joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49510c
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e473c
call fcn.004d0500
sub esp, 0x74
mov eax, dword [0x52d320]
push ebx
xor eax, ebp
cmp byte [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ebx, ecx
je 0x49521c
push edi
lea ecx, [ebp - 0x48]
call dword [0x4ea6b0]
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.004d05da
pop ecx
push eax
push esi
call fcn.0044f5c2
push str.normal.png
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00407770
push str.hover.png
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.00407770
add esp, 0x24
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call dword [0x4ea6a4]
mov edi, dword [0x4eaadc]
push eax
call edi
test eax, eax
jne 0x4951a9
push esi
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e4]
mov byte [ebp - 4], 3
jmp 0x4951c7
lea ecx, [ebp - 0x64]
call dword [0x4ea6a4]
push eax
call edi
test eax, eax
jne 0x4951f4
push esi
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e4]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
push 0x4fc760
call dword [0x4ea6f8]
lea ecx, [ebp - 0x2c]
push esi
call dword [0x4ea4e0]
push eax
call sub.minizip.dll_mini_unzip_dll
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call dword [0x4ea4dc]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call dword [0x4ea4f8]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call dword [0x4ea4f8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call dword [0x4ea4f8]
pop edi
push dword [ebp + 0x10]
lea ecx, [ebx + 0x218]
push esi
push dword [ebp + 8]
push ebx
call fcn.00494ee6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 0xc
Function at 0x49638c
Capabilities:
Check if file exists

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
je 0x4963af
push dword [esp + 0xc]
call dword [0x4eaadc]
test eax, eax
je 0x4963af
mov ecx, esi
call fcn.0049617d
test eax, eax
jne 0x4963b5
xor al, al
pop esi
ret 8
pop esi
mov ecx, eax
jmp 0x4a6ed0
mov eax, 0x4e5b67
call fcn.004d0500
sub esp, 0x38
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x10], ecx
je 0x4a6ef5
push dword [ebp + 0xc]
call dword [0x4eaadc]
test eax, eax
jne 0x4a6efc
xor al, al
jmp 0x4a7030
push ebx
lea ecx, [ebp - 0x44]
call fcn.0040ef83
mov dword [ebp - 0x44], vtable.xlue_basic_xml_dom_parser_char_.0
push esi
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.0040f4aa
push dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
call fcn.004a32f0
test al, al
lea ecx, [ebp - 0x40]
jne 0x4a6f37
call fcn.0040dea8
xor bl, bl
jmp 0x4a701a
push edi
call fcn.0040dea8
lea ecx, [ebp - 0x44]
call fcn.00446d5c
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, esi
mov byte [ebp - 4], 1
jne 0x4a6f59
xor bl, bl
jmp 0x4a7019
lea ecx, [edi + 0x30]
call dword [0x4ea4e0]
cmp eax, esi
je 0x4a700c
push str.skin
push eax
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x4a700c
lea ecx, [edi + 0x80]
call fcn.0045fdf8
cmp eax, esi
mov dword [ebp - 0x14], eax
mov dword [ebp + 0xc], esi
jbe 0x4a7008
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0040e6ef
mov esi, eax
mov dword [ebp - 0x1c], esi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call dword [0x4ea4e0]
mov ebx, eax
push str.color_scheme
push ebx
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x4a6fd1
mov ecx, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.004a4dae
jmp 0x4a6fee
push str.auto_color_scheme
push ebx
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x4a6fee
mov ecx, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.004a4dc6
test esi, esi
mov byte [ebp - 4], 1
je 0x4a6ffd
mov ecx, esi
call fcn.0040d957
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x14]
jb 0x4a6f94
mov bl, 1
jmp 0x4a700e
xor bl, bl
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040d957
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], vtable.xlue_basic_xml_dom_parser_char_.0
call fcn.0040ea10
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4963ed
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e4895
call fcn.004d0500
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
lea edx, [eax + 0x78]
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
leave
ret

Function at 0x4964d9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e49ae
call fcn.004d0500
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.SkinManager.3.0
mov dword [esi + 4], vtable.SkinManager.2.0
mov dword [esi + 8], vtable.SkinManager.1.0
mov dword [esi + 0xc], vtable.SkinManager.0
lea ecx, [esi + 0x3b4]
mov dword [ebp - 4], 0x12
call fcn.0043363e
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 0x11
call fcn.00431e6f
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x10
call fcn.00496152
lea ecx, [esi + 0x388]
mov byte [ebp - 4], 0xf
call fcn.004aa5f1
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xe
call fcn.0049d879
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xd
call fcn.00496460
lea ecx, [esi + 0x1e4]
mov byte [ebp - 4], 0xc
call fcn.0049fbec
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0xb
call fcn.0049ec32
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0xa
call dword [0x4ea4dc]
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 9
call dword [0x4ea4dc]
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 8
call dword [0x4ea4dc]
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 7
call dword [0x4ea4dc]
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 6
call fcn.0049b433
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.00496127
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 4
call dword [0x4ea4f8]
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.004a894a
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.004a88ae
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004a0fa0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.0043363e
lea ecx, [esi + 0x20]
call fcn.0040151d
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4964e4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e49ae
call fcn.004d0500
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.SkinManager.3.0
mov dword [esi + 4], vtable.SkinManager.2.0
mov dword [esi + 8], vtable.SkinManager.1.0
mov dword [esi + 0xc], vtable.SkinManager.0
lea ecx, [esi + 0x3b4]
mov dword [ebp - 4], 0x12
call fcn.0043363e
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 0x11
call fcn.00431e6f
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x10
call fcn.00496152
lea ecx, [esi + 0x388]
mov byte [ebp - 4], 0xf
call fcn.004aa5f1
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xe
call fcn.0049d879
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xd
call fcn.00496460
lea ecx, [esi + 0x1e4]
mov byte [ebp - 4], 0xc
call fcn.0049fbec
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0xb
call fcn.0049ec32
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0xa
call dword [0x4ea4dc]
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 9
call dword [0x4ea4dc]
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 8
call dword [0x4ea4dc]
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 7
call dword [0x4ea4dc]
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 6
call fcn.0049b433
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.00496127
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 4
call dword [0x4ea4f8]
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.004a894a
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.004a88ae
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004a0fa0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.0043363e
lea ecx, [esi + 0x20]
call fcn.0040151d
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x496710
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e4acc
call fcn.004d0500
push ecx
push ecx
mov eax, dword [0x4eac50]
push ebx
push esi
mov esi, ecx
mov dword [esi + 4], vtable.IRemoteSkinInstallerCallBack.0
mov dword [esi + 8], vtable.IRecommendPackageDownloadCallBack.0
xor ebx, ebx
push edi
lea edi, [esi + 0xc]
mov dword [edi + 4], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], eax
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.SkinManager.3.0
mov dword [esi + 4], vtable.SkinManager.2.0
mov dword [esi + 8], vtable.SkinManager.1.0
mov dword [edi], vtable.SkinManager.0
call fcn.004a1e7a
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004a0f60
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.004a8a03
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.004a8ab6
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 4
call dword [0x4ea6b0]
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.0043f62c
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 6
call fcn.0049b52b
mov byte [esi + 0xf8], bl
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 7
mov dword [esi + 0xfc], ebx
call dword [0x4ea6d4]
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 8
call dword [0x4ea6d4]
push 0x4eb79e
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 9
call dword [0x4ea4e4]
push 0x4eb79e
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0xa
call dword [0x4ea4e4]
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0xb
mov byte [esi + 0x170], bl
call fcn.0049ebe5
lea ecx, [esi + 0x1e4]
mov byte [ebp - 4], 0xc
call fcn.0049fc21
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xd
call fcn.004963ed
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xe
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a8], ebx
mov byte [esi + 0x2ac], bl
call fcn.0049da27
push esi
lea ecx, [esi + 0x388]
mov byte [ebp - 4], 0xf
call fcn.004aa67f
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x10
call fcn.0043f62c
lea eax, [esi + 0x3a4]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea ecx, [esi + 0x3b4]
mov byte [ebp - 4], 0x12
call fcn.004a1e7a
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ebx
push closesocket
push ebx
push ecx
mov dword [esi + 0x390], 0x3ac
mov dword [esi + 0x394], 0x258
mov dword [eax], ebx
mov eax, esp
mov dword [ebp - 0x14], esp
push 0xfffffffffffffffd
mov ecx, edi
mov byte [ebp - 4], 0x13
mov dword [eax], ebx
call fcn.0049473f
call fcn.004a4426
call fcn.00494532
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4971bc
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e4b63
call fcn.004d0500
sub esp, 0x7c
mov eax, dword [0x52d320]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
mov esi, ecx
mov dword [ebp - 0x6c], edi
call fcn.00496993
mov ebx, eax
mov ecx, ebx
call fcn.004a5613
push eax
lea ecx, [ebp - 0x48]
call dword [0x4ea6a8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x49721e
push edi
push 1
mov ecx, esi
call fcn.00498bbf
jmp 0x497354
mov eax, dword [esi + 0x3ac]
mov ecx, dword [esi + 0x3a8]
lea edx, [ebp - 0x6c]
push edx
push eax
push ecx
lea eax, [ebp - 0x68]
push eax
call fcn.004949c7
mov eax, dword [esi + 0x3ac]
add esp, 0x10
cmp dword [ebp - 0x68], eax
jne 0x497354
push edi
lea ecx, [ebp - 0x88]
call dword [0x4ea4e4]
lea eax, [ebp - 0x88]
push eax
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 1
call fcn.0040cdba
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0
call dword [0x4ea4dc]
push str.http:__img.skin.client.xunlei.com_skinimg_
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e4]
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004a4d94
push eax
lea ecx, [ebp - 0x2c]
call dword [0x4ea6f8]
push str..jpg
lea ecx, [ebp - 0x2c]
call dword [0x4ea6f8]
lea ecx, [ebp - 0x64]
call dword [0x4ea6b0]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call dword [0x4ea4e0]
push eax
call fcn.0044f8f4
push 0x20
call fcn.004d00ba
mov ebx, eax
add esp, 0x10
mov dword [ebp - 0x68], ebx
test ebx, ebx
mov byte [ebp - 4], 4
je 0x4972f7
mov ecx, ebx
call dword [0x4ea6d4]
and dword [ebx + 0x1c], 0
jmp 0x4972f9
xor ebx, ebx
push edi
mov ecx, ebx
mov byte [ebp - 4], 3
call dword [0x4ea768]
push esi
lea edi, [ebx + 0x1c]
push 0x494877
mov ecx, edi
call fcn.00493ef9
mov edi, dword [edi]
push ebx
push edi
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
lea ecx, [ebp - 0x64]
call dword [0x4ea6a4]
push eax
call fcn.004aa5ac
mov ecx, eax
call fcn.004a9f9b
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call dword [0x4ea4f8]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x4ea4dc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call dword [0x4ea4f8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004d0557
leave
ret 4
Function at 0x497c60
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x4e4c06
call fcn.004d0500
sub esp, 0x7c
mov eax, dword [0x52d320]
xor eax, ebp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x84], eax
je 0x497e4a
cmp byte [edi], 0
je 0x497e4a
test eax, eax
je 0x497e4a
cmp word [eax], 0
je 0x497e4a
push ebx
lea ecx, [ebp - 0x64]
call dword [0x4ea6d4]
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x64]
call dword [0x4ea768]
push 0x4fc750
lea ecx, [ebp - 0x64]
call dword [0x4ea6f8]
lea ecx, [ebp - 0x2c]
call dword [0x4ea6d4]
lea eax, [ebp - 0x2c]
push eax
push 4
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call dword [0x4ea4e0]
push eax
call fcn.004a703f
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [esi + 0xc8]
