joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dc60
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f18d5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov edi, dword [ebx + 8]
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49dcc2
mov eax, 1
jmp 0x49de47
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [esi + 0x1290]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov dword [ebp - 0x60], eax
mov ecx, eax
movq qword [ebp - 0x20], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SR_settings.uvksr
push 0
call fcn.0057bb00
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc520
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
movlpd qword [ebp - 0x54], xmm0
call fcn.005dc3e0
mov esi, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0
push 0
push 0
push eax
push 0
push 0
push 0x104
mov byte [ebp - 4], 2
call fcn.005db9a0
push eax
call dword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
test eax, eax
jne 0x49dd76
push dword [ebp - 0x58]
xor esi, esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
call fcn.005dc1c0
push ecx
mov ecx, dword [ebp - 0x5c]
call fcn.0043e540
push eax
push str.uvksr
push 1
lea ecx, [ebp - 0x20]
call fcn.005dbf40
mov ecx, eax
call fcn.005dc190
mov ecx, dword [ebp - 0x60]
push eax
push 0x808
push str.System_repair_files__.uvksr_
push 0
call fcn.0057bb00
push eax
mov edx, str.Export_System_repair_settings
lea ecx, [ebp - 0x2c]
call fcn.005e1da0
test al, al
jne 0x49ddc2
or edi, 0xffffffff
jmp 0x49de28
xorps xmm0, xmm0
lea ecx, [ebp - 0x2c]
push 0
push 0x2a
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x4c]
call fcn.005e4770
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.005e4670
test eax, eax
jne 0x49ddf6
xor edi, edi
jmp 0x49de0d
push 1
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc260
mov edi, 1
lea ecx, [ebp - 0x44]
call fcn.005d9280
mov eax, dword [ebp - 0x4c]
cmp eax, 0xffffffff
je 0x49de28
test eax, eax
je 0x49de28
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x49de35
push esi
call fcn.0041e1c3
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0x2c]
call fcn.005dc430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x4afe86
Capabilities:
Check if file exists

Disassembly:
ret
Function at 0x4b53a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x4b53fb
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4b53ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b53fb
mov edx, dword [esi + 4]
mov ecx, edx
call fcn.005d8c40
test eax, eax
je 0x4b53f0
mov ecx, dword [esi + 8]
call fcn.005d8c40
test eax, eax
je 0x4b53fb
push dword [esi + 0xc]
push ecx
push edx
mov ecx, edi
call fcn.004b4fc0
mov eax, 1
pop edi
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x4cab70
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f366b
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xffffffffffffffba
push 1
push str.Cancel
sub esp, 8
mov ecx, ebx
push 0x46
push 0x1c2
push 0
push str.Creating_the_uninstall_list...
call fcn.0043da60
mov ecx, eax
call fcn.005b64a0
mov ecx, eax
call fcn.005b66e0
push 1
mov ecx, ebx
call fcn.0043d8e0
push 0
push 1
mov ecx, ebx
call fcn.0043d720
push 0
push 0
push edi
push 0x4bbd00
push 0
push 0
mov byte [edi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x14], esi
xor edx, edx
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.005cca30
test al, al
je 0x4cac56
nop dword [eax]
push 0
push 0
mov ecx, ebx
call fcn.0043d720
test eax, eax
je 0x4cac49
cmp byte [edi + 0xc], 0
jne 0x4cac49
mov byte [edi + 0xc], 1
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x4cac30
push 2
lea ecx, [ebx + 0x14f0]
call fcn.005b6250
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.004357a0
test al, al
je 0x4cacc9
push 0xffffffffffffffff
push ecx
mov ecx, ebx
call fcn.00435850
add esp, 4
or eax, 0x20
mov edx, 8
push eax
push ecx
push dword [ebx + 0x1f78]
mov ecx, dword [edi + 4]
push 2
call fcn.005a9990
mov ebx, eax
cmp esi, 0xffffffff
je 0x4cacbd
test esi, esi
je 0x4cacbd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov esi, ebx
mov eax, 0xffffffff
cmove esi, eax
cmp byte [edi + 0xc], 0
sete bl
cmp esi, 0xffffffff
je 0x4cace0
test esi, esi
je 0x4cace0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x4d1c40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3e40
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x48], ebx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], edi
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
call fcn.005dc5e0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movq qword [ebp - 0x30], xmm0
mov ecx, str.SOFTWAREClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
movsd xmm0, qword [0x6edab8]
mov eax, str.SOFTWAREMicrosoftWindowsShellNoRoamMUICache
comisd xmm0, xmmword [ebx + 8]
push 1
mov dword [ebp - 0x28], 0
cmovbe eax, ecx
lea ecx, [ebp - 0x30]
push eax
call fcn.005dc570
sub esp, 0xc
mov byte [ebp - 4], 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
lea ecx, [ebx + 0x1290]
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x30]
call fcn.005da510
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6aa0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
movq qword [ebp - 0x40], xmm0
call fcn.005d6ac0
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
push 8
push 0xffffffffffffffff
push str.._FriendlyAppNameApplicationCompany__
call fcn.00418af0
mov esi, eax
mov dword [ebp - 0x44], esi
add esp, 0x14
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30]
lea ebx, [edi + 0xc]
push 0x20019
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d6a30
test al, al
je 0x4d1e34
xor edi, edi
cmp byte [ebx], 0
jne 0x4d1e30
nop
lea eax, [ebp - 0x40]
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.005d62e0
test al, al
je 0x4d1e34
push 1
push dword [ebp - 0x40]
lea ecx, [ebp - 0x24]
call fcn.005dc260
lea ecx, [ebp - 0x24]
call fcn.005dc3a0
cmp eax, 2
jl 0x4d1e26
push 1
lea ecx, [ebp - 0x24]
call fcn.005dc440
cmp word [eax], 0x3a
jne 0x4d1e26
mov eax, dword [ebp - 0x48]
movsd xmm0, qword [eax + 8]
comisd xmm0, xmmword [0x6edac0]
jbe 0x4d1dd5
push 0
push 0x62439c
push esi
lea ecx, [ebp - 0x24]
call fcn.005d9500
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d1e26
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.____File_not_found
push dword [ebp - 0x40]
lea ecx, [ebp - 0x30]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005dc200
push 1
push 8
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov ecx, dword [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
call fcn.004ceb00
inc edi
cmp byte [ebx], 0
je 0x4d1d70
xor bl, bl
jmp 0x4d1e3a
cmp byte [ebx], 0
sete bl
test esi, esi
je 0x4d1e47
push esi
call fcn.00418a90
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.005d6ab0
lea ecx, [ebp - 0x18]
call fcn.005d69e0
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x4d2680
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f3f31
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov bl, byte [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], esi
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
mov ecx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionFonts
mov byte [ebp - 4], 1
test bl, bl
mov dword [ebp - 0x24], 0
mov eax, str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionFonts
xorps xmm0, xmm0
cmove eax, ecx
movq qword [ebp - 0x2c], xmm0
push 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc570
push 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push 0x20019
mov dword [ebp - 0x14], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x14]
call fcn.005d6a80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
movq qword [ebp - 0x44], xmm0
call fcn.005d6ac0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
lea edi, [esi + 0xc]
call fcn.005d6a00
test eax, eax
je 0x4d283b
xor esi, esi
cmp byte [edi], 0
jne 0x4d2837
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop
lea eax, [ebp - 0x44]
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.005d62e0
test al, al
je 0x4d283b
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x14]
call fcn.005d6740
test al, al
je 0x4d282d
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call ebx
test eax, eax
jne 0x4d282d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x38]
push str.Fonts_
push dword [eax + 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
call ebx
test eax, eax
jne 0x4d282d
sub esp, 0xc
lea ecx, [ebp - 0x2c]
push eax
push eax
push eax
push eax
push eax
push 0x68fb68
push dword [ebp - 0x44]
push 0x62bd28
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005da510
push 1
push 6
lea ecx, [ebp - 0x20]
call fcn.005dc190
mov ecx, dword [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
call fcn.004ceb00
inc esi
cmp byte [edi], 0
je 0x4d2780
xor bl, bl
jmp 0x4d2841
cmp byte [edi], 0
sete bl
lea ecx, [ebp - 0x44]
call fcn.005d6ab0
lea ecx, [ebp - 0x14]
call fcn.005d69e0
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
Function at 0x4e5470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4d12
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
sub esp, 8
push 0x50
push 0x1c2
push 0
push str.Retrieving_system_info__please_wait...
call fcn.0043da60
lea eax, [ebx + 0x14f0]
push 1
push str.Cancel
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.005b64a0
push 1
mov ecx, ebx
call fcn.0043d8e0
mov esi, dword [edi + 4]
push 0
push 0
push 0xb
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x10a0
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push edi
push 0x4bc780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
xor edx, edx
mov ecx, esi
mov dword [ebp - 0x14], 0
call fcn.005cca30
test al, al
je 0x4e556e
push 0
push 0
mov ecx, ebx
call fcn.0043d720
test eax, eax
je 0x4e5561
cmp dword [edi + 4], 0
je 0x4e5561
mov dword [edi + 4], 0
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x4e5545
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x109d
push edi
call ebx
push 0
push 1
push 0xb
push edi
call ebx
mov ecx, dword [ebp - 0x20]
push 2
call fcn.005b6250
mov edi, dword [ebp - 0x14]
cmp esi, 0xffffffff
je 0x4e55b4
test esi, esi
je 0x4e55b4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x4e6420
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4e0c
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ecx + 0x14e4]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x4e6556
cmp edi, 1
jl 0x4e6556
push edi
mov ecx, ebx
call fcn.005c5730
push 0
push 0
push 0x1004
push eax
mov dword [ebp - 0x64], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0
test eax, eax
je 0x4e6556
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
push 0x38
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x58]
push esi
call fcn.005dd680
xor esi, esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x60], esi
jbe 0x4e652d
push 0
push esi
push edi
mov ecx, ebx
call fcn.005bb510
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc1c0
push 0xf000
push esi
push 0x102c
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
lea ecx, [ebp - 0x20]
and eax, 1
push eax
call fcn.005dc190
push eax
push str.UVK_Tweaks
lea ecx, [ebp - 0x58]
call fcn.005dd090
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc esi
neg eax
add dword [ebp - 0x5c], eax
cmp esi, dword [ebp - 0x60]
jb 0x4e64d7
push ecx
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.005dca80
xor esi, esi
lea ecx, [ebp - 0x58]
test al, al
cmovne esi, dword [ebp - 0x5c]
call fcn.005dd5d0
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov eax, esi
jmp 0x4e6558
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x501734
Capabilities:
Check if file exists
Create thread

Disassembly:
ret
Function at 0x503cd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5c4e
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
sub esp, 8
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
lea ecx, [edi + 0x143c]
movq qword [ebp - 0x1c], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005dc190
push eax
push str.DeviceRescue__
lea ecx, [ebp - 0x1c]
call fcn.005dc520
push 0x270
lea eax, [ebp - 0x290]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00420090
add esp, 8
lea ecx, [ebp - 0x1c]
push 0
push 0xffffffffffffffff
push 0xcf0000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x226
push 0x2ee
call fcn.005dc190
push eax
push str.UVK_Ultra_GUI
push 0
lea ecx, [ebp - 0x290]
call fcn.005c6220
mov byte [ebp - 4], 1
test byte [edi + 0x13dc], 2
je 0x503dc5
lea ecx, [edi + 0x146c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x503dc5
push ecx
lea ecx, [edi + 0x146c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x290]
call fcn.005c4180
push 0xa00
call fcn.0041e3d6
mov esi, eax
add esp, 4
mov dword [ebp - 0x294], esi
push 0xa00
push 0
push esi
mov byte [ebp - 4], 2
call fcn.00420090
add esp, 0xc
mov ecx, esi
call fcn.00586560
push 2
mov esi, eax
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x290]
mov ecx, esi
push eax
push dword [edi + 4]
call fcn.00582640
mov ebx, eax
test esi, esi
je 0x503e2b
mov ecx, esi
call fcn.00586440
push 0xa00
push esi
call fcn.0041e7c1
add esp, 8
push 0
push 0
push 0
push str.DeviceRescue_was_successfully_launched_in_a_separate_thread.
mov ecx, edi
call fcn.0045a700
lea ecx, [ebp - 0x290]
call fcn.005c1c60
lea ecx, [ebp - 0x1c]
call fcn.005dc430
xor eax, eax
test ebx, ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x50b410
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x50b428
pop esi
pop ebp
ret 0x20
mov ecx, dword [esi + 0x40]
push ebx
push edi
mov edi, dword [esi + 0x3c]
inc edi
lea eax, [ecx - 1]
mov dword [esi + 0x3c], edi
cmp edi, eax
jb 0x50b440
add ecx, ecx
mov dword [esi + 0x40], ecx
push ecx
lea ebx, [edi + 1]
mov ecx, esi
push ebx
call fcn.004042f0
cmp dword [eax], edi
ja 0x50b452
mov dword [eax], ebx
mov eax, dword [eax + 8]
lea ecx, [edi + edi*2]
push dword [ebp + 8]
lea ecx, [eax + ecx*4]
call fcn.005dc510
mov ebx, dword [esi + 0x3c]
lea ecx, [esi + 0xc]
push dword [esi + 0x40]
lea edi, [ebx + 1]
push edi
call fcn.004042f0
cmp dword [eax], ebx
ja 0x50b47b
mov dword [eax], edi
mov eax, dword [eax + 8]
lea ecx, [ebx + ebx*2]
push dword [ebp + 0xc]
lea ecx, [eax + ecx*4]
call fcn.005dc510
mov ebx, dword [esi + 0x3c]
lea ecx, [esi + 0x18]
push dword [esi + 0x40]
lea edi, [ebx + 1]
push edi
call fcn.004042f0
cmp dword [eax], ebx
ja 0x50b4a4
mov dword [eax], edi
mov eax, dword [eax + 8]
lea ecx, [ebx + ebx*2]
push dword [ebp + 0x10]
lea ecx, [eax + ecx*4]
call fcn.005dc510
mov ebx, dword [esi + 0x3c]
lea ecx, [esi + 0x30]
push dword [esi + 0x40]
lea edi, [ebx + 1]
push edi
call fcn.004036b0
cmp dword [eax], ebx
ja 0x50b4cd
mov dword [eax], edi
mov eax, dword [eax + 8]
lea ecx, [esi + 0x24]
mov dword [eax + ebx*4], 0
mov edi, dword [esi + 0x3c]
push dword [esi + 0x40]
lea ebx, [edi + 1]
push ebx
call fcn.004042f0
cmp dword [eax], edi
ja 0x50b4ef
mov dword [eax], ebx
mov eax, dword [eax + 8]
lea ecx, [edi + edi*2]
push 0
lea ecx, [eax + ecx*4]
call fcn.005dc510
mov eax, dword [esi + 0x3c]
pop edi
pop ebx
pop esi
pop ebp
ret 0x20

Function at 0x50b510
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6305
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70f200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x40], 0x64
call fcn.0050b370
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50b5e0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c90]
cmp ecx, 0xffffffff
je 0x50b603
test ecx, ecx
je 0x50b603
xor edx, edx
call fcn.005cca30
test al, al
je 0x50b603
mov al, 3
pop esi
ret 8
push edi
push 0
push 0
push esi
push 0x513260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [esi + 0x1c90]
cmp eax, 0xffffffff
je 0x50b630
test eax, eax
je 0x50b630
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c90], edi
test edi, edi
jne 0x50b64b
mov dword [esi + 0x1c90], 0xffffffff
pop edi
xor al, al
pop esi
ret 8
cmp edi, 0xffffffff
je 0x50b644
pop edi
mov al, 1
pop esi
ret 8
Function at 0x50bcd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
cmp eax, 1
jge 0x50bd1b
mov esi, 0xa0
nop dword [eax + eax]
mov eax, dword [ebx + 8]
mov eax, dword [esi + eax]
cmp eax, 1
jl 0x50bd05
push eax
mov ecx, ebx
call fcn.0050bcd0
add edi, eax
add esi, 4
cmp esi, 0xbc
jl 0x50bcf0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 4]
push eax
call fcn.005c5730
push 0
push 0
push 0x1004
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x50bd45
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [eax - 1]
test esi, esi
js 0x50bd7e
nop dword [eax]
push 0xf000
push esi
push 0x102c
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
je 0x50bd79
push esi
push dword [ebp + 8]
mov ecx, ebx
call fcn.0050b770
add edi, eax
sub esi, 1
jns 0x50bd50
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4