joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411eed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x10], edi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00412436
mov esi, eax
test esi, esi
jns 0x411f3a
push str.Failed_to_initialize_file_search.
push esi
push 0x100
push 5
push 0x2a8
push str.d:_awixwix_src_burnengine_search.cpp
call fcn.004012a1
add esp, 0x18
jmp 0x412010
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.0040bf1d
mov esi, eax
test esi, esi
jns 0x411f64
push str.Failed_to_format_variable_string.
push esi
push 0x100
push 5
push 0x2ad
jmp 0x411f28
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x411f89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x411fbf
movzx esi, si
or esi, 0x80070000
jmp 0x411fbf
test al, 0x10
je 0x411fba
push ebx
push ebx
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040cfc8
mov esi, eax
test esi, esi
jns 0x411fbf
push str.Failed_to_set_directory_search_path_variable.
push esi
push 0x100
push 5
push 0x2b7
jmp 0x411f28
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x411ff9
cmp esi, 0x80070003
je 0x411ff9
test esi, esi
jns 0x412010
push dword [edi + 0x14]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
push 0x100
push 5
push 0x2c3
push str.d:_awixwix_src_burnengine_search.cpp
call fcn.004012a1
add esp, 0x20
jmp 0x412010
push esi
push dword [edi + 0x14]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.0040ba47
add esp, 0x14
mov esi, ebx
lea eax, [ebp - 0x10]
push eax
call fcn.00412400
push dword [ebp - 4]
call fcn.0040432f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41202a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x10], edi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00412436
mov esi, eax
test esi, esi
jns 0x41206a
push str.Failed_to_initialize_file_search.
push esi
push 0x100
push 5
push 0x2df
jmp 0x412155
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.0040bf1d
mov esi, eax
test esi, esi
jns 0x412097
push str.Failed_to_format_variable_string.
push esi
push 0x100
push 5
push 0x2e4
jmp 0x412155
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41211a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x412102
cmp esi, 3
je 0x412102
test esi, esi
je 0x412116
jle 0x4120c8
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4120cf
mov esi, 0x80004005
push esi
push 0x2f1
mov ebx, str.d:_awixwix_src_burnengine_search.cpp
push ebx
call fcn.0040129e
push dword [edi + 0x14]
push dword [edi]
push str.File_search:__ls__failed_get_to_file_attributes.__ls
push esi
push 0x100
push 5
push 0x2f1
push ebx
call fcn.004012a1
add esp, 0x20
jmp 0x412162
push dword [edi + 0x14]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0040ba47
add esp, 0x10
mov eax, ebx
jmp 0x41212d
test al, 0x10
je 0x41212a
push dword [edi + 0x14]
push dword [edi]
push str.File_search:__ls__found_directory_at_path:__ls
jmp 0x41210c
xor eax, eax
inc eax
push ebx
mov ecx, ebx
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040cf8d
mov esi, eax
test esi, esi
jns 0x412162
push str.Failed_to_set_variable.
push esi
push 0x100
push 5
push 0x2ff
push str.d:_awixwix_src_burnengine_search.cpp
call fcn.004012a1
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
call fcn.00412400
push dword [ebp - 4]
call fcn.0040432f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41217c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x10], edi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00412436
mov esi, eax
test esi, esi
jns 0x4121c9
push str.Failed_to_initialize_file_search.
push esi
push 0x100
push 5
push 0x349
push str.d:_awixwix_src_burnengine_search.cpp
call fcn.004012a1
add esp, 0x18
jmp 0x412297
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.0040bf1d
mov esi, eax
test esi, esi
jns 0x4121f3
push str.Failed_to_format_variable_string.
push esi
push 0x100
push 5
push 0x34e
jmp 0x4121b7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412250
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x412216
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x412281
cmp esi, 0x80070003
je 0x412281
test esi, esi
jns 0x412297
push dword [edi + 0x14]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
push 0x100
push 5
push 0x364
push str.d:_awixwix_src_burnengine_search.cpp
call fcn.004012a1
add esp, 0x20
jmp 0x412297
test al, 0x10
jne 0x412281
push ebx
push ebx
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040cfc8
mov esi, eax
test esi, esi
jns 0x412216
push str.Failed_to_set_variable_to_file_search_path.
push esi
push 0x100
push 5
push 0x35c
jmp 0x4121b7
push dword [edi + 0x14]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0040ba47
add esp, 0x10
mov esi, ebx
lea eax, [ebp - 0x10]
push eax
call fcn.00412400
push dword [ebp - 4]
call fcn.0040432f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4129e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
xor ebx, ebx
push ebx
push eax
push dword [edi + 0x1c]
mov dword [ebp - 8], ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call fcn.0040bf1d
mov esi, eax
test esi, esi
jns 0x412a2f
push str.Failed_to_format_key_string.
push esi
push 0x100
push 5
push 0x37f
jmp 0x412b89
lea eax, [ebp - 4]
push eax
xor eax, eax
cmp dword [edi + 0x24], ebx
setne al
inc eax
push eax
push 1
push dword [ebp - 8]
push dword [edi + 0x18]
call fcn.00467b72
mov esi, eax
cmp esi, 0x80070003
je 0x412a65
cmp esi, 0x80070002
je 0x412a65
xor ebx, ebx
test esi, esi
setns bl
jmp 0x412a67
xor esi, esi
test esi, esi
jns 0x412a92
push dword [edi + 0x1c]
push str.Failed_to_open_registry_key._Key___ls
push esi
push 0x100
push 5
push 0x383
push str.d:_awixwix_src_burnengine_search.cpp
call fcn.004012a1
add esp, 0x1c
jmp 0x412b96
test ebx, ebx
jne 0x412aad
push dword [edi + 0x1c]
push str.Registry_key_not_found._Key___ls
push 2
call fcn.0040ba47
add esp, 0xc
jmp 0x412b61
cmp dword [edi + 0x20], 0
je 0x412b61
push 0
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x20]
push dword [ebp + 0xc]
call fcn.0040bf1d
mov esi, eax
test esi, esi
jns 0x412ae5
push str.Failed_to_format_value_string.
push esi
push 0x100
push 5
push 0x38d
jmp 0x412b89
xor ecx, ecx
lea eax, [ebp - 0x10]
push ecx
push ecx
push eax
push ecx
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
sub eax, 0
je 0x412b5e
dec eax
sub eax, 1
je 0x412b45
test esi, esi
je 0x412b61
jle 0x412b18
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x412b1f
mov esi, 0x80004005
push esi
push 0x39b
mov ebx, str.d:_awixwix_src_burnengine_search.cpp
push ebx
call fcn.0040129e
push str.Failed_to_query_registry_key_value.
push esi
push 0x100
push 5
push 0x39b
push ebx
jmp 0x412b8e
push dword [edi + 0x20]
push dword [edi + 0x1c]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.0040ba47
add esp, 0x10
xor ebx, ebx
jmp 0x412b61
xor ebx, ebx
inc ebx
push 0
push 0
push ebx
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040cf8d
mov esi, eax
test esi, esi
jns 0x412bac
push str.Failed_to_set_variable.
push esi
push 0x100
push 5
push 0x3a1
push str.d:_awixwix_src_burnengine_search.cpp
call fcn.004012a1
add esp, 0x18
test esi, esi
jns 0x412bac
push esi
push dword [edi]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.0040ba47
add esp, 0x10
push dword [ebp - 8]
call fcn.0040432f
push dword [ebp - 0xc]
call fcn.0040432f
cmp dword [ebp - 4], 0
je 0x412bcb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x419e57
Capabilities:
Access the windows event log

Disassembly:
push edi
xor edi, edi
push edi
push edi
push edi
push 0x481f28
push str._Failed
push str.Setup
push edi
call fcn.00466096
test eax, eax
jns 0x419ef2
push esi
push str.Application
push edi
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov esi, eax
test esi, esi
jne 0x419ed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419ea0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x419ea7
mov esi, 0x80004005
push ebx
push esi
mov ebx, 0xfd
mov edi, str.d:_awixwix_src_burnenginelogging.cpp
push ebx
push edi
call fcn.0040129e
push str.Failed_to_open_Application_event_log
push esi
push 0x100
push 5
push ebx
push edi
call fcn.004012a1
add esp, 0x18
pop ebx
jmp 0x419ef1
push edi
push 0x481d44
push edi
xor eax, eax
inc eax
push eax
push edi
push eax
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
pop esi
pop edi
ret

Function at 0x41c464
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov eax, 0x20000004
push esi
push edi
mov edi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 8], ebx
je 0x41c51b
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.0041b4ee
mov esi, eax
test esi, esi
jns 0x41c4c0
push str.Failed_to_allocate_administrator_SID.
push esi
push 0x100
push 5
push 0x7d1
push str.d:_awixwix_src_burnenginecache.cpp
call fcn.004012a1
mov edi, dword [ebp - 4]
add esp, 0x18
jmp 0x41c544
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x41c513
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41c4e9
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41c4f0
mov esi, 0x80004005
push esi
mov ebx, 0x7d6
mov edi, str.d:_awixwix_src_burnenginecache.cpp
push ebx
push edi
call fcn.0040129e
push str.Failed_to_initialize_ACL.
push esi
push 0x100
push 5
push ebx
push edi
jmp 0x41c4b0
mov edi, dword [ebp - 4]
mov eax, 0x20000005
push 0x7d0
push 3
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push edi
push eax
push 1
push dword [ebp + 0xc]
call fcn.0047019e
push 0x80
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test edi, edi
je 0x41c54e
push edi
call fcn.0040758b
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41d64b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4b1040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x254]
push esi
xor esi, esi
push 0x250
push esi
push eax
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
call fcn.00452250
add esp, 0xc
mov dword [ebp - 0x264], esi
lea eax, [ebp - 0x260]
push eax
push str..unverified
push dword [ebp + 8]
push ebx
call fcn.0041de1a
mov esi, dword [ebp - 0x260]
test eax, eax
js 0x41d6b9
push 7
push esi
call fcn.00401d86
cmp dword [ebp + 8], 0
jne 0x41d7a8
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x41d7a8
lea ecx, [ebp - 0x25c]
push ecx
push 0x477d34
push eax
call fcn.00405d77
test eax, eax
js 0x41d7a8
push edi
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41d7a7
test byte [ebp - 0x254], 0x10
jne 0x41d78a
lea eax, [ebp - 0x264]
push eax
push 0x104
lea eax, [ebp - 0x228]
push eax
call fcn.004031cb
test eax, eax
js 0x41d78a
mov eax, dword [ebp - 0x264]
cmp eax, 2
jbe 0x41d75f
push 0x2e
pop ecx
cmp cx, word [ebp + eax*2 - 0x22c]
jne 0x41d75f
movzx ecx, word [ebp + eax*2 - 0x22a]
push 0x52
pop edx
cmp dx, cx
je 0x41d78a
push 0x72
pop edx
cmp dx, cx
je 0x41d78a
lea ecx, [ebp - 0x258]
push ecx
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push dword [ebx + 0x84]
call fcn.00405d90
test eax, eax
js 0x41d78a
push dword [ebp - 0x258]
call fcn.00404e55
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41d70a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
cmp dword [ebp - 0x258], 0
je 0x41d7bc
push dword [ebp - 0x258]
call fcn.00404128
cmp dword [ebp - 0x25c], 0
je 0x41d7d0
push dword [ebp - 0x25c]
call fcn.00404128
test esi, esi
je 0x41d7da
push esi
call fcn.00404128
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00451586
leave
ret 8
Function at 0x422b06
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
cmp dword [edi + 0x72c], 0xffffffff
jne 0x422c53
lea eax, [edi + 0x718]
cmp dword [eax], 0
jne 0x422b52
push eax
lea eax, [edi + 0x40]
push eax
push dword [edi + 0x164]
lea eax, [edi + 0x3c0]
push eax
push dword [edi + 0x7ac]
call fcn.0041d44e
mov esi, eax
test esi, esi
js 0x422bfa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00429c12
mov esi, eax
cmp esi, 0x81f407d0
jne 0x422b74
cmp ebx, 1
jae 0x422c34
inc ebx
jmp 0x422b13
test esi, esi
js 0x422c34
push 1
push 0
push 1
push str.WixBundleElevated
lea eax, [edi + 0x80]
push eax
call fcn.0040cf8d
mov esi, eax
test esi, esi
js 0x422c0e
xor eax, eax
push eax
push eax
push edi
push 0x4218f0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x714], eax
test eax, eax
jne 0x422b13
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x422bd0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x422bd7
mov esi, 0x80004005
push esi
mov ebx, 0x25f
mov edi, str.d:_awixwix_src_burnenginecore.cpp
push ebx
push edi
call fcn.0040129e
push str.Failed_to_create_unelevated_logging_thread.
push esi
push 0x100
push 5
push ebx
push edi
jmp 0x422c4b
push str.Failed_to_cache_engine_to_working_directory.
push esi
push 0x100
push 5
push 0x250
jmp 0x422c46
push str.WixBundleElevated
push str.Failed_to_overwrite_the__ls_built_in_variable.
push esi
push 0x100
push 5
push 0x25c
push str.d:_awixwix_src_burnenginecore.cpp
call fcn.004012a1
add esp, 0x1c
jmp 0x422c53
push str.Failed_to_actually_elevate.
push esi
push 0x100
push 5
push 0x259
push str.d:_awixwix_src_burnenginecore.cpp
call fcn.004012a1
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4298e2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor eax, eax
mov edx, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x30]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 4]
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x3c]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x54], ebx
xor ebx, ebx
push ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x40]
push eax
push 0x424d70
push ebx
push ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x4299d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42999d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4299a4
mov esi, 0x80004005
push esi
mov ebx, 0x652
mov edi, str.d:_awixwix_src_burnengineelevation.cpp
push ebx
push edi
call fcn.0040129e
push str.Failed_to_create_elevated_cache_thread.
push esi
push 0x100
push 5
push ebx
push edi
call fcn.004012a1
add esp, 0x18
jmp 0x429a5a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x428840
push dword [ebp + 8]
call fcn.0041af2b
mov esi, eax
test esi, esi
jns 0x429a0e
push str.Failed_to_pump_messages_in_child_process.
push esi
push 0x100
push 5
push 0x655
push str.d:_awixwix_src_burnengineelevation.cpp
call fcn.004012a1
add esp, 0x18
jmp 0x429a53
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x493e0
push edi
call fcn.00470d4d
test eax, eax
jns 0x429a43
push str.Failed_to_wait_for_cache_thread_to_complete.
push eax
push 0x100
push 5
push 0x6c5
push str.d:_awixwix_src_burnengineelevation.cpp
call fcn.004012a1
add esp, 0x18
mov ecx, dword [ebp + 0x34]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x38]
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x429a65
call fcn.00429a6e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x38
Function at 0x42bbb7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x24]
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push esi
call fcn.00470dea
mov edi, eax
test edi, edi
jns 0x42bc2a
push str.Failed_to_read_splash_screen_configuration_resource.
push edi
mov ebx, 0x100
mov esi, str.d:_awixwix_src_burnengine_splashscreen.cpp
push ebx
push 5
push 0x9b
push esi
call fcn.004012a1
push str.Failed_to_load_splash_screen_configuration.
push edi
push ebx
push 5
push 0x53
push esi
call fcn.004012a1
add esp, 0x30
xor ebx, ebx
jmp 0x42bd44
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
sub eax, ebx
je 0x42bd44
sub eax, 1
je 0x42bc71
mov edi, 0x8007000d
mov esi, str.d:_awixwix_src_burnengine_splashscreen.cpp
push edi
push 0x5c
push esi
call fcn.0040129e
mov eax, dword [ebp - 0x18]
push dword [eax]
push str.Invalid_splash_screen_type:__i
push edi
push 0x100
push 5
push 0x5c
push esi
call fcn.004012a1
add esp, 0x1c
jmp 0x42bd44
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x42bcc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x42bc9a
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x42bca1
mov edi, 0x80004005
push edi
push 0x60
mov esi, str.d:_awixwix_src_burnengine_splashscreen.cpp
push esi
call fcn.0040129e
push str.Failed_to_create_modal_event.
push edi
push 0x100
push 5
push 0x60
push esi
call fcn.004012a1
add esp, 0x18
jmp 0x42bd44
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
push eax
push 0x42b910
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x42bd35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x42bd0f
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x42bd16
mov edi, 0x80004005
push edi
push 0x69
mov esi, str.d:_awixwix_src_burnengine_splashscreen.cpp
push esi
call fcn.0040129e
push str.Failed_to_create_UI_thread.
push edi
push 0x100
push 5
push 0x69
jmp 0x42bcbe
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [ebp - 0xc], 0
je 0x42bd56
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0x10], 0
pop edi
pop esi
pop ebx
je 0x42bd68
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 0xc
Function at 0x42c1ab
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
xor ebx, ebx
push ebx
push 0x3ff
mov esi, ebx
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x42c230
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42c1fb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42c202
mov esi, 0x80004005
push esi
push 0x38
mov edi, str.d:_awixwix_src_burnengineuithread.cpp