joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cf50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [ecx]
push edi
mov edi, dword [ebp + 0x14]
cmp esi, 7
jle 0x46d010
test bl, 3
je 0x46cf88
movzx edx, byte [ebx]
dec esi
movzx ecx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edi + edx*4]
test bl, 3
jne 0x46cf73
mov ecx, esi
and ecx, 0xfffffff8
add ebx, ecx
sub esi, ecx
neg ecx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ecx
je 0x46d00d
mov esi, ecx
xor eax, dword [esi + ebx]
movzx ecx, al
shr eax, 8
mov edx, dword [edi + ecx*4 + 0xc00]
movzx ecx, al
shr eax, 8
xor edx, dword [edi + ecx*4 + 0x800]
movzx ecx, al
shr eax, 8
mov ebx, dword [edi + ecx*4 + 0x400]
xor ebx, dword [edi + eax*4]
mov eax, dword [ebp + 0xc]
xor ebx, dword [esi + eax + 4]
xor ebx, edx
movzx eax, bl
shr ebx, 8
mov ecx, dword [edi + eax*4 + 0xc00]
movzx eax, bl
shr ebx, 8
xor ecx, dword [edi + eax*4 + 0x800]
movzx eax, bl
shr ebx, 8
mov eax, dword [edi + eax*4 + 0x400]
xor eax, dword [edi + ebx*4]
mov ebx, dword [ebp + 0xc]
xor eax, ecx
add esi, 8
jne 0x46cfa0
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test esi, esi
jle 0x46d02d
movzx edx, byte [ebx]
lea ebx, [ebx + 1]
movzx ecx, al
dec esi
xor edx, ecx
shr eax, 8
xor eax, dword [edi + edx*4]
test esi, esi
jg 0x46d014
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470b70
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x90], 0
mov dword [esi], vtable.CFileWriterThread.0
jne 0x470b9d
push 1
call fcn.00473240
mov ecx, esi
call fcn.00481b60
test al, al
je 0x470b9d
push 0
mov ecx, esi
call fcn.00482000
lea ecx, [esi + 0x80]
call fcn.00470a10
lea ecx, [esi + 0x70]
call fcn.00481a60
lea ecx, [esi + 0x50]
call fcn.00470920
lea ecx, [esi + 0x38]
call fcn.00481a20
mov ecx, esi
pop esi
jmp fcn.004817b0

Function at 0x470dd0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.00472350
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00472180
movzx ecx, byte [ebp + 0x10]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x470e42
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x470e52
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x470e62
push eax
call fcn.0056bbd4
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x470e72
push ecx
call fcn.0056bbd4
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470e80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x65ff14], 0
push ebx
jne 0x470e94
xor eax, eax
jmp 0x470ea7
lea eax, [ebp - 4]
push eax
push 3
push str.BCreateDirectory
call fcn.00479970
add esp, 0xc
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], vtable.CPathString.0
mov dword [ebp - 8], 0
call fcn.00472350
push 0
lea ecx, [ebp - 0x10]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x470eeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x470eeb
xor bl, bl
jmp 0x470eed
mov bl, 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x470efd
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x470f0d
push eax
call fcn.0056bbd4
add esp, 4
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x470f1d
push ecx
call fcn.00479930
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x470fb7
push eax
call fcn.0056bbd4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x470fc7
push ecx
call fcn.0056bbd4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47101e
test al, 0x10
je 0x47101e
mov bl, 1
jmp 0x471020
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x471030
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x471040
push eax
call fcn.0056bbd4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471130
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
cmp dword [0x65ff14], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x47114b
xor eax, eax
jmp 0x47115e
lea eax, [ebp - 0x10]
push eax
push 3
push str.CFileReader::BOpenFile
call fcn.00479970
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov dword [edi + 0x30], 0
cmp eax, 0xffffffff
je 0x471186
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x471180
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0xffffffff
mov ebx, dword [ebp + 0xc]
mov eax, ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
and eax, 0xffffffb3
je 0x4711da
push eax
push str.unsupported_flags_0x_x_passed_to_CFileReader::BOpenFile
push 0x13b5
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.004775b0
add esp, 0x10
test al, al
jne 0x4711d7
int3
and ebx, 0x4c
cmp byte [edi + 0x2c], 0
je 0x4712e7
xor esi, esi
mov dword [ebp - 0xc], vtable.CPathString.0
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], esi
call fcn.00472350
push 0x3a
push dword [ebp - 8]
call fcn.0056e2f0
add esp, 8
test eax, eax
je 0x471265
mov ecx, dword [ebp - 8]
mov edx, 0x100
sub eax, ecx
lea esi, [eax + 2]
mov eax, 0xff
cmp esi, eax
cmova esi, eax
cmp esi, edx
mov eax, esi
cmova eax, edx
push eax
push ecx
lea eax, [ebp - 0x11c]
push eax
call fcn.0046a6e0
add esp, 0xc
mov byte [ebp + esi - 0x11c], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
xor esi, esi
jmp 0x47127d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
cmovne esi, dword [ebp + 0xc]
test eax, eax
je 0x4712a1
push eax
call fcn.0056bbd4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4712b8
push eax
call fcn.0056bbd4
add esp, 4
mov dword [ebp - 8], 0
mov dword [edi + 0x30], esi
test esi, esi
je 0x4712c4
or ebx, 2
jmp 0x4712e7
push dword [ebp + 8]
push str.Failed_to_get_sector_size_for_drive_file__s_is_on__not_using_unbuffered_IO
push 0x13c4
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.004775b0
add esp, 0x10
test al, al
jne 0x4712e3
int3
mov byte [edi + 0x2c], 0
push edi
push ebx
test bl, 0x40
mov ecx, 0
push 0
mov eax, 3
cmovne eax, ecx
push eax
push 1
push dword [ebp + 8]
call fcn.00471ce0
add esp, 0x18
test eax, eax
jne 0x471316
cmp dword [edi], 0xffffffff
je 0x471316
mov bl, 1
jmp 0x471318
xor bl, bl
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x471328
push ecx
call fcn.00479930
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4716e0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
call fcn.00472900
add esp, 4
mov dword [ebp - 0xc], vtable.CPathString.0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push 0
push dword [ebp + 8]
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x471731
push eax
call fcn.0056bbd4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x471741
push ecx
call fcn.0056bbd4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471a30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.00472350
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00472180
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x471a9f
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x471aaf
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x471abf
push eax
call fcn.0056bbd4
add esp, 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x471acf
push ecx
call fcn.0056bbd4
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x471b90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CPathString.0
mov dword [ebp - 0x10], 0
call fcn.00472350
mov edi, dword [ebp - 0x14]
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.00470f70
add esp, 4
test al, al
jne 0x471c97
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471bd1
sub ecx, edx
lea esi, [edi - 1]
add esi, ecx
cmp esi, edi
jbe 0x471c5d
cmp byte [esi], 0x5c
jne 0x471c55
push 0
push edi
lea ecx, [ebp - 0xc]
mov byte [esi], 0
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], vtable.CPathString.0
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x471c37
push eax
call fcn.0056bbd4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x471c4e
push eax
call fcn.0056bbd4
add esp, 4
mov dword [ebp - 8], 0
mov byte [esi], 0x5c
test bl, bl
jne 0x471c5c
dec esi
cmp esi, edi
ja 0x471be3
jmp 0x471c5d
inc esi
mov al, byte [esi]
test al, al
je 0x471c82
cmp al, 0x5c
jne 0x471c7a
push ecx
mov eax, esp
mov byte [esi], 0
mov dword [eax], edi
call fcn.00470e80
add esp, 4
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x471c63
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.00470e80
add esp, 4
test al, al
jne 0x471c97
xor bl, bl
jmp 0x471c99
mov bl, 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x471ca9
push eax
call fcn.0056bbd4
add esp, 4
test edi, edi
je 0x471cb6
push edi
call fcn.0056bbd4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471ce0
Capabilities:
Inspect section memory permissions
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], vtable.CPathString.0
mov dword [ebp - 0xc], 0
call fcn.00472350
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
mov eax, dword [ebp + 0x1c]
shl ecx, 0x1f
mov edx, ecx
or edx, 0x40000000
mov dword [eax], 0xffffffff
mov eax, ebx
and al, 2
mov eax, 0xc0000000
cmove edx, ecx
cmp ebx, 4
cmove edx, eax
mov eax, edx
or eax, 4
and bl, 8
cmove eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
cmp eax, 7
ja case.default.0x471d7a
jmp dword [eax*4 + 0x471e8c]
xor edi, edi
jmp 0x471d6e
mov edi, 1
jmp 0x471d6e
mov edi, 2
jmp 0x471d6e
mov edi, 3
jmp 0x471d6e
mov edi, 7
mov eax, dword [ebp + 0x14]
cmp eax, 3
ja case.default.0x471d7a
jmp dword [eax*4 + 0x471eac]
mov ebx, 3
jmp 0x471d9b
mov ebx, 4
jmp 0x471d9b
mov ebx, 1
jmp 0x471d9b
mov ebx, 2
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
and ecx, 1
shl ecx, 0x1e
sub ecx, 0xffffff80
mov edx, ecx
or edx, 0x20000000
and al, 2
cmove edx, ecx
mov ecx, dword [ebp + 0x18]
mov esi, edx
mov eax, ecx
or esi, 0x8000000
and al, 8
cmove esi, edx
test cl, 0x10
je 0x471dda
and esi, 0xffffff7f
or esi, 0x100
mov eax, ecx
mov ecx, esi
or ecx, 0x4000000
and al, 0x20
push 0
cmove ecx, esi
push ecx
push ebx
push 0
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 0x1c]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x471e16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x471e60
mov ebx, dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileTime]
test bl, 4
je 0x471e3d
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push ecx
push 0
push eax
mov dword [ebp - 4], 0xffffffff
call esi
test bl, bl
jns 0x471e57
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [edi]
call esi
xor esi, esi
jmp 0x471e60
mov esi, 0x57
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x471e70
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x471e80
push eax
call fcn.0056bbd4
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
je 0x471f33
mov dword [esi], 0
mov esi, dword [ebp + 0x10]
xor edi, edi
test esi, esi
je 0x471f92
mov ebx, dword [ebp + 0xc]
mov ecx, 0x40000000
mov dword [ebp + 0x10], 0
cmp esi, ecx
mov eax, esi
push 0
cmova eax, ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x471f78
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x471f92
add ebx, eax
add edi, eax
sub esi, eax
je 0x471f92
jmp 0x471f3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x471f8e
test edi, edi
jne 0x471f92
pop edi
pop esi
pop ebx
pop ebp
ret
test eax, eax
jne 0x471fb3
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x471faf
test esi, esi
je 0x471fb1
push 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, 0x26
pop ebx
pop ebp
ret
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x471fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
test eax, eax
push ebx
lea ebx, [ebp - 4]
cmovne ebx, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
xor ebx, ebx
test edi, edi
je 0x472040
xor esi, esi
lea eax, [ebp + 0x14]
push esi
push eax
mov ecx, 0x40000000
mov dword [ebp + 0x14], esi
cmp edi, ecx
mov eax, edi
cmova eax, ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x47202c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x472033
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x472037
test ebx, ebx
jne 0x472040
add dword [ebp + 0xc], esi
add ebx, esi
sub edi, esi
jmp 0x471fec
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472900
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x472951
test al, 3
je 0x47294d
and eax, 0xfffffffc
lea ecx, [ebp - 0xc]
push eax
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x472953
xor bl, bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x472963
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x472973
push eax
call fcn.0056bbd4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x472fc4
mov edi, dword [esi + 0x1c]
lea ecx, [ebp - 4]
push ebx
xor ebx, ebx
push ebx
push ecx
push edi
push dword [esi + 0xc]
mov dword [ebp - 4], ebx
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x472f9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x472fa0
jmp 0x472fa4
mov ebx, dword [ebp - 4]
cmp edi, ebx
je 0x472fb1
mov eax, dword [esi + 4]
mov ecx, 1
add eax, 0x1c
xchg dword [eax], ecx
mov eax, dword [esi + 4]
neg edi
add eax, 0x18
lock xadd dword [eax], edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
test eax, eax
je 0x47308f
cmp byte [eax], 0
je 0x47308f
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, dword [esi + 8]
mov edi, 0x593544
test ecx, ecx
mov edx, edi
push eax
cmovne edx, ecx
lea eax, [ebp - 0x14]
push edx
push str._s.async_u.tmp
push eax
call fcn.0046aaa0
add esp, 0x10
cmp byte [ebp - 5], 0
jge 0x473010
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x473013
mov eax, edi
jmp 0x473013
lea eax, [ebp - 0x14]
push 1
push eax
lea eax, [esi + 0xc]
push eax
call fcn.004730c0
add esp, 0xc
test al, al
je 0x473072
mov eax, dword [esi + 8]
test eax, eax
cmovne edi, eax
cmp byte [ebp - 5], 0
jge 0x473042
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x473045
mov eax, 0x593544
jmp 0x473045
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00471a30
add esp, 8
test al, al
jne 0x473072
cmp byte [ebp - 5], al
jge 0x473066
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x473069
mov eax, 0x593544
jmp 0x473069
lea eax, [ebp - 0x14]
push eax
call fcn.00473470
add esp, 4
cmp byte [ebp - 5], 0
jge 0x4730ab
call fcn.00480220
push 0
push dword [ebp - 0x14]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Invalid_FileWriterItem_t
push 0x158a
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.004775a0
add esp, 0xc
test al, al
jne 0x4730ab
int3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4730c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], vtable.CPathString.0
mov dword [ebp - 0xc], 0
call fcn.00472350
push dword [ebp - 0x10]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.0046b5e0
push dword [ebp - 4]
call fcn.00469ed0
mov eax, dword [ebp - 4]
mov ecx, esp
mov dword [ecx], eax
call fcn.00471b90
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
xor esi, esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x14]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x473174
call ebx
cmp eax, 0x20
jne 0x473170
push 0xa
call fcn.00482680
inc esi
add esp, 4
cmp esi, 0xa
jl 0x473115
push str.INVALID_HANDLE_VALUE:_ERROR_SHARING_VIOLATION
push 0x8b0
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier1_fileio.cpp
call fcn.004775a0
add esp, 0xc
test al, al
jne 0x473170
int3
xor bl, bl
jmp 0x4731ad
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
mov dword [ebp - 8], 0
push dword [esi + 0x10]
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test byte [ebp + 0x10], 1
je 0x47319d
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 8]
sete bl
call fcn.00480220
push 0
push dword [ebp - 4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4731ce
push eax
call fcn.0056bbd4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4731de
push eax
call fcn.0056bbd4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.00472350
lea ecx, [ebp - 0xc]
call fcn.00472180
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x4734b6
push eax
call fcn.0056bbd4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4734c6
push ecx
call fcn.0056bbd4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4768a0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
movzx ebx, byte [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
dec ebx
push edi
mov edi, dword [ebp + 0xc]
or ebx, 0xdfdfdfdf
shr edi, 2
lea edx, [eax + edi*4]
mov dword [ebp + 0x10], edx
test edi, edi
je 0x476934
mov ecx, edx
lea eax, [edi*4]
and ecx, 3
sub edx, eax
mov dword [ebp + 0x14], ecx
add edx, 2
jmp 0x4768e0
test ecx, ecx
jne 0x4768e9
mov eax, dword [edx - 2]
jmp 0x47690a
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 2]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 0x14]
and eax, ebx
add edx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
sub edi, 1
jne 0x4768e0
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, edi
and eax, 3
sub eax, 1
je 0x47695d
sub eax, 1
je 0x476954
sub eax, 1
jne 0x476975
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, edi
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret