joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov ebx, esp
push 0x5f
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45d787
test edi, edi
js 0x45d7c2
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x18]
push 0
push ecx
push edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45d747
mov ebx, dword [esp + 0x18]
test ebx, ebx
jns 0x45d757
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
mov ecx, esp
call fcn.0048b5e0
test byte [0x598b10], 0x19
jne 0x45d7d0
lea ecx, [esp + 0x20]
call fcn.004a1a80
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
lea edx, [esp + 0x1c]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
test edi, edi
jns 0x45d70b
mov ebx, 0xffffffff
test byte [0x598b10], 0x19
je 0x45d767
mov dword [esp + 4], 0
mov dword [esp], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x18]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45d767
Function at 0x45d820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov edi, esp
push 0x7f
push str....._base_files_file_win.cc
push str.Write
push edi
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45d919
mov ecx, edi
mov edi, 0xffffffff
test ebx, ebx
js 0x45d8f0
mov eax, dword [ebp + 0x14]
test eax, eax
js 0x45d8f0
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0
pxor xmm0, xmm0
movdqa xmmword [esp], xmm0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0xffffffff
lea edx, [esp + 0x14]
push ecx
push edx
push eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
cmp eax, 1
sbb edi, edi
or edi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.0048b5e0
test byte [0x598b10], 0x19
jne 0x45d951
lea ecx, [esp + 0x20]
call fcn.004a1a80
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00528e13
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
lea edx, [esp + 0x1c]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
jmp 0x45d883
mov dword [esp + 4], 0
mov dword [esp], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x18]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45d8f9
Function at 0x45d9a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov ebx, esp
push 0x97
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45da70
test edi, edi
js 0x45daab
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x18]
push 0
push ecx
push edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0x18]
mov ecx, esp
call fcn.0048b5e0
test byte [0x598b10], 0x19
jne 0x45dab9
lea ecx, [esp + 0x20]
call fcn.004a1a80
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00528e13
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
lea edx, [esp + 0x1c]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
test edi, edi
jns 0x45da0a
mov esi, 0xffffffff
test byte [0x598b10], 0x19
je 0x45da50
mov dword [esp + 4], 0
mov dword [esp], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x18]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45da50
Function at 0x45db10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea edi, [esp + 0x10]
push 0xac
push str....._base_files_file_win.cc
push str.GetLength
push edi
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45dbeb
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
lea eax, [esp + 0x28]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, eax
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
call fcn.0048b5e0
test byte [0x598b10], 0x19
jne 0x45dc23
xor ebx, ebx
cmp edi, 1
sbb ebx, ebx
or esi, ebx
or ebx, dword [esp + 0xc]
lea ecx, [esp + 0x30]
call fcn.004a1a80
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00528e13
mov eax, esi
mov edx, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
sub esp, 8
movq xmm0, qword [esp + 0x30]
movq qword [esp], xmm0
lea edx, [esp + 0x2c]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
jmp 0x45db71
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x28]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45dbbe
Function at 0x45e8e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov edi, esp
push 0x1ff
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45e97e
cmp byte [esi + 0xb], 0
jns 0x45e948
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
test byte [0x598b10], 0x19
jne 0x45e9b9
cmp esi, 0xffffffff
setne bl
lea ecx, [esp + 0x20]
call fcn.004a1a80
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
lea edx, [esp + 0x1c]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
cmp byte [esi + 0xb], 0
js 0x45e946
jmp 0x45e948
mov dword [esp + 4], 0
mov dword [esp], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x18]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45e95a

Function at 0x45ea10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.0052c210
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x45eb0c
push ebx
call fcn.00542c14
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00474ed0
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x224], 0xffffffff
mov dword [ebp - 0x220], 0xffffffff
movzx eax, byte [ebp - 0x229]
test al, al
jns 0x45eaa7
mov edi, dword [ebp - 0x234]
mov eax, dword [ebp - 0x230]
lea ebx, [ebp - 0x228]
mov ecx, ebx
push eax
push edi
call fcn.00474ed0
mov ecx, ebx
call fcn.00476540
mov edi, dword [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x45ead0
push dword [edi]
call fcn.00528424
add esp, 4
mov eax, dword [ebp - 0x220]
mov dword [edi + 8], eax
movsd xmm0, qword [ebp - 0x228]
movsd qword [edi], xmm0
mov byte [ebp - 0x21d], 0
mov word [ebp - 0x228], 0
cmp byte [ebp - 0x229], 0
jns 0x45eb0c
push dword [ebp - 0x234]
call fcn.00528424
add esp, 4
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45eb30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.0052c210
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x581860]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x45eb98
cmp word [ebp - 0x214], 0
je 0x45eb98
push edi
call fcn.00542c14
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00474ed0
jmp 0x45ec05
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x220]
push eax
call fcn.0045ea10
add esp, 4
test al, al
je 0x45ebe0
mov eax, dword [ebp - 0x218]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x220]
movsd qword [esi], xmm0
jmp 0x45ec05
mov ecx, esi
push 3
push 0x5818e0
call fcn.00474ed0
cmp byte [ebp - 0x215], 0
jns 0x45ec05
push dword [ebp - 0x220]
call fcn.00528424
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00528e13
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x45f2f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
lea ebx, [esp + 0x28]
push 0x3f9
push str....._base_files_file_util_win.cc
push 0x581923
push ebx
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x230]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45f46a
lea eax, [esp + 0x2a]
push 0x206
push 0xff
push eax
call fcn.0052c210
add esp, 0xc
mov word [esp + 0x28], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x45f434
push ebx
call fcn.00542c14
add esp, 4
lea edi, [esp + 0xc]
mov ecx, edi
push eax
push ebx
call fcn.00474ed0
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
movzx eax, byte [esp + 0x17]
test al, al
jns 0x45f3dd
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
lea ebx, [esp + 0x18]
mov ecx, ebx
push eax
push edi
call fcn.00474ed0
mov ecx, ebx
call fcn.00476540
mov edi, dword [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x45f404
push dword [edi]
call fcn.00528424
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [edi + 8], eax
movq xmm0, qword [esp + 0x18]
movq qword [edi], xmm0
mov byte [esp + 0x23], 0
mov word [esp + 0x18], 0
cmp byte [esp + 0x17], 0
jns 0x45f434
push dword [esp + 0xc]
call fcn.00528424
add esp, 4
test byte [0x598b10], 0x19
jne 0x45f4a2
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x230]
call fcn.004a1a80
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
lea edx, [esp + 0x14]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
jmp 0x45f365
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x40]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45f43d
Function at 0x45f4f0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, dword [0x597010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov edi, esp
push 0x409
push str....._base_files_file_util_win.cc
push 0x581938
push edi
call fcn.004733a0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push 0
call fcn.004a1610
test byte [0x598b10], 0x19
jne 0x45f58d
cmp byte [esi + 0xb], 0
jns 0x45f558
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
test byte [0x598b10], 0x19
jne 0x45f5c8
test esi, esi
setne bl
lea ecx, [esp + 0x20]
call fcn.004a1a80
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00528e13
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
lea edx, [esp + 0x1c]
mov ecx, str.ScopedBlockingCall
call fcn.00462090
add esp, 8
cmp byte [esi + 0xb], 0
js 0x45f556
jmp 0x45f558
mov dword [esp + 4], 0
mov dword [esp], 0
sub esp, 0x18
movq xmm0, qword [esp + 0x18]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x57f540
mov dword [esp + 8], 0x57d4a9
mov dword [esp + 4], 0x598b10
mov dword [esp], 0x45
call fcn.00433670
add esp, 0x18
jmp 0x45f56a
Function at 0x45fa00
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2b4
mov ebx, edx
mov edi, ecx
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.0052c210
add esp, 0xc
mov ecx, esi
push 0
push 0
mov dword [ebp - 0x2c0], ebx
push ebx
push 3
push 0
push edi
call fcn.00493c00
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x2ac], 0xffffffff
mov dword [ebp - 0x2a8], 0xffffffff
lea eax, [ebp - 0x2b0]
mov ecx, esi
push eax
call fcn.00493ed0
movzx eax, byte [ebp - 0x2a5]
mov ecx, eax
test al, al
jns 0x45fa89
mov ecx, dword [ebp - 0x2ac]
test ecx, ecx
je 0x45fbf6
xor edi, edi
jmp 0x45faaa
mov edi, esi
test ecx, ecx
je 0x45fbf8
cmp byte [ebp - 0x2a4], 0
je 0x45fb50
mov ebx, dword [ebp - 0x2a0]
test bl, 1
je 0x45faf2
cmp byte [ebp + 8], 0
jne 0x45fad5
xor esi, esi
mov ecx, ebx
and ecx, 0x10
jne 0x45fb90
mov ecx, ebx
and ecx, 0xfffffffe
lea edx, [ebp - 0x2b0]
test al, al
jns 0x45faea
mov edx, dword [ebp - 0x2b0]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
je 0x45fb55
xor esi, esi
cmp byte [ebp + 8], 0
je 0x45fb90
lea ecx, [ebp - 0x2b0]
mov edx, dword [ebp - 0x2c0]
push 1
call fcn.0045fa00
add esp, 4
mov esi, eax
test eax, eax
jne 0x45fb90
cmp byte [ebp - 0x2a5], 0
lea eax, [ebp - 0x2b0]
jns 0x45fb34
mov eax, dword [ebp - 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x45fb90
jmp 0x45fb77
call fcn.0047b030
cmp byte [ebp - 0x2a5], 0
lea eax, [ebp - 0x2b0]
jns 0x45fb6a
mov eax, dword [ebp - 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x45fb90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x45fb90
mov esi, eax
nop dword [eax + eax]
test edi, edi
cmovne esi, edi
lea ecx, [ebp - 0x2a4]
lea eax, [ebp - 0x2bc]
push eax
call fcn.00493ed0
cmp byte [ebp - 0x2a5], 0
jns 0x45fbbe
push dword [ebp - 0x2b0]
call fcn.00528424
add esp, 4
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2a8], eax
movsd xmm0, qword [ebp - 0x2bc]
movsd qword [ebp - 0x2b0], xmm0
movzx eax, byte [ebp - 0x2a5]
mov ecx, eax
test al, al
jns 0x45faa0
mov ecx, dword [ebp - 0x2ac]
jmp 0x45faa0
xor esi, esi
test al, al
jns 0x45fc0a
push dword [ebp - 0x2b0]
call fcn.00528424
add esp, 4
lea ecx, [ebp - 0x2a4]
call fcn.00493e50
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
mov eax, esi
add esp, 0x2b4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4622f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.00529740
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x599b44]
cmp eax, 0xffffffff
je 0x46244d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x46244d
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.0052bc90
add esp, 0xc
mov ecx, dword [0x599b44]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebx, ebx
je 0x462369
push ebx
call fcn.0052845c
add esp, 4
mov eax, dword [0x59d86c]
mov ecx, dword [0x59b038]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x462462
mov esi, dword [0x59d868]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x4623a2
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea eax, [ebp - 0x1410]
push 0xc00
push 0x59cc68
push eax
call fcn.0052bc90
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x101
jmp 0x4623d9
mov ecx, dword [ebp - 0x1418]
dec ecx
je 0x46243a
test al, 1
je 0x46243f
mov dword [ebp - 0x1418], ecx
xor esi, esi
lea ebx, [ebp - 0x1408]
xor eax, eax
jmp 0x4623fc
inc esi
add ebx, 0xc
cmp esi, 0x100
je 0x4623d0
mov edi, dword [ebp + esi*8 - 0x810]
test edi, edi
je 0x4623f0
cmp dword [ebx - 8], 0
je 0x4623f0
mov ecx, dword [ebp + esi*8 - 0x80c]
cmp ecx, dword [ebx]
jne 0x4623f0
mov ecx, dword [ebx - 4]
test ecx, ecx
je 0x4623f0
mov dword [ebp + esi*8 - 0x810], 0
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x4623f0
call fcn.0047b030
push 2
push dword [ebp - 0x1414]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x59d86c
call fcn.00528497
add esp, 4
cmp dword [0x59d86c], 0xffffffff
jne 0x46238a
push 4
call fcn.005283f4
add esp, 4
mov dword [eax], 0
mov dword [0x59d868], eax
push 0x59d86c
call fcn.0052850d
add esp, 4
jmp 0x46238a
Function at 0x4624b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x599b44]
cmp eax, 0xffffffff
je 0x4624cd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4624d2
call fcn.004625e0
mov eax, dword [0x59d86c]
mov ecx, dword [0x59b038]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x462593
mov edi, dword [0x59d868]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x46250b
push edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ecx, dword [0x59cc64]
inc ecx
mov edx, 0x100
nop word [eax + eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x59cc68], 0
je 0x46254d
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x59cc68], 0
je 0x46254d
add ecx, 2
add edx, 0xfffffffe
jne 0x462520
jmp 0x46257d
lea ecx, [eax*4 + 0x59cc68]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x59cc6c], ecx
mov dword [0x59cc64], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x59cc70]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4625d4
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x59d86c
call fcn.00528497
add esp, 4
cmp dword [0x59d86c], 0xffffffff
jne 0x4624f3
push 4
call fcn.005283f4
add esp, 4
mov dword [eax], 0
mov dword [0x59d868], eax
push 0x59d86c
call fcn.0052850d
add esp, 4
jmp 0x4624f3
int3

Function at 0x4625e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x804
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x599b44]
cmp esi, 0xffffffff
jne 0x46262e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4626a2
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x599b44], esi
je 0x46262e
push esi
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov esi, dword [0x599b44]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x46269f
lea ebx, [ebp - 0x810]
push 0x800
push 0
push ebx
call fcn.0052c210
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x800
call fcn.00528453
add esp, 4
mov edi, eax
push 0x800
push ebx
push eax
call fcn.0052bc90
add esp, 0xc
mov eax, edi
or eax, 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
mov eax, edi
add esp, 0x804
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3