joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5635df
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80100c]
jne 0x5635e9
repz ret
jmp fcn.0056f6f7

Function at 0x568bc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x568bf9
call fcn.00566f8c
mov dword [eax], esi
call fcn.00566f79
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00563a11
add esp, 0x14
push 0x16
pop eax
jmp 0x568c4e
test dword [ebp + 0xc], 0xfffffff9
jne 0x568bd5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x568c26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00566f9f
pop ecx
call fcn.00566f79
mov eax, dword [eax]
jmp 0x568c4e
test al, 0x10
jne 0x568c4c
test al, 1
je 0x568c4c
test byte [ebp + 0xc], 2
je 0x568c4c
call fcn.00566f8c
mov dword [eax], 5
call fcn.00566f79
mov dword [eax], 0xd
jmp 0x568c1d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x582c4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0056ff52
and dword [ebp - 4], 0
cmp dword [0x81189c], 0
mov ebx, eax
jne 0x582cfb
push 0x771278
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x582dac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x791b60
push edi
call esi
test eax, eax
je 0x582dac
push eax
call fcn.0056fee0
mov dword [esp], 0x791b50
push edi
mov dword [0x81189c], eax
call esi
push eax
call fcn.0056fee0
mov dword [esp], 0x791b3c
push edi
mov dword [0x8118a0], eax
call esi
push eax
call fcn.0056fee0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x8118a4], eax
call esi
push eax
call fcn.0056fee0
pop ecx
mov dword [0x8118ac], eax
test eax, eax
je 0x582cfb
push 0x791b08
push edi
call esi
push eax
call fcn.0056fee0
pop ecx
mov dword [0x8118a8], eax
mov eax, dword [0x8118a8]
cmp eax, ebx
je 0x582d53
cmp dword [0x8118ac], ebx
je 0x582d53
push eax
call fcn.0056ff5b
push dword [0x8118ac]
mov esi, eax
call fcn.0056ff5b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x582d53
test edi, edi
je 0x582d53
call esi
test eax, eax
je 0x582d4a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x582d4a
test byte [ebp - 0xc], 1
jne 0x582d53
or dword [ebp + 0x10], 0x200000
jmp 0x582d8c
mov eax, dword [0x8118a0]
cmp eax, ebx
je 0x582d8c
push eax
call fcn.0056ff5b
pop ecx
test eax, eax
je 0x582d8c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x582d8c
mov eax, dword [0x8118a4]
cmp eax, ebx
je 0x582d8c
push eax
call fcn.0056ff5b
pop ecx
test eax, eax
je 0x582d8c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81189c]
call fcn.0056ff5b
pop ecx
test eax, eax
je 0x582dac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x582dae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x599ef0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72bd7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcc
mov dword [ebp - 0x60], 0
lea eax, [ebp - 0x69]
mov dword [ebp - 0x68], eax
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00446c40
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.005a5ad0
add esp, 8
push 0x7fff
lea ecx, [ebp - 0x3c]
call fcn.005a0430
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x78], ecx
cmp dword [ebp - 0x10], 8
jb 0x599f6c
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xd8], edx
jmp 0x599f75
lea eax, [ebp - 0x24]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jbe 0x59a098
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
sub edx, 1
cmp dword [ebp - 0x2c], edx
jae 0x59a098
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
cmp ecx, dword [ebp - 0x38]
jb 0x599fd6
push 0
push 0x130
push str..includePoco_Buffer.h
push str.index____used
call fcn.005a4b60
add esp, 0x10
mov edx, dword [ebp - 0x34]
xor eax, eax
mov ecx, dword [ebp - 0x80]
mov word [edx + ecx*2], ax
lea edx, [ebp - 0x89]
mov dword [ebp - 0x88], edx
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.0040b0a0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x5c], ecx
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.005a6110
add esp, 8
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.0040b0a0
mov ecx, dword [0x7c2410]
push ecx
push 0
lea edx, [ebp - 0x58]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040aed0
mov eax, dword [ebp - 0x60]
or eax, 1
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.0040b0a0
mov byte [ebp - 4], 1
movzx ecx, byte [ebp - 0x30]
test ecx, ecx
je 0x59a07e
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x94]
push eax
call fcn.00563af8
add esp, 4
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00446c40
mov eax, dword [ebp + 8]
jmp 0x59a12f
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.0040b0a0
mov ecx, dword [0x7c2410]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040aed0
mov eax, dword [ebp - 0x60]
or eax, 1
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 1
movzx ecx, byte [ebp - 0x30]
test ecx, ecx
je 0x59a0e6
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0xa8]
push eax
call fcn.00563af8
add esp, 4
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00446c40
mov eax, dword [ebp + 8]
jmp 0x59a12f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x59a140
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72bd9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
mov ecx, dword [ebp + 8]
call fcn.005a0340
lea eax, [ebp - 0x11c]
push eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], 0x100
jbe 0x59a196
mov dword [ebp - 0x238], 0x100
jmp 0x59a19f
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x238], edx
mov eax, dword [ebp - 0x238]
lea ecx, [ebp + eax*2 - 0x11c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
jae 0x59a297
lea eax, [ebp - 0x18d]
mov dword [ebp - 0x18c], eax
push 0
push 0
lea ecx, [ebp - 0x138]
call fcn.00446c40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x18]
jae 0x59a21c
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
test eax, eax
je 0x59a21c
mov ecx, dword [ebp - 0x10]
mov dx, word [ecx]
mov word [ebp - 0x1a6], dx
movzx eax, word [ebp - 0x1a6]
push eax
push 1
lea ecx, [ebp - 0x138]
call fcn.004514e0
mov ecx, dword [ebp - 0x10]
add ecx, 2
mov dword [ebp - 0x10], ecx
jmp 0x59a1dd
lea edx, [ebp - 0x1b1]
mov dword [ebp - 0x1b0], edx
push 0
push 0
lea ecx, [ebp - 0x154]
call fcn.0040b0a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x138]
push ecx
call fcn.005a5e20
add esp, 8
lea edx, [ebp - 0x154]
push edx
mov ecx, dword [ebp + 8]
call fcn.0058cb60
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x154]
call fcn.0040b0a0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x138]
call fcn.00446c40
jmp 0x59a1af
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5a71b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72c701
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x5a71ec
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xec], edx
jmp 0x5a71f8
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xec], eax
push 0
push 0
mov ecx, dword [ebp - 0xec]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5a722e
push 0
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x60]
call fcn.005933e0
push 0x7daa7c
lea eax, [ebp - 0x60]
push eax
call fcn.00563aac
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0049abdb
add esp, 4
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x5a725a
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xf0], edx
jmp 0x5a7266
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xf0], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040aae0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x68]
push eax
call fcn.00563af8
add esp, 4
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.0040b0a0
mov ecx, dword [0x7c2410]
push ecx
push 0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040aed0
mov eax, dword [ebp - 0x6c]
or eax, 1
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040b0a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5a72f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x5a730a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 8], edx
jmp 0x5a7313
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 8], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
xor edx, edx
cmp edx, dword [ebp - 4]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x5a7340
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72c713
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x5a7375
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xb4], edx
jmp 0x5a7381
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x10
jb 0x5a7398
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xb8], eax
jmp 0x5a73a4
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0xb4]
push edx
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x5a7414
push str.cannot_set_environment_variable:
lea ecx, [ebp - 0x28]
call fcn.0040aae0
mov dword [ebp - 4], 0
mov ecx, dword [0x7c2410]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x28]
call fcn.00447010
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
call fcn.00593a10
push 0x7dab3c
lea ecx, [ebp - 0x58]
push ecx
call fcn.00563aac
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040b0a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5a86f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72c78e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x5a87d7
lea edx, [ebp - 0x79]
mov dword [ebp - 0x78], edx
push 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.0040b0a0
mov dword [ebp - 0xf8], str.Cannot_get_computer_name
mov eax, dword [ebp - 0xf8]
add eax, 1
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0xf8]
mov dl, byte [ecx]
mov byte [ebp - 0xfd], dl
add dword [ebp - 0xf8], 1
cmp byte [ebp - 0xfd], 0
jne 0x5a875d
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0xfc]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x104]
push ecx
push str.Cannot_get_computer_name
lea ecx, [ebp - 0x6c]
call fcn.0040a9d0
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x50]
call fcn.00593a10
push 0x7dab3c
lea eax, [ebp - 0x50]
push eax
call fcn.00563aac
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.0040b0a0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040aae0
mov edx, dword [ebp - 0x70]
or edx, 1
mov dword [ebp - 0x70], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5a8800
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov word [ecx + 4], ax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x288
mov edx, dword [ebp - 0xc]
push edx
call fcn.0049abdb
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x6f
jne 0x5a8873
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00563af8
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.0049abdb
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
jmp 0x5a887e
cmp dword [ebp - 4], 0
je 0x5a887e
jmp 0x5a88fe
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x5a88ec
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], 0
cmp dword [ebp - 0x10], 0
je 0x5a88ec
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
jne 0x5a88ec
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x1a0], 6
jne 0x5a88e2
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x190], 6
jne 0x5a88e2
mov byte [ebp - 0x11], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x190]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x194
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005645b0
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x5a8899
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.00563af8
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x5a9100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5a9132
push 0
push 0x5e
push str.e:giteepoco_1.9.0_all_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.005a4b60
add esp, 0x10
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 8
jb 0x5a914f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
jmp 0x5a9158
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a91a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, 2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x13
ja case.0x5a918d.2
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x5a91b8]
jmp dword [edx*4 + 0x5a91b0]
xor al, al
jmp 0x5a91a9
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.005aa4c0
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x5a91d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5a9202
push 0
push 0x74
push str.e:giteepoco_1.9.0_all_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.005a4b60
add esp, 0x10
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 8
jb 0x5a921f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
jmp 0x5a9228
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a925f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 5
je 0x5a924c
jmp 0x5a9250
xor al, al
jmp 0x5a9261
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.005aa4c0
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x5a9270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5a92a5
push 0
push 0x87
push str.e:giteepoco_1.9.0_all_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.005a4b60
add esp, 0x10
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 8
jb 0x5a92c2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
jmp 0x5a92cb
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a92ed
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.005aa4c0
add esp, 4
mov eax, dword [ebp - 4]
and eax, 1
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x5a9410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5a9445
push 0
push 0x9f
push str.e:giteepoco_1.9.0_all_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.005a4b60
add esp, 0x10
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 8
jb 0x5a9462
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
jmp 0x5a946b
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a948d
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.005aa4c0
add esp, 4
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x5a94a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5a94d5
push 0
push 0xaa
push str.e:giteepoco_1.9.0_all_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.005a4b60
add esp, 0x10
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 8
jb 0x5a94f2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
jmp 0x5a94fb
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a951d
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.005aa4c0
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x5a9539
mov edx, dword [ebp - 4]
and edx, 0x400
je 0x5a9539
mov dword [ebp - 0x14], 1
jmp 0x5a9540
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x5a9710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5a9745
push 0
push 0xc5
push str.e:giteepoco_1.9.0_all_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.005a4b60
add esp, 0x10
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 8
jb 0x5a9762
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
jmp 0x5a976b
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a978d
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.005aa4c0
add esp, 4
mov eax, dword [ebp - 4]
and eax, 2
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x5a9bf0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5a9c25
push 0
push 0x112
push str.e:giteepoco_1.9.0_all_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.005a4b60
add esp, 0x10
mov eax, dword [ebp - 0x10]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 8
jb 0x5a9c42
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
jmp 0x5a9c4b
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5a9c6d
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
call fcn.005aa4c0
add esp, 4
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x5a9c80
mov edx, dword [ebp - 4]
and edx, 0xfffffffe
mov dword [ebp - 4], edx
jmp 0x5a9c89
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x18], 8
jb 0x5a9ca6
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
jmp 0x5a9caf
mov edx, dword [ebp - 0xc]
add edx, 4
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x5a9cd0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
call fcn.005aa4c0
add esp, 4
mov esp, ebp
pop ebp
ret 4