joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a77c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x808040]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edx, 0x20019
or edx, dword [ebp + 0x10]
push esi
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a7880
xor eax, eax
lea edx, [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [esi]
sub esp, 0x30
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4a78a0
mov eax, dword [ebp - 0x1c]
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
test dh, 1
jne 0x4a7886
lea edx, [esi + 8]
lea edi, [ebp - 0x14]
mov dword [edi], 0x104
xor edi, edi
dec edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
xor edi, edi
lea ebx, [ebp - 0x1c]
push ebx
push edi
push edi
push edi
lea edi, [ebp - 0x14]
push edi
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4a788c
jmp 0x4a7886
mov dword [esi], 0
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a7880

Function at 0x4a78d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x4a7941
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
jne 0x4a7941
lea edi, [esi + 8]
lea edx, [ebp - 0x14]
mov dword [edx], 0x104
xor ebx, ebx
dec ebx
lea edx, [ebp - 0x1c]
mov dword [edx], ebx
mov dword [edx + 4], ebx
xor ebx, ebx
push edx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x14]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4a7941
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [esi + 8], 0
jmp 0x4a792f
Function at 0x4a80d0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm0, qword [0x80f340]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4a80fb
jnp 0x4a8120
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.005c6b46
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x80f350]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a8255
mov eax, dword [0x80f360]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a828e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub ebx, dword [0x80f358]
sbb edi, dword [0x80f35c]
movd xmm0, edi
movd xmm1, ebx
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm1, qword [esp + 0x30]
pxor xmm0, xmm0
movsd xmm2, qword [0x782048]
ucomisd xmm2, xmm1
ja 0x4a80fb
mov eax, dword [esp + 8]
sub eax, dword [0x80f348]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x80f34c]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x782050]
subpd xmm0, xmmword [0x782060]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x80f340], xmm0
jmp 0x4a80fb
push 0x80f350
call fcn.005c580d
add esp, 4
cmp dword [0x80f350], 0xffffffff
jne 0x4a815f
rdtsc
mov dword [0x80f348], eax
mov dword [0x80f34c], edx
push 0x80f350
call fcn.005c5887
add esp, 4
jmp 0x4a815f
push 0x80f360
call fcn.005c580d
add esp, 4
cmp dword [0x80f360], 0xffffffff
jne 0x4a8180
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x80f35c], ecx
mov dword [0x80f358], eax
push 0x80f360
call fcn.005c5887
add esp, 4
jmp 0x4a8180
Function at 0x4a84e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x4a8517
mov eax, dword [0x80a580]
cmp eax, 0xffffffff
je 0x4a85a0
mov ebx, 0x100000
test eax, eax
jne 0x4a8517
mov ebx, 0x80000
push 0x10
call fcn.005c5789
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x81156c]
bt ecx, eax
jae 0x4a8592
push edi
call fcn.004bf510
add esp, 4
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x4a8920
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4a85d1
test edi, edi
je 0x4a85c4
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x81956c], 1
jmp 0x4a8542
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x80a580
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4a86cb
mov eax, dword [0x80a580]
jmp 0x4a8509
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x4a8579
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp eax, 0x27a
jg 0x4a8671
cmp dword [ebp - 0x20], 8
je 0x4a8687
cmp dword [ebp - 0x20], 0xe
je 0x4a8687
mov eax, dword [0x80f39c]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4a86dc
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
call fcn.004b6570
add esp, 8
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x4a8639
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x4a86da
sete cl
test ebx, ebx
setne dl
or dl, cl
je 0x4a86da
push eax
push ebx
push dword [0x80f398]
call fcn.004d6ec0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x4a8690
push dword [ebp - 0x1c]
call fcn.005c57c0
jmp 0x4a868d
cmp dword [ebp - 0x20], 0x5af
je 0x4a8687
cmp dword [ebp - 0x20], 0x27b
jne 0x4a85fb
push ebx
call fcn.004d79c0
add esp, 4
test esi, esi
mov eax, edi
je 0x4a8579
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x81156c]
bt edx, ecx
jae 0x4a86bb
push eax
call fcn.004bf630
add esp, 4
push esi
call fcn.005c57c0
add esp, 4
mov eax, edi
jmp 0x4a8579
mov dword [0x80a580], 0
jmp 0x4a8512
ud2
push 0x80f39c
call fcn.005c580d
add esp, 4
cmp dword [0x80f39c], 0xffffffff
jne 0x4a861c
push 0x20
push str.create_thread_last_error
call fcn.004d6ea0
add esp, 8
mov dword [0x80f398], eax
push 0x80f39c
call fcn.005c5887
add esp, 4
jmp 0x4a861c
Function at 0x4a8ac0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x4c], eax
pcmpeqd xmm0, xmm0
mov eax, esp
movdqa xmmword [eax], xmm0
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
mov dword [eax], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4a8b1e
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x4c]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call fcn.00645550
xor esi, esi
xor edi, edi
jmp 0x4a8b08

Function at 0x4a8b30
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0xce
push str....._base_system_sys_info_win.cc
push str.AmountOfFreeDiskSpace
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00552b00
xor esi, esi
dec esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], esi
cmp byte [edi + 0xb], 0
jns 0x4a8ba4
mov edi, dword [edi]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x50]
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4a8bef
mov esi, dword [esp + 4]
test esi, esi
jns 0x4a8bcc
xor edi, edi
dec edi
mov esi, SysReAllocString
jmp 0x4a8bcf
mov edi, dword [esp]
lea ecx, [esp + 0x10]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
mov eax, edi
mov edx, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, esi
jmp 0x4a8bcf

Function at 0x4a95d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4a960b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4a9622
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4a9604
mov dword [esi], ebx
call fcn.0055fb70
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x4a9639
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
add esp, 4
mov dword [esi], 0
jmp 0x4a95f5
int3
Function at 0x4a9640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4a9661
call fcn.0055fb70
mov dword [esi], 0
test ebx, ebx
je 0x4a9690
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x4a96c8
cmp edi, 2
jb 0x4a9689
mov dword [esi], ebx
mov edi, eax
call fcn.0055fb70
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x4a96b1
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [edi]
call fcn.0054ae70
add esp, 4
mov dword [edi], 0
jmp 0x4a96a5
mov dword [ebp - 0x10], eax
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x4a9679

Function at 0x4a96f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4a9711
call fcn.0055fb70
cmp dword [esi], ebx
je 0x4a973a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x4a9772
cmp edi, 2
jb 0x4a9733
mov dword [esi], ebx
mov edi, eax
call fcn.0055fb70
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x4a975b
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [edi]
call fcn.0054ae70
add esp, 4
mov dword [edi], 0
jmp 0x4a974f
mov dword [ebp - 0x10], eax
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x4a9723
Function at 0x4ab0b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.004da800
mov byte [esi + 4], 0
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi], 0x771c90
mov dword [esi + 0xc], eax
movaps xmm0, xmmword [0x78b570]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x4ab11a
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jae 0x4ab124
lea eax, [edi + 1]
cmp eax, 2
jb 0x4ab10e
mov dword [esi + 0xc], edi
call fcn.0055fb70
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0055fb70
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.0054ae70
mov dword [esi + 0xc], 0
jmp 0x4ab0fe

Function at 0x4ac5a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x1c
push str....._base_filesmemory_mapped_file_win.cc
push str.MapImageToMemory
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.00552b00
mov ecx, esi
call fcn.0054f940
test al, al
je 0x4ac6e4
mov ecx, esi
call fcn.004ac9a0
sub esp, 0x18
movq xmm0, qword [0x78b840]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x4ac660
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x4ac6c8
lea eax, [edi + 1]
cmp eax, 2
jb 0x4ac656
mov dword [esi + 0x24], edi
call fcn.0055fb70
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x24]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4ac6e4
sub esp, 0x14
movd xmm0, dword [0x78b850]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4ac6e4
mov edi, eax
mov ecx, esp
mov dword [ecx], fcn.005fb180
mov dword [ecx + 4], eax
call fcn.004dc760
mov eax, dword [eax + 0x50]
test eax, eax
setne bl
je 0x4ac6a8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
lea ecx, [esp + 0x10]
call fcn.00552b70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [esi + 0x24]
call fcn.0054ae70
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x4ac646
xor ebx, ebx
jmp 0x4ac6a8
Function at 0x4ac9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x99
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.00552b00
test ebx, ebx
js 0x4aca70
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.005704d0
test al, al
jne 0x4aca75
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
push 0
push edi
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [edi]
lea ecx, [esp + 0x10]
call fcn.00570560
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x4aca50
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::WriteAtCurrentPos
call fcn.006b4be0
jmp 0x4aca25

Function at 0x4aca90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xaf
push str....._base_files_file_win.cc
push str.GetLength
push edi
call fcn.0055fb40
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.00552b00
mov dword [edi + 4], 0xffffffff
mov dword [edi], esi
call fcn.005704d0
test al, al
jne 0x4acb48
xor eax, eax
dec eax
lea ebx, [esp + 8]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [ebx + 4]
or edi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.00570560
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
push esi
push esi
push dword [esp + 0xc]
push str.File::GetLength
call fcn.006b4be0
jmp 0x4acafa
Function at 0x4acb60
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x30]
push 0xbc
push str....._base_files_file_win.cc
push str.SetLength
push esi
call fcn.0055fb40
add esp, 0x10
xor ebx, ebx
mov ecx, edi
push ebx
push esi
call fcn.00552b00
mov dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call fcn.005704d0
test al, al
jne 0x4accb7
xor eax, eax
dec eax
lea ecx, [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4acc8e
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 4], xmm0
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4acc8e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
je 0x4acc8e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea ecx, [esp + 0x30]
call fcn.00570560
lea ecx, [esp + 0x40]
call fcn.00552b70
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x30]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push str.File::SetLength
call fcn.006b4be0
jmp 0x4acbd1
Function at 0x4ace00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x174
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.0055fb40
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00552b00
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x4ad021
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x4acff6
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x4acf2d
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x4acf75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x4ad007
mov eax, edi
inc eax
cmp eax, 2
jb 0x4acf6c
mov dword [ebx], edi
call fcn.0055fb70
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x4acfc1
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x4acfd5
test cl, 0xa
je 0x4acf9d
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x4acfe9
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004acce0
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x4acfa3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x4acf9d
push dword [ebp + 8]
call fcn.004aea20
add esp, 4
jmp 0x4acfa3
bt ebx, 0x15
jb 0x4ad03e
or edx, 0x20000000
jmp 0x4acebe
call fcn.0055fb70
push dword [ebx]
call fcn.0054ae70
add esp, 4
mov dword [ebx], 0
jmp 0x4acf5d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.00645550
jmp 0x4acfa3
int3
Function at 0x4ad110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x4ad145
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4ad14c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4ad13e
mov dword [esi], ebx
call fcn.0055fb70
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
add esp, 4
mov dword [esi], 0
jmp 0x4ad12f

Function at 0x4ad240
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.004ad250