joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418cf8
Capabilities:
Delete file

Disassembly:
push 0xec
mov eax, 0x56cf31
call fcn.00523c97
mov edi, ecx
push edi
lea eax, [ebp - 0x60]
push eax
mov esi, edx
call fcn.0049515b
xor ebx, ebx
push 0xa
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.004951ff
test al, al
jne 0x418d71
lea eax, [ebp - 0xf8]
push eax
call fcn.004036c8
mov esi, eax
push str.Cannot_open_file_for_writing:
push esi
mov byte [ebp - 4], 1
call fcn.00405d7d
push esi
mov ecx, edi
call fcn.0041193b
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.00403732
mov byte [ebp - 4], 2
push 0x270
mov ecx, str.srcApplicationUsageCollector.cpp
lea eax, [ebp - 0x48]
call fcn.004025fb
push 0x2e
push str.__xml_version1.0_encodingUTF_8___n_Data__n
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004042f1
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x49], bl
jae 0x418da0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x49]
push ecx
push ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x60]
call dword [eax + 0x24]
cmp byte [ebp - 0x49], bl
je 0x418e45
lea ecx, [ebp - 0x60]
call fcn.004952b9
cmp dword [edi + 0x14], 8
jb 0x418dcb
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x418df1
push str.Cannot_write_file_header.
lea esi, [ebp - 0x48]
call fcn.0040338f
mov byte [ebp - 4], 4
push 0x27a
jmp 0x418d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xf8]
push eax
call fcn.004036c8
mov esi, eax
push str.Cannot_write_file_header_and_delete_incomplete_file__ec
push esi
mov byte [ebp - 4], 5
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.0041056c
push 0x589be4
push esi
call fcn.00405d7d
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.00403732
mov byte [ebp - 4], 6
push 0x27f
jmp 0x418d64
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
mov edi, 0x1e8
mov dword [ebp - 0x50], ebx
cdq
mov ebx, edi
idiv ebx
test eax, eax
je 0x418e85
and dword [ebp - 0x54], 0
add ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x60]
push eax
call fcn.00415c52
mov eax, dword [esi + 4]
pop ecx
mov ecx, dword [esi]
sub eax, ecx
cdq
mov ebx, edi
idiv ebx
inc dword [ebp - 0x50]
add dword [ebp - 0x54], edi
cmp dword [ebp - 0x50], eax
jb 0x418e61
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403ff6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004951b2
call fcn.00523d1a
ret
Function at 0x419db8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5693b3
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xec], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
lea eax, [esp + 0xdc]
push eax
mov esi, ecx
call fcn.00486592
pop ecx
and dword [esp + 0x108], 0
lea ecx, [esp + 0xa4]
push esi
push ecx
mov ecx, eax
call fcn.0041028b
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe0]
mov byte [esp + 0x10c], 2
call fcn.00404145
lea eax, [esp + 0xa4]
call fcn.004954de
test al, al
je 0x419f19
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x419e65
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x419f19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.004036c8
mov esi, eax
push str.Cannot_delete_
push esi
mov byte [esp + 0x110], 3
call fcn.00405d7d
push esi
lea ecx, [esp + 0xb0]
call fcn.0041193b
add esp, 0xc
push 0x586c18
push esi
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.0041056c
lea eax, [esp + 0xc0]
push eax
mov eax, esi
call fcn.00403732
mov byte [esp + 0x108], 4
cmp dword [esp + 0xd4], 8
mov eax, dword [esp + 0xc0]
jae 0x419eee
lea eax, [esp + 0xc0]
push eax
push 2
pop ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xc4]
call fcn.00404145
lea eax, [esp + 0xc]
mov byte [esp + 0x108], 2
call fcn.00402669
push 1
xor edi, edi
lea esi, [esp + 0xa8]
call fcn.00404145
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret
Function at 0x41c96d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55c4dd
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x338], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x350]
mov dword fs:[0], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
lea edi, [esp + 0x154]
call fcn.00407c06
lea eax, [esp + 0x114]
push str.cmd.exe__c
xor ebx, ebx
push eax
lea edi, [esp + 0x22c]
mov dword [esp + 0x360], ebx
call fcn.004291af
push 0x44
pop esi
push esi
lea eax, [esp + 0x40]
push ebx
push eax
mov byte [esp + 0x36c], 1
call fcn.00517e90
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x14
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x128]
mov dword [esp + 0x38], esi
inc eax
lea esi, [esp + 0x18]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.004276c3
mov byte [esp + 0x358], 2
cmp dword [esp + 0x128], 8
mov ecx, dword [esp + 0x114]
mov eax, ecx
jae 0x41ca52
lea eax, [esp + 0x114]
cmp dword [esp + 0x128], 8
mov edx, dword [esp + 0x124]
lea eax, [eax + edx*2]
jae 0x41ca6d
lea ecx, [esp + 0x114]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push ecx
push dword [esp + 0x1c]
call fcn.00515390
mov eax, dword [esp + 0x1d8]
add esp, 0xc
cmp dword [esp + 0x1e0], 8
jae 0x41ca99
lea eax, [esp + 0x1cc]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x38]
push ecx
push eax
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [esp + 0x34]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
jne 0x41cb4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x7c]
push eax
call fcn.004036c8
mov edi, eax
push str.CreateProcess_failed_with
push edi
mov byte [esp + 0x360], 3
call fcn.00405d7d
pop ecx
pop ecx
push esi
push edi
call fcn.0041056c
lea eax, [esp + 0x130]
push eax
mov eax, edi
call fcn.00403732
mov byte [esp + 0x358], 4
cmp esi, ebx
jle 0x41cb17
and esi, 0xffff
or esi, 0x80070000
push 1
push 0x183
push str.srcAppManager.cpp
push esi
lea eax, [esp + 0x140]
push eax
lea eax, [esp + 0x2c8]
push eax
call fcn.0049844a
push 0x5c983c
lea eax, [esp + 0x2b8]
push eax
call fcn.0051ed55
push dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x24]
call esi
lea esi, [esp + 0x14]
call fcn.00426e9d
push 1
xor edi, edi
lea esi, [esp + 0x118]
call fcn.00404145
lea ebx, [esp + 0x14c]
call fcn.004075cc
mov ecx, dword [esp + 0x350]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x338]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret 8
Function at 0x41cc60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5726e0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
push ebx
lea esi, [esp + 0x2c]
mov edi, ecx
call fcn.00420896
xor esi, esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x30]
mov edx, edi
mov byte [esp + 0x80], 1
call fcn.00420332
mov eax, dword [esp + 0x20]
cmp eax, esi
jne 0x41cd01
push str.Cannot_choose_recommended_settings
lea esi, [esp + 0x50]
call fcn.0040338f
push 0x1a0
mov ecx, str.srcAppManager.cpp
mov eax, esi
mov byte [esp + 0x7c], 2
call fcn.004025fb
push dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
push eax
push eax
lea eax, [esp + 0x20]
call fcn.00426865
push eax
push ebx
mov ecx, edi
call fcn.0042255c
lea eax, [esp + 0x10]
call fcn.0041cc3a
push 1
xor edi, edi
lea esi, [esp + 0x34]
call fcn.00404145
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret 4
Function at 0x42b1a3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [esi]
call fcn.00515ffd
push dword [esi]
mov ebx, eax
push 1
push edi
push dword [ebp + 8]
call fcn.00516a9b
add esp, 0x14
cmp eax, 1
jne 0x42b1d4
lea eax, [ebx + edi]
cmp eax, dword [esi + 8]
jbe 0x42b1d0
mov dword [esi + 8], eax
mov al, 1
jmp 0x42b1d6
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x42b520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55c3de
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov esi, dword [ebx]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x20], eax
cmp esi, eax
jne 0x42b578
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
jmp 0x42b64b
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
call fcn.0042c3df
mov esi, dword [esp + 0x1c]
xor ecx, ecx
push ecx
mov dword [esp + 0x54], ecx
mov eax, dword [ebx + 0xc]
push ecx
push eax
push dword [esi + 0x40]
call fcn.005163a3
add esp, 0x10
test eax, eax
je 0x42b5d0
push str.Cannot_seek_to_data_position
lea esi, [esp + 0x28]
call fcn.0040338f
mov byte [esp + 0x50], 1
push 0x105
mov ecx, str.srcBlobStorage.cpp
mov eax, esi
call fcn.004025fb
push dword [esi + 0x40]
mov ebx, dword [ebx]
push 1
push ebx
mov ebx, dword [esp + 0x18]
push ebx
call fcn.00516927
add esp, 0x10
cmp eax, 1
je 0x42b60b
push str.Cannot_read_blob_data
lea esi, [esp + 0x28]
call fcn.0040338f
mov byte [esp + 0x50], 2
push 0x109
mov ecx, str.srcBlobStorage.cpp
mov eax, esi
jmp 0x42b5cb
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea eax, [esp + 0xc]
cmp edi, eax
je 0x42b642
mov esi, edi
call fcn.00426e9d
mov eax, dword [esp + 0x10]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea esi, [esp + 0xc]
call fcn.00426e9d
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret 4

Function at 0x42d368
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55f2a7
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
push 0x190
mov esi, ecx
push 0
push esi
call fcn.00517e90
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x42d41d
lea eax, [esp + 0xc]
push eax
call fcn.004036c8
mov esi, eax
and dword [esp + 0xd0], 0
push str.WSAStartup_failed_with
push esi
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.00404bb6
lea eax, [esp + 0xa4]
push eax
mov eax, esi
call fcn.00403732
push 0x1b
mov ecx, 0x58cacc
lea eax, [esp + 0xa8]
mov byte [esp + 0xd4], 1
call fcn.004025fb
mov eax, esi
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret
Function at 0x42d448
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56c99e
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
lea ebx, [esp + 0xac]
call fcn.00486a96
and dword [esp + 0x110], 0
lea eax, [esp + 0xc8]
push str..bak
push eax
call fcn.004100cb
pop ecx
pop ecx
push 8
mov byte [esp + 0x114], 1
mov eax, dword [esp + 0xcc]
pop esi
cmp dword [esp + 0xdc], esi
jae 0x42d4d2
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xc8]
cmp dword [esp + 0xdc], esi
jae 0x42d4f0
lea ecx, [esp + 0xc8]
mov eax, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x42d507
lea eax, [esp + 0xac]
push ecx
push eax
call fcn.005186ff
pop ecx
pop ecx
push 3
pop edi
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 4
call fcn.00487cf9
test al, al
je 0x42d52c
mov edi, dword [esp + 0x10]
push edi
call fcn.004929e4
pop ecx
push esi
call fcn.00515ac7
mov ebx, eax
pop ecx
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x42d576
mov byte [esp + 0x110], 3
and dword [ebx + 4], 0
mov dword [ebx], vtable.GFE::FileTraceHandler.0
mov edi, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x42d56d
lea edi, [esp + 0xac]
mov ecx, ebx
call fcn.00492d2e
jmp 0x42d578
xor ebx, ebx
push ebx
mov byte [esp + 0x114], 1
call fcn.00492ad6
pop ecx
lea eax, [esp + 0x14]
push eax
call fcn.004036c8
mov edi, eax
push str.Running
push edi
mov byte [esp + 0x118], 4
call fcn.00405d7d
push 0x58cb48
push edi
call fcn.00405f31
push str._version
push edi
call fcn.00405d7d
push 0x58cb6c
push edi
call fcn.00405f31
add esp, 0x20
lea eax, [esp + 0xe4]
push eax
mov eax, edi
call fcn.00403732
mov byte [esp + 0x110], 5
mov eax, dword [esp + 0xe4]
cmp dword [esp + 0xf8], esi
jae 0x42d5f8
lea eax, [esp + 0xe4]
push eax
push 3
pop ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe8]
call fcn.00404145
lea eax, [esp + 0x14]
mov byte [esp + 0x110], 1
call fcn.00402669
push 1
lea esi, [esp + 0xcc]
call fcn.00404145
push 1
lea esi, [esp + 0xb0]
call fcn.00404145
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret 4
Function at 0x42d668
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x454
mov eax, 0x5578bd
call fcn.00523c97
xor eax, eax
mov edi, 0x206
xor ebx, ebx
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov byte [ebp - 0x441], bl
call fcn.00517e90
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x42d6c9
push str.GetSystemDirectory_failed.
push 2
pop ecx
call fcn.00492b4d
pop ecx
xor al, al
jmp 0x42d8a4
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x44c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x42d6ee
push str.IsWow64Process_failed.
jmp 0x42d6b9
lea eax, [ebp - 0x21c]
push eax
lea esi, [ebp - 0x440]
call fcn.0040338f
push str._nvcoproc.bin
mov eax, esi
push eax
mov dword [ebp - 4], ebx
call fcn.0040d964
cmp dword [ebp - 0x44c], 1
jne 0x42d859
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00517e90
add esp, 0xc
push str.kernel32.dll
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x42d776
push str.PathCombine_failed.
push 2
pop ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x440]
call fcn.00404145
jmp 0x42d6c2
lea eax, [ebp - 0x424]
call fcn.004010fe
mov edi, eax
mov dword [ebp - 0x460], edi
mov byte [ebp - 4], 1
cmp edi, ebx
jne 0x42d798
push str.Failed_to_load_kernel32.dll.
jmp 0x42d759
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
call esi
mov dword [ebp - 0x450], eax
cmp eax, ebx
jne 0x42d7ca
push str.Wow64RevertWow64FsRedirection_not_supported.
push 2
pop ecx
call fcn.00492b4d
pop ecx
push edi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42d762
push str.Wow64DisableWow64FsRedirection
push edi
call esi
cmp eax, ebx
jne 0x42d7dd
push str.Wow64DisableWow64FsRedirection_not_supported.
jmp 0x42d7b5
lea ecx, [ebp - 0x448]
push ecx
mov dword [ebp - 0x448], ebx
call eax
cmp eax, 1
jne 0x42d84d
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0049515b
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x454]
call fcn.004954de
push dword [ebp - 0x448]
mov byte [ebp - 0x441], al
call dword [ebp - 0x450]
test eax, eax
jne 0x42d83e
push str.Enabling_back_Wow64_redirection_failed._Exiting.
xor ecx, ecx
call fcn.00492b4d
pop ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 1
call fcn.004951b2
push edi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42d88f
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0049515b
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x454]
call fcn.004954de
lea ecx, [ebp - 0x45c]
mov byte [ebp - 0x441], al
mov byte [ebp - 4], bl
call fcn.004951b2
push 1
xor edi, edi
lea esi, [ebp - 0x440]
call fcn.00404145
mov al, byte [ebp - 0x441]
call fcn.00523d1a
ret
Function at 0x43b558
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55bc31
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x174], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x14], 8
jb 0x43b5a3
mov eax, dword [edi]
jmp 0x43b5a5
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43b636
lea eax, [esp + 0xac]
push eax
call fcn.004036c8
mov esi, eax
and dword [esp + 0x190], 0
push str.Feedback_erased:
push esi
call fcn.00405d7d
push esi
mov ecx, edi
call fcn.0041193b
add esp, 0xc
lea eax, [esp + 0x164]
push eax
mov eax, esi
call fcn.00403732
mov byte [esp + 0x190], 1
cmp dword [esp + 0x178], 8
mov eax, dword [esp + 0x164]
jae 0x43b610
lea eax, [esp + 0x164]
push eax
push 3
pop ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x168]
call fcn.00404145
lea eax, [esp + 0xac]
jmp 0x43b6d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.004036c8
mov esi, eax
push str.Cannot_erase_file
push esi
mov dword [esp + 0x198], 2
call fcn.00405d7d
push esi
mov ecx, edi
call fcn.0041193b
add esp, 0xc
push 0x586990
push esi
call fcn.00405d7d
pop ecx
pop ecx
push dword [esp + 0x10]
push esi
call fcn.0041056c
lea eax, [esp + 0x148]
push eax
mov eax, esi
call fcn.00403732
mov byte [esp + 0x190], 3
cmp dword [esp + 0x15c], 8
mov eax, dword [esp + 0x148]
jae 0x43b6b3
lea eax, [esp + 0x148]
push eax
push 2
pop ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x14c]
call fcn.00404145
lea eax, [esp + 0x14]
or dword [esp + 0x190], 0xffffffff
call fcn.00402669
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.0051497f
mov esp, ebp
pop ebp
ret
Function at 0x4439ff
Capabilities:
Get geographical location

Disassembly:
push 4
mov eax, 0x55fb35
call fcn.00523c2e
mov edi, ecx
mov ebx, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push ebx
call fcn.00480dd9
xor esi, esi
mov dword [ebp - 4], esi
cmp edi, esi
setne byte [ebp - 0x10]
mov dword [ebx], vtable.GFESUGARClient.0
mov dword [ebx + 0xb4], esi
push 8
push dword [ebp - 0x10]
mov dword [ebx + 0xb8], edi
mov edi, str.srcGeoLocation.cpp
call fcn.004922e6
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xbc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0xc0], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0xc4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0xc8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0xcc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebx + 0xd0], eax
mov al, byte [ebp + 0x2c]
mov dword [ebx + 0xd4], esi
pop ecx
mov word [ebx + 0xd8], 1
mov byte [ebx + 0xda], 0
pop ecx
lea esi, [ebx + 0xe0]
mov byte [ebx + 0xdc], 0
mov byte [ebx + 0xdd], al
call fcn.00491be8
push 0x2b
push dword [ebp - 0x10]
mov edi, str.srcGFESugarClient.cpp
mov byte [ebp - 4], 1
call fcn.004922e6
xor esi, esi
cmp dword [ebp + 0xc], esi
push 0x2c
setne al
movzx eax, al
push eax
call fcn.004922e6
cmp dword [ebp + 0x18], esi
push 0x2d
setne al
movzx eax, al
push eax
call fcn.004922e6
cmp dword [ebp + 0x14], esi
push 0x2e
setne al
movzx eax, al
push eax
call fcn.004922e6
cmp dword [ebp + 0x10], esi
push 0x2f
setne al
movzx eax, al
push eax
call fcn.004922e6
add esp, 0x28
mov eax, ebx
call fcn.00523d06
ret 0x28
Function at 0x44e752
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x552356
call fcn.00523c97
mov ebx, ecx
cmp dword [ebx + 0x44], 0
mov dword [ebp - 0x34], ebx
je 0x44e842
cmp byte [ebx + 0x49], 0
je 0x44e842
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x44e78a
xor al, al
jmp 0x44e844
push 0
push 8
pop edi
lea esi, [ebp - 0x2c]
call fcn.0044e4fb
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x44e7e1
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
push eax
push edx
push dword [ebp - 0x38]
call dword [esi + 0x18]
xor edi, edi
sub eax, edi
je 0x44e7e6
dec eax
je 0x44e7ea
dec eax
dec eax
je 0x44e83e
xor bl, bl
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403ff6
mov al, bl
jmp 0x44e844
mov edx, dword [ebp - 0x2c]
jmp 0x44e7af
mov byte [ebx + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x44e7f6
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x44e81c
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x44e809
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.00516a9b
add esp, 0x10
cmp esi, eax
jne 0x44e7d0
cmp byte [ebx + 0x49], 0
je 0x44e83e
cmp esi, edi
jne 0x44e7a1
push edi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.00403e6d
mov ebx, dword [ebp - 0x34]
jmp 0x44e7a1
mov bl, 1
jmp 0x44e7d2
mov al, 1
call fcn.00523d1a
ret

Function at 0x44f429
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x10]
push ebx
push edi
xor edx, edx
push 0xa
mov eax, ecx
pop ebx
div ebx
xor edi, edi
mov dword [ebp - 4], 0x811c9dc5
inc eax
test ecx, ecx
je 0x44f46d
cmp dword [esi + 0x14], 0x10
jb 0x44f453
mov edx, dword [esi]
jmp 0x44f455
mov edx, esi
mov ebx, dword [ebp - 4]
movsx edx, byte [edx + edi]
imul ebx, ebx, 0x1000193
xor edx, ebx
add edi, eax
mov dword [ebp - 4], edx
cmp edi, ecx
jb 0x44f449
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x20]
mov eax, ecx
and eax, dword [ebp - 4]
pop edi
pop ebx
cmp dword [edx + 0x24], eax
ja 0x44f488
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
leave
ret 4