joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2a80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov cl, byte [esi + 0x11c]
lea eax, [esi + 0xc]
test cl, cl
jne 0x4b2aa7
mov eax, dword [esi + 8]
cmp word [eax + 6], 0x3a
jne 0x4b2b3f
lea eax, [esi + 0xc]
test cl, cl
jne 0x4b2abc
mov eax, dword [esi + 8]
cmp word [eax + 8], 0
jne 0x4b2b3f
push esi
lea ecx, [ebp - 0x24c]
call fcn.004ad170
push 0x551b6c
lea eax, [ebp - 0x24c]
push 0x561dd0
push eax
call fcn.004ad730
add esp, 0xc
lea eax, [ebp - 0x240]
cmp byte [ebp - 0x130], 0
cmove eax, dword [ebp - 0x244]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b2b11
xor bl, bl
jmp 0x4b2b17
shr ebx, 4
and bl, 1
cmp byte [ebp - 0x130], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4b2c60
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
jmp 0x4b2c53
push esi
lea ecx, [ebp - 0x128]
call fcn.004ad170
mov al, byte [esi + 0x11c]
lea ecx, [esi + 0xc]
test al, al
jne 0x4b2b5b
mov ecx, dword [esi + 8]
cmp word [ecx + 6], 0x3a
jne 0x4b2b84
lea ecx, [esi + 0xc]
test al, al
jne 0x4b2b6c
mov ecx, dword [esi + 8]
cmp word [ecx + 8], 0x5c
jne 0x4b2b84
lea ecx, [esi + 0xc]
test al, al
jne 0x4b2b7d
mov ecx, dword [esi + 8]
cmp word [ecx + 0xa], 0
je 0x4b2bcc
push edi
mov edi, dword [esi + 4]
test edi, edi
je 0x4b2bcb
test al, al
lea eax, [esi + 0xc]
jne 0x4b2b96
mov eax, dword [esi + 8]
cmp word [eax + edi*2 + 2], 0x5c
jne 0x4b2bcb
lea eax, [edi - 1]
push edi
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x124], eax
call fcn.004ada80
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
xor ecx, ecx
mov word [eax + edi*2 + 2], cx
pop edi
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b2bf2
xor bl, bl
jmp 0x4b2c37
mov al, byte [esi + 0x11c]
lea ecx, [esi + 0xc]
test al, al
jne 0x4b2c02
mov ecx, dword [esi + 8]
cmp word [ecx + 6], 0x3a
jne 0x4b2c31
lea ecx, [esi + 0xc]
test al, al
jne 0x4b2c13
mov ecx, dword [esi + 8]
cmp word [ecx + 8], 0x5c
jne 0x4b2c31
test al, al
je 0x4b2c23
add esi, 0xc
jmp 0x4b2c26
mov esi, dword [esi + 8]
cmp word [esi + 0xa], 0
jne 0x4b2c31
mov bl, 1
jmp 0x4b2c37
shr ebx, 4
and bl, 1
cmp byte [ebp - 0xc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4b2c60
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x4b2c60
push eax
call fcn.004e4a56
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
Function at 0x4b2c80
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53930b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
mov ebx, dword [ebp + 8]
jne 0x4b2cc2
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4b2ce0
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4b2d89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.004b2a50
test al, al
je 0x4b2d89
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4b2d18
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x134]
add eax, 4
push 0
push eax
call fcn.004b2790
push edi
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.004af720
mov ecx, eax
call fcn.004af870
mov ecx, ebx
call fcn.004af720
lea ecx, [ebp - 0x134]
push ecx
push 0x5624f0
mov ecx, eax
call fcn.004af980
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4b2d85
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x4b2d85
push eax
call fcn.004e4a56
add esp, 4
xor al, al
jmp 0x4b2d8b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b3130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4b323c
test edi, edi
je 0x4b31e6
cmp word [edi], 0
je 0x4b31e6
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4b3183
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.004af720
mov ecx, eax
call fcn.004af870
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x562558
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
lea ecx, [ebx + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
push 0x551b6c
push 0x561dd0
push esi
call fcn.004ad730
push edi
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x4b31f5
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.004af720
mov ecx, eax
call fcn.004af870
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x562558
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
lea ecx, [edi + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x18]
je 0x4b330b
test edi, edi
je 0x4b32c5
cmp word [edi], 0
je 0x4b32c5
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4b3261
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0
call fcn.004af720
mov ecx, eax
call fcn.004af870
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x562568
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
lea ecx, [ebx + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
push 0x551b6c
push 0x561dd0
push esi
call fcn.004ad730
push edi
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x4b32d4
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x562568
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
lea ecx, [edi + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4b33f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b3430
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.004eec3a
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4b348b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x551b6c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4b348b
mov ecx, dword [ebp - 8]
mov bl, 1
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test esi, esi
je 0x4b3498
push esi
call fcn.004e4a56
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5393a1
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x44c], edi
xor eax, eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
mov dword [ebp - 4], eax
call fcn.004b35b0
cmp eax, 2
jne 0x4b384c
push 0x3e
xor eax, eax
mov dword [ebp - 0x418], 0
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x414], 7
mov word [ebp - 0x428], ax
call fcn.0040b450
push 4
push str.http
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
call fcn.0040c270
push 0xb
push str.UserChoice
lea ecx, [ebp - 0x428]
call fcn.0040c270
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x428]
cmp dword [ebp - 0x414], 8
push ecx
cmovae eax, dword [ebp - 0x428]
lea ecx, [ebp - 0x458]
push eax
push reloc.WS2_32.dll_accept
call fcn.004b3500
mov esi, dword [ebp - 0x458]
test eax, eax
jne 0x4b3832
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.004e5200
add esp, 0xc
mov dword [ebp - 0x448], 0x400
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
push str.Progid
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b3832
mov eax, dword [ebp - 0x44c]
cmp eax, 1
je 0x4b37c7
cmp eax, 2
jne 0x4b3832
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x4b3829
test al, 1
jne 0x4b3832
shr eax, 1
cmp word [ebp + eax*2 - 0x412], 0
jne 0x4b3832
xor eax, eax
cmp ax, word [ebp - 0x410]
je 0x4b3832
lea edx, [ebp - 0x410]
lea ecx, [ebp - 0x440]
call fcn.004b38d0
mov byte [ebp - 0x441], al
test esi, esi
je 0x4b380f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0
call fcn.0040b3f0
cmp byte [ebp - 0x441], 0
jne 0x4b385c
jmp 0x4b384c
xor eax, eax
mov word [ebp - 0x410], ax
test esi, esi
je 0x4b383d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0
call fcn.0040b3f0
mov edx, str.http
lea ecx, [ebp - 0x440]
call fcn.004b38d0
movups xmm0, xmmword [ebp - 0x440]
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x440]
mov dword [edi + 0x14], 0
xor eax, eax
movups xmmword [edi], xmm0
mov word [ebp - 0x440], ax
movq xmm0, qword [ebp - 0x430]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 7
call fcn.0040b3f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret
Function at 0x4b44f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5a992c]
push ebx
mov ebx, dword [ebp + 8]
test al, 1
jne 0x4b452f
or eax, 1
mov ecx, 0x5a9930
mov dword [0x5a992c], eax
call fcn.004ad0c0
push 0x53be60
call fcn.004e27b4
add esp, 4
cmp byte [0x5a21c0], 0
jne 0x4b46a8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e5200
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4b46a1
push edi
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x41c], 0
push 0
push eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x418], 0
call fcn.004e5200
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4b46a0
push esi
push edi
call fcn.004eec3a
mov esi, eax
add esp, 4
test esi, esi
je 0x4b469f
push esi
push edi
push dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4b4696
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push str.VarFileInfoTranslation
push esi
call edi
test eax, eax
je 0x4b4696
cmp dword [ebp - 0x418], 4
jb 0x4b4696
mov ecx, dword [ebp - 0x420]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x414]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.004b49d0
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
call edi
test eax, eax
je 0x4b4696
mov eax, dword [ebp - 0x418]
cmp eax, 2
jbe 0x4b4696
mov ecx, dword [ebp - 0x424]
cmp word [ecx + eax*2 - 2], 0
jne 0x4b468a
push ecx
mov ecx, 0x5a9930
call fcn.004ad300
jmp 0x4b4696
push eax
push ecx
mov ecx, 0x5a9930
call fcn.004ad370
push esi
call fcn.004e4a56
add esp, 4
pop esi
pop edi
mov byte [0x5a21c0], 1
cmp byte [0x5a9a4c], 0
mov eax, 0x5a993c
mov ecx, ebx
cmove eax, dword [0x5a9938]
add eax, 4
push eax
call fcn.004ad300
mov ecx, dword [ebp - 4]
mov al, byte [0x5a21c0]
xor ecx, ebp
pop ebx
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 4
Function at 0x4b5c90
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x130]
lea ebx, [esi + 0x130]
push edi
mov edi, dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp + 8]
mov eax, dword [eax + 0x18]
call eax
test al, al
je 0x4b5eaa
mov eax, dword [ebp + 8]
push ecx
push eax
mov ecx, ebx
call fcn.004b9310
test al, al
je 0x4b5eaa
mov dword [esi + 0x34c], ebx
mov eax, 0x552bc8
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esi + 8], ebx
cmp dword [eax], ebx
je 0x4b5d6e
add ecx, 0x10
add eax, 0x10
cmp ecx, 0x50
jb 0x4b5ce4
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x563c40
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
push ebx
push 0x561dc8
push esi
call fcn.004ad730
add esp, 0xc
cmp byte [edi + 0x11c], 0
je 0x4b5d31
add edi, 0xc
jmp 0x4b5d34
mov edi, dword [edi + 8]
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x563c54
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push 0
push 0x80
push edx
push 0
push eax
push ecx
mov dword [ebp - 4], ecx
mov ecx, edi
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
call fcn.004ad690
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
mov ebx, 1
cmp eax, 0xffffffff
jne 0x4b5e14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4b5dce
cmp ebx, 3
jge 0x4b5e4f
cmp byte [esi + 0x350], 0
je 0x4b5deb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b5deb
cmp eax, 5
jne 0x4b5e28
cmp ebx, 3
jge 0x4b5e4f
push 0x80
mov ecx, edi
call fcn.004ad690
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push dword [ebp + 0xc]
mov ecx, edi
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.004ad690
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc ebx
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4b5da7
push edi
lea ecx, [esi + 0xc]
call fcn.004b2940
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x4b5e4f
cmp byte [edi + 0x11c], al
je 0x4b5e39
add edi, 0xc
jmp 0x4b5e3c
mov edi, dword [edi + 8]
mov ecx, dword [ebp + 8]
push 0x563c10
call fcn.0040f580
lea ecx, [edi + 4]
push ecx
jmp 0x4b5eb7
cmp byte [edi + 0x11c], 0
je 0x4b5e5d
add edi, 0xc
jmp 0x4b5e60
mov edi, dword [edi + 8]
mov ecx, dword [ebp + 8]
push eax
call fcn.004af720
mov ecx, eax
call fcn.004af870
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x563c54
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x5624e0
push 0x561dd0
push eax
call fcn.004ad730
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b6010
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5397bb
mov eax, dword fs:[0]
push eax
sub esp, 0x360
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x36c]
call fcn.004b5b30
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - 0x18], vtable.t_fileWrite.1.0
mov dword [ebp - 4], 0
lea eax, [edi + 0xc]
cmp byte [edi + 0x11c], 0
jne 0x4b6079
mov eax, dword [edi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push edi
push ebx
lea ecx, [ebp - 0x36c]
call fcn.004b5c90
test al, al
je 0x4b60f1
push 2
push 0x56225c
push ebx
lea ecx, [ebp - 0x18]
call fcn.004b6c30
test al, al
je 0x4b60f1
push dword [esi + 0xc]
lea ecx, [ebp - 0x18]
push dword [esi + 4]
push ebx
call fcn.004b6c30
test al, al
je 0x4b60f1
lea ecx, [ebp - 0x36c]
call fcn.004b5ed0
push dword [esi + 4]
call fcn.004e4a56
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov bl, 1
mov dword [esi + 0xc], 0
jmp 0x4b60f3
xor bl, bl
lea ecx, [ebp - 0x36c]
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - 0x18], vtable.t_byteStreamWrite.0
call fcn.004b5bd0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b6570
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53983b
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x57c06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x4b65c9
push eax
call fcn.004e4a56
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push ecx
lea ecx, [ebp - 0x370]
call fcn.004b5b30
mov dword [ebp - method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [ebp - 0x1c], 0x563e7c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push esi
push ebx
lea ecx, [ebp - 0x370]
mov dword [ebp - 4], 0
call fcn.004b5c90
test al, al
je 0x4b6760
lea eax, [ebp - 0x374]
mov dword [ebp - 0x374], 0
push eax
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x378], eax
cmp eax, 0xffffffff
jne 0x4b664e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b6648
xor eax, eax
jmp 0x4b664e
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x36c]
mov dword [ebp - 0x378], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x374], eax
cmp eax, 0xffffffff
jne 0x4b6693
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b668d
xor eax, eax
mov dword [ebp - 0x374], eax
jmp 0x4b6693
mov eax, dword [ebp - 0x374]
add eax, 4
push eax
call fcn.004eec3a
add esp, 4
mov dword [ebp - 0x378], eax
test eax, eax
jne 0x4b66cc
mov dword [edi + 0x24], 2
lea edi, [esi + 0xc]
cmp byte [esi + 0x11c], al
jne 0x4b66be
mov edi, dword [esi + 8]
mov ecx, ebx
call fcn.004af720
push 0x563ce4
jmp 0x4b6702
push dword [ebp - 0x374]
lea ecx, [ebp - 0x1c]
push eax
push ebx
call fcn.004b6df0
test al, al
jne 0x4b6726
mov dword [edi + 0x24], 3
cmp byte [esi + 0x11c], 0
lea edi, [esi + 0xc]
jne 0x4b66f6
mov edi, dword [esi + 8]
mov ecx, ebx
call fcn.004af720
push 0x563c54
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
jmp 0x4b6767
lea ecx, [ebp - 0x370]
call fcn.004b5ed0
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x374]
xor edx, edx
mov ecx, dword [ebp - 0x378]
push eax
push ecx
push ebx
mov dword [ecx + eax], edx
mov ecx, edi
call fcn.004b6860
test al, al
jne 0x4b675c
mov dword [edi + 0x24], 4
jmp 0x4b66e7
mov bl, 1
jmp 0x4b6769
mov dword [edi + 0x24], 1
xor bl, bl
lea ecx, [ebp - 0x370]
mov dword [ebp - method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [ebp - 0x1c], vtable.t_byteStreamRead.0
call fcn.004b5bd0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e24d7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b6be0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4b6bfa
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004b5c90
test al, al
pop edi
setne al
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x4b6c30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b6cce
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x4b6c79
mov edi, dword [esi - 0x340]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
call fcn.004af720
mov ecx, eax
call fcn.004af870
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
call fcn.004af720
push 0x563c84
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
lea ecx, [edi + 4]
push ecx
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp - 4]
cmp edi, ebx
je 0x4b6d76
cmp byte [esi - 0x22c], 0
lea eax, [esi - 0x33c]
jne 0x4b6cee
mov eax, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
call fcn.004af720
push 0x563df4
mov esi, eax
push 0x561dd0
push esi
call fcn.004ad730
push 0x563e10
push 0x561dd0
push esi
call fcn.004ad730
push ebx
push 0x561dc8
push esi
call fcn.004ad730
push 0x563e1c
push 0x561dd0
push esi
call fcn.004ad730
push edi
push 0x561dc8
push esi
call fcn.004ad730
push 0x563e04
push 0x561dd0
push esi
call fcn.004ad730
mov eax, dword [ebp + 0x10]
add esp, 0x48
add eax, 4
push eax
push 0x561dd0
push esi
call fcn.004ad730
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc