joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5202e0
Capabilities:
Prepare http request
Read http header
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b41d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 8]
xor bl, bl
xor edi, edi
mov eax, 0x800000
cmp byte [esi + 4], bl
cmovne edi, eax
test ecx, ecx
je 0x5204a5
call fcn.00546d80
mov dword [ebp - 0x10], eax
test eax, eax
je 0x5204a5
mov eax, dword [esi + 0xc]
lea ecx, [eax*8 + 0x644bb8]
call fcn.00546d80
mov dword [ebp - 0x14], eax
test eax, eax
je 0x520498
push edi
push 0
push 0
push 0
push dword [ebp - 0x10]
push eax
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, eax
mov dword [esi + 0x18], ecx
test ecx, ecx
je 0x52048b
mov eax, dword [ebp + 0xc]
push esi
push eax
push eax
push dword [ebp + 8]
push 0
push 0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x520445
push 0
push dword [esi + 0x18]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov bl, al
test bl, bl
je 0x520405
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 4
push eax
lea ecx, [esi + 0x10]
push ecx
push 0
push 0x20000013
push dword [esi + 0x18]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x52048b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.OHttpStream_Header_Request_error___s___d
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.005455a0
mov esi, eax
push edi
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.005480b0
push eax
push esi
push 0x57
push str.OHttpStream::sendRequest
push str.d:jenkinsworkspaceclient3.lib.networklib_networklib_srcohttpstream.cpp
push 0
call fcn.00550890
lea ecx, [ebp - 0x1c]
jmp 0x520483
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.OHttpStream_Recieve_Response_Failure_error___s___d
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.005455a0
mov esi, eax
push edi
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.005480b0
push eax
push esi
push 0x5d
push str.OHttpStream::sendRequest
push str.d:jenkinsworkspaceclient3.lib.networklib_networklib_srcohttpstream.cpp
push 0
call fcn.00550890
lea ecx, [ebp - 0x1c]
jmp 0x520483
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.OHttpStream_SendRequest_Failure_error___s___d
lea ecx, [ebp - 0x24]
mov edi, eax
call fcn.005455a0
mov esi, eax
push edi
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.005480b0
push eax
push esi
push 0x63
push str.OHttpStream::sendRequest
push str.d:jenkinsworkspaceclient3.lib.networklib_networklib_srcohttpstream.cpp
push 0
call fcn.00550890
lea ecx, [ebp - 0x24]
add esp, 0x1c
call fcn.00500b70
push 2
push dword [ebp - 0x14]
call fcn.0056f898
add esp, 8
push 2
push dword [ebp - 0x10]
call fcn.0056f898
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5215f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b438f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x1c
mov dword [ebp - 0x10], 0
mov esi, 0xd
call fcn.0056f8a6
push 0xffffffffffffffff
push str.OFileDownload
mov ebx, eax
lea eax, [ebp - 0x10]
push 0xe
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00585d85
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005456c0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x10]
mov dword [edi], vtable.OThread.0
call fcn.00545740
mov dword [edi + 4], 0
mov word [edi + 8], 0
mov dword [edi + 0xc], 0xfffffffe
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x5216a0
push 2
push eax
call fcn.0056f898
add esp, 8
test ebx, ebx
je 0x5216af
push 2
push ebx
call fcn.0056f898
add esp, 8
lea ecx, [edi + 0x18]
mov dword [edi], vtable.OFileDownload.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov eax, dword [ebp + 0x14]
push dword [ebp + 0xc]
mov byte [ebp - 4], 9
mov dword [edi + 0x28], eax
mov dword [edi + 0x5c], eax
mov dword [edi + 0x70], 0
call fcn.00546210
push dword [ebp + 8]
lea ecx, [edi + 0x20]
call fcn.00546210
mov eax, dword [ebp + 0x10]
mov ecx, edi
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov byte [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x60], 0
mov word [edi + 0x58], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x44], eax
call fcn.005218a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x521970
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b43df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
test edi, edi
je 0x521a1a
test esi, esi
je 0x521a1a
push 0x78
call fcn.0056f5ce
add esp, 4
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 4], 0
push dword [ebp + 8]
push esi
push edi
call fcn.005215f0
mov esi, eax
test esi, esi
je 0x521a1c
cmp byte [ebp + 0x10], 1
jne 0x521a1c
mov eax, dword [esi + 4]
mov byte [esi + 9], 1
test eax, eax
jne 0x521a00
push eax
push 4
push esi
push 0x550410
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0xc]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 4]
test eax, eax
je 0x521a07
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5233f0
Capabilities:
Initialize winhttp library
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b469b
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x63b404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
cmp byte [0x648c23], bl
jne 0x5235ae
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test esi, esi
jne 0x52351c
xor edx, edx
xor ecx, ecx
call fcn.0054efd0
test eax, eax
jne 0x523461
call fcn.00548f30
mov ecx, eax
call fcn.00549310
mov ecx, eax
call fcn.00546d80
mov esi, eax
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpOpen]
test eax, eax
je 0x5234f1
mov edx, dword [ebp - 0x1b4]
test edx, edx
je 0x5234f1
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x1a4], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x523496
sub ecx, dword [ebp - 0x1a4]
sar ecx, 1
je 0x5234f1
mov edi, dword [ebp - 0x1b0]
test edi, edi
je 0x5234eb
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x1a4], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5234c0
sub ecx, dword [ebp - 0x1a4]
sar ecx, 1
je 0x5234eb
push 0
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push edx
push 3
push esi
call edi
mov dword [0x648c38], eax
jmp 0x5234f6
push 0
push 0
jmp 0x5234d8
mov eax, dword [0x648c38]
test eax, eax
jne 0x52350a
push eax
push eax
push eax
push eax
push esi
call edi
mov dword [0x648c38], eax
test eax, eax
je 0x52350c
mov bl, 1
test esi, esi
je 0x5235ae
push 2
push esi
jmp 0x5235a6
push 0x54
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a8], 0x29
call fcn.0056f8a6
mov ecx, dword [ebp - 0x1a8]
push 0xffffffffffffffff
push str.Unable_to_initialise_WSASTartup_result__d
inc ecx
mov dword [ebp - 0x1ac], eax
push ecx
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.00585d85
mov ecx, dword [ebp - 0x1a8]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1a8], ecx
push esi
lea eax, [ebp - 0x1ac]
mov dword [ebp - 4], edx
push eax
push 0x9e
push str.ONetworkTools::initialise
push str.d:jenkinsworkspaceclient3.lib.networklib_networklib_srconetworktools.cpp
push edx
call fcn.00550890
mov eax, dword [ebp - 0x1ac]
add esp, 0x30
test eax, eax
je 0x5235ae
push 2
push eax
call fcn.0056f898
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056f3c2
mov esp, ebp
pop ebp
ret
Function at 0x523770
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b47ff
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.OInputStream.0
mov dword [ebp - 4], 0
mov esi, 9
push 0x14
mov dword [ebp - 0x10], 0
call fcn.0056f8a6
push 0xffffffffffffffff
push str.ODownload
mov ebx, eax
lea eax, [ebp - 0x10]
push 0xa
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00585d85
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x24]
call fcn.005456c0
lea esi, [edi + 4]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esi
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.OThread.0
call fcn.00545740
mov dword [esi + 4], 0
mov word [esi + 8], 0
mov dword [esi + 0xc], 0xfffffffe
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x523834
push 2
push eax
call fcn.0056f898
add esp, 8
test ebx, ebx
je 0x523843
push 2
push ebx
call fcn.0056f898
add esp, 8
lea ecx, [edi + 0x20]
mov dword [edi], vtable.ODownload.1.0
mov dword [esi], vtable.ODownload.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 9
mov dword [edi + 0x1c], eax
call fcn.00546210
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x34], eax
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov eax, dword [esi + 4]
mov byte [esi + 9], 1
test eax, eax
jne 0x5238f8
push eax
push 4
push esi
push 0x550410
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0xc]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 4]
test eax, eax
je 0x5238ff
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x523a40
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b484f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0x14], 2
mov eax, 0x800000
cmove esi, eax
mov eax, dword [edi + 0x1c]
lea ecx, [eax*8 + 0x648c8c]
call fcn.00546d80
push esi
push 0
push 0
push 0
push dword [ebp + 0x34]
mov ebx, eax
push ebx
push dword [edi + 0x5c]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [edi + 0x60], eax
test ebx, ebx
je 0x523ab1
push 2
push ebx
call fcn.0056f898
add esp, 8
mov eax, dword [edi + 0x60]
test eax, eax
je 0x523be9
push 0
push 0x10000
push fcn.0047d320
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
push 0x20000000
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [edi + 0x2c], 0
jg 0x523b11
jl 0x523ae8
cmp dword [edi + 0x28], 0
ja 0x523b11
cmp dword [edi + 0x34], 0
jg 0x523b11
jl 0x523af6
cmp dword [edi + 0x30], 0
ja 0x523b11
push edi
push 0
push 0
push 0
push 0
push 0
push dword [edi + 0x60]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov bl, al
jmp 0x523b92
push 8
call fcn.0056f5ce
add esp, 4
mov dword [ebp + 0x40], eax
push str.Range:_bytes
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.005455a0
mov dword [ebp - 4], 0xffffffff
mov esi, eax
push dword [edi + 0x2c]
mov ecx, esi
push dword [edi + 0x28]
call fcn.00546340
push 0x2d
mov ecx, esi
call fcn.00546290
mov ecx, dword [edi + 0x30]
add ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x34]
adc eax, dword [edi + 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.00546340
mov ecx, esi
call fcn.00546d80
mov esi, eax
test esi, esi
je 0x523bac
push edi
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push dword [edi + 0x60]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push 2
push esi
mov bl, al
call fcn.0056f898
add esp, 8
test bl, bl
je 0x523bac
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x523bd3
cmp eax, 0x20000000
je 0x523bd3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x524da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4aaf
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x63b404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22c], ecx
xor esi, esi
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push 0x23
xor edi, edi
mov dword [ebp - 0x220], esi
push esi
mov dword [ebp - 0x21c], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x524e2e
push 8
call fcn.0056f5ce
add esp, 4
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], 0xc
push ecx
mov ecx, eax
call fcn.00545630
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x220], esi
push esi
lea ecx, [ebp - 0x228]
call fcn.005456c0
mov dword [ebp - 4], 0x10
test esi, esi
je 0x524fd1
push 0x5c
lea ecx, [ebp - 0x228]
call fcn.00546290
push 0x644d38
lea ecx, [ebp - 0x228]
call fcn.00546600
lea ecx, [ebp - 0x228]
call fcn.00548850
test al, al
jne 0x524e80
lea ecx, [ebp - 0x228]
call fcn.00548700
lea ecx, [ebp - 0x228]
call fcn.00548850
test al, al
je 0x524fa8
push ecx
mov edx, 0x644d10
lea ecx, [ebp - 0x228]
call fcn.005494a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x524fa8
mov ecx, dword [ebx + 4]
xor esi, esi
mov eax, ecx
test ecx, ecx
je 0x524f2b
nop dword [eax]
test edi, edi
jne 0x524f2b
cmp esi, ecx
jae 0x524f21
mov eax, dword [ebx]
test eax, eax
je 0x524f21
mov edi, dword [eax + esi*4]
test edi, edi
je 0x524f1b
mov ecx, edi
call fcn.00525b40
test eax, eax
je 0x524f1b
push dword [ebp - 0x22c]
mov ecx, eax
call fcn.00547150
test al, al
je 0x524f1b
push 0xc
call fcn.0056f5ce
add esp, 4
mov dword [ebp - 0x230], eax
push edi
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.005251c0
mov edi, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x21c], edi
jmp 0x524f21
mov edi, dword [ebp - 0x21c]
mov ecx, dword [ebx + 4]
inc esi
mov eax, ecx
cmp esi, ecx
jb 0x524ec0
xor edi, edi
test eax, eax
je 0x524f73
cmp edi, eax
jae 0x524f6b
mov esi, dword [ebx]
test esi, esi
je 0x524f6b
mov esi, dword [esi + edi*4]
test esi, esi
je 0x524f6b
mov eax, dword [esi]
test eax, eax
je 0x524f59
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [esi], 0
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056f898
add esp, 8
mov eax, dword [ebx + 4]
inc edi
cmp edi, eax
jb 0x524f35
mov eax, dword [ebx]
test eax, eax
je 0x524f8a
push 4
push eax
call fcn.0056f898
add esp, 8
mov dword [ebx], 0
push 8
push ebx
mov dword [ebx + 4], 0
call fcn.0056f898
mov esi, dword [ebp - 0x220]
add esp, 8
mov edi, dword [ebp - 0x21c]
mov eax, dword [esi]
test eax, eax
je 0x524fbf
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [esi], 0
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056f898
add esp, 8
mov ecx, dword [ebp - 0x228]
test ecx, ecx
je 0x524fe6
push 2
push ecx
call fcn.0056f898
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056f3c2
mov esp, ebp
pop ebp
ret
Function at 0x525010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4b0f
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x63b404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
test ecx, ecx
je 0x5251a0
test edx, edx
je 0x5251a0
push ebx
push esi
call fcn.00525dd0
mov esi, eax
add esp, 8
test esi, esi
je 0x5251a0
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x525177
push 8
call fcn.0056f5ce
add esp, 4
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], 0xc
push ecx
mov ecx, eax
call fcn.00545630
mov edi, eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x525177
push edi
lea ecx, [ebp - 0x220]
call fcn.005456c0
push 0x5c
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0x10
call fcn.00546290
push 0x644d38
lea ecx, [ebp - 0x220]
call fcn.00546600
push esi
lea ecx, [ebp - 0x220]
call fcn.00546600
push 0x644d48
lea ecx, [ebp - 0x220]
call fcn.00546600
mov dl, 1
lea ecx, [ebp - 0x220]
call fcn.0054c570
mov ecx, eax
test ecx, ecx
je 0x525125
mov eax, dword [ecx]
push 1
call dword [eax]
push 0xc
call fcn.0056f5ce
add esp, 4
mov dword [ebp - 0x224], eax
push esi
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.005251c0
lea ecx, [ebp - 0x220]
mov ebx, eax
call fcn.00500b70
mov eax, dword [edi]
test eax, eax
je 0x525165
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [edi], 0
push 8
push edi
mov dword [edi + 4], 0
call fcn.0056f898
add esp, 8
mov eax, dword [esi]
test eax, eax
je 0x52518e
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [esi], 0
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056f898
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056f3c2
mov esp, ebp
pop ebp
ret
Function at 0x526190
Capabilities:
Check if file exists
Get file attributes
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4dd5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 4], 0
jle 0x52634b
call fcn.00546d80
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056f898
add esp, 8
cmp edi, 0xffffffff
je 0x52634b
push 0x2c
call fcn.0056f5ce
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.OGameShell.0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00546d80
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
mov dword [edi + 4], eax
call fcn.0056fc1b
mov eax, dword [edi + 4]
add esp, 4
test eax, eax
je 0x5262c6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetEnvParam
push eax
call esi
push str.InstallKey
push dword [edi + 4]
mov dword [edi + 8], eax
call esi
push str.ExpireCurrentKey
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.SetDefaultKey
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.UpdateEnvironment
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
cmp dword [edi + 8], 0
mov dword [edi + 0x18], eax
je 0x5262b4
cmp dword [edi + 0xc], 0
je 0x5262b4
cmp dword [edi + 0x10], 0
je 0x5262b4
cmp dword [edi + 0x14], 0
je 0x5262b4
test eax, eax
je 0x5262b4
mov ecx, edi
call fcn.00526480
mov eax, dword [edi + 4]
jmp 0x5262c6
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi + 4], 0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x52635f
push 0x3a
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x1c
call fcn.0056f8a6
mov ecx, eax
mov eax, dword [ebp - 0x14]
push 0xffffffffffffffff
push str.OGameShell:_drmOpenDllFailed
inc eax
mov dword [ebp - 0x18], ecx
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
call fcn.00585d85
mov ecx, dword [ebp - 0x14]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 4
push eax
push 0x16
push str.OGameShell::open
push str.d:jenkinsworkspaceclient3.lib.drmlibdrmlib_srcogameshell.cpp
push edx
call fcn.00550890
mov eax, dword [ebp - 0x18]
add esp, 0x2c
test eax, eax
je 0x526343
push 2
push eax
call fcn.0056f898
add esp, 8
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret