joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac670
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x30]
push 0xb9
push str....._base_files_file_win.cc
push str.SetLength
push esi
call fcn.005613a0
add esp, 0x10
xor ebx, ebx
mov ecx, edi
push ebx
push esi
call fcn.005546a0
mov dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call fcn.00571f20
test al, al
jne 0x4ac7c7
xor eax, eax
dec eax
lea ecx, [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4ac79e
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 4], xmm0
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4ac79e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
je 0x4ac79e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea ecx, [esp + 0x30]
call fcn.00571fb0
lea ecx, [esp + 0x40]
call fcn.00554710
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x30]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push str.File::SetLength
call fcn.006b8950
jmp 0x4ac6e1
Function at 0x4ac910
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x171
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.005613a0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.005546a0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x4acb31
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x4acb06
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x4aca3d
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x4aca85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x4acb17
mov eax, edi
inc eax
cmp eax, 2
jb 0x4aca7c
mov dword [ebx], edi
call fcn.005613d0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x4acad1
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x4acae5
test cl, 0xa
je 0x4acaad
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x4acaf9
lea ecx, [esp + 0x20]
call fcn.00554710
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c9f16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ac7f0
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x4acab3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x4acaad
push dword [ebp + 8]
call fcn.004ae740
add esp, 4
jmp 0x4acab3
bt ebx, 0x15
jb 0x4acb4e
or edx, 0x20000000
jmp 0x4ac9ce
call fcn.005613d0
push dword [ebx]
call fcn.0054cbb0
add esp, 4
mov dword [ebx], 0
jmp 0x4aca6d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.00649760
jmp 0x4acab3
int3
Function at 0x4acc20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x4acc55
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4acc5c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4acc4e
mov dword [esi], ebx
call fcn.005613d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005613d0
push dword [esi]
call fcn.0054cbb0
add esp, 4
mov dword [esi], 0
jmp 0x4acc3f

Function at 0x4acd50
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.004acd60
Function at 0x4acfc0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.004acd60

Function at 0x4acfd0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea eax, [esp + 0x250]
push 0x1db
push str....._base_files_file_util_win.cc
push 0x791b37
push eax
call fcn.005613a0
add esp, 0x10
mov ecx, esi
lea esi, [esp + 0x250]
push 0
push esi
call fcn.005546a0
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push esi
call fcn.005cced0
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4ad058
mov eax, dword [ebx]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.005598f0
add esp, 0xc
push esi
call fcn.00534700
add esp, 4
lea esi, [esp + 0x48]
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push esi
call fcn.005cced0
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4ad094
mov eax, dword [edi]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.005598f0
add esp, 0xc
push esi
call fcn.00534700
add esp, 4
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4ad0b7
mov eax, dword [ebx]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x4ad0c1
mov ecx, dword [edi]
sub esp, 0x18
movsd xmm0, qword [0x791ac0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x4ad11f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ac7f0
add esp, 4
mov dword [esp + 0xc], eax
cmp byte [edi + 0xb], 0
jns 0x4ad0fd
mov edi, dword [edi]
mov esi, dword [ebp + 0x10]
cmp byte [ebx + 0xb], 0
jns 0x4ad108
mov ebx, dword [ebx]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test esi, esi
je 0x4ad121
test eax, eax
jne 0x4ad121
jmp 0x4ad142
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.00554710
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esp + 0xc], 0xfffffffc
jne 0x4ad152
call fcn.00642850
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi], eax
xor ebx, ebx
jmp 0x4ad121
Function at 0x4ad160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x20e
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.005613a0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005546a0
cmp byte [edi + 0xb], 0
jns 0x4ad1bc
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.00554710
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ad1f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x217
push str....._base_files_file_util_win.cc
push str.PathHasAccess
push esi
call fcn.005613a0
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.005546a0
cmp byte [edi + 0xb], 0
jns 0x4ad251
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x4ad2e7
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x4ad2aa
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x4ad2e3
call fcn.005613d0
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x4ad2c5
call fcn.005613d0
push esi
call fcn.0054cbb0
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00554710
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4ad2a3
xor ebx, ebx
jmp 0x4ad2c5
Function at 0x4ad2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x236
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.005613a0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005546a0
cmp byte [edi + 0xb], 0
jns 0x4ad34c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.00554710
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ad380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.005cced0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x4ad403
push ebx
call fcn.005e54a4
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00561710
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.004bbc60
mov ecx, dword [ebp + 8]
push ebx
call fcn.00561870
mov ecx, ebx
call fcn.005617f0
mov ecx, edi
call fcn.005617f0
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4ad430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.005cced0
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x791ad0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4ad4ad
cmp word [ebp - 0x214], 0
je 0x4ad4ad
push edi
call fcn.005e54a4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00561710
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00561680
push edi
call fcn.004ad380
add esp, 4
mov ecx, esi
test al, al
jne 0x4ad4e2
push 3
push 0x791b60
call fcn.00561710
jmp 0x4ad4e8
push edi
call fcn.005616e0
lea ecx, [ebp - 0x220]
call fcn.005617f0
jmp 0x4ad497
Function at 0x4ad830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x8153d8], 0
jne 0x4ada53
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2bc
push str....._base_files_file_util_win.cc
push str.GetSecureSystemTemp
push ebx
call fcn.005613a0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005546a0
cmp dword [ebp + 8], 0
je 0x4ada5a
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
call fcn.00561680
push esi
push 0x65
call fcn.004af6e0
add esp, 8
test al, al
je 0x4ad997
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push str.SystemTemp
push ebx
call fcn.004bbb50
mov ecx, esi
push ebx
call fcn.00561870
mov ecx, ebx
call fcn.005617f0
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x40]
push 0x20e
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.005613a0
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.005546a0
cmp byte [esi + 0xb], 0
jns 0x4ad931
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.00554710
cmp esi, 0xffffffff
je 0x4ad997
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.004ad1f0
add esp, 4
test al, al
je 0x4ad997
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.00561810
mov ecx, esi
call fcn.005617f0
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.00554710
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 4]
call fcn.005617f0
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ebx, [esp + 4]
mov ecx, ebx
call fcn.00561680
push ebx
push 0x67
call fcn.004af6e0
add esp, 8
test al, al
je 0x4ada43
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x20e
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.005613a0
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.005546a0
cmp byte [esp + 0xf], 0
jns 0x4ada10
mov ebx, dword [esp + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.00554710
cmp ebx, 0xffffffff
je 0x4ada43
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.004ad1f0
add esp, 4
test al, al
jne 0x4ad960
lea ecx, [esp + 4]
call fcn.005617f0
xor ebx, ebx
jmp 0x4ad976
xor ebx, ebx
jmp 0x4ad97f
int3
Function at 0x4ae120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, esp
push 0x403
push str....._base_files_file_util_win.cc
push 0x791c2a
push eax
call fcn.005613a0
add esp, 0x10
xor ebx, ebx
mov ecx, esi
push ebx
lea eax, [esp + 4]
push eax
call fcn.005546a0
cmp byte [edi + 0xb], 0
jns 0x4ae181
mov edi, dword [edi]
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x791af0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x4ae1ca
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x4ae23c
call fcn.005613d0
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
dec esi
cmp dword [ebp + 0x10], 0
js 0x4ae208
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4ae208
mov eax, dword [ebp + 0xc]
xor edi, edi
dec edi
mov dword [esp], edi
push 0
lea ecx, [esp + 4]
push ecx
mov esi, dword [ebp + 0x10]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, esi
cmove edi, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edi
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4ae21e
call fcn.005613d0
push ebx
call fcn.0054cbb0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00554710
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x4ae1c3

Function at 0x4ae240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x43c
push str....._base_files_file_util_win.cc
push 0x791c34
push ebx
call fcn.005613a0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005546a0
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.005cced0
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x4ae306
push ebx
call fcn.005e54a4
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.00561710
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.004bbc60
mov ecx, dword [ebp + 8]
push ebx
call fcn.00561870
mov ecx, ebx
call fcn.005617f0
mov ecx, edi
call fcn.005617f0
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.00554710
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ae330
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x44c
push str....._base_files_file_util_win.cc
push 0x791c49
push ebx
call fcn.005613a0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.005546a0
cmp byte [edi + 0xb], 0
jns 0x4ae38c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.00554710
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ae760
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.005cced0
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.004aea70
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.004aed20
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x4ae7cd
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x4ae8c8
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.005cced0
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004aece0
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x4ae91f
mov ecx, ebx
call fcn.004ae980
test al, al
jne 0x4ae8cc
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4ae82e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4ae8c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x4ae851
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00410a30
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004aed20
lea ecx, [ebp - 0x500]
push ebx
call fcn.00561870
mov ecx, ebx
call fcn.005617f0
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x4ae88d
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x4ae7dd
lea ecx, [ebp - 0x500]
call fcn.005617f0
lea ecx, [ebp - 0x2a4]
call fcn.004aec70
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4ae851
xor esi, esi
jmp 0x4ae897
xor esi, esi
cmp byte [ebp + 8], 0
je 0x4ae851
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.004ae760
add esp, 4
test eax, eax
jne 0x4ae84f
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4ae90b
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4ae851
jmp 0x4ae83d
cmp byte [ebp + 8], 0
jne 0x4ae952
lea ecx, [ebp - 0x4f4]
call fcn.004ae980
test al, al
je 0x4ae94c
lea ecx, [ebp - 0x4f4]
call fcn.004ae980
test al, al
je 0x4ae819
jmp 0x4ae8c4
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x4ae963
lea ecx, [ebp - 0x500]
jmp 0x4ae969
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4ae80a
Function at 0x4af660
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
call fcn.005645c0
mov ecx, eax
push str.enable_low_end_device_mode
call fcn.00564aa0
test al, al
jne 0x4af687
cmp byte [0x8153f8], 1
je 0x4af6a2
pop ebp
jmp fcn.004a8590
call fcn.004a8590
mov ecx, 0x20000000
cmp eax, 0x20000000
cmovae eax, ecx
test edx, edx
cmovne eax, ecx
xor edx, edx
jmp 0x4af6b4
mov eax, dword [0x8153f0]
mov edx, dword [0x8153f4]
shld edx, eax, 0x14
shl eax, 0x14
pop ebp
ret