joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443a81
Capabilities:
Get geographical location

Disassembly:
push 4
mov eax, 0x55f80e
call fcn.00523995
mov edi, ecx
mov ebx, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push ebx
call fcn.00480e63
xor esi, esi
mov dword [ebp - 4], esi
cmp edi, esi
setne byte [ebp - 0x10]
mov dword [ebx], vtable.GFESUGARClient.0
mov dword [ebx + 0xb4], esi
push 8
push dword [ebp - 0x10]
mov dword [ebx + 0xb8], edi
mov edi, str.srcGeoLocation.cpp
call fcn.0049247f
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xbc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0xc0], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0xc4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0xc8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0xcc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebx + 0xd0], eax
mov al, byte [ebp + 0x2c]
mov dword [ebx + 0xd4], esi
pop ecx
mov word [ebx + 0xd8], 1
mov byte [ebx + 0xda], 0
pop ecx
lea esi, [ebx + 0xe0]
mov byte [ebx + 0xdc], 0
mov byte [ebx + 0xdd], al
call fcn.00491d81
push 0x2b
push dword [ebp - 0x10]
mov edi, str.srcGFESugarClient.cpp
mov byte [ebp - 4], 1
call fcn.0049247f
xor esi, esi
cmp dword [ebp + 0xc], esi
push 0x2c
setne al
movzx eax, al
push eax
call fcn.0049247f
cmp dword [ebp + 0x18], esi
push 0x2d
setne al
movzx eax, al
push eax
call fcn.0049247f
cmp dword [ebp + 0x14], esi
push 0x2e
setne al
movzx eax, al
push eax
call fcn.0049247f
cmp dword [ebp + 0x10], esi
push 0x2f
setne al
movzx eax, al
push eax
call fcn.0049247f
add esp, 0x28
mov eax, ebx
call fcn.00523a6d
ret 0x28

Function at 0x44e834
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x552f94
call fcn.005239fe
mov ebx, ecx
cmp dword [ebx + 0x44], 0
mov dword [ebp - 0x34], ebx
je 0x44e924
cmp byte [ebx + 0x49], 0
je 0x44e924
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x44e86c
xor al, al
jmp 0x44e926
push 0
push 8
pop edi
lea esi, [ebp - 0x2c]
call fcn.0044e5dd
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x44e8c3
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
push eax
push edx
push dword [ebp - 0x38]
call dword [esi + 0x18]
xor edi, edi
sub eax, edi
je 0x44e8c8
dec eax
je 0x44e8cc
dec eax
dec eax
je 0x44e920
xor bl, bl
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403fde
mov al, bl
jmp 0x44e926
mov edx, dword [ebp - 0x2c]
jmp 0x44e891
mov byte [ebx + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x44e8d8
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x44e8fe
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x44e8eb
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.005167fa
add esp, 0x10
cmp esi, eax
jne 0x44e8b2
cmp byte [ebx + 0x49], 0
je 0x44e920
cmp esi, edi
jne 0x44e883
push edi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.00403e55
mov ebx, dword [ebp - 0x34]
jmp 0x44e883
mov bl, 1
jmp 0x44e8b4
mov al, 1
call fcn.00523a81
ret
Function at 0x44f52b
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x10]
push ebx
push edi
xor edx, edx
push 0xa
mov eax, ecx
pop ebx
div ebx
xor edi, edi
mov dword [ebp - 4], 0x811c9dc5
inc eax
test ecx, ecx
je 0x44f56f
cmp dword [esi + 0x14], 0x10
jb 0x44f555
mov edx, dword [esi]
jmp 0x44f557
mov edx, esi
mov ebx, dword [ebp - 4]
movsx edx, byte [edx + edi]
imul ebx, ebx, 0x1000193
xor edx, ebx
add edi, eax
mov dword [ebp - 4], edx
cmp edi, ecx
jb 0x44f54b
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x20]
mov eax, ecx
and eax, dword [ebp - 4]
pop edi
pop ebx
cmp dword [edx + 0x24], eax
ja 0x44f58a
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
leave
ret 4
Function at 0x45ac0a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55f389
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
cmp dword [ebx + 0x10], esi
push 0x64
setne al
movzx eax, al
push eax
mov edi, str.srcPackageManager.cpp
call fcn.004924b4
pop ecx
xor edi, edi
pop ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x14], 3
push dword [ebx + 0x10]
lea esi, [esp + 0x1c]
push dword [ebx + 0xc]
push dword [ebx + 8]
call fcn.0045d2b1
add esp, 0xc
mov esi, eax
mov byte [esp + 0x38], 1
cmp esi, edi
jae 0x45acc0
cmp dword [esp + 0x1c], esi
ja 0x45acc0
sub esi, dword [esp + 0x1c]
sar esi, 2
cmp edi, dword [esp + 0x24]
jne 0x45acac
lea ecx, [esp + 0x1c]
call fcn.0045d03c
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea eax, [eax + esi*4]
test edi, edi
je 0x45acde
mov ecx, dword [eax]
and dword [eax], 0
mov dword [edi], ecx
jmp 0x45acde
cmp edi, dword [esp + 0x24]
jne 0x45acd3
lea ecx, [esp + 0x1c]
call fcn.0045d03c
mov edi, dword [esp + 0x20]
test edi, edi
je 0x45acde
mov eax, dword [esi]
and dword [esi], 0
mov dword [edi], eax
mov byte [esp + 0x38], 0
mov ecx, dword [esp + 0x18]
add edi, 4
mov dword [esp + 0x20], edi
test ecx, ecx
je 0x45acf8
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [edi - 4]
call fcn.004926d7
dec dword [esp + 0x14]
jne 0x45ac6c
xor esi, esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + esi*4]
call fcn.004928ad
inc esi
cmp esi, 3
jb 0x45ad0c
or dword [esp + 0x38], 0xffffffff
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x45ad4b
mov esi, ebx
cmp ebx, edi
je 0x45ad44
mov ecx, dword [esi]
test ecx, ecx
je 0x45ad3d
mov eax, dword [ecx]
push 1
call dword [eax]
add esi, 4
cmp esi, edi
jne 0x45ad31
push ebx
call fcn.00515779
pop ecx
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ec23
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x551fd1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
and dword [esp + 8], 0
lea eax, [esp + 0xc]
push eax
call fcn.0046ec94
push dword [ebp + 8]
and dword [esp + 0x3c], 0
mov esi, eax
call fcn.0046f0ef
pop ecx
lea esi, [esp + 0x1c]
call fcn.004e7046
lea esi, [esp + 0xc]
call fcn.004e7046
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x471998
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56cda2
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
lea ebx, [esp + 0xb0]
call fcn.00471ada
and dword [esp + 0xf8], 0
mov eax, ebx
call fcn.004957ff
test al, al
je 0x471aa6
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x471a0e
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x471aa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00403689
mov esi, eax
push str.Cannot_delete_ShadowPlayStatistics_file:
push esi
mov byte [esp + 0x100], 1
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
lea eax, [esp + 0xcc]
push eax
mov eax, esi
call fcn.004036f3
push 2
pop ecx
mov byte [esp + 0xf8], cl
cmp dword [esp + 0xe0], 8
mov eax, dword [esp + 0xcc]
jae 0x471a7e
lea eax, [esp + 0xcc]
push eax
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd0]
call fcn.0040412d
lea eax, [esp + 0x14]
mov byte [esp + 0xf8], 0
call fcn.0040262a
push 1
xor edi, edi
lea esi, [esp + 0xb4]
call fcn.0040412d
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret
Function at 0x485b66
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56cda2
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
lea ebx, [esp + 0xb0]
call fcn.00485b24
and dword [esp + 0xf8], 0
mov eax, ebx
call fcn.004957ff
test al, al
je 0x485c74
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x485bdc
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x485c74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00403689
mov esi, eax
push str.Cannot_delete_VRDevicesInfo_file:
push esi
mov byte [esp + 0x100], 1
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
lea eax, [esp + 0xcc]
push eax
mov eax, esi
call fcn.004036f3
push 2
pop ecx
mov byte [esp + 0xf8], cl
cmp dword [esp + 0xe0], 8
mov eax, dword [esp + 0xcc]
jae 0x485c4c
lea eax, [esp + 0xcc]
push eax
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd0]
call fcn.0040412d
lea eax, [esp + 0x14]
mov byte [esp + 0xf8], 0
call fcn.0040262a
push 1
xor edi, edi
lea esi, [esp + 0xb4]
call fcn.0040412d
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret
Function at 0x4862f6
Capabilities:
Access the windows event log

Disassembly:
push 0xb4
mov eax, 0x55a1a1
call fcn.005239fe
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], ebx
jne 0x486346
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xac], str.No_callback_provided
call fcn.00514f60
mov dword [ebp - 0xbc], vtable.std::invalid_argument.0
push 0x5c9738
lea eax, [ebp - 0xbc]
push eax
call fcn.0051eb2a
push str.System
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x486395
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x486374
and eax, 0xffff
or eax, 0x80070000
push 0x14
push str.srcWindowsEventLogReader.cpp
mov edx, eax
lea ecx, [ebp - 0xa4]
call fcn.004988c2
push 0x5c9774
lea eax, [ebp - 0xa4]
jmp 0x486340
mov esi, 0x10000
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
call fcn.0043e183
mov byte [ebp - 4], 2
jmp 0x486419
xor ebx, ebx
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
sub eax, esi
push eax
push esi
push ebx
push 9
push dword [ebp - 0xa8]
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xb0], ebx
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
cmp eax, ebx
jne 0x486421
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x26
je 0x486463
cmp eax, 0x7a
jne 0x48644c
mov esi, dword [ebp - 0xb0]
lea eax, [ebp - 0xc0]
call fcn.0043e183
mov esi, dword [ebp - 0xc0]
jmp 0x4863bf
mov eax, dword [ebp - 0xac]
lea ebx, [esi + eax]
mov edi, esi
cmp esi, ebx
jae 0x4863bd
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x48648e
mov eax, dword [ecx]
push edi
call dword [eax + 4]
test al, al
je 0x486493
add edi, dword [edi]
cmp edi, ebx
jb 0x486430
jmp 0x4863bd
call edi
cmp eax, ebx
jle 0x48645c
and eax, 0xffff
or eax, 0x80070000
push 0x2e
jmp 0x486376
cmp esi, ebx
je 0x48646e
push esi
call fcn.00515779
pop ecx
cmp dword [ebp - 0xa8], 0xffffffff
je 0x486483
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
jmp 0x4864bc
call fcn.00535e03
test esi, esi
je 0x48649e
push esi
call fcn.00515779
pop ecx
cmp dword [ebp - 0xa8], 0xffffffff
je 0x4864b3
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x4864cf
mov eax, dword [ecx]
lea edx, [ebp + 8]
cmp ecx, edx
setne dl
movzx edx, dl
push edx
call dword [eax + 0xc]
call fcn.00523a81
ret
Function at 0x4866de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5f7350]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
push 0x208
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x21c], edi
call fcn.00517bf0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push dword [ebp + 8]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, eax
cmp edx, edi
jge 0x486740
push 0x18
mov eax, str.srcClientPaths.cpp
call fcn.0042cd9b
lea eax, [ebp - 0x218]
push eax
call fcn.00403350
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005146df
leave
ret
Function at 0x4877ba
Capabilities:
Read file via mapping

Disassembly:
push 0x40
mov eax, 0x55e80c
call fcn.00523995
push str.AA45D379_DBB1_4AF4_833B_39E697EDCCA4
xor ebx, ebx
push ebx
push 4
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x18], eax
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp eax, ebx
jne 0x48780b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4877fa
and eax, 0xffff
or eax, 0x80070000
mov edx, eax
push 0x95
mov eax, str.srcClientRpc.cpp
call fcn.0042cd9b
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x48783b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x487832
and eax, 0xffff
or eax, 0x80070000
mov edx, eax
push 0xa1
jmp 0x487801
push 0x1c
lea ecx, [ebp - 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x487869
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x487860
and eax, 0xffff
or eax, 0x80070000
mov edx, eax
push 0xac
jmp 0x487801
mov eax, dword [ebp - 0x40]
shr eax, 1
lea ecx, [ebp - 0x1c]
inc eax
push ecx
lea esi, [ebp - 0x30]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.004277f8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x40]
mov ecx, eax
and ecx, edi
sub eax, ecx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x30]
call fcn.00517c70
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x30]
mov esi, dword [ebp + 8]
call fcn.00403350
lea esi, [ebp - 0x30]
mov dword [ebp - 0x20], edi
call fcn.004e7046
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 0xffffffff
je 0x4878d4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
call fcn.00523a6d
ret

Function at 0x487b24
Capabilities:
Get common file path

Disassembly:
push 0x24c
mov eax, 0x55a0b6
call fcn.005239fe
and dword [ebp - 0x258], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov esi, ecx
call fcn.00517bf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x487b92
push str.GetSystemDirectory_failed
lea esi, [ebp - 0x238]
call fcn.00403350
and dword [ebp - 4], 0
push 0x12
mov ecx, str.srcClientCommon_MergeWhitelist.cpp
mov eax, esi
call fcn.004025bc
push 0x5a2b94
lea eax, [ebp - 0x21c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x487bcb
push str.PathCombineW_failed
lea esi, [ebp - 0x254]
call fcn.00403350
mov dword [ebp - 4], 1
push 0x16
mov ecx, str.srcClientCommon_MergeWhitelist.cpp
mov eax, esi
jmp 0x487b8d
lea eax, [ebp - 0x21c]
push eax
call fcn.00403350
mov eax, esi
call fcn.00523a81
ret
Function at 0x4889ea
Capabilities:
Get common file path

Disassembly:
push 0x320
mov eax, 0x559f56
call fcn.00523a34
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x280], edx
xor edx, edx
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp + 0x10]
cmp dword [ebx + 0x10], edx
jne 0x488a4c
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x268], str.File_path_must_not_be_empty
call fcn.00514f60
push 0x5c9738
lea eax, [ebp - 0x28c]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::invalid_argument.0
call fcn.0051eb2a
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x270], edx
push eax
mov dword [ebp - 4], edx
push ebx
lea edi, [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.00488d99
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x278]
cmp eax, edi
je 0x488aab
mov esi, eax
call fcn.004e7046
mov eax, dword [edi]
mov dword [ebp - 0x278], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x274], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x270], eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea esi, [ebp - 0x23c]
call fcn.004e7046
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
push 0x208
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x22a]
push edi
push eax
call fcn.00517bf0
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push 0x28
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x268], eax
cmp eax, edi
jge 0x488b86
lea eax, [ebp - 0x32c]
push eax
call fcn.00403689
mov esi, eax
push str.GFE::Feedback::Builder::AddFile:_SHGetFolderPath_failed_with
push esi
mov byte [ebp - 4], 6
call fcn.00405d65
pop ecx
pop ecx
push dword [ebp - 0x268]
push esi
call fcn.00410496
lea eax, [ebp - 0x248]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 7
cmp dword [ebp - 0x234], 8
mov eax, dword [ebp - 0x248]
jae 0x488b4b
lea eax, [ebp - 0x248]
push eax
push 2
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x248]
call fcn.0040412d
lea eax, [ebp - 0x32c]
mov byte [ebp - 4], 0
call fcn.0040262a
lea esi, [ebp - 0x278]
call fcn.004e7046
call fcn.00523a90
ret 0xc
push ebx
lea esi, [ebp - 0x264]
call fcn.0040d97a
lea eax, [ebp - 0x22c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.0040ffab
pop ecx
test al, al
je 0x488bce
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x488bb2
sub eax, edx
sar eax, 1
push 0xd
lea ecx, [ebp - 0x264]
call fcn.0040ec65
push dword [ebp - 0x280]
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x278]
lea edx, [ebp - 0x264]
push eax
push dword [ebp - 0x278]
push dword [ebp - 0x27c]
call fcn.004891ec
push 1
xor edi, edi
lea esi, [ebp - 0x264]
call fcn.0040412d
jmp 0x488b73
Function at 0x48e720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
cld
invalid
call dword [ebp - 0x3a]
test dword [esi + 0x25fffffc], edi
lea eax, [ebp - 0x354]
push eax
call fcn.0048dee5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x48e795
call fcn.0048de9a
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0048dee5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0048de9a
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
invalid
invalid
Function at 0x490fe7
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x4a8
mov eax, 0x565334
call fcn.005239fe
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 0x380], ebx
cmp dword [esi], ebx
mov dword [ebp - 0x374], eax
setne al
movzx eax, al
push 0x1e1
push eax
mov edi, str.srcwindows_registry.cpp
mov dword [ebp - 0x37c], esi
call fcn.004924b4
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x378]
push eax
push ebx
push ebx
push ebx
push dword [esi]
mov dword [ebp - 0x378], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp edi, ebx
je 0x4910cd
lea eax, [ebp - 0x41c]
push eax
call fcn.00403689
mov esi, eax
push str.RegQueryInfoKey_failed_with
push esi
mov dword [ebp - 4], 1
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.00410496
lea eax, [ebp - 0x24c]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 2
cmp edi, ebx
jle 0x49109c
and edi, 0xffff
or edi, 0x80070000
push 1
push 0x1f7
push str.srcwindows_registry.cpp
push edi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.00498954
push 0x5c9774
lea eax, [ebp - 0x36c]
push eax
call fcn.0051eb2a
mov edi, dword [ebp - 0x374]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x380], 1
mov dword [ebp - 0x370], ebx
cmp dword [ebp - 0x378], ebx
ja 0x491106
mov eax, edi
call fcn.00523a81
ret 4
mov esi, dword [ebp - 0x37c]
push ebx
push ebx
push ebx
xor eax, eax
push ebx
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x370]
mov dword [ebp - 0x384], 0x100
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x4910f6
cmp esi, ebx
jne 0x49119c
lea eax, [ebp - 0x214]
push eax
lea esi, [ebp - 0x230]
call fcn.00403350
mov dword [ebp - 4], 5
mov edi, dword [ebp - 0x374]
mov ecx, esi
call fcn.0040dea7
push 1
xor edi, edi
mov byte [ebp - 4], bl
call fcn.0040412d
inc dword [ebp - 0x370]
mov eax, dword [ebp - 0x370]
mov edi, dword [ebp - 0x374]
cmp eax, dword [ebp - 0x378]
jb 0x491100
jmp 0x4910f6
lea eax, [ebp - 0x4b4]
push eax
call fcn.00403689
mov edi, eax
push str.RegEnumKeyEx_failed_with
push edi
mov dword [ebp - 4], 3
call fcn.00405d65
pop ecx
pop ecx
push esi
push edi
call fcn.00410496
lea eax, [ebp - 0x230]
push eax
mov eax, edi
call fcn.004036f3
mov byte [ebp - 4], 4
cmp esi, ebx
jle 0x4911e7
and esi, 0xffff
or esi, 0x80070000
push 1
push 0x21a
push str.srcwindows_registry.cpp
push esi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00498954
push 0x5c9774
lea eax, [ebp - 0x2dc]
jmp 0x4910c7