joyce8/EMBER2024-capa huggingface dataset:
Function at 0x526d40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00651b20
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.006547d0
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x526dcf
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x526dd3
mov ecx, esi
push edi
call fcn.00524400
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x526db6
cmp eax, 2
jne 0x526e15
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.006547d0
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x526e1c
mov ecx, esi
push ebx
jmp 0x526daf
mov esi, 0x3f4
jmp 0x526db6
mov esi, 0xea
jmp 0x526db6

Function at 0x526e30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0066e7c4
add esp, 4
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x526f30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x7a9040]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edx, 0x20019
or edx, dword [ebp + 0x10]
push esi
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x526fed
xor eax, eax
lea edx, [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [esi]
sub esp, 0x30
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x52700d
mov eax, dword [ebp - 0x1c]
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
jne 0x526ff3
lea edx, [esi + 8]
lea edi, [ebp - 0x14]
mov dword [edi], 0x104
xor edi, edi
dec edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
xor edi, edi
lea ebx, [ebp - 0x1c]
push ebx
push edi
push edi
push edi
lea edi, [ebp - 0x14]
push edi
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x526ff9
jmp 0x526ff3
mov dword [esi], 0
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x526fed

Function at 0x527060
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x5270d1
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
jne 0x5270d1
lea edi, [esi + 8]
lea edx, [ebp - 0x14]
mov dword [edx], 0x104
xor ebx, ebx
dec ebx
lea edx, [ebp - 0x1c]
mov dword [edx], ebx
mov dword [edx + 4], ebx
xor ebx, ebx
push edx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x14]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x5270d1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [esi + 8], 0
jmp 0x5270bf
Function at 0x5278b0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm0, qword [0x7b24f8]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x5278db
jnp 0x527900
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.00650d60
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x7b2508]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x527a35
mov eax, dword [0x7b2518]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x527a6e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub ebx, dword [0x7b2510]
sbb edi, dword [0x7b2514]
movd xmm0, edi
movd xmm1, ebx
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm1, qword [esp + 0x30]
pxor xmm0, xmm0
movsd xmm2, qword [0x739fd8]
ucomisd xmm2, xmm1
ja 0x5278db
mov eax, dword [esp + 8]
sub eax, dword [0x7b2500]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x7b2504]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x736f30]
subpd xmm0, xmmword [0x736f40]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x7b24f8], xmm0
jmp 0x5278db
push 0x7b2508
call fcn.00650831
add esp, 4
cmp dword [0x7b2508], 0xffffffff
jne 0x52793f
rdtsc
mov dword [0x7b2500], eax
mov dword [0x7b2504], edx
push 0x7b2508
call fcn.006508ab
add esp, 4
jmp 0x52793f
push 0x7b2518
call fcn.00650831
add esp, 4
cmp dword [0x7b2518], 0xffffffff
jne 0x527960
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x7b2514], ecx
mov dword [0x7b2510], eax
push 0x7b2518
call fcn.006508ab
add esp, 4
jmp 0x527960
Function at 0x527cc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x527cf7
mov eax, dword [0x7ab7f0]
cmp eax, 0xffffffff
je 0x527d80
mov ebx, 0x100000
test eax, eax
jne 0x527cf7
mov ebx, 0x80000
push 0x10
call fcn.006507be
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x7b4788]
bt ecx, eax
jae 0x527d72
push edi
call fcn.00545e50
add esp, 4
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x528120
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x527db1
test edi, edi
je 0x527da4
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x7bc788], 1
jmp 0x527d22
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x7ab7f0
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x527eab
mov eax, dword [0x7ab7f0]
jmp 0x527ce9
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x527d59
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp eax, 0x27a
jg 0x527e51
cmp dword [ebp - 0x20], 8
je 0x527e67
cmp dword [ebp - 0x20], 0xe
je 0x527e67
mov eax, dword [0x7b2554]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x527ebc
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
call fcn.005dc4c0
add esp, 8
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x527e19
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x527eba
sete cl
test ebx, ebx
setne dl
or dl, cl
je 0x527eba
push eax
push ebx
push dword [0x7b2550]
call fcn.00557b70
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x527e70
push dword [ebp - 0x1c]
call fcn.006507ee
jmp 0x527e6d
cmp dword [ebp - 0x20], 0x5af
je 0x527e67
cmp dword [ebp - 0x20], 0x27b
jne 0x527ddb
push ebx
call fcn.00559340
add esp, 4
test esi, esi
mov eax, edi
je 0x527d59
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x7b4788]
bt edx, ecx
jae 0x527e9b
push eax
call fcn.00545f70
add esp, 4
push esi
call fcn.006507ee
add esp, 4
mov eax, edi
jmp 0x527d59
mov dword [0x7ab7f0], 0
jmp 0x527cf2
ud2
push 0x7b2554
call fcn.00650831
add esp, 4
cmp dword [0x7b2554], 0xffffffff
jne 0x527dfc
push 0x20
push str.create_thread_last_error
call fcn.00557b50
add esp, 8
mov dword [0x7b2550], eax
push 0x7b2554
call fcn.006508ab
add esp, 4
jmp 0x527dfc
Function at 0x528ff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x52902b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x529042
lea eax, [ebx + 1]
cmp eax, 2
jb 0x529024
mov dword [esi], ebx
call fcn.005e4650
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x529059
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [esi]
call fcn.005cf200
add esp, 4
mov dword [esi], 0
jmp 0x529015
int3

Function at 0x529060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x529081
call fcn.005e4650
mov dword [esi], 0
test ebx, ebx
je 0x5290b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x5290e8
cmp edi, 2
jb 0x5290a9
mov dword [esi], ebx
mov edi, eax
call fcn.005e4650
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x5290d1
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [edi]
call fcn.005cf200
add esp, 4
mov dword [edi], 0
jmp 0x5290c5
mov dword [ebp - 0x10], eax
call fcn.005e4650
push dword [esi]
call fcn.005cf200
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x529099

Function at 0x529110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x529131
call fcn.005e4650
cmp dword [esi], ebx
je 0x52915a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x529192
cmp edi, 2
jb 0x529153
mov dword [esi], ebx
mov edi, eax
call fcn.005e4650
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x52917b
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [edi]
call fcn.005cf200
add esp, 4
mov dword [edi], 0
jmp 0x52916f
mov dword [ebp - 0x10], eax
call fcn.005e4650
push dword [esi]
call fcn.005cf200
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x529143
Function at 0x52a950
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.0055b680
mov byte [esi + 4], 0
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi], 0x7339e0
mov dword [esi + 0xc], eax
movaps xmm0, xmmword [0x753220]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x52a9ba
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jae 0x52a9c4
lea eax, [edi + 1]
cmp eax, 2
jb 0x52a9ae
mov dword [esi + 0xc], edi
call fcn.005e4650
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005e4650
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.005cf200
mov dword [esi + 0xc], 0
jmp 0x52a99e

Function at 0x52b9f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x1c
push str....._base_filesmemory_mapped_file_win.cc
push str.MapImageToMemory
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.005d6a70
mov ecx, esi
call fcn.005d37b0
test al, al
je 0x52bb34
mov ecx, esi
call fcn.0052bdf0
sub esp, 0x18
movq xmm0, qword [0x753460]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x52bab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x52bb18
lea eax, [edi + 1]
cmp eax, 2
jb 0x52baa6
mov dword [esi + 0x24], edi
call fcn.005e4650
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x24]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x52bb34
sub esp, 0x14
movd xmm0, dword [0x738220]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x52bb34
mov edi, eax
mov ecx, esp
mov dword [ecx], fcn.00689f80
mov dword [ecx + 4], eax
call fcn.0055d420
mov eax, dword [eax + 0x50]
test eax, eax
setne bl
je 0x52baf8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
lea ecx, [esp + 0x10]
call fcn.005d6ae0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [esi + 0x24]
call fcn.005cf200
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x52ba96
xor ebx, ebx
jmp 0x52baf8
Function at 0x52be00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x97
push str....._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.005e4620
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.005d6a70
test ebx, ebx
js 0x52bec0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.005fae60
test al, al
jne 0x52bec5
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
push 0
push edi
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [edi]
lea ecx, [esp + 0x10]
call fcn.005faef0
lea ecx, [esp + 0x20]
call fcn.005d6ae0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x52bea0
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::WriteAtCurrentPos
call fcn.006c9900
jmp 0x52be75

Function at 0x52bee0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xac
push str....._base_files_file_win.cc
push str.GetLength
push edi
call fcn.005e4620
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.005d6a70
mov dword [edi + 4], 0xffffffff
mov dword [edi], esi
call fcn.005fae60
test al, al
jne 0x52bf98
xor eax, eax
dec eax
lea ebx, [esp + 8]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [ebx + 4]
or edi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.005faef0
lea ecx, [esp + 0x20]
call fcn.005d6ae0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
push esi
push esi
push dword [esp + 0xc]
push str.File::GetLength
call fcn.006c9900
jmp 0x52bf4a
Function at 0x52bfb0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x30]
push 0xb9
push str....._base_files_file_win.cc
push str.SetLength
push esi
call fcn.005e4620
add esp, 0x10
xor ebx, ebx
mov ecx, edi
push ebx
push esi
call fcn.005d6a70
mov dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call fcn.005fae60
test al, al
jne 0x52c107
xor eax, eax
dec eax
lea ecx, [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x52c0de
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 4], xmm0
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x52c0de
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
je 0x52c0de
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea ecx, [esp + 0x30]
call fcn.005faef0
lea ecx, [esp + 0x40]
call fcn.005d6ae0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x30]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push str.File::SetLength
call fcn.006c9900
jmp 0x52c021
Function at 0x52c490
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x171
push str....._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.005e4620
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.005d6a70
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x52c6b1
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x52c686
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x52c5bd
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x52c605
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x52c697
mov eax, edi
inc eax
cmp eax, 2
jb 0x52c5fc
mov dword [ebx], edi
call fcn.005e4650
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x52c651
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x52c665
test cl, 0xa
je 0x52c62d
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x52c679
lea ecx, [esp + 0x20]
call fcn.005d6ae0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00650d60
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0052c370
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x52c633
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x52c62d
push dword [ebp + 8]
call fcn.0052e320
add esp, 4
jmp 0x52c633
bt ebx, 0x15
jb 0x52c6ce
or edx, 0x20000000
jmp 0x52c54e
call fcn.005e4650
push dword [ebx]
call fcn.005cf200
add esp, 4
mov dword [ebx], 0
jmp 0x52c5ed
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.006a7ec0
jmp 0x52c633
int3
Function at 0x52c7a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x52c7d5
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x52c7dc
lea eax, [ebx + 1]
cmp eax, 2
jb 0x52c7ce
mov dword [esi], ebx
call fcn.005e4650
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [esi]
call fcn.005cf200
add esp, 4
mov dword [esi], 0
jmp 0x52c7bf

Function at 0x52c8d0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.0052c8e0