joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487430
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x171
push str.file_win.cc
push str.DoInitialize
push esi
call fcn.0049a500
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00490060
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x4875fb
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jae 0x4874fa
bt ebx, 0x15
jb 0x487662
or edx, 0x20000000
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, eax
shl edi, 8
and edi, 0xa000000
or edi, esi
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov esi, eax
jns 0x487569
mov esi, dword [eax]
xor ebx, ebx
push ebx
push edi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov esi, dword [esp + 4]
cmp dword [esi], eax
je 0x4875c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x4875aa
call fcn.0049a530
push dword [esi]
call fcn.004844e0
add esp, 4
mov dword [esi], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x4875b9
mov dword [esi], edi
call fcn.0049a530
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jae 0x487615
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00487310
add esp, 4
mov dword [esi + 0x14], eax
lea ecx, [esp + 0x20]
call fcn.004900e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004e8be6
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.005183b0
jmp 0x4875dd
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [esi + 0x14], 0
mov byte [esi + 0x19], al
test cl, 4
jne 0x487639
test cl, 0xa
mov eax, dword [ebp + 8]
je 0x48764e
mov byte [esi + 0x18], 1
jmp 0x48764e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [esi + 0x18]
mov eax, dword [ebp + 8]
bt ecx, 0x15
jae 0x4875dd
push eax
call fcn.00489860
add esp, 4
jmp 0x4875dd
int3

Function at 0x487740
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00487750
Function at 0x487990
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.00487750

Function at 0x4879a0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1e7
push str.file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.0049a500
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00490060
mov al, byte [edi + 0xb]
test al, al
jns 0x487a08
cmp dword [edi + 4], 0x103
jbe 0x487a08
xor ebx, ebx
jmp 0x487a1e
test al, al
jns 0x487a0e
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.004900e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x487a40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x450
mov edi, dword [ebp + 0xc]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x448], eax
pcmpeqd xmm0, xmm0
mov esi, esp
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x240]
push 0x1f3
push str.file_util_win.cc
push 0x5334ec
push ebx
call fcn.0049a500
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00490060
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push ebx
call fcn.004ec220
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x487abf
mov eax, dword [ecx]
mov esi, 0x104
push esi
push eax
push ebx
call fcn.00491810
add esp, 0xc
push ebx
call fcn.004117a0
add esp, 4
lea ebx, [esp + 0x38]
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push ebx
call fcn.004ec220
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x487afb
mov eax, dword [edi]
push esi
push eax
push ebx
call fcn.00491810
add esp, 0xc
push ebx
call fcn.004117a0
add esp, 4
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x487b1c
mov eax, dword [ecx]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x487b26
mov ecx, dword [edi]
sub esp, 0x18
movaps xmm0, xmmword [0x533490]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov bl, 1
test eax, eax
je 0x487b67
mov ecx, esp
call fcn.004900e0
mov ecx, dword [esp + 0x448]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00487310
add esp, 4
mov esi, eax
cmp byte [edi + 0xb], 0
jns 0x487b80
mov edi, dword [edi]
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
jns 0x487b8b
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x487b48
test eax, eax
jne 0x487b48
cmp esi, 0xfffffffc
jne 0x487baf
call fcn.005172f0
mov esi, eax
mov dword [edi], esi
xor ebx, ebx
jmp 0x487b48

Function at 0x487bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x226
push str.file_util_win.cc
push str.PathExists
push ebx
call fcn.0049a500
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00490060
cmp byte [edi + 0xb], 0
jns 0x487c1c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004900e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x487c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x22f
push str.file_util_win.cc
push str.PathHasAccess
push esi
call fcn.0049a500
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00490060
cmp byte [edi + 0xb], 0
jns 0x487cb1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x487d43
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x487d0a
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x487d47
call fcn.0049a530
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x487d25
call fcn.0049a530
push esi
call fcn.004844e0
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004900e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x487d25
xor esi, esi
jmp 0x487d03

Function at 0x487d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x24e
push str.file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0049a500
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00490060
cmp byte [edi + 0xb], 0
jns 0x487dac
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004900e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x487de0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.004ec220
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x487e63
push ebx
call fcn.005043ab
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0049c050
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.0049e3d0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0049c140
mov ecx, ebx
call fcn.0049c100
mov ecx, edi
call fcn.0049c100
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x487e90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.004ec220
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x5334a0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x487f0c
cmp word [ebp - 0x214], 0
je 0x487f0c
push edi
call fcn.005043ab
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0049c050
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e8be6
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.0049c000
push edi
call fcn.00487de0
add esp, 4
mov ecx, esi
test al, al
jne 0x487f41
push 3
push 0x533514
call fcn.0049c050
jmp 0x487f47
push edi
call fcn.0049c020
lea ecx, [ebp - 0x220]
call fcn.0049c100
jmp 0x487ef6
Function at 0x488630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x55acd8], 0
je 0x488670
xor ebx, ebx
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2d4
push str.file_util_win.cc
push str.GetSecureSystemTemp
push ebx
call fcn.0049a500
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00490060
cmp dword [ebp + 8], 0
je 0x488856
xor edi, edi
dec edi
lea esi, [esp + 4]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, esi
call fcn.0049c000
push esi
push 0x65
call fcn.0048a720
add esp, 8
test al, al
je 0x48877e
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push 0x533572
push ebx
call fcn.0049e270
mov ecx, esi
push ebx
call fcn.0049c140
mov ecx, ebx
call fcn.0049c100
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea eax, [esp + 0x40]
push 0x226
push str.file_util_win.cc
push str.PathExists
push eax
call fcn.0049a500
add esp, 0x10
mov ecx, ebx
push 0
lea eax, [esp + 0x44]
push eax
call fcn.00490060
cmp byte [esi + 0xb], 0
jns 0x48874b
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.004900e0
cmp esi, 0xffffffff
je 0x48877e
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00487c50
add esp, 4
test al, al
jne 0x48883e
lea esi, [esp + 4]
mov ecx, esi
call fcn.0049c100
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov ecx, esi
call fcn.0049c000
push esi
push 0x67
call fcn.0048a720
add esp, 8
test al, al
je 0x488825
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x226
push str.file_util_win.cc
push str.PathExists
push edi
call fcn.0049a500
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.00490060
cmp byte [esp + 0xf], 0
lea eax, [esp + 4]
jns 0x4887f6
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.004900e0
cmp ebx, 0xffffffff
je 0x488825
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00487c50
add esp, 4
test al, al
jne 0x48883e
lea ecx, [esp + 4]
call fcn.0049c100
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.004900e0
jmp 0x488658
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.0049c120
mov ecx, esi
call fcn.0049c100
mov bl, 1
jmp 0x488830
int3
Function at 0x488860
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0xa8], eax
cmp dword [ebp + 8], 0
je 0x488aa9
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x70]
push 0x2ee
push str.file_util_win.cc
push str.GetOrCreateSecureSystemTemp
push esi
call fcn.0049a500
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00490060
xor esi, esi
dec esi
lea edi, [esp + 0x24]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov ecx, edi
call fcn.0049c000
push edi
push 0x65
call fcn.0048a720
add esp, 8
test al, al
je 0x488990
lea ebx, [esp + 0x18]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
lea ecx, [esp + 0x24]
push 0xa
push str.SystemTemp
push ebx
call fcn.0049d200
lea edi, [esp + 0x70]
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea eax, [esp + 0x60]
push 0x226
push str.file_util_win.cc
push str.PathExists
push eax
call fcn.0049a500
add esp, 0x10
mov ecx, edi
push 0
lea eax, [esp + 0x64]
push eax
call fcn.00490060
cmp byte [ebx + 0xb], 0
jns 0x488953
mov ebx, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, edi
call fcn.004900e0
cmp ebx, esi
je 0x488987
lea edi, [esp + 0x18]
mov ecx, edi
mov edx, 2
push 0x40000000
call fcn.00487c50
add esp, 4
test al, al
jne 0x488a60
lea ecx, [esp + 0x18]
call fcn.0049c100
lea edi, [esp + 0x18]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov ecx, edi
call fcn.0049c000
push edi
push 3
call fcn.0048a720
add esp, 8
test al, al
je 0x488a74
lea ebx, [esp + 0xc]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
lea ecx, [esp + 0x18]
push 4
push str.Temp
push ebx
call fcn.0049d200
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x70]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea eax, [esp + 0x60]
push 0x226
push str.file_util_win.cc
push str.PathExists
push eax
call fcn.0049a500
add esp, 0x10
mov ecx, edi
push 0
lea eax, [esp + 0x64]
push eax
call fcn.00490060
cmp byte [ebx + 0xb], 0
jns 0x488a1d
mov ebx, dword [esp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, edi
call fcn.004900e0
cmp ebx, esi
je 0x488a4b
lea eax, [esp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.0049c120
mov bl, 1
lea ecx, [esp + 0xc]
call fcn.0049c100
jmp 0x488a76
lea eax, [esp + 0xc]
push eax
call fcn.0048b230
add esp, 4
test al, al
jne 0x488a31
xor ebx, ebx
jmp 0x488a40
mov ecx, dword [ebp + 8]
push edi
call fcn.0049c120
mov ecx, edi
call fcn.0049c100
mov bl, 1
jmp 0x488a7f
xor ebx, ebx
lea ecx, [esp + 0x18]
call fcn.0049c100
lea ecx, [esp + 0x24]
call fcn.0049c100
lea ecx, [esp + 0x30]
call fcn.004900e0
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x4893c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x48e
push str.file_util_win.cc
push 0x53363d
push ebx
call fcn.0049a500
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push ebx
call fcn.00490060
cmp byte [edi + 0xb], 0
jns 0x48941d
mov edi, dword [edi]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x52d080]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x8000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x489464
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x4894aa
call fcn.0049a530
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
dec esi
mov edx, dword [ebp + 0x10]
test edx, edx
js 0x489476
lea eax, [ebx + 1]
cmp eax, 2
jae 0x4894ae
lea eax, [ebx + 1]
cmp eax, 2
jb 0x48948c
call fcn.0049a530
push ebx
call fcn.004844e0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.004900e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e8be6
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x48945d
mov eax, dword [ebp + 0xc]
mov dword [esp], 0xffffffff
push 0
lea ecx, [esp + 4]
push ecx
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4894d5
mov esi, dword [esp]
test esi, esi
jns 0x489476
jmp 0x4894da
xor esi, esi
dec esi
jmp 0x489476
int3
Function at 0x4894e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x4a1
push str.file_util_win.cc
push 0x533646
push ebx
call fcn.0049a500
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push ebx
call fcn.00490060
cmp byte [edi + 0xb], 0
jns 0x48953d
mov edi, dword [edi]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x52a960]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x489588
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x4895fa
call fcn.0049a530
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
dec esi
cmp dword [ebp + 0x10], 0
js 0x4895c6
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4895c6
mov eax, dword [ebp + 0xc]
xor edi, edi
dec edi
mov dword [esp], edi
push 0
lea ecx, [esp + 4]
push ecx
mov esi, dword [ebp + 0x10]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, esi
cmove edi, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edi
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4895dc
call fcn.0049a530
push ebx
call fcn.004844e0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.004900e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e8be6
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x489581

Function at 0x489600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x4da
push str.file_util_win.cc
push 0x533650
push ebx
call fcn.0049a500
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00490060
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.004ec220
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x4896c6
push ebx
call fcn.005043ab
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.0049c050
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.0049e3d0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0049c140
mov ecx, ebx
call fcn.0049c100
mov ecx, edi
call fcn.0049c100
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.004900e0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x489710
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x9b
push str.file_util_win.cc
push str.DoCopyFile
push edi
call fcn.0049a500
add esp, 0x10
mov ecx, ebx
push 0
mov ebx, edi
push edi
mov edi, esi
call fcn.00490060
mov ecx, esi
call fcn.0049e4e0
test al, al
jne 0x489794
mov esi, dword [esp]
mov ecx, esi
call fcn.0049e4e0
test al, al
jne 0x489794
cmp byte [edi + 0xb], 0
jns 0x4897c1
cmp dword [edi + 4], 0x103
jbe 0x4897c1
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004900e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea ecx, [esp + 4]
call fcn.004b8be0
jmp 0x489796
cmp byte [esi + 0xb], 0
jns 0x4897d0
cmp dword [esi + 4], 0x103
ja 0x489794
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi], eax
push 0xa8
push str.file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.0049a500
add esp, 0x10
mov ecx, esi
mov esi, dword [esp]
push 0x55ace0
push ebx
call fcn.004b8ab0
cmp byte [esi + 0xb], 0
jns 0x48980f
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x48981b
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4897b4
mov edi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
je 0x4897b6
mov ecx, eax
and ecx, 1
je 0x4897b6
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x4897b6