joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3c60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x676ce0]
cmp eax, 0xffffffff
je 0x4c3c7d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4c3c82
call fcn.004c3d90
mov eax, dword [0x685fe8]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4c3d36
mov edi, dword [0x685fe4]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4c3d2a
mov ecx, dword [0x6853e0]
inc ecx
xor edx, edx
nop dword [eax]
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x6853e4], 0
je 0x4c3cde
inc edx
cmp edx, 0x100
jne 0x4c3cc0
jmp 0x4c3d0e
lea eax, [eax*4 + 0x6853e4]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x6853e8], ecx
mov dword [0x6853e0], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x6853ec]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4c3d7b
cmp eax, 0x100
jge 0x4c3d7e
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.004cea50
jmp 0x4c3cb4
push 0x685fe8
call fcn.005dc7c7
add esp, 4
cmp dword [0x685fe8], 0xffffffff
jne 0x4c3ca3
push 4
call fcn.005dc726
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.0046fdf0
mov dword [0x685fe4], edi
push 0x685fe8
call fcn.005dc83d
add esp, 4
jmp 0x4c3ca3
int3
int3

Function at 0x4c3d90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov ecx, dword [0x676ce0]
mov dword [ebp - 0x810], ecx
cmp ecx, 0xffffffff
jne 0x4c3e34
lea esi, [ebp - 0x810]
push esi
call fcn.0051b550
add esp, 4
test al, al
je 0x4c3eb5
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x4c3e10
push esi
call fcn.0051b550
add esp, 4
test al, al
je 0x4c3eb8
cmp dword [ebp - 0x810], 0xffffffff
je 0x4c3eb8
push 0xffffffffffffffff
call fcn.0051b570
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x676ce0], ecx
je 0x4c3e34
push ecx
call fcn.0051b570
add esp, 4
mov ecx, dword [0x676ce0]
mov dword [ebp - 0x810], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4c3eb2
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.005dfe70
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.0051b580
add esp, 8
push 0x800
call fcn.005dc783
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.005df8f0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.0051b580
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x4c8450
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 0xc]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea edi, [esp + 0xc]
push 0x4c
push str....._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.0050b630
mov dword [esp + 8], 0xffffffff
cmp byte [esi + 0xb], 0
jns 0x4c84bb
mov esi, dword [esi]
mov edi, dword [ebp + 8]
lea eax, [esp + 8]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4c85a8
js 0x4c861e
mov ebx, eax
push eax
call fcn.005dc726
add esp, 4
mov edi, eax
push ebx
push 0
push eax
call fcn.005dfe70
add esp, 0xc
push edi
push ebx
push dword [esp + 0x10]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4c8590
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], 0xffffffff
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c8590
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4c8590
add ebx, edi
push 0x1c
mov dword [esp + 8], eax
call fcn.005dc726
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x67b000]
bt ecx, eax
mov eax, dword [esp + 4]
movzx edx, word [eax]
movzx ecx, word [eax + 2]
mov dword [esi], fcn.004c8c20
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
jae 0x4c85b2
push edi
mov ebx, ecx
mov word [esp + 8], dx
call fcn.004b9fa0
movzx edx, word [esp + 8]
mov ecx, ebx
add esp, 4
jmp 0x4c85be
mov esi, dword [ebp + 8]
mov dword [esi], 0
test edi, edi
je 0x4c8600
push edi
call fcn.005dc756
add esp, 4
jmp 0x4c8600
mov dword [edi], 0
mov esi, edi
jmp 0x4c8600
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x683000], 1
mov dword [esi + 0x10], edi
mov word [esi + 0x14], dx
mov word [esi + 0x16], cx
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], 0xffffffff
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
push eax
push 0x624eca
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c8623
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.0050b690
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005f1440
int3
Function at 0x4c8d80
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.004c8d90

Function at 0x4c8fb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x470
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x468], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x450], xmm0
movdqa xmmword [esp + 0x440], xmm0
movdqa xmmword [esp + 0x430], xmm0
movdqa xmmword [esp + 0x420], xmm0
lea ebx, [esp + 0x218]
push 0x1a0
push str....._base_files_file_util_win.cc
push 0x624f37
push ebx
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x420]
push 0
push ebx
call fcn.0050b630
push 0x208
push 0xff
push ebx
call fcn.005dfe70
add esp, 0xc
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4c9046
mov eax, dword [esi]
push 0x104
push eax
push ebx
call fcn.004c0920
add esp, 0xc
push ebx
call fcn.00410cd0
add esp, 4
lea ebx, [esp + 0x10]
push 0x208
