joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fd00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60bcae
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov edi, dword [esp + 0x24]
mov dword [esi], vtable.CPnzMtProcess.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov eax, 7
xor ecx, ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov word [esi + 0x20], cx
xor edx, edx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov word [esi + 0x3c], dx
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x2c]
push edi
push ebx
or ecx, 0x100410
push ecx
mov byte [esp + 0x28], 2
mov byte [esi + 0x54], al
mov dword [esi + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x48fdea
cmp byte [esi + 0x54], bl
je 0x48fdea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x58], eax
call fcn.004895c0
test al, al
jne 0x48fdea
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x48fdea
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [esi + 0x58]
mov ecx, dword [eax]
push edx
push edi
push str.Failed_to_open_process__i:__i
push 0x277
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzMtProcess.cpp
push 2
push eax
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x1c
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc

Function at 0x48ff00
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], cx
mov ecx, eax
lea edi, [ecx + 2]
mov edi, edi
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x48ff30
sub ecx, edi
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004037b0
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x48ff50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x72d150]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
lea eax, [esp + 8]
push eax
push 0x208
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x48ff8f
cmp eax, 0x208
jb 0x48ffd4
call fcn.004895c0
test al, al
jne 0x48ffd4
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x48ffd4
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.Failed_to_get_current_directory
push 0xaf
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzMtProcess.cpp
push 2
push eax
call edx
add esp, 0x14
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
lea eax, [esp + 8]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48fff0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004037b0
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005cd251
add esp, 0x210
ret

Function at 0x491ac0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x617b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 8], ecx
mov cl, byte [esp + 0x24]
mov dword [esi + 0xc], edx
mov dl, byte [esp + 0x30]
mov byte [esi + 0x10], cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + 0x11], dl
mov edx, dword [esp + 0x20]
mov dword [esi + 0x14], ecx
lea ecx, [esi + 0x20]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.CPnzSerializer.0
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
call fcn.00453960
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x494f10
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x60c1c4
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov esi, dword [esp + 0x24]
lea ecx, [edi + 4]
mov dword [edi], vtable.CPnzMetaInfo.0
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov byte [ecx + 4], 0
lea ebp, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x494f60
sub eax, ebp
push eax
push esi
call fcn.00403490
lea ecx, [edi + 0x24]
mov dword [esp + 0x1c], 0
call fcn.004e2640
test byte [0x730558], 1
mov byte [esp + 0x1c], 1
jne 0x494fa9
or dword [0x730558], 1
mov ecx, 0x730158
mov byte [esp + 0x1c], 2
call fcn.004a48b0
mov byte [esp + 0x1c], 1
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x494fb0
sub eax, edx
mov ecx, eax
mov eax, 0xffffffff
mov edx, esi
je 0x494fe1
movzx ebp, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, ebp
shr eax, 8
xor eax, dword [esi*4 + 0x730158]
dec ecx
inc edx
test ecx, ecx
jne 0x494fc4
not eax
mov dword [edi + 0x20], eax
mov eax, dword [esp + 0x28]
test eax, eax
je 0x494ff0
call eax
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8
Function at 0x498dd0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x60c626
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esi], vtable.IPnzLogOutput::CLogMessage.0
lea edi, [esi + 0x10]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov word [edi], ax
mov word [edi + 2], cx
mov word [edi + 4], dx
mov word [edi + 6], ax
mov word [edi + 8], cx
mov word [edi + 0xa], dx
mov dword [edi + 0xc], eax
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], eax
mov word [esi + 0x30], cx
lea ebp, [esi + 0x48]
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], eax
mov dword [esp + 0x34], eax
mov byte [ebp + 4], dl
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x3c]
push 0x5c
push ebx
mov byte [esp + 0x3c], 1
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 8], edx
call fcn.005d4700
push 0x2f
push ebx
mov dword [esp + 0x54], eax
call fcn.005d4700
add esp, 0x10
cmp eax, dword [esp + 0x44]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x44]
jb 0x498e88
lea eax, [esp + 0x14]
mov eax, dword [eax]
inc eax
mov dword [esp + 0x44], eax
cmp eax, ebx
lea eax, [esp + 0x3c]
jb 0x498e9b
lea eax, [esp + 0x44]
mov ecx, dword [eax]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x498ea2
sub eax, ebx
push eax
push ecx
mov ecx, ebp
call fcn.00403490
mov eax, dword [esp + 0x40]
mov dword [esi + 0x64], eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [esi + 0x28], eax
or eax, 0xffffffff
lea ecx, [esp + 0x1c]
push ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
call fcn.005d4354
movzx edx, word [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
add esp, 4
push edx
push ecx
mov dword [esi + 0x24], ecx
push eax
mov ecx, edi
mov dword [esi + 0x20], eax
call fcn.00498d50
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x49bcf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x60cab9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
xor ebx, ebx
mov dword [esi + 4], vtable.CPnzRefTarget.0
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.CPnzXmlSettings.0
mov dword [esi + 4], vtable.CPnzXmlSettings.1.0
push 4
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x6906f0
mov dword [esp + 0x30], ebx
mov byte [ecx + 4], bl
call fcn.00403490
lea ecx, [esi + 0x28]
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x68b01b
mov byte [esp + 0x30], 1
mov byte [ecx + 4], bl
call fcn.00403490
lea ecx, [esi + 0x44]
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x68eb30
mov byte [esp + 0x30], 2
mov byte [ecx + 4], bl
call fcn.00403490
lea ecx, [esi + 0x60]
mov byte [esp + 0x28], 3
call fcn.004e2640
lea ebp, [esi + 0x78]
mov dword [ebp], ebx
lea edi, [esi + 0x7c]
mov dword [edi], ebx
lea eax, [esp + 0x17]
push eax
lea edx, [esp + 0x1b]
lea ecx, [esi + 0x80]
push edx
mov byte [esp + 0x30], 6
call fcn.00499fa0
lea eax, [esp + 0x17]
push eax
lea edx, [esp + 0x1b]
lea ecx, [esi + 0xa0]
push edx
mov byte [esp + 0x30], 7
call fcn.00499fa0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x2c], 8
call fcn.005588a0
add esp, 4
push eax
mov ecx, edi
mov byte [esp + 0x2c], 9
call sym.start.exe_public:_class_CPnzSmartPtr_struct_CPnzRouterNode::CRpcBatch_____thiscall_CPnzSmartPtr_struct_CPnzRouterNode::CRpcBatch_::operator_class_CPnzSmartPtr_struct_CPnzRouterNode::CRpcBatch__const__
mov eax, dword [esp + 0x18]
mov byte [esp + 0x28], 8
cmp eax, ebx
je 0x49be39
mov dword [esp + 0x18], ebx
mov edi, dword [eax + 4]
lea ecx, [edi + 4]
call fcn.00489550
test eax, eax
jne 0x49be39
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
lea ecx, [edi + 8]
call fcn.00489550
test eax, eax
jne 0x49be39
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
push 0xb4
call fcn.005be6fe
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x28], 0xa
cmp eax, ebx
je 0x49be5c
mov ecx, eax
call fcn.00445910
jmp 0x49be5e
xor eax, eax
push eax
mov ecx, ebp
mov byte [esp + 0x2c], 8
call sym.start.exe_public:_class_CPnzSmartPtr_struct_CPnzRouterNode::CRpcBatch_____thiscall_CPnzSmartPtr_struct_CPnzRouterNode::CRpcBatch_::operator_struct_CPnzRouterNode::CRpcBatch__
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4a0190
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x14], ebp
cmp dword [ebp + 8], edi
je 0x4a01eb
call fcn.004895c0
test al, al
jne 0x4a01eb
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a01eb
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.m_pszArglist__NULL
push str.PnzAssert:__s
push 0x64
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzCmdLineInfo.cpp
push 2
push eax
call edx
add esp, 0x18
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x4a025a
call fcn.004895c0
test al, al
jne 0x4a034f
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a034f
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.CommandLineToArgvW_failed_n
push 0x6b
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzCmdLineInfo.cpp
push 2
push eax
call edx
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
sub esp, 0x20
mov eax, esp
xor edx, edx
mov dword [esp + 0x38], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], edi
mov word [eax + 4], dx
lea esi, [ebp + 0xc]
push ecx
mov ecx, esi
mov byte [eax + 0x1c], dl
mov byte [eax + 0x1d], dl
mov byte [eax + 0x1e], dl
call fcn.004a00a0
cmp dword [esp + 0x10], edi
jle 0x4a034f
xor ebx, ebx
jmp 0x4a02a4
mov ebp, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 5
cmp edi, eax
jb 0x4a02b6
call fcn.005cdc9b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + edi*4]
mov eax, edx
lea ebp, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a02c1
mov ecx, dword [esi + 0xc]
sub eax, ebp
sar eax, 1
push eax
push edx
add ecx, ebx
call fcn.004037b0
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0xc]
sar edx, 5
cmp edi, edx
jb 0x4a02ee
call fcn.005cdc9b
mov eax, dword [esi + 0xc]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 5
cmp edi, eax
jb 0x4a0309
call fcn.005cdc9b
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ebp, dword [esi + 0xc]
mov edx, dword [edx + 8]
push eax
add ebp, ebx
call edx
mov byte [ebp + 0x1c], al
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 5
cmp edi, eax
jb 0x4a0333
call fcn.005cdc9b
mov edx, dword [esi + 0xc]
inc edi
cmp edi, dword [esp + 0x10]
sete cl
mov byte [ebx + edx + 0x1d], cl
add ebx, 0x20
cmp edi, dword [esp + 0x10]
jl 0x4a02a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4a4770
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor edx, edx
xor eax, eax
test dl, 1
je 0x4a4783
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x4a478f
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x4a4799
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x4a47a3
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x4a47ad
or eax, 8
shr ecx, 1
test cl, 1
je 0x4a47b7
or eax, 4
shr ecx, 1
test cl, 1
je 0x4a47c1
or eax, 2
test cl, 2
je 0x4a47c9
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
mov edi, edi
test al, 1
je 0x4a488d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x4a4880
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x4a4777
pop edi
pop esi
pop ebx
ret
Function at 0x4a53e0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [ecx + 0x1c]
sub esp, 8
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4a544e
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004895c0
test al, al
jne 0x4a5444
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a5444
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push str.Failed_to_get_file_size__error:__i
push 0x216
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFile.cpp
push 2
push eax
call edx
add esp, 0x18
or eax, 0xffffffff
or edx, eax
pop esi
add esp, 8
ret
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x4a54f0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 0x1c]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a5576
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004895c0
test al, al
jne 0x4a5567
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a5567
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push str.Failed_to_write_file__error:__i
push 0x240
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFile.cpp
push 2
push eax
call edx
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop esi
pop ecx
ret 8
mov eax, dword [esp]
pop ecx
ret 8

Function at 0x4a5580
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 0x1c]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a5606
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004895c0
test al, al
jne 0x4a55f7
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a55f7
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push str.Failed_to_read_file__error:__i
push 0x255
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFile.cpp
push 2
push eax
call edx
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop esi
pop ecx
ret 8
mov eax, dword [esp]
pop ecx
ret 8
Function at 0x4a5610
Capabilities:
Clear file content

Disassembly:
mov eax, dword [ecx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4a5678
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004895c0
test al, al
jne 0x4a566d
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a566d
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push str.Failed_to_set_end_of_file__error:__i
push 0x267
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFile.cpp
push 2
push eax
call edx
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
ret
mov al, 1
ret

Function at 0x4a5760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4a5773
mov eax, dword [esi]
jmp 0x4a5775
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4a5786
pop edi
mov al, 1
pop esi
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 2
je 0x4a57ec
cmp ebx, 3
je 0x4a57ec
call fcn.004895c0
test al, al
jne 0x4a57e5
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a57e5
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi + 0x18], 8
jb 0x4a57ca
mov esi, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push ebx
push str.Failed_to_get_file_attributes__error:__i__file:__S
push 0x2b
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFile.cpp
push 2
push eax
call edx
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor al, al
pop esi
ret
Function at 0x4a5800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4a5813
mov eax, dword [esi]
jmp 0x4a5815
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4a5837
mov ecx, dword [esp + 0x10]
mov byte [ecx], 1
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4a5832
mov dword [ecx], eax
pop edi
mov al, 1
pop esi
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 2
je 0x4a58a3
cmp ebx, 3
je 0x4a58a3
call fcn.004895c0
test al, al
jne 0x4a5896
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a5896
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi + 0x18], 8
jb 0x4a587b
mov esi, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push ebx
push str.Failed_to_get_file_attributes__error:__i__file:__S
push 0x48
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFile.cpp
push 2
push eax
call edx
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor al, al
pop esi
ret
mov eax, dword [esp + 0x14]
pop ebx
pop edi
mov byte [eax], 0
mov al, 1
pop esi
ret

Function at 0x4a58b0
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4a58c3
mov eax, dword [esi]
jmp 0x4a58c5
mov eax, esi
mov ecx, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
jne 0x4a58db
pop edi
mov al, al
pop esi
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.004895c0
test al, al
jne 0x4a5930
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a5930
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi + 0x18], 8
jb 0x4a5915
mov esi, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push ebx
push str.Failed_to_set_file_attributes__error:__i__file:__S
push 0x58
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFile.cpp
push 2
push eax
call edx
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor al, al
pop esi
ret
Function at 0x4a66f0
Capabilities:
Hash data via wincrypt

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x4a674c
call fcn.004895c0
test al, al
jne 0x4a6740
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a6740
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.m_hash___NULL
push str.PnzAssert:__s
push 0x52
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsCryptPnzCrHash.cpp
push 2
push eax
call edx
add esp, 0x18
cmp dword [esi + 8], 0
jne 0x4a674c
xor al, al
pop esi
ret 8
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4a675e
test ebx, ebx
jne 0x4a67a5
call fcn.004895c0
test al, al
jne 0x4a67a5
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a67a5
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str._data___NULL___dataSize___0
push str.PnzAssert:__s
push 0x57
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsCryptPnzCrHash.cpp
push 2
push eax
call edx
add esp, 0x18
test edi, edi
je 0x4a680a
test ebx, ebx
je 0x4a680a
mov eax, dword [esi + 8]
push 0
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4a6812
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004895c0
test al, al
jne 0x4a680a
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a680a
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push str.CryptHashData___has_failed__error:__i
push 0x5e
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsCryptPnzCrHash.cpp
push 2
push eax
call edx
add esp, 0x18
pop edi
pop ebx
xor al, al
pop esi
ret 8
pop edi
pop ebx
mov al, 1
pop esi
ret 8