joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d34c0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov ebx, esp
push 0x5a
push str....._base_system_sys_info_win.cc
push str.AmountOfFreeDiskSpace
push ebx
call fcn.004b6370
add esp, 0x10
lea esi, [esp + 0x20]
mov ecx, esi
push 0
push ebx
call fcn.0050b630
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
cmp byte [edi + 0xb], 0
jns 0x4d3552
mov edi, dword [edi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [esp + 4]
cmp edx, 0x7fffffff
mov ecx, SysReAllocString
cmovb ecx, edx
mov edi, 0xffffffff
test edx, edx
js 0x4d3582
mov edi, dword [esp]
xor ebx, ebx
cmp eax, 1
sbb ebx, ebx
or edi, ebx
or ebx, ecx
mov ecx, esi
call fcn.0050b690
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005dd6f3
mov eax, edi
mov edx, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d3fa0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm1, qword [0x686148]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x4d411c
jp 0x4d411c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x686158]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4d4141
mov eax, dword [0x686168]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4d417a
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea ebx, [esp + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esi, dword [0x686160]
sbb edi, dword [0x686164]
movd xmm0, edi
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm0, qword [esp + 0x30]
pxor xmm1, xmm1
movsd xmm2, qword [0x625d08]
ucomisd xmm2, xmm0
ja 0x4d411c
mov eax, dword [esp + 8]
sub eax, dword [0x686150]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x686154]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x625ce0]
subpd xmm2, xmmword [0x625cf0]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x686148], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.005dd6f3
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x686158
call fcn.005dc7c7
add esp, 4
cmp dword [0x686158], 0xffffffff
jne 0x4d4012
rdtsc
mov dword [0x686150], eax
mov dword [0x686154], edx
push 0x686158
call fcn.005dc83d
add esp, 4
jmp 0x4d4012
push 0x686168
call fcn.005dc7c7
add esp, 4
cmp dword [0x686168], 0xffffffff
jne 0x4d4033
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [0x686164], ecx
mov dword [0x686160], eax
push 0x686168
call fcn.005dc83d
add esp, 4
jmp 0x4d4033
Function at 0x4d5550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x4d55e6
mov esi, ecx
mov dword [esp + 0x14], 0x9ff00ff
mov dword [esp + 0xc], 0x63736964
mov dword [esp + 0x10], 0x65647261
mov byte [esp + 0x14], 0x64
lea eax, [esp + 0xc]
mov edi, esp
push eax
push edi
call fcn.004d54c0
push 0x48
call fcn.005dc726
add esp, 4
mov ebx, eax
mov ecx, eax
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x14]
push eax
call fcn.004d44a0
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x4d55d0
mov ecx, edi
call fcn.004d4510
push edi
call fcn.005dc756
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x4d55e3
push dword [esp + 0xc]
call fcn.005dc756
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.005dd6f3
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4da520
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x4da58d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4da560
cmp edx, 1
jne 0x4da596
jmp 0x4da5b2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x4da5b2
cmp edx, 2
je 0x4da5a9
cmp edx, 3
jne 0x4da5bd
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x4da718
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov edx, edi
shr edx, 1
and edx, 0x55555555
mov eax, edi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x4da626
lea edx, [edi - 1]
and edx, ebx
jmp 0x4da632
mov edx, ebx
cmp ebx, edi
jb 0x4da632
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4da718
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x4da718
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4da686
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x4da716
mov ebx, dword [ebx]
test ebx, ebx
je 0x4da716
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
jne 0x4da6e0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x4da69b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x4da67c
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x4da6f8
cmp dword [ebp - 0x10], 0
je 0x4da712
cmp byte [esi], dl
jne 0x4da67c
dec eax
xor ecx, ecx
nop dword [eax]
cmp eax, ecx
je 0x4da712
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x4da6c0
jmp 0x4da67c
cmp dword [ebp - 0x28], 1
jbe 0x4da670
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x4da673
xor edx, edx
div ecx
mov eax, edx
jmp 0x4da673
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4da712
push eax
push esi
push ecx
call fcn.005de9dd
add esp, 0xc
test eax, eax
jne 0x4da67c
mov ecx, ebx
jmp 0x4da718
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4f15fa
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
call fcn.004bb260
mov dword [ebp - 0x34], eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push dword [ebp - 0x34]
push esi
push eax
push str..pipemojo._lu._lu._I64u
push ebx
call fcn.004c0f20
add esp, 0x18
mov dword [ebp - 0x34], esp
push eax
mov edi, esp
cmp byte [ebx + 0xb], 0
jns 0x4f165c
mov ebx, dword [ebp - 0x1c]
sub esp, 0x20
xor esi, esi
mov dword [esp + 0x1c], esi
movaps xmm0, xmmword [0x628410]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x18], 0x1388
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi], esi
mov ecx, edi
push eax
call fcn.0041dc1e
lea ebx, [ebp - 0x28]
mov ecx, ebx
call fcn.004f1b32
mov esp, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
mov ecx, esi
push ebx
call fcn.004f1b0c
mov ecx, ebx
call fcn.004f1b60
mov eax, dword [esi + 4]
inc eax
cmp eax, 1
ja 0x4f16da
push 0x4a
push str.....mojopubliccppplatformplatform_channel.cc
push ebx
call fcn.00541fc0
add esp, 0xc
mov ecx, ebx
call fcn.00541f80
mov ecx, ebx
call fcn.00541f90
mov dword [ebp - 0x34], esp
mov eax, dword [0x6284b4]
mov dword [ebp - 0x20], eax
movsd xmm0, qword [0x6284ac]
movsd qword [ebp - 0x28], xmm0
push eax
mov edi, esp
cmp byte [ebp - 0x11], 0
jns 0x4f1700
mov eax, dword [ebp - 0x1c]
jmp 0x4f1703
lea eax, [ebp - 0x1c]
xor esi, esi
push esi
push 0x40100000
push 3
push ebx
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], esi
mov ecx, edi
push eax
call fcn.0041dc1e
lea ebx, [ebp - 0x30]
mov ecx, ebx
call fcn.004f1b32
mov esp, dword [ebp - 0x34]
mov esi, dword [ebp - 0x3c]
mov ecx, esi
push ebx
call fcn.004f1b0c
mov ecx, ebx
call fcn.004f1b60
mov eax, dword [esi + 4]
inc eax
cmp eax, 1
ja 0x4f176b
push 0x57
push str.....mojopubliccppplatformplatform_channel.cc
push ebx
call fcn.00541fc0
add esp, 0xc
mov ecx, ebx
call fcn.00541f80
mov ecx, ebx
call fcn.00541f90
push 0
mov eax, dword [ebp - 0x38]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4f17cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x4f17ad
cmp byte [ebp - 0x11], 0
jns 0x4f179b
push dword [ebp - 0x1c]
call fcn.005dc756
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5c
push str.....mojopubliccppplatformplatform_channel.cc
push ebx
call fcn.00541fc0
add esp, 0xc
mov ecx, ebx
call fcn.00541f80
mov ecx, ebx
call fcn.00541f90
jmp 0x4f178a
int3
Function at 0x4f503e
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4f5060
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4f5143
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4f509b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004f515a
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x4f5141
call fcn.004b7210
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x265
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.0041482a
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4f50ef
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4f5114
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x4f5136
push dword [ebp - 0xc4]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b7460
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f515a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4f517c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f524b
mov bl, 1
test al, 0x10
jne 0x4f52f3
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x4f52f1
lea ecx, [ebp - 0xb8]
push 2
push 0x254
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.004b6940
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0041482a
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4f51e4
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4f5209
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0041482a
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x4f523b
push dword [ebp - 0xc4]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b6d50
jmp 0x4f52f1
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x4f52f1
call fcn.004b7210
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x250
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0041482a
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4f529f
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4f52c4
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x4f52e6
push dword [ebp - 0xc4]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b7460
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f67e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x4f683a
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.004f7adc
test al, al
jne 0x4f6827
add esi, 0x58
cmp esi, ebx
jne 0x4f6812
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x4f683a
cmp byte [esi + 0x1b], 0
jns 0x4f683f
mov eax, dword [esi + 0x10]
jmp 0x4f6842
xor edi, edi
inc edi
jmp 0x4f6865
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x4f6865
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f7974
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x50]
cmp eax, edx
jne 0x4f7989
cmp byte [ecx + 0x1b], 0
jns 0x4f7997
mov ecx, dword [ecx + 0x10]
jmp 0x4f799a
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [ecx + ecx*2]
inc eax
jmp 0x4f79b4
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, eax
shr edx, 3
and edx, 2
xor eax, eax
inc eax
cmp ecx, 0xffffffff
cmovne eax, edx
pop ebp
ret
Function at 0x4f8020
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f7d30
Function at 0x4f84a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f8030
Function at 0x50acd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov edi, esp
push 0x1b
push str....._base_filesmemory_mapped_file_win.cc
push str.MapImageToMemory
push edi
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.0050b630
mov ecx, esi
call fcn.004c9d40
test al, al
je 0x50adad
mov ecx, esi
call fcn.00453e90
sub esp, 0x18
movdqa xmm0, xmmword [0x62b1b0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x50ada5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jb 0x50ad8b
call fcn.004b63a0
push dword [esi + 0x24]
call fcn.004d0370
add esp, 4
mov dword [esi + 0x24], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x50ad9b
mov dword [esi + 0x24], edi
call fcn.004b63a0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
lea eax, [edi + 1]
cmp eax, 2
jae 0x50adcf
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.0050b690
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
sub esp, 0x14
movdqa xmm0, xmmword [0x62b1c0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x50adad
mov dword [esp], fcn.0041a350
mov dword [esp + 4], eax
mov ecx, esp
call fcn.005286c0
mov eax, dword [eax + 0x50]
mov dword [esi + 0x20], eax
mov bl, 1
jmp 0x50adaf
Function at 0x50ae10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea edi, [esp + 0x10]
push 0x3a
push str....._base_filesmemory_mapped_file_win.cc
push str.MapFileRegionToMemory
push edi
call fcn.004b6370
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.0050b630
mov ecx, esi
call fcn.004c9d40
xor ebx, ebx
test al, al
je 0x50af20
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, 3
ja case.default.0x50ae86
jmp dword [eax*4 + 0x62b224]
mov edi, 2
jmp 0x50aeb5
mov edi, 4
jmp 0x50aeb5
mov ebx, dword [ecx + 8]
mov edi, 4
jmp 0x50aeb5
sub esp, 4
mov ecx, esi
call fcn.0050acd0
mov ebx, eax
jmp 0x50af20
xor edi, edi
mov ecx, esi
call fcn.00453e90
push 0
push ebx
push 0
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp dword [esi + 0x24], eax
mov dword [esp + 4], edi
je 0x50af18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jb 0x50aefe
call fcn.004b63a0
push dword [esi + 0x24]
call fcn.004d0370
add esp, 4
mov dword [esi + 0x24], 0
mov eax, ebx
inc eax
cmp eax, 2
jb 0x50af0e
mov dword [esi + 0x24], ebx
call fcn.004b63a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esi + 0x24]
inc ebx
cmp ebx, 2
jae 0x50af40
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.0050b690
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [esp + 0xc], 0
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x62b238
call fcn.0050b090
test al, al
je 0x50af85
mov ecx, esi
call fcn.004ca160
mov ecx, eax
add ecx, 0xffffffff
adc edx, 0xffffffff
xor ebx, ebx
mov edi, 0xfffffffe
cmp edi, ecx
mov ecx, 0
sbb ecx, edx
jb 0x50af20
mov dword [esi + 0x20], eax
xor ecx, ecx
xor eax, eax
jmp 0x50affc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call fcn.0050b1d0
add esp, 0x18
mov edx, dword [edi + 8]
mov eax, dword [esp + 0xc]
mov ecx, eax
sar ecx, 0x1f
add eax, edx
adc ecx, 0
mov edi, ecx
and edi, 1
neg edi
xor ecx, edi
setne bl
mov ecx, dword [esp + 0x14]
test ecx, ecx
js 0x50af1e
test bl, bl
jne 0x50af1e
test edi, edi
js 0x50af1e
mov ebx, dword [esp + 0x10]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 4]
and edx, 2
add edx, 2
push eax
push ebx
push ecx
push edx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x50af1e
add eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov bl, 1
jmp 0x50af20
Function at 0x511ff0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6890e0]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x51201b
mov ecx, 0x6890d8
pop ebp
jmp fcn.004c3f80
push 0x6890e0
call fcn.005dc7c7
add esp, 4
cmp dword [0x6890e0], 0xffffffff
jne 0x512010
mov dword [0x6890dc], 0
mov dword [0x6890d8], 0
mov ecx, 0x6890d8
push 0
call fcn.004c3ff0
push 0x6890e0
call fcn.005dc83d
add esp, 4
jmp 0x512010