joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474980
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00474990

Function at 0x474c10
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 1
pop ebp
jmp fcn.00474990

Function at 0x474c30
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov edi, esp
push 0x20d
push str....._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push edi
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.00479320
cmp byte [esi + 0xb], 0
jns 0x474cab
cmp dword [esi + 4], 0x103
jbe 0x474ca9
xor ebx, ebx
jmp 0x474cbb
mov esi, dword [esi]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.004793a0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x474ce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x58], eax
call fcn.0046fa70
cmp eax, 8
jg 0x474d10
push 0x32
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x474e0d
mov esi, dword [ebp + 8]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x21d
push str....._base_files_file_util_win.cc
push str.DeleteFileWithDispositionFlags
push ebx
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.00479320
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x474d6b
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x474dc7
test al, 0x10
jne 0x474dcb
cmp byte [esi + 0xb], 0
jns 0x474d83
mov esi, dword [esi]
sub esp, 0x1c
movdqa xmm0, xmmword [0x55f3b0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x474dd7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x474ddb
call fcn.004877f0
jmp 0x474ddd
xor ebx, ebx
jmp 0x474e04
push 0x32
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x474e04
xor esi, esi
jmp 0x474dec
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esi + 1]
cmp eax, 2
jae 0x474e22
xor ebx, ebx
lea eax, [esi + 1]
cmp eax, 2
jb 0x474e04
call fcn.004877f0
push esi
call fcn.00470390
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004793a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x55ea32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.NtSetInformationFile
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x474dec
mov ecx, eax
mov eax, dword [ebp + 0xc]
or eax, 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
call dword [section..00cfg]
lea eax, [esp + 0xc]
push 0x40
push 4
push eax
push ebx
push esi
call ecx
test eax, eax
sete bl
je 0x474dee
mov edi, eax
push 0x55ea32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x474ea1
mov ecx, eax
call dword [section..00cfg]
push edi
call ecx
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x474dee
Function at 0x474eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
mov edi, esp
push 0x2a0
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push edi
call fcn.00479320
call fcn.004c5230
test al, al
je 0x474f4e
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
movdqa xmmword [esp], xmm0
mov dword [esp + 0x20], 0xffffffff
cmp byte [esi + 0xb], 0
jns 0x474f3e
mov esi, dword [esi]
push edi
push 0
push esi
call fcn.004c53b0
add esp, 0xc
test eax, eax
jmp 0x474f60
cmp byte [esi + 0xb], 0
jns 0x474f56
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea ecx, [esp + 0x30]
call fcn.004793a0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x474f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov ebx, esp
push 0x2cf
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.004877c0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.00479320
cmp byte [edi + 0xb], 0
jns 0x475000
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004793a0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x475040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.0050bb40
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x4750c3
push ebx
call fcn.00520fd4
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00487b60
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00488e90
mov ecx, dword [ebp + 8]
push ebx
call fcn.00487c60
mov ecx, ebx
call fcn.00487c20
mov ecx, edi
call fcn.00487c20
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4750f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.0050bb40
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x55f3c0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x475158
cmp word [ebp - 0x214], 0
je 0x475158
push edi
call fcn.00520fd4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00487b60
jmp 0x4751b1
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.00487b00
push edi
call fcn.00475040
add esp, 4
mov ecx, esi
test al, al
je 0x47519a
push edi
call fcn.00487b30
jmp 0x4751a6
push 3
push 0x55f482
call fcn.00487b60
lea ecx, [ebp - 0x220]
call fcn.00487c20
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00508d63
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x475510
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x36e
push str....._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push ebx
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.00479320
cmp byte [edi + 0xb], 0
mov esi, edi
jns 0x475582
mov esi, dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4755b4
mov bl, 1
test al, 0x10
jne 0x47565c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4755a5
mov dword [eax], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x47565c
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov ecx, edi
push ebx
call fcn.00488280
push edi
push ebx
call fcn.00475690
add esp, 8
test al, al
je 0x4755fe
mov eax, 0xfffffffc
mov edi, 2
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4755f5
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x475651
push dword [ebp + 0xc]
push ebx
call fcn.00475510
add esp, 8
test al, al
je 0x475651
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x475653
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp eax, 0xb7
jne 0x47563b
push edi
call fcn.00474f90
add esp, 4
test al, al
jne 0x475653
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x47567a
mov edi, dword [esp + 0xc]
push edi
call fcn.004744e0
add esp, 4
jmp 0x4755f3
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.00487c20
lea ecx, [esp + 0x20]
call fcn.004793a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 0xc]
jmp 0x4755f5
Function at 0x475870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
mov dword [esp + 0x254], 0xffffffff
mov dword [esp + 0x250], 0xffffffff
lea ebx, [esp + 0x18]
push 0x4bb
push str....._base_files_file_util_win.cc
push 0x55f4ce
push ebx
call fcn.004877c0
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push ebx
call fcn.00479320
lea eax, [esp + 0x1a]
push 0x206
push 0xff
push eax
call fcn.0050bb40
add esp, 0xc
mov word [esp + 0x18], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x475959
push ebx
call fcn.00520fd4
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.00487b60
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.00488e90
mov ecx, dword [ebp + 8]
push ebx
call fcn.00487c60
mov ecx, ebx
call fcn.00487c20
mov ecx, edi
call fcn.00487c20
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x220]
call fcn.004793a0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x475990
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x575010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov ebx, esp
push 0x4cb
push str....._base_files_file_util_win.cc
push 0x55f4e3
push ebx
call fcn.004877c0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.00479320
cmp byte [edi + 0xb], 0
jns 0x475a00
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.004793a0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x475ce0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.0050bb40
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.00475fe0
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.004761e0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x475d63
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x475f15
xor edi, edi
lea ebx, [ebp - 0x4f4]
jmp 0x475d8a
mov edi, esi
test eax, eax
je 0x475f17
push 0x250
push 0xff
push ebx
call fcn.0050bb40
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004761a0
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x475e02
mov ecx, dword [ebp + 8]
test cl, 1
jne 0x475de2
mov ecx, ebx
call fcn.00475f50
test al, al
je 0x475ddc
mov ecx, ebx
call fcn.00475f50
xor esi, esi
test al, al
je 0x475e60
jmp 0x475ed0
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x475dfa
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.00475f50
test al, al
je 0x475e60
xor esi, esi
mov eax, dword [ebp + 8]
test al, 1
je 0x475ed0
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push eax
call fcn.00475ce0
add esp, 4
mov esi, eax
test eax, eax
jne 0x475ed0
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x475e4e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x475ed0
jmp 0x475eb9
mov eax, dword [ebp + 8]
test al, 2
jne 0x475e90
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x475e7c
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x475ed0
jmp 0x475eb9
call fcn.0046fa70
xor ecx, ecx
cmp eax, 0xd
setge cl
shl ecx, 4
or ecx, 2
xor esi, esi
push ecx
lea eax, [ebp - 0x500]
push eax
call fcn.00474ce0
add esp, 8
test al, al
jne 0x475ed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x475ed0
mov esi, eax
nop dword [eax]
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.0042a680
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004761e0
lea ecx, [ebp - 0x500]
push ebx
call fcn.00487c60
mov ecx, ebx
call fcn.00487c20
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x475d80
mov eax, dword [ebp - 0x4fc]
jmp 0x475d80
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.00487c20
lea ecx, [ebp - 0x2a4]
call fcn.00476130
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d63
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47e9f0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x47ea5d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x47ea30
cmp edx, 1
jne 0x47ea66
jmp 0x47ea82
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x47ea82
cmp edx, 2
je 0x47ea79
cmp edx, 3
jne 0x47ea8d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x47ebee
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x47eaf6
lea edx, [ebx - 1]
and edx, edi
jmp 0x47eb02
mov edx, edi
cmp edi, ebx
jb 0x47eb02
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x47ebee
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x47ebee
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x47eb55
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x47ebec
mov ebx, dword [ebx]
test ebx, ebx
je 0x47ebec
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x47ebb0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x47eb69
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x47eb4b
lea ecx, [ebx + 8]
test al, al
jns 0x47eb77
mov ecx, dword [ecx]
js 0x47ebce
cmp dword [ebp - 0x14], 0
je 0x47ebe8
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x47eb4b
inc ecx
cmp eax, ecx
jne 0x47eb90
jmp 0x47ebe8
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x47eb40
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x47eb43
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x47eb43
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x47ebe8
push eax
push esi
push ecx
call fcn.00509f3d
add esp, 0xc
test eax, eax
jne 0x47eb4b
mov ecx, ebx
jmp 0x47ebee
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x485480
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call fcn.00485550
mov eax, dword [esi]
mov dword [0x577cd0], eax
test al, 1
jne 0x48549c
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [0x57ae88]
test eax, eax
je 0x4854c9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x57ae88], 0
mov ecx, dword [0x57ae74]
test ecx, ecx
jne 0x4854f8
and byte [0x577cd0], 0xfe
jmp 0x4854d3
mov ecx, dword [0x57ae74]
test ecx, ecx
jne 0x4854f8
push 0xc
call fcn.00507d96
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x57ae74], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x485526
push eax
call fcn.0046751c
cmp dword [esi + 0xc], 0
jne 0x48551f
mov eax, dword [0x57ae74]
cmp byte [eax + 0xb], 0
jns 0x485518
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
jmp fcn.00485660
push str.string::assign_received_nullptr
push str.__s___nullptr
push 0x9dd
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.0043403c
int3
Function at 0x489530
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00473e20
mov dword [esi], 0
test eax, eax
je 0x489592
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jb 0x489578
mov dword [ebp - 0x10], eax
call fcn.004877f0
push dword [esi]
call fcn.00470390
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x48958b
mov dword [esi], ebx
mov ebx, eax
call fcn.004877f0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.00487b20
lea ecx, [esi + 0x10]
call fcn.004c50a0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
movzx eax, byte [edi + 0x18]
mov byte [esi + 0x18], al
movzx eax, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x48a220
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x575010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.0047a5b0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x48a24e
mov esi, dword [ebp - 0x1c]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x48a26c
push dword [ebp - 0x1c]
call fcn.00507dc6
add esp, 4
cmp dword [ebp + 8], 0
je 0x48a319
test esi, esi
je 0x48a319
lea eax, [esi + esi]
test esi, esi
mov ecx, 0xffffffff
cmovns ecx, eax
push ecx
call fcn.00507df3
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.0047a5b0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x48a2b1
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x48a2cb
push dword [ebp - 0x1c]
call fcn.00507dc6
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x48a2dd
push edi
call fcn.00520fd4
add esp, 4
jmp 0x48a2df
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.0047a5f0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x48a2fd
push dword [ebx]
call fcn.00507dc6
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
test edi, edi
je 0x48a319
push edi
call fcn.00507dfc
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d63
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret