joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d9b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x404
test eax, eax
jne 0x46da8e
mov word [ebp - 0x404], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push 0
lea eax, [ebp - 4]
mov dword [ebp + 0xc], 0
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46db08
mov eax, dword [ebp - 4]
push esi
push edi
cmp eax, 1
je 0x46da10
cmp eax, 2
jne 0x46dac1
mov esi, dword [ebp + 0xc]
and esi, 0xfffffffe
mov dword [ebp + 0xc], esi
cmp esi, 0xbebc200
jae 0x46db01
mov eax, esi
mov ecx, 2
shr eax, 1
or edi, 0xffffffff
inc eax
mul ecx
cmovb eax, edi
push eax
call fcn.005519f1
add esp, 4
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0xc]
xor edx, edx
shr ecx, 1
mov word [edi + ecx*2], dx
mov ecx, dword [ebp - 4]
cmp ecx, 1
je 0x46da75
cmp ecx, 2
jne 0x46dab8
cmp eax, 0xea
jne 0x46dacc
push edi
call fcn.005519fa
add esp, 4
lea esi, [esi*2 + 0xfa0]
jmp 0x46da16
push 0x200
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x46d9cb
mov eax, 0x57
mov esp, ebp
pop ebp
ret
push edi
call fcn.005519fa
add esp, 4
pop edi
mov eax, 0xd
pop esi
mov esp, ebp
pop ebp
ret
push 0xa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.0054dd70
push edi
mov esi, eax
call fcn.005519fa
add esp, 0x14
test esi, esi
jne 0x46daee
cmp word [edi], si
jne 0x46dac1
xor eax, eax
mov ecx, 0xea
cmp esi, dword [ebp + 0x14]
pop edi
cmovg eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xe
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46db10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6d94fd
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
sub esp, 0x410
push ebx
push esi
push edi
test eax, eax
jne 0x46dc44
mov word [ebp - 0x41c], ax
mov eax, dword [ebp + 0x10]
mov edi, 0x6e7a86
test eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0x4000000
mov dword [ebp - 0x1c], 0
cmovne edi, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x4000000
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xd], 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
push 4
push 0
push 0
push edi
mov byte [ebp - 0xf], 1
call fcn.0054df30
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.005519f1
push 0
mov ebx, eax
push esi
push ebx
push edi
mov dword [ebp - 0x18], ebx
call fcn.0054df30
mov ecx, ebx
add esp, 0x24
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46dbd7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push ebx
call fcn.005519fa
add esp, 4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov eax, esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x4000000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x200
lea ecx, [ebp - 0x41c]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x46db43
mov ecx, dword [ebp - 0xc]
mov eax, 0x57
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4793d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul edx, ecx, 0x1000193
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 5]
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
pop esi
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
pop ebp
ret 4
Function at 0x481130
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x481162
push esi
call fcn.00484c00
add esp, 4
cmp byte [esi + 0x40], 0
je 0x48115b
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x4811ee
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x4811d8
lea ecx, [ecx]
mov eax, dword [esi + 8]
test eax, eax
je 0x48118f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x4811d2
cmp eax, 2
je 0x4811d8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x481180
cmp eax, 3
je 0x4811b7
cmp eax, 1
jne 0x481180
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x481180
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x481180
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00481220
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x481210
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.00481220
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x481220
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x48124e
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
je 0x4812d2
lea ebx, [esi + 0x78]
lea ecx, [ecx]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x4812a6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x481285
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x4812e9
cmp eax, dword [esi + 0x60]
jb 0x481267
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
jne 0x481260
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x48b200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x4c], 1
mov ebx, dword [esi + 0x1b8]
mov dword [ebp - 0x14], ebx
jne 0x48b226
mov eax, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x48b22b
xor eax, eax
mov byte [ebx + 0x1c], al
push dword [esi + 0x64]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
push 1
mov eax, dword [ecx + 8]
push esi
call eax
mov dword [ebx + 0x18], eax
xor edi, edi
mov eax, dword [ebx + 0x14]
add esp, 0x10
cmp dword [esi + 0x64], edi
jle 0x48b313
mov ecx, dword [ebx + edi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
je 0x48b273
mov eax, dword [ebx + 0x18]
add dword [eax + edi*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov eax, dword [eax + edi*4]
mov dword [ebp - 8], eax
lea eax, [ecx - 1]
push eax
push ebx
push edi
push esi
call fcn.0048b5a0
add esp, 0x10
mov edx, eax
xor esi, esi
cmp esi, edx
jle 0x48b2ae
mov eax, dword [ebp - 0x10]
inc ebx
dec eax
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.0048b5a0
mov edx, eax
add esp, 0x10
cmp esi, edx
jg 0x48b295
mov ecx, dword [ebp - 0xc]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 8]
mov byte [esi + eax], cl
inc esi
cmp esi, 0xff
jle 0x48b291
cmp dword [ebp - 4], 0
je 0x48b300
mov ebx, eax
mov ecx, 1
lea edx, [ebx - 1]
lea esp, [esp]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x48b2e0
mov esi, dword [ebp + 8]
inc edi
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
cmp edi, dword [esi + 0x64]
jl 0x48b256
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49b610
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x90], 0
mov dword [esi], vtable.CFileWriterThread.0
jne 0x49b63d
push 1
call fcn.0049e350
mov ecx, esi
call fcn.00541350
test al, al
je 0x49b63d
push 0
mov ecx, esi
call fcn.00541940
lea ecx, [esi + 0x80]
call fcn.0049b480
lea ecx, [esi + 0x70]
call fcn.00541140
lea ecx, [esi + 0x50]
call fcn.0049b3a0
lea ecx, [esi + 0x38]
call fcn.00541100
mov ecx, esi
pop esi
jmp fcn.00540f00
Function at 0x49b8a0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.0049d360
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049d360
lea ecx, [ebp - 0xc]
call fcn.0049d1a0
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0049d1a0
movzx ecx, byte [ebp + 0x10]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49b912
push eax
call fcn.005519fa
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49b922
push eax
call fcn.005519fa
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49b932
push eax
call fcn.005519fa
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49b942
push ecx
call fcn.005519fa
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49b950
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x82a4b4], 0
push ebx
jne 0x49b964
xor eax, eax
jmp 0x49b977
lea eax, [ebp - 4]
push eax
push 3
push str.BCreateDirectory
call fcn.00540320
add esp, 0xc
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], vtable.CPathString.0
mov dword [ebp - 8], 0
call fcn.0049d360
push 0
lea ecx, [ebp - 0x10]
call fcn.0049d1a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x49b9bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x49b9bb
xor bl, bl
jmp 0x49b9bd
mov bl, 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x49b9cd
push eax
call fcn.005519fa
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49b9dd
push eax
call fcn.005519fa
add esp, 4
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x49b9ed
push ecx
call fcn.005402e0
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49bae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049d360
lea ecx, [ebp - 0xc]
call fcn.0049d1a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49bb27
push eax
call fcn.005519fa
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x49bb37
push ecx
call fcn.005519fa
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49bb40
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.CPathString.0
mov dword [ebp - 0x1c], 0
call fcn.0049d360
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebx], 0
mov dword [ebx + 4], 0
test edi, edi
je 0x49bb88
mov dword [edi], 0
mov dword [edi + 4], 0
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x49bb9c
mov dword [esi], 0
mov dword [esi + 4], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.0049d1a0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49bbe8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
test edi, edi
je 0x49bbd5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
test esi, esi
je 0x49bbe4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov bl, 1
jmp 0x49bbea
xor bl, bl
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49bbfa
push eax
call fcn.005519fa
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x49bc0a
push eax
call fcn.005519fa
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49bc30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049d360
lea ecx, [ebp - 0xc]
call fcn.0049d1a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49bc6e
test al, 0x10
je 0x49bc6e
mov bl, 1
jmp 0x49bc70
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x49bc80
push eax
call fcn.005519fa
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49bc90
push eax
call fcn.005519fa
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49bd80
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
cmp dword [0x82a4b4], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x49bd9b
xor eax, eax
jmp 0x49bdae
lea eax, [ebp - 0x10]
push eax
push 3
push str.CFileReader::BOpenFile
call fcn.00540320
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov dword [edi + 0x30], 0
cmp eax, 0xffffffff
je 0x49bdd6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x49bdd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0xffffffff
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
and eax, 0xffffffb3
je 0x49be2a
push eax
push str.unsupported_flags_0x_x_passed_to_CFileReader::BOpenFile
push 0x1400
push str.C:_buildworker_steam_rel_client_win32_build_src_tier1_fileio.cpp
call fcn.0053aeb0
add esp, 0x10
test al, al
jne 0x49be27
int3
and ebx, 0x4c
cmp byte [edi + 0x2c], 0
je 0x49bf37
xor esi, esi
mov dword [ebp - 0xc], vtable.CPathString.0
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], esi
call fcn.0049d360
push 0x3a
push dword [ebp - 8]
call fcn.00553400
add esp, 8
test eax, eax
je 0x49beb5
mov ecx, dword [ebp - 8]
mov edx, 0x100
sub eax, ecx
lea esi, [eax + 2]
mov eax, 0xff
cmp esi, eax
cmova esi, eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ecx
lea eax, [ebp - 0x11c]
push eax
call fcn.0054ba20
add esp, 0xc
mov byte [ebp + esi - 0x11c], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
xor esi, esi
jmp 0x49becd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
cmovne esi, dword [ebp + 0xc]
test eax, eax
je 0x49bef1
push eax
call fcn.005519fa
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49bf08
push eax
call fcn.005519fa
add esp, 4
mov dword [ebp - 8], 0
mov dword [edi + 0x30], esi
test esi, esi
je 0x49bf14
or ebx, 2
jmp 0x49bf37
push dword [ebp + 8]
push str.Failed_to_get_sector_size_for_drive_file__s_is_on__not_using_unbuffered_IO
push 0x140f
push str.C:_buildworker_steam_rel_client_win32_build_src_tier1_fileio.cpp
call fcn.0053aeb0
add esp, 0x10
test al, al
jne 0x49bf33
int3
mov byte [edi + 0x2c], 0
push edi
push ebx
test bl, 0x40
mov ecx, 0
push 0
mov eax, 3
cmovne eax, ecx
push eax
push 1
push dword [ebp + 8]
call fcn.0049c9e0
add esp, 0x18
test eax, eax
jne 0x49bf66
cmp dword [edi], 0xffffffff
je 0x49bf66
mov bl, 1
jmp 0x49bf68
xor bl, bl
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x49bf78
push ecx
call fcn.005402e0
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49c3b0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
call fcn.0049d9d0
add esp, 4
mov dword [ebp - 0xc], vtable.CPathString.0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push 0
push dword [ebp + 8]
call fcn.0049d360
lea ecx, [ebp - 0xc]
call fcn.0049d1a0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49c401
push eax
call fcn.005519fa
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x49c411
push ecx
call fcn.005519fa
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49c420
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
push ecx
mov eax, esp
lea ecx, [ebp - 0x434]
mov dword [eax], 0x6ea6a8
push dword [ebp + 8]
call fcn.0049b0c0
lea ecx, [ebp - 0x434]
call fcn.0049bca0
test al, al
je 0x49c583
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea esp, [esp]
push dword [ebp + 8]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x18], vtable.CPathString.0
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
call fcn.0049d360
mov eax, dword [ebp - 0x42c]
mov esi, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, ecx
shr eax, 4
test al, 1
je 0x49c515
shr ecx, 0xa
test cl, 1
je 0x49c506
push esi
call fcn.0049d9d0
add esp, 4
mov dword [ebp - 0xc], vtable.CPathString.0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push 0
push esi
call fcn.0049d360
lea ecx, [ebp - 0xc]
call fcn.0049d1a0
push eax
call edi
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
test eax, eax
je 0x49c4ed
push eax
call fcn.005519fa
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49c53e
push eax
call fcn.005519fa
add esp, 4
mov dword [ebp - 8], 0
jmp 0x49c53e
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.0049c420
add esp, 4
jmp 0x49c53e
push esi
call fcn.0049e720
add esp, 4
test al, al
jne 0x49c53e
push esi
call fcn.0049bae0
add esp, 4
test al, al
je 0x49c53e
push esi
call fcn.0049d9d0
push esi
call fcn.0049e720
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], vtable.CPathString.0
test eax, eax
je 0x49c55c
push eax
call fcn.005519fa
add esp, 4
mov dword [ebp - 0x10], 0
test esi, esi
je 0x49c570
push esi
call fcn.005519fa
add esp, 4
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x434]
call fcn.0049bca0
test al, al
jne 0x49c460
push dword [ebp + 8]
call fcn.0049c3b0
mov ecx, dword [ebp - 0x430]
add esp, 4
mov bl, al
cmp ecx, 0xffffffff
je 0x49c5a2
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x250
push dword [ebp - 0x42c]
call fcn.005519e3
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c5c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.0049d360
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049d360
lea ecx, [ebp - 0xc]
call fcn.0049d1a0
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0049d1a0
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x49c62f
push eax
call fcn.005519fa
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x49c63f
push eax
call fcn.005519fa
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49c64f
push eax
call fcn.005519fa
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49c65f
push ecx
call fcn.005519fa
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49c860
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.0049d360
mov edi, dword [ebp - 0x14]
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.0049bae0
add esp, 4
test al, al
jne 0x49c964
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49c8a1
sub ecx, edx
lea esi, [edi - 1]
add esi, ecx
cmp esi, edi
jbe 0x49c92a
cmp byte [esi], 0x5c
jne 0x49c922
push 0
push edi
lea ecx, [ebp - 0xc]
mov byte [esi], 0
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.0049d360
lea ecx, [ebp - 0xc]
call fcn.0049d1a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0xc], vtable.CPathString.0
test ecx, ecx
je 0x49c903
push ecx
call fcn.005519fa
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x49c91a
push eax
call fcn.005519fa
add esp, 4
mov dword [ebp - 8], 0
mov byte [esi], 0x5c
cmp ebx, 0xffffffff
jne 0x49c929
dec esi
cmp esi, edi
ja 0x49c8b3
jmp 0x49c92a
inc esi
mov al, byte [esi]
test al, al
je 0x49c94f
cmp al, 0x5c
jne 0x49c947
push ecx
mov eax, esp
mov byte [esi], 0
mov dword [eax], edi
call fcn.0049b950
add esp, 4
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x49c930
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.0049b950
add esp, 4
test al, al
jne 0x49c964
xor bl, bl
jmp 0x49c966
mov bl, 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49c976
push eax
call fcn.005519fa
add esp, 4
test edi, edi
je 0x49c983
push edi
call fcn.005519fa
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret