joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64710ef0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push edi
xor edi, edi
cmp dword [ebx + 4], edi
je 0x64710f06
xor eax, eax
inc eax
jmp 0x64710f92
push esi
push str.A6269ACC_B90F_4E5F_A1FA_FC31EE19E299
push edi
cmp dword [ebp + 8], edi
je 0x64710f1b
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x64710f26
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
test esi, esi
je 0x64710f5d
cmp esi, 0xffffffff
je 0x64710f5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x64710f4a
push str.quickLaunch__preJoinWarmUp__checkMutext__alreadyExist
call fcn.64721861
jmp 0x64710f83
xor edi, edi
mov dword [ebx + 4], esi
push str.quickLaunch__preJoinWarmUp__checkMutex_success
inc edi
call fcn.64721861
pop ecx
jmp 0x64710f8f
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
cmp dword [ebp + 8], esi
je 0x64710f78
push str.quickLaunch__preJoinWarmUp__checkMutext_create_failed__err_x
call fcn.6471ba48
pop ecx
jmp 0x64710f5a
push str.quickLaunch__preJoinWarmUp__checkMutext_open_failed__not_exist__err_x
call fcn.64721861
pop ecx
pop ecx
test esi, esi
je 0x64710f8f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x64715e5d
Capabilities:
Get file version info

Disassembly:
push 0x12c
mov eax, 0x64743968
call fcn.647264a8
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x12c], al
mov dword [ebp - 4], eax
push 0x103
push eax
mov byte [ebp - 0x114], al
lea eax, [ebp - 0x113]
push eax
call fcn.64725a70
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x64715f39
push edi
call fcn.64722f0e
mov esi, eax
pop ecx
test esi, esi
je 0x64715f39
and dword [ebp - 0x130], 0
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x130]
push eax
push 0x64745954
push esi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x130]
test ecx, ecx
je 0x64715f32
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._u__u__u__u
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.64704ee5
add esp, 0x1c
push esi
call fcn.647261f1
pop ecx
cmp byte [ebp - 0x114], 0
jne 0x64715f46
xor eax, eax
jmp 0x64715f53
lea eax, [ebp - 0x114]
push eax
call fcn.64725b00
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
call fcn.6470219f
xor ebx, ebx
cmp byte [ebp - 0x114], bl
setne bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x12c]
call fcn.647020ab
mov eax, ebx
call fcn.64726457
ret 4
Function at 0x64715ff4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x647439b1
mov eax, dword fs:[0]
push eax
mov eax, 0x288c
call fcn.64726940
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2884], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x288c], esi
call fcn.6472897d
push 0x27ff
mov dword [ebp - 0x2898], eax
mov edi, ebx
lea eax, [ebp - 0x280f]
mov byte [ebp - 0x2810], bl
push ebx
push eax
call fcn.64725a70
add esp, 0xc
lea ecx, [ebp - 0x2840]
push str.open__
call fcn.647011e6
mov dword [ebp - 4], ebx
push esi
push eax
lea eax, [ebp - 0x2828]
push eax
call fcn.647030d2
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2840]
push ebx
push 1
call fcn.647020ab
cmp dword [ebp - 0x2814], 0x10
lea eax, [ebp - 0x2828]
lea ecx, [ebp - 0x2880]
cmovae eax, dword [ebp - 0x2828]
push eax
push str.CWarmUpMgrImpl::DoWarmup_by_ReadAllFileData
call fcn.647109cd
mov byte [ebp - 4], 3
push ebx
push ebx
push 3
push ebx
push 7
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2880]
call fcn.64710b28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2828]
push ebx
push 1
call fcn.647020ab
test esi, esi
je 0x647161a2
cmp esi, 0xffffffff
je 0x647161a2
mov ecx, dword [ebp - 0x2884]
call fcn.64716816
mov ecx, dword [ebp - 0x2884]
call fcn.647165ed
test eax, eax
jne 0x647161a4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x2888], ebx
mov ecx, ebx
test edi, edi
je 0x6471619d
mov edx, 0x2800
cmp edi, edx
cmova eax, edx
mov dword [ebp - 0x2890], eax
add ecx, eax
mov dword [ebp - 0x2888], eax
mov dword [ebp - 0x2894], ecx
mov ecx, dword [ebp - 0x2884]
call fcn.64716816
mov ecx, dword [ebp - 0x2884]
call fcn.647165ed
test eax, eax
jne 0x6471619d
push ebx
lea eax, [ebp - 0x2888]
push eax
push dword [ebp - 0x2888]
lea eax, [ebp - 0x2810]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x2894]
mov eax, dword [ebp - 0x2890]
cmp ecx, edi
jb 0x64716149
xor ebx, ebx
inc ebx
jmp 0x647161a4
mov esi, ebx
test esi, esi
je 0x647161af
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x647161d5
call fcn.6472897d
sub eax, dword [ebp - 0x2898]
push edi
push dword [ebp - 0x288c]
push eax
push str.quickLaunch__warmup__costTime_d_file_s_size_d_success
call fcn.64721861
add esp, 0x10
jmp 0x647161ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x288c]
push str.quickLaunch__warmup__file_s_failed_err_d
call fcn.64713cdf
add esp, 0xc
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.647263d1
mov esp, ebp
pop ebp
ret 4
Function at 0x6471648c
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x3c], esi
je 0x6471649c
xor eax, eax
inc eax
jmp 0x647164cf
push str.E8D14C33_2869_4DFF_8D49_AFBC828DE737
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
jne 0x647164c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x647164cd
push eax
push str.quickLaunch__warmUp__acquireIO_failed_error_d
call fcn.6471ba48
pop ecx
pop ecx
jmp 0x647164cd
xor esi, esi
mov dword [edi + 0x3c], eax
inc esi
mov eax, esi
pop edi
pop esi
ret

Function at 0x647164d2
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 4], eax
cmp dword [eax + 0x40], esi
je 0x647164f0
cmp dword [eax + 0x44], esi
je 0x647164f0
xor eax, eax
inc eax
jmp 0x647165df
push ebx
push edi
push str.2DCF4CF1_5526_4088_9560_ED5AB9BEC4E6
push esi
push 0xf001f
mov edi, esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x64716538
push esi
push esi
push esi
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x6471658b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.quickLaunch__warmUp__init_shared_memory_failed_err_d
call fcn.6471ba48
pop ecx
pop ecx
jmp 0x647165d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x647165b8
push str.2DCF4CF1_5526_4088_9560_ED5AB9BEC4E6
push 0x408
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
push esi
mov ebx, eax
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x64716520
push 0x400
lea eax, [edi + 8]
mov dword [edi], 0x408
push esi
push eax
mov dword [edi + 4], esi
call fcn.64725a70
add esp, 0xc
test ebx, ebx
je 0x647165c5
mov eax, 0x408
cmp dword [edi], eax
jb 0x647165a6
mov eax, dword [ebp - 4]
xor esi, esi
inc esi
mov dword [eax + 0x44], edi
mov dword [eax + 0x40], ebx
jmp 0x647165db
push dword [edi]
push eax
push str.quickLaunch__warmUp__init_shared_memory_incompatible_expected_d_but_d
call fcn.6471ba48
add esp, 0xc
jmp 0x647165c5
push eax
push str.quickLaunch__warmUp__init_shared_memory_failed_err_d
call fcn.6471ba48
pop ecx
pop ecx
test edi, edi
je 0x647165d0
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
je 0x647165db
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x647165f1
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x1b8
mov eax, 0x64743a7c
call fcn.647264a8
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push 0x64748e50
push esi
push eax
call fcn.64703114
add esp, 0xc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x198]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x64716641
push eax
jmp 0x64716768
cmp byte [ebp - 0x16c], 0x2e
je 0x64716751
test byte [ebp - 0x198], 0x10
lea eax, [ebp - 0x16c]
push eax
push esi
je 0x64716721
lea eax, [ebp - 0x40]
push eax
call fcn.64703114
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x64716683
lea eax, [ebp - 0x40]
push eax
call fcn.647095f7
xor eax, eax
cmp dword [esi + 0x20], eax
je 0x64716718
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b0], 0xf
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 0x1c4], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c4]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.6470210b
mov eax, dword [esi + 0x18]
mov ecx, ebx
mov dword [ebp - 0x1ac], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x1a8], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x19c], eax
mov eax, dword [esi + 0x24]
inc eax
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.647165f1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
push 0
push 1
call fcn.647020ab
xor eax, eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x40]
push eax
jmp 0x6471674a
lea eax, [ebp - 0x58]
push eax
call fcn.64703114
add esp, 0xc
mov byte [ebp - 4], 5
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x64716741
lea eax, [ebp - 0x58]
push eax
call fcn.647095f7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0
push 1
call fcn.647020ab
lea eax, [ebp - 0x198]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x64716641
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.647020ab
call fcn.64726457
ret 4

Function at 0x64716eaa
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
je 0x64716b57
push str.quickLaunch__warmUp__failed_to_start__already_running
call fcn.64721861
pop ecx
xor eax, eax
jmp 0x64716b9c
push edi
xor edi, edi
inc edi
call fcn.6471648c
mov ecx, esi
call fcn.647164d2
lea eax, [esi + 0x34]
mov dword [esi + 0x4c], ebx
push eax
push ebx
push esi
push 0x64716c66
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x64716b99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.quickLaunch__warmUp__failed_to_create_thread_err_d
call fcn.6471ba48
pop ecx
pop ecx
mov edi, ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ecx]
test ecx, ecx
jne 0x64716b3d
xor eax, eax
ret
Function at 0x64716ec4
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0xf0000000
xor edi, edi
lea eax, [ebp - 8]
push 0x18
push edi
push edi
push eax
mov dword [ebp - 8], edi
mov esi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x64716f06
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CalHashOfData::CryptAcquireContext_fail_err__d_
call fcn.6471ba48
pop ecx
pop ecx
xor eax, eax
jmp 0x64716f8c
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 0x18]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x64716f64
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x64716f56
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov esi, eax
test esi, esi
jne 0x64716f77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CalHashOfData::CryptGetHashParam_fail__err__d_
jmp 0x64716f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CalHashOfData::CryptHashData_fail__err__d_
jmp 0x64716f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CalHashOfData::CryptCreateHash_fail_err__d_
call fcn.6471ba48
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64717ced
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x310], 0
jne 0x64717dd8
push edi
push str.GpcUnpackVersion
call fcn.6471bcd0
mov edi, eax
test edi, edi
jne 0x64717d55
push 0x45c
push 0x64749b84
push str.lpszVersion
lea eax, [ebp - 0x508]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.647180d0
lea eax, [ebp - 0x108]
push eax
push str.DecompressPath:_s
call fcn.64721861
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.647191f7
pop edi
test eax, eax
je 0x64717dd5
push 1
mov ecx, esi
call fcn.647192bb
push 0x400
lea eax, [ebp - 0x508]
mov ecx, esi
push eax
call fcn.64718211
lea eax, [ebp - 0x508]
push eax
push str.DecompressUrl:_s
call fcn.64721861
pop ecx
pop ecx
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x508]
push eax
push esi
push 0x64718be1
call fcn.6471bb29
jmp 0x64717ddd
mov ecx, dword [esi + 4]
call fcn.6471c53b
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.647263d1
mov esp, ebp
pop ebp
ret
Function at 0x64717dec
Capabilities:
Print debug messages

Disassembly:
push 0x548
mov eax, 0x64743daf
call fcn.647264a8
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x554]
push ebx
push str.CATGpcExtMgr::CheckExtension
call fcn.647109cd
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x310], ebx
jne 0x64717ed7
push str.GpcExtVersion
call fcn.6471bcd0
mov edi, eax
test edi, edi
jne 0x64717e63
push 0x48d
push 0x64749b84
push str.lpszExtVersion
lea eax, [ebp - 0x514]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], bl
push ebx
push eax
call fcn.64725a70
add esp, 0xc
lea eax, [ebp - 0x114]
mov ecx, esi
push 0x104
push eax
call fcn.647188b2
push edi
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.647191f7
mov ecx, esi
test eax, eax
je 0x64717ed9
push 1
call fcn.647192bb
push 0x400
lea eax, [ebp - 0x514]
mov ecx, esi
push eax
call fcn.647189d8
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x514]
push eax
push esi
push 0x64718d46
call fcn.6471bb29
jmp 0x64717ede
mov ecx, esi
call fcn.647191b7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x554]
call fcn.64710b28
call fcn.64726457
ret

Function at 0x64717ef3
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x24c
mov eax, 0x64743cf5
call fcn.647264a8
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x258]
push ebx
push str.CATGpcExtMgr::CheckRootDir
call fcn.647109cd
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x64718016
mov ecx, esi
call fcn.64718f33
test eax, eax
je 0x64718000
mov edi, 0x103
mov byte [ebp - 0x114], bl
push edi
lea eax, [ebp - 0x113]
push ebx
push eax
call fcn.64725a70
add esp, 0xc
lea eax, [ebp - 0x114]
mov ecx, esi
push 0x104
push eax
call fcn.6471841a
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x64717f77
push 0x64747ee0
push str._UpdateUser
call fcn.6471d2e3
call fcn.64702df6
test eax, eax
je 0x64717f9e
lea eax, [ebp - 0x114]
push eax
call fcn.64702bb8
pop ecx
test eax, eax
jne 0x64718016
mov dword [esi + 8], 1
jmp 0x64718016
push edi
lea eax, [ebp - 0x217]
mov byte [ebp - 0x218], bl
push ebx
push eax
call fcn.64725a70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x64749ed4
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x64717f95
lea eax, [ebp - 0x218]
push 0x64749ed8
push eax
call fcn.6472917a
pop ecx
pop ecx
test eax, eax
je 0x64717f95
push eax
call fcn.64727b9f
pop ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x64718016
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x64718016
push 0x64749ea8
push str._UpdateUser
call fcn.6471d2e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.64710b28
call fcn.64726457
ret

Function at 0x6471805a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.6471841a
Function at 0x647180d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
jne 0x6471811f
push 0x28f
push 0x64749b84
push str.lpszPath
lea eax, [ebp - 0x484]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x7f
lea eax, [ebp - 0x83]
mov byte [ebp - 0x84], 0
push 0
push eax
call fcn.64725a70
add esp, 0xc
test edi, edi
je 0x647181ff
push esi
mov esi, 0x80
mov ecx, ebx
push esi
push edi
call fcn.6471805a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
jl 0x647181fe
push edi
call fcn.64725b00
pop ecx
cmp byte [eax + edi - 1], 0x5c
jne 0x64718185
push edi
call fcn.64725b00
pop ecx
movzx eax, byte [eax + edi - 2]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x64718198
push 0x104
push 0x64745954
push edi
call fcn.64722c82
add esp, 0xc
push esi
lea eax, [ebp - 0x84]
mov ecx, ebx
push eax
call fcn.64718063
push edi
call fcn.64725b00
mov esi, eax
lea eax, [ebp - 0x84]
push eax
call fcn.64725b00
add esi, eax
mov eax, 0x104
pop ecx
pop ecx
cmp esi, eax
jb 0x647181ed
push str.GpcUnpackPath
push 0x6e
call fcn.647191c5
pop ecx
mov ecx, dword [ebx + 4]
push eax
call fcn.6471d8eb
mov eax, dword [ebx + 4]
mov dword [eax + 0x330], 1
jmp 0x647181fe
push eax
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.64722c82
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret 8
Function at 0x64718211
Capabilities:
Print debug messages

Disassembly:
push 0x518
mov eax, 0x64743d33
call fcn.647264a8
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x6471825f
push 0x2af
push 0x64749b84
push str.lpszUrl
lea eax, [ebp - 0x450]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x64718412
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x46c]
mov ecx, dword [ebx + 4]
push eax
push edi
push esi
push str.GpcUrlRoot
mov dword [ebp - 0x46c], 0x3b6
call fcn.6471bc5a
test eax, eax
je 0x64718412
push esi
call fcn.64725b00
pop ecx
cmp byte [eax + esi - 1], 0x2f
je 0x647182b6
push edi
push 0x64749d34
push esi
call fcn.64722c82
mov ecx, dword [ebp - 0x46c]
add esp, 0xc
inc ecx
mov dword [ebp - 0x46c], ecx
jmp 0x647182bc
mov ecx, dword [ebp - 0x46c]
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0x40
push eax
mov eax, edi
sub eax, ecx
push eax
lea eax, [esi + ecx]
mov ecx, dword [ebx + 4]
push eax
push str.GpcUnpackName
call fcn.6471bc5a
test eax, eax
jne 0x647182f6
push edi
push str.atgpcdec
push esi
call fcn.64722c82
add esp, 0xc
mov ecx, dword [ebx + 4]
push str.GpcCompressMethod
call fcn.6471bcd0
mov ecx, dword [ebx + 4]
push str.GpcUnpackVersion
mov dword [ebp - 0x474], eax
call fcn.6471bcd0
mov ebx, eax
test ebx, ebx
je 0x64718341
push ebx
call fcn.64725b00
pop ecx
cmp eax, 0x40
jae 0x64718341
push str.2__6__0__0
push ebx
call fcn.647277ec
pop ecx
pop ecx
push edi
test eax, eax
js 0x64718342
push 0x64749d60
jmp 0x64718347
push edi
push str..apk
push esi
call fcn.64722c82
add esp, 0xc
mov byte [ebp - 0x50], 0
lea eax, [ebp - 0x4f]
push 0x3f
push 0
push eax
call fcn.64725a70
push edi
push str._random
push esi
call fcn.64722c82
add esp, 0x18
lea ecx, [ebp - 0x524]
push 1
push 3
call fcn.64717969
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x514]
call fcn.64717b62
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x524]
call fcn.6471a5e5
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x647183b3
mov eax, dword [eax]
push 0x40
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.64722cdb
add esp, 0xc
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x468]
call fcn.647020ab
push edi
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.64722c82
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.6470d196
lea ecx, [ebp - 0x4bc]
call fcn.6470d016
push esi
push ebx
push dword [ebp - 0x474]
push str.GpcCompressMethod__s__lpUnPackVer__s__GetDecompressUrl____s_
call fcn.64721861
add esp, 0x10
call fcn.64726457
ret 8
Function at 0x647188b2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
jne 0x64718906
push 0x214
push 0x64749b84
push str.lpszPath
lea eax, [ebp - 0x484]
push str.ASSERT__s_failed_at_file__s__line__d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x647189c6
push esi
push 0x7f
lea eax, [ebp - 0x83]
mov byte [ebp - 0x84], 0
push 0
push eax
call fcn.64725a70
add esp, 0xc
mov esi, 0x80
mov ecx, ebx
push esi
push edi
call fcn.6471841a
push edi
call fcn.64725b00
pop ecx
cmp byte [eax + edi - 1], 0x5c
jne 0x64718954
push edi
call fcn.64725b00
pop ecx
movzx eax, byte [eax + edi - 2]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x64718965
push dword [ebp + 0xc]
push 0x64745954
push edi
call fcn.64722c82
add esp, 0xc
push esi
lea eax, [ebp - 0x84]
mov ecx, ebx
push eax
call fcn.64718845
push edi
call fcn.64725b00
mov esi, eax
lea eax, [ebp - 0x84]
push eax
call fcn.64725b00
pop ecx
add esi, eax
pop ecx
cmp esi, 0x104
pop esi
jb 0x647189b3
mov ecx, dword [ebx + 4]
push str.GpcExtensionPath
push 0x6e
call fcn.6471d7b2
mov eax, dword [ebx + 4]
mov dword [eax + 0x330], 1
jmp 0x647189c6
push dword [ebp + 0xc]
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.64722c82
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret 8