joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68ef96a4
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x68f5d2a0
call fcn.68f54ccb
mov eax, dword [ebp + 0xc]
push 0xac
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x230], eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x224], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x228]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x228], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x68ef970b
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x224], eax
jmp 0x68ef9710
call fcn.68ef99de
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x228], ebx
mov edi, 0x80070000
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x234], 0x105
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x228]
cmp eax, 0x103
je 0x68ef985b
cmp eax, ebx
je 0x68ef9788
call esi
test eax, eax
jg 0x68ef9774
call esi
jmp 0x68ef977d
call esi
and eax, 0xffff
or eax, edi
push eax
push 0x2e6e3033
call fcn.68f079b4
push ebx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x224]
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCRegistryKey::constructor_struct_HKEY_____wchar_t_const___bool_
mov byte [ebp - 4], 1
push 0x20019
lea ecx, [ebp - 0x248]
call fcn.68f079b4
test eax, eax
je 0x68ef97d7
call esi
test eax, eax
jg 0x68ef97c3
call esi
jmp 0x68ef97cc
call esi
and eax, 0xffff
or eax, edi
push eax
push 0x2e6e3034
call fcn.68f079b4
push ebx
push str.Index
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public:_long_int___thiscall_GCRegistryKey::GetValue_unsigned_long_int___wchar_t_const___unsigned_long_int__const
test eax, eax
je 0x68ef9806
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public_virtual:_void___thiscall_GCRegistryKey::destructor_void_
jmp 0x68ef9721
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp + 8]
jne 0x68ef97f3
mov ebx, dword [ebp - 0x230]
lea eax, [ebp - 0x248]
push eax
call fcn.68f079b4
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public_virtual:_void___thiscall_GCRegistryKey::destructor_void_
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], ebx
je 0x68ef9851
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x224], ebx
mov al, 1
call fcn.68f54d4e
ret 8
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], ebx
je 0x68ef9879
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x224], ebx
xor al, al
jmp 0x68ef9853
Function at 0x68ef9a08
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x68f5d211
call fcn.68f54ccb
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x230], esi
mov ebx, edx
mov dword [ebp - 0x228], edi
mov dword [ebp - 4], edi
push edi
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCRegistryKey::constructor_bool_
mov byte [ebp - 4], 1
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x22c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x68ef9a71
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x228], eax
jmp 0x68ef9a76
call fcn.68ef99de
mov dword [ebp - 0x22c], edi
jmp 0x68ef9a84
mov esi, dword [ebp - 0x230]
lea eax, [ebp - 0x250]
push eax
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x22c]
mov dword [ebp - 0x234], 0x105
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x22c]
cmp eax, 0x103
jne 0x68ef9ad3
push 0x80004005
push 0x2e6e3162
jmp 0x68ef9af9
cmp eax, edi
je 0x68ef9afe
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
test eax, eax
jg 0x68ef9ae7
call edi
jmp 0x68ef9af3
call edi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e3163
call fcn.68f079b4
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
lea ecx, [ebp - 0x248]
call fcn.68f079b4
push 0x20019
lea ecx, [ebp - 0x248]
call fcn.68f079b4
lea eax, [ebp - 0x248]
push eax
call fcn.68f079b4
mov eax, dword [ebx]
cmp eax, dword [esi]
jne 0x68ef9a84
lea eax, [esi + 4]
xor edi, edi
cmp word [eax], di
je 0x68ef9b90
push eax
lea eax, [ebx + 4]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x68ef9a84
mov byte [ebp - 4], al
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public_virtual:_void___thiscall_GCRegistryKey::destructor_void_
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x228], edi
je 0x68ef9c20
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], edi
jmp 0x68ef9c20
mov eax, dword [ebx + 0x54]
cmp eax, dword [esi + 0x54]
jne 0x68ef9a84
mov eax, dword [ebx + 0xa8]
cmp eax, dword [esi + 0xa8]
jne 0x68ef9a84
push 0x10
lea edi, [esi + 0x44]
pop ecx
lea esi, [ebx + 0x44]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x68ef9bc2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x68ef9a7e
mov edi, dword [ebp - 0x230]
push 0x10
add edi, 0x98
pop ecx
lea esi, [ebx + 0x98]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x68ef9bea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x68ef9a7e
mov byte [ebp - 4], al
lea ecx, [ebp - 0x248]
call sym.GrooveUtil.DLL_public_virtual:_void___thiscall_GCRegistryKey::destructor_void_
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x228], 0
je 0x68ef9c20
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x228], 0
call fcn.68f54d4e
ret
Function at 0x68f08b5d
Capabilities:
Terminate process

Disassembly:
push 0x24
mov eax, 0x68f5f422
call fcn.68f54c95
xor ebx, ebx
push ebx
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCriticalErrorInfo::StartErrorBlock_bool_
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp byte [ebp + 0xc], bl
je 0x68f08b98
test byte [0x68fa87d8], 0x10
je 0x68f08b98
push 0x666
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov esi, dword [ebp + 8]
test byte [0x68fa87d8], 1
je 0x68f08baa
push esi
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCSM::ReportErrorCSM_class_GCError_const__
test byte [0x68fa87d8], 2
je 0x68f08bb9
push esi
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCErrorServices::HandleErrorThroughSystemEventLog_class_GCError_const__
cmp byte [ebp + 0xc], bl
je 0x68f08c3d
mov eax, dword [esi]
mov ecx, SysReAllocString
and eax, ecx
cmp eax, ecx
jne 0x68f08c3d
mov al, byte [0x68fa87d8]
test al, 4
jne 0x68f08be8
test al, 8
je 0x68f08c3d
mov edi, dword [sym.GrooveUtil.DLL_unsigned_long_int_GCGrooveThreadId::ms_MainSTAThreadId]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, edi
jne 0x68f08c3d
push 1
lea ecx, [ebp + 0xc]
call fcn.68f079b4
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], bl
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 5
lea ebx, [ebp - 0x30]
call fcn.68f08935
mov byte [ebp - 4], 6
mov byte [ebp - 4], 2
mov eax, ebx
push eax
call fcn.68f08ac6
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCAutoWaitCursor::destructor_void_
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCriticalErrorInfo::EndErrorBlock_void_
call fcn.68f54d3a
ret 8
Function at 0x68f09a16
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f59320
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1144
call fcn.68f54e20
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x1140], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x1158]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x12c]
push eax
call fcn.68f0a872
xor ebx, ebx
mov dword [esp + 0x1160], ebx
cmp esi, ebx
je 0x68f09adc
push 1
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.68f079b4
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1160], 1
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x12c]
mov edi, eax
je 0x68f09abe
push eax
call fcn.68f079b4
push eax
push edi
lea ecx, [esp + 0x134]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStackStrBase::Set_wchar_t_const__const__unsigned_long_int_
mov byte [esp + 0x1160], bl
cmp dword [esp + 0x10], ebx
je 0x68f09ad4
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
push ebx
mov ecx, esi
call sym.GrooveUtil.DLL_public:_void___thiscall_GCError::Report_bool_const
cmp dword [ebp + 0xc], ebx
je 0x68f09b56
call fcn.68f079b4
push eax
push 0x2d53
lea eax, [esp + 0x24]
push eax
call fcn.68f08ee6
mov byte [esp + 0x1160], 2
call fcn.68f079b4
push eax
push dword [ebp + 0xc]
lea eax, [esp + 0x944]
push eax
call fcn.68f0a82e
mov byte [esp + 0x1160], 3
push 0x186a02
push dword [esp + 0x940]
push dword [esp + 0x24]
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCMso::DoAlert_wchar_t_const___wchar_t_const___unsigned_long_int_
mov byte [esp + 0x1160], 2
lea eax, [esp + 0x93c]
push eax
call fcn.68f08ae9
mov byte [esp + 0x1160], bl
lea ecx, [esp + 0x1c]
call fcn.68ef3ef5
cmp byte [ebp + 0x10], bl
je 0x68f09b71
cmp dword [esp + 0x14], ebx
je 0x68f09b6c
push dword [esp + 0x14]
call fcn.68f079b4
jmp 0x68f09b71
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCMso::InvokeCrashWatson_void_
push dword [ebp + 0x14]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
or dword [esp + 0x1160], 0xffffffff
lea eax, [esp + 0x12c]
push eax
call fcn.68f08ae9
mov ecx, dword [esp + 0x1158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1140]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 0x14
Function at 0x68f0e4ba
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x68f0e4d7
mov edx, eax
shr edx, 4
and dl, 1
mov byte [ecx], dl
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret 8

Function at 0x68f0e4eb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5de28
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x248], ebx
cmp esi, ebx
je 0x68f0e54e
cmp word [esi], bx
jne 0x68f0e569
lea eax, [esp + 0x20]
push eax
call fcn.68f079b4
mov esi, dword [eax]
lea ecx, [esp + 0x14]
call fcn.68f079b4
mov dword [esp + 0x14], esi
jmp 0x68f0e579
push esi
call fcn.68f079b4
push esi
lea ecx, [esp + 0x18]
call fcn.68f079b4
lea eax, [esp + 0x24]
push eax
push ebx
push edi
push dword [esp + 0x20]
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
cmp eax, ebx
jne 0x68f0e5b5
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x68f0e59e
call esi
jmp 0x68f0e5aa
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e746e
call fcn.68f079b4
mov dword [esp + 0x18], ebx
mov byte [esp + 0x248], 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.68f079b4
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esi], eax
mov byte [esp + 0x248], bl
cmp dword [esp + 0x18], ebx
je 0x68f0e5f3
lea ecx, [esp + 0x18]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
or dword [esp + 0x248], 0xffffffff
cmp dword [esp + 0x14], ebx
je 0x68f0e60a
lea ecx, [esp + 0x14]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x68f0ed52
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
call fcn.68f079b4
cmp eax, 0x104
jbe 0x68f0ed67
and word [esi + 0x208], 0
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x68f0ed79
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x68f0edb6
push esi
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x68f0ed9e
call esi
jmp 0x68f0edaa
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e7474
call fcn.68f079b4
pop esi
mov eax, edi
shr eax, 4
not eax
and eax, 1
pop edi
pop ebp
ret 4
Function at 0x68f0edc5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x68f0ee02
push esi
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x68f0edea
call esi
jmp 0x68f0edf6
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e7475
call fcn.68f079b4
pop esi
mov eax, edi
shr eax, 4
and eax, 1
pop edi
pop ebp
ret 4
Function at 0x68f19187
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xc
mov eax, 0x68f5f80b
call fcn.68f54c62
mov edx, dword [ebx + 4]
cmp edx, 0x200
mov esi, dword [sym.GrooveUtil.DLL_class_GCMenuHelper__GCMenuHelper::ms_pCurrentMenu]
jne 0x68f1921f
mov eax, dword [esi + 0x9c]
cmp eax, 0x11f
je 0x68f1921f
cmp eax, 0x101
je 0x68f1921f
cmp dword [esi + 0x98], 0
je 0x68f192f2
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [0x68fac0cc]
cmp eax, 0x1f4
jbe 0x68f192f2
movzx eax, word [ebx + 0xc]
mov dword [ebp - 0x18], eax
movzx eax, word [ebx + 0xe]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx eax, word [ebp - 0x14]
movzx ecx, word [ebp - 0x18]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebx + 8]
push dword [ebx + 4]
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x68f192f2
mov edi, 0x100
cmp edx, edi
jb 0x68f192f2
cmp edx, 0x109
ja 0x68f192f2
cmp byte [esi + 0x90], 0
je 0x68f1924b
cmp dword [ebx + 8], 0x27
jne 0x68f1924b
mov cl, 1
jmp 0x68f1924d
xor cl, cl
cmp byte [esi + 0x91], 0
je 0x68f19260
cmp dword [ebx + 8], 0x25
jne 0x68f19260
mov al, 1
jmp 0x68f19262
xor al, al
test cl, cl
jne 0x68f192f2
test al, al
jne 0x68f192f2
mov eax, dword [ebx + 0xc]
shr eax, 0x1d
not al
and al, 1
cmp edx, 0x104
jne 0x68f19288
test al, al
je 0x68f19299
cmp edx, edi
jne 0x68f192a8
mov eax, dword [ebx + 8]
cmp eax, 0x25
je 0x68f19299
cmp eax, 0x27
jne 0x68f192a8
push 0
push 0
push 0x1f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call dword [sym.imp.kernel32.dll_GetTickCount]
push dword [esi + 0x30]
mov edi, 0x68f79b40
push edi
lea ecx, [ebp - 0x10]
mov dword [0x68fac0cc], eax
call fcn.68f079b4
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
push eax
mov dword [ebp - 0x14], eax
call dword [ecx + 0x10]
test eax, eax
jge 0x68f192e6
push edi
push dword [ebp - 0x14]
push eax
call fcn.68ef1079
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCAnyIPtr::destructor_void_
mov eax, dword [ebx + 4]
mov dword [esi + 0x9c], eax
xor eax, eax
call fcn.68f54d3a
ret
Function at 0x68f1a35e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5bc58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x38], 3
lea edi, [ecx + 0xcc]
push dword [edi]
lea ebx, [esp + 0x20]
call fcn.68f079b4
mov eax, dword [edi]
neg eax
sbb eax, eax
test eax, eax
mov dword [esp + 0x14], eax
je 0x68f1a405
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x18]
add eax, 0xc4
call fcn.68f079b4
mov edi, dword [eax]
mov eax, dword [esp + 0x18]
mov ebx, dword [eax]
mov eax, esi
lea ecx, [esp + 0x1c]
call fcn.68f1b988
mov eax, dword [esp + 0x1c]
lea eax, [eax + esi*8]
inc esi
cmp dword [esp + 0x14], 0
mov dword [eax], ebx
mov dword [eax + 4], edi
jne 0x68f1a3c7
push 0x68f388ca
push 8
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.MSVCR80.dll_qsort]
xor edi, edi
add esp, 0x10
cmp dword [esp + 0x20], edi
jle 0x68f1a46d
mov ebx, dword [esp + 0x10]
add ebx, 0x64
mov eax, edi
lea ecx, [esp + 0x1c]
call fcn.68f1b988
mov eax, edi
lea ecx, [esp + 0x1c]
call fcn.68f1b988
mov eax, edi
lea ecx, [esp + 0x1c]
call fcn.68f1b988
mov eax, edi
lea ecx, [esp + 0x1c]
call fcn.68f1b988
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + edi*8]
mov eax, ebx
call fcn.68f079b4
inc edi
cmp edi, dword [esp + 0x20]
jl 0x68f1a42c
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 0xd0]
lea eax, [esi + 0x44]
push eax
call fcn.68f079b4
mov ecx, esi
call sym.GrooveUtil.DLL_public:_void___thiscall_NewGCWBXMLEncoder::WriteAgain_void_
or dword [esp + 0x38], 0xffffffff
lea eax, [esp + 0x1c]
push eax
call fcn.68f011e4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x68f1c634
Capabilities:
Get common file path

Disassembly:
push 0xe7c
mov eax, 0x68f5b028
call fcn.68f54ccb
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x68f1c680
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x68f1c669
call esi
jmp 0x68f1c675
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e3434
call fcn.68f079b4
lea eax, [ebp - 0xa74]
push eax
call fcn.68f1ca1c
and dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp eax, dword [ebp - 0xa74]
je 0x68f1c6b7
push eax
call fcn.68f079b4
push eax
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0xa74]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStackStrBase::Set_wchar_t_const__const__unsigned_long_int_
lea eax, [ebp - 0xe84]
push eax
call fcn.68ef94b5
mov byte [ebp - 4], 1
push 0x68f73d24
push dword [ebp - 0xa74]
lea eax, [ebp - 0xe84]
push 0x68f73d58
push eax
call fcn.68f079b4
mov eax, dword [edi]
add esp, 0x10
push 0
push 0x80
push 2
push dword [ebp - 0xe84]
mov ecx, edi
call dword [eax]
test al, al
jne 0x68f1c729
xor bl, bl
mov byte [ebp - 4], 0
lea eax, [ebp - 0xe84]
push eax
call fcn.68f08ae9
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xa74]
push eax
call fcn.68f08ae9
mov al, bl
call fcn.68f54d4e
ret
mov eax, dword [edi]
push 0x18
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, edi
call dword [eax + 0x14]
mov esi, dword [sym.imp.MSVCR80.dll_memmove_s]
push 4
lea eax, [ebp - 0x2c]
push eax
lea ebx, [edi + 0x10]
push 4
push ebx
call esi
push 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x14]
push 0xc
push eax
call esi
push 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 0x20]
push 8
push eax
call esi
and dword [ebp - 0xe88], 0
add esp, 0x30
cmp dword [ebx], 0
jbe 0x68f1c80d
mov ebx, 0x208
and dword [ebp - 0x44c], 0
push ebx
lea eax, [ebp - 0x654]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x20c
lea eax, [ebp - 0x23c]
push 0
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [edi]
add esp, 0xc
push 0x20c
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, edi
call dword [eax + 0x14]
push ebx
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x654]
push ebx
push eax
call esi
push 4
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44c]
push 4
push eax
call esi
add esp, 0x20
lea ecx, [edi + 0x28]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x654]
push edx
call fcn.68f079b4
inc dword [ebp - 0xe88]
mov eax, dword [ebp - 0xe88]
cmp eax, dword [edi + 0x10]
jb 0x68f1c77e
mov bl, 1
jmp 0x68f1c701
Function at 0x68f1dbac
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x68f57d1b
call fcn.68f54c62
mov edi, ecx
mov esi, dword [ebp + 8]
and dword [esi], 0
cmp byte [0x68fa8a24], 0
mov ebx, dword [ebp + 0xc]
je 0x68f1dc1e
test ebx, ebx
je 0x68f1dc1e
lea edx, [ebp - 0x10]
call fcn.68f079b4
mov eax, dword [eax]
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
push eax
call fcn.68f079b4
test eax, eax
je 0x68f1dc12
cmp dword [eax], 2
jne 0x68f1dc12
mov eax, dword [eax + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.68f079b4
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x68f1dc0e
mov dword [eax], 4
xor eax, eax
jmp 0x68f1dc5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.68f079b4
mov ecx, edi
call sym.GrooveUtil.DLL_public:_bool___thiscall_GCRegistryKey::IsVirtualKey_void_const
test al, al
je 0x68f1dc2e
push 2
pop eax
jmp 0x68f1dc5c
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 0x10]
mov eax, edi
neg eax
push 0
lea ecx, [edi + 4]
sbb eax, eax
push ebx
and eax, ecx
push dword [eax]
mov dword [ebp + 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, edi
call fcn.68f1e366
call fcn.68f54d3a
ret 0xc

Function at 0x68f1dc64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.68f54e20
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1058], ecx
call fcn.68f079b4
push dword [ebp - 0x1058]
mov edx, esi
mov ecx, edi
call fcn.68f1e5ac
test al, al
je 0x68f1dcb8
test ebx, ebx
je 0x68f1dcb1
mov dword [ebx], 1
xor eax, eax
jmp 0x68f1dd38
mov ecx, edi
call sym.GrooveUtil.DLL_public:_bool___thiscall_GCRegistryKey::IsVirtualKey_void_const
test al, al
je 0x68f1dcc8
push 2
pop eax
jmp 0x68f1dd38
and word [ebp - 0x1054], 0
push 0x1046
lea eax, [ebp - 0x1052]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x105c]
push eax
lea eax, [ebp - 0x1054]
push eax
push ebx
mov eax, edi
neg eax
push 0
lea ecx, [edi + 4]
sbb eax, eax
push esi
and eax, ecx
push dword [eax]
mov dword [ebp - 0x105c], 0x1048
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, edi
call fcn.68f1e366
mov esi, eax
test esi, esi
jne 0x68f1dd36
mov ecx, dword [ebp - 0x1058]
lea eax, [ebp - 0x1054]
push eax
call fcn.68f079b4
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.68f53fd7
leave
ret 0xc