ecx, 4
test dx, dx
jne 0x491064
xor eax, eax
jmp 0x49108f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4910cf
mov ecx, str.FAT32
lea eax, [esp]
jmp 0x4910a0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4910c6
test dx, dx
je 0x4910c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4910c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4910a0
xor eax, eax
jmp 0x4910cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4910e8
mov al, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.0052f708
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor al, al
xor ecx, esp
call fcn.0052f708
add esp, 0x1210
ret 4

Function at 0x491120
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
lea ecx, [esp]
push 0x800
push ecx
push eax
call fcn.004a1e60
movzx eax, word [esp]
lea ecx, [esp]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x491185
cmp eax, 5
je 0x491185
xor al, al
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
mov al, 1
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 4
Function at 0x4911a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push esi
call fcn.004a2d60
movzx eax, word [eax]
cmp eax, 0x2e
je 0x4911e0
cmp eax, 0x20
je 0x4911e0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x491235
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x491266
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x491210
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x491266
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x491266
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x491266
cmp byte [esp + 0x1010], 0
je 0x49124c
push dword [esp + 0x1014]
push esi
call fcn.004918b0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 2
je 0x491294
xor eax, eax
cmp ecx, 3
pop esi
sete al
inc eax
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 0xc
mov ecx, dword [esp + 0x1004]
mov eax, 2
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 0xc
Function at 0x4912c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1090
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x108c], eax
mov ecx, dword [esp + 0x1094]
mov dword [esp + 0xc], ecx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4912e6
push ebx
sub ecx, edx
mov dword [esp + 0x14], 0
push ebp
sar ecx, 1
push esi
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x1c]
push edi
mov dword [esp + 0x24], 0
call fcn.004be820
lea ecx, [esp + 0x20]
call fcn.004be560
mov edi, eax
mov ecx, edx
mov ebx, 0x368f0847
mov dword [esp + 0x10], edi
mul ebx
mov ebp, 0x4f8b588e
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], eax
mov esi, edx
mov eax, edi
mul ebp
mov edi, eax
mov ebp, edx
mov eax, ecx
mul ebx
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 0x14]
mov edx, 0x4f8b588e
mul edx
add ecx, esi
mov dword [esp + 0x28], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x28]
adc ebp, 0
mov dword [esp + 0x30], edi
xor eax, eax
add ebx, ebp
mov ebp, dword [esp + 0x10]
adc eax, eax
add ecx, ebx
adc edx, eax
mov eax, dword [esp + 0x14]
sub ebp, ecx
sbb eax, edx
shrd ebp, eax, 1
shr eax, 1
add ebp, ecx
adc eax, edx
shrd ebp, eax, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor edi, edi
mov eax, 0x4f8b588f
mov dword [esp + 0x10], ecx
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xf
imul eax, eax, 0xc350
sub ebp, eax
lea eax, [esp + 0x38]
push ebp
push ecx
push str._u._03u
push 0x32
push eax
call fcn.00404ce0
lea ecx, [esp + 0x4c]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4913d7
mov esi, dword [esp + 0x18]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + esi]
mov ecx, dword [esp + 0x10a8]
cmp eax, ecx
jae 0x491495
mov ebx, dword [esp + 0x1c]
cmp edi, 0x3e8
je 0x491495
sub ecx, esi
lea eax, [esp + 0x38]
push ecx
push eax
lea eax, [ebx + esi*2]
push eax
call fcn.004bd090
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x491453
push 0x800
lea eax, [esp + 0xa0]
push eax
push ebx
call fcn.004a21d0
test al, al
je 0x4914b2
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4914b2
inc ebp
lea eax, [esp + 0x38]
push ebp
push dword [esp + 0x14]
inc edi
push str._u._03u
push 0x32
push eax
call fcn.00404ce0
lea eax, [esp + 0x4c]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x491475
mov ecx, dword [esp + 0x10a8]
sub eax, edx
sar eax, 1
add eax, esi
cmp eax, ecx
jb 0x491400
xor eax, eax
mov ecx, dword [esp + 0x109c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x1090
ret 8
mov eax, ebx
jmp 0x491497
Function at 0x4914c0
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x49150e
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x49150e
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 4

Function at 0x491530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1068
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1064], eax
push ebx
mov ebx, dword [esp + 0x1078]
push ebp
mov ebp, dword [esp + 0x1074]
push esi
push edi
mov edi, dword [esp + 0x1080]
push ebx
push ebp
push edi
call fcn.004bd090
push 0x32
push str.temp
lea eax, [esp + 0x18]
push eax
call fcn.004bd090
xor esi, esi
lea esp, [esp]
push 0x2e
lea eax, [esp + 0x1c]
push eax
lea eax, [esi + 0x3e8]
push 0
push eax
call fcn.004bce60
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.004a2ea0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4915d1
push 0x800
lea eax, [esp + 0x78]
push eax
push edi
call fcn.004a21d0
test al, al
je 0x4915da
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4915da
inc esi
cmp esi, 0x3e8
jb 0x491580
push edi
push ebp
call fcn.00491600
mov ecx, dword [esp + 0x1074]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x1068
ret 0xc

Function at 0x491600
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x2014]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test eax, eax
jne 0x49167f
push 0x800
lea eax, [esp + 0x1010]
push eax
push edi
call fcn.004a21d0
test al, al
je 0x49167f
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x49167f
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x491681
mov al, bl
mov ecx, dword [esp + 0x200c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x2004
ret 8
Function at 0x4916d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1028
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1024], eax
mov ecx, dword [esp + 0x1038]
push ebx
push ebp
mov ebp, dword [esp + 0x103c]
push esi
mov esi, dword [esp + 0x1038]
push edi
mov edi, dword [esp + 0x1040]
mov dword [esp + 0x18], ecx
test edi, edi
je 0x49171c
mov eax, dword [edi]
or eax, dword [edi + 4]
mov byte [esp + 0x10], 1
jne 0x491721
mov byte [esp + 0x10], 0
test ebp, ebp
je 0x491732
mov eax, dword [ebp]
or eax, dword [ebp + 4]
mov byte [esp + 0x12], 1
jne 0x491737
mov byte [esp + 0x12], 0
test ecx, ecx
je 0x491747
mov eax, dword [ecx]
or eax, dword [ecx + 4]
mov byte [esp + 0x11], 1
jne 0x49174c
mov byte [esp + 0x11], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x491780
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x491794
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x491794
test bl, 1
je 0x491794
push 0
push esi
mov byte [esp + 0x1b], 1
call fcn.004918b0
jmp 0x491799
mov byte [esp + 0x13], 0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x4917fd
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x491888
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x491888
cmp byte [esp + 0x10], 0
je 0x491810
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.004be5f0
cmp byte [esp + 0x12], 0
je 0x491823
lea eax, [esp + 0x2c]
mov ecx, ebp
push eax
call fcn.004be5f0
cmp byte [esp + 0x11], 0
je 0x491838
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
call fcn.004be5f0
movzx eax, byte [esp + 0x10]
lea ecx, [esp + 0x1c]
neg eax
mov edi, dword [esp + 0x14]
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x24]
push eax
movzx eax, byte [esp + 0x15]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x30]
push eax
movzx eax, byte [esp + 0x1a]
neg eax
sbb eax, eax
and eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
je 0x491888
push ebx
push esi
call fcn.004918b0
mov ecx, dword [esp + 0x1034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x1028
ret 0x10
Function at 0x4918b0
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
push dword [esp + 0x1014]
mov esi, dword [esp + 0x1014]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test eax, eax
jne 0x491915
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x491915
push dword [esp + 0x1014]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
jmp 0x491917
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x1004
ret 8

Function at 0x491a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5505e0
mov eax, dword fs:[0]
push eax
mov eax, 0x2054
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.004a2580
test al, al
je 0x491ac9
lea ecx, [ebp - 0x1018]
call fcn.004926b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1018]
push esi
call fcn.004928b0
push 0
lea eax, [ebp - 0x2060]
mov dword [ebp - 0x1050], 0
push eax
lea ecx, [ebp - 0x1018]
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x103c], 0
call fcn.00492790
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1018]
call fcn.004926d0
mov al, bl
jmp 0x491b02
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x491aff
push 0x800
lea eax, [ebp - 0x1010]
push eax
push esi
call fcn.004a21d0
test al, al
je 0x491afc
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052f708
mov esp, ebp
pop ebp
ret 4