joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad4b0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.004ad250

Function at 0x4ad4c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea eax, [esp + 0x250]
push 0x1da
push str....._base_files_file_util_win.cc
push 0x78ba67
push eax
call fcn.0055fb40
add esp, 0x10
mov ecx, esi
lea esi, [esp + 0x250]
push 0
push esi
call fcn.00552b00
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push esi
call fcn.005c9b00
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4ad548
mov eax, dword [ebx]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.00557da0
add esp, 0xc
push esi
call fcn.00533150
add esp, 4
lea esi, [esp + 0x48]
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push esi
call fcn.005c9b00
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4ad584
mov eax, dword [edi]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.00557da0
add esp, 0xc
push esi
call fcn.00533150
add esp, 4
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4ad5a7
mov eax, dword [ebx]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x4ad5b1
mov ecx, dword [edi]
sub esp, 0x18
movsd xmm0, qword [0x78b9f0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x4ad60f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004acce0
add esp, 4
mov dword [esp + 0xc], eax
cmp byte [edi + 0xb], 0
jns 0x4ad5ed
mov edi, dword [edi]
mov esi, dword [ebp + 0x10]
cmp byte [ebx + 0xb], 0
jns 0x4ad5f8
mov ebx, dword [ebx]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test esi, esi
je 0x4ad611
test eax, eax
jne 0x4ad611
jmp 0x4ad632
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.00552b70
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esp + 0xc], 0xfffffffc
jne 0x4ad642
call fcn.0063ecb0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi], eax
xor ebx, ebx
jmp 0x4ad611
Function at 0x4ad650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x20d
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00552b00
cmp byte [edi + 0xb], 0
jns 0x4ad6ac
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.00552b70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ad6e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x216
push str....._base_files_file_util_win.cc
push str.PathHasAccess
push esi
call fcn.0055fb40
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00552b00
cmp byte [edi + 0xb], 0
jns 0x4ad741
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x4ad7d7
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x4ad79a
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x4ad7d3
call fcn.0055fb70
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x4ad7b5
call fcn.0055fb70
push esi
call fcn.0054ae70
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4ad793
xor ebx, ebx
jmp 0x4ad7b5
Function at 0x4ad800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x235
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00552b00
cmp byte [edi + 0xb], 0
jns 0x4ad85c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.00552b70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ad890
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.005c9b00
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x4ad913
push ebx
call fcn.005e20d4
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0055fe60
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.004bc2d0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0055ffc0
mov ecx, ebx
call fcn.0055ff40
mov ecx, edi
call fcn.0055ff40
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ad940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.005c9b00
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x78ba00]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4ad9bd
cmp word [ebp - 0x214], 0
je 0x4ad9bd
push edi
call fcn.005e20d4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0055fe60
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.0055fdd0
push edi
call fcn.004ad890
add esp, 4
mov ecx, esi
test al, al
jne 0x4ad9f2
push 3
push 0x78ba90
call fcn.0055fe60
jmp 0x4ad9f8
push edi
call fcn.0055fe30
lea ecx, [ebp - 0x220]
call fcn.0055ff40
jmp 0x4ad9a7
Function at 0x4ae400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, esp
push 0x3e1
push str....._base_files_file_util_win.cc
push 0x78bb3b
push eax
call fcn.0055fb40
add esp, 0x10
xor edi, edi
mov ecx, esi
push edi
lea eax, [esp + 4]
push eax
call fcn.00552b00
cmp byte [ebx + 0xb], 0
jns 0x4ae461
mov ebx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], edi
movaps xmm0, xmmword [0x78ba20]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x4ae4a6
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, 0xffffffff
je 0x4ae509
call fcn.0055fb70
mov edi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 1]
cmp esi, 2
jb 0x4ae50d
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp], 0xffffffff
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [esp], ebx
sete bl
and bl, al
cmp esi, 2
jb 0x4ae4eb
call fcn.0055fb70
push edi
call fcn.0054ae70
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00552b70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x4ae49f
xor ebx, ebx
jmp 0x4ae4d8

Function at 0x4ae520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x41b
push str....._base_files_file_util_win.cc
push 0x78bb45
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00552b00
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.005c9b00
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x4ae5e6
push ebx
call fcn.005e20d4
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.0055fe60
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.004bc2d0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0055ffc0
mov ecx, ebx
call fcn.0055ff40
mov ecx, edi
call fcn.0055ff40
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.00552b70
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ae610
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x42b
push str....._base_files_file_util_win.cc
push 0x78bb5a
push ebx
call fcn.0055fb40
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00552b00
cmp byte [edi + 0xb], 0
jns 0x4ae66c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.00552b70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aea60
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.005c9b00
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.004aed70
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.004af020
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x4aeacd
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x4aebc8
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.005c9b00
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004aefe0
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x4aec1f
mov ecx, ebx
call fcn.004aec80
test al, al
jne 0x4aebcc
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4aeb2e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4aebc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x4aeb51
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00410a30
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004af020
lea ecx, [ebp - 0x500]
push ebx
call fcn.0055ffc0
mov ecx, ebx
call fcn.0055ff40
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x4aeb8d
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x4aeadd
lea ecx, [ebp - 0x500]
call fcn.0055ff40
lea ecx, [ebp - 0x2a4]
call fcn.004aef70
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4aeb51
xor esi, esi
jmp 0x4aeb97
xor esi, esi
cmp byte [ebp + 8], 0
je 0x4aeb51
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.004aea60
add esp, 4
test eax, eax
jne 0x4aeb4f
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4aec0b
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4aeb51
jmp 0x4aeb3d
cmp byte [ebp + 8], 0
jne 0x4aec52
lea ecx, [ebp - 0x4f4]
call fcn.004aec80
test al, al
je 0x4aec4c
lea ecx, [ebp - 0x4f4]
call fcn.004aec80
test al, al
je 0x4aeb19
jmp 0x4aebc4
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x4aec63
lea ecx, [ebp - 0x500]
jmp 0x4aec69
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4aeb0a
Function at 0x4af9e0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
call fcn.00562d10
mov ecx, eax
push str.enable_low_end_device_mode
call fcn.005631f0
test al, al
jne 0x4afa07
cmp byte [0x80f410], 1
je 0x4afa22
pop ebp
jmp fcn.004a8ac0
call fcn.004a8ac0
mov ecx, 0x20000000
cmp eax, 0x20000000
cmovae eax, ecx
test edx, edx
cmovne eax, ecx
xor edx, edx
jmp 0x4afa34
mov eax, dword [0x80f408]
mov edx, dword [0x80f40c]
shld edx, eax, 0x14
shl eax, 0x14
pop ebp
ret
Function at 0x4b0420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov dword [esp + 4], edx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 0x98], eax
xor ebx, ebx
test ecx, ecx
je 0x4b058e
push ebx
push ebx
push ecx
mov dword [esp + 0x14], ecx
call fcn.005d7e64
add esp, 0xc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x20]
push 0x51
push str....._base_files_file_util.cc
push str.ReadStreamToSpanWithMaxSize
push esi
call fcn.0055fb40
add esp, 0x10
mov ecx, edi
push ebx
push esi
call fcn.00552b00
mov dword [esi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push dword [esp + 8]
call fcn.005d7e3d
add esp, 4
push eax
call fcn.005d905a
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x4b05a6
mov eax, dword [esp + 0x44]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x40]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 4]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x18]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0xc]
call dword [0x8010bc]
mov eax, dword [esp + 0x10]
push edi
push eax
push ebx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 8]
push edi
push 1
push eax
call fcn.005dfeaf
add esp, 0x10
test eax, eax
