joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52bc60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x52bc9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x52bcb2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x52bc94
mov dword [esi], ebx
call fcn.0063cf00
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x52bcc9
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0063cf00
push dword [esi]
call fcn.00633790
add esp, 4
mov dword [esi], 0
jmp 0x52bc85
int3

Function at 0x52bd00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x52bd21
call fcn.0063cf00
cmp dword [esi], edi
je 0x52bd4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x52bd82
cmp ebx, 2
jb 0x52bd43
mov dword [esi], edi
mov edi, eax
call fcn.0063cf00
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x52bd6b
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0063cf00
push dword [edi]
call fcn.00633790
add esp, 4
mov dword [edi], 0
jmp 0x52bd5f
mov dword [ebp - 0x10], eax
call fcn.0063cf00
push dword [esi]
call fcn.00633790
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x52bd33
Function at 0x52cad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 8], ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x58], eax
xor edi, edi
dec edi
lea ebx, [esp + 0x20]
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x30], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x97
push str........._base_files_file_win.cc
push str.WriteAtCurrentPos
push esi
call fcn.0063ced0
add esp, 0x10
mov ecx, ebx
push 0
push esi
mov esi, dword [ebp + 0xc]
call fcn.00635f30
test esi, esi
js 0x52cb80
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00659db0
test al, al
jne 0x52cba0
lea ebx, [esp + 0xc]
mov dword [ebx], 0xffffffff
push 0
push ebx
push esi
push edi
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
cmp eax, 1
sbb edi, edi
or edi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.00659e50
lea ecx, [esp + 0x20]
call fcn.00635fb0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0066e1f1
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x10]
push 0
push esi
push dword [esp + 0x10]
push str.File::WriteAtCurrentPos
call fcn.006ccbe0
jmp 0x52cb53

Function at 0x52cbc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x58], eax
xor eax, eax
dec eax
lea ebx, [esp + 0x20]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xac
push str........._base_files_file_win.cc
push str.GetLength
push edi
call fcn.0063ced0
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.00635f30
xor eax, eax
dec eax
mov dword [edi + 4], eax
mov dword [edi], esi
call fcn.00659db0
test al, al
jne 0x52cc80
lea ebx, [esp + 8]
xor eax, eax
dec eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [ebx + 4]
or edi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.00659e50
lea ecx, [esp + 0x20]
call fcn.00635fb0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0066e1f1
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
push esi
push esi
push dword [esp + 0xc]
push str.File::GetLength
call fcn.006ccbe0
jmp 0x52cc32
Function at 0x52cca0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x78], eax
xor eax, eax
dec eax
lea edi, [esp + 0x40]
mov dword [edi + 0x34], eax
mov dword [edi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x30]
push 0xb9
push str........._base_files_file_win.cc
push str.SetLength
push esi
call fcn.0063ced0
add esp, 0x10
xor ebx, ebx
mov ecx, edi
xor edi, edi
dec edi
push ebx
push esi
call fcn.00635f30
mov dword [esi + 4], edi
mov dword [esi], ebx
call fcn.00659db0
test al, al
jne 0x52cdfc
lea eax, [esp + 0x28]
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
mov ecx, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], eax
mov dword [esp], ecx
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x52cdd3
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 4], xmm0
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x52cdd3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
je 0x52cdd3
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea ecx, [esp + 0x30]
call fcn.00659e50
lea ecx, [esp + 0x40]
call fcn.00635fb0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x30]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push str.File::SetLength
call fcn.006ccbe0
jmp 0x52cd19
Function at 0x52cf60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x58], eax
xor eax, eax
dec eax
lea edi, [esp + 0x20]
mov dword [edi + 0x34], eax
mov dword [edi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x173
push str........._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.0063ced0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00635f30
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x52d18a
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x52d15f
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x52d096
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x52d0de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x52d170
mov eax, edi
inc eax
cmp eax, 2
jb 0x52d0d5
mov dword [ebx], edi
