joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467e50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
mov edi, 5
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x467e87
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x467f01
cmp esi, dword [ebp + 0xc]
ja 0x467f01
call fcn.00480170
mov ecx, eax
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x467f01
xor edi, edi
test esi, esi
je 0x467ef2
lea esp, [esp]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov eax, 0x100000
cmp esi, eax
cmovb eax, esi
push eax
lea eax, [edi + ecx]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x467f11
add edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
sub esi, dword [ebp - 8]
jne 0x467ec0
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edi
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00480170
mov esi, dword [ebp - 4]
mov ecx, eax
push 0
push esi
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 5
mov esp, ebp
pop ebp
ret

Function at 0x46cc00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x62eff0], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
je 0x46cc3c
cmp esi, 0xc0
jl 0x46cc3c
mov edi, dword [ebp + 0xc]
mov eax, esi
shr eax, 6
dec eax
push eax
push edi
push dword [ebp + 8]
call fcn.0046cc60
mov eax, esi
add esp, 0xc
and eax, 0x3f
sub esi, eax
add edi, esi
mov esi, eax
jmp 0x46cc3f
mov edi, dword [ebp + 0xc]
push 0x5b53e8
push esi
push edi
push dword [ebp + 8]
call fcn.0046cdb0
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x46cc60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x40
mov eax, dword [ebp + 8]
movaps xmm3, xmmword [0x5b7400]
movups xmm4, xmmword [edx]
push esi
movups xmm5, xmmword [edx + 0x10]
mov esi, dword [eax]
movups xmm6, xmmword [edx + 0x20]
push edi
movups xmm7, xmmword [edx + 0x30]
add edx, 0x40
cmp esi, 0xffffffff
jne 0x46cc97
movaps xmm2, xmmword [0x5b73f0]
jmp 0x46ccda
xor edi, edi
mov ecx, 0x5b358fd3
test esi, esi
je 0x46ccbf
mov eax, esi
sar eax, 0x1f
and eax, ecx
xor edi, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
add esi, esi
jne 0x46cca2
xor eax, eax
movd xmm0, edi
xorps xmm2, xmm2
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm2, xmm1
pclmulqdq xmm2, xmm3, 0x11
mov eax, dword [ebp + 0x10]
xorps xmm2, xmm7
test eax, eax
jle 0x46cd50
lea edx, [edx + 0x40]
movaps xmm1, xmm4
movups xmm0, xmmword [edx - 0x40]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm4, xmm3, 0
xorps xmm4, xmm1
movaps xmm1, xmm5
xorps xmm4, xmm0
movups xmm0, xmmword [edx - 0x30]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm5, xmm3, 0
xorps xmm5, xmm1
movaps xmm1, xmm6
xorps xmm5, xmm0
movups xmm0, xmmword [edx - 0x20]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm6, xmm3, 0
xorps xmm6, xmm1
movaps xmm1, xmm2
xorps xmm6, xmm0
movups xmm0, xmmword [edx - 0x10]
pclmulqdq xmm2, xmm3, 0
pclmulqdq xmm1, xmm3, 0x11
xorps xmm2, xmm1
xorps xmm2, xmm0
sub eax, 1
jne 0x46cce4
xor eax, eax
xor edi, edi
movups xmmword [ebp - 0x40], xmm4
movups xmmword [ebp - 0x30], xmm5
movups xmmword [ebp - 0x20], xmm6
movups xmmword [ebp - 0x10], xmm2
xor eax, dword [ebp + edi*4 - 0x40]
inc edi
movzx ecx, al
shr eax, 8
mov esi, dword [ecx*4 + 0x5b5fe8]
movzx ecx, al
shr eax, 8
mov edx, eax
shr edx, 8
xor esi, dword [ecx*4 + 0x5b5be8]
movzx ecx, al
mov eax, dword [edx*4 + 0x5b53e8]
xor eax, dword [ecx*4 + 0x5b57e8]
xor eax, esi
cmp edi, 0x10
jl 0x46cd64
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x46cdb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [ecx]
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 7
jle 0x46ce79
test bl, 3
je 0x46cde8
movzx edx, byte [ebx]
dec edi
movzx ecx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [esi + edx*4]
test bl, 3
jne 0x46cdd3
mov ecx, edi
and ecx, 0xfffffff8
add ebx, ecx
sub edi, ecx
neg ecx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], edi
mov dword [ebp - 4], ecx
je 0x46ce76
mov edi, dword [ebp + 0x14]
xor eax, dword [ebx + ecx]
lea esi, [ebx + ecx]
movzx ecx, al
shr eax, 8
mov edx, dword [edi + ecx*4 + 0xc00]
movzx ecx, al
shr eax, 8
xor edx, dword [edi + ecx*4 + 0x800]
movzx ecx, al
shr eax, 8
mov ebx, dword [edi + ecx*4 + 0x400]
xor ebx, dword [edi + eax*4]
xor ebx, dword [esi + 4]
xor ebx, edx
movzx eax, bl
shr ebx, 8
mov ecx, dword [edi + eax*4 + 0xc00]
movzx eax, bl
shr ebx, 8
xor ecx, dword [edi + eax*4 + 0x800]
movzx eax, bl
shr ebx, 8
mov eax, dword [edi + eax*4 + 0x400]
xor eax, dword [edi + ebx*4]
mov ebx, dword [ebp + 0xc]
xor eax, ecx
mov ecx, dword [ebp - 4]
add ecx, 8
mov dword [ebp - 4], ecx
jne 0x46ce01
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
test edi, edi
jle 0x46ce99
lea ecx, [ecx]
movzx edx, byte [ebx]
lea ebx, [ebx + 1]
movzx ecx, al
dec edi
xor edx, ecx
shr eax, 8
xor eax, dword [esi + edx*4]
test edi, edi
jg 0x46ce80
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470a90
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x90], 0
mov dword [esi], vtable.CFileWriterThread.0
jne 0x470abd
push 1
call fcn.00472ef0
mov ecx, esi
call fcn.00481a50
test al, al
je 0x470abd
push 0
mov ecx, esi
call fcn.00481f30
lea ecx, [esi + 0x80]
call fcn.00470930
lea ecx, [esi + 0x70]
call fcn.00481950
lea ecx, [esi + 0x50]
call fcn.00470850
lea ecx, [esi + 0x38]
call fcn.00481910
mov ecx, esi
pop esi
jmp fcn.004816a0

Function at 0x470cf0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.00472190
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00471fd0
movzx ecx, byte [ebp + 0x10]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x470d62
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x470d72
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x470d82
push eax
call fcn.0056baf4
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x470d92
push ecx
call fcn.0056baf4
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470da0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x65ff5c], 0
push ebx
jne 0x470db4
xor eax, eax
jmp 0x470dc7
lea eax, [ebp - 4]
push eax
push 3
push str.BCreateDirectory
call fcn.00479a40
add esp, 0xc
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], vtable.CPathString.0
mov dword [ebp - 8], 0
call fcn.00472190
push 0
lea ecx, [ebp - 0x10]
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x470e0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x470e0b
xor bl, bl
jmp 0x470e0d
mov bl, 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x470e1d
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x470e2d
push eax
call fcn.0056baf4
add esp, 4
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x470e3d
push ecx
call fcn.00479a00
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x470ed7
push eax
call fcn.0056baf4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x470ee7
push ecx
call fcn.0056baf4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470ef0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x470f2e
test al, 0x10
je 0x470f2e
mov bl, 1
jmp 0x470f30
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x470f40
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x470f50
push eax
call fcn.0056baf4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471040
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
cmp dword [0x65ff5c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x47105b
xor eax, eax
jmp 0x47106e
lea eax, [ebp - 0x10]
push eax
push 3
push str.CFileReader::BOpenFile
call fcn.00479a40
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov dword [edi + 0x30], 0
cmp eax, 0xffffffff
je 0x471096
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x471090
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0xffffffff
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
and eax, 0xffffffb3
je 0x4710ea
push eax
push str.unsupported_flags_0x_x_passed_to_CFileReader::BOpenFile
push 0x1400
push str.C:_buildworker_steam_rel_client_win32_build_src_tier1_fileio.cpp
call fcn.004774f0
add esp, 0x10
test al, al
jne 0x4710e7
int3
and ebx, 0x4c
cmp byte [edi + 0x2c], 0
je 0x4711f7
xor esi, esi
mov dword [ebp - 0xc], vtable.CPathString.0
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], esi
call fcn.00472190
push 0x3a
push dword [ebp - 8]
call fcn.0056e2c0
add esp, 8
test eax, eax
je 0x471175
mov ecx, dword [ebp - 8]
mov edx, 0x100
sub eax, ecx
lea esi, [eax + 2]
mov eax, 0xff
cmp esi, eax
cmova esi, eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ecx
lea eax, [ebp - 0x11c]
push eax
call fcn.0046a4c0
add esp, 0xc
mov byte [ebp + esi - 0x11c], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
xor esi, esi
jmp 0x47118d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
cmovne esi, dword [ebp + 0xc]
test eax, eax
je 0x4711b1
push eax
call fcn.0056baf4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4711c8
push eax
call fcn.0056baf4
add esp, 4
mov dword [ebp - 8], 0
mov dword [edi + 0x30], esi
test esi, esi
je 0x4711d4
or ebx, 2
jmp 0x4711f7
push dword [ebp + 8]
push str.Failed_to_get_sector_size_for_drive_file__s_is_on__not_using_unbuffered_IO
push 0x140f
push str.C:_buildworker_steam_rel_client_win32_build_src_tier1_fileio.cpp
call fcn.004774f0
add esp, 0x10
test al, al
jne 0x4711f3
int3
mov byte [edi + 0x2c], 0
push edi
push ebx
test bl, 0x40
mov ecx, 0
push 0
mov eax, 3
cmovne eax, ecx
push eax
push 1
push dword [ebp + 8]
call fcn.00471b10
add esp, 0x18
test eax, eax
jne 0x471226
cmp dword [edi], 0xffffffff
je 0x471226
mov bl, 1
jmp 0x471228
xor bl, bl
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x471238
push ecx
call fcn.00479a00
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x471670
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
call fcn.00472740
add esp, 4
mov dword [ebp - 0xc], vtable.CPathString.0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push 0
push dword [ebp + 8]
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x4716c1
push eax
call fcn.0056baf4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4716d1
push ecx
call fcn.0056baf4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4716e0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
push ecx
mov eax, esp
lea ecx, [ebp - 0x434]
mov dword [eax], 0x5b2a54
push dword [ebp + 8]
call fcn.00470650
lea ecx, [ebp - 0x434]
call fcn.00470f60
test al, al
je 0x471843
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea esp, [esp]
push dword [ebp + 8]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x18], vtable.CPathString.0
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
call fcn.00472190
mov eax, dword [ebp - 0x42c]
mov esi, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, ecx
shr eax, 4
test al, 1
je 0x4717d5
shr ecx, 0xa
test cl, 1
je 0x4717c6
push esi
call fcn.00472740
add esp, 4
mov dword [ebp - 0xc], vtable.CPathString.0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push 0
push esi
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
push eax
call edi
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4717ad
push eax
call fcn.0056baf4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4717fe
push eax
call fcn.0056baf4
add esp, 4
mov dword [ebp - 8], 0
jmp 0x4717fe
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.004716e0
add esp, 4
jmp 0x4717fe
push esi
call fcn.00473120
add esp, 4
test al, al
jne 0x4717fe
push esi
call fcn.00470e90
add esp, 4
test al, al
je 0x4717fe
push esi
call fcn.00472740
push esi
call fcn.00473120
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], vtable.CPathString.0
test eax, eax
je 0x47181c
push eax
call fcn.0056baf4
add esp, 4
mov dword [ebp - 0x10], 0
test esi, esi
je 0x471830
push esi
call fcn.0056baf4
add esp, 4
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x434]
call fcn.00470f60
test al, al
jne 0x471720
push dword [ebp + 8]
call fcn.00471670
mov ecx, dword [ebp - 0x430]
add esp, 4
mov bl, al
cmp ecx, 0xffffffff
je 0x471862
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x250
push dword [ebp - 0x42c]
call fcn.0056ba55
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471880
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.00472190
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00471fd0
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x4718ef
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4718ff
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x47190f
push eax
call fcn.0056baf4
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x47191f
push ecx
call fcn.0056baf4
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4719c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.00472190
mov edi, dword [ebp - 0x14]
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.00470e90
add esp, 4
test al, al
jne 0x471ac4
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471a01
sub ecx, edx
lea esi, [edi - 1]
add esi, ecx
cmp esi, edi
jbe 0x471a8a
cmp byte [esi], 0x5c
jne 0x471a82
push 0
push edi
lea ecx, [ebp - 0xc]
mov byte [esi], 0
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0xc], vtable.CPathString.0
test ecx, ecx
je 0x471a63
push ecx
call fcn.0056baf4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x471a7a
push eax
call fcn.0056baf4
add esp, 4
mov dword [ebp - 8], 0
mov byte [esi], 0x5c
cmp ebx, 0xffffffff
jne 0x471a89
dec esi
cmp esi, edi
ja 0x471a13
jmp 0x471a8a
inc esi
mov al, byte [esi]
test al, al
je 0x471aaf
cmp al, 0x5c
jne 0x471aa7
push ecx
mov eax, esp
mov byte [esi], 0
mov dword [eax], edi
call fcn.00470da0
add esp, 4
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x471a90
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.00470da0
add esp, 4
test al, al
jne 0x471ac4
xor bl, bl
jmp 0x471ac6
mov bl, 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x471ad6
push eax
call fcn.0056baf4
add esp, 4
test edi, edi
je 0x471ae3
push edi
call fcn.0056baf4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471b10
Capabilities:
Inspect section memory permissions
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], vtable.CPathString.0
mov dword [ebp - 0xc], 0
call fcn.00472190
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
mov eax, dword [ebp + 0x1c]
shl ecx, 0x1f
mov edx, ecx
or edx, 0x40000000
test bl, 2
mov dword [eax], 0xffffffff
mov eax, 0xc0000000
cmove edx, ecx
cmp ebx, 4
cmove edx, eax
mov eax, edx
or eax, 4
test bl, 8
cmove eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
cmp eax, 7
ja case.default.0x471ba9
jmp dword [eax*4 + 0x471cbc]
xor edi, edi
jmp 0x471b9d
mov edi, 1
jmp 0x471b9d
mov edi, 2
jmp 0x471b9d
mov edi, 3
jmp 0x471b9d
mov edi, 7
mov eax, dword [ebp + 0x14]
cmp eax, 3
ja case.default.0x471ba9
jmp dword [eax*4 + 0x471cdc]
mov dword [ebp + 0xc], 3
jmp 0x471bd2
mov dword [ebp + 0xc], 4
jmp 0x471bd2
mov dword [ebp + 0xc], 1
jmp 0x471bd2
mov dword [ebp + 0xc], 2
mov ebx, dword [ebp + 0x18]
mov ecx, ebx
and ecx, 1
shl ecx, 0x1e
sub ecx, 0xffffff80
mov edx, ecx
or edx, 0x20000000
test bl, 2
cmove edx, ecx
mov esi, edx
or esi, 0x8000000
test bl, 8
cmove esi, edx
test bl, 0x10
je 0x471c0d
and esi, 0xffffff7f
or esi, 0x100
mov ecx, esi
or ecx, 0x4000000
test bl, 0x20
push 0
cmove ecx, esi
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push 0
push edi
push dword [ebp - 4]
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 0x1c]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x471c4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x471c91
mov esi, dword [sym.imp.KERNEL32.dll_SetFileTime]
test bl, 4
je 0x471c6e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push ecx
push 0
push eax
mov dword [ebp - 4], 0xffffffff
call esi
test bl, bl
jns 0x471c88
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [edi]
call esi
xor esi, esi
jmp 0x471c91
mov esi, 0x57
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x471ca1
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x471cb1
push eax
call fcn.0056baf4
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471d50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
je 0x471d63
mov dword [esi], 0
mov esi, dword [ebp + 0x10]
xor edi, edi
test esi, esi
je 0x471dc0
mov ebx, dword [ebp + 0xc]
mov ecx, 0x40000000
mov dword [ebp + 0x10], 0
cmp esi, ecx
mov eax, esi
push 0
cmova eax, ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x471db1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, ecx
cmp ecx, 0xe8
je 0x471ddd
xor eax, eax
test edx, edx
jne 0x471de1
jmp 0x471db4
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x471dc0
add ebx, eax
add edi, eax
sub esi, eax
jne 0x471d6f
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x471de8
test esi, esi
je 0x471dea
push 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, 0x26
pop ebx
pop ebp
ret
test edi, edi
jne 0x471dc0
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
mov dword [eax], edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x471e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
test eax, eax
push ebx
push esi
lea esi, [ebp - 4]
cmovne esi, eax
push edi
mov dword [ebp - 4], esi
xor edi, edi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x471e79
mov ebx, dword [ebp + 0xc]
push 0
mov ecx, 0x40000000
mov dword [ebp + 0x14], 0
lea eax, [ebp + 0x14]
cmp esi, ecx
push eax
mov eax, esi
cmova eax, ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x471e66
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
test eax, eax
je 0x471e69
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x471e71
test edi, edi
jne 0x471e79
add ebx, ecx
add edi, ecx
sub esi, ecx
jne 0x471e21
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472740
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472190
lea ecx, [ebp - 0xc]
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x472791
test al, 3
je 0x47278d
and eax, 0xfffffffc
lea ecx, [ebp - 0xc]
push eax
call fcn.00471fd0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x472793
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x4727a3
push eax
call fcn.0056baf4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4727b3
push eax
call fcn.0056baf4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret