joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422563
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov dword [ebp - 0x1cc], ecx
mov dword [ebp - 4], 1
push 0x59bd8c
lea eax, [ebp - 0x1a8]
push eax
call fcn.0054c45b
add esp, 8
mov ecx, dword [ebp - 0x1cc]
mov edx, dword [ecx + 0x5c]
push edx
mov eax, dword [ebp - 0x1cc]
push eax
push 8
push 0x59bcb0
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.0040171c
add esp, 0x14
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x1cc]
mov ecx, dword [eax + 0x5c]
push ecx
call fcn.004016bb
add esp, 8
cmp dword [0x5c5d0c], 0
je 0x4225e9
push str.IDC_BUTTON_DisConnect
lea edx, [ebp - 0x24]
push edx
call fcn.0054bec0
add esp, 8
jmp 0x4225fa
push str.IDC_BUTTON_Connect
lea eax, [ebp - 0x24]
push eax
call fcn.0054bec0
add esp, 8
push 0x20
lea ecx, [ebp - 0x1c8]
push ecx
push 0xc2d
mov ecx, dword [ebp - 0x1cc]
call fcn.00564186
mov ecx, eax
call fcn.00564356
lea edx, [ebp - 0x128]
push edx
push 0x20
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x1c8]
push ecx
push 0xc2d
mov ecx, dword [ebp - 0x1cc]
call fcn.00564186
mov ecx, eax
call fcn.0056432f
push 1
mov ecx, dword [ebp - 0x1cc]
call fcn.004089e0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x42aabb
Capabilities:
Delete file
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0054bec0
add esp, 8
push 0x2e
lea edx, [ebp - 0x20c]
push edx
call fcn.0054d880
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42aaf8
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0x70
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x42ab13
jmp 0x42abea
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x42ab2e
jmp 0x42abea
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.0054bec0
add esp, 8
push str.inf
lea edx, [ebp - 0x314]
push edx
call fcn.0054bed0
add esp, 8
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x42ab6b
jmp 0x42abea
push 0x20
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
push str.other
lea ecx, [ebp - 0x314]
push ecx
call fcn.0054bed0
add esp, 8
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x42abc1
jmp 0x42abea
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x4363d2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x208], 1
push 0x5a5f18
lea eax, [ebp - 0x310]
push eax
call fcn.0054c45b
add esp, 8
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 0x16c]
push edx
mov eax, dword [ebp - 0x314]
push eax
push 4
push 0x5a5e78
lea ecx, [ebp - 0x310]
push ecx
call fcn.0040171c
add esp, 0x14
lea edx, [ebp - 0x204]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004016bb
add esp, 8
mov dword [ebp - 0x290], 0
jmp 0x436457
mov ecx, dword [ebp - 0x290]
add ecx, 1
mov dword [ebp - 0x290], ecx
mov edx, dword [ebp - 0x290]
cmp edx, dword [0x5be010]
jge 0x4364f0
mov eax, dword [ebp - 0x290]
push eax
push str.Page_d
lea ecx, [ebp - 0x28c]
push ecx
call fcn.0054c45b
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x28c]
push ecx
lea edx, [ebp - 0x28c]
push edx
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 0x290]
add ecx, 0x323
push ecx
mov ecx, dword [ebp - 0x314]
call fcn.00564186
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x4364eb
lea edx, [ebp - 0x100]
push edx
mov ecx, dword [ebp - 0x20c]
call fcn.0056432f
jmp 0x436448
push 0x104
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x314]
call fcn.00564356
push 0x5a5f2c
lea ecx, [ebp - 0x204]
push ecx
call fcn.0054bed0
add esp, 8
mov edx, dword [ebp - 0x314]
add edx, 0x60
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
mov ecx, dword [ebp - 0x314]
call fcn.0056432f
push 1
mov ecx, dword [ebp - 0x314]
call fcn.004089e0
mov eax, dword [ebp - 0x208]
mov esp, ebp
pop ebp
ret 4
Function at 0x437340
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57086d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov dword [ebp - 0x240], ecx
mov eax, dword [ebp - 0x240]
cmp dword [eax + 0x5bc], 0
jne 0x437378
jmp 0x43759c
lea ecx, [ebp - 0x224]
call fcn.00438b80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00426870
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x240]
mov eax, dword [edx + 0x16c]
push eax
call fcn.004016bb
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x23c]
call fcn.00438b60
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], edx
push 0x86
lea ecx, [ebp - 0x224]
call fcn.00438ce0
push 0x5d95f8
push 0
push 0x400
push 0
lea ecx, [ebp - 0x224]
call fcn.00438cb0