call fcn.0063cf00
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x52d12a
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x52d13e
test cl, 0xa
je 0x52d106
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x52d152
lea ecx, [esp + 0x20]
call fcn.00635fb0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0066e1f1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0052ce20
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x52d10c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x52d106
push dword [ebp + 8]
call fcn.0052dc40
add esp, 4
jmp 0x52d10c
bt ebx, 0x15
jb 0x52d1a7
or edx, 0x20000000
jmp 0x52d027
call fcn.0063cf00
push dword [ebx]
call fcn.00633790
add esp, 4
mov dword [ebx], 0
jmp 0x52d0c6
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.006b6d10
jmp 0x52d10c
int3
Function at 0x52d290
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.0052d2a0
Function at 0x52d4d0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.0052d2a0

Function at 0x52d4e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x48], eax
xor eax, eax
dec eax
lea esi, [esp + 0x10]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1ff
push str........._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.0063ced0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00635f30
cmp byte [edi + 0xb], 0
jns 0x52d545
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
dec ecx
cmp eax, ecx
setne bl
mov ecx, esi
call fcn.00635fb0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52d570
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x48], eax
xor eax, eax
dec eax
lea esi, [esp + 0x10]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x227
push str........._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0063ced0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00635f30
cmp byte [edi + 0xb], 0
jns 0x52d5d5
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
xor eax, eax
dec eax
cmp ebx, eax
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.00635fb0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52d610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.006719e0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x52d693
push ebx
call fcn.00687336
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0063d8a0
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00536540
mov ecx, dword [ebp + 8]
push ebx
call fcn.0063da00
mov ecx, ebx
call fcn.0063d9e0
mov ecx, edi
call fcn.0063d9e0
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52d6c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.006719e0
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x70a3a0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x52d73c
cmp word [ebp - 0x214], 0
je 0x52d73c
push edi
call fcn.00687336
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0063d8a0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0066e1f1
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.0063d790
push edi
call fcn.0052d610
add esp, 4
mov ecx, esi
test al, al
je 0x52d76b
push edi
call fcn.0063d870
jmp 0x52d777
push 3
push 0x70a404
call fcn.0063d8a0
lea ecx, [ebp - 0x220]
call fcn.0063d9e0
jmp 0x52d726
Function at 0x52db40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [esp + 0x258], eax
xor eax, eax
dec eax
lea esi, [esp + 0x220]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x18]
push 0x3f9
push str........._base_files_file_util_win.cc
push 0x70a450
push ebx
call fcn.0063ced0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00635f30
lea esi, [esp + 0x1a]
push 0x206
push 0xff
push esi
call fcn.006719e0
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x52dc10
push ebx
call fcn.00687336
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.0063d8a0
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.00536540
mov ecx, dword [ebp + 8]
push ebx
call fcn.0063da00
mov ecx, ebx
call fcn.0063d9e0
mov ecx, edi
call fcn.0063d9e0
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x220]
call fcn.00635fb0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52df80
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.006719e0
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.0052e270
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.0052e3f0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x52dfed
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x52e13f
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.006719e0
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0052e3b0
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x52e06f
cmp byte [ebp + 8], 0
jne 0x52e04f
mov ecx, ebx
call fcn.0052e1c0
test al, al
je 0x52e049
mov ecx, ebx
call fcn.0052e1c0
xor esi, esi
test al, al
je 0x52e0c1
jmp 0x52e0f7
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x52e067
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.0052e1c0
test al, al
je 0x52e0c1
xor esi, esi
cmp byte [ebp + 8], 0
je 0x52e0f7
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.0052df80
add esp, 4
mov esi, eax
test eax, eax
jne 0x52e0f7
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x52e0b3
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
jmp 0x52e0df
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x52e0d6
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x52e0f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x52e0f7
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00514420
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0052e3f0
lea ecx, [ebp - 0x500]
push ebx
call fcn.0063da00
mov ecx, ebx
call fcn.0063d9e0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x52e133
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x52dffd
jmp 0x52e141
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.0063d9e0
lea ecx, [ebp - 0x2a4]
call fcn.0052e340
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x534550
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call fcn.005345f0
mov eax, dword [esi]
mov dword [0x72cc40], eax
test al, 1
jne 0x53456c
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [0x72ffe0]
test eax, eax
je 0x5345c8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x72ffe0], 0
mov ecx, dword [0x72ffcc]
test ecx, ecx
jne 0x5345b3
and byte [0x72cc40], 0xfe
push 0xc
call fcn.0066d870
add esp, 4
mov ecx, eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
mov dword [0x72ffcc], ecx
push dword [esi + 4]
call fcn.005352d0
cmp dword [esi + 0xc], 0
je 0x5345d4
pop esi
pop ebp
jmp fcn.005346f0
mov ecx, dword [0x72ffcc]
test ecx, ecx
jne 0x5345b3
jmp 0x534597
mov eax, dword [0x72ffcc]
cmp byte [eax + 0xb], 0
jns 0x5345e1
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x5345c1
Function at 0x5346f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x72ffe0], 0
jne 0x5347aa
mov esi, dword [0x72ffcc]
test esi, esi
je 0x5347c1
test byte [0x72cc40], 1
je 0x5347aa
cmp byte [esi + 0xb], 0
jns 0x534734
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x70aed0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x72ffe0], eax
inc eax
cmp eax, 1
ja 0x5347aa
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.006719e0
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x534861
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xc
call fcn.0066d870
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.006719e0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.0069b560
movzx eax, byte [esi + 0xb]
mov ecx, esi
test al, al
jns 0x534816
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
jne 0x534833
mov ecx, esi
push 9
push str.debug.log
call fcn.00526ac0
mov dword [0x72ffcc], esi
jmp 0x534723
lea edi, [eax + eax]
test edi, edi
je 0x53481a
lea edx, [edi - 2]
cmp word [ecx + edi - 2], 0x5c
mov edi, edx
jne 0x534836
cmp edx, 0xfffffffe
je 0x53481a
sar edx, 1
cmp eax, edx
jbe 0x53491c
inc edx
mov ecx, esi
push edx
call fcn.0069de90
jmp 0x53481a
mov esi, dword [0x72ffcc]
push edi
call fcn.00687336
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.005267b0
mov ecx, dword [0x72ffcc]
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x534911
mov eax, dword [ecx + 4]
test eax, eax
je 0x534923
mov edx, dword [ecx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x5348b2
push 1
push 0x7069e0
call fcn.00526ac0
mov ecx, dword [0x72ffcc]
push 9
push str.debug.log
call fcn.00526ac0
mov eax, dword [0x72ffcc]
cmp byte [eax + 0xb], 0
jns 0x5348cb
mov eax, dword [eax]
movaps xmm0, xmmword [0x70aed0]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x72ffe0], eax
inc eax
cmp eax, 1
ja 0x5347aa
mov dword [0x72ffe0], 0
jmp 0x5347a8
test eax, eax
je 0x534923
mov edx, ecx
jmp 0x534898
mov ecx, esi
call fcn.0069b530
push str.string::back__:_string_is_empty
push str._empty__
push 0x502
push str........._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.0069cc70
int3
Function at 0x536820
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00634d90
mov dword [esi], 0
test eax, eax
je 0x536867
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x536899
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x536860
mov dword [esi], ebx
mov ebx, eax
call fcn.0063cf00
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.0063d7b0
lea ecx, [esi + 0x10]
call fcn.00659de0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0063cf00
push dword [esi]
call fcn.00633790
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x53684d

Function at 0x536e50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x730040]
test ebx, ebx
jne 0x536ed2
push 0x28
call fcn.0066d870
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.0066d870
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x536edc
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 8], edi
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x730040], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x536ef7
mov edi, eax
push eax
call fcn.00687336
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00536f00
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x25
push str........._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.0069cc70
int3