joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2810
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ea6b0
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x4b2869
push eax
call fcn.005cff1c
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push ecx
lea ecx, [ebp - 0x370]
call fcn.004a91b0
mov dword [ebp - method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [ebp - 0x1c], 0x794d88
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push esi
push ebx
lea ecx, [ebp - 0x370]
mov dword [ebp - 4], 0
call fcn.004a9310
test al, al
je 0x4b2a0d
lea eax, [ebp - 0x378]
mov dword [ebp - 0x378], 0
push eax
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x374], eax
cmp eax, 0xffffffff
jne 0x4b28ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b28e8
xor eax, eax
jmp 0x4b28ee
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x36c]
mov dword [ebp - 0x378], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x374], eax
cmp eax, 0xffffffff
jne 0x4b2933
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b292d
xor eax, eax
mov dword [ebp - 0x374], eax
jmp 0x4b2933
mov eax, dword [ebp - 0x374]
add eax, 4
push eax
call fcn.005cff37
add esp, 4
mov dword [ebp - 0x378], eax
test eax, eax
jne 0x4b296c
mov dword [edi + 0x24], 2
lea edi, [esi + 0xc]
cmp byte [esi + 0x11c], al
jne 0x4b295e
mov edi, dword [esi + 8]
mov ecx, ebx
call fcn.0049c7f0
push 0x794bf4
jmp 0x4b29b1
push dword [ebp - 0x374]
lea ecx, [ebp - 0x1c]
push eax
push ebx
call fcn.004b3030
test al, al
jne 0x4b29d5
mov ecx, dword [ebp - 0x378]
push ecx
mov dword [edi + 0x24], 3
call fcn.005cff1c
add esp, 4
cmp byte [esi + 0x11c], 0
lea edi, [esi + 0xc]
jne 0x4b29a5
mov edi, dword [esi + 8]
mov ecx, ebx
call fcn.0049c7f0
push 0x7945e4
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x791e68
push esi
call fcn.0049a160
add esp, 0xc
jmp 0x4b2a14
lea ecx, [ebp - 0x370]
call fcn.004a9530
mov ecx, dword [ebp - 0x378]
xor edx, edx
mov eax, dword [ebp - 0x374]
push ecx
push eax
push ecx
mov dword [ecx + eax], edx
mov ecx, edi
push ebx
call fcn.004b2b30
test al, al
jne 0x4b2a09
mov dword [edi + 0x24], 4
jmp 0x4b2996
mov bl, 1
jmp 0x4b2a16
mov dword [edi + 0x24], 1
xor bl, bl
lea ecx, [ebp - 0x370]
mov dword [ebp - method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [ebp - 0x1c], vtable.t_byteStreamRead.0
call fcn.004a9250
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b2e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov esi, ecx
call ebx
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b2f0c
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x4b2ebb
mov edi, dword [esi - 0x340]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
call fcn.0049c7f0
mov ecx, eax
call fcn.0049c950
push 0
call ebx
mov ecx, dword [ebp + 8]
call fcn.0049c7f0
push 0x794638
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
lea ecx, [edi + 4]
push ecx
push 0x791e68
push esi
call fcn.0049a160
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 4]
cmp ebx, edi
je 0x4b2fb4
cmp byte [esi - 0x22c], 0
lea eax, [esi - 0x33c]
jne 0x4b2f2c
mov eax, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
call fcn.0049c7f0
push 0x794d00
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
push 0x794d20
push 0x791e68
push esi
call fcn.0049a160
push edi
push 0x791e60
push esi
call fcn.0049a160
push 0x794d10
push 0x791e68
push esi
call fcn.0049a160
push ebx
push 0x791e60
push esi
call fcn.0049a160
push 0x794d2c
push 0x791e68
push esi
call fcn.0049a160
mov eax, dword [ebp + 0x10]
add esp, 0x48
add eax, 4
push eax
push 0x791e68
push esi
call fcn.0049a160
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b3030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4b3131
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push edi
push dword [ebp + 0xc]
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b30a9
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x4b3083
mov edi, dword [esi - 0x340]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, ebx
call fcn.0049c7f0
mov ecx, eax
call fcn.0049c950
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 0x10], 0x794608
jmp 0x4b30cb
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4b30fd
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], cl
jne 0x4b30c4
mov edi, dword [esi - 0x340]
mov dword [ebp + 0x10], 0x794648
mov ecx, ebx
call fcn.0049c7f0
push dword [ebp + 0x10]
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
lea ecx, [edi + 4]
push ecx
push 0x791e68
push esi
call fcn.0049a160
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp ecx, edi
je 0x4b3131
cmp byte [esi - 0x22c], 0
lea eax, [esi - 0x33c]
jne 0x4b3116
mov eax, dword [esi - 0x340]
add eax, 4
push eax
push ecx
push edi
push str.penc_rN
push ebx
call fcn.0049c8a0
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
add dword [esi + 8], edi
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4b4d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ea93e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
sub esp, 0x28
mov dword [ebp - 4], 1
mov esi, esp
mov dword [ebp - 0x2c], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x4b4dc7
mov eax, dword [ecx]
push esi
mov eax, dword [eax]
call eax
mov dword [esi + 0x24], eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004b49d0
cmp dword [ebp - 0x34], 0
mov ecx, 0x792f60
mov eax, 0x792f68
mov dword [ebp - 0x30], 1
cmovne eax, ecx
add esp, 0x20
mov edx, esp
xor ecx, ecx
mov dword [edx], eax
cmp word [eax], cx
je 0x4b4e02
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x4b4df8
lea eax, [ebp - 0x28]
mov dword [edx + 4], ecx
push eax
mov ecx, edi
call fcn.004dbe60
mov esi, eax
cmp edi, esi
je 0x4b4e40
mov ecx, edi
call fcn.004743f0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x28]
call fcn.004743f0
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b4e52
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4b4e65
mov ecx, edi
call fcn.004da710
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x4b4e7d
mov esi, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4ba180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eaef0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7ce4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005be217
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.005bce33
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x4bc99c
mov esi, ecx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4bc755
sub esi, edx
sar esi, 1
je 0x4bc99c
push 0x7850a0
push ecx
lea eax, [ebp - 0x164]
mov dword [ebp - 0x164], 0
push eax
call fcn.005c4e8d
add esp, 0xc
test eax, eax
jne 0x4bc99c
push 0x40
push eax
lea eax, [ebp - 0x58]
mov bl, 1
push eax
call fcn.005c0be0
push dword [ebp - 0x164]
lea eax, [ebp - 0x58]
push 1
push 0x40
push eax
call fcn.005cb2c3
mov eax, 0x5a4d
add esp, 0x1c
cmp ax, word [ebp - 0x58]
jne 0x4bc918
mov eax, dword [ebp - 0x1c]
push 0
add eax, 4
push eax
push dword [ebp - 0x164]
call fcn.005c5363
push dword [ebp - 0x164]
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0
push 1
xorps xmm0, xmm0
push 0x14
push eax
movups xmmword [ebp - 0x18], xmm0
call fcn.005cb2c3
add esp, 0x1c
cmp dword [edi + 0x120], 0
je 0x4bc80f
mov dword [edi + 0x120], 0
lea esi, [edi + 8]
mov dword [edi + 4], 0
push 1
mov ecx, esi
call fcn.0049a590
cmp byte [esi + 0x114], 0
lea eax, [esi + 4]
jne 0x4bc830
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 4], cx
push dword [ebp - 0x14]
push 0x791e58
push edi
call fcn.0049a160
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x164]
call fcn.005c5363
mov ax, word [ebp - 0x18]
mov ecx, 0x14c
add esp, 0x18
cmp cx, ax
jne 0x4bc89c
push 0xf8
lea eax, [ebp - 0x150]
push 0
push eax
call fcn.005c0be0
push dword [ebp - 0x164]
lea eax, [ebp - 0x150]
push 1
push 0xf8
push eax
call fcn.005cb2c3
push dword [ebp - 0x100]
jmp 0x4bc96d
mov ecx, 0x200
cmp cx, ax
je 0x4bc93b
mov ecx, 0x8664
cmp cx, ax
je 0x4bc93b
cmp dword [edi + 0x120], 0
je 0x4bc8cb
mov dword [edi + 0x120], 0
push 1
mov ecx, esi
mov dword [edi + 4], 0
call fcn.0049a590
cmp byte [esi + 0x114], 0
je 0x4bc910
add esi, 4
xor eax, eax
xor bl, bl
mov word [esi + 4], ax
push dword [ebp - 0x164]
call fcn.005c5010
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
mov esi, dword [esi]
xor eax, eax
mov word [esi + 4], ax
push dword [ebp - 0x164]
xor bl, bl
call fcn.005c5010
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push 0x108
lea eax, [ebp - 0x160]
push 0
push eax
call fcn.005c0be0
push dword [ebp - 0x164]
lea eax, [ebp - 0x160]
push 1
push 0x108
push eax
call fcn.005cb2c3
push dword [ebp - 0x110]
push 0x791e58
push edi
call fcn.0049a160
add esp, 0x28
push dword [ebp - 0x164]
call fcn.005c5010
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4bd190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x7d7ff0], 0
push ebx
je 0x4bd32f
push dword [0x7d7ff8]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebx
test eax, eax
je 0x4bd1ed
cmp dword [eax], 0xd
jbe 0x4bd1ed
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4bd1ed
push 0
push 0x7d9668
push 0x7d96a0
push 0
push eax
call fcn.005c1512
add esp, 0x14
test eax, eax
je 0x4bd1ed
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
test eax, eax
jne 0x4bd3e3
cmp dword [0x7d7ff0], 0
je 0x4bd32f
push esi
push edi
push 0x802b24
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x7d7ff0], 0
je 0x4bd257
push dword [0x7d7ff8]
call ebx
test eax, eax
je 0x4bd257
cmp dword [eax], 0xd
jbe 0x4bd257
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4bd257
push 0
push 0x7d9668
push 0x7d96a0
push 0
push eax
call fcn.005c1512
add esp, 0x14
test eax, eax
je 0x4bd257
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov esi, eax
test esi, esi
jne 0x4bd31b
push 0x2014
call fcn.005be217
mov esi, eax
push 0x2000
push 0
push esi
mov dword [ebp - 4], esi
mov dword [esi + 0x2004], 0
mov dword [esi + 0x2008], 0
mov dword [esi + 0x200c], 0
mov byte [esi + 0x2000], 0
call fcn.005c0be0
add esp, 0x10
mov dword [esi + 0x2010], 0
cmp dword [0x7d7ff0], 0
je 0x4bd31b
push dword [0x7d7ff8]
call ebx
test eax, eax
je 0x4bd31b
cmp dword [eax], 0xd
jbe 0x4bd31b
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x34]
test ecx, ecx
jne 0x4bd315
push 8
call fcn.005be217
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
mov dword [edi], vtable.t_visualDataItemPtr_class_t_perfManager_.0
mov dword [edi + 4], esi
cmp dword [0x7d7ff0], 0
je 0x4bd31b
push dword [0x7d7ff8]
call ebx
test eax, eax
je 0x4bd31b
cmp dword [eax], 0xd
jbe 0x4bd31b
mov eax, dword [eax + 8]
push 0x802b24
mov dword [eax + 0x34], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
push 0x802b24
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x802bd4]
test eax, eax
jne 0x4bd3e3
push 0x802b24
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x8037ac]
cmp eax, dword [ecx + 0x20]
jle 0x4bd3c9
push 0x8037ac
call fcn.005be60a
add esp, 4
cmp dword [0x8037ac], 0xffffffff
jne 0x4bd3c9
push 0x2000
push 0
push 0x8037b0
mov dword [0x8057b4], 0
mov dword [0x8057b8], 0
mov dword [0x8057bc], 0
mov byte [0x8057b0], 0
call fcn.005c0be0
push 0x6fe6f0
mov dword [0x8057c0], 0
call fcn.005be4c2
push 0x8037ac
call fcn.005be5c0
add esp, 0x14
push 0x802b24
mov dword [0x802bd4], 0x8037b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x802bd4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd760
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x7d7ff0], 0
push ebx
je 0x4bd8ca
push dword [0x7d7ff8]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebx
test eax, eax
je 0x4bd7bd
cmp dword [eax], 0x17
jbe 0x4bd7bd
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x4bd7bd
push 0
push 0x7d96c0
push 0x7d96a0
push 0
push eax
call fcn.005c1512
add esp, 0x14
test eax, eax
je 0x4bd7bd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
test eax, eax
jne 0x4bd98c
cmp dword [0x7d7ff0], 0
je 0x4bd8ca
push esi
push edi
push 0x802b24
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x7d7ff0], 0
je 0x4bd827
push dword [0x7d7ff8]
call ebx
test eax, eax
je 0x4bd827
cmp dword [eax], 0x17
jbe 0x4bd827
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x4bd827
push 0
push 0x7d96c0
push 0x7d96a0
push 0
push eax
call fcn.005c1512
add esp, 0x14
test eax, eax
je 0x4bd827
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x4bd8b6
push 0x202c
call fcn.005be217
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.004bd490
cmp dword [0x7d7ff0], 0
mov edi, eax
je 0x4bd8b6
push dword [0x7d7ff8]
call ebx
test eax, eax
je 0x4bd8b6
cmp dword [eax], 0x17
jbe 0x4bd8b6
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
jne 0x4bd8b0
push 8
call fcn.005be217
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], vtable.t_visualDataItemPtr_class_t_perfCationManager_.0
mov dword [esi + 4], edi
cmp dword [0x7d7ff0], 0
je 0x4bd8b6
push dword [0x7d7ff8]
call ebx
test eax, eax
je 0x4bd8b6
cmp dword [eax], 0x17
jbe 0x4bd8b6
mov eax, dword [eax + 8]
push 0x802b24
mov dword [eax + 0x5c], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
push 0x802b24
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x802bd8]
test eax, eax
jne 0x4bd98c
push 0x802b24
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x8077f4]
cmp eax, dword [ecx + 0x20]
jle 0x4bd972
push 0x8077f4
call fcn.005be60a
add esp, 4
cmp dword [0x8077f4], 0xffffffff
jne 0x4bd972
push 0x2000
push 0
push 0x8057c8
mov dword [0x8077cc], 0
mov dword [0x8077d0], 0
mov dword [0x8077d4], 0
mov byte [0x8077c8], 0
call fcn.005c0be0
add esp, 0xc
mov dword [0x8077d8], 0
push 0x8077dc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x6fe720
call fcn.005be4c2
push 0x8077f4
call fcn.005be5c0
add esp, 8
push 0x802b24
mov dword [0x802bd8], 0x8057c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x802bd8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdb40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eb21c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7ce4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [ebp + 8]
lea edx, [esi + 0x20]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], fcn.005cff37
mov dword [esi + 0x18], fcn.005cfea2
mov dword [esi + 0x1c], fcn.005cff1c
mov dword [edx + 4], fcn.005cff37
mov dword [edx + 8], fcn.005cfea2
mov dword [edx + 0xc], fcn.005cff1c
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0x1fff8
mov dword [edx], vtable.common::t_heap.0
mov dword [esi + 0x3c], fcn.005cff37
mov dword [esi + 0x40], fcn.005cfea2
mov dword [esi + 0x44], fcn.005cff1c
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x8000
mov dword [esi + 0x38], vtable.common::t_heap.0
mov dword [esi + 0x50], 0
mov byte [esi + 0x54], al
mov dword [ebp - 4], 0
lea eax, [esi + 0x58]
mov dword [esi], vtable.t_hookConfigFile.0
mov dword [ebp + 8], eax
mov byte [eax + 4], 0
mov dword [eax + 8], str.setting
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], fcn.005cff37
mov dword [eax + 0x20], fcn.005cfea2
mov dword [eax + 0x24], fcn.005cff1c
mov dword [eax + 0x28], edx
mov dword [eax], vtable.t_hookConfigFile::t_setting.0
mov byte [eax + 0x30], 0
mov dword [eax + 0x34], str.cfwcnt
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x2c], vtable.n_config::t_int.0
mov byte [eax + 0x44], 0
mov dword [eax + 0x48], str.gmfnwcnt
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x40], vtable.n_config::t_int.0
mov byte [eax + 0x58], 0
mov dword [eax + 0x5c], 0x794980
mov dword [eax + 0x60], 0x78802c
mov dword [eax + 0x64], 0x78802c
mov dword [eax + 0x54], vtable.n_config::t_str.0
mov dword [eax + 0x68], 0
lea ecx, [esi + 0xc4]
mov dword [ebp + 8], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x794ff4
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x84]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.005cff37
mov dword [ecx + 0x24], fcn.005cfea2
mov dword [ecx + 0x28], fcn.005cff1c
mov dword [ecx], vtable.n_config::t_arraySection_class_t_hookConfigFile::t_item_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
lea ecx, [esi + 0xf8]
mov dword [ebp + 8], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x794fe8
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x98]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.005cff37
mov dword [ecx + 0x24], fcn.005cfea2
mov dword [ecx + 0x28], fcn.005cff1c
mov dword [ecx], vtable.n_config::t_arraySection_class_t_hookConfigFile::t_item_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.004bde30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4be7f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eb2a0
mov eax, dword fs:[0]
push eax
sub esp, 0x134
push ebx
push esi
push edi
mov eax, dword [0x7ce4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
movzx eax, byte [edi + 0x164]
lea ecx, [ebp - 0x140]
mov ebx, dword [ebp + 8]
push eax
call fcn.004bdb40
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp dword [esi + 4], 0
je 0x4be934
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4be856
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4be934
shr eax, 4
not al
test al, 1
je 0x4be934
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4be885
mov eax, dword [esi + 8]
add eax, 4
lea ecx, [ebp - 0x140]
push eax
call fcn.004b1630
test al, al
jne 0x4be8a2
mov esi, 0x795040
jmp 0x4be939
mov ecx, edi
mov dword [edi + 0x1c], 0
call fcn.004beeb0
lea ecx, [edi + 0x20]
mov dword [edi + 0x3c], 0
call fcn.004beeb0
push 0
push edi
lea ecx, [ebp - 0x140]
call fcn.004bdf40
push 1
push edi
lea ecx, [ebp - 0x140]
call fcn.004bdf40
mov eax, dword [ebp - 0x88]
mov ebx, 0x786008
test eax, eax
cmovne ebx, eax
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4be8f0
sub ecx, edx
sar ecx, 1
mov dword [edi + 0x44], ecx
lea esi, [ecx + 1]
push esi
lea ecx, [edi + 0x48]
call fcn.0049a590
cmp byte [edi + 0x15c], 0
je 0x4be91c
add edi, 0x4c
jmp 0x4be91f
mov edi, dword [edi + 0x48]
lea eax, [esi + esi]
push eax
lea eax, [edi + 4]
push ebx
push eax
call fcn.005c0660
add esp, 0xc
mov bl, 1
jmp 0x4be951
mov esi, 0x791f28
mov ecx, ebx
call fcn.0049c7f0
push esi
push 0x791e68
push eax
call fcn.0049a160
add esp, 0xc
xor bl, bl
lea ecx, [ebp - 0x140]
call fcn.004be980
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8