joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46edb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [esi + 0x50], bl
push ecx
add esp, 4
and eax, 0xc8b
add eax, 0x13539
add eax, 0x17bbd
pop eax
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x46edf6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x46ebc1
mov dword [ebp - 0x314], 0

Function at 0x46ee00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
call 0x46ee12
add byte [edx + 0x39], cl
xor al, 0x4d
inc eax
inc ebx
add esp, 4
add ebx, 0x30b6
and ebx, 0x345
pop ebx
push ecx
sub ecx, 0xc788
pop ecx
push esi
or esi, 0x105be
pop esi
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push esi
push eax
add esp, 4
or esi, 0x691
pop esi
push ecx
add ecx, 0x15af6
neg byte [edx + 1]
add byte [ecx + 0x17b8ae1], al
add bl, ch
invalid
pop ecx
push edi
push eax
add esp, 4
sub edi, 0x516a
xor edi, 0x16650
pop edi
mov dword [ebp - 0x794], 0
invalid
test eax, ecx

Function at 0x46ee12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
call 0x46ee12
add byte [edx + 0x39], cl
xor al, 0x4d
inc eax
inc ebx
add esp, 4
add ebx, 0x30b6
and ebx, 0x345
pop ebx
push ecx
sub ecx, 0xc788
pop ecx
push esi
or esi, 0x105be
pop esi
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push esi
push eax
add esp, 4
or esi, 0x691
pop esi
push ecx
add ecx, 0x15af6
neg byte [edx + 1]
add byte [ecx + 0x17b8ae1], al
add bl, ch
invalid
pop ecx
push edi
push eax
add esp, 4
sub edi, 0x516a
xor edi, 0x16650
pop edi
mov dword [ebp - 0x794], 0
invalid
test eax, ecx
Function at 0x46f540
Capabilities:
Encode data using xor

Disassembly:
std
add dword [ecx], eax
jmp 0x147f5cd
mov dword [esi + 0xf001], 0x286c74d
lock add byte [eax], al
jo 0x46f4bb
mov dword [esi + 0xf002], 0x386c770
mov dword [esi + 0xf003], 0x486c762
lock add byte [eax], al
xchg byte [ebx], al
lock add byte [eax], al
invalid
mov dword gs:[esi + 0xf005], 0x686c753
lock add byte [eax], al
mov word [esi + 0xf007], 0xc774
xchg byte [eax], cl
lock add byte [eax], al
jo 0x46f4e5
xchg byte [ecx], cl
lock add byte [eax], al
jbe 0x46f4ec
xchg byte [edx], cl
lock add byte [eax], al
jae 0x46f4f3
xchg byte [ebx], cl
lock add byte [eax], al
mov dword fs:[esi + 0xf00c], 0xd86c766
lock add byte [eax], al
add dword [edi - 0x7e], edx
push edi
and bh, 0x2e
push ecx
add dword [ecx], eax
sub bh, 0xbf
jle 0x46f54e
add dword [edx + 0x22dd7e7], eax
add dword [edx + 0x1ae8bcf], eax
add dword [edi + 0x58], ebx
out 0xd7, eax
xlatb
sub eax, 0xcf820102
mov ebp, dword [esi + 0x585f0101]
xor al, 0xd8
xchg esi, eax
add dword [ecx], eax
pushal
push edi
add bh, 0xdb
add al, byte gs:[ecx]
in al, dx
pop es
cmp eax, 0x4e494950
dec ebx
pop edi
mov dword [esi + 0xefcd], 0xce86c754
out dx, eax
add byte [eax], al
push 0xffffffffffffffc7
xchg bh, cl
mov dword [esi + 0xefce], 0xcf86c76a
mov dword [esi + 0xefcf], 0xd086c77b
out dx, eax
add byte [eax], al
jnp 0x46f54f
mov dword [esi + 0xefd0], 0xd186c766
out dx, eax
add byte [eax], al
push eax
mov dword [esi + 0xefd2], 0xd386c767
out dx, eax
add byte [eax], al
push ebx
mov dword [esi + 0xefd4], 0xd586c766
out dx, eax
add byte [eax], al
je 0x46f579
xchg al, dl
out dx, eax
add byte [eax], al
mov word [esi + 0xefd1], 0xc750
xchg dl, dl
mov dword [esi + 0xefd1], 0xd286c750
out dx, eax
add byte [eax], al
mov dword [bp - 0x102d], 0xc7530000
xchg ah, dl
out dx, eax
add byte [eax], al
mov word [esi + 0xefd5], 0xc774
xchg dh, dl
out dx, eax
add byte [eax], al
jo 0x46f580
xchg bh, dl
out dx, eax
add byte [eax], al
jbe 0x46f587
xchg al, bl
out dx, eax
add byte [eax], al
jae 0x46f58e
xchg cl, bl
out dx, eax
add byte [eax], al
mov dword fs:[esi + 0xefda], 0xdb86c766
out dx, eax
add byte [eax], al
add dword [ebx - 0x7e], edx
jmp 0x46f5d0

Function at 0x46f970
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
add dword [ecx], eax
dec ebx
cmp al, 0x40
cmp al, 0x4d
cmp eax, dword [ebp + eax*8 + 0x4908ec05]
inc esi
dec edx
dec edx
inc edi
inc ecx
xor eax, 0x2291f882
add dword [ecx], eax
xor al, 0x66
adc al, byte [edx]
add dword [eax - 0x39], esp
xchg ch, dh
test byte [eax], 0
dec eax
mov dword [esi + 0xf6f6], 0xf786c766
test byte [eax], 0
jne 0x46f94f
xchg al, bh
test byte [eax], 0
dec esi
invalid
invalid
Function at 0x489b80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x4c], 1
mov ebx, dword [esi + 0x1b8]
mov dword [ebp - 0x14], ebx
