joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4892c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x4c], 1
mov ebx, dword [esi + 0x1b8]
mov dword [ebp - 0x14], ebx
jne 0x4892e6
mov eax, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x4892eb
xor eax, eax
mov byte [ebx + 0x1c], al
push dword [esi + 0x64]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
push 1
mov eax, dword [ecx + 8]
push esi
call eax
mov dword [ebx + 0x18], eax
xor edi, edi
mov eax, dword [ebx + 0x14]
add esp, 0x10
cmp dword [esi + 0x64], edi
jle 0x4893d3
mov ecx, dword [ebx + edi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
je 0x489333
mov eax, dword [ebx + 0x18]
add dword [eax + edi*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov eax, dword [eax + edi*4]
mov dword [ebp - 8], eax
lea eax, [ecx - 1]
push eax
push ebx
push edi
push esi
call fcn.00489660
add esp, 0x10
mov edx, eax
xor esi, esi
cmp esi, edx
jle 0x48936e
mov eax, dword [ebp - 0x10]
inc ebx
dec eax
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.00489660
mov edx, eax
add esp, 0x10
cmp esi, edx
jg 0x489355
mov ecx, dword [ebp - 0xc]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 8]
mov byte [esi + eax], cl
inc esi
cmp esi, 0xff
jle 0x489351
cmp dword [ebp - 4], 0
je 0x4893c0
mov ebx, eax
mov ecx, 1
lea edx, [ebx - 1]
lea esp, [esp]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x4893a0
mov esi, dword [ebp + 8]
inc edi
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
cmp edi, dword [esi + 0x64]
jl 0x489316
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x499df0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
xor edx, edx
mov eax, dword [edi + 0x68]
test eax, eax
mov dword [edi], vtable.CFileWriterThread.0
cmovg edx, eax
test edx, edx
je 0x499e24
push str.m_queueItemsPending.Count____0
push 0x14bd
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.00522050
add esp, 0xc
test al, al
jne 0x499e24
int3
cmp dword [edi + 0x90], 0
je 0x499e49
push str.m_vecRegisteredWriters.Count____0
push 0x14be
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.00522050
add esp, 0xc
test al, al
jne 0x499e49
int3
cmp byte [edi + 0x94], 0
jne 0x499e6f
push 1
mov ecx, edi
call fcn.0049ccb0
mov ecx, edi
call fcn.00527840
test al, al
je 0x499e6f
push 0
mov ecx, edi
call fcn.00527d10
lea ecx, [edi + 0x80]
mov dword [edi + 0x90], 0
call fcn.00499020
lea ecx, [edi + 0x80]
call fcn.00499020
lea ecx, [edi + 0x70]
call fcn.00527650
lea ecx, [edi + 0x50]
call fcn.00499c10
lea ecx, [edi + 0x38]
call fcn.00527610
mov ecx, edi
pop edi
pop esi
jmp fcn.00527410
Function at 0x49a080
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push ecx
mov eax, esp
lea ecx, [ebp - 0x18]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 0xc]
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0049b910
movzx ecx, byte [ebp + 0x10]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49a0e4
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a0f4
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49a104
push eax
call fcn.005383c4
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49a114
push ecx
call fcn.005383c4
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a120
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
push 0
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x49a161
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x49a161
xor bl, bl
jmp 0x49a163
mov bl, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x49a173
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a183
push eax
call fcn.005383c4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a240
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, dword [ebp - 4]
je 0x49a293
test eax, eax
je 0x49a27d
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a28d
push eax
call fcn.005383c4
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x49a2a0
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a2b0
push eax
call fcn.005383c4
add esp, 4
push dword [ebp + 8]
call fcn.0049a2e0
add esp, 4
test al, al
je 0x49a28d
push dword [ebp + 8]
call fcn.0049c330
push dword [ebp + 8]
call fcn.0049d0b0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x49a2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49a320
push eax
call fcn.005383c4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x49a330
push ecx
call fcn.005383c4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a340
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push ecx
mov eax, esp
lea ecx, [ebp - 0x24]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebx], 0
mov dword [ebx + 4], 0
test edi, edi
je 0x49a381
mov dword [edi], 0
mov dword [edi + 4], 0
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x49a395
mov dword [esi], 0
mov dword [esi + 4], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49a3e1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
test edi, edi
je 0x49a3ce
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
test esi, esi
je 0x49a3dd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov bl, 1
jmp 0x49a3e3
xor bl, bl
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49a3f3
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x49a403
push eax
call fcn.005383c4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49a457
test al, 0x10
je 0x49a457
mov bl, 1
jmp 0x49a459
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x49a469
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a479
push eax
call fcn.005383c4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a560
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov dword [edi + 0x30], 0
cmp eax, 0xffffffff
je 0x49a593
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x49a58d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0xffffffff
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
and eax, 0xffffffb3
je 0x49a5e7
push eax
push str.unsupported_flags_0x_x_passed_to_CFileReader::BOpenFile
push 0x12e7
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.00522070
add esp, 0x10
test al, al
jne 0x49a5e4
int3
and ebx, 0x4c
cmp byte [edi + 0x2c], 0
je 0x49a6ef
mov eax, dword [ebp + 8]
xor esi, esi
push ecx
mov ecx, esp
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0xc]
call fcn.00499a00
push 0x3a
push dword [ebp - 8]
call fcn.00539d50
add esp, 8
test eax, eax
je 0x49a66d
mov ecx, dword [ebp - 8]
mov edx, 0x100
sub eax, ecx
lea esi, [eax + 2]
mov eax, 0xff
cmp esi, eax
cmova esi, eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ecx
lea eax, [ebp - 0x118]
push eax
call fcn.00532810
add esp, 0xc
mov byte [ebp + esi - 0x118], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
xor esi, esi
jmp 0x49a685
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
cmovne esi, dword [ebp + 0xc]
test eax, eax
je 0x49a6a9
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49a6c0
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 8], 0
mov dword [edi + 0x30], esi
test esi, esi
je 0x49a6cc
or ebx, 2
jmp 0x49a6ef
push dword [ebp + 8]
push str.Failed_to_get_sector_size_for_drive_file__s_is_on__not_using_unbuffered_IO
push 0x12f6
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.00522070
add esp, 0x10
test al, al
jne 0x49a6eb
int3
mov byte [edi + 0x2c], 0
push edi
push ebx
test bl, 0x40
mov ecx, 0
push 0
mov eax, 3
cmovne eax, ecx
push eax
push 1
push dword [ebp + 8]
call fcn.0049b1c0
add esp, 0x18
test eax, eax
jne 0x49a725
cmp dword [edi], 0xffffffff
je 0x49a725
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49ab50
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
call fcn.0049c330
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49ab96
push eax
call fcn.005383c4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x49aba6
push ecx
call fcn.005383c4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49abb0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
push ecx
mov eax, esp
lea ecx, [ebp - 0x434]
mov dword [eax], 0x6cf5b0
push dword [ebp + 8]
call fcn.00499750
lea ecx, [ebp - 0x434]
call fcn.0049a480
test al, al
je 0x49acd8
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea esp, [esp]
push dword [ebp + 8]
push ecx
mov eax, esp
lea ecx, [ebp - 0x428]
mov dword [eax], ecx
lea ecx, [ebp - 0x18]
call fcn.00499a00
mov eax, dword [ebp - 0x42c]
mov esi, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, ecx
shr eax, 4
test al, 1
je 0x49ac86
shr ecx, 0xa
test cl, 1
je 0x49ac7a
push esi
call fcn.0049c330
mov eax, esp
lea ecx, [ebp - 0xc]
push esi
mov dword [eax], 0
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call edi
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
test eax, eax
je 0x49ac64
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49ac93
push eax
call fcn.005383c4
mov dword [ebp - 8], 0
jmp 0x49ac90
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.0049abb0
jmp 0x49ac90
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.0049a240
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], vtable.CPathString.0
test eax, eax
je 0x49acb1
