joyce8/EMBER2024-capa huggingface dataset:
Function at 0x647189d8
Capabilities:
Print debug messages

Disassembly:
push 0x518
mov eax, 0x64743d33
call fcn.647264a8
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x64718a26
push 0x22f
push 0x64749b84
push str.lpszUrl
lea eax, [ebp - 0x450]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x64718bd9
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x46c]
mov ecx, dword [ebx + 4]
push eax
push edi
push esi
push str.GpcUrlRoot
mov dword [ebp - 0x46c], 0x3b6
call fcn.6471bc5a
test eax, eax
je 0x64718bd9
push esi
call fcn.64725b00
pop ecx
cmp byte [eax + esi - 1], 0x2f
je 0x64718a7d
push edi
push 0x64749d34
push esi
call fcn.64722c82
mov ecx, dword [ebp - 0x46c]
add esp, 0xc
inc ecx
mov dword [ebp - 0x46c], ecx
jmp 0x64718a83
mov ecx, dword [ebp - 0x46c]
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0x40
push eax
mov eax, edi
sub eax, ecx
push eax
lea eax, [esi + ecx]
mov ecx, dword [ebx + 4]
push eax
push str.GpcExtName
call fcn.6471bc5a
test eax, eax
jne 0x64718abd
push edi
push str.atgpcext
push esi
call fcn.64722c82
add esp, 0xc
mov ecx, dword [ebx + 4]
push str.GpcCompressMethod
call fcn.6471bcd0
mov ecx, dword [ebx + 4]
push str.GpcUnpackVersion
mov dword [ebp - 0x474], eax
call fcn.6471bcd0
mov ebx, eax
test ebx, ebx
je 0x64718b08
push ebx
call fcn.64725b00
pop ecx
cmp eax, 0x40
jae 0x64718b08
push str.2__6__0__0
push ebx
call fcn.647277ec
pop ecx
pop ecx
push edi
test eax, eax
js 0x64718b09
push 0x64749d60
jmp 0x64718b0e
push edi
push str..apk
push esi
call fcn.64722c82
add esp, 0xc
mov byte [ebp - 0x50], 0
lea eax, [ebp - 0x4f]
push 0x3f
push 0
push eax
call fcn.64725a70
push edi
push str._random
push esi
call fcn.64722c82
add esp, 0x18
lea ecx, [ebp - 0x524]
push 1
push 3
call fcn.64717969
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x514]
call fcn.64717b62
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x524]
call fcn.6471a5e5
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x64718b7a
mov eax, dword [eax]
push 0x40
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.64722cdb
add esp, 0xc
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x468]
call fcn.647020ab
push edi
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.64722c82
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.6470d196
lea ecx, [ebp - 0x4bc]
call fcn.6470d016
push esi
push ebx
push dword [ebp - 0x474]
push str.GpcCompressMethod__s__lpUnPackVer__s___GetExtensionUrl____s_
call fcn.64721861
add esp, 0x10
call fcn.64726457
ret 8
Function at 0x64718f33
Capabilities:
Print debug messages

Disassembly:
push 0x548
mov eax, 0x64743daf
call fcn.647264a8
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x554]
push ebx
push str.CATGpcExtMgr::HasAnyUpdate
call fcn.647109cd
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x6471905a
push str.GpcUnpackVersion
call fcn.6471bcd0
mov edi, eax
test edi, edi
jne 0x64718fa6
push 0x375
push 0x64749b84
push str.lpszVersion
lea eax, [ebp - 0x514]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], bl
push ebx
push eax
call fcn.64725a70
add esp, 0xc
lea eax, [ebp - 0x114]
mov ecx, esi
push 0x104
push eax
call fcn.647180d0
push edi
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.647191f7
test eax, eax
jne 0x64719051
mov ecx, dword [esi + 4]
push str.GpcExtVersion
call fcn.6471bcd0
mov edi, eax
test edi, edi
jne 0x6471902b
push 0x381
push 0x64749b84
push str.lpszExtVersion
lea eax, [ebp - 0x514]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.647188b2
push edi
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.647191f7
test eax, eax
je 0x6471905d
push 1
mov ecx, esi
call fcn.647192bb
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x554]
call fcn.64710b28
mov eax, ebx
call fcn.64726457
ret
Function at 0x6471abaa
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x438], 0
jne 0x6471ac02
push 0xb88
push 0x6474a308
push str.m_pCurStreamFile
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [edi + 0x438]
test eax, eax
je 0x6471ac9e
push eax
push ebx
push 1
push esi
call fcn.6472634f
add esp, 0x10
push 0
cmp eax, ebx
jne 0x6471ac95
lea ecx, [edi + 0x43c]
call fcn.6472134e
mov esi, eax
test esi, esi
jne 0x6471ac67
push 0xb91
push 0x6474a308
push str.pItem
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x6471ac9e
add dword [esi + 0x10], ebx
lea ecx, [esi + 8]
push dword [esi + 0x10]
call fcn.647213c4
push eax
push str.atgpc:_downloading__s___d_bytes
call fcn.64721861
add esp, 0xc
mov ecx, edi
push ebx
push 1
push dword [esi + 4]
call fcn.6471bb9b
push eax
call dword [esi]
jmp 0x6471ac9e
push 0x6d
mov ecx, edi
call fcn.6471d7b2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret 8

Function at 0x6471acdd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x43c]
mov ecx, ebx
call fcn.64721ad0
test eax, eax
je 0x6471ada2
push edi
lea edi, [esi + 0x2f8]
cmp dword [edi], 0
jne 0x6471ada1
push 0
mov ecx, ebx
call fcn.6472134e
mov ebx, eax
test ebx, ebx
jne 0x6471ad59
push 0xab5
push 0x6474a308
push str.pItem
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.6471cf52
push edi
push 0
lea ecx, [ebx + 8]
call fcn.647213c4
push eax
push dword [esi + 0x2f4]
call sym.NPATGPC.dll_GpcGetStream
cmp dword [edi], 0
jne 0x6471ada1
mov ecx, esi
call fcn.6471b205
add esi, 0x334
push esi
call fcn.64722a18
mov dword [esp], 0x104
push 0
push esi
call fcn.64725a70
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret

Function at 0x6471adb2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x328], 0
je 0x6471ade6
cmp dword [esi + 0x468], 0
je 0x6471adda
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x468]
cmp eax, 0x1f4
jbe 0x6471ade6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x468], eax
pop esi
ret
Function at 0x6471af8c
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2b4
mov eax, 0x6474408a
call fcn.647264a8
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x154]
push ebx
push str.CATGpcWindow::CheckOldInstalledPath
call fcn.647109cd
mov dword [ebp - 4], ebx
mov dword [edi + 0x508], ebx
call fcn.64702df6
test eax, eax
jne 0x6471b0bf
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], bl
push ebx
push eax
call fcn.64725a70
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.6471bd18
add esp, 0x14
mov ecx, edi
push str.GpcProductRoot
call fcn.6471bcd0
mov esi, eax
mov ecx, edi
push str.GpcProductVersion
mov dword [ebp - 0x2bc], esi
call fcn.6471bcd0
test esi, esi
mov dword [ebp - 0x2c0], eax
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
je 0x6471b037
push dword [ebp - 0x2bc]
lea eax, [ebp - 0x114]
push eax
call esi
mov eax, dword [ebp - 0x2c0]
test eax, eax
je 0x6471b045
push eax
lea eax, [ebp - 0x114]
push eax
call esi
lea eax, [ebp - 0x178]
push eax
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x6471b0bf
push 0x6474a62c
lea eax, [ebp - 0x114]
push eax
call esi
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x6471b0bf
jmp 0x6471b09a
test byte [ebp - 0x2b8], 0x10
jne 0x6471b09a
mov eax, ebx
inc ebx
cmp eax, 0xa
jg 0x6471b0ae
lea eax, [ebp - 0x2b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x6471b089
jmp 0x6471b0b8
mov dword [edi + 0x508], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.64710b28
call fcn.64726457
ret
Function at 0x6471b4e3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push esi
push 0
mov dword [ebp - 0x414], edi
mov edi, dword [ebp + 0x28]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40c], edi
mov edi, dword [ebp - 0x414]
push edi
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x24]
push eax
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp + 0x20]
push ecx
push edx
push ebx
push dword [ebp - 0x418]
push dword [ebp - 0x408]
push str.ATActiveXContainerWindowForPlugin
push dword [ebp - 0x40c]
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, dword [ebp - 0x410]
mov dword [ebx + 0x28c], eax
test eax, eax
je 0x6471b60a
push ebx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edi, 0x104
push edi
call fcn.64722f0e
mov esi, eax
pop ecx
test esi, esi
je 0x6471b5af
push edi
push esi
call fcn.647209a4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push str.GpcRunningPath
push dword [ebx + 0x28c]
call dword [sym.imp.USER32.dll_SetPropA]
cmp dword [ebx + 0x28c], 0
jne 0x6471b5e9
push 0xe4
push 0x6474a308
push str.m_hWnd
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x6471cb79
push dword [ebx + 0x28c]
push 0x65
call fcn.647209a4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebx + 0x278], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx + 0x28c], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret 0x24
Function at 0x6471b93c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.6471b205
mov eax, dword [edi + 0x30c]
lea ecx, [edi + 0x43c]
xor edx, edx
test eax, eax
cmovg edx, eax
push edx
call fcn.6472134e
mov esi, eax
test esi, esi
jne 0x6471b9aa
push 0xba6
push 0x6474a308
push str.pItem
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x6471ba18
cmp dword [esi + 0x10], 0
lea ecx, [esi + 8]
jbe 0x6471b9cb
push dword [esi + 0x10]
call fcn.647213c4
push eax
push str.atgpc:_downloaded__s___d_bytes
call fcn.64721861
add esp, 0xc
jmp 0x6471b9f8
push ebx
push str._client_
call fcn.647213c4
push eax
call fcn.64729430
pop ecx
pop ecx
test eax, eax
je 0x6471b9f7
lea ecx, [esi + 8]
call fcn.647213c4
push eax
push str.__s__Cant_Find_on_Client_Package
call fcn.6471ba48
pop ecx
pop ecx
pop ebx
cmp dword [ebp + 8], 0
mov ecx, edi
je 0x6471ba09
lea eax, [edi + 0x334]
push eax
jmp 0x6471ba0b
push 0
push 0
push dword [esi + 4]
call fcn.6471bb9b
push eax
call dword [esi]
lea esi, [edi + 0x334]
push esi
call fcn.64722a18
mov dword [esp], 0x104
push 0
push esi
call fcn.64725a70
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.647263d1
mov esp, ebp
pop ebp
ret 4

Function at 0x6471bb9b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x28c], 0
jne 0x6471bbeb
push 0x8fd
push 0x6474a308
push str.m_hWnd
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x28c]
xor ecx, ebp
pop esi
call fcn.647263d1
mov esp, ebp
pop ebp
ret

Function at 0x6471bcf7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x454
pop ebp
jmp fcn.6472187e
Function at 0x6471c53b
Capabilities:
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x474], 0
je 0x6471c58c
push 0x5bc
push 0x6474a308
push str._m_hLibExtension
lea eax, [ebp - 0x508]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push eax
lea ecx, [ebx + 0x318]
call fcn.647180d0
push 0x6474971c
push dword [0x6475c194]
lea eax, [ebp - 0x108]
push eax
call fcn.64717419
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x108]
push eax
jne 0x6471c5ed
push str.Wrong_signature_in__s_
call fcn.64721861
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
push 0x6f
jmp 0x6471c66c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebx + 0x49c], eax
test eax, eax
jne 0x6471c61a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Load__Decompress_Failed__last_error__d___s
call fcn.64721861
add esp, 0xc
jmp 0x6471c668
push str.GpcDecompressFile
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x4a0], eax
test eax, eax
jne 0x6471c67d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.6471d1dd
mov esi, dword [ebx + 0x49c]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Load__Decompress_Failed_m_hLibDecompress_x__last_error__d___s
call fcn.64721861
add esp, 0x10
push 0
push 0x6c
mov ecx, ebx
call fcn.6471d7b2
mov dword [ebx + 0x330], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret
Function at 0x6471cc1f
Capabilities:
Print debug messages

Disassembly:
push 0x408
mov eax, 0x647441bd
call fcn.647264a8
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test ebx, ebx
jne 0x6471cc6a
push 0x466
push 0x6474a308
push str.pMessage
lea eax, [ebp - 0x410]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
call esi
mov eax, dword [ebx + 4]
dec eax
je 0x6471cd65
dec eax
je 0x6471cd58
dec eax
je 0x6471cd65
dec eax
je 0x6471cd65
dec eax
je 0x6471ccd2
dec eax
je 0x6471cd65
dec eax
je 0x6471ccc8
push 0x4a6
push 0x6474a308
push str.FALSE
lea eax, [ebp - 0x410]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
call esi
jmp 0x6471cd65
xor esi, esi
mov dword [edi + 0x2f4], esi
jmp 0x6471cd50
xor eax, eax
xor esi, esi
cmp dword [ebx + 0x10], esi
mov ecx, edi
sete al
push eax
call fcn.6471b93c
lea ecx, [edi + 0x43c]
push esi
call fcn.6472134e
mov ebx, eax
test ebx, ebx
jne 0x6471cd27
push 0x48f
push 0x6474a308
push str.pItem
lea eax, [ebp - 0x410]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x414], ebx
test ebx, ebx
je 0x6471cd44
or dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 8]
call fcn.647212df
push ebx
call fcn.647239ab
pop ecx
push esi
lea ecx, [edi + 0x43c]
call fcn.647229d4
mov dword [edi + 0x2f8], esi
jmp 0x6471cd65
push dword [ebx + 0x14]
mov ecx, edi
push dword [ebx + 0x18]
call fcn.6471abaa
call fcn.64726457
ret 4

Function at 0x6471cf52
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x438], ebx
je 0x6471cfa5
push 0xb67
push 0x6474a308
push str._m_pCurStreamFile
lea eax, [ebp - 0x508]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104
lea esi, [edi + 0x334]
push ebx
push esi
call fcn.64725a70
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push ebx
push 0x6474aca4
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x6471cff8
push 0x104
push esi
push ebx
push 0x6474aca8
call fcn.64721ff1
add esp, 0x10
push 0x64749ed8
push esi
call fcn.6472917a
pop ecx
pop ecx
xor ecx, ecx
mov dword [edi + 0x438], eax
test eax, eax
pop edi
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret
Function at 0x6471e2ea
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x6471e33a
push 0x5c8
push 0x6474aee8
push str.pProvider
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x6471e372
push 0x5c9
push 0x6474aee8
push str.pfnCallback
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp + 0x10]
mov eax, esi
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi], ebx
xor ecx, ebp
pop esi
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x6471e392
Capabilities:
Print debug messages

Disassembly:
push 0x408
mov eax, 0x64744254
call fcn.647264a8
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [esi + 0x24]
mov dword [ebp - 0x414], esi
call fcn.64721259
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
jne 0x6471e3f1
push 0x5e9
push 0x6474aee8
push str.pSap
lea eax, [ebp - 0x410]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test edi, edi
jne 0x6471e422
push 0x5ea
push 0x6474aee8
push str.lpszUrl
lea eax, [ebp - 0x410]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x24]
push edi
mov dword [esi + 0x20], eax
call fcn.647212f5
mov ecx, dword [ebp + 0x10]
and dword [esi + 0x30], 0
push 0x20
push str._CGpcStream_
push esi
mov dword [esi + 0x2c], ecx
call fcn.64722cdb
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.64726457
ret 0xc
Function at 0x6471e523
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
jne 0x6471e577
push 0x337
push 0x6474aee8
push str.hGpc
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test edi, edi
jne 0x6471e5b2
push 0x338
push 0x6474aee8
push str.hGpcStream
lea eax, [ebp - 0x404]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x4e28
jmp 0x6471e6b0
xor ebx, ebx
cmp dword [esi + 0x38], ebx
jne 0x6471e5c3
mov eax, 0x4e21
jmp 0x6471e6b0
push dword [ebp + 8]
mov ecx, esi
call fcn.6471e953
test eax, eax
jne 0x6471e5db
mov eax, 0x4e22
jmp 0x6471e6b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.64722e0d
mov eax, dword [0x6475a144]
add esp, 0x10
cmp dword [ebp - 0x40c], ebx
jg 0x6471e61b
cmp dword [ebp - 0x408], 0xc
jl 0x6471e61e
push 2
pop eax
cmp eax, 2
jne 0x6471e686
cmp dword [esi + 0x28], edi
je 0x6471e62d
cmp dword [esi + 0x28], ebx
jne 0x6471e6a7
push edi
push str.NPATGPC_:_Abort_stream_0x_lx...
call fcn.64721861
pop ecx
pop ecx
mov dword [edi + 0x30], 1
cmp dword [edi + 0x20], ebx
je 0x6471e67d
lea ecx, [edi + 0x24]
mov dword [ebp - 0x430], 5
mov dword [ebp - 0x42c], edi
call fcn.647213c4
mov ecx, dword [edi + 0x20]
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 0x424], 2
call fcn.6471f64c
mov ecx, esi
call fcn.6471f40b
jmp 0x6471e6a7
mov eax, dword [esi + 0x34]
push ebx
push 0x801b
push 0x111
push dword [eax + 0x28c]
call fcn.6471ea40
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret 8

Function at 0x6471e6c3
Capabilities:
Print debug messages

Disassembly:
push 0x40c
mov eax, 0x647442ad
call fcn.647264a8
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x6471e70c
push 0x4fc
push 0x6474aee8
push str.pSap
lea eax, [ebp - 0x410]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi]
mov ebx, vtable.CGpcLock.0
mov ecx, esi
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x414], esi
call dword [eax]
and dword [ebp - 4], 0
lea ecx, [esi + 0x1c]
push 0
push edi
call fcn.647214b1
or dword [ebp - 4], 0xffffffff
mov ecx, esi
mov eax, dword [esi]
mov dword [ebp - 0x418], ebx
call dword [eax + 4]
xor eax, eax
inc eax
call fcn.64726457
ret 4