joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd5d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.004d29f0
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5c3210]
cmp eax, 0xffffffff
je 0x4cd602
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
jne 0x4cd617
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, 0xfffffffc
mov esi, 0x800
lea edi, [ebp - 0x810]
push esi
push 0xff
push edi
call fcn.004d5a00
add esp, 0xc
push esi
push ebx
push edi
call fcn.004d4f00
add esp, 0xc
mov ecx, dword [0x5c3210]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.00401720
add esp, 8
test ebx, ebx
je 0x4cd668
push ebx
call fcn.004cffe7
add esp, 4
mov eax, dword [0x5c7164]
mov ecx, dword [0x5c7534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x4cd738
mov esi, dword [0x5c7160]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4cd77d
lea eax, [ebp - 0x1410]
push 0xc00
push 0x5c6560
push eax
call fcn.004d4f00
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ebx, 0x100
test al, 1
je 0x4cd723
xor esi, esi
lea edi, [ebp - 0x1408]
xor eax, eax
mov ecx, dword [ebp + esi*8 - 0x810]
test ecx, ecx
jne 0x4cd6ec
inc esi
add edi, 0xc
cmp esi, 0x100
jne 0x4cd6d3
jmp 0x4cd719
cmp dword [edi - 8], 0
je 0x4cd6de
mov edx, dword [ebp + esi*8 - 0x80c]
cmp edx, dword [edi]
jne 0x4cd6de
mov edx, dword [edi - 4]
test edx, edx
je 0x4cd6de
mov dword [ebp + esi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x4cd6de
lea ecx, [ebx - 1]
cmp ebx, 2
mov ebx, ecx
jae 0x4cd6c5
push 2
push dword [ebp - 0x1414]
call fcn.00401720
add esp, 8
jmp 0x4cd602
push 0x5c7164
call fcn.004d02b9
add esp, 4
cmp dword [0x5c7164], 0xffffffff
jne 0x4cd689
push 4
call fcn.004cf0a6
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.004c1420
mov dword [0x5c7160], esi
push 0x5c7164
call fcn.004d03d3
add esp, 4
jmp 0x4cd689
mov ecx, esi
call fcn.004c2c70
jmp 0x4cd69e

Function at 0x4cde80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4cdebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4cded2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4cdeb4
mov dword [esi], ebx
call fcn.004bafe0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x4cdee9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004bafe0
push dword [esi]
call fcn.004c1b90
add esp, 4
mov dword [esi], 0
jmp 0x4cdea5
int3

Function at 0x4f2def
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f3038

Function at 0x4f6959
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f6964
Function at 0x500d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x58], eax
xor eax, eax
dec eax
lea edi, [esp + 0x20]
mov dword [edi + 0x34], eax
mov dword [esp + 0xc], eax
mov dword [edi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x3c1
push str..._.._base_files_file_util_win.cc
push 0x57e0f1
push ebx
call fcn.004c10c0
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
push ebx
call fcn.004c7be0
cmp byte [esi + 0xb], 0
jns 0x500dfc
mov esi, dword [esi]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x57e010]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x500e43
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, 0xffffffff
je 0x500eb1
call fcn.004bafe0
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [ebx + 1]
cmp esi, 2
jb 0x500e7e
mov eax, dword [ebp + 0xc]
xor edi, edi
dec edi
mov dword [esp + 0x10], edi
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [ebp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebp + 0x10]
cmove edi, ecx
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, edi
mov dword [esp + 0xc], ecx
cmp esi, 2
jb 0x500e91
call fcn.004bafe0
push ebx
call fcn.004c1b90
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004c7b60
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004d25a3
mov eax, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x500e3c

Function at 0x501a80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00501ad0
mov ecx, eax
call fcn.004ba5b0
test eax, eax
jne 0x501ab7
call fcn.00501ad0
mov esi, eax
push 0xc
call fcn.004cf0a6
add esp, 4
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
mov ecx, esi
push eax
call fcn.004b9f80
call fcn.00501ad0
mov ecx, eax
pop esi
pop ebp
jmp fcn.004ba5b0

Function at 0x5024d0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.004d5a00
add esp, 0xc
lea eax, [ebp - 0x218]
mov dword [eax], 0x101
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x50252f
mov ecx, esi
push str.UICreated_
call fcn.00414d50
mov ecx, esi
push ebx
call fcn.0041e580
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x502670
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x188
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x180], eax
lea esi, [esp + 0x70]
push 0x110
push 0
push esi
call fcn.004d5a00
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x5026d7
cmp dword [esp + 0x70], 5
seta bl
mov ecx, dword [esp + 0x180]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.00501dd0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x2e
push str.IsVistaOrGreater
push 1
call fcn.00501b30
lea ecx, [esp + 0x4c]
push 0x57a182
push str.Cant_get_Windows_version_info
call fcn.004fc970
mov ecx, esi
call fcn.00501b70
cmp byte [edi + 0xb], 0
jns 0x50272c
push dword [esp + 4]
call fcn.004cf0d6
add esp, 4
xor ebx, ebx
jmp 0x5026bf

Function at 0x502730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x18
pop ebp
ret 4

Function at 0x5029d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004d00f2
add esp, 4
add eax, eax
add eax, 2
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5048a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004d0370
add esp, 0x10
cmp eax, esi
jne 0x504923
cmp ebx, 1
je 0x5048c5
cmp ebx, 2
mov esi, 0xffffffff
je 0x504926
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.004d031b
add esp, 4
neg eax
sbb esi, esi
jmp 0x504926
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x504940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x504969
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.004d0370
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
test esi, esi
jle 0x504991
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x504993
inc edi
cmp esi, edi
mov eax, ebx
jne 0x504972
mov edi, esi
jmp 0x504993
xor edi, edi
mov eax, edi
add esp, 4
jmp 0x504962
Function at 0x5049a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x5049ed
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x504a07
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.004d0370
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x5049ef
jmp 0x5049f1
xor ebx, ebx
mov esi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x504a8a
mov ebx, eax
cmp eax, 3
je 0x504a75
cmp ebx, 1
ja 0x504a8a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004d0370
add esp, 0x10
cmp eax, esi
jne 0x504a8a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x504a12
mov ebx, dword [ebp + 8]
jmp 0x5049ef
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004d0370
add esp, 0x10
cmp eax, ebx
je 0x504a6d
xor esi, esi
dec esi
jmp 0x5049f1

Function at 0x504ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x504af9
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.004d0370
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
test esi, esi
jle 0x504b22
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x504b24
inc edi
cmp esi, edi
mov eax, ebx
jne 0x504b02
mov edi, esi
jmp 0x504b24
xor edi, edi
mov eax, edi
add esp, 4
jmp 0x504af2
Function at 0x504b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x504b7f
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x504b97
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.004d0370
add esp, 0x10
cmp eax, 1
je 0x504b81
xor esi, esi
dec esi
jmp 0x504b81
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x504b7a
mov ebx, eax
cmp eax, 3
je 0x504c06
cmp ebx, 1
ja 0x504b7a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004d0370
add esp, 0x10
cmp eax, esi
jne 0x504b7a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x504ba2
movzx esi, word [ebp + 8]
jmp 0x504b81
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004d0370
add esp, 0x10
cmp eax, ebx
jne 0x504b7a
jmp 0x504bfd
Function at 0x51a010
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004cc630
test al, al
jne 0x51a02e
mov ecx, esi
call fcn.004cc630
test al, al
je 0x51a033
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.0051a040

