joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4504fb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x45051e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x4505bd
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x4505b1
jg 0x450544
test esi, esi
je 0x4505b1
test ecx, ecx
jl 0x450589
jg 0x45054e
test eax, eax
je 0x450589
cmp edi, ecx
jg 0x45055e
jl 0x450558
cmp esi, eax
jae 0x45055e
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x4505b1
jg 0x450596
test esi, esi
je 0x4505b1
cmp dword [ebx + 0x4c], 0
je 0x4505b1
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45d4d6
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x4c
mov eax, 0x479866
call fcn.0046e476
mov ebx, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ecx
push ecx
push str.Path
call edi
mov esi, eax
lea ecx, [ebp - 0x28]
cmp esi, dword [ebp - 0x18]
ja 0x45d52c
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x18], esi
cmovae ecx, dword [ebp - 0x28]
xor eax, eax
mov word [ecx + esi*2], ax
jmp 0x45d537
sub eax, dword [ebp - 0x18]
push 0
push eax
call fcn.0044dcad
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
push str.Path
call edi
mov edi, 0x480278
lea eax, [ebp - 0x58]
push edi
push ebx
push eax
call fcn.0040f180
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.00469673
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0040bbd0
cmp esi, 0xffffffff
jne 0x45d5d8
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
and dword [ebp - 0x2c], 0
push ebx
call fcn.0040d190
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push edi
call fcn.0040c0b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040c300
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040bbd0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040bbd0
call fcn.0046e420
ret
Function at 0x45df3c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x8b8
mov eax, 0x479a9c
call fcn.0046e476
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x420]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push edi
push str._s.
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00452bcf
push 0x250
lea eax, [ebp - 0x8c4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x28
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x208
mov ebx, eax
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp ebx, 0xffffffff
je 0x45e102
lea eax, [ebp - 0x898]
push 0x485fe0
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
je 0x45e0e5
lea eax, [ebp - 0x898]
push 0x485fe4
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
je 0x45e0e5
test byte [ebp - 0x8c4], 0x10
je 0x45e049
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x898]
push eax
push edi
push str._s_s
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.00452bcf
lea eax, [ebp - 0x628]
push eax
call fcn.0045df3c
add esp, 0x24
jmp 0x45e0e5
lea eax, [ebp - 0x898]
push eax
push edi
push str._s_s
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00452bcf
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45e0e5
call sub.common.dll_class_base::ILogger____cdecl_base::get_log_instance_void_
mov esi, eax
test esi, esi
je 0x45e0e5
mov ecx, dword [esi]
push 5
mov edx, dword [ecx + 0x18]
mov ecx, esi
call edx
test al, al
je 0x45e0e5
push 0x48bbc7
push 0x795
push str.e:dailybuild_devwegame_clientcodesmain_tgp_daemon_src_tgp_daemon_main.cpp
push 5
push esi
lea ecx, [ebp - 0x674]
call fcn.0043df1b
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
push str._CleanCache_delete_file_fail:_s__err__u
push 0
push esi
call fcn.0043f4bb
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.0043e231
lea eax, [ebp - 0x8c4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45dfc3
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x45e174
call sub.common.dll_class_base::ILogger____cdecl_base::get_log_instance_void_
mov esi, eax
test esi, esi
je 0x45e174
mov ecx, dword [esi]
push 5
mov edx, dword [ecx + 0x18]
mov ecx, esi
call edx
test al, al
je 0x45e174
push 0x48bbc7
push 0x79e
push str.e:dailybuild_devwegame_clientcodesmain_tgp_daemon_src_tgp_daemon_main.cpp
push 5
push esi
lea ecx, [ebp - 0x674]
call fcn.0043df1b
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._CleanCache_delete_file_fail:_s__err__u
push 0
push esi
call fcn.0043f4bb
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.0043e231
call fcn.0046e420
ret
Function at 0x461bd8
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x477150
call fcn.0046e442
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
call sub.common.dll_int___cdecl_ierd_tgp::overseas::get_client_version_type_void_
mov ecx, dword [ebp + 8]
mov esi, eax
push str.WEGAME_LAUNCHER_SILENT_LISTENER_WND
call fcn.0040bcb0
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
cmp esi, 2
jne 0x461c28
mov ecx, dword [ebp + 8]
push str.WEGAMEX_LAUNCHER_SILENT_LISTENER_WND
call fcn.0040bf40
push str._TGP__GetWeGameLauncherWndName_OVERSEA_VER
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
call fcn.0046e40b
ret
Function at 0x4621d4
Capabilities:
Query environment variable