push 0
lea ecx, [ebp - 0x224]
call fcn.00438c80
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x114], 0
jmp 0x43742c
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x21c]
call fcn.00438c40
cmp dword [ebp - 0x114], eax
jge 0x437559
mov ecx, dword [ebp - 0x114]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00438c60
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x437554
mov dword [ebp - 0x234], 0
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x244], edx
cmp dword [ebp - 0x244], 0x8006
je 0x4374a4
cmp dword [ebp - 0x244], 0x8007
je 0x4374bf
cmp dword [ebp - 0x244], 0x8008
je 0x4374da
jmp 0x4374f3
mov eax, dword [ebp - 0x240]
cmp dword [eax + 0x5c4], 0
je 0x4374bd
mov dword [ebp - 0x234], 1
jmp 0x4374f3
mov ecx, dword [ebp - 0x240]
cmp dword [ecx + 0x5c4], 0
jne 0x4374d8
mov dword [ebp - 0x234], 1
jmp 0x4374f3
mov edx, dword [ebp - 0x240]
cmp dword [edx + 0x5c4], 0
je 0x4374f3
mov dword [ebp - 0x234], 1
cmp dword [ebp - 0x114], 3
jae 0x437554
lea eax, [ebp - 0x218]
push eax
push pe_nt_image_headers32
lea ecx, [ebp - 0x110]
push ecx
push 0x5d95fc
mov edx, dword [ebp - 0x114]
mov eax, dword [edx*8 + 0x5a5e9c]
push eax
push str.SettingDlg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00438cb0
jmp 0x43741d
push 0
lea ecx, [ebp - 0x224]
call fcn.00438c80
mov dword [ebp - 0x10], eax
push 0
mov edx, dword [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
push 0
mov ecx, dword [ebp - 0x10]
call fcn.005624a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00438be0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x43ddf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x128], 1
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x230]
mov edx, dword [ecx + 0x5c]
push edx
call fcn.004016bb
add esp, 8
push str.SettingPTestOpt
lea eax, [ebp - 0x22c]
push eax
call fcn.0054c45b
add esp, 8
mov ecx, dword [ebp - 0x230]
mov edx, dword [ecx + 0x5c]
push edx
mov eax, dword [ebp - 0x230]
push eax
push 4
push 0x5a6fd0
lea ecx, [ebp - 0x22c]
push ecx
call fcn.0040171c
add esp, 0x14
push 0x42a
mov ecx, dword [ebp - 0x230]
call fcn.00564186
mov ecx, eax
call fcn.00406ac0
mov dword [ebp - 0x1ac], 0
jmp 0x43de8f
mov edx, dword [ebp - 0x1ac]
add edx, 1
mov dword [ebp - 0x1ac], edx
cmp dword [ebp - 0x1ac], 5
jge 0x43def6
mov eax, dword [ebp - 0x1ac]
push eax
push str.PTestMode_d
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.0054c45b
add esp, 0xc
lea edx, [ebp - 0x124]
push edx
push 0x20
lea eax, [ebp - 0x20]
push eax
push 0x5d967c
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x20]
push eax
push 0x42a
mov ecx, dword [ebp - 0x230]
call fcn.00564186
mov ecx, eax
call fcn.00406a90
jmp 0x43de80
push 1
mov ecx, dword [ebp - 0x230]
call fcn.004089e0
mov eax, dword [ebp - 0x128]
mov esp, ebp
pop ebp
ret 4

Function at 0x440773
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 0x5c]
push edx
call fcn.004016bb
add esp, 8
push 0x5a7b04
lea eax, [ebp - 0x20c]
push eax
call fcn.0054c45b
add esp, 8
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 0x5c]
push edx
mov eax, dword [ebp - 0x210]
push eax
push 0xf
push 0x5a78a8
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0040171c
add esp, 0x14
mov dword [ebp - 0x18c], 0
jmp 0x4407fb
mov edx, dword [ebp - 0x18c]
add edx, 1
mov dword [ebp - 0x18c], edx
cmp dword [ebp - 0x18c], 4
jae 0x44085d
mov eax, dword [ebp - 0x18c]
push eax
push str.SNMode_d
lea ecx, [ebp - 0x188]
push ecx
call fcn.0054c45b
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 0x20
mov eax, dword [ebp - 0x18c]
shl eax, 5
add eax, 0x5a7920
push eax
mov ecx, dword [ebp - 0x18c]
shl ecx, 5
add ecx, 0x5a7920
push ecx
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x4407ec
push 1
mov ecx, dword [ebp - 0x210]
call fcn.004089e0
mov eax, dword [ebp - 0x108]
mov esp, ebp
pop ebp
ret 4
Function at 0x4415f3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 0x5c]
push edx
call fcn.004016bb
add esp, 8
push str.SettingSNOpt
lea eax, [ebp - 0x20c]
push eax
call fcn.0054c45b
add esp, 8
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + 0x5c]
push edx
mov eax, dword [ebp - 0x210]
push eax
push 0xf
push 0x5a7b28
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0040171c
add esp, 0x14
mov dword [ebp - 0x18c], 0
jmp 0x44167b
mov edx, dword [ebp - 0x18c]
add edx, 1
mov dword [ebp - 0x18c], edx
cmp dword [ebp - 0x18c], 4
jae 0x4416dd
mov eax, dword [ebp - 0x18c]
push eax
push str.SNMode2_d
lea ecx, [ebp - 0x188]
push ecx
call fcn.0054c45b
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 0x20
mov eax, dword [ebp - 0x18c]
shl eax, 5
add eax, str.Disable_SN
push eax
mov ecx, dword [ebp - 0x18c]
shl ecx, 5
add ecx, str.Disable_SN
push ecx
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x44166c
push 1
mov ecx, dword [ebp - 0x210]
call fcn.004089e0
mov eax, dword [ebp - 0x108]
mov esp, ebp
pop ebp
ret 4
Function at 0x46d360
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push 0x5d969c
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054bec0
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
call fcn.0053534c
add esp, 4
push 0x20
push 0
lea edx, [ebp - 0x168]
push edx
call fcn.0054bfb0
add esp, 0xc
push 0x40
push 0
lea eax, [ebp - 0x148]
push eax
call fcn.0054bfb0
add esp, 0xc
push 0x5a8ba8
lea ecx, [ebp - 0x108]
push ecx
call fcn.0054bed0
add esp, 8
mov dword [ebp - 4], 0
jmp 0x46d3d5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x17
jge 0x46d412
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4764]
cmp edx, dword [eax + 0x5b8460]
jne 0x46d410
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
mov ecx, dword [eax + 0x5b845c]
push ecx
lea edx, [ebp - 0x168]
push edx
call fcn.0054bec0
add esp, 8
jmp 0x46d412
jmp 0x46d3cc
mov eax, dword [ebp + 0xc]
push eax
call fcn.0053534c
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x5a8bc0
push 0x5a8bd8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x46d4ae
lea edx, [ebp - 0x108]
push edx
push 0x40
lea eax, [ebp - 0x148]
push eax
push 0x5d96a0
lea ecx, [ebp - 0x168]
push ecx
push 0x5a8be8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x148]
push edx
call fcn.0054c3e0
add esp, 4
test eax, eax
je 0x46d49b
push 0x5a8bf8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0054bed0
add esp, 8
jmp 0x46d4ac
push 0x5a8c04
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054bed0
add esp, 8
jmp 0x46d4bf
push 0x5a8c18
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0054bed0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4bb428
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xa0], 0
cmp dword [ebp - 0x90], 4
jne 0x4bb49a
cmp dword [ebp - 0x8c], 0x5a
je 0x4bb498
mov dword [ebp - 0xa8], 1
jmp 0x4bb4de
cmp dword [ebp - 0x90], 5
jne 0x4bb4cb
cmp dword [ebp - 0x8c], 0
jne 0x4bb4b6
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x4bb4c9
mov dword [ebp - 0x98], 1
jmp 0x4bb4de
cmp dword [ebp - 0x90], 6
jne 0x4bb4de
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0xa0]
mov esp, ebp
pop ebp
ret
Function at 0x4bc7b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5711b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x114], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x124]
call fcn.00565486
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x29908], 0
push 0x14
push 0
mov edx, dword [ebp + 8]
add edx, 0x2990c
push edx
call fcn.0054bfb0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2f778], 0
je 0x4bc9ff
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x234]
call fcn.004cdd1d
cmp dword [ebp - 0x10], 0
jl 0x4bc9ff
mov dword [ebp - 0x228], 0
jmp 0x4bc86b
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jg 0x4bc9ea
lea ecx, [ebp - 0x224]
push ecx
call fcn.0053534c
add esp, 4
push 0x5ac88c
lea edx, [ebp - 0x224]
push edx
call fcn.0054bed0
add esp, 8
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x14
mov ecx, dword [eax + 0x5b845c]
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.0054bed0
add esp, 8
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x234]
call fcn.004cfade
cmp dword [ebp - 0x228], 0
je 0x4bc900
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x14
mov ecx, dword [eax + 0x5b8458]
push ecx
push str._sPTestD_d.BIN
lea edx, [ebp - 0x110]
push edx
call fcn.0054c45b
add esp, 0x10
jmp 0x4bc921
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x14
mov ecx, dword [eax + 0x5b8458]
push ecx
push str._sPTestB.Bin
lea edx, [ebp - 0x110]
push edx
call fcn.0054c45b
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.0054bed0
add esp, 8
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4bc9e3
push 0
push 0x40
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x124]
call fcn.00565598
test eax, eax
je 0x4bc9df
lea ecx, [ebp - 0x124]
call fcn.00565892
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x124]
call fcn.005656b5
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x22c]
mov dword [eax + edx*4 + 0x2990c], ecx
lea ecx, [ebp - 0x124]
call fcn.00565892
mov edx, dword [ebp - 0x228]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 0x29920], eax
lea ecx, [ebp - 0x124]
call fcn.00565892
mov edx, dword [ebp - 0x22c]
add edx, eax
mov dword [ebp - 0x22c], edx
lea ecx, [ebp - 0x124]
call fcn.005657b3
jmp 0x4bc9e1
jmp 0x4bc9ea
jmp 0x4bc9e5
jmp 0x4bc9ea
jmp 0x4bc85c
cmp dword [ebp - 0x228], 5
jne 0x4bc9ff
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x29908], ecx
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.005654db
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bdbd7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov dword [ebp - 0x208], ecx
push 0x64
push 1
push 0x8000
call fcn.00536ece
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x442c], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x442c], 0
jne 0x4bdc2c
push str.Open_Short_Buffer_alloc_Fail__
mov eax, dword [ebp - 0x208]
add eax, 0x22c4
push eax
call fcn.0054bec0
add esp, 8
xor eax, eax
jmp 0x4bddaf
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x4764], 0xe
jl 0x4bdc8b
mov edx, dword [ebp + 8]
cmp dword [edx + 0x4764], 0x1c
jg 0x4bdc8b
mov eax, dword [ebp + 8]
mov dword [eax + 0x3da0], 0x1000
push 0x8000
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x442c]
push edx
call fcn.0054bfb0
add esp, 0xc
push 0x1010
push 0x591a50
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x442c]
push ecx
call fcn.0054c980
add esp, 0xc
jmp 0x4bddaa
mov edx, dword [ebp + 8]
cmp dword [edx + 0x4764], 4
jl 0x4bdd9d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4764], 5
jg 0x4bdd9d
lea ecx, [ebp - 0x200]
push ecx
call fcn.0053534c
add esp, 4
push 0x5acbe8
lea edx, [ebp - 0x200]
push edx
call fcn.0054bed0
add esp, 8
push 0
push 3
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x208]
call fcn.004bf515
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4bdd9b
lea eax, [ebp - 0x200]
push eax
call fcn.004284fc
add esp, 4
push 0x5acbec
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054d3be
add esp, 8
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jne 0x4bdd4e
push str.OpenShort_File_not_found
mov edx, dword [ebp - 0x208]
add edx, 0x22c4
push edx
call fcn.0054bec0
add esp, 8
xor eax, eax
jmp 0x4bddaf
mov eax, dword [ebp - 0x204]
push eax
push 0x8000
push 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x442c]
push edx
call fcn.0054d276
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3da0], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3da0]
sub eax, 0x10
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3da0], eax
mov edx, dword [ebp - 0x204]
push edx
call fcn.0054d1f9
add esp, 4
jmp 0x4bddaa
mov eax, dword [ebp + 8]
mov dword [eax + 0x3da0], 0
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4bdf10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0x3fc0
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004c2ed5
mov ecx, dword [ebp + 8]
add ecx, 0x3fc0
push ecx
call fcn.0054c3e0
add esp, 4
test eax, eax
jne 0x4bdf56
xor eax, eax
jmp 0x4be033
mov dword [ebp - 0x10], 0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
add edx, 0x3fc0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4bdf8c
xor eax, eax
jmp 0x4be033
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x20
call fcn.0054e2f0
mov ecx, dword [ebp - 0x18]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x3db0], ecx
mov edx, dword [ebp - 4]
mov dword [eax + 0x3db4], edx
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
test eax, eax
je 0x4be021
push 0x64
push 1
push 0x200
call fcn.00536ece
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x4438], eax
push 0x200
mov edx, dword [ebp + 8]
add edx, 0x3fc0
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x4438]
push ecx
call fcn.0054c980
add esp, 0xc
jmp 0x4be02e
mov edx, dword [ebp + 8]
mov dword [edx + 0x4438], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4be31a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x35e0], 0
je 0x4be367
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
add ecx, 0x4208
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4be35b
xor eax, eax
jmp 0x4be384
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4be37f
mov eax, dword [ebp + 8]
add eax, 0x4104
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4be37f
xor eax, eax
jmp 0x4be384
mov eax, 1
mov esp, ebp
pop ebp
ret 4