joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52cb50
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.0052c8e0

Function at 0x52cb60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea eax, [esp + 0x250]
push 0x1db
push str....._base_files_file_util_win.cc
push 0x75367d
push eax
call fcn.005e4620
add esp, 0x10
mov ecx, esi
lea esi, [esp + 0x250]
push 0
push esi
call fcn.005d6a70
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push esi
call fcn.006547d0
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x52cbe8
mov eax, dword [ebx]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.005db590
add esp, 0xc
push esi
call fcn.005b6bd0
add esp, 4
lea esi, [esp + 0x48]
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push esi
call fcn.006547d0
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x52cc24
mov eax, dword [edi]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.005db590
add esp, 0xc
push esi
call fcn.005b6bd0
add esp, 4
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x52cc47
mov eax, dword [ebx]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x52cc51
mov ecx, dword [edi]
sub esp, 0x18
movsd xmm0, qword [0x749d20]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x52ccaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0052c370
add esp, 4
mov dword [esp + 0xc], eax
cmp byte [edi + 0xb], 0
jns 0x52cc8d
mov edi, dword [edi]
mov esi, dword [ebp + 0x10]
cmp byte [ebx + 0xb], 0
jns 0x52cc98
mov ebx, dword [ebx]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test esi, esi
je 0x52ccb1
test eax, eax
jne 0x52ccb1
jmp 0x52ccd2
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.005d6ae0
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esp + 0xc], 0xfffffffc
jne 0x52cce2
call fcn.006a1820
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi], eax
xor ebx, ebx
jmp 0x52ccb1
Function at 0x52ccf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x20e
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005d6a70
cmp byte [edi + 0xb], 0
jns 0x52cd4c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.005d6ae0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52cd80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x217
push str....._base_files_file_util_win.cc
push str.PathHasAccess
push esi
call fcn.005e4620
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.005d6a70
cmp byte [edi + 0xb], 0
jns 0x52cde1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x52ce77
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x52ce3a
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x52ce73
call fcn.005e4650
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x52ce55
call fcn.005e4650
push esi
call fcn.005cf200
add esp, 4
lea ecx, [esp + 0x20]
call fcn.005d6ae0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x52ce33
xor ebx, ebx
jmp 0x52ce55
Function at 0x52ce80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x236
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005d6a70
cmp byte [edi + 0xb], 0
jns 0x52cedc
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.005d6ae0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52cf10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.006547d0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x52cf93
push ebx
call fcn.0066e7c4
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.005e5420
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.0053e580
mov ecx, dword [ebp + 8]
push ebx
call fcn.005e5580
mov ecx, ebx
call fcn.005e5500
mov ecx, edi
call fcn.005e5500
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52cfc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.006547d0
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x753610]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x52d03d
cmp word [ebp - 0x214], 0
je 0x52d03d
push edi
call fcn.0066e7c4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.005e5420
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.005e5390
push edi
call fcn.0052cf10
add esp, 4
mov ecx, esi
test al, al
jne 0x52d072
push 3
push 0x75368a
call fcn.005e5420
jmp 0x52d078
push edi
call fcn.005e53f0
lea ecx, [ebp - 0x220]
call fcn.005e5500
jmp 0x52d027
Function at 0x52d410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x7b2570], 0
jne 0x52d577
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2bc
push str....._base_files_file_util_win.cc
push str.GetSecureSystemTemp
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005d6a70
cmp dword [ebp + 8], 0
je 0x52d57b
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
call fcn.005e5390
push esi
push 0x65
call fcn.0052f1b0
add esp, 8
test al, al
je 0x52d57e
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push str.SystemTemp
push ebx
call fcn.0053e470
mov ecx, esi
push ebx
call fcn.005e5580
mov ecx, ebx
call fcn.005e5500
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x40]
push 0x20e
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.005e4620
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.005d6a70
cmp byte [esi + 0xb], 0
jns 0x52d511
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.005d6ae0
cmp esi, 0xffffffff
je 0x52d57e
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.0052cd80
add esp, 4
test al, al
je 0x52d57e
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.005e5520
mov ecx, esi
call fcn.005e5500
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.005d6ae0
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x52d55f
int3
lea ecx, [esp + 4]
call fcn.005e5500
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea esi, [esp + 4]
mov ecx, esi
call fcn.005e5390
push esi
push 0x67
call fcn.0052f1b0
add esp, 8
test al, al
je 0x52d62e
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x20e
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.005e4620
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.005d6a70
cmp byte [esp + 0xf], 0
lea eax, [esp + 4]
jns 0x52d5fb
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.005d6ae0
cmp ebx, 0xffffffff
je 0x52d62e
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.0052cd80
add esp, 4
test al, al
jne 0x52d540
lea ecx, [esp + 4]
call fcn.005e5500
xor ebx, ebx
jmp 0x52d556
Function at 0x52dd00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, esp
push 0x403
push str....._base_files_file_util_win.cc
push 0x753707
push eax
call fcn.005e4620
add esp, 0x10
xor ebx, ebx
mov ecx, esi
push ebx
lea eax, [esp + 4]
push eax
call fcn.005d6a70
cmp byte [edi + 0xb], 0
jns 0x52dd61
mov edi, dword [edi]
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x753620]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x52ddaa
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x52de1c
call fcn.005e4650
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
dec esi
cmp dword [ebp + 0x10], 0
js 0x52dde8
lea eax, [ebx + 1]
cmp eax, 2
jb 0x52dde8
mov eax, dword [ebp + 0xc]
xor edi, edi
dec edi
mov dword [esp], edi
push 0
lea ecx, [esp + 4]
push ecx
mov esi, dword [ebp + 0x10]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, esi
cmove edi, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edi
lea eax, [ebx + 1]
cmp eax, 2
jb 0x52ddfe
call fcn.005e4650
push ebx
call fcn.005cf200
add esp, 4
lea ecx, [esp + 0x10]
call fcn.005d6ae0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x52dda3

Function at 0x52de20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x43c
push str....._base_files_file_util_win.cc
push 0x753711
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005d6a70
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.006547d0
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x52dee6
push ebx
call fcn.0066e7c4
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.005e5420
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.0053e580
mov ecx, dword [ebp + 8]
push ebx
call fcn.005e5580
mov ecx, ebx
call fcn.005e5500
mov ecx, edi
call fcn.005e5500
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.005d6ae0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52df10
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x44c
push str....._base_files_file_util_win.cc
push 0x753726
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005d6a70
cmp byte [edi + 0xb], 0
jns 0x52df6c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.005d6ae0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52e340
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.006547d0
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.0052e650
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.0052e7f0
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x52e3ad
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x52e4a8
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.006547d0
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0052e7b0
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x52e4ff
mov ecx, ebx
call fcn.0052e560
test al, al
jne 0x52e4ac
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x52e40e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x52e4a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x52e431
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.0047c650
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0052e7f0
lea ecx, [ebp - 0x500]
push ebx
call fcn.005e5580
mov ecx, ebx
call fcn.005e5500
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x52e46d
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x52e3bd
lea ecx, [ebp - 0x500]
call fcn.005e5500
lea ecx, [ebp - 0x2a4]
call fcn.0052e740
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x52e431
xor esi, esi
jmp 0x52e477
xor esi, esi
cmp byte [ebp + 8], 0
je 0x52e431
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.0052e340
add esp, 4
test eax, eax
jne 0x52e42f
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x52e4eb
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x52e431
jmp 0x52e41d
cmp byte [ebp + 8], 0
jne 0x52e532
lea ecx, [ebp - 0x4f4]
call fcn.0052e560
test al, al
je 0x52e52c
lea ecx, [ebp - 0x4f4]
call fcn.0052e560
test al, al
je 0x52e3f9
jmp 0x52e4a4
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x52e543
lea ecx, [ebp - 0x500]
jmp 0x52e549
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x52e3ea
Function at 0x52ff20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov dword [esp + 4], edx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x98], eax
xor ebx, ebx
test ecx, ecx
je 0x53008e
push ebx
push ebx
push ecx
mov dword [esp + 0x14], ecx
call fcn.0066c070
add esp, 0xc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x20]
push 0x51
push str....._base_files_file_util.cc
push str.ReadStreamToSpanWithMaxSize
push esi
call fcn.005e4620
add esp, 0x10
mov ecx, edi
push ebx
push esi
call fcn.005d6a70
mov dword [esi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push dword [esp + 8]
call fcn.0066300e
add esp, 4
push eax
call fcn.006639bd
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x5300a6
mov eax, dword [esp + 0x44]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x40]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 4]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x18]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0xc]
call dword [0x7a29f4]
mov eax, dword [esp + 0x10]
push edi
push eax
push ebx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 8]
push edi
push 1
push eax
call fcn.0066bd80
add esp, 0x10
test eax, eax
je 0x53004e
mov ebx, eax
mov eax, dword [esp + 4]
sub eax, esi
cmp eax, ebx
jb 0x5300b0
add ebx, esi
push dword [esp + 8]
call fcn.0066b46f
add esp, 4
test eax, eax
je 0x5300b8
mov esi, ebx
push dword [esp + 8]
call fcn.0066b49b
add esp, 4
test eax, eax
sete bl
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x7a29f4]
mov eax, dword [esp + 0x94]
lea edx, [esp + 0x10]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x60]
call fcn.005d6ae0
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x52ffe2
xor ebx, ebx
mov esi, dword [esp + 4]
jmp 0x53005f
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x7a29f4]
mov eax, dword [esp + 0x94]
lea esi, [esp + 0x10]
push dword [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov esi, ebx
jmp 0x530018
Function at 0x53b040
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.0053b1c0
mov eax, dword [edi]
mov dword [0x7ab82c], eax
mov bl, 1
test al, 1
jne 0x53b07c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x7b2670]
test eax, eax
je 0x53b0a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7b2670], 0
cmp dword [0x7b2674], 0
jne 0x53b0a6
and byte [0x7ab82c], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x53b0c3
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x53b0b8
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x53b12e
mov dword [0x7b2670], eax
jmp 0x53b068
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x53b0ce
mov eax, dword [edi + 8]
test eax, eax
je 0x53b16f
lea esi, [edi + 4]
mov ecx, dword [0x7b2674]
test ecx, ecx
jne 0x53b102
push 0xc
call fcn.006507be
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x7b2674], eax
push esi
call fcn.005c7cd0
cmp dword [edi + 0x14], 0
jne 0x53b122
mov eax, dword [0x7b2674]
cmp byte [eax + 0xb], 0
jns 0x53b11b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.006a5360
mov ebx, eax
jmp 0x53b068
lea eax, [ebp - 0x24]
push 0x232
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push eax
call fcn.005e4620
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push str.settings.log_file_path.empty__
push esi
call fcn.006a7b60
add esp, 0x10
mov ecx, esi
call fcn.006a7dc0
mov eax, dword [edi + 0x18]
jmp 0x53b0bc
lea ebx, [ebp - 0x24]
push 0x238
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push ebx
call fcn.005e4620
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push str._settings.log_file_path.empty__
push esi
call fcn.006a7b60
add esp, 0x10
mov ecx, esi
push str.LOG_TO_FILE_set_but_no_log_file_path_
call fcn.00686250
mov ecx, esi
call fcn.006a7dc0
jmp 0x53b0d6