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 0x10], 0
test esi, esi
je 0x49acc5
push esi
call fcn.005383c4
add esp, 4
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x434]
call fcn.0049a480
test al, al
jne 0x49abf0
push dword [ebp + 8]
call fcn.0049ab50
mov ecx, dword [ebp - 0x430]
add esp, 4
mov bl, al
cmp ecx, 0xffffffff
je 0x49acf7
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x250
push dword [ebp - 0x42c]
call fcn.005383ad
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ad20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push ecx
mov eax, esp
lea ecx, [ebp - 0x18]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 0xc]
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0049b910
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49ad81
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49ad91
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49ada1
push eax
call fcn.005383c4
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49adb1
push ecx
call fcn.005383c4
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49afb0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push ecx
mov eax, esp
lea ecx, [ebp - 0x18]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
mov edi, dword [ebp - 0x14]
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
push edi
mov dword [eax], 0
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49b007
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49b017
push eax
call fcn.005383c4
add esp, 4
test bl, bl
jne 0x49b13a
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49b024
sub ecx, edx
lea esi, [edi - 1]
add esi, ecx
cmp esi, edi
jbe 0x49b0a9
cmp byte [esi], 0x5c
jne 0x49b0a1
push ecx
mov eax, esp
mov byte [esi], 0
push edi
lea ecx, [ebp - 0xc]
mov dword [eax], 0
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49b083
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49b09a
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 8], 0
mov byte [esi], 0x5c
test bl, bl
jne 0x49b0a8
dec esi
cmp esi, edi
ja 0x49b036
jmp 0x49b0a9
inc esi
mov al, byte [esi]
test al, al
je 0x49b125
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp al, 0x5c
jne 0x49b11d
push ecx
mov eax, esp
mov byte [esi], 0
push edi
lea ecx, [ebp - 0xc]
mov dword [eax], 0
call fcn.00499a00
push 0
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x49b0e5
call ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], vtable.CPathString.0
test eax, eax
je 0x49b103
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49b11a
push eax
call fcn.005383c4
add esp, 4
mov dword [ebp - 8], 0
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x49b0b5
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.0049a120
add esp, 4
test al, al
jne 0x49b13a
xor bl, bl
jmp 0x49b13c
mov bl, 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49b14c
push eax
call fcn.005383c4
add esp, 4
test edi, edi
je 0x49b159
push edi
call fcn.005383c4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b1c0
Capabilities:
Inspect section memory permissions
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ecx
mov eax, esp
lea ecx, [ebp - 0x14]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
mov eax, dword [ebp + 0x1c]
mov ecx, ebx
shl ecx, 0x1f
mov edx, ecx
or edx, 0x40000000
mov dword [eax], 0xffffffff
mov eax, ebx
and al, 2
mov eax, 0xc0000000
cmove edx, ecx
cmp ebx, 4
cmove edx, eax
mov eax, edx
or eax, 4
and bl, 8
cmove eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
cmp eax, 7
ja case.default.0x49b253
jmp dword [eax*4 + 0x49b364]
xor edi, edi
jmp 0x49b247
mov edi, 1
jmp 0x49b247
mov edi, 2
jmp 0x49b247
mov edi, 3
jmp 0x49b247
mov edi, 7
mov eax, dword [ebp + 0x14]
cmp eax, 3
ja case.default.0x49b253
jmp dword [eax*4 + 0x49b384]
mov ebx, 3
jmp 0x49b274
mov ebx, 4
jmp 0x49b274
mov ebx, 1
jmp 0x49b274
mov ebx, 2
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
and ecx, 1
shl ecx, 0x1e
sub ecx, 0xffffff80
mov edx, ecx
or edx, 0x20000000
and al, 2
cmove edx, ecx
mov ecx, dword [ebp + 0x18]
mov esi, edx
mov eax, ecx
or esi, 0x8000000
and al, 8
cmove esi, edx
test cl, 0x10
je 0x49b2b3
and esi, 0xffffff7f
or esi, 0x100
mov eax, ecx
mov ecx, esi
or ecx, 0x4000000
and al, 0x20
push 0
cmove ecx, esi
push ecx
push ebx
push 0
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 0x1c]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x49b2ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x49b339
mov ebx, dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileTime]
test bl, 4
je 0x49b316
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push ecx
push 0
push eax
mov dword [ebp - 4], 0xffffffff
call esi
test bl, bl
jns 0x49b330
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [edi]
call esi
xor esi, esi
jmp 0x49b339
mov esi, 0x57
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49b349
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49b359
push eax
call fcn.005383c4
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b5a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
test eax, eax
push ebx
lea ebx, [ebp - 4]
cmovne ebx, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
xor ebx, ebx
test edi, edi
je 0x49b610
xor esi, esi
lea eax, [ebp + 0x14]
push esi
push eax
mov ecx, 0x40000000
mov dword [ebp + 0x14], esi
cmp edi, ecx
mov eax, edi
cmova eax, ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x49b5fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x49b603
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x49b607
test ebx, ebx
jne 0x49b610
add dword [ebp + 0xc], esi
add ebx, esi
sub edi, esi
jmp 0x49b5bc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49b710
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push ecx
mov eax, esp
lea ecx, [ebp - 0x1c]
xor edi, edi
mov dword [eax], edi
push dword [ebp + 8]
call fcn.00499a00
mov ebx, dword [ebp - 0x18]
push 0x3a
push ebx
call fcn.00539d50
add esp, 8
test eax, eax
je 0x49b78d
sub eax, ebx
mov ecx, 0x100
lea esi, [eax + 2]
mov eax, 0xff
cmp esi, eax
cmova esi, eax
cmp esi, ecx
mov eax, esi
cmova eax, ecx
push eax
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.00532810
add esp, 0xc
mov byte [ebp + esi - 0x11c], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x11c]
push eax
jmp 0x49b79f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov eax, dword [ebp - 0x14]
cmovne edi, dword [ebp - 4]
test eax, eax
je 0x49b7bb
push eax
call fcn.005383c4
add esp, 4
test ebx, ebx
je 0x49b7c8
push ebx
call fcn.005383c4
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c330
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push ecx
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00499a00
lea ecx, [ebp - 0xc]
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49c37a
test al, 3
je 0x49c376
and eax, 0xfffffffc
lea ecx, [ebp - 0xc]
push eax
call fcn.0049b910
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x49c37c
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x49c38c
push eax
call fcn.005383c4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49c39c
push eax
call fcn.005383c4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x49c864
mov edi, dword [esi + 0x20]
lea ecx, [ebp - 4]
push ebx
xor ebx, ebx
push ebx
push ecx
push edi
push dword [esi + 0x10]
mov dword [ebp - 4], ebx
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x49c83d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x49c840
jmp 0x49c844
mov ebx, dword [ebp - 4]
cmp edi, ebx
je 0x49c851
mov eax, dword [esi + 4]
mov ecx, 1
add eax, 0x1c
xchg dword [eax], ecx
mov eax, dword [esi + 4]
neg edi
add eax, 0x18
lock xadd dword [eax], edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
test eax, eax
je 0x49c92f
cmp byte [eax], 0
je 0x49c92f
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, dword [esi + 8]
mov edi, 0x6cca60
test ecx, ecx
mov edx, edi
push eax
cmovne edx, ecx
lea eax, [ebp - 0x14]
push edx
push str._s.async_u.tmp
push eax
call fcn.0049e1d0
add esp, 0x10
cmp byte [ebp - 5], 0
jge 0x49c8b0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x49c8b3
mov eax, edi
jmp 0x49c8b3
lea eax, [ebp - 0x14]
push 1
push eax
lea eax, [esi + 0xc]
push eax
call fcn.0049c960
add esp, 0xc
test al, al
je 0x49c912
mov eax, dword [esi + 8]
test eax, eax
cmovne edi, eax
cmp byte [ebp - 5], 0
jge 0x49c8e2
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x49c8e5
mov eax, 0x6cca60
jmp 0x49c8e5
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0049ad20
add esp, 8
test al, al
jne 0x49c912
cmp byte [ebp - 5], al
jge 0x49c906
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x49c909
mov eax, 0x6cca60
jmp 0x49c909
lea eax, [ebp - 0x14]
push eax
call fcn.0049d0b0
add esp, 4
cmp byte [ebp - 5], 0
jge 0x49c94b
call fcn.00521c10
push 0
push dword [ebp - 0x14]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Invalid_FileWriterItem_t
push 0x1440
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.00522050
add esp, 0xc
test al, al
jne 0x49c94b
int3
pop edi
pop esi
mov esp, ebp
pop ebp
ret