Function at 0x51a040
Capabilities:
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov edi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x98], eax
xor eax, eax
dec eax
lea esi, [esp + 0x10]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x60]
push 0x46e
push str..._.._base_files_file_util_win.cc
push str.MoveUnsafe
push ebx
call fcn.004c10c0
add esp, 0x10
mov ecx, esi
mov esi, edi
push 0
push ebx
call fcn.004c7be0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x51a0b4
mov ecx, dword [esi + 4]
cmp ecx, 0x103
jbe 0x51a0df
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.004c7b60
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0xc]
movzx edx, byte [edi + 0xb]
mov ecx, edx
test dl, dl
jns 0x51a0ef
mov ecx, dword [edi + 4]
cmp ecx, 0x103
ja 0x51a0bc
mov ecx, edi
test dl, dl
jns 0x51a0ff
mov ecx, dword [edi]
mov edx, esi
test al, al
jns 0x51a107
mov edx, dword [esi]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x51a0be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
lea esi, [esp + 0x60]
xor eax, eax
dec eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea eax, [esp + 0x50]
push 0x210
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push eax
call fcn.004c10c0
add esp, 0x10
mov ecx, esi
push 0
lea eax, [esp + 0x54]
push eax
mov esi, dword [ebp + 8]
call fcn.004c7be0
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x51a177
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
lea ecx, [esp + 0x60]
call fcn.004c7b60
xor eax, eax
dec eax
cmp esi, eax
je 0x51a195
and esi, 0x10
jne 0x51a1a4
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x51a0bc
push edi
push dword [ebp + 8]
call fcn.005208c0
add esp, 8
test al, al
jne 0x51a0be
jmp 0x51a195
Function at 0x51a620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x5c64c4], 0
je 0x51a658
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x5c64b4]
test esi, esi
je 0x51a6f1
test byte [0x5c31f0], 1
je 0x51a641
cmp byte [esi + 0xb], 0
jns 0x51a677
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x57d610]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5c64c4], eax
inc eax
cmp eax, 1
ja 0x51a641
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.004d5a00
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x51a6ea
cmp eax, 0x104
jbe 0x51a7ce
xor ebx, ebx
jmp 0x51a641
push 0xc
call fcn.004cf0a6
add esp, 4
mov esi, eax
lea ebx, [ebp - 0x218]
push 0x208
push 0xff
push ebx
call fcn.004d5a00
add esp, 0xc
xor edi, edi
push 0x104
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
push ebx
call fcn.004d00f2
add esp, 4
cmp eax, 0x7ffffff0
jae 0x51a866
mov ebx, eax
cmp eax, 5
jae 0x51a753
mov byte [esi + 0xb], bl
mov edi, esi
test ebx, ebx
jne 0x51a775
jmp 0x51a78a
lea edi, [ebx + 8]
and edi, 0xfffffff8
lea eax, [edi + edi]
push eax
call fcn.004cf0a6
add esp, 4
mov dword [esi], eax
or edi, 0x80000000
mov dword [esi + 8], edi
mov edi, eax
mov dword [esi + 4], ebx
mov eax, ebx
add eax, ebx
push eax
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.004d4f00
add esp, 0xc
mov word [edi + ebx*2], 0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x51a79b
mov eax, dword [esi + 4]
mov ecx, esi
push eax
push 0x5c
call fcn.004c9900
cmp eax, 0xffffffff
mov bl, 1
je 0x51a7b7
inc eax
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.0040ad20
mov ecx, esi
push 0x57d694
call fcn.0041e580
mov dword [0x5c64b4], esi
jmp 0x51a666
mov ecx, dword [0x5c64b4]
push esi
call fcn.00414d50
mov ecx, dword [0x5c64b4]
movzx eax, byte [ecx + 0xb]
test al, al
js 0x51a85f
mov edx, ecx
cmp word [edx + eax*2 - 2], 0x5c
je 0x51a802
push 0x57d690
call fcn.0041e580
mov ecx, dword [0x5c64b4]
push 0x57d694
call fcn.0041e580
mov eax, dword [0x5c64b4]
cmp byte [eax + 0xb], 0
jns 0x51a819
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x57d610]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5c64c4], eax
inc eax
cmp eax, 1
ja 0x51a641
mov dword [0x5c64c4], 0
jmp 0x51a6ea
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
jmp 0x51a7ea
mov ecx, esi
call fcn.004fc800
int3
Function at 0x51f980
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov esi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x2a4]
push 0x294
push 0xff
push edi
call fcn.004d5a00
add esp, 0xc
mov ecx, edi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push esi
call fcn.00520970
xor eax, eax
dec eax
lea esi, [ebp - 0x500]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, edi
push esi
call fcn.0042c670
movzx eax, byte [esi + 0xb]
test al, al
jns 0x51f9ed
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x51fb54
lea ebx, [ebp - 0x4f4]
xor esi, esi
push 0x250
push 0xff
push ebx
call fcn.004d5a00
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00519f90
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x51fa82
mov ecx, ebx
call fcn.005203d0
test al, al
je 0x51fac9
xor edi, edi
cmp byte [ebp + 8], 0
je 0x51fb01
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.0051f980
add esp, 4
mov edi, eax
test eax, eax
jne 0x51fb01
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
js 0x51fb83
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, 0
jmp 0x51fae7
cmp byte [ebp + 8], 0
je 0x51faad
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x51faa0
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x51fa26
mov ecx, ebx
call fcn.005203d0
test al, al
je 0x51fb49
mov ecx, ebx
call fcn.005203d0
xor edi, edi
test al, al
jne 0x51fb01
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x51fade
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
test eax, eax
jne 0x51fb01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove edi, eax
test esi, esi
cmovne edi, esi
mov ecx, ebx
call fcn.004ff490
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0042c670
lea ecx, [ebp - 0x500]
push ebx
call fcn.00411710
mov ecx, ebx
call fcn.004c5e70
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x51fb3d
mov eax, dword [ebp - 0x4fc]
mov esi, edi
test eax, eax
jne 0x51f9fd
jmp 0x51fb56
mov eax, dword [ebp - 0x4f4]
jmp 0x51fa88
xor edi, edi
lea ecx, [ebp - 0x500]
call fcn.004c5e70
lea ecx, [ebp - 0x2a4]
call fcn.00430980
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, edi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x500]
jmp 0x51fa74

Function at 0x51fb90
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.0041a500
Function at 0x51fba0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x48], eax
xor eax, eax
dec eax
lea esi, [esp + 0x10]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1a9
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.004c10c0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004c7be0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x51fc0a
mov ecx, dword [edi + 4]
cmp ecx, 0x103
jbe 0x51fc16
xor ebx, ebx
jmp 0x51fc2c
test al, al
jns 0x51fc1c
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.004c7b60
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret