joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4481b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x44821d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4481f0
cmp edx, 1
jne 0x448226
jmp 0x448242
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x448242
cmp edx, 2
je 0x448239
cmp edx, 3
jne 0x44824d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x4483ae
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x4482b6
lea edx, [ebx - 1]
and edx, edi
jmp 0x4482c2
mov edx, edi
cmp edi, ebx
jb 0x4482c2
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4483ae
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x4483ae
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x448315
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x4483ac
mov ebx, dword [ebx]
test ebx, ebx
je 0x4483ac
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x448370
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x448329
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x44830b
lea ecx, [ebx + 8]
test al, al
jns 0x448337
mov ecx, dword [ecx]
js 0x44838e
cmp dword [ebp - 0x14], 0
je 0x4483a8
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x44830b
inc ecx
cmp eax, ecx
jne 0x448350
jmp 0x4483a8
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x448300
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x448303
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x448303
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4483a8
push eax
push esi
push ecx
call fcn.004aa0cd
add esp, 0xc
test eax, eax
jne 0x44830b
mov ecx, ebx
jmp 0x4483ae
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x449c60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x449ccd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x449ca0
cmp edx, 1
jne 0x449cd6
jmp 0x449cf2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x449cf2
cmp edx, 2
je 0x449ce9
cmp edx, 3
jne 0x449cfd
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x449e5e
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x449d66
lea edx, [ebx - 1]
and edx, edi
jmp 0x449d72
mov edx, edi
cmp edi, ebx
jb 0x449d72
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x449e5e
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x449e5e
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x449dc5
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x449e5c
mov ebx, dword [ebx]
test ebx, ebx
je 0x449e5c
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x449e20
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x449dd9
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x449dbb
lea ecx, [ebx + 8]
test al, al
jns 0x449de7
mov ecx, dword [ecx]
js 0x449e3e
cmp dword [ebp - 0x14], 0
je 0x449e58
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x449dbb
inc ecx
cmp eax, ecx
jne 0x449e00
jmp 0x449e58
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x449db0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x449db3
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x449db3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x449e58
push eax
push esi
push ecx
call fcn.004aa0cd
add esp, 0xc
test eax, eax
jne 0x449dbb
mov ecx, ebx
jmp 0x449e5e
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x44fb10
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.0044fb20

Function at 0x44fd40
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 1
pop ebp
jmp fcn.0044fb20
Function at 0x450290
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x1c9
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.00440700
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0044d330
cmp byte [edi + 0xb], 0
jns 0x4502f6
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.0044d3b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x450320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x1f1
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.00440700
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0044d330
cmp byte [edi + 0xb], 0
jns 0x450386
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.0044d3b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4503c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.004ab560
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
add esi, 0xfffffefc
cmp esi, 0xfffffefd
jb 0x450448
push ebx
call fcn.004c3f8c
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0043d840
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.0043ed90
mov ecx, dword [ebp + 8]
push ebx
call fcn.0043d930
mov ecx, ebx
call fcn.0043d8f0
mov ecx, edi
call fcn.0043d8f0
cmp esi, 0xfffffefd
setae bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x450470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.004ab560
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x4e7af0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4504d8
cmp word [ebp - 0x214], 0
je 0x4504d8
push edi
call fcn.004c3f8c
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0043d840
jmp 0x450531
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.0043d7e0
push edi
call fcn.004503c0
add esp, 4
mov ecx, esi
test al, al
je 0x45051a
push edi
call fcn.0043d810
jmp 0x450526
push 3
push 0x4e7b62
call fcn.0043d840
lea ecx, [ebp - 0x220]
call fcn.0043d8f0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004a8de3
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x450550
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov ebx, dword [ebp + 8]
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov esi, esp
push 0x290
push str....._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push esi
call fcn.00440700
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push esi
call fcn.0044d330
cmp byte [ebx + 0xb], 0
mov esi, ebx
jns 0x4505b6
mov esi, dword [ebx]
mov edi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4505e8
mov bl, 1
test al, 0x10
jne 0x4506d9
test edi, edi
je 0x4505d9
mov dword [edi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x4506d9
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov ecx, ebx
mov edi, esp
push edi
call fcn.0043df50
movzx eax, byte [ebx + 0xb]
mov ecx, ebx
test al, al
jns 0x450618
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
test eax, eax
je 0x450624
test ecx, ecx
je 0x4506f7
movzx ebx, byte [esp + 0xb]
test bl, bl
cmovs ebx, dword [esp + 4]
mov edx, dword [esp]
cmovns edx, edi
test ebx, ebx
je 0x450642
test edx, edx
je 0x4506f7
cmp ebx, eax
jne 0x450661
test ebx, ebx
je 0x450661
xor ebx, ebx
nop dword [eax]
movzx edi, word [edx + ebx*2]
cmp di, word [ecx + ebx*2]
jne 0x450665
inc ebx
cmp eax, ebx
jne 0x450650
jmp 0x4506b6
cmp ebx, eax
je 0x4506b6
mov edi, dword [ebp + 0xc]
push edi
lea eax, [esp + 4]
push eax
call fcn.00450550
add esp, 8
test al, al
je 0x4506d0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4506d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
jne 0x4506a7
push dword [ebp + 8]
call fcn.00450320
add esp, 4
test al, al
jne 0x4506d2
test edi, edi
je 0x4506c9
push esi
call fcn.00450ee0
add esp, 4
jmp 0x4506c7
mov eax, 0xfffffffc
mov esi, 2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4506c9
mov dword [edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov ecx, esp
call fcn.0043d8f0
lea ecx, [esp + 0x10]
call fcn.0044d3b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.string_view::string_view__CharT___size_t_:_received_nullptr
push str.__len__0____s___nullptr
push 0x129
push str....._buildtools_third_partylibc_trunkinclude_string_view
push str._s:_d:_assertion__s_failed:__s
call fcn.00416514
int3
Function at 0x450860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov edi, esp
push 0x38a
push str....._base_files_file_util_win.cc
push 0x4e7b8e
push edi
call fcn.00440700
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.0044d330
cmp byte [esi + 0xb], 0
jns 0x4508c4
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x4e7b00]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0xffffffff
test eax, eax
je 0x45090b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x45090f
call fcn.00440730
jmp 0x450911
xor edi, edi
jmp 0x450957
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x450957
lea eax, [edi + 1]
cmp eax, 2
jb 0x450957
mov eax, dword [ebp + 0xc]
mov dword [esp], 0xffffffff
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, ebx
mov edx, 0xffffffff
cmove edx, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edx
lea eax, [edi + 1]
cmp eax, 2
jb 0x45096d
call fcn.00440730
push edi
call fcn.004642e0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.0044d3b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004a8de3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x450990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
lea ebx, [esp + 0x18]
push 0x3c3
push str....._base_files_file_util_win.cc
push 0x4e7b98
push ebx
call fcn.00440700
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push ebx
call fcn.0044d330
lea eax, [esp + 0x1a]
push 0x206
push 0xff
push eax
call fcn.004ab560
add esp, 0xc
mov word [esp + 0x18], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xfffffefb
cmp esi, 0xfffffefc
jb 0x450a71
push ebx
call fcn.004c3f8c
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.0043d840
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.0043ed90
mov ecx, dword [ebp + 8]
push ebx
call fcn.0043d930
mov ecx, ebx
call fcn.0043d8f0
mov ecx, edi
call fcn.0043d8f0
cmp esi, 0xfffffefc
setae bl
lea ecx, [esp + 0x220]
call fcn.0044d3b0
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x450aa0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x3d3
push str....._base_files_file_util_win.cc
push 0x4e7bad
push ebx
call fcn.00440700
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0044d330
cmp byte [edi + 0xb], 0
jns 0x450b06
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.0044d3b0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x450b50
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, edx
mov edi, ecx
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea ebx, [esp + 0x10]
push 0x7e
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.00440700
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.0044d330
mov ecx, edi
call fcn.0043ede0
test al, al
jne 0x450be0
mov ecx, esi
call fcn.0043ede0
test al, al
jne 0x450be0
cmp byte [edi + 0xb], 0
jns 0x450bd1
cmp dword [edi + 4], 0x103
ja 0x450be0
cmp byte [esi + 0xb], 0
jns 0x450c00
cmp dword [esi + 4], 0x103
jbe 0x450c00
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.0044d3b0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x8b
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.00440700
add esp, 0x10
lea ecx, [esp + 0x10]
push 0x4fb884
push ebx
call fcn.0046f2e0
cmp byte [esi + 0xb], 0
jns 0x450c3b
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
movzx eax, al
cmp byte [edi + 0xb], 0
jns 0x450c4a
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x450c81
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x450c79
mov eax, edi
and eax, 1
je 0x450c79
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
jmp 0x450c83
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.0046f400
jmp 0x450be2
Function at 0x450ca0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.004ab560
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.00453650
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.00453850
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x450d23
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x450ea5
xor edi, edi
lea ebx, [ebp - 0x4f4]
jmp 0x450d4a
mov edi, esi
test eax, eax
je 0x450ea7
push 0x250
push 0xff
push ebx
call fcn.004ab560
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00453810
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x450dc0
cmp byte [ebp + 8], 0
jne 0x450da0
mov ecx, ebx
call fcn.00453590
test al, al
je 0x450d9a
mov ecx, ebx
call fcn.00453590
xor esi, esi
test al, al
je 0x450e20
jmp 0x450e60
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x450db8
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.00453590
test al, al
je 0x450e20
xor esi, esi
cmp byte [ebp + 8], 0
je 0x450e60
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.00450ca0
add esp, 4
mov esi, eax
test eax, eax
jne 0x450e60
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x450e08
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x450e60
jmp 0x450e42
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x450e35
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x450e60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x450e60
mov esi, eax
nop word cs:[eax + eax]
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00411770
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00453850
lea ecx, [ebp - 0x500]
push ebx
call fcn.0043d930
mov ecx, ebx
call fcn.0043d8f0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x450d40
mov eax, dword [ebp - 0x4fc]
jmp 0x450d40
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.0043d8f0
lea ecx, [ebp - 0x2a4]
call fcn.004537a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8de3
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x452540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x4f6014]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x4525a8
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x4525a8
cmp dword [ebp - 0x14], 4
jne 0x4525a8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004a8de3
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x4525c0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004a9200
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.004ab560
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x452696
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x452649
mov edi, 0x3f4
cmp eax, 1
jne 0x452696
mov ecx, esi
push ebx
jmp 0x45268f
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.004ab560
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x452696
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
call fcn.004354ce
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8de3
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8