joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429b72
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b2106
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x6274d0]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
push edi
mov eax, dword [0x6274d0]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
lea ebx, [esp + 0xac]
call fcn.00470784
and dword [esp + 0x110], 0
lea eax, [esp + 0xc8]
push str..bak
push eax
call fcn.0040cf5b
pop ecx
pop ecx
push 8
mov byte [esp + 0x114], 1
mov eax, dword [esp + 0xcc]
pop esi
cmp dword [esp + 0xdc], esi
jae 0x429bfc
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xc8]
cmp dword [esp + 0xdc], esi
jae 0x429c1a
lea ecx, [esp + 0xc8]
mov eax, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x429c31
lea eax, [esp + 0xac]
push ecx
push eax
call fcn.00561013
pop ecx
pop ecx
push 3
pop edi
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 4
call fcn.0047170a
test al, al
je 0x429c56
mov edi, dword [esp + 0x10]
push edi
call fcn.0047c4fd
pop ecx
push esi
call fcn.0055e7f7
mov ebx, eax
pop ecx
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x429ca0
mov byte [esp + 0x110], 3
and dword [ebx + 4], 0
mov dword [ebx], vtable.GFE::FileTraceHandler.0
mov edi, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x429c97
lea edi, [esp + 0xac]
mov ecx, ebx
call fcn.0047c847
jmp 0x429ca2
xor ebx, ebx
push ebx
mov byte [esp + 0x114], 1
call fcn.0047c5ef
pop ecx
lea eax, [esp + 0x14]
push eax
call fcn.00409ac6
mov edi, eax
push str.Running_version
push edi
mov byte [esp + 0x118], 4
call fcn.0040fa1f
push 0x5c92f4
push edi
call fcn.0040fd5c
push 0x5c9300
push edi
call fcn.0040fa1f
push str.2.2.2
push edi
call fcn.0040fd5c
push 0x29
push edi
call fcn.004101f8
add esp, 0x28
lea eax, [esp + 0xe4]
push eax
mov eax, edi
call fcn.00409b30
mov byte [esp + 0x110], 5
mov eax, dword [esp + 0xe4]
cmp dword [esp + 0xf8], esi
jae 0x429d2a
lea eax, [esp + 0xe4]
push eax
push 3
pop ecx
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe8]
call fcn.0040b028
lea eax, [esp + 0x14]
mov byte [esp + 0x110], 1
call fcn.004021a3
push 1
lea esi, [esp + 0xcc]
call fcn.0040b028
push 1
lea esi, [esp + 0xb0]
call fcn.0040b028
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.0055d7fe
mov esp, ebp
pop ebp
ret 4
Function at 0x429d9a
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x454
mov eax, 0x59de42
call fcn.0056ce95
xor eax, eax
mov edi, 0x206
xor ebx, ebx
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov byte [ebp - 0x441], bl
call fcn.00560d40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x429dfb
push str.GetSystemDirectory_failed.
push 2
pop ecx
call fcn.0047c666
pop ecx
xor al, al
jmp 0x429fcf
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x44c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x429e20
push str.IsWow64Process_failed.
jmp 0x429deb
lea eax, [ebp - 0x21c]
push eax
lea esi, [ebp - 0x440]
call fcn.00409096
push str._nvcoproc.bin
mov eax, esi
push eax
mov dword [ebp - 4], ebx
call fcn.004090e2
cmp dword [ebp - 0x44c], 1
jne 0x429f8b
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00560d40
add esp, 0xc
push str.kernel32.dll
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x429ea8
push str.PathCombine_failed.
push 2
pop ecx
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x440]
call fcn.0040b028
jmp 0x429df4
lea eax, [ebp - 0x424]
call fcn.00401137
mov edi, eax
mov dword [ebp - 0x460], edi
mov byte [ebp - 4], 1
cmp edi, ebx
jne 0x429eca
push str.Failed_to_load_kernel32.dll.
jmp 0x429e8b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
call esi
mov dword [ebp - 0x450], eax
cmp eax, ebx
jne 0x429efc
push str.Wow64RevertWow64FsRedirection_not_supported.
push 2
pop ecx
call fcn.0047c666
pop ecx
push edi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x429e94
push str.Wow64DisableWow64FsRedirection
push edi
call esi
cmp eax, ebx
jne 0x429f0f
push str.Wow64DisableWow64FsRedirection_not_supported.
jmp 0x429ee7
lea ecx, [ebp - 0x448]
push ecx
mov dword [ebp - 0x448], ebx
call eax
cmp eax, 1
jne 0x429f7f
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0047c15a
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x454]
call fcn.0047c4dd
push dword [ebp - 0x448]
mov byte [ebp - 0x441], al
call dword [ebp - 0x450]
test eax, eax
jne 0x429f70
push str.Enabling_back_Wow64_redirection_failed._Exiting.
xor ecx, ecx
call fcn.0047c666
pop ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 1
call fcn.0047c1b1
push edi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x429fba
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0047c15a
mov eax, dword [ebp - 0x454]
call fcn.0047c4dd
lea ecx, [ebp - 0x45c]
mov byte [ebp - 0x441], al
call fcn.0047c1b1
push 1
xor edi, edi
lea esi, [ebp - 0x440]
call fcn.0040b028
mov al, byte [ebp - 0x441]
call fcn.0056cf18
ret
Function at 0x43f043
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x5b6266
call fcn.0056ce95
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x4c], eax
call esi
cmp dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x50], eax
je 0x43f176
xor ebx, ebx
cmp dword [ebp - 0x4c], ebx
je 0x43f176
cmp eax, 0xffffffff
je 0x43f176
cmp eax, ebx
je 0x43f176
push 3
pop edi
push edi
call fcn.0047c4fd
push 0x20
call fcn.0055e7f7
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x43f0cf
lea ecx, [esi + 4]
mov dword [esi], vtable.GFE::MemoryTraceHandler.0
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
mov word [ecx], ax
mov eax, 0x10000
mov byte [ebp - 4], 2
call fcn.0040d1e6
jmp 0x43f0d1
xor esi, esi
or dword [ebp - 4], 0xffffffff
push esi
call fcn.0047c5ef
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.0046405a
lea ecx, [ebp - 0x48]
mov eax, esi
mov dword [ebp - 4], edi
call fcn.004819fa
mov byte [ebp - 4], 4
call fcn.0047c554
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], ebx
jae 0x43f109
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, ecx
push ecx
push eax
push dword [ebp - 0x4c]
call esi
test eax, eax
jne 0x43f141
xor ebx, ebx
inc ebx
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040b028
push 1
lea esi, [ebp - 0x2c]
call fcn.0040b028
mov eax, ebx
jmp 0x43f179
push dword [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x43f158
lea eax, [ebp - 0x48]
push ebx
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [ebp - 0x38]
add ecx, ecx
push ecx
push eax
push dword [ebp - 0x50]
call esi
push dword [ebp - 0x50]
mov esi, eax
call edi
cmp esi, ebx
jne 0x43f127
jmp 0x43f124
xor eax, eax
inc eax
call fcn.0056cf18
ret
Function at 0x45ad3b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59a74a
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x6274d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
and dword [esp + 8], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0045adaf
push dword [ebp + 0xc]
and dword [esp + 0x3c], 0
mov esi, eax
call fcn.0045b1df
pop ecx
lea esi, [esp + 0x1c]
call fcn.004c601a
lea esi, [esp + 0xc]
call fcn.004c601a
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x45c739
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b2751
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x6274d0]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x6274d0]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
lea ebx, [esp + 0xb0]
call fcn.0045c87b
and dword [esp + 0xf8], 0
mov eax, ebx
call fcn.0047c4dd
test al, al
je 0x45c847
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x45c7af
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45c847
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00409ac6
mov esi, eax
push str.Cannot_delete_ShadowPlayStatistics_file:
push esi
mov byte [esp + 0x100], 1
call fcn.0040fa1f
pop ecx
pop ecx
push edi
push esi
call fcn.0040d432
lea eax, [esp + 0xcc]
push eax
mov eax, esi
call fcn.00409b30
push 2
pop ecx
mov byte [esp + 0xf8], cl
cmp dword [esp + 0xe0], 8
mov eax, dword [esp + 0xcc]
jae 0x45c81f
lea eax, [esp + 0xcc]
push eax
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd0]
call fcn.0040b028
lea eax, [esp + 0x14]
mov byte [esp + 0xf8], 0
call fcn.004021a3
push 1
xor edi, edi
lea esi, [esp + 0xb4]
call fcn.0040b028
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.0055d7fe
mov esp, ebp
pop ebp
ret
Function at 0x468136
Capabilities:
Get geographical location

Disassembly:
push 0xc
mov eax, 0x5b7ebb
call fcn.0056ce2c
mov ebx, dword [ebp + 8]
xor edi, edi
push edi
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.updtSUGARClient.0
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.0047ba70
push edi
lea esi, [ebx + 0x10]
mov dword [ebp - 4], edi
call fcn.0047ba70
lea esi, [ebx + 0x14]
mov byte [ebp - 4], 1
call fcn.0047ba48
mov byte [ebp - 4], 2
lea esi, [ebx + 0x1c]
mov dword [ebx + 0x18], edi
call fcn.0047ba48
lea eax, [ebx + 0x20]
push eax
mov byte [ebp - 4], 3
call fcn.0046831a
lea eax, [ebx + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.0046831a
lea eax, [ebx + 0x60]
push eax
mov byte [ebp - 4], 5
call fcn.0046831a
lea eax, [ebx + 0x80]
push eax
mov byte [ebp - 4], 6
call fcn.0046831a
mov byte [ebp - 4], 7
lea esi, [ebx + 0xa8]
mov dword [ebx + 0xa0], edi
mov word [ebx + 0xa4], 1
call fcn.0047ba48
mov byte [ebp - 4], 8
lea esi, [ebx + 0xb4]
mov byte [ebx + 0xac], 0
mov dword [ebx + 0xb0], 0xea60
call fcn.0047ba48
mov esi, dword [ebp + 0xc]
cmp esi, edi
setne byte [ebp + 0xc]
push 8
push dword [ebp + 0xc]
mov byte [ebp - 4], 9
mov edi, str.srcGeoLocation.cpp
mov dword [ebx + 0xb8], esi
call fcn.0047a44a
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0xc4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0xc8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0xcc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebx + 0xbc], esi
mov esi, dword [ebp + 0x1c]
mov dword [ebx + 0xd4], eax
mov eax, dword [ebp + 0x18]
push 0x3a
push dword [ebp + 0xc]
mov dword [ebx + 0xd0], esi
mov dword [ebx + 0xd8], eax
mov edi, str.srcSUGARClient.cpp
call fcn.0047a44a
cmp dword [ebp + 0x10], 0
push 0x3b
setne al
movzx eax, al
push eax
call fcn.0047a44a
cmp dword [ebp + 0x14], 0
push 0x3c
setne al
movzx eax, al
push eax
call fcn.0047a44a
test esi, esi
setne al
movzx eax, al
push 0x3d
push eax
call fcn.0047a44a
cmp dword [ebp + 0x18], 0
push 0x3e
setne al
movzx eax, al
push eax
call fcn.0047a44a
push ebx
push 0x46b1ca
call fcn.00482348
add esp, 0x38
mov dword [ebx + 8], eax
test eax, eax
jne 0x4682f1
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp + 0x10], str.Cannot_create_policy_thread
call fcn.0055dff9
push 0x5ff9b8
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], vtable.std::runtime_error.0
call fcn.005676bc
mov eax, ebx
call fcn.0056cf04
ret 0x24
Function at 0x46c738
Capabilities:
Delete file

Disassembly:
push 0x114
mov eax, 0x5b7071
call fcn.0056cecb
mov esi, ecx
lea eax, [esi + 0xb4]
push dword [eax]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
lea ebx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.0046b6a6
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x70]
je 0x46c790
push str.Trying_to_send_stored_feedbacks...
push 3
pop ecx
call fcn.0047c666
pop ecx
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
sub eax, ecx
push 0x1c
cdq
pop edi
idiv edi
cmp dword [ebp - 0x50], eax
jae 0x46c9b4
mov ebx, dword [ebp - 0x50]
imul ebx, ebx, 0x1c
add ebx, ecx
push ebx
lea eax, [ebp - 0x80]
push eax
call fcn.0047c15a
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.0047c1fe
test al, al
je 0x46c8e5
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0047a4ef
test al, al
je 0x46c8cc
lea ecx, [ebp - 0x80]
call fcn.0047c2b8
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
sub eax, ecx
shr eax, 1
push eax
lea eax, [ebp - 0x4c]
call fcn.0040c665
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0xd8]
push eax
lea edx, [ebp - 0x30]
call fcn.0043b3cd
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.0040b028
mov dword [ebp - 4], 5
cmp dword [ebx + 0x14], 8
jb 0x46c848
mov eax, dword [ebx]
jmp 0x46c84a
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x46c8bd
lea eax, [ebp - 0x120]
push eax
call fcn.00409ac6
mov esi, eax
push str.Cannot_delete_feedback_file
push esi
mov byte [ebp - 4], 0xa
call fcn.0040fa1f
pop ecx
pop ecx
push esi
mov ecx, ebx
call fcn.0040fbd3
pop ecx
lea eax, [ebp - 0x30]
push eax
mov eax, esi
call fcn.00409b30
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x46c898
lea eax, [ebp - 0x30]
xor ecx, ecx
push eax
inc ecx
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.0040b028
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 5
call fcn.004021a3
push 1
xor edi, edi
lea esi, [ebp - 0x4c]
call fcn.0040b028
mov esi, dword [ebp - 0x64]
xor edi, edi
cmp dword [ebp - 0x60], edi
je 0x46c8dc
push dword [ebp - 0x60]
call fcn.0055e74f
pop ecx
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.0047c1b1
inc dword [ebp - 0x50]
jmp 0x46c794
lea esi, [ebp - 0x74]
call fcn.0040b1e1
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x46c9ce
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0056cf27
ret
Function at 0x47004e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a2243
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x6274d0]
xor eax, esp
mov dword [esp + 0xe4], eax
push ebx
push esi
mov eax, dword [0x6274d0]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
dec eax
je 0x4700ea
lea eax, [esp + 0x3c]
push eax
call fcn.00409ac6
mov esi, eax
and dword [esp + 0x100], 0
push str.Version_is_not_supported:
push esi
call fcn.0040fa1f
pop ecx
pop ecx
push dword [ebp + 8]
push esi
call fcn.0040d432
lea eax, [esp + 0xd4]
push eax
mov eax, esi
call fcn.00409b30
push 0x16b
mov ecx, str.srcTarConManager.cpp
lea eax, [esp + 0xd8]
mov byte [esp + 0x104], 1
call fcn.00401f44
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], vtable.GFE::IOMemory.0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esi
push ecx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x108], 2
call fcn.0047e846
mov ebx, vtable.GFE::BinaryStream.0
lea eax, [esp + 0x20]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x10c], 3
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
push eax
lea esi, [esp + 0x2c]
call fcn.0047e57b
pop ecx
mov esi, eax
call fcn.0047e57b
pop ecx
mov esi, eax
call fcn.0047e57b
mov eax, dword [esp + 0x10]
mov dword [edi], eax
mov eax, dword [esp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [edi + 8], eax
mov dword [esp + 0x18], ebx
call fcn.0047e89d
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xe4]
xor ecx, esp
call fcn.0055d7fe
mov esp, ebp
pop ebp
ret
Function at 0x4701b1
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a21ec
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x6274d0]
xor eax, esp
mov dword [esp + 0xe4], eax
push ebx
push esi
mov eax, dword [0x6274d0]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 2
pop ecx
sub eax, ecx
je 0x470251
lea eax, [esp + 0x3c]
push eax
call fcn.00409ac6
mov esi, eax
and dword [esp + 0x100], 0
push str.Version_is_not_supported:
push esi
call fcn.0040fa1f
pop ecx
pop ecx
push dword [ebp + 8]
push esi
call fcn.0040d432
lea eax, [esp + 0xd4]
push eax
mov eax, esi
call fcn.00409b30
push 0x185
mov ecx, str.srcTarConManager.cpp
lea eax, [esp + 0xd8]
mov byte [esp + 0x104], 1
call fcn.00401f44
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], vtable.GFE::IOMemory.0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esi
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x108], ecx
call fcn.0047e846
mov ebx, vtable.GFE::BinaryStream.0
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
push ecx
push ecx
mov byte [esp + 0x108], 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
lea eax, [edi + 8]
push ecx
lea esi, [esp + 0x20]
mov dword [esp + 0x28], eax
call fcn.0047e57b
pop ecx
mov esi, eax
call fcn.0047e57b
mov edx, dword [esp + 0x1c]
mov ecx, eax
call fcn.0047e5b1
mov eax, dword [esp + 0xc]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
mov dword [edi + 4], eax
mov dword [esp + 0x14], ebx
call fcn.0047e89d
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xe4]
xor ecx, esp
call fcn.0055d7fe
mov esp, ebp
pop ebp
ret

Function at 0x4703a2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6274d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
push 0x208
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x21c], edi
call fcn.00560d40
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push dword [ebp + 8]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, eax
cmp edx, edi
jge 0x470404
push 0x18
mov eax, str.srcClientPaths.cpp
call fcn.0043ec23
lea eax, [ebp - 0x218]
push eax
call fcn.00409096
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0055d7fe
leave
ret
Function at 0x471248
Capabilities:
Read file via mapping

Disassembly:
push 0x40
mov eax, 0x5a63b2
call fcn.0056ce2c
push str.AA45D379_DBB1_4AF4_833B_39E697EDCCA4
xor ebx, ebx
push ebx
push 4
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x18], eax
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp eax, ebx
jne 0x471299
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x471288
and eax, 0xffff
or eax, 0x80070000
mov edx, eax
push 0x90
mov eax, str.srcClientRpc.cpp
call fcn.0043ec23
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x4712c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4712c0
and eax, 0xffff
or eax, 0x80070000
mov edx, eax
push 0x9c
jmp 0x47128f
push 0x1c
lea ecx, [ebp - 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4712f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4712ee
and eax, 0xffff
or eax, 0x80070000
mov edx, eax
push 0xa7
jmp 0x47128f
mov eax, dword [ebp - 0x40]
shr eax, 1
lea ecx, [ebp - 0x1c]
inc eax
push ecx
lea esi, [ebp - 0x30]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.00465046
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x40]
mov ecx, eax
and ecx, edi
sub eax, ecx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x30]
call fcn.00560920
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x30]
mov esi, dword [ebp + 8]
call fcn.00409096
lea esi, [ebp - 0x30]
mov dword [ebp - 0x20], edi
call fcn.004c601a
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 0xffffffff
je 0x471362
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
call fcn.0056cf04
ret

Function at 0x47136b
Capabilities:
Get common file path

Disassembly:
push 0x24c
mov eax, 0x5a2152
call fcn.0056ce95
and dword [ebp - 0x258], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov esi, ecx
call fcn.00560d40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4713d9
push str.GetSystemDirectory_failed
lea esi, [ebp - 0x238]
call fcn.00409096
and dword [ebp - 4], 0
push 0x12
mov ecx, str.srcClientCommon_MergeWhitelist.cpp
mov eax, esi
call fcn.00401f44
push 0x5d96a4
lea eax, [ebp - 0x21c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x471412
push str.PathCombineW_failed
lea esi, [ebp - 0x254]
call fcn.00409096
mov dword [ebp - 4], 1
push 0x16
mov ecx, str.srcClientCommon_MergeWhitelist.cpp
mov eax, esi
jmp 0x4713d4
lea eax, [ebp - 0x21c]
push eax
call fcn.00409096
mov eax, esi
call fcn.0056cf18
ret
Function at 0x4729b0
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x59ba51
call fcn.0056ce95
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x472a91
cmp byte [edi + 0x49], bl
je 0x472a91
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4729e5
xor al, al
jmp 0x472a93
lea esi, [ebp - 0x2c]
call fcn.004726c2
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x472a33
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x472a38
dec eax
je 0x472a3c
dec eax
dec eax
je 0x472a8d
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040aadd
mov al, bl
jmp 0x472a93
mov edx, dword [ebp - 0x2c]
jmp 0x4729fe
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x472a48
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x472a6e
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x472a5b
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0055f689
add esp, 0x10
cmp esi, eax
jne 0x472a21
cmp byte [edi + 0x49], 0
je 0x472a8d
test esi, esi
jne 0x4729f0
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.0040f77b
jmp 0x4729f0
mov bl, 1
jmp 0x472a23
mov al, 1
call fcn.0056cf18
ret