Disassembly:
push 0x34
mov eax, 0x47a5cf
call fcn.0046e476
mov ebx, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
push ecx
push ecx
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
lea ecx, [ebp - 0x28]
cmp esi, dword [ebp - 0x18]
ja 0x462228
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x18], esi
cmovae ecx, dword [ebp - 0x28]
xor eax, eax
mov word [ecx + esi*2], ax
jmp 0x462233
sub eax, dword [ebp - 0x18]
push 0
push eax
call fcn.0044dcad
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x480278
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.0040f180
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.00469673
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040bbd0
or dword [ebp - 4], 0xffffffff
cmp esi, 0xffffffff
lea ecx, [ebp - 0x28]
setne bl
call fcn.0040bbd0
mov al, bl
call fcn.0046e420
ret

Function at 0x462884
Capabilities:
Accept command line arguments

Disassembly:
push 0x58
mov eax, 0x47a77c
call fcn.0046e476
call sub.common.dll_public:_static_bool___cdecl_ierd_tgp::common::Sys_wrapper::IsStartFromUrlProtocol_void_
test al, al
je 0x46295a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040bcb0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call sub.common.dll_bool___cdecl_ierd_tgp::common::u16to8_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x40]
push str.TGP_EXTERNAL_MESSAGE_RECEIVER
push eax
mov dword [ebp - 0x64], 0x106
call sub.common.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_ierd_tgp::util_multi_instance::get_coexist_name_char_const__
add esp, 0x10
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae eax, dword [ebp - 0x40]
push eax
push str.Static
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x462937
lea eax, [ebp - 0x64]
push eax
push ebx
push 0x4a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00420c80
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.00420c80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0040bbd0
call fcn.0046e420
ret
Function at 0x46324e
Capabilities:
Read .ini file

Disassembly:
push 0x8d8
mov eax, 0x47a9a9
call fcn.0046e476
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x8e4], esi
mov dword [ebp - 0x8e0], ebx
push 7
pop ecx
mov dword [ebp - 0x850], ebx
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x850], ebx
mov dword [ebp - 0x84c], ecx
mov word [ebp - 0x860], ax
inc eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
mov dword [ebp - 0x8e0], eax
xor eax, eax
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x834], ecx
mov word [ebp - 0x848], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x890]
push eax
call fcn.00461579
mov byte [ebp - 4], 3
mov dword [esp], str.cmd_launcher_info.ini
push eax
lea eax, [ebp - 0x878]
push eax
call fcn.00421330
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x848]
push eax
call fcn.0040bc30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x878]
call fcn.0040bbd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x890]
call fcn.0040bbd0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
push 0x410
lea eax, [ebp - 0x830]
push eax
push 0x485d1c
push str.launcher
push str.cmd_launcher_info
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x860]
call fcn.0040bf40
lea eax, [ebp - 0x860]
push esi
push eax
call sub.common.dll_bool___cdecl_ierd_tgp::common::u16to8_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____
pop ecx
pop ecx
call sub.common.dll_class_base::ILogger____cdecl_base::get_log_instance_void_
mov edi, eax
test edi, edi
je 0x4633e0
mov eax, dword [edi]
mov ecx, edi
push 3
mov eax, dword [eax + 0x18]
call eax
test al, al
je 0x4633e0
push 0x48bbc7
push 0x729
push str.e:dailybuild_devwegame_clientcodesmain_tgp_daemon_src_tgp_daemon_main.cpp
push 3
push edi
lea ecx, [ebp - 0x8dc]
call fcn.0043df1b
mov byte [ebp - 4], 5
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x4633c1
mov ecx, dword [esi]
push ecx
push str._main_read_cmd_launcher_info__get_launcher_from_cmd_start_for__launcher___s
push ebx
push eax
call fcn.0043f4bb
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8dc]
call fcn.0043e231
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x848]
call fcn.0040bbd0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x860]
call fcn.0040bbd0
mov eax, esi
call fcn.0046e420
ret
Function at 0x46380f
Capabilities:
Accept command line arguments
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x47aa96
call fcn.0046e476
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4639a2
push 0x228
lea eax, [ebp - 0x284]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x288], 0x22c
lea eax, [ebp - 0x288]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x46399b
call sub.common.dll_class_base::ILogger____cdecl_base::get_log_instance_void_
mov esi, eax
push 5
pop ebx
test esi, esi
je 0x4638cd
mov ecx, dword [esi]
push ebx
mov edx, dword [ecx + 0x18]
mov ecx, esi
call edx
test al, al
je 0x4638cd
push 0x48bbc7
push 0xe2
push str.e:dailybuild_devwegame_clientcodesmain_tgp_daemon_src_tgp_daemon_main.cpp
push ebx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0043df1b
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x28c], eax
mov ecx, esi
lea eax, [ebp - 0x28c]
push eax
push str._main_cmd:
call fcn.0045393d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.0043e231
call sub.common.dll_class_base::ILogger____cdecl_base::get_log_instance_void_
mov esi, eax
test esi, esi
je 0x463924
mov ecx, dword [esi]
push ebx
mov edx, dword [ecx + 0x18]
mov ecx, esi
call edx
test al, al
je 0x463924
push 0x48bbc7
push 0xe3
push str.e:dailybuild_devwegame_clientcodesmain_tgp_daemon_src_tgp_daemon_main.cpp
push ebx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0043df1b
mov dword [ebp - 4], 1
mov ecx, dword [eax + 0xc]
push 0x480458
push str._main_RecordProcessList:
call fcn.0043dcb8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.0043e231
call sub.common.dll_class_base::ILogger____cdecl_base::get_log_instance_void_
mov esi, eax
test esi, esi
je 0x46398a
mov ecx, dword [esi]
push ebx
mov edx, dword [ecx + 0x18]
mov ecx, esi
call edx
test al, al
je 0x46398a
push 0x48bbc7
push 0xe5
push str.e:dailybuild_devwegame_clientcodesmain_tgp_daemon_src_tgp_daemon_main.cpp
push ebx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0043df1b
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x280]
push ecx
push str.pid___parent___name
mov ecx, eax
call fcn.00453590
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.0043e231
lea eax, [ebp - 0x288]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x463924
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0046e420
ret
Function at 0x463a3a
Capabilities:
Delete file
Move file

Disassembly:
push 0x8d0
mov eax, 0x47ab21
call fcn.0046e476
mov esi, 0x208
lea eax, [ebp - 0x62c]
push esi
xor edi, edi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x62c]
mov ebx, 0x104
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x674]
call fcn.0040bcb0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x674]
call sub.common.dll_public:_class_ierd_tgp::filesystem::path___thiscall_ierd_tgp::filesystem::path::filename_void_
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x65c]
push ecx
mov ecx, eax
call fcn.0046c98b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x68c]
call fcn.0040bbd0
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x674]
call sub.common.dll_public:_class_ierd_tgp::filesystem::path___thiscall_ierd_tgp::filesystem::path::parent_path_void_
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x644]
push ecx
mov ecx, eax
call fcn.0046c98b
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x68c]
call fcn.0040bbd0
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x648], 8
lea ecx, [ebp - 0x65c]
lea eax, [ebp - 0x644]
cmovae ecx, dword [ebp - 0x65c]
lea esi, [ebx - 1]
cmp dword [ebp - 0x630], 8
push ecx
cmovae eax, dword [ebp - 0x644]
push eax
push str._slog_browser__s.log
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00452bcf
add esp, 0x20
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x463beb
cmp dword [ebp - 0x8c0], 0
jne 0x463b78
cmp dword [ebp - 0x8bc], 0x1400000
jbe 0x463be4
push 0x20a
lea eax, [ebp - 0x424]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push esi
push 0x481998
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x424]
add esp, 0x2c
push eax
call esi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x218]
push eax
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x644]
call fcn.0040bbd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x65c]
call fcn.0040bbd0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.0040bbd0
call fcn.0046e420
ret
Function at 0x46478a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x54], 0x44
lea edi, [ebp - 0x10]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4647be
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
setne al
pop ebx
leave
ret

Function at 0x465b31
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x465c8c
push edi
push 0x29
pop edi
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x465c8a
cmp eax, edi
jne 0x465b72
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x465c8a
cmp eax, edi
jne 0x465b72
test dword [esi + 0x50], edx
je 0x465c98
cmp eax, 0x2e
jne 0x465b8d
push 5
lea ecx, [esi + 0x24]
call fcn.00467dd8
mov ecx, esi
call fcn.00467e27
jmp 0x465c75
cmp eax, 0x5c
jne 0x465be2
mov ecx, esi
call fcn.00467e27
test byte [esi + 0x50], 0x80
je 0x465bd6
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x465bbe
push 4
lea ecx, [esi + 0x24]
call fcn.00467dd8
mov ecx, esi
call fcn.00467e27
jmp 0x465c7c
cmp eax, 0x42
jne 0x465bd6
push 4
lea ecx, [esi + 0x24]
call fcn.00467dd8
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x465bb2
mov ecx, esi
call fcn.00465ca2
jmp 0x465c75
cmp eax, 0x5b
jne 0x465c02
mov ecx, esi
call fcn.00467e27
mov ecx, esi
call fcn.004663e9
cmp dword [esi + 0x4c], 0x5d
je 0x465b81
push 4
jmp 0x465c9a
cmp eax, 0x28
jne 0x465c1e
mov ecx, esi
call fcn.00467e27
mov ecx, esi
call fcn.0046836c
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x465c98
jmp 0x465c6a
cmp eax, 0x5e
jne 0x465c27
push 2
jmp 0x465baa
cmp eax, 0x24
jne 0x465c33
push 3
jmp 0x465baa
cmp eax, 0x2a
je 0x465c94
cmp eax, 0x2b
je 0x465c94
cmp eax, 0x3f
je 0x465c94
cmp eax, 0x7b
je 0x465c94
cmp eax, 0x7d
jne 0x465c51
test dword [esi + 0x50], edx
je 0x465c90
cmp eax, 0x5d
jne 0x465c5b
test dword [esi + 0x50], edx
je 0x465bfb
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00465486
mov bl, 1
mov ecx, esi
call fcn.00467e27
test bl, bl
je 0x465c7c
mov ecx, esi
call fcn.00467f53
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x465b47
pop ebx
pop edi
mov al, cl
pop esi
ret
push 6
jmp 0x465c9a
push 0xa
jmp 0x465c9a
push 5
mov ecx, esi
call fcn.004672fb
int3
Function at 0x470ef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47bfd8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4a4284]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
lea eax, [edi + 4]
push eax
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call sub.VCRUNTIME140.dll___std_exception_copy
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 4], 1
call fcn.00435d50
mov dword [edi + 0x2c], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4710b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c080
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4a4284]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
lea eax, [edi + 4]
xorps xmm0, xmm0
mov dword [edi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 4]
mov dword [ebp - 4], 0
push eax
call sub.VCRUNTIME140.dll___std_exception_copy
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
lea ecx, [edi + 0x14]
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
lea eax, [ebx + 0x14]
push eax
mov dword [ebp - 4], 1
call fcn.00435d50
lea esi, [edi + 0x2c]
mov dword [ebp - 4], 2
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x30]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x471149
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x34]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x10], eax
mov eax, edi
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x56a000
Capabilities:
Terminate process

Disassembly:
push 0x56adb7
call fcn.0056a00f
jmp fcn.0046f54a