joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0xa8], eax
test ecx, ecx
je 0x4547c5
cmp byte [ecx + 0xb], 0
js 0x45495b
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
xor esi, esi
push esi
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.0051cc5a
add esp, 0xc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x20]
push 0xcd
push str..._.._base_files_file_util.cc
push str.ReadStreamToStringWithMaxSize
push ebx
call fcn.004dea80
add esp, 0x10
mov ecx, edi
push esi
push ebx
call fcn.004e60a0
mov dword [ebx + 0x30], esi
pxor xmm0, xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
push dword [ebp + 8]
call fcn.0051534a
add esp, 4
push eax
call fcn.00515e3a
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x45496c
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
xor eax, eax
mov edi, edx
neg edi
mov edi, 0
sbb edi, ecx
cmovl eax, ecx
mov ebx, 0xffff
cmovl ebx, edx
mov edx, dword [ebp + 0xc]
cmp edx, ebx
mov ecx, 0
sbb ecx, eax
lea edi, [esp + 0x10]
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
cmovb ebx, edx
inc ebx
mov ecx, edi
push esi
push ebx
call fcn.004daf30
cmp byte [esp + 0x1b], 0
mov eax, edi
jns 0x4548a7
mov eax, dword [esp + 0x10]
add eax, esi
push dword [ebp + 8]
push ebx
push 1
push eax
call fcn.0051ca57
add esp, 0x10
test eax, eax
je 0x4548e8
mov ecx, dword [ebp + 0xc]
sub ecx, esi
cmp ecx, eax
jb 0x454978
test esi, esi
mov ecx, 0x10000
cmove ebx, ecx
add esi, eax
push dword [ebp + 8]
call fcn.0051c610
add esp, 4
test eax, eax
je 0x45497c
push dword [ebp + 8]
call fcn.0051c63c
add esp, 4
test eax, eax
sete bl
mov dword [esp + 0xc], esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x454933
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, dword [esp + 0x18]
mov dword [ecx + 8], esi
movq xmm0, qword [esp + 0x10]
movq qword [ecx], xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
push 0
push dword [esp + 0x10]
call fcn.004daf30
cmp byte [esp + 0x1b], 0
js 0x45498b
lea ecx, [esp + 0x60]
call fcn.004e6100
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
jmp 0x4547c5
mov ebx, 0xffff
xor eax, eax
jmp 0x454875
xor ebx, ebx
jmp 0x4548fc
lea eax, [esi + ebx]
lea ecx, [esp + 0x10]
push 0
push eax
jmp 0x454895
push dword [esp + 0x10]
call fcn.00503da5
add esp, 4
jmp 0x45493a
Function at 0x454ce0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004dbe00
test al, al
je 0x454d23
call fcn.004dbdf0
mov esi, eax
mov ecx, eax
push 0x5eb53b
call fcn.004dbe90
test al, al
jne 0x454d4b
mov ecx, esi
push str.vmodule
call fcn.004dbe90
test al, al
jne 0x454d4b
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x600e64], eax
mov bl, 1
test al, 1
jne 0x454deb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [0x605ff8], 0
jne 0x454e6c
mov eax, dword [0x605ffc]
mov dword [0x605ff8], eax
push 0x14
call fcn.00503d75
add esp, 4
mov edi, eax
mov ebx, str.vmodule
push ebx
call fcn.0051f310
add esp, 4
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push ebx
push edx
call fcn.004dbf80
mov eax, 0x5eb53b
push eax
call fcn.0051f310
add esp, 4
lea ebx, [ebp - 0x28]
mov ecx, esi
push eax
mov eax, 0x5eb53b
push eax
push ebx
call fcn.004dbf80
mov ecx, edi
push 0x606000
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.00566a10
mov dword [0x605ffc], edi
cmp byte [ebx + 0xb], 0
jns 0x454dd1
push dword [ebp - 0x28]
call fcn.00503da5
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x454d23
push dword [ebp - 0x1c]
call fcn.00503da5
add esp, 4
jmp 0x454d23
mov eax, dword [0x606014]
test eax, eax
jne 0x454e00
mov ecx, dword [0x606004]
test ecx, ecx
je 0x454e22
jmp 0x454e3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x606014], 0
mov ecx, dword [0x606004]
test ecx, ecx
jne 0x454e3e
and byte [0x600e64], 0xfe
push 0xc
call fcn.00503d75
add esp, 4
mov ecx, eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
mov dword [0x606004], ecx
push dword [esi + 4]
call fcn.00442dc0
cmp dword [esi + 0xc], 0
jne 0x454e60
mov eax, dword [0x606004]
cmp byte [eax + 0xb], 0
jns 0x454e59
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00551ca0
mov ebx, eax
jmp 0x454d37
int3
Function at 0x459360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x600e84]
cmp eax, 0xffffffff
je 0x459380
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
jmp 0x45937e

Function at 0x459390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x600e84]
cmp eax, 0xffffffff
je 0x459457
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x459457
mov eax, dword [0x606ce0]
mov ecx, dword [0x6033f4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x459461
mov edi, dword [0x606cdc]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4594a6
mov ecx, dword [0x6060d8]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x6060dc], 0
jne 0x4594b2
lea eax, [eax*4 + 0x6060dc]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x6060e0], ecx
mov dword [0x6060d8], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x6060e4]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4594c4
cmp eax, 0x100
jge 0x4594c7
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004594d0
jmp 0x4593b5
push 0x606ce0
call fcn.00503e17
add esp, 4
cmp dword [0x606ce0], 0xffffffff
jne 0x4593d6
push 4
call fcn.00503d75
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004e8440
mov dword [0x606cdc], edi
push 0x606ce0
call fcn.00503e8d
add esp, 4
jmp 0x4593d6
mov ecx, edi
call fcn.004e8450
jmp 0x4593eb
inc edx
cmp edx, 0x100
jne 0x4593f4
jmp 0x45943b
int3
int3
Function at 0x4594d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x600e84]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x45957d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4595c6
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.00508060
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00482ac0
add esp, 8
push edi
call fcn.00503dd3
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.00507560
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00482ac0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00482aa0
add esp, 4
test al, al
je 0x4595c9
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x4595cc
xor eax, eax
dec eax
lock cmpxchg dword [0x600e84], ecx
je 0x459501
push ecx
call fcn.0056cec0
add esp, 4
mov ecx, dword [0x600e84]
mov dword [ebp - 0x814], ecx
jmp 0x459501
int3
int3
push esi
call fcn.00482aa0
add esp, 4
test al, al
je 0x4595f4
cmp dword [ebp - 0x814], 0xffffffff
je 0x4595f4
push 0xffffffffffffffff
call fcn.0056cec0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x45959b
int3
Function at 0x45a920
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 8]
push 0x4c
push str..._.._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.004dea80
add esp, 0x10
mov ecx, esi
push 0
push edi
mov edi, ebx
call fcn.004e60a0
mov dword [esp + 4], 0xffffffff
cmp byte [ebx + 0xb], 0
jns 0x45a98a
mov edi, dword [edi]
lea eax, [esp + 4]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x45aaa0
mov ebx, eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
test ebx, ebx
js 0x45aac3
push ebx
call fcn.00503d75
add esp, 4
mov esi, eax
mov dword [esp + 8], eax
push ebx
push 0
push eax
call fcn.00508060
add esp, 0xc
push esi
push ebx
push dword [esp + 0xc]
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45aaab
lea eax, [esp + 0x1c]
mov dword [eax], 0
lea ecx, [esp + 0x18]
mov dword [ecx], 0xffffffff
push ecx
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45aaab
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
test eax, eax
je 0x45aaab
mov edi, esi
add edi, ebx
push 0x1c
call fcn.00503d75
add esp, 4
mov ebx, eax
mov eax, dword [esp]
mov eax, dword [eax]
mov dword [ebx], fcn.0045ae40
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0xffffffff
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push 0x5e2f4a
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45aacc
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
lea ecx, [esp + 0x20]
call fcn.004e6100
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00504596
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
jmp 0x45aa81
mov eax, dword [ebp + 8]
mov dword [eax], 0
test esi, esi
je 0x45aa81
push esi
call fcn.00503da5
add esp, 4
jmp 0x45aa81
lea ecx, [esp + 8]
call fcn.00534620
int3
Function at 0x45ab60
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov ebx, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
mov dword [ebp - 0x230], eax
movzx edi, word [ecx + 0x16]
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call esi
mov word [ebp - 0x222], ax
movzx eax, word [ebx + 0x16]
mov dword [ebp - 0x228], eax
movzx eax, word [ebx + 0x14]
mov dword [ebp - 0x22c], eax
call esi
mov word [ebp - 0x224], ax
lea esi, [ebp - 0x218]
push 0x208
push 0xff
push esi
call fcn.00508060
add esp, 0xc
mov eax, 0x104
push dword [ebp + 8]
push edi
push dword [ebp - 0x230]
push str.StringFileInfo_04x_04x_ls
push eax
push eax
push esi
call fcn.0045ade0
add esp, 0x1c
lea eax, [ebp - 0x21c]
mov dword [eax], 0
lea ecx, [ebp - 0x220]
mov dword [ecx], 0xffffffff
push ecx
push eax
mov edi, esi
push esi
mov esi, ebx
push dword [ebx + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45ac4f
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x45ac4f
mov edx, dword [ebp - 0x220]
test edx, edx
je 0x45ac4f
mov ecx, dword [ebp + 0xc]
dec edx
push edx
push eax
call fcn.004e3b80
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0x208
push 0xff
mov ebx, edi
push edi
call fcn.00508060
add esp, 0xc
movzx eax, word [ebp - 0x222]
push dword [ebp + 8]
push dword [ebp - 0x228]
push eax
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
push edi
call fcn.0045ade0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0xffffffff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45acd1
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x45acd1
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x45ac29
push 0x208
push 0xff
mov ebx, edi
push edi
call fcn.00508060
add esp, 0xc
mov eax, 0x104
push dword [ebp + 8]
push 0x4e4
push dword [ebp - 0x22c]
push str.StringFileInfo_04x_04x_ls
push eax
push eax
push edi
call fcn.0045ade0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0xffffffff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45ad50
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x45ad50
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x45ac29
push 0x208
push 0xff
push edi
call fcn.00508060
add esp, 0xc
movzx eax, word [ebp - 0x224]
push dword [ebp + 8]
push 0x4e4
push eax
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
push edi
call fcn.0045ade0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0xffffffff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45adcf
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x45adcf
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x45ac29
xor ebx, ebx
jmp 0x45ac36
Function at 0x45b080
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.0045b090
Function at 0x45b2e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.0045b090

Function at 0x45b2f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov ebx, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x410]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x208]
push 0x17c
push str..._.._base_files_file_util_win.cc
push 0x5e2fcd
push edi
call fcn.004dea80
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.004e60a0
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push edi
call fcn.00508060
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x45b376
mov eax, dword [ebx]
mov esi, 0x104
push esi
push eax
push edi
call fcn.004e3900
add esp, 0xc
push edi
call fcn.004d3470
add esp, 4
mov edi, esp
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push edi
call fcn.00508060
add esp, 0xc
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0xb], 0
jns 0x45b3b4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
push eax
push edi
call fcn.004e3900
add esp, 0xc
push edi
call fcn.004d3470
add esp, 4
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x45b3d2
mov eax, dword [ebx]
mov edi, dword [ebp + 0xc]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x45b3df
mov ecx, dword [edi]
sub esp, 0x18
movaps xmm0, xmmword [0x5e2f50]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov cl, 1
test eax, eax
jne 0x45b438
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045c800
add esp, 4
mov esi, eax
cmp byte [edi + 0xb], 0
jns 0x45b41a
mov edi, dword [edi]
cmp byte [ebx + 0xb], 0
jns 0x45b422
mov ebx, dword [ebx]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne cl
jne 0x45b438
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x45b45e
mov ebx, ecx
lea ecx, [esp + 0x410]
call fcn.004e6100
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp esi, 0xfffffffc
jne 0x45b46a
call fcn.00556340
mov esi, eax
mov dword [edi], esi
xor ecx, ecx
jmp 0x45b438
Function at 0x45b470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1af
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.004dea80
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e60a0
cmp byte [edi + 0xb], 0
jns 0x45b4d1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004e6100
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45b500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1d7
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.004dea80
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e60a0
cmp byte [edi + 0xb], 0
jns 0x45b561
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004e6100
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45b5a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.00508060
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x45b623
push ebx
call fcn.0051f544
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.004dd130
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00454570
mov ecx, dword [ebp + 8]
push ebx
call fcn.004dd210
mov ecx, ebx
call fcn.004dd1f0
mov ecx, edi
call fcn.004dd1f0
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45b650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.00508060
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x5e2f60]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x45b6cc
cmp word [ebp - 0x214], 0
je 0x45b6cc
push edi
call fcn.0051f544
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004dd130
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00504596
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.004dd0a0
push edi
call fcn.0045b5a0
add esp, 4
mov ecx, esi
test al, al
je 0x45b6fb
push edi
call fcn.004dd100
jmp 0x45b707
push 3
push 0x5e2ff6
call fcn.004dd130
lea ecx, [ebp - 0x220]
call fcn.004dd1f0
jmp 0x45b6b6
Function at 0x45ba40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0xa8], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x60]
push 0x264
push str..._.._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push ebx
call fcn.004dea80
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.004e60a0
cmp byte [esi + 0xb], 0
mov ebx, esi
jns 0x45baab
mov ebx, dword [esi]
mov edi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45bae5
mov bl, 1
test al, 0x10
je 0x45bbea
lea ecx, [esp + 0x20]
call fcn.004e6100
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
dec eax
lea edi, [esp + 4]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.004dd940
movzx ecx, byte [edi + 0xb]
mov eax, ecx
test cl, cl
jns 0x45bb0a
mov eax, dword [esp + 8]
mov dword [esp], eax
movzx eax, byte [esi + 0xb]
mov edx, eax
test al, al
jns 0x45bb1a
mov edx, dword [esi + 4]
mov edi, dword [esp]
cmp edi, edx
je 0x45bc05
push dword [ebp + 0xc]
lea eax, [esp + 8]
push eax
call fcn.0045ba40
add esp, 8
test al, al
je 0x45bc55
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x45bb5a
lea ecx, [esp + 4]
call fcn.004dd1f0
jmp 0x45bac4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
cmp eax, 0xb7
jne 0x45bbd7
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea eax, [esp + 0x10]
push 0x1d7
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push eax
call fcn.004dea80
add esp, 0x10
mov ecx, edi
push 0
lea eax, [esp + 0x14]
push eax
call fcn.004e60a0
cmp byte [esi + 0xb], 0
jns 0x45bbb7
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
lea ecx, [esp + 0x60]
call fcn.004e6100
cmp esi, 0xffffffff
je 0x45bbd7
and esi, 0x10
jne 0x45bb4c
cmp dword [ebp + 0xc], 0
je 0x45bc4c
push dword [esp]
call fcn.0045c800
add esp, 4
jmp 0x45bc47
test edi, edi
je 0x45bbf6
mov eax, edi
mov dword [edi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x45bac4
test edi, edi
je 0x45bc35
lea edi, [esp + 4]
test cl, cl
jns 0x45bc15
mov edi, dword [esp + 4]
mov ecx, esi
test al, al
jns 0x45bc1d
mov ecx, dword [esi]
xor edx, edx
movzx eax, word [edi + edx*2]
cmp ax, word [ecx + edx*2]
mov eax, dword [esp]
jne 0x45bb25
inc edx
cmp eax, edx
jne 0x45bc1f
mov eax, 0xfffffffc
mov dword [esp], 2
cmp dword [ebp + 0xc], 0
je 0x45bc4c
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x45bb4c