joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x641dc0], 0
jne 0x4839ba
mov esi, dword [0x641db0]
test esi, esi
je 0x4837d1
test byte [0x63f220], 1
jne 0x4838b8
jmp 0x4839ba
push 0xc
call fcn.00596296
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push edi
call fcn.005b0e94
add esp, 4
cmp eax, 0x7ffffff0
jae 0x4839d1
mov ebx, eax
cmp eax, 5
jae 0x48382b
mov byte [esi + 0xb], bl
mov eax, esi
test ebx, ebx
jne 0x483857
jmp 0x48386a
lea edi, [ebx + 8]
and edi, 0xfffffff8
js 0x4839d8
lea eax, [edi + edi]
push eax
call fcn.00596296
add esp, 4
mov dword [esi], eax
or edi, 0x80000000
mov dword [esi + 8], edi
mov dword [esi + 4], ebx
lea edi, [ebp - 0x218]
mov ecx, ebx
add ecx, ebx
push ecx
push edi
push eax
mov edi, eax
call fcn.00599c40
mov eax, edi
add esp, 0xc
mov word [eax + ebx*2], 0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x48387b
mov eax, dword [esi + 4]
mov ecx, esi
push eax
push 0x5c
call fcn.00479b10
cmp eax, 0xffffffff
mov bl, 1
je 0x483899
add eax, 1
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.004797aa
mov ecx, esi
push 0x5cd450
call fcn.004794e8
mov dword [0x641db0], esi
test byte [0x63f220], 1
je 0x4839ba
cmp byte [esi + 0xb], 0
jns 0x4838c0
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x5cd3c0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x641dc0], eax
add eax, 1
cmp eax, 1
ja 0x4839ba
mov word [ebp - 0x218], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4839b8
cmp eax, 0x104
ja 0x4839b8
mov ecx, dword [0x641db0]
push esi
call fcn.0047966c
mov ecx, dword [0x641db0]
movzx eax, byte [ecx + 0xb]
test al, al
js 0x483945
mov edx, ecx
jmp 0x48394a
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x483962
push 0x5c593a
call fcn.004794e8
mov ecx, dword [0x641db0]
push 0x5cd450
call fcn.004794e8
mov eax, dword [0x641db0]
cmp byte [eax + 0xb], 0
jns 0x483979
mov eax, dword [eax]
movaps xmm0, xmmword [0x5cd3c0]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x641dc0], eax
add eax, 1
cmp eax, 1
ja 0x4839ba
mov dword [0x641dc0], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00478354
call fcn.005aa3fa
int3
Function at 0x4847d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x4847f2
cmp dword [esi], edi
jne 0x4847fe
jmp 0x48481d
call fcn.004835e0
mov eax, dword [ebp + 8]
cmp dword [esi], edi
je 0x48481d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x484839
cmp ebx, 2
jae 0x484859
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 8]
movups xmm0, xmmword [eax + 4]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esi + 0x10], xmm1
movups xmmword [esi + 4], xmm0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004835e0
push dword [esi]
call fcn.00498c60
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x484813
mov dword [esi], edi
mov edi, eax
call fcn.004835e0
mov eax, edi
jmp 0x484813

Function at 0x48e1f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.00596860
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x63f240]
cmp eax, 0xffffffff
je 0x48e346
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x48e346
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00599c40
add esp, 0xc
mov ecx, dword [0x63f240]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.004e1ca0
add esp, 8
test ebx, ebx
je 0x48e26b
push ebx
call fcn.0059634c
add esp, 4
mov eax, dword [0x642aa0]
mov ecx, dword [0x644310]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x48e35b
mov esi, dword [0x642a9c]
mov ecx, esi
call fcn.00497730
lea eax, [ebp - 0x1410]
push 0xc00
push 0x641e9c
push eax
call fcn.00599c40
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, 0x100
mov al, 1
jmp 0x48e2da
lea ecx, [edi - 1]
cmp edi, 2
mov edi, ecx
jb 0x48e336
test al, 1
je 0x48e336
xor eax, eax
lea esi, [ebp - 0x1408]
xor ebx, ebx
jmp 0x48e2fe
add ebx, 1
add esi, 0xc
cmp ebx, 0x100
je 0x48e2d0
mov ecx, dword [ebp + ebx*8 - 0x810]
test ecx, ecx
je 0x48e2f0
cmp dword [esi - 8], 0
je 0x48e2f0
mov edx, dword [ebp + ebx*8 - 0x80c]
cmp edx, dword [esi]
jne 0x48e2f0
mov edx, dword [esi - 4]
test edx, edx
je 0x48e2f0
mov dword [ebp + ebx*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x48e2f0
push 2
push dword [ebp - 0x1414]
call fcn.004e1ca0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x642aa0
call fcn.00596397
add esp, 4
cmp dword [0x642aa0], 0xffffffff
jne 0x48e28c
push 4
call fcn.00596296
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00447100
mov dword [0x642a9c], esi
push 0x642aa0
call fcn.0059640d
add esp, 4
jmp 0x48e28c
Function at 0x48e3a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x63f240]
cmp eax, 0xffffffff
je 0x48e3c2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x48e3d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x63f240]
cmp eax, 0xffffffff
je 0x48e3ed
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x48e3f2
call fcn.0048e500
mov eax, dword [0x642aa0]
mov ecx, dword [0x644310]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x48e4a9
mov edi, dword [0x642a9c]
mov ecx, edi
call fcn.00497730
mov eax, dword [0x641e98]
add eax, 1
mov ecx, 0x100
nop dword [eax]
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x641e9c], 0
je 0x48e45d
lea edx, [eax + 1]
movzx edx, dl
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x641e9c], 0
je 0x48e45d
add eax, 2
add ecx, 0xfffffffe
jne 0x48e430
jmp 0x48e48d
lea eax, [ebx*4 + 0x641e9c]
mov dword [eax], 1
lea eax, [edx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x641ea0], ecx
mov dword [0x641e98], edx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x641ea4]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x48e4ee
cmp eax, 0x100
jge 0x48e4f1
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x642aa0
call fcn.00596397
add esp, 4
cmp dword [0x642aa0], 0xffffffff
jne 0x48e413
push 4
call fcn.00596296
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00447100
mov dword [0x642a9c], edi
push 0x642aa0
call fcn.0059640d
add esp, 4
jmp 0x48e413
int3
int3

Function at 0x48e500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x63f240]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x48e59e
lea esi, [ebp - 0x810]
push esi
call fcn.004e1c70
add esp, 4
test al, al
je 0x48e61f
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x48e575
push esi
call fcn.004e1c70
add esp, 4
test al, al
je 0x48e622
cmp dword [ebp - 0x810], 0xffffffff
je 0x48e622
push 0xffffffffffffffff
call fcn.004e1c90
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x63f240], ecx
mov eax, dword [ebp - 0x810]
je 0x48e59e
push eax
call fcn.004e1c90
add esp, 4
mov eax, dword [0x63f240]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x48e61c
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.0059a740
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.004e1ca0
add esp, 8
push 0x800
call fcn.00596343
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.00599c40
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.004e1ca0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00596351
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x492f00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x58], eax
lea edi, [esp + 8]
push 0x4d
push str..._.._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.004835b0
add esp, 0x10
lea ecx, [esp + 0x18]
push 0
push edi
call fcn.004d4910
cmp byte [ebx + 0xb], 0
jns 0x492f47
mov ebx, dword [ebx]
mov edi, dword [ebp + 8]
lea eax, [esp + 4]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x493078
mov esi, eax
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
test eax, eax
js 0x49309c
push esi
call fcn.00596296
add esp, 4
mov ebx, eax
mov dword [esp + 8], eax
mov edi, esi
add edi, eax
mov dword [esp + 0x10], edi
push esi
push 0
push eax
call fcn.0059a740
add esp, 0xc
mov dword [esp + 0xc], edi
push ebx
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoW
xor edi, edi
test eax, eax
je 0x49305a
mov eax, dword [esp + 8]
mov dword [esp + 0x54], 0
lea ecx, [esp + 0x50]
lea ebx, [esp + 0x54]
push ecx
push ebx
push str.VarFileInfoTranslation
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49305a
mov esi, dword [esp + 0x54]
test esi, esi
je 0x49305a
push 0x1c
call fcn.00596296
add esp, 4
mov edi, eax
mov eax, dword [esi]
mov dword [edi], 0x5cd6b0
mov ecx, dword [esp + 8]
mov dword [edi + 4], ecx
mov edx, dword [esp + 0xc]
mov dword [edi + 8], edx
mov edx, dword [esp + 0x10]
mov dword [edi + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
mov dword [esp + 0x54], 0
lea eax, [esp + 0x50]
push eax
push ebx
push 0x5cd8a6
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4930a5
mov eax, dword [esp + 0x54]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov edi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x49307e
mov dword [esp + 0xc], eax
push eax
call fcn.00596316
add esp, 4
jmp 0x49307e
mov dword [edi], 0
lea ecx, [esp + 0x18]
call fcn.004d4a30
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00596351
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 8]
call fcn.0047a3cc
int3
Function at 0x493290
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov esi, ecx
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
mov dword [ebp - 0x230], eax
movzx ebx, word [ecx + 0x16]
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call edi
mov word [ebp - 0x224], ax
movzx eax, word [esi + 0x16]
mov dword [ebp - 0x22c], eax
movzx eax, word [esi + 0x14]
mov dword [ebp - 0x228], eax
call edi
mov word [ebp - 0x222], ax
lea edi, [ebp - 0x218]
push dword [ebp + 8]
push ebx
push dword [ebp - 0x230]
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.00493490
add esp, 0x1c
mov dword [ebp - 0x21c], 0
lea ebx, [ebp - 0x220]
lea eax, [ebp - 0x21c]
push ebx
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x493347
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x493347
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x49345b
movzx eax, word [ebp - 0x224]
push dword [ebp + 8]
push dword [ebp - 0x22c]
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.00493490
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4933a7
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4933a7
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x49345b
push dword [ebp + 8]
push 0x4e4
push dword [ebp - 0x228]
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.00493490
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x493400
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x493400
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x49345b
movzx eax, word [ebp - 0x222]
push dword [ebp + 8]
push 0x4e4
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.00493490
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x493483
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x493483
mov edx, dword [ebp - 0x220]
test edx, edx
je 0x493483
mov ecx, dword [ebp + 0xc]
add edx, 0xffffffff
push edx
push eax
call fcn.00478fda
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
jmp 0x49346a

Function at 0x493670
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00493680
Function at 0x4939e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x450], eax
lea ebx, [esp + 0x248]
push 0x196
push str..._.._base_files_file_util_win.cc
push 0x5cd927
push ebx
call fcn.004835b0
add esp, 0x10
lea ecx, [esp + 8]
push 0
push ebx
call fcn.004d4910
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x493a38
mov eax, dword [esi]
push 0x104
push eax
push ebx
call fcn.0048b560
add esp, 0xc
push ebx
call fcn.00413500
add esp, 4
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x493a5a
mov eax, dword [edi]
lea ebx, [esp + 0x40]
push 0x104
push eax
push ebx
call fcn.0048b560
add esp, 0xc
push ebx
call fcn.00413500
add esp, 4
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x493a80
mov eax, dword [esi]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x493a8a
mov ecx, dword [edi]
sub esp, 0x18
movaps xmm0, xmmword [0x5cd8b0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov bl, 1
test eax, eax
jne 0x493af9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004949c0
add esp, 4
cmp byte [edi + 0xb], 0
jns 0x493ac3
mov edi, dword [edi]
cmp byte [esi + 0xb], 0
mov dword [esp + 4], eax
jns 0x493acf
mov esi, dword [esi]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x493af9
test eax, eax
jne 0x493af9
mov eax, dword [esp + 4]
cmp eax, 0xfffffffc
jne 0x493af5
call fcn.004949a0
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esp + 8]
call fcn.004d4a30
mov ecx, dword [esp + 0x450]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x493b20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x48], eax
mov ebx, esp
push 0x1c9
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.004835b0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.004d4910
cmp byte [edi + 0xb], 0
jns 0x493b6a
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004d4a30
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x493ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x48], eax
mov ebx, esp
push 0x1db
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.004835b0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.004d4910
cmp byte [edi + 0xb], 0
jns 0x493bea
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004d4a30
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x493c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
add esi, 0xffffffff
cmp esi, 0x102
ja 0x493cb8
cmp word [ebp - 0x21a], 0
je 0x493c82
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
lea eax, [ecx + 1]
cmp word [ebp + ecx*2 - 0x218], 0
mov ecx, eax
jne 0x493c70
jmp 0x493c84
xor eax, eax
lea ebx, [ebp - 0x234]
mov ecx, ebx
push eax
push edi
call fcn.004808b0
lea edi, [ebp - 0x228]
mov ecx, ebx
push edi
call fcn.00482ac0
mov ecx, dword [ebp + 8]
push edi
call fcn.004809b0
mov ecx, edi
call fcn.00480970
mov ecx, ebx
call fcn.00480970
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x493ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0xc], eax
sub esp, 0x14
lea edi, [ebp - 0x214]
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x5cd8c0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x493d49
cmp word [ebp - 0x214], 0
je 0x493d49
xor eax, eax
nop
cmp word [ebp + eax*2 - 0x212], 0
lea eax, [eax + 1]
jne 0x493d30
mov ecx, esi
push eax
push edi
call fcn.004808b0
jmp 0x493d84
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.00480860
push edi
call fcn.00493c20
add esp, 4
mov ecx, esi
test al, al
je 0x493d6d
push edi
call fcn.00480880
jmp 0x493d79
push 3
push 0x5cd950
call fcn.004808b0
lea ecx, [ebp - 0x220]
call fcn.00480970
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00596351
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x493da0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov esi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x98], eax
lea edi, [esp + 0x60]
push 0x265
push str..._.._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push edi
call fcn.004835b0
add esp, 0x10
lea ecx, [esp + 0x18]
push 0
push edi
call fcn.004d4910
cmp byte [esi + 0xb], 0
mov ebx, esi
jns 0x493df2
mov ebx, dword [esi]
mov edi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x493e24
mov bl, 1
test al, 0x10
jne 0x493f55
test edi, edi
je 0x493e15
mov dword [edi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x493f55
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00481210
movzx edx, byte [esp + 0x17]
mov eax, edx
test dl, dl
jns 0x493e3f
mov eax, dword [esp + 0x10]
movzx ecx, byte [esi + 0xb]
test cl, cl
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
js 0x493e5b
mov edx, esi
cmp eax, ecx
jne 0x493ea5
test eax, eax
jne 0x493e66
jmp 0x493e91
cmp eax, dword [esi + 4]
jne 0x493ea5
mov edx, dword [esi]
test eax, eax
je 0x493e91
lea edi, [esp + 0xc]
cmp byte [esp + 8], 0
jns 0x493e75
mov edi, dword [esp + 0xc]
xor ecx, ecx
nop word [eax + eax]
movzx ebx, word [edi + ecx*2]
cmp bx, word [edx + ecx*2]
jne 0x493ea5
add ecx, 1
cmp eax, ecx
jne 0x493e80
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x493e9e
mov dword [eax], 0xfffffffc
push 2
jmp 0x493f44
mov edi, dword [ebp + 0xc]
push edi
lea eax, [esp + 0x10]
push eax
call fcn.00493da0
add esp, 8
test al, al
je 0x493f4a
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x493f4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
cmp eax, 0xb7
jne 0x493f30
lea edi, [esp + 0x50]
push 0x1db
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push edi
call fcn.004835b0
add esp, 0x10
lea ecx, [esp + 0x60]
push 0
push edi
call fcn.004d4910
cmp byte [esi + 0xb], 0
jns 0x493f11
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
lea ecx, [esp + 0x60]
call fcn.004d4a30
cmp esi, 0xffffffff
mov edi, dword [ebp + 0xc]
je 0x493f30
and esi, 0x10
jne 0x493f4c
test edi, edi
mov esi, dword [esp + 4]
je 0x493f43
push esi
call fcn.004949c0
add esp, 4
mov dword [edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea ecx, [esp + 0xc]
call fcn.00480970
lea ecx, [esp + 0x18]
call fcn.004d4a30
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret