joyce8/EMBER2024-capa huggingface dataset:
Function at 0x507211f7
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
mov ebx, dword [sym.imp.kernel32.dll_IsBadWritePtr]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10
push esi
call ebx
test eax, eax
je 0x50721219
xor edi, edi
jmp 0x50721229
mov edi, dword [esi]
sub edi, 0x779ff326
neg edi
sbb edi, edi
not edi
and edi, esi
test edi, edi
jne 0x50721237
mov eax, 0x810002
jmp 0x50721369
mov esi, dword [ebp + 0x10]
push 0x18
push esi
call ebx
test eax, eax
jne 0x50721366
mov ebx, dword [ebp + 0xc]
push 0x10
push ebx
call dword [sym.imp.kernel32.dll_IsBadReadPtr]
test eax, eax
jne 0x50721366
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
je 0x50721366
cmp word [eax], cx
je 0x50721366
lea edx, [ebp - 4]
push edx
push 0x507270e0
lea edx, [ebp - 0x114]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push ecx
push ecx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
xor edx, edx
cmp eax, edx
je 0x50721366
cmp dword [ebp - 4], edx
jne 0x50721366
cmp dword [ebx + 8], 4
je 0x507212b5
mov dword [ebp + 8], 5
jmp 0x50721361
mov ecx, dword [esi]
cmp ecx, edx
je 0x507212f1
mov eax, dword [esi + 8]
cmp eax, edx
jbe 0x507212f1
add eax, eax
push eax
push ecx
call dword [sym.imp.kernel32.dll_IsBadWritePtr]
test eax, eax
jne 0x50721366
mov eax, dword [esi]
mov dword [0x5072b5b4], eax
and word [eax], 0
mov eax, dword [esi + 8]
mov dword [0x5072b5b8], eax
mov eax, dword [edi + 8]
mov dword [0x5072b5bc], eax
jmp 0x507212fd
mov dword [0x5072b5b4], edx
mov dword [0x5072b5b8], edx
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x114]
push eax
mov ax, word [ebx + 0xc]
push eax
push dword [edi + 4]
call fcn.507215ca
movzx eax, ax
test eax, eax
mov dword [ebp + 8], eax
jne 0x50721361
push 1
and dword [esi + 0xc], 0
pop eax
lea ecx, [ebp - 0x10]
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
mov ax, word [ebx + 0xc]
push 0xa
mov word [esi + 0x14], ax
mov word [edi + 0xc], ax
movzx eax, ax
push ecx
push 0x1004
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
jle 0x50721361
lea eax, [ebp - 0x10]
push eax
call fcn.50723f67
pop ecx
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
jmp 0x50721369
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x50722470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x5072247f
pop dword [ebp - 0x18]
mov eax, 0xe5be3ace
sub eax, 0x954c164f
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x37b28
push 0
mov eax, 0xdddf253
add eax, 0x42947e3d
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x4b6a
mov ebx, eax
mov edx, 0x5072e000
add edx, dword [ebp - 0x18]
mov edi, 0xacb53e77
add dword [ebp - 4], 0xf68449cf
mov esi, dword [edx]
xor esi, edi
mov dword [ebp - 0x14], 0xee280828
mov dword [ebx], esi
xor dword [ebp - 4], 0x40f72313
add ebx, 0x34eaa9bb
sub ebx, 0x34eaa9b7
add edx, 4
loop 0x507224cc
add eax, 0x1207b
xor ebx, ebx
add ebx, eax
add eax, 0x1f69ba57
add eax, 0xe09645ae
mov ecx, 0x50720000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x403987
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x208
push 0
push eax
call fcn.0042f8b0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4039ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x403a5c
mov esi, 0x80004005
jmp 0x403a5c
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x403a1b
push 1
push 0x44b898
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00403806
mov esi, eax
test esi, esi
js 0x403a5c
mov esi, 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00403853
mov esi, eax
test esi, esi
js 0x403a5c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x4039d0
test edi, edi
je 0x403a5c
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0040224f
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd3b
leave
ret 0xc
Function at 0x404203
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4042d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404233
xor esi, esi
jmp 0x4042d2
cmp eax, 3
je 0x404244
push 0
push edi
call fcn.004042da
test eax, eax
jne 0x40422c
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x4042bf
push 0x5c
mov edx, eax
pop esi
cmp dx, si
mov eax, ecx
cmovne eax, ebx
add ecx, 2
mov ebx, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x404256
test ebx, ebx
je 0x4042bf
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.00404203
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x4042d1
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4042bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4042ab
xor esi, esi
inc esi
jmp 0x4042d1
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x4042d1
xor esi, esi
jmp 0x4042d1
mov esi, 0x80070003
push esi
push 0x72
push str.c:jworkspacewix3_build5059eb25_srclibsdutildirutil.cpp
call fcn.00403970
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x4042da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4042fe
test al, 0x10
je 0x4042fe
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4042fb
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x409b56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004073bb
mov esi, eax
test esi, esi
jns 0x409b81
push str.Failed_to_format_variable_string.
jmp 0x409bfa
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409bbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x409bb5
cmp esi, 0x80070003
jne 0x409bb7
xor esi, esi
xor eax, eax
jmp 0x409bc5
xor eax, eax
xor ecx, ecx
test dl, 0x10
je 0x409bc7
inc eax
xor ecx, ecx
test esi, esi
jns 0x409be0
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fdf0
add esp, 0x10
jmp 0x409c02
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040832c
mov esi, eax
test esi, esi
jns 0x409c02
push str.Failed_to_set_variable.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0040291f
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x409c12
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004073bb
mov esi, eax
test esi, esi
jns 0x409c48
push str.Failed_to_format_variable_string.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
jmp 0x409cd2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409c6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x409c92
test al, 0x10
je 0x409c8d
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004082d2
mov esi, eax
test esi, esi
jns 0x409c92
push str.Failed_to_set_directory_search_path_variable.
jmp 0x409c3b
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x409cbb
cmp esi, 0x80070003
je 0x409cbb
test esi, esi
jns 0x409cd2
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fdf0
add esp, 0x10
jmp 0x409cd2
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.004402d3
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.0040291f
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x409ce2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004073bb
mov esi, eax
test esi, esi
jns 0x409d10
push str.Failed_to_format_variable_string.
jmp 0x409db0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409d87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409d6f
cmp eax, 3
je 0x409d6f
test eax, eax
je 0x409d83
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28b
push str.c:jworkspacewix3_build5059eb25_src_burnengine_search.cpp
call fcn.00403970
push dword [edi + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.0043fdf0
add esp, 0xc
jmp 0x409db8
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.004402d3
add esp, 0x10
xor eax, eax
jmp 0x409d94
xor eax, eax
xor ecx, ecx
test edx, 0x10
jne 0x409d96
inc eax
xor ecx, ecx
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040832c
mov esi, eax
test esi, esi
jns 0x409db8
push str.Failed_to_set_variable.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0040291f
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x409dc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004073bb
mov esi, eax
test esi, esi
jns 0x409dfe
push str.Failed_to_format_variable_string.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
jmp 0x409e80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409e49
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x409e6a
cmp esi, 0x80070003
je 0x409e6a
test esi, esi
jns 0x409e80
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.0043fdf0
add esp, 0x10
jmp 0x409e80
test al, 0x10
jne 0x409e6a
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004082d2
mov esi, eax
test esi, esi
jns 0x409e20
push str.Failed_to_set_variable_to_file_search_path.
jmp 0x409df1
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.004402d3
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.0040291f
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x40a2ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
push ecx
mov eax, dword [ebx + 0x24]
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
call fcn.004073bb
mov esi, eax
test esi, esi
jns 0x40a33f
push str.Failed_to_format_key_string.
jmp 0x40a44c
xor edi, edi
lea eax, [ebp - 0xc]
push eax
inc edi
mov eax, 0x101
cmp dword [ebp + 8], 0
cmove eax, edi
push eax
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.00440aee
mov esi, eax
test esi, esi
jns 0x40a396
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x40a383
push str.Registry_key_not_found._Key___ls
push 2
call fcn.004402d3
add esp, 0xc
jmp 0x40a42e
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.0043fdf0
add esp, 0xc
jmp 0x40a454
xor eax, eax
cmp dword [ebx + 0x20], eax
je 0x40a432
push eax
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.004073bb
mov esi, eax
test esi, esi
jns 0x40a3c1
push str.Failed_to_format_value_string.
jmp 0x40a44c
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub eax, 0
je 0x40a430
dec eax
sub eax, 1
je 0x40a419
xor eax, eax
test ecx, ecx
je 0x40a432
movzx esi, cx
mov eax, 0x80004005
or esi, 0x80070000
test ecx, ecx
cmovle esi, ecx
test esi, esi
cmovns esi, eax
push esi
push 0x322
push str.c:jworkspacewix3_build5059eb25_src_burnengine_search.cpp
call fcn.00403970
push str.Failed_to_query_registry_key_value.
jmp 0x40a44c
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.004402d3
add esp, 0x10
xor edi, edi
xor eax, eax
push 0
push eax
push edi
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.0040832c
mov esi, eax
test esi, esi
jns 0x40a46b
push str.Failed_to_set_variable.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
test esi, esi
jns 0x40a46b
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.004402d3
add esp, 0x10
push dword [ebp - 4]
call fcn.0040291f
push dword [ebp - 8]
call fcn.0040291f
cmp dword [ebp - 0xc], 0
je 0x40a48a
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x40b299
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x40b2ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
push edi
push 0x140
push str.c:jworkspacewix3_build5059eb25_src_burnengine_section.cpp
call fcn.00403970
push str.Failed_to_get_module_handle_to_process.
push edi
call fcn.0043fdf0
pop ecx
pop ecx
jmp 0x40b43a
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x40b316
mov esi, 0x8007000d
push esi
push 0x14a
push str.c:jworkspacewix3_build5059eb25_src_burnengine_section.cpp
mov edi, esi
call fcn.00403970
push str.Failed_to_find_valid_DOS_image_header_in_buffer.
push esi
jmp 0x40b2e1
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x40b340
mov esi, 0x8007000d
push esi
push 0x155
push str.c:jworkspacewix3_build5059eb25_src_burnengine_section.cpp
mov edi, esi
call fcn.00403970
push str.Failed_to_find_valid_NT_image_header_in_buffer.
jmp 0x40b313
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44f288
push ebx
call fcn.0042fb73
add esp, 0xc
test eax, eax
je 0x40b385
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x40b3ac
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x40b36c
cmp dword [ebx + 4], 0x6e727562
jne 0x40b36c
cmp dword [ebx + 0x10], 0x34
jae 0x40b3ca
mov esi, 0x8007000d
push esi
push 0x17a
push str.c:jworkspacewix3_build5059eb25_src_burnengine_section.cpp
mov edi, esi
call fcn.00403970
push dword [ebx + 0x10]
push str.Failed_to_read_section_info__data_to_short:__u
jmp 0x40b3f4
mov esi, 0x8007000d
push esi
push 0x16e
push str.c:jworkspacewix3_build5059eb25_src_burnengine_section.cpp
mov edi, esi
call fcn.00403970
push str.Failed_to_find_Burn_section.
jmp 0x40b431
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x40b3ff
mov esi, 0x8007000d
push esi
push 0x184
push str.c:jworkspacewix3_build5059eb25_src_burnengine_section.cpp
mov edi, esi
call fcn.00403970
push dword [ebx + 4]
push str.Failed_to_read_section_info__unsupported_version:__08x
push esi
call fcn.0043fdf0
add esp, 0xc
jmp 0x40b439
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x40b415
inc ecx
cmp ecx, 4
jne 0x40b404
jmp 0x40b439
mov esi, 0x8007000d
push esi
push 0x18a
push str.c:jworkspacewix3_build5059eb25_src_burnengine_section.cpp
mov edi, esi
call fcn.00403970
push str.Bundle_guid_didnt_match_the_guid_in_the_PE_Header_in_memory.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x413b74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0042f8b0
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x413c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28d
push str.c:jworkspacewix3_build5059eb25_src_burnenginelogging.cpp
call fcn.00403970
push str.Failed_to_get_temp_folder.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
jmp 0x413cff
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401c5f
mov esi, eax
test esi, esi
jns 0x413c33
push str.Failed_to_get_length_of_temp_folder.
jmp 0x413c05
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x413cd7
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x4543d0
push eax
call fcn.00401fb8
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x413c77
push str.Failed_to_format_session_id_as_a_string.
jmp 0x413cf6
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.00401c5f
mov esi, eax
test esi, esi
jns 0x413c9b
push str.Failed_to_get_length_of_session_id_string.
jmp 0x413cf6
push dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov esi, edi
sub esi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + esi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
cmove edi, esi
jmp 0x413cdd
mov edi, dword [ebp - 0x218]
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0040224f
mov esi, eax
test esi, esi
jns 0x413cfe
push str.Failed_to_copy_temp_folder.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x413d13
push dword [ebp - 0x210]
call fcn.00402706
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd3b
leave
ret 4
Function at 0x41493d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
and dword [ebp - 0xc], esi
and dword [ebp - 8], esi
and dword [ebp - 4], esi
xor ebx, ebx
push edi
push 0
lea eax, [ebp - 4]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [ebp - 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x41499d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x414986
xor esi, esi
jmp 0x41499d
cmp eax, 0x6d
je 0x414a02
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4149e3
add ebx, dword [ebp - 4]
cmp ebx, 8
jb 0x414953
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edi], ecx
mov dword [edi + 4], eax
test eax, eax
je 0x414a64
push 0
push eax
call fcn.00403a94
mov dword [edi + 0xc], eax
test eax, eax
jne 0x414a11
mov esi, 0x8007000e
push esi
push 0x323
push str.c:jworkspacewix3_build5059eb25_src_burnenginepipe.cpp
call fcn.00403970
push str.Failed_to_allocate_data_for_message.
jmp 0x4149f8
push esi
push 0x318
push str.c:jworkspacewix3_build5059eb25_src_burnenginepipe.cpp
call fcn.00403970
push str.Failed_to_read_message_from_pipe.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
jmp 0x414a64
xor ecx, ecx
xor eax, eax
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
inc esi
jmp 0x4149ab
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi + 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x327
push str.c:jworkspacewix3_build5059eb25_src_burnenginepipe.cpp
call fcn.00403970
push str.Failed_to_read_data_for_message.
jmp 0x4149f8
mov dword [edi + 8], 1
cmp dword [edi + 8], 0
jne 0x414a78
cmp dword [edi + 0xc], 0
je 0x414a78
push dword [edi + 0xc]
call fcn.00403b4e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x414a81
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00414651
mov esi, eax
test esi, esi
jns 0x414ab3
push str.Failed_to_allocate_message_to_write.
jmp 0x414b14
mov dword [ebp + 0x14], edi
cmp dword [ebp - 4], edi
jbe 0x414b1c
push 0
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
sub eax, edi
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414ae1
add edi, dword [ebp + 0x14]
cmp edi, dword [ebp - 4]
jb 0x414abb
jmp 0x414b1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2f0
push str.c:jworkspacewix3_build5059eb25_src_burnenginepipe.cpp
call fcn.00403970
push str.Failed_to_write_message_type_to_pipe.
push esi
call fcn.0043fdf0
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x414b2a
push dword [ebp - 8]
call fcn.00403b4e
pop edi
mov eax, esi
pop esi
leave
ret 0x10