joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x48], eax
mov ebx, esp
push 0x1c9
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.00472ef0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0047d4a0
cmp byte [edi + 0xb], 0
jns 0x48276a
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.0047d5c0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4827a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x48], eax
mov ebx, esp
push 0x1db
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.00472ef0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0047d4a0
cmp byte [edi + 0xb], 0
jns 0x4827ea
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.0047d5c0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x482820
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
add esi, 0xffffffff
cmp esi, 0x102
ja 0x4828b8
cmp word [ebp - 0x21a], 0
je 0x482882
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
lea eax, [ecx + 1]
cmp word [ebp + ecx*2 - 0x218], 0
mov ecx, eax
jne 0x482870
jmp 0x482884
xor eax, eax
lea ebx, [ebp - 0x234]
mov ecx, ebx
push eax
push edi
call fcn.0046ed80
lea edi, [ebp - 0x228]
mov ecx, ebx
push edi
call fcn.00470790
mov ecx, dword [ebp + 8]
push edi
call fcn.0046ee80
mov ecx, edi
call fcn.0046ee40
mov ecx, ebx
call fcn.0046ee40
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4828e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
sub esp, 0x14
lea edi, [ebp - 0x214]
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x6522c0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x482949
cmp word [ebp - 0x214], 0
je 0x482949
xor eax, eax
nop
cmp word [ebp + eax*2 - 0x212], 0
lea eax, [eax + 1]
jne 0x482930
mov ecx, esi
push eax
push edi
call fcn.0046ed80
jmp 0x482984
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.0046ed20
push edi
call fcn.00482820
add esp, 4
mov ecx, esi
test al, al
je 0x48296d
push edi
call fcn.0046ed50
jmp 0x482979
push 3
push 0x652346
call fcn.0046ed80
lea ecx, [ebp - 0x220]
call fcn.0046ee40
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x482fa0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x98], eax
lea edi, [esp + 0x60]
push 0x265
push str..._.._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x18]
push 0
push edi
call fcn.0047d4a0
cmp byte [esi + 0xb], 0
mov ebx, esi
jns 0x482ff2
mov ebx, dword [esi]
mov edi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x483024
mov bl, 1
test al, 0x10
jne 0x483155
test edi, edi
je 0x483015
mov dword [edi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x483155
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046f6e0
movzx edx, byte [esp + 0x17]
mov eax, edx
test dl, dl
jns 0x48303f
mov eax, dword [esp + 0x10]
movzx ecx, byte [esi + 0xb]
test cl, cl
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
js 0x48305b
mov edx, esi
cmp eax, ecx
jne 0x4830a5
test eax, eax
jne 0x483066
jmp 0x483091
cmp eax, dword [esi + 4]
jne 0x4830a5
mov edx, dword [esi]
test eax, eax
je 0x483091
lea edi, [esp + 0xc]
cmp byte [esp + 8], 0
jns 0x483075
mov edi, dword [esp + 0xc]
xor ecx, ecx
nop word [eax + eax]
movzx ebx, word [edi + ecx*2]
cmp bx, word [edx + ecx*2]
jne 0x4830a5
add ecx, 1
cmp eax, ecx
jne 0x483080
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48309e
mov dword [eax], 0xfffffffc
push 2
jmp 0x483144
mov edi, dword [ebp + 0xc]
push edi
lea eax, [esp + 0x10]
push eax
call fcn.00482fa0
add esp, 8
test al, al
je 0x48314a
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x48314c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
cmp eax, 0xb7
jne 0x483130
lea edi, [esp + 0x50]
push 0x1db
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x60]
push 0
push edi
call fcn.0047d4a0
cmp byte [esi + 0xb], 0
jns 0x483111
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
lea ecx, [esp + 0x60]
call fcn.0047d5c0
cmp esi, 0xffffffff
mov edi, dword [ebp + 0xc]
je 0x483130
and esi, 0x10
jne 0x48314c
test edi, edi
mov esi, dword [esp + 4]
je 0x483143
push esi
call fcn.00483f80
add esp, 4
mov dword [edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea ecx, [esp + 0xc]
call fcn.0046ee40
lea ecx, [esp + 0x18]
call fcn.0047d5c0
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x483350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x48], eax
mov edi, esp
push 0x3b2
push str..._.._base_files_file_util_win.cc
push 0x6523c0
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.0047d4a0
cmp byte [esi + 0xb], 0
jns 0x483398
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x639080]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0xffffffff
test eax, eax
je 0x483424
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x48341d
mov esi, dword [ebp + 0x10]
call fcn.00472f20
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [esp + 4]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp], esi
mov ecx, 0xffffffff
cmove ecx, esi
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, ecx
call fcn.00472f20
push edi
call fcn.00485d50
add esp, 4
jmp 0x483424
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x10]
call fcn.0047d5c0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x483450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x258], eax
lea edi, [esp + 0x50]
push 0x3e5
push str..._.._base_files_file_util_win.cc
push 0x6523ca
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x18]
push 0
push edi
call fcn.0047d4a0
mov word [esp + 0x50], 0
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xffffffff
cmp esi, 0x103
ja 0x4834ff
cmp word [esp + 0x50], 0
je 0x4834cf
xor ecx, ecx
nop
lea eax, [ecx + 1]
cmp word [esp + ecx*2 + 0x52], 0
mov ecx, eax
jne 0x4834c0
jmp 0x4834d1
xor eax, eax
mov ebx, esp
mov ecx, ebx
push eax
push edi
call fcn.0046ed80
lea edi, [esp + 0xc]
mov ecx, ebx
push edi
call fcn.00470790
mov ecx, dword [ebp + 8]
push edi
call fcn.0046ee80
mov ecx, edi
call fcn.0046ee40
mov ecx, ebx
call fcn.0046ee40
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x18]
call fcn.0047d5c0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x483550
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, edx
mov edi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x50], eax
lea ebx, [esp + 8]
push 0xb2
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x18]
push 0
push ebx
call fcn.0047d4a0
mov ecx, edi
call fcn.004707c0
test al, al
jne 0x4835a9
mov ecx, esi
call fcn.004707c0
test al, al
je 0x4835c9
xor ebx, ebx
lea ecx, [esp + 0x18]
call fcn.0047d5c0
mov ecx, dword [esp + 0x50]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [edi + 0xb], 0
jns 0x4835d8
cmp dword [edi + 4], 0x103
ja 0x4835a9
cmp byte [esi + 0xb], 0
jns 0x4835e7
cmp dword [esi + 4], 0x103
ja 0x4835a9
push 0xbf
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.00472ef0
add esp, 0x10
mov ecx, esp
push ebx
call fcn.004ba560
mov eax, dword [0x8fd628]
test al, 1
je 0x48366b
mov al, byte [ebp + 8]
cmp byte [esi + 0xb], 0
jns 0x48361b
mov esi, dword [esi]
movzx eax, al
cmp byte [edi + 0xb], 0
jns 0x483626
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x48365d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x483655
mov eax, edi
and eax, 1
je 0x483655
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
jmp 0x48365f
xor ebx, ebx
mov ecx, esp
call fcn.004ba730
jmp 0x4835ab
or eax, 1
mov dword [0x8fd628], eax
mov ecx, esp
call fcn.004ba670
jmp 0x483610
Function at 0x483680
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x88], eax
lea edi, [esp + 0x50]
push 0x45f
push str..._.._base_files_file_util_win.cc
push str.MoveUnsafe
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 8]
push 0
push edi
call fcn.0047d4a0
mov al, byte [esi + 0xb]
test al, al
jns 0x4836dc
cmp dword [esi + 4], 0x103
ja 0x4837d3
mov ecx, dword [ebp + 0xc]
cmp byte [ecx + 0xb], 0
jns 0x4836f4
cmp dword [ecx + 4], 0x103
ja 0x4837d3
mov ecx, dword [ecx]
mov edx, esi
test al, al
jns 0x4836fc
mov edx, dword [esi]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x4837d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
lea edi, [esp + 0x40]
push 0x1db
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x50]
push 0
push edi
call fcn.0047d4a0
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x48374c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
lea ecx, [esp + 0x50]
call fcn.0047d5c0
cmp edi, 0xffffffff
je 0x4837c9
and edi, 0x10
je 0x4837c9
push 0x482
push str..._.._base_files_file_util_win.cc
push str.CopyAndDeleteDirectory
lea edi, [esp + 0x4c]
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x50]
push 0
push edi
call fcn.0047d4a0
mov ecx, esi
mov edx, dword [ebp + 0xc]
push 0
push 1
call fcn.00482230
add esp, 8
test al, al
je 0x4837c0
mov ecx, esi
mov edx, 1
call fcn.00481cc0
test al, al
je 0x4837c0
lea ecx, [esp + 0x50]
call fcn.0047d5c0
jmp 0x4837d5
lea ecx, [esp + 0x50]
call fcn.0047d5c0
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea ecx, [esp + 8]
call fcn.0047d5c0
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x483800
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov eax, ecx
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea esi, [ebp - 0x2a4]
mov ecx, esi
mov dword [ebp - 0x504], edx
push edx
push 3
push 0
push eax
call fcn.00491480
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.004916d0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x483851
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x4839bd
lea ebx, [ebp - 0x4f4]
xor edi, edi
jmp 0x48387a
mov edi, esi
test eax, eax
je 0x4839bf
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00491650
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x4838dd
cmp byte [ebp + 8], 0
jne 0x4838bd
mov ecx, ebx
call fcn.004913f0
test al, al
je 0x4838b7
mov ecx, ebx
call fcn.004913f0
xor esi, esi
test al, al
je 0x483940
jmp 0x483978
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x4838d5
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.004913f0
test al, al
je 0x483940
xor esi, esi
cmp byte [ebp + 8], 0
je 0x483978
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.00483800
add esp, 4
mov esi, eax
test eax, eax
jne 0x483978
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x483925
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x483978
jmp 0x483962
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x483955
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x483978
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00401e20
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004916d0
lea ecx, [ebp - 0x500]
push ebx
call fcn.0046ee80
mov ecx, ebx
call fcn.0046ee40
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x483870
mov eax, dword [ebp - 0x4fc]
jmp 0x483870
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.0046ee40
lea ecx, [ebp - 0x2a4]
call fcn.004915e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x483ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x68], eax
lea ebx, [esp + 0x10]
push 0x73
push str..._.._base_files_file_win.cc
push str.Write
push ebx
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.0047d4a0
lea ecx, [esp + 0x28]
call fcn.004ab290
call fcn.004ab230
test al, al
je 0x483b49
mov eax, edi
sar eax, 0x1f
lea ecx, [esp + 0x28]
push eax
push edi
push esi
push str.File::Write
call fcn.004ab2c0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.004ab2a0
lea ecx, [esp + 0x30]
call fcn.0047d5c0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x483bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x50], eax
lea ebx, [esp + 8]
push 0x88
push str..._.._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x18]
push 0
push ebx
call fcn.0047d4a0
test edi, edi
js 0x483c46
mov ebx, dword [ebp + 8]
lea ecx, [esp + 8]
call fcn.004ab290
call fcn.004ab230
test al, al
je 0x483c1f
lea ecx, [esp + 8]
push 0
push edi
push esi
push str.File::WriteAtCurrentPos
call fcn.004ab2c0
lea eax, [esp + 4]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 4]
lea ecx, [esp + 8]
call fcn.004ab2a0
jmp 0x483c4b
mov esi, 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0047d5c0
mov ecx, dword [esp + 0x50]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x483c70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x54], eax
lea edi, [esp + 8]
push 0x9c
push str..._.._base_files_file_win.cc
push str.GetLength
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x18]
push 0
push edi
call fcn.0047d4a0
lea ecx, [esp + 8]
call fcn.004ab290
call fcn.004ab230
test al, al
je 0x483cd5
lea ecx, [esp + 8]
push 0
push 0
push esi
push str.File::GetLength
call fcn.004ab2c0
mov eax, esp
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb esi, esi
mov edi, dword [esp + 4]
or edi, esi
or esi, dword [esp]
lea ecx, [esp + 8]
call fcn.004ab2a0
lea ecx, [esp + 0x18]
call fcn.0047d5c0
mov ecx, dword [esp + 0x54]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x483d20
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x68], eax
lea edi, [esp + 0x20]
push 0xa9
push str..._.._base_files_file_win.cc
push str.SetLength
push edi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push edi
mov edi, dword [ebp + 0xc]
call fcn.0047d4a0
lea ecx, [esp + 0x20]
call fcn.004ab290
call fcn.004ab230
test al, al
je 0x483d8a
lea ecx, [esp + 0x20]
push edi
push ebx
push esi
push str.File::SetLength
call fcn.004ab2c0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x483e4e
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x483e4e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x483e4e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x14]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
jmp 0x483e50
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004ab2a0
lea ecx, [esp + 0x30]
call fcn.0047d5c0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x484030
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x58], eax
lea esi, [esp + 0x10]
push 0x16e
push str..._.._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push esi
call fcn.0047d4a0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov ecx, 1
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x4841d6
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, bl
cmovns edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
mov esi, ebx
and esi, 0x400
mov eax, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, eax
shl edi, 8
mov ebx, edi
and ebx, 0x2000000
or ebx, esi
and edi, 0x8000000
or edi, ebx
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x48415c
mov esi, dword [esi]
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
push 0
push edi
push eax
push 0
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov eax, dword [ebx]
cmp eax, edi
je 0x4841ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jb 0x4841a2
call fcn.00472f20
push dword [ebx]
call fcn.00485d50
add esp, 4
mov dword [ebx], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x4841b1
mov dword [ebx], edi
call fcn.00472f20
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jae 0x4841e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00483f80
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x484218
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [edi + 0x14], 0xffffffff
jmp 0x484218
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
mov eax, dword [ebp + 0xc]
test al, 4
jne 0x484209
test al, 0xa
je 0x484218
mov byte [ebx + 0x18], 1
jmp 0x484218
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [ebx + 0x18]
lea ecx, [esp + 0x20]
call fcn.0047d5c0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8