joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404086
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [section..data], 0xffffffff
jne 0x40409f
mov eax, 0x456610
jmp 0x4041d9
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
and dword [ebp - 0xc], 0
cmp dword [ebp - 0x10], 0
je 0x4040c1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4040d1
mov eax, 0x456610
jmp 0x4041d9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4040ea
mov eax, 0x456610
jmp 0x4041d9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax], 0
and dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x4041d6
mov ecx, dword [ebp - 0xc]
call fcn.00425dc8
test eax, eax
je 0x40415b
mov ecx, dword [ebp - 0xc]
call fcn.00425dc8
push eax
call fcn.00438f50
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
cmp eax, 0x1000
jl 0x404134
jmp 0x4041d6
mov ecx, dword [ebp - 0xc]
call fcn.00425dc8
push eax
push dword [ebp - 4]
call fcn.0043a100
pop ecx
pop ecx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jmp 0x404192
mov dword [ebp - 0x18], 4
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x18]
cmp eax, 0x1000
jl 0x404171
jmp 0x4041d6
push str.NULL
push dword [ebp - 4]
call fcn.0043a100
pop ecx
pop ecx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 2
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
cmp eax, 0x1000
jl 0x4041a8
jmp 0x4041d6
push 0x456ec0
push dword [ebp - 4]
call fcn.0043a100
pop ecx
pop ecx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x4040fa
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x404e64
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0043a580
cmp dword [section..data], 0xffffffff
je 0x404fc6
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404fa0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x404f9e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x404ed6
push str.0__pRFHead__lActiveStackBasedObjects
push str.DEBUG
push 0x516
push str.D:projectsutil_srcdebug.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x404f11
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
push str._ld_missing_stack_based_destructor_calls_detected
lea eax, [ebp - 0x2008]
push eax
call fcn.00405ab8
add esp, 0xc
push eax
push str.DEBUG
push 0x519
push str.D:projectsutil_srcdebug.cpp
call fcn.00405307
add esp, 0x10
mov eax, dword [ebp - 4]
cmp eax, dword [0x478ef4]
jne 0x404f23
and dword [0x478ef4], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x404f61
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x404f61
push str.HeapFree_Failed_
push str.DEBUG
push 0x51e
push str.D:projectsutil_srcdebug.cpp
call fcn.00405307
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.0040303e
pop ecx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x404f9e
push str.TlsSetValue_failed_
push str.DEBUG
push 0x523
push str.D:projectsutil_srcdebug.cpp
call fcn.00405613
add esp, 0x10
jmp 0x404fc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404fc6
push str.NO_ERROR__GetLastError__
push str.DEBUG
push 0x528
push str.D:projectsutil_srcdebug.cpp
call fcn.00405131
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x404fd4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [section..data], 0xffffffff
je 0x40505c
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405006
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
jmp 0x40505c
push 0x18
call fcn.00403027
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push dword [ebp - 4]
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
and dword [eax + 0x14], 0
mov esp, ebp
pop ebp
ret
Function at 0x405dbd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45323c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x40b0
call fcn.0043a580
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 8], 0
jne 0x405df4
xor eax, eax
inc eax
jmp 0x405fc2
mov byte [ebp - 0x40c0], 0
push 0x3fff
push 0
lea eax, [ebp - 0x40bf]
push eax
call fcn.00438ec0
add esp, 0xc
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push 0x4000
lea eax, [ebp - 0x40c0]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004170ba
add esp, 0xc
cmp dword [ebp - 0x14], 0x3c00
jge 0x405ef9
push 0x4000
lea eax, [ebp - 0x40c0]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [eax + 0xc]
call fcn.00416b81
add esp, 0x10
cmp dword [ebp - 0x14], 0x3c00
jge 0x405ef9
push 0x4000
lea eax, [ebp - 0x40c0]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00416a4d
add esp, 0x10
cmp dword [ebp - 0x14], 0x3c00
jge 0x405ef9
push 0x4000
lea eax, [ebp - 0x40c0]
push eax
lea eax, [ebp - 0x14]
push eax
push 0xa
push 0xa
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [eax + 0xc]
call fcn.004167ea
add esp, 0x18
cmp dword [ebp - 0x14], 0x3c00
jge 0x405ef9
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00417222
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x4000
lea eax, [ebp - 0x40c0]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x34]
push eax
call fcn.00416e14
add esp, 0x14
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push str.except.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
push 2
push 0
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x40c0]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call fcn.00405c97
pop ecx
jmp 0x405f5b
or dword [ebp - 4], 0xffffffff
jmp 0x405f65
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [ebp + 0xc]
push str.Structured_exception_caught._Class_0x_08X._Thread_:_0x_08X
lea eax, [ebp - 0xc0]
push eax
call fcn.0043a06d
add esp, 0x10
lea eax, [ebp - 0xc0]
push eax
push str.EXCEPTION_EXECUTE_HANDLER
push 0x2b4
push str.D:projectsutil_srcplatform.cpp
call fcn.0040538a
add esp, 0x10
lea eax, [ebp - 0x40c0]
push eax
push str.EXCEPTION_EXECUTE_HANDLER
push 0x2b5
push str.D:projectsutil_srcplatform.cpp
call fcn.0040538a
add esp, 0x10
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4063f8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx + 8]
mov byte [eax + 8], cl
call fcn.0040407c
movzx eax, al
test eax, eax
je 0x40647d
call fcn.00404fca
cmp eax, 0xffffffff
je 0x40647d
call fcn.00404fca
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406457
push dword [ebp - 4]
call fcn.0041f982
pop ecx
movzx eax, al
test eax, eax
je 0x406455
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], eax
jmp 0x40647d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40647d
push str.NO_ERROR__GetLastError__
push 0x457ac4
push 0x270
push str.D:projectsutil_srcgstring.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [eax], 0x47934c
mov eax, dword [ebp - 4]
and dword [eax + 4], 0
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [eax + 0x47934c]
test eax, eax
je 0x4064b5
push 0x273
push str.D:projectsutil_srcgstring.cpp
push str.___stbuf_0_
call fcn.00404768
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov byte [eax + ecx], 0
mov ecx, dword [ebp + 8]
call fcn.004084b1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406503
mov eax, dword [ebp - 8]
inc eax
push eax
mov ecx, dword [ebp - 4]
call fcn.004088bf
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [eax]
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00438870
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x40650c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0xff
call fcn.0040407c
movzx eax, al
test eax, eax
je 0x40658c
call fcn.00404fca
cmp eax, 0xffffffff
je 0x40658c
call fcn.00404fca
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406566
push dword [ebp - 4]
call fcn.0041f982
pop ecx
movzx eax, al
test eax, eax
je 0x406564
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
jmp 0x40658c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40658c
push str.NO_ERROR__GetLastError__
push 0x457ac4
push 0x27f
push str.D:projectsutil_srcgstring.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [eax], 0x47934c
mov eax, dword [ebp - 4]
and dword [eax + 4], 0
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [eax + 0x47934c]
test eax, eax
je 0x4065c4
push 0x282
push str.D:projectsutil_srcgstring.cpp
push str.___stbuf_0_
call fcn.00404768
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov byte [eax + ecx], 0
cmp dword [ebp + 8], 0
je 0x406612
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
movsx eax, byte [ecx + eax]
test eax, eax
je 0x406612
push dword [ebp + 8]
call fcn.00438f50
pop ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
push eax
mov ecx, dword [ebp - 4]
call fcn.004088bf
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.0043a100
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x40661b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0xff
call fcn.0040407c
movzx eax, al
test eax, eax
je 0x40669a
call fcn.00404fca
cmp eax, 0xffffffff
je 0x40669a
call fcn.00404fca
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406674
push dword [ebp - 4]
call fcn.0041f982
pop ecx
movzx eax, al
test eax, eax
je 0x406672
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
jmp 0x40669a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40669a
push str.NO_ERROR__GetLastError__
push 0x457ac4
push 0x267
push str.D:projectsutil_srcgstring.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [eax], 0x47934c
mov eax, dword [ebp - 4]
and dword [eax + 4], 0
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [eax + 0x47934c]
test eax, eax
je 0x4066d2
push 0x26a
push str.D:projectsutil_srcgstring.cpp
push str.___stbuf_0_
call fcn.00404768
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4066e8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
call fcn.0040407c
movzx eax, al
test eax, eax
je 0x406760
call fcn.00404fca
cmp eax, 0xffffffff
je 0x406760
call fcn.00404fca
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40673a
push dword [ebp - 8]
call fcn.0041f982
pop ecx
movzx eax, al
test eax, eax
je 0x406738
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
jmp 0x406760
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406760
push str.NO_ERROR__GetLastError__
push 0x457ac4
push 0x29d
push str.D:projectsutil_srcgstring.cpp
call fcn.00405131
add esp, 0x10
mov ecx, dword [ebp - 8]
call fcn.004074eb
mov esp, ebp
pop ebp
ret

Function at 0x40bf12
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4536b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004097ea
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.GARG_LIST.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0040beaf
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x19]
call fcn.0040650c
mov byte [ebp - 4], 2
lea eax, [ebp - 0x19]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.0040ca4d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x19]
call fcn.004066e8
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40dce1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4539ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
and dword [ebp - 0x14], 0
push 1
push str.GRemoveReservedFilesystemCharsFromString
lea ecx, [ebp - 0x58]
call fcn.00411882
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.004063f8
mov byte [ebp - 4], 2
mov byte [ebp - 0x44], 0x5c
mov byte [ebp - 0x43], 0x2f
mov byte [ebp - 0x42], 0x3a
mov byte [ebp - 0x41], 0x2a
mov byte [ebp - 0x40], 0x3f
mov byte [ebp - 0x3f], 0x22
mov byte [ebp - 0x3e], 0x3c
mov byte [ebp - 0x3d], 0x3e
mov byte [ebp - 0x3c], 0x7c
mov byte [ebp - 0x3b], 0
and dword [ebp - 0x10], 0
jmp 0x40dd5a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movsx eax, byte [ebp + eax - 0x44]
test eax, eax
je 0x40ddf5
push 1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004091f8
test eax, eax
je 0x40ddf0
push 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
call fcn.004085bc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x40ddeb
mov byte [ebp + 0x10], 0
push dword [ebp + 0xc]
push str.Illegal_chars_found_in_value_name:
lea eax, [ebp - 0x35]
push eax
call fcn.00406b1f
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x20]
call fcn.00406b07
push eax
push str.GREG
push 0x431
push str.D:projectsutil_srcgfio.cpp
call fcn.00405613
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x35]
call fcn.004066e8
jmp 0x40dd6a
jmp 0x40dd53
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004063f8
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004066e8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00411939
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40eacc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453fc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], ecx
push str.GFIO::Read
lea ecx, [ebp - 0x38]
call fcn.004117cd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 5], 0
jne 0x40eb20
push str.m_handle
push str.GFIO
push 0x1c6
push str.D:projectsutil_srcgfio.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 0x10]
cmp dword [eax + 5], 0
jne 0x40eb41
and dword [ebp - 0x14], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00411939
mov eax, dword [ebp - 0x14]
jmp 0x40ebc1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [eax + 5]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40eb8e
xor eax, eax
inc eax
je 0x40eb79
push 0x1c9
push str.D:projectsutil_srcgfio.cpp
push 0x456614
call fcn.00404768
add esp, 0xc
and dword [ebp - 0x18], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00411939
mov eax, dword [ebp - 0x18]
jmp 0x40ebc1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
je 0x40ebab
and dword [ebp - 0x20], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00411939
mov eax, dword [ebp - 0x20]
jmp 0x40ebc1
mov dword [ebp - 0x24], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00411939
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x40ee61
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453a30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x14], ecx
push str.GFIO::SetFileSize
lea ecx, [ebp - 0x34]
call fcn.004117cd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 5], 0
jne 0x40eeb5
push str.m_handle
push str.GFIO
push 0x24b
push str.D:projectsutil_srcgfio.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 0x14]
cmp dword [eax + 5], 0
jne 0x40eed3
and dword [ebp - 0x18], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00411939
mov eax, dword [ebp - 0x18]
jmp 0x40ef2a
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
call dword [eax + 0x18]
test eax, eax
jne 0x40eefa
and dword [ebp - 0x1c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00411939
mov eax, dword [ebp - 0x1c]
jmp 0x40ef2a
mov eax, dword [ebp - 0x14]
push dword [eax + 5]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x40ef10
mov byte [ebp - 0xd], 1
jmp 0x40ef14
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
mov dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00411939
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ef3a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453a42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
push str.GFIO::Size
lea ecx, [ebp - 0x2c]
call fcn.004117cd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 5], 0
jne 0x40ef8e
push str.m_handle
push str.GFIO
push 0x239
push str.D:projectsutil_srcgfio.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 0x10]
cmp dword [eax + 5], 0
jne 0x40efac
and dword [ebp - 0x14], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00411939
mov eax, dword [ebp - 0x14]
jmp 0x40efd5
push 0
mov eax, dword [ebp - 0x10]
push dword [eax + 5]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x18], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00411939
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40efe5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453a42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x14], ecx
push str.GFIO::SizeEx
lea ecx, [ebp - 0x2c]
call fcn.004117cd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 5], 0
jne 0x40f039
push str.m_handle
push str.GFIO
push 0x242
push str.D:projectsutil_srcgfio.cpp
call fcn.00405131
add esp, 0x10
mov eax, dword [ebp - 0x14]
cmp dword [eax + 5], 0
jne 0x40f057
mov byte [ebp - 0xd], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00411939
mov al, byte [ebp - 0xd]
jmp 0x40f0c7
push dword [ebp + 8]
mov eax, dword [ebp - 0x14]
push dword [eax + 5]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40f07f
mov byte [ebp - 0xe], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00411939
mov al, byte [ebp - 0xe]
jmp 0x40f0c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00405ba3
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x40f0b4
push 0x45769c
push dword [ebp - 0x18]
push str.GFIO
push 0x245
push str.D:projectsutil_srcgfio.cpp
call fcn.00405539
add esp, 0x14
mov byte [ebp - 0xf], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00411939
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4