je 0x4b054e
mov ebx, eax
mov eax, dword [esp + 4]
sub eax, esi
cmp eax, ebx
jb 0x4b05b0
add ebx, esi
push dword [esp + 8]
call fcn.005df825
add esp, 4
test eax, eax
je 0x4b05b8
mov esi, ebx
push dword [esp + 8]
call fcn.005df851
add esp, 4
test eax, eax
sete bl
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x8010bc]
mov eax, dword [esp + 0x94]
lea edx, [esp + 0x10]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x60]
call fcn.00552b70
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x4b04e2
xor ebx, ebx
mov esi, dword [esp + 4]
jmp 0x4b055f
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x8010bc]
mov eax, dword [esp + 0x94]
lea esi, [esp + 0x10]
push dword [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov esi, ebx
jmp 0x4b0518

Function at 0x4b07f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ae400
Function at 0x4ba140
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004ba2c0
mov eax, dword [edi]
mov dword [0x80a5bc], eax
mov bl, 1
test al, 1
jne 0x4ba17c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x80f4b0]
test eax, eax
je 0x4ba1a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x80f4b0], 0
cmp dword [0x80f4b4], 0
jne 0x4ba1a6
and byte [0x80a5bc], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4ba1c3
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x4ba1b8
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x4ba22e
mov dword [0x80f4b0], eax
jmp 0x4ba168
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x4ba1ce
mov eax, dword [edi + 8]
test eax, eax
je 0x4ba26f
lea esi, [edi + 4]
mov ecx, dword [0x80f4b4]
test ecx, ecx
jne 0x4ba202
push 0xc
call fcn.005c5789
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x80f4b4], eax
push esi
call fcn.00535690
cmp dword [edi + 0x14], 0
jne 0x4ba222
mov eax, dword [0x80f4b4]
cmp byte [eax + 0xb], 0
jns 0x4ba21b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00642920
mov ebx, eax
jmp 0x4ba168
lea eax, [ebp - 0x24]
push 0x232
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push eax
call fcn.0055fb40
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push str.settings.log_file_path.empty__
push esi
call fcn.00645220
add esp, 0x10
mov ecx, esi
call fcn.00645480
mov eax, dword [edi + 0x18]
jmp 0x4ba1bc
lea ebx, [ebp - 0x24]
push 0x238
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push ebx
call fcn.0055fb40
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push str._settings.log_file_path.empty__
push esi
call fcn.00645220
add esp, 0x10
mov ecx, esi
push str.LOG_TO_FILE_set_but_no_log_file_path_
call fcn.006428f0
mov ecx, esi
call fcn.00645480
jmp 0x4ba1d6
Function at 0x4bcc30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.005c6f70
mov esi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.005555e0
add esp, 0xc
test esi, esi
je 0x4bcce9
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.005c9b00
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x4bcc95
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x4bccbb
cmp eax, 0x7fff
jae 0x4bcd12
push esi
push eax
push edi
call fcn.004b56c0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x4bccd2
push dword [ebp - 0x1001c]
call fcn.005c57c0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x4bccfa
lea eax, [ebp - 0x1001c]
jmp 0x4bcd00
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x4bccbb
int3

Function at 0x4bd290
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x80f53c]
test ebx, ebx
jne 0x4bd314
push 0x28
call fcn.005c5789
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.005c5789
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x4bd31e
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x80f53c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x4bd31e
mov edi, eax
push eax
call fcn.005e20d4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004bd320
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4c2fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x4c30f5
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x8010bc]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x8010bc]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x8010bc]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x4c3091
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x4c3085
push 1
call fcn.0057fa20
add esp, 4
bt eax, 0x19
jae 0x4c310a
not eax
test eax, 0x12000000
jne 0x4c30f9
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403290
add esp, 0xc
mov eax, 0x401cd0
mov ecx, 0x401140
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4c30e1
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00402f80
jmp 0x4c30b9
bt eax, 9
jae 0x4c312b
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00404020
add esp, 0xc
xor eax, eax
mov ecx, 0x4040d0
jmp 0x4c30c6
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00646080
add esp, 0xc
mov eax, 0x646c10
mov ecx, 0x645f90
jmp 0x4c30c6