call fcn.004150f2
mov eax, dword [esi + 0xcc]
cmp dword [ebp - 0x88], eax
je 0x497d31
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
mov ecx, esi
call fcn.00497706
mov bl, al
jmp 0x497e2b
lea ecx, [ebp - 0x48]
call dword [0x4ea6b0]
lea eax, [ebp - 0x48]
push eax
push 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ebx, [esi + 0x4c]
call dword [0x4ea4e0]
push eax
mov ecx, ebx
call fcn.004a0608
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
mov edi, dword [0x4eaadc]
push eax
call edi
test eax, eax
je 0x497dab
push 4
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
mov ecx, esi
call fcn.00495a11
test al, al
jne 0x497d96
xor bl, bl
jmp 0x497e1e
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
mov ecx, esi
call fcn.00497706
mov bl, al
jmp 0x497e1e
lea ecx, [ebp - 0x80]
call dword [0x4ea6b0]
lea eax, [ebp - 0x80]
push eax
push 4
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.004a07a1
lea ecx, [ebp - 0x80]
call dword [0x4ea6a4]
push eax
call edi
test eax, eax
jne 0x497de6
lea ecx, [ebp - 0x80]
call dword [0x4ea6a4]
push eax
call dword [0x4ea860]
pop ecx
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
lea ecx, [esi + 0x94]
call fcn.004a8b69
lea ecx, [ebp - 0x80]
mov bl, al
mov byte [ebp - 4], 2
call dword [0x4ea4f8]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call dword [0x4ea4f8]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x4ea4dc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call dword [0x4ea4dc]
mov al, bl
pop ebx
jmp 0x497e4c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 8
Function at 0x4980fa
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e4c5b
call fcn.004d0500
sub esp, 0x5c
mov eax, dword [0x52d320]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
test edi, edi
mov dword [ebp - 0x10], eax
mov esi, ecx
je 0x4982a0
cmp byte [edi], 0
je 0x4982a0
test ebx, ebx
je 0x4982a0
cmp word [ebx], 0
je 0x4982a0
lea ecx, [ebp - 0x64]
call dword [0x4ea6d4]
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x64]
call dword [0x4ea768]
push 0x4fc750
lea ecx, [ebp - 0x64]
call dword [0x4ea6f8]
lea ecx, [ebp - 0x2c]
call dword [0x4ea6d4]
lea eax, [ebp - 0x2c]
push eax
push 0xa
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call dword [0x4ea4e0]
push eax
call fcn.004a703f
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0xc8]
call fcn.004150f2
mov eax, dword [esi + 0xcc]
cmp dword [ebp - 0x68], eax
je 0x4981bf
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
mov ecx, esi
call fcn.00497706
mov bl, al
jmp 0x498282
lea ecx, [ebp - 0x48]
call dword [0x4ea6b0]
lea eax, [ebp - 0x48]
push eax
push 0xa
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call dword [0x4ea4e0]
push eax
lea ecx, [esi + 0x4c]
call fcn.004a0608
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x49823c
push 0xa
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
mov ecx, esi
call fcn.00495a11
test al, al
je 0x49822c
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
mov ecx, esi
call fcn.00497706
jmp 0x498273
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
call dword [0x4ea364]
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
push 1
mov ecx, esi
call fcn.004957fa
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
push ebx
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
push eax
lea ecx, [esi + 0x94]
call fcn.004a8b69
lea ecx, [ebp - 0x48]
mov bl, al
mov byte [ebp - 4], 1
call dword [0x4ea4f8]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x4ea4dc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call dword [0x4ea4dc]
mov al, bl
jmp 0x4982a2
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 0xc
Function at 0x4988fa
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e4d12
call fcn.004d0500
sub esp, 0x228
mov eax, dword [0x52d320]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
test esi, esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
je 0x49894e
push esi
call fcn.004a05e2
test al, al
pop ecx
jne 0x498955
push 0
push 0
push esi
mov ecx, ebx
call fcn.00496b6f
test eax, eax
je 0x49894e
mov ecx, eax
call fcn.004a4d9d
push eax
mov ecx, ebx
call fcn.0049737e
jmp 0x498a45
xor al, al
jmp 0x498a45
push edi
push esi
call dword [0x4eaad0]
mov edi, eax
test edi, edi
jne 0x49896a
xor al, al
jmp 0x498a44
lea ecx, [ebp - 0x234]
call dword [0x4ea6d4]
and dword [ebp - 4], 0
lea eax, [ebp - 0x234]
push eax
push edi
call dword [0x4ea7b4]
pop ecx
push eax
push edi
call fcn.0044f54c
add esp, 0xc
push edi
mov ecx, ebx
call fcn.004940f3
push eax
lea eax, [ebp - 0x218]
push eax
call dword [0x4eaad8]
lea eax, [ebp - 0x218]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x4989ee
lea ecx, [ebp - 0x234]
call dword [0x4ea4e0]
push eax
mov ecx, ebx
call fcn.00494f54
test eax, eax
je 0x4989d6
mov bl, 1
jmp 0x498a32
lea ecx, [ebp - 0x234]
call dword [0x4ea4e0]
push eax
mov ecx, ebx
call fcn.00495a4e
mov bl, al
jmp 0x498a32
push 0
lea eax, [ebp - 0x218]
push eax
push esi
call dword [0x4ea36c]
test eax, eax
je 0x498a30
lea ecx, [ebp - 0x234]
call dword [0x4ea4e0]
push eax
mov ecx, ebx
call fcn.00495a4e
test al, al
je 0x498a30
lea ecx, [ebp - 0x234]
call dword [0x4ea4e0]
push eax
mov ecx, ebx
call fcn.00497706
jmp 0x4989ea
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [0x4ea4dc]
mov al, bl
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 4
Function at 0x49b547
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e4dcd
call fcn.004d0500
sub esp, 0x2c
mov ecx, dword [ebp + 0xc]
push 0x4eb79e
call dword [0x4ea768]
push dword [ebp + 8]
call dword [0x4eaadc]
test eax, eax
jne 0x49b576
xor al, al
jmp 0x49b64b
push ebx
lea ecx, [ebp - 0x38]
call fcn.0040ef83
xor ebx, ebx
push ebx
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.0040f4aa
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0040f500
test al, al
lea ecx, [ebp - 0x34]
jne 0x49b5ad
call fcn.0040dea8
mov byte [ebp + 0xb], bl
jmp 0x49b63b
push edi
call fcn.0040dea8
lea ecx, [ebp - 0x38]
call fcn.00446d5c
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, ebx
mov byte [ebp - 4], 1
jne 0x49b5cd
mov byte [ebp + 0xb], bl
jmp 0x49b63a
lea ecx, [edi + 0x30]
call dword [0x4ea4e0]
cmp eax, ebx
je 0x49b62d
push str.info
push eax
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x49b62d
push esi
push ebx
mov ecx, edi
call fcn.0040e6ef
mov esi, eax
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call dword [0x4ea4e0]
mov ecx, esi
call fcn.0040e9e6
mov ecx, dword [ebp + 0xc]
push eax
call dword [0x4ea768]
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x49b626
mov ecx, esi
call fcn.0040d957
mov byte [ebp + 0xb], 1
pop esi
jmp 0x49b630
mov byte [ebp + 0xb], bl
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.0040d957
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040ea10
mov al, byte [ebp + 0xb]
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8
Function at 0x49d708
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e4ff2
call fcn.004d0500
sub esp, 0x44
mov eax, dword [0x52d320]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 4]
push edi
lea edi, [esi + 0xbc]
mov ecx, edi
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
jne 0x49d747
xor al, al
jmp 0x49d85f
push ebx
xor ebx, ebx
cmp dword [esi + 0xd8], ebx
je 0x49d759
mov al, 1
jmp 0x49d85e
lea ecx, [ebp - 0x48]
call fcn.004a1e7a
mov ecx, edi
mov dword [ebp - 4], ebx
call dword [0x4ea6a4]
push eax
lea ecx, [ebp - 0x48]
call fcn.004a36b4
cmp eax, ebx
mov dword [ebp - 0x50], eax
jne 0x49d783
xor bl, bl
jmp 0x49d850
lea ecx, [ebp - 0x2c]
call dword [0x4ea6d4]
lea eax, [ebp - 0x2c]
push eax
push 1
mov ecx, esi
mov byte [ebp - 4], 1
call dword [0x4ea4e0]
push eax
call fcn.004a703f
push 0xd0
call fcn.004d00ba
add esp, 0x10
mov dword [ebp - 0x4c], eax
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x49d7d2
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e0]
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.004a46ae
mov edi, eax
jmp 0x49d7d4
xor edi, edi
mov dword [ebp - 0x4c], edi
push 1
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.004a44f5
push dword [ebp - 0x50]
mov ecx, edi
call fcn.004a4a4b
test al, al
jne 0x49d7f6
xor bl, bl
jmp 0x49d837
mov ecx, edi
mov dword [ebp - 0x4c], ebx
mov dword [esi + 0xd8], edi
call fcn.004a45df
mov ebx, eax
xor edi, edi
test ebx, ebx
jbe 0x49d835
mov ecx, dword [esi + 0xd8]
push edi
call fcn.004a4641
test eax, eax
mov dword [ebp - 0x50], eax
je 0x49d830
lea eax, [ebp - 0x50]
push eax
lea ecx, [esi + 0xdc]
call fcn.0049b3ee
inc edi
cmp edi, ebx
jb 0x49d80e
mov bl, 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.00494499
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x4ea4dc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0043363e
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4