joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4548c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f4bce
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0xdb
je 0x4548fc
mov byte [0], 0x78
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edi
je 0x454917
cmp byte [esi + 5], 0
jne 0x454914
push eax
call fcn.004cac16
add esp, 4
mov dword [esi + 8], edi
lea ecx, [esp + 0x38]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov byte [esi + 5], 0
call fcn.004537d0
mov eax, dword [esp + 0xa4]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0xa0], edi
call fcn.00453ac0
mov ebp, dword [esp + 0xa8]
lea ecx, [esp + 0x38]
push ebp
push ecx
call fcn.00456880
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x4549bb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4549d6
test ebp, ebp
je 0x4549b0
lea ecx, [esp + 0x1c]
call fcn.00451c20
lea ecx, [esp + 0x1c]
mov byte [esp + 0x9c], 1
call fcn.00453240
mov esi, dword [ebp]
lea ecx, [esp + 0x1c]
call fcn.004c06c0
mov edx, dword [esi + 0x10]
push eax
mov ecx, ebp
call edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x9c], 0
call fcn.00451e70
push 0
push ebx
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x38]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00453880
xor al, al
jmp 0x454acf
test edi, edi
jne 0x4549ff
push edi
push ebx
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x38]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00453880
mov al, 1
jmp 0x454acf
lea ebp, [edi + 4]
push ebp
call fcn.004cabe6
push ebp
push 0
push eax
mov dword [esi + 8], eax
call fcn.004db150
mov ecx, dword [esi + 8]
add esp, 0x10
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
push ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov esi, dword [esp + 0xa8]
mov byte [esp + 0x17], 1
jne 0x454a8f
test esi, esi
je 0x454a8a
lea ecx, [esp + 0x1c]
call fcn.00451c20
lea ecx, [esp + 0x1c]
mov byte [esp + 0x9c], 2
call fcn.00453240
mov ebp, dword [esi]
lea ecx, [esp + 0x1c]
call fcn.004c06c0
mov edx, dword [ebp + 0x10]
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x9c], 0
call fcn.00451e70
mov byte [esp + 0x17], 0
cmp dword [esp + 0x18], edi
je 0x454aac
test esi, esi
je 0x454aa7
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_read_the_entire_file
mov ecx, esi
call edx
mov byte [esp + 0x17], 0
push 0
push ebx
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x38]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00453880
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
Function at 0x455b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f6ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00451c20
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
push edi
mov dword [esp + 0x38], 0
call fcn.0045e130
add esp, 8
test al, al
je 0x455b82
mov dword [esi + 0x20], edi
lea ecx, [esp + 0xc]
add esi, 4
push ecx
mov ecx, esi
call fcn.00452b00
jmp 0x455b93
mov dword [esi + 0x20], 0
add esi, 4
mov ecx, esi
call fcn.00451240
mov ecx, esi
call fcn.00451af0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00451e70
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4

Function at 0x455e10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f4ceb
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x3ac], eax
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x3b8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c8]
lea ecx, [esp + 8]
call fcn.004683b0
lea ecx, [esp + 8]
mov dword [esp + 0x3c0], 0
call fcn.004683e0
test al, al
jne 0x455e87
lea edx, [esp + 0x1a8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x455eab
lea eax, [esp + 0xa0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xa0]
push ecx
mov ecx, esi
call fcn.00453a00
jmp 0x455eba
lea edx, [esp + 0x1a8]
push edx
mov ecx, esi
call fcn.00453ac0
lea ecx, [esp + 8]
mov dword [esp + 0x3c0], 0xffffffff
call fcn.004683d0
mov ecx, dword [esp + 0x3b8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x3ac]
xor ecx, esp
call fcn.004d99c4
add esp, 0x3bc
ret

Function at 0x455f00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f4ceb
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x3ac], eax
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x3b8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c8]
lea ecx, [esp + 8]
call fcn.004683b0
lea ecx, [esp + 8]
mov dword [esp + 0x3c0], 0
call fcn.004683e0
test al, al
je 0x455f84
lea eax, [esp + 0xa0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0xa0]
push ecx
mov ecx, esi
call fcn.00453a00
jmp 0x455fd9
lea edx, [esp + 0x1a8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x455fca
lea eax, [esp + 0xa0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x455fb9
mov byte [esp + 0xa0], al
lea ecx, [esp + 0xa0]
push ecx
mov ecx, esi
call fcn.00453a00
jmp 0x455fd9
lea edx, [esp + 0x1a8]
push edx
mov ecx, esi
call fcn.00453ac0
lea ecx, [esp + 8]
mov dword [esp + 0x3c0], 0xffffffff
call fcn.004683d0
mov ecx, dword [esp + 0x3b8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x3ac]
xor ecx, esp
call fcn.004d99c4
add esp, 0x3bc
ret
Function at 0x456110
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4f4d8c
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x16c], eax
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x180]
mov dword fs:[0], eax
mov esi, dword [esp + 0x190]
mov edi, dword [esp + 0x194]
mov ebp, dword [esp + 0x198]
lea ecx, [esp + 0x88]
call fcn.004537d0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x188], 0
call fcn.004537d0
push esi
lea ecx, [esp + 0x8c]
mov byte [esp + 0x18c], 1
call fcn.004546c0
push edi
lea ecx, [esp + 0x30]
call fcn.004546c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x90]
call fcn.004543f0
push 0x5c
push 0x2f
lea ecx, [esp + 0x34]
call fcn.004543f0
lea ecx, [esp + 0xe4]
call fcn.004683b0
lea ecx, [esp + 0xe4]
mov byte [esp + 0x188], 2
call fcn.004683e0
test al, al
lea ecx, [esp + 0x2c]
je 0x4561fe
call fcn.00453f00
push eax
lea ecx, [esp + 0x8c]
call fcn.00453f00
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x456217
call fcn.00453b20
push eax
lea ecx, [esp + 0x8c]
call fcn.00453b20
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
sbb eax, eax
neg eax
test eax, eax
jne 0x4562ad
test ebp, ebp
je 0x45626d
lea ecx, [esp + 0x10]
call fcn.00451c20
lea ecx, [esp + 0x10]
mov byte [esp + 0x188], 3
call fcn.00453240
mov esi, dword [ebp]
lea ecx, [esp + 0x10]
call fcn.004c06c0
push eax
mov eax, dword [esi + 0x28]
push str.errorMsg
mov ecx, ebp
call eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x188], 2
call fcn.00451e70
lea ecx, [esp + 0xe4]
mov byte [esp + 0x188], 1
call fcn.004683d0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x188], 0
call fcn.00453880
lea ecx, [esp + 0x88]
mov dword [esp + 0x188], 0xffffffff
call fcn.00453880
xor al, al
jmp 0x4562eb
lea ecx, [esp + 0xe4]
mov byte [esp + 0x188], 1
call fcn.004683d0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x188], 0
call fcn.00453880
lea ecx, [esp + 0x88]
mov dword [esp + 0x188], 0xffffffff
call fcn.00453880
mov al, 1
mov ecx, dword [esp + 0x180]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.004d99c4
add esp, 0x17c
ret
Function at 0x4564a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4f4e76
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x104]
mov dword fs:[0], eax
mov esi, dword [esp + 0x114]
lea ecx, [esp + 0xc]
call fcn.004537d0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x110], 0
call fcn.004546c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
call fcn.004543f0
lea ecx, [esp + 0x68]
call fcn.004683b0
lea ecx, [esp + 0x68]
mov byte [esp + 0x10c], 1
call fcn.004683e0
test al, al
lea ecx, [esp + 0xc]
je 0x45653b
call fcn.00453f00
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x456547
call fcn.00453b20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [esp + 0x68]
setne bl
mov byte [esp + 0x10c], 0
call fcn.004683d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10c], 0xffffffff
call fcn.00453880
mov al, bl
mov ecx, dword [esp + 0x104]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xf4]
xor ecx, esp
call fcn.004d99c4
add esp, 0x104
ret

Function at 0x456cd0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4f4e26
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
mov edi, dword [esp + 0x118]
mov esi, dword [esp + 0x11c]
lea ecx, [esp + 0x10]
call fcn.004537d0
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x114], 0
call fcn.004546c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x18]
call fcn.004543f0
lea ecx, [esp + 0x6c]
call fcn.004683b0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x110], 1
call fcn.004683e0
test al, al
push esi
lea ecx, [esp + 0x14]
je 0x456d74
call fcn.00453f00
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x456d80
call fcn.00453b20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
lea ecx, [esp + 0x6c]
setne bl
mov byte [esp + 0x110], 0
call fcn.004683d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x110], 0xffffffff
call fcn.00453880
mov al, bl
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf4]
xor ecx, esp
call fcn.004d99c4
add esp, 0x104
ret
Function at 0x456de0
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4f4e76
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x104]
mov dword fs:[0], eax
mov esi, dword [esp + 0x114]
lea ecx, [esp + 0xc]
call fcn.004537d0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x110], 0
call fcn.004546c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
call fcn.004543f0
lea ecx, [esp + 0x68]
call fcn.004683b0
lea ecx, [esp + 0x68]
mov byte [esp + 0x10c], 1
call fcn.004683e0
test al, al
lea ecx, [esp + 0xc]
je 0x456e7b
call fcn.00453f00
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x456e87
call fcn.00453b20
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
lea ecx, [esp + 0x68]
setne bl
mov byte [esp + 0x10c], 0
call fcn.004683d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10c], 0xffffffff
call fcn.00453880
mov al, bl
mov ecx, dword [esp + 0x104]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xf4]
xor ecx, esp
call fcn.004d99c4
add esp, 0x104
ret

Function at 0x456ee0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4f4e76
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x104]
mov dword fs:[0], eax
mov esi, dword [esp + 0x114]
lea ecx, [esp + 0xc]
call fcn.004537d0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x110], 0
call fcn.004546c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
call fcn.004543f0
lea ecx, [esp + 0x68]
call fcn.004683b0
lea ecx, [esp + 0x68]
mov byte [esp + 0x10c], 1
call fcn.004683e0
test al, al
je 0x456f83
mov eax, dword [esp + 0x118]
push eax
lea ecx, [esp + 0x10]
call fcn.00453f00
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x456f9b
mov ecx, dword [esp + 0x118]
push ecx
lea ecx, [esp + 0x10]
call fcn.00453b20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [esp + 0x68]
setne bl
mov byte [esp + 0x10c], 0
call fcn.004683d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10c], 0xffffffff
call fcn.00453880
mov al, bl
mov ecx, dword [esp + 0x104]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xf4]
xor ecx, esp
call fcn.004d99c4
add esp, 0x104
ret
Function at 0x457110
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4f4eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
xor edi, edi
push ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x4571b8
mov esi, dword [esp + 0x40]
cmp esi, edi
je 0x4571a0
lea ecx, [esp + 0x10]
call fcn.00451c20
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], edi
call fcn.00453240
mov edi, dword [esi]
lea ecx, [esp + 0x10]
call fcn.004c06c0
mov edx, dword [edi + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_get_file_size__64_
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.00451e70
or eax, 0xffffffff
or edx, 0xffffffff
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
mov ecx, dword [esp + 0xc]
push ecx
push eax
call fcn.00468410
add esp, 8
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x4571e0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4f4eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45726c
mov esi, dword [esp + 0x40]
test esi, esi
je 0x45726c
lea ecx, [esp + 0x10]
call fcn.00451c20
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call fcn.00453240
mov ebx, dword [esi]
lea ecx, [esp + 0x10]
call fcn.004c06c0
mov edx, dword [ebx + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_get_file_size
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], edi
call fcn.00451e70
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x457280
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4f4ef3
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x9c]
test ebx, ebx
mov eax, dword [esp + 0xa4]
mov byte [eax], 0
je 0x4573a5
cmp byte [ebx], 0
je 0x4573a5
lea ecx, [esp + 0x30]
call fcn.004537d0
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0
call fcn.00453a00
push 0x5c
push 0x2f
lea ecx, [esp + 0x38]
call fcn.004543f0
mov esi, dword [esp + 0xa0]
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00456880
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x457391
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4573a9
test esi, esi
je 0x457386
lea ecx, [esp + 0x14]
call fcn.00451c20
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 1
call fcn.00453240
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.004c06c0
mov edx, dword [ebp + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push ebx
push str.filename
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_get_file_size
mov ecx, esi
call edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 0
call fcn.00451e70
push 0
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0xffffffff
call fcn.00453880
xor eax, eax
jmp 0x4573d4
push 0
push edi
call fcn.004661e0
mov eax, dword [esp + 0xac]
add esp, 8
lea ecx, [esp + 0x30]
mov byte [eax], 1
mov dword [esp + 0x94], 0xffffffff
call fcn.00453880
mov eax, ebp
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x4573f0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4f4ef3
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x9c]
test ebx, ebx
mov eax, dword [esp + 0xa4]
mov byte [eax], 0
je 0x457516
cmp word [ebx], 0
je 0x457516
lea ecx, [esp + 0x30]
call fcn.004537d0
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0
call fcn.00453ac0
push 0x5c
push 0x2f
lea ecx, [esp + 0x38]
call fcn.004543f0
mov esi, dword [esp + 0xa0]
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00456880
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x457502
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x45751a
test esi, esi
je 0x4574f7
lea ecx, [esp + 0x14]
call fcn.00451c20
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 1
call fcn.00453240
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.004c06c0
mov edx, dword [ebp + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push ebx
push str.filename
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_get_file_size
mov ecx, esi
call edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 0
call fcn.00451e70
push 0
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x94], 0xffffffff
call fcn.00453880
xor eax, eax
jmp 0x457545
push 0
push edi
call fcn.004661e0
mov eax, dword [esp + 0xac]
add esp, 8
lea ecx, [esp + 0x30]
mov byte [eax], 1
mov dword [esp + 0x94], 0xffffffff
call fcn.00453880
mov eax, ebp
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x457810
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4f5960
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x10]
call fcn.00451b50
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.004511b0
lea ecx, [esp + 0xc]
call fcn.004c06c0
mov edi, eax
test edi, edi
je 0x45794d
cmp byte [edi], 0
je 0x45794d
mov esi, dword [esp + 0x58]
push esi
push edi
call fcn.00457560
add esp, 8
test al, al
jne 0x4578b0
test esi, esi
je 0x457961
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push edi
push str.delete_filename
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Cannot_delete_file__file_does_not_exist
mov ecx, esi
call eax
jmp 0x457961
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x457928
test esi, esi
je 0x457961
lea ecx, [esp + 0x28]
call fcn.00451c20
push str.DeleteFile:
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 1
call fcn.004516b0
lea ecx, [esp + 0x28]
call fcn.00453240
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Cannot_delete_file
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push edi
push str.delete_filename
mov ecx, esi
call eax
mov edi, dword [esi]
lea ecx, [esp + 0x28]
call fcn.004c06c0
mov edx, dword [edi + 0x14]
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0
call fcn.00451e70
jmp 0x457961
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00451e70
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x457961
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.Cannot_delete_file__filename_is_null_or_empty
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00451e70
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret
Function at 0x457a20
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f4fa3
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebx, dword [esp + 0xa0]
test ebx, ebx
je 0x457acb
cmp byte [ebx], 0
je 0x457acb
lea ecx, [esp + 0x34]
call fcn.004537d0
push ebx
lea ecx, [esp + 0x38]
mov dword [esp + 0x9c], 0
call fcn.00453a00
mov esi, dword [esp + 0xac]
push esi
lea eax, [esp + 0x38]
push eax
push 0x33
call fcn.004565a0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x457ad2
test esi, esi
je 0x457ab7
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push ebx
push str.filename
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push str.Failed_to_write_complete_file__7_
mov ecx, esi
call eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0xffffffff
call fcn.00453880
xor al, al
jmp 0x457b9e
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x457b7d
mov ebp, dword [esp + 0xa8]
test ebp, ebp
je 0x457b7d
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], ebp
je 0x457b7d
test esi, esi
je 0x457b6d
lea ecx, [esp + 0x18]
call fcn.00451c20
lea ecx, [esp + 0x18]
mov byte [esp + 0x98], 1
call fcn.00453240
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push ebx
push str.filename
mov ecx, esi
call eax
mov ebx, dword [esi]
lea ecx, [esp + 0x18]
call fcn.004c06c0
mov edx, dword [ebx + 0x10]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push str.Failed_to_write_complete_file__1_
mov ecx, esi
call edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x98], 0
call fcn.00451e70
push 0
push edi
call fcn.004661e0
add esp, 8
jmp 0x457ab7
push 0
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x34]
mov dword [esp + 0x98], 0xffffffff
call fcn.00453880
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret