joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b820
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
lea esi, [ecx + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x49b9d3
mov dword [ebp - 0x14], esi
mov esi, dword [edi + 0x14]
test esi, esi
je 0x49b925
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov eax, esi
shr eax, 1
and eax, 0x55555555
mov edx, esi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x10], eax
cmp eax, 1
ja 0x49b8bb
lea ebx, [esi - 1]
and ebx, ecx
jmp 0x49b8cd
mov ebx, ecx
cmp ecx, esi
mov edx, esi
jb 0x49b8cf
mov eax, ecx
mov esi, edx
xor edx, edx
div esi
mov ebx, edx
mov edx, esi
mov eax, dword [edi + 0x10]
mov eax, dword [eax + ebx*4]
test eax, eax
mov edi, dword [ebp - 0x10]
je 0x49b925
mov esi, dword [eax]
test esi, esi
je 0x49b925
lea eax, [edx - 1]
mov dword [ebp - 0x18], eax
jmp 0x49b8fe
mov eax, dword [ebp + 8]
cmp dword [esi + 8], eax
je 0x49b938
mov esi, dword [esi]
test esi, esi
je 0x49b925
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x49b8f0
cmp edi, 1
ja 0x49b910
and eax, dword [ebp - 0x18]
jmp 0x49b921
cmp eax, edx
jb 0x49b921
mov edi, edx
xor edx, edx
div edi
mov eax, edx
mov edx, edi
mov edi, dword [ebp - 0x10]
cmp eax, ebx
je 0x49b8f8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov esi, dword [0x704490]
cmp esi, 1
ja 0x49b9a3
push 0x704490
call fcn.00499160
add esp, 4
test al, al
je 0x49b99d
mov dword [0x704498], 0
mov dword [0x704494], 0
mov esi, 0x704494
mov ecx, 0x704494
push 0
call fcn.004acff0
push 0x704490
push 0
push 0x704494
push 0x704490
call fcn.00499220
add esp, 0x10
jmp 0x49b9a3
mov esi, dword [0x704490]
mov ecx, esi
call fcn.004acf70
mov edi, eax
mov ecx, esi
mov eax, dword [ebp + 0xc]
mov ebx, eax
push eax
call fcn.004acfb0
mov eax, dword [ebx + 0x14]
push dword [ebp + 8]
push eax
call dword [eax + 4]
add esp, 8
mov ecx, esi
push edi
call fcn.004acfb0
jmp 0x49b92e
mov ecx, esi
call fcn.004b9690
jmp 0x49b83d
Function at 0x4aca40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.00641d10
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x701214]
cmp eax, 0xffffffff
je 0x4acba6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x4acba6
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.006452d0
add esp, 0xc
mov ecx, dword [0x701214]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.0056b8e0
add esp, 8
push ebx
call fcn.00641805
add esp, 4
lea edi, [ebp - 0x1410]
push 0xc00
push 0xff
push edi
call fcn.00645dd0
add esp, 0xc
mov eax, dword [0x705170]
mov ecx, dword [0x705840]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4acbc7
mov esi, dword [0x70516c]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4acbbb
push 0xc00
push 0x70456c
push edi
call fcn.006452d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ebx, 0x100
jmp 0x4acb3a
lea ecx, [ebx - 1]
cmp ebx, 2
mov ebx, ecx
jb 0x4acb96
test al, 1
je 0x4acb96
xor edi, edi
lea esi, [ebp - 0x1408]
xor eax, eax
jmp 0x4acb5e
add edi, 1
add esi, 0xc
cmp edi, 0x100
je 0x4acb30
mov ecx, dword [ebp + edi*8 - 0x810]
test ecx, ecx
je 0x4acb50
cmp dword [esi - 8], 0
je 0x4acb50
mov edx, dword [ebp + edi*8 - 0x80c]
cmp edx, dword [esi]
jne 0x4acb50
mov edx, dword [esi - 4]
test edx, edx
je 0x4acb50
mov dword [ebp + edi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x4acb50
push 2
push dword [ebp - 0x1414]
call fcn.0056b8e0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.004b9690
jmp 0x4acb06
push 0x705170
call fcn.00641847
add esp, 4
cmp dword [0x705170], 0xffffffff
jne 0x4acaf1
push 4
call fcn.0064173e
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00490e60
mov dword [0x70516c], esi
push 0x705170
call fcn.006418bd
add esp, 4
jmp 0x4acaf1

Function at 0x4acc10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x701214]
cmp eax, 0xffffffff
je 0x4acc32
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4acc40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x701214]
cmp eax, 0xffffffff
je 0x4acc5d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4acc62
call fcn.004acd80
mov eax, dword [0x705170]
mov ecx, dword [0x705840]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4acd35
mov edi, dword [0x70516c]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4acd29
mov ecx, dword [0x704568]
add ecx, 1
mov edx, 0x100
nop word cs:[eax + eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x70456c], 0
je 0x4accdd
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x70456c], 0
je 0x4accdd
add ecx, 2
add edx, 0xfffffffe
jne 0x4accb0
jmp 0x4acd0d
lea ecx, [eax*4 + 0x70456c]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x704570], ecx
mov dword [0x704568], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x704574]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4acd7a
cmp eax, 0x100
jge 0x4acd7d
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.004b9690
jmp 0x4acc98
push 0x705170
call fcn.00641847
add esp, 4
cmp dword [0x705170], 0xffffffff
jne 0x4acc83
push 4
call fcn.0064173e
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00490e60
mov dword [0x70516c], edi
push 0x705170
call fcn.006418bd
add esp, 4
jmp 0x4acc83
int3
int3

Function at 0x4acd80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov eax, dword [0x701214]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x4ace28
lea esi, [ebp - 0x810]
push esi
call fcn.0056b8b0
add esp, 4
test al, al
je 0x4acea9
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x4acdff
push esi
call fcn.0056b8b0
add esp, 4
test al, al
je 0x4aceac
cmp dword [ebp - 0x810], 0xffffffff
je 0x4aceac
push 0xffffffffffffffff
call fcn.0056b8d0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x701214], ecx
mov eax, dword [ebp - 0x810]
je 0x4ace28
push eax
call fcn.0056b8d0
add esp, 4
mov eax, dword [0x701214]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4acea6
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.00645dd0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.0056b8e0
add esp, 8
push 0x800
call fcn.006417f3
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.006452d0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.0056b8e0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0064180a
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x4acf70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push dword [0x701214]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and eax, 3
cmp eax, 2
jne 0x4acf96
call fcn.0056b920
xor eax, eax
jmp 0x4acfab
xor eax, eax
and ecx, 0xfffffffc
je 0x4acfab
mov edx, dword [esi]
mov edi, dword [ecx + edx*8 + 4]
cmp edi, dword [esi + 4]
jne 0x4acfab
mov eax, dword [ecx + edx*8]
pop esi
pop edi
pop ebp
ret
Function at 0x4b4ab0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.004b4ac0
Function at 0x4b4eb0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 1
pop ebp
jmp fcn.004b4ac0

Function at 0x4b4ed0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov edi, esp
push 0x18a
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push edi
call fcn.004994e0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.004ab280
cmp byte [esi + 0xb], 0
jns 0x4b4f4b
cmp dword [esi + 4], 0x103
jbe 0x4b4f49
xor ebx, ebx
jmp 0x4b4f5b
mov esi, dword [esi]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.004ab2f0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b4f80
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
lea ebx, [esp + 0x250]
push 0x196
push str..._.._base_files_file_util_win.cc
push 0x689fed
push ebx
call fcn.004994e0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.004ab280
push 0x208
push 0xff
push ebx
call fcn.00645dd0
add esp, 0xc
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4b5011
mov eax, dword [esi]
push 0x104
push eax
push ebx
call fcn.004a8890
add esp, 0xc
push ebx
call fcn.00402f50
add esp, 4
lea ebx, [esp + 0x48]
push 0x208
push 0xff
push ebx
call fcn.00645dd0
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4b504a
mov eax, dword [edi]
push 0x104
push eax
push ebx
call fcn.004a8890
add esp, 0xc
push ebx
call fcn.00402f50
add esp, 4
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4b506c
mov eax, dword [esi]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x4b5076
mov ecx, dword [edi]
sub esp, 0x18
movaps xmm0, xmmword [0x677e70]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov bl, 1
test eax, eax
jne 0x4b50e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b7ab0
add esp, 4
cmp byte [edi + 0xb], 0
jns 0x4b50af
mov edi, dword [edi]
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], eax
jns 0x4b50bb
mov esi, dword [esi]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4b50e5
test eax, eax
jne 0x4b50e5
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
jne 0x4b50e1
call fcn.004b7a40
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.004ab2f0
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b57d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov ebx, esp
push 0x1c9
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.004994e0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.004ab280
cmp byte [edi + 0xb], 0
jns 0x4b5840
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004ab2f0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b5870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov ebx, esp
push 0x1f1
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.004994e0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.004ab280
cmp byte [edi + 0xb], 0
jns 0x4b58e0
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004ab2f0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b5920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0xff
push edi
call fcn.00645dd0
add esp, 0xc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
add esi, 0xffffffff
cmp esi, 0x102
ja 0x4b59c8
cmp word [ebp - 0x21a], 0
je 0x4b5992
xor ecx, ecx
nop word cs:[eax + eax]
nop
lea eax, [ecx + 1]
cmp word [ebp + ecx*2 - 0x218], 0
mov ecx, eax
jne 0x4b5980
jmp 0x4b5994
xor eax, eax
lea ebx, [ebp - 0x234]
mov ecx, ebx
push eax
push edi
call fcn.004956d0
lea edi, [ebp - 0x228]
mov ecx, ebx
push edi
call fcn.00497840
mov ecx, dword [ebp + 8]
push edi
call fcn.004957d0
mov ecx, edi
call fcn.00495790
mov ecx, ebx
call fcn.00495790
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b59f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.00645dd0
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x689f70]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4b5a69
cmp word [ebp - 0x214], 0
je 0x4b5a69
xor eax, eax
nop
cmp word [ebp + eax*2 - 0x212], 0
lea eax, [eax + 1]
jne 0x4b5a50
mov ecx, esi
push eax
push edi
call fcn.004956d0
jmp 0x4b5ac2
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.00495680
push edi
call fcn.004b5920
add esp, 4
mov ecx, esi
test al, al
je 0x4b5aab
push edi
call fcn.004956a0
jmp 0x4b5ab7
push 3
push 0x68a016
call fcn.004956d0
lea ecx, [ebp - 0x220]
call fcn.00495790
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0064180a
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x4b6630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov edi, esp
push 0x36f
push str..._.._base_files_file_util_win.cc
push 0x68a090
push edi
call fcn.004994e0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.004ab280
cmp byte [esi + 0xb], 0
jns 0x4b669e
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x689f90]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0xffffffff
test eax, eax
je 0x4b6731
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x4b672a
mov esi, dword [ebp + 0x10]
call fcn.00499510
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp], 0xffffffff
push 0
lea eax, [esp + 4]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp], esi
mov ecx, 0xffffffff
cmove ecx, esi
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, ecx
call fcn.00499510
push edi
call fcn.004bbc10
add esp, 4
jmp 0x4b6731
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x10]
call fcn.004ab2f0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064180a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b6750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea edi, [esp + 0x60]
push 0x3a2
push str..._.._base_files_file_util_win.cc
push 0x68a09a
push edi
call fcn.004994e0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.004ab280
lea eax, [esp + 0x62]
push 0x206
push 0xff
push eax
call fcn.00645dd0
add esp, 0xc
mov word [esp + 0x60], 0
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xffffffff
cmp esi, 0x103
ja 0x4b6841
cmp word [esp + 0x60], 0
je 0x4b680f
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + 1]
cmp word [esp + ecx*2 + 0x62], 0
mov ecx, eax
jne 0x4b6800
jmp 0x4b6811
xor eax, eax
lea ebx, [esp + 8]
mov ecx, ebx
push eax
push edi
call fcn.004956d0
lea edi, [esp + 0x14]
mov ecx, ebx
push edi
call fcn.00497840
mov ecx, dword [ebp + 8]
push edi
call fcn.004957d0
mov ecx, edi
call fcn.00495790
mov ecx, ebx
call fcn.00495790
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.004ab2f0
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b6870
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov ebx, esp
push 0x3b2
push str..._.._base_files_file_util_win.cc
push 0x68a0af
push ebx
call fcn.004994e0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.004ab280
cmp byte [edi + 0xb], 0
jns 0x4b68e0
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.004ab2f0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b6930
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, edx
mov edi, ecx
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0xb2
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.004994e0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.004ab280
mov ecx, edi
call fcn.00497890
test al, al
jne 0x4b69af
mov ecx, esi
call fcn.00497890
test al, al
je 0x4b69cf
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004ab2f0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [edi + 0xb], 0
jns 0x4b69de
cmp dword [edi + 4], 0x103
ja 0x4b69af
cmp byte [esi + 0xb], 0
jns 0x4b69ed
cmp dword [esi + 4], 0x103
ja 0x4b69af
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xffffffff
push 0xbf
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.004994e0
add esp, 0x10
lea ecx, [esp + 4]
push 0x70519c
push ebx
call fcn.0056c680
cmp byte [esi + 0xb], 0
jns 0x4b6a34
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x4b6a40
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4b6a77
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4b6a6f
mov eax, edi
and eax, 1
je 0x4b6a6f
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
jmp 0x4b6a79
xor ebx, ebx
lea ecx, [esp + 4]
call fcn.0056c870
jmp 0x4b69b1