jne 0x489ba6
mov eax, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x489bab
xor eax, eax
mov byte [ebx + 0x1c], al
push dword [esi + 0x64]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
push 1
mov eax, dword [ecx + 8]
push esi
call eax
mov dword [ebx + 0x18], eax
xor edi, edi
mov eax, dword [ebx + 0x14]
add esp, 0x10
cmp dword [esi + 0x64], edi
jle 0x489c93
mov ecx, dword [ebx + edi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
je 0x489bf3
mov eax, dword [ebx + 0x18]
add dword [eax + edi*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov eax, dword [eax + edi*4]
mov dword [ebp - 8], eax
lea eax, [ecx - 1]
push eax
push ebx
push edi
push esi
call fcn.00489f20
add esp, 0x10
mov edx, eax
xor esi, esi
cmp esi, edx
jle 0x489c2e
mov eax, dword [ebp - 0x10]
inc ebx
dec eax
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.00489f20
mov edx, eax
add esp, 0x10
cmp esi, edx
jg 0x489c15
mov ecx, dword [ebp - 0xc]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 8]
mov byte [esi + eax], cl
inc esi
cmp esi, 0xff
jle 0x489c11
cmp dword [ebp - 4], 0
je 0x489c80
mov ebx, eax
mov ecx, 1
lea edx, [ebx - 1]
lea esp, [esp]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x489c60
mov esi, dword [ebp + 8]
inc edi
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
cmp edi, dword [esi + 0x64]
jl 0x489bd6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a4c0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x94], 0
mov dword [edi], vtable.CFileWriterThread.0
jne 0x49a4ee
push 1
call fcn.0049d630
mov ecx, edi
call fcn.0053d030
test al, al
je 0x49a4ee
push 0
mov ecx, edi
call fcn.0053d5e0
lea ecx, [edi + 0x80]
mov dword [edi + 0x90], 0
call fcn.004998e0
lea ecx, [edi + 0x80]
call fcn.004998e0
lea ecx, [edi + 0x70]
call fcn.0053ce20
lea ecx, [edi + 0x50]
call fcn.0049a2e0
lea ecx, [edi + 0x38]
call fcn.0053cde0
mov ecx, edi
pop edi
pop esi
jmp fcn.0053cbe0
Function at 0x49a700
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.0049c250
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049c250
lea ecx, [ebp - 0xc]
call fcn.0049c080
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0049c080
movzx ecx, byte [ebp + 0x10]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49a772
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a782
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49a792
push eax
call fcn.0054d204
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49a7a2
push ecx
call fcn.0054d204
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a7b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049c250
push 0
lea ecx, [ebp - 0xc]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x49a7f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x49a7f8
xor bl, bl
jmp 0x49a7fa
mov bl, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x49a80a
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a81a
push eax
call fcn.0054d204
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049c250
lea ecx, [ebp - 0xc]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49a957
push eax
call fcn.0054d204
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x49a967
push ecx
call fcn.0054d204
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a970
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.CPathString.0
mov dword [ebp - 0x1c], 0
call fcn.0049c250
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebx], 0
mov dword [ebx + 4], 0
test edi, edi
je 0x49a9b8
mov dword [edi], 0
mov dword [edi + 4], 0
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x49a9cc
mov dword [esi], 0
mov dword [esi + 4], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49aa18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
test edi, edi
je 0x49aa05
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
test esi, esi
je 0x49aa14
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov bl, 1
jmp 0x49aa1a
xor bl, bl
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49aa2a
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x49aa3a
push eax
call fcn.0054d204
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49aa60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049c250
lea ecx, [ebp - 0xc]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49aa9e
test al, 0x10
je 0x49aa9e
mov bl, 1
jmp 0x49aaa0
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x49aab0
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49aac0
push eax
call fcn.0054d204
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49abb0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov dword [edi + 0x30], 0
cmp eax, 0xffffffff
je 0x49abe3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x49abdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0xffffffff
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
and eax, 0xffffffb3
je 0x49ac37
push eax
push str.unsupported_flags_0x_x_passed_to_CFileReader::BOpenFile
push 0x138c
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.00536b80
add esp, 0x10
test al, al
jne 0x49ac34
int3
and ebx, 0x4c
cmp byte [edi + 0x2c], 0
je 0x49ad44
xor esi, esi
mov dword [ebp - 0xc], vtable.CPathString.0
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], esi
call fcn.0049c250
push 0x3a
push dword [ebp - 8]
call fcn.0054eb80
add esp, 8
test eax, eax
je 0x49acc2
mov ecx, dword [ebp - 8]
mov edx, 0x100
sub eax, ecx
lea esi, [eax + 2]
mov eax, 0xff
cmp esi, eax
cmova esi, eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ecx
lea eax, [ebp - 0x118]
push eax
call fcn.00547600
add esp, 0xc
mov byte [ebp + esi - 0x118], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
xor esi, esi
jmp 0x49acda
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
cmovne esi, dword [ebp + 0xc]
test eax, eax
je 0x49acfe
push eax
call fcn.0054d204
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49ad15
push eax
call fcn.0054d204
add esp, 4
mov dword [ebp - 8], 0
mov dword [edi + 0x30], esi
test esi, esi
je 0x49ad21
or ebx, 2
jmp 0x49ad44
push dword [ebp + 8]
push str.Failed_to_get_sector_size_for_drive_file__s_is_on__not_using_unbuffered_IO
push 0x139b
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.00536b80
add esp, 0x10
test al, al
jne 0x49ad40
int3
mov byte [edi + 0x2c], 0
push edi
push ebx
test bl, 0x40
mov ecx, 0
push 0
mov eax, 3
cmovne eax, ecx
push eax
push 1
push dword [ebp + 8]
call fcn.0049b910
add esp, 0x18
test eax, eax
jne 0x49ad7a
cmp dword [edi], 0xffffffff
je 0x49ad7a
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49b1b0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
call fcn.0049ccb0
add esp, 4
mov dword [ebp - 0xc], vtable.CPathString.0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push 0
push dword [ebp + 8]
call fcn.0049c250
lea ecx, [ebp - 0xc]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49b201
push eax
call fcn.0054d204
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x49b211
push ecx
call fcn.0054d204
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b500
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.0049c250
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049c250
lea ecx, [ebp - 0xc]
call fcn.0049c080
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0049c080
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49b56f
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49b57f
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49b58f
push eax
call fcn.0054d204
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49b59f
push ecx
call fcn.0054d204
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49b790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.0049c250
mov edi, dword [ebp - 0x14]
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.0049a910
add esp, 4
test al, al
jne 0x49b897
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49b7d1
sub ecx, edx
lea esi, [edi - 1]
add esi, ecx
cmp esi, edi
jbe 0x49b85d
cmp byte [esi], 0x5c
jne 0x49b855
push 0
push edi
lea ecx, [ebp - 0xc]
mov byte [esi], 0
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049c250
lea ecx, [ebp - 0xc]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49b837
push eax
call fcn.0054d204
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49b84e
push eax
call fcn.0054d204
add esp, 4
mov dword [ebp - 8], 0
mov byte [esi], 0x5c
test bl, bl
jne 0x49b85c
dec esi
cmp esi, edi
ja 0x49b7e3
jmp 0x49b85d
inc esi
mov al, byte [esi]
test al, al
je 0x49b882
cmp al, 0x5c
jne 0x49b87a
push ecx
mov eax, esp
mov byte [esi], 0
mov dword [eax], edi
call fcn.0049a7b0
add esp, 4
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x49b863
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.0049a7b0
add esp, 4
test al, al
jne 0x49b897
xor bl, bl
jmp 0x49b899
mov bl, 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49b8a9
push eax
call fcn.0054d204
add esp, 4
test edi, edi
je 0x49b8b6
push edi
call fcn.0054d204
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b910
Capabilities:
Inspect section memory permissions
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], vtable.CPathString.0
mov dword [ebp - 0xc], 0
call fcn.0049c250
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
mov eax, dword [ebp + 0x1c]
shl ecx, 0x1f
mov edx, ecx
or edx, 0x40000000
mov dword [eax], 0xffffffff
mov eax, ebx
and al, 2
mov eax, 0xc0000000
cmove edx, ecx
cmp ebx, 4
cmove edx, eax
mov eax, edx
or eax, 4
and bl, 8
cmove eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
cmp eax, 7
ja case.default.0x49b9aa
jmp dword [eax*4 + 0x49babc]
xor edi, edi
jmp 0x49b99e
mov edi, 1
jmp 0x49b99e
mov edi, 2
jmp 0x49b99e
mov edi, 3
jmp 0x49b99e
mov edi, 7
mov eax, dword [ebp + 0x14]
cmp eax, 3
ja case.default.0x49b9aa
jmp dword [eax*4 + 0x49badc]
mov ebx, 3
jmp 0x49b9cb
mov ebx, 4
jmp 0x49b9cb
mov ebx, 1
jmp 0x49b9cb
mov ebx, 2
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
and ecx, 1
shl ecx, 0x1e
sub ecx, 0xffffff80
mov edx, ecx
or edx, 0x20000000
and al, 2
cmove edx, ecx
mov ecx, dword [ebp + 0x18]
mov esi, edx
mov eax, ecx
or esi, 0x8000000
and al, 8
cmove esi, edx
test cl, 0x10
je 0x49ba0a
and esi, 0xffffff7f
or esi, 0x100
mov eax, ecx
mov ecx, esi
or ecx, 0x4000000
and al, 0x20
push 0
cmove ecx, esi
push ecx
push ebx
push 0
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 0x1c]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x49ba46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x49ba90
mov ebx, dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileTime]
test bl, 4
je 0x49ba6d
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push ecx
push 0
push eax
mov dword [ebp - 4], 0xffffffff
call esi
test bl, bl
jns 0x49ba87
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [edi]
call esi
xor esi, esi
jmp 0x49ba90
mov esi, 0x57
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49baa0
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49bab0
push eax
call fcn.0054d204
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49bd00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
test eax, eax
push ebx
lea ebx, [ebp - 4]
cmovne ebx, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
xor ebx, ebx
test edi, edi
je 0x49bd70
xor esi, esi
lea eax, [ebp + 0x14]
push esi
push eax
mov ecx, 0x40000000
mov dword [ebp + 0x14], esi
cmp edi, ecx
mov eax, edi
cmova eax, ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x49bd5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x49bd63
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x49bd67
test ebx, ebx
jne 0x49bd70
add dword [ebp + 0xc], esi
add ebx, esi
sub edi, esi
jmp 0x49bd1c
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49be70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], vtable.CPathString.0
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], edi
call fcn.0049c250
mov ebx, dword [ebp - 0x18]
push 0x3a
push ebx
call fcn.0054eb80
add esp, 8
test eax, eax
je 0x49bef3
sub eax, ebx
mov ecx, 0x100
lea esi, [eax + 2]
mov eax, 0xff
cmp esi, eax
cmova esi, eax
cmp esi, ecx
mov eax, esi
cmova eax, ecx
push eax
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.00547600
add esp, 0xc
mov byte [ebp + esi - 0x11c], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x11c]
push eax
jmp 0x49bf05
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov eax, dword [ebp - 0x14]
cmovne edi, dword [ebp - 4]
test eax, eax
je 0x49bf21
push eax
call fcn.0054d204
add esp, 4
test ebx, ebx
je 0x49bf2e
push ebx
call fcn.0054d204
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ccb0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049c250
lea ecx, [ebp - 0xc]
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49cd01
test al, 3
je 0x49ccfd
and eax, 0xfffffffc
lea ecx, [ebp - 0xc]
push eax
call fcn.0049c080
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x49cd03
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x49cd13
push eax
call fcn.0054d204
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49cd23
push eax
call fcn.0054d204
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret