joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e50
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407d5c
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x101
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x403021
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.00404cc0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x270]
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
push str.runneradmin
movq qword [ebp - 0x224], xmm0
call fcn.00404cc0
push str.Lain
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 1
call fcn.00404cc0
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp - 0x240]
push eax
push ecx
lea ecx, [ebp - 0x224]
call fcn.00404400
push 0x404c60
push 2
push 0x18
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 4
push eax
call fcn.004066cc
mov edi, dword [ebp - 0x224]
mov ebx, dword [ebp - 0x240]
cmp edi, dword [ebp - 0x220]
je 0x402fda
cmp dword [edi + 0x14], 7
mov eax, edi
jbe 0x402f4f
mov eax, dword [edi]
cmp dword [ebp - 0x22c], 7
lea esi, [ebp - 0x240]
mov ecx, dword [ebp - 0x230]
cmova esi, ebx
cmp ecx, dword [edi + 0x10]
jne 0x402fcb
mov edx, ecx
test edx, edx
je 0x402f83
sub esi, eax
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x402fcb
add eax, 2
sub edx, 1
jne 0x402f72
lea ecx, [ebp - 0x224]
call fcn.00405460
mov eax, dword [ebp - 0x22c]
cmp eax, 7
jbe 0x402fc4
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x402fba
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403011
push ecx
push ebx
call fcn.004067e1
add esp, 8
mov eax, 1
jmp 0x403023
add edi, 0x18
cmp edi, dword [ebp - 0x220]
jne 0x402f45
lea ecx, [ebp - 0x224]
call fcn.00405460
mov eax, dword [ebp - 0x22c]
cmp eax, 7
jbe 0x403021
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x403017
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403017
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebx
call fcn.004067e1
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret
Function at 0x403c70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x403c9c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x403cc4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x403cca
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x403d54
jg 0x403ce1
test esi, esi
je 0x403d54
test ecx, ecx
jl 0x403d37
jg 0x403ceb
test eax, eax
je 0x403d37
cmp edi, ecx
jg 0x403cff
jl 0x403cf5
cmp esi, eax
jae 0x403cff
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x403d54
jg 0x403d3a
test esi, esi
je 0x403d54
jmp 0x403d3a
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x403d54
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403d70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x403d9c
jl 0x403d90
test ecx, ecx
jne 0x403d9c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x403db5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x403e03
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x403e09
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x403e09
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x403e76
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x403e32
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x403e64
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403e76
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x403e40
test edi, edi
je 0x403e76
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4041f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x404220
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40425c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40425c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x404333
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x404284
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404290
movsx eax, bl
jmp 0x4042c8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4042f2
sub eax, 1
je 0x4042f2
sub eax, 2
jne 0x404333
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404310
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x404333
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040668e
mov esp, ebp
pop ebp
ret 4
Function at 0x4051c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40527c
cmp byte [esi + 0x3d], 0
je 0x40527c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40526a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x405231
sub eax, 1
je 0x405235
sub eax, 2
jne 0x40526a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405253
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40526a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040668e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040668e
mov esp, ebp
pop ebp
ret
Function at 0x40708a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4070c9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4070c9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4070c9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4070c9
cmp dword [ecx + 0x74], 0xe
jbe 0x4070c9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402d78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [0x4063a4]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x402da3
xor eax, eax
inc eax
jmp 0x402e8d
push esi
push edi
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x30c
lea eax, [ebp - 0x41c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x110]
push ecx
push 0x406600
lea eax, [ebp + eax - 0x41c]
push str.__service__sid___s___wd___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, 0xf01ff
push edi
mov esi, 0x406500
push esi
push dword [ebp - 0xc]
call dword [0x4063a8]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x402e42
push ebx
push ebx
push 0x405610
push ebx
push ebx
lea eax, [ebp - 0x41c]
push eax
push 1
push 3
push 0x10
push edi
push 0x4063e0
push esi
push dword [ebp - 0xc]
call dword [0x4063ac]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x402e7f
push ebx
push ebx
push dword [ebp - 8]
call dword [0x4063b0]
test eax, eax
jne 0x402e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x402e6f
xor ecx, ecx
cmp eax, 0x420
setne cl
lea ecx, [ecx + ecx + 2]
mov dword [ebp - 4], ecx
jmp 0x402e76
mov dword [ebp - 4], 3
push dword [ebp - 8]
call dword [0x4063b8]
push dword [ebp - 0xc]
call dword [0x4063b8]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402fd6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00404000
cmp dword [ebp + 8], 0x1c
push ebx
push edi
lea edi, [esi + 0x10]
jb 0x4030bd
cmp dword [esi], 0x80000001
jne 0x4030bd
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jbe 0x4030b1
mov eax, dword [edi]
mov edx, dword [ebp + 8]
mov ecx, eax
jmp 0x40301c
cmp byte [ecx + esi], 0
je 0x403023
inc ecx
cmp edx, ecx
mov dword [ebp - 8], ecx
ja 0x403015
mov ebx, dword [edi + 4]
add ebx, dword [edi + 8]
cmp edx, ebx
jb 0x4030bd
cmp edx, ecx
je 0x4030bd
add eax, esi
push eax
lea eax, [ebp - 0x1008]
push eax
mov byte [ebp - 0x1008], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4030bd
push 0
lea eax, [ebp - 8]
push eax
push dword [edi + 8]
mov eax, dword [edi + 4]
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4030b6
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 8]
jne 0x4030b6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 0xc
cmp eax, dword [esi + 4]
jb 0x40300c
xor eax, eax
inc eax
jmp 0x4030c7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x4033ea
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403410
cmp al, 0x22
je 0x403420
inc esi
mov al, byte [esi]
test al, al
jne 0x4033ff
cmp al, 0x22
jne 0x403421
jmp 0x403420
cmp al, 0x20
jle 0x403421
inc esi
cmp byte [esi], 0x20
jg 0x403414
jmp 0x403421
cmp al, 0x20
jg 0x403427
inc esi
mov al, byte [esi]
test al, al
jne 0x40341c
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403495
push 0x406004
push section..data
call fcn.0040347b
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403457
movzx eax, word [ebp - 0x14]
jmp 0x40345a
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004034ad
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40368a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406010]
jne 0x403694
repz ret
jmp fcn.00403868
Function at 0x4025b8
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Move file

Disassembly:
push 0x70
mov eax, 0x45506d
call fcn.004367c5
mov edi, ecx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 8], ebx
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
push ebx
push ebx
push 0x458a70
mov dword [ebp - 0x74], ebx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x40279e
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x7c], esi
push esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.004059d5
push 0x466ad8
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00407d24
push eax
lea ecx, [ebp - 0x40]
call fcn.004059a2
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.00407c2e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ebx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40265f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40278b
push str.NvNode
lea ecx, [ebp - 0x40]
call fcn.00407d24
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ebx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402694
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40278b
push str.launcher.log
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004090e8
mov byte [ebp - 4], 6
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
mov dword [esp], str..bak
call fcn.004090e8
mov dword [esp], str.67DF32C5_5AAE_4C02_BAA0_9DE41E8E9FE2
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [edi + 4]
mov dword [edi + 4], eax
test ecx, ecx
je 0x4026df
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 4]
test eax, eax
je 0x40277b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402708
push 0x1388
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40273f
jmp 0x40277b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40273f
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
push 1
cmovae ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push 0x80
push 4
push ebx
push 3
push 0x100004
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
test ecx, ecx
je 0x40277b
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x58]
call fcn.00407c2e
lea ecx, [ebp - 0x28]
call fcn.00407c2e
lea ecx, [ebp - 0x40]
call fcn.00407c2e
test esi, esi
je 0x40279e
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
call fcn.0043676f
ret
Function at 0x402917
Capabilities:
Check if file exists

Disassembly:
push esi
push edi
push str.23FC14F6_CBB0_400C_AB0D_D94A864ED2B7
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x40295e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40297c
cmp eax, 0x102
je 0x402959
cmp eax, 0xffffffff
je 0x402951
mov edi, 0x8000ffff
jmp 0x40297c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402969
push 2
pop edi
jmp 0x40297c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402979
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x40297c
xor edi, edi
inc edi
test esi, esi
je 0x402987
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x402a73
Capabilities:
Enumerate processes

Disassembly:
push 0x46c
mov eax, 0x455100
call fcn.004367c5
mov esi, edx
mov ebx, ecx
mov eax, dword [esi]
mov dword [esi + 4], eax
cmp dword [ebx + 0x10], 0
je 0x402ac4
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x402ac4
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x402acc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.0043676f
ret
and dword [ebp - 0x238], 0
lea ecx, [ebp - 0x248]
and dword [ebp - 0x234], 0
push ebx
call fcn.00407d4b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x238]
cmovae ecx, dword [ebp - 0x248]
cmovae edx, dword [ebp - 0x248]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x248]
cmovae ecx, dword [ebp - 0x248]
push eax
push ecx
lea ecx, [ebp - 0x478]
call fcn.00409170
add esp, 0xc
push dword [ebp - 0x46c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x402c73
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00438150
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x402c73
and dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
push eax
call fcn.00407cab
push 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x230]
pop ebx
cmp dword [ebp - 0x21c], ebx
cmovae ecx, dword [ebp - 0x230]
cmovae edx, dword [ebp - 0x230]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push eax
push ecx
lea ecx, [ebp - 0x478]
call fcn.00409170
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x230]
add esp, 0xc
lea ecx, [ebp - 0x248]
cmp dword [ebp - 0x21c], ebx
cmovae eax, dword [ebp - 0x230]
cmp dword [ebp - 0x234], ebx
cmovae ecx, dword [ebp - 0x248]
cmp edx, dword [ebp - 0x220]
jne 0x402c64
push edx
push eax
push ecx
call fcn.00401130
add esp, 0xc
test eax, eax
jne 0x402c64
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x402c55
mov eax, dword [ebp - 0x46c]
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x402c64
lea eax, [ebp - 0x46c]
push eax
push ecx
mov ecx, esi
call fcn.004095e5
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00407c2e
lea eax, [ebp - 0x474]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402b32
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 4]
lea ecx, [ebp - 0x248]
mov esi, dword [esi]
call fcn.00407c2e
sub edi, esi
cmp edi, 4
sbb al, al
inc al
jmp 0x402ac6