push 0xff
push ebx
call fcn.005dfe70
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4c907f
mov eax, dword [edi]
push 0x104
push eax
push ebx
call fcn.004c0920
add esp, 0xc
push ebx
call fcn.00410cd0
add esp, 4
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4c90a1
mov eax, dword [esi]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x4c90ab
mov ecx, dword [edi]
sub esp, 0x18
movaps xmm0, xmmword [0x624ed0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov bl, 1
test eax, eax
jne 0x4c911a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ca260
add esp, 4
cmp byte [edi + 0xb], 0
jns 0x4c90e4
mov edi, dword [edi]
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], eax
jns 0x4c90f0
mov esi, dword [esi]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4c911a
test eax, eax
jne 0x4c911a
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
jne 0x4c9116
call fcn.004ca240
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esp + 0x420]
call fcn.0050b690
mov ecx, dword [esp + 0x468]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c9140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x1d3
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.004b6370
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0050b630
cmp byte [edi + 0xb], 0
jns 0x4c91a6
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.0050b690
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c91d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x1fb
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.004b6370
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0050b630
cmp byte [edi + 0xb], 0
jns 0x4c9236
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.0050b690
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c9270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.005dfe70
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
add esi, 0xfffffefc
cmp esi, 0xfffffefd
jb 0x4c92f8
push ebx
call fcn.005f8ba4
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.004b3860
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.004b57f0
mov ecx, dword [ebp + 8]
push ebx
call fcn.004b3990
mov ecx, ebx
call fcn.004b3910
mov ecx, edi
call fcn.004b3910
cmp esi, 0xfffffefd
setae bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c9320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.005dfe70
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x624ee0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4c9388
cmp word [ebp - 0x214], 0
je 0x4c9388
push edi
call fcn.005f8ba4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004b3860
jmp 0x4c93e1
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.004b3810
push edi
call fcn.004c9270
add esp, 4
mov ecx, esi
test al, al
je 0x4c93ca
push edi
call fcn.004b3830
jmp 0x4c93d6
push 3
push 0x624f60
call fcn.004b3860
lea ecx, [ebp - 0x220]
call fcn.004b3910
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x4c9400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov esi, esp
push 0x288
push str....._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push esi
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push esi
call fcn.0050b630
cmp byte [edi + 0xb], 0
mov ebx, edi
jns 0x4c9466
mov ebx, dword [edi]
mov esi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c9498
mov bl, 1
test al, 0x10
jne 0x4c9583
test esi, esi
je 0x4c9489
mov dword [esi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x4c9583
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov ecx, edi
mov eax, esp
push eax
call fcn.004b3f90
movzx edx, byte [esp + 0xb]
mov eax, edx
test dl, dl
jns 0x4c94c8
mov eax, dword [esp + 4]
movzx ecx, byte [edi + 0xb]
test cl, cl
js 0x4c94de
mov esi, edx
mov edx, edi
cmp eax, ecx
jne 0x4c9522
test eax, eax
jne 0x4c94ee
jmp 0x4c950f
cmp eax, dword [edi + 4]
jne 0x4c9522
mov esi, edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
test eax, eax
je 0x4c950f
mov edi, esp
mov ecx, esi
test cl, cl
jns 0x4c94f9
mov edi, dword [esp]
xor ecx, ecx
nop dword [eax + eax]
movzx esi, word [edi + ecx*2]
cmp si, word [edx + ecx*2]
jne 0x4c9522
inc ecx
cmp eax, ecx
jne 0x4c9500
mov eax, 0xfffffffc
mov edi, 2
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4c9571
jmp 0x4c9573
mov esi, dword [ebp + 0xc]
push esi
lea eax, [esp + 4]
push eax
call fcn.004c9400
add esp, 8
test al, al
je 0x4c957a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4c957c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xb7
jne 0x4c9564
push dword [ebp + 8]
call fcn.004c91d0
add esp, 4
test al, al
jne 0x4c957c
test esi, esi
je 0x4c9573
push edi
call fcn.004ca260
add esp, 4
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov ecx, esp
call fcn.004b3910
lea ecx, [esp + 0x10]
call fcn.0050b690
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c96f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov edi, esp
push 0x382
push str....._base_files_file_util_win.cc
push 0x624f8f
push edi
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.0050b630
cmp byte [esi + 0xb], 0
jns 0x4c9754
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x624ef0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0xffffffff
test eax, eax
je 0x4c979b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x4c979f
call fcn.004b63a0
jmp 0x4c97a1
xor edi, edi
jmp 0x4c97e7
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4c97e7
lea eax, [edi + 1]
cmp eax, 2
jb 0x4c97e7
mov eax, dword [ebp + 0xc]
mov dword [esp], 0xffffffff
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, ebx
mov edx, 0xffffffff
cmove edx, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edx
lea eax, [edi + 1]
cmp eax, 2
jb 0x4c97fd
call fcn.004b63a0
push edi
call fcn.004d0370
add esp, 4
lea ecx, [esp + 0x10]
call fcn.0050b690
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c9820
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
lea ebx, [esp + 0x18]
push 0x3bb
push str....._base_files_file_util_win.cc
push 0x624f99
push ebx
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push ebx
call fcn.0050b630
lea eax, [esp + 0x1a]
push 0x206
push 0xff
push eax
call fcn.005dfe70
add esp, 0xc
mov word [esp + 0x18], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xfffffefb
cmp esi, 0xfffffefc
jb 0x4c9901
push ebx
call fcn.005f8ba4
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.004b3860
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.004b57f0
mov ecx, dword [ebp + 8]
push ebx
call fcn.004b3990
mov ecx, ebx
call fcn.004b3910
mov ecx, edi
call fcn.004b3910
cmp esi, 0xfffffefc
setae bl
lea ecx, [esp + 0x220]
call fcn.0050b690
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c9930
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x3cb
push str....._base_files_file_util_win.cc
push 0x624fae
push ebx
call fcn.004b6370
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0050b630
cmp byte [edi + 0xb], 0
jns 0x4c9996
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.0050b690
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c99c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov ebx, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
lea esi, [esp + 0x18]
push 0x3d0
push str....._base_files_file_util_win.cc
push str.GetMaximumPathComponentLength
push esi
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push esi
call fcn.0050b630
push 0x208
push 0xff
push esi
call fcn.005dfe70
add esp, 0xc
lea edi, [esp + 0xc]
mov ecx, ebx
push edi
call fcn.004b5a70
cmp byte [esp + 0x17], 0
mov eax, edi
jns 0x4c9a5f
mov eax, dword [esp + 0xc]
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov ebx, eax
mov ecx, edi
call fcn.004b3910
test ebx, ebx
je 0x4c9ad7
mov dword [esp + 8], 0
lea eax, [esp + 8]
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4c9ad7
lea edi, [esp + 0xc]
mov ecx, dword [ebp + 8]
push edi
call fcn.004b57f0
movzx ebx, byte [esp + 0x17]
test bl, bl
jns 0x4c9ab7
mov ebx, dword [esp + 0x10]
mov ecx, edi
call fcn.004b3910
mov eax, 0x102
sub eax, ebx
xor esi, esi
test eax, eax
cmovg esi, eax
mov eax, dword [esp + 8]
cmp eax, esi
cmovl esi, eax
jmp 0x4c9adc
mov esi, 0xffffffff
lea ecx, [esp + 0x220]
call fcn.0050b690
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c9b00
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.005dfe70
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.004d2250
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.004d2490
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x4c9b83
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x4c9d05
xor edi, edi
lea ebx, [ebp - 0x4f4]
jmp 0x4c9baa
mov edi, esi
test eax, eax
je 0x4c9d07
push 0x250
push 0xff
push ebx
call fcn.005dfe70
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004d2410
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x4c9c20
cmp byte [ebp + 8], 0
jne 0x4c9c00
mov ecx, ebx
call fcn.004d2240
test al, al
je 0x4c9bfa
mov ecx, ebx
call fcn.004d2240
xor esi, esi
test al, al
je 0x4c9c80
jmp 0x4c9cc0
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x4c9c18
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.004d2240
test al, al
je 0x4c9c80
xor esi, esi
cmp byte [ebp + 8], 0
je 0x4c9cc0
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.004c9b00
add esp, 4
mov esi, eax
test eax, eax
jne 0x4c9cc0
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4c9c68
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x4c9cc0
jmp 0x4c9ca2
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4c9c95
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x4c9cc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x4c9cc0
mov esi, eax
nop word cs:[eax + eax]
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00410cd0
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004d2490
lea ecx, [ebp - 0x500]
push ebx
call fcn.004b3990
mov ecx, ebx
call fcn.004b3910
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x4c9ba0
mov eax, dword [ebp - 0x4fc]
jmp 0x4c9ba0
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.004b3910
lea ecx, [ebp - 0x2a4]
call fcn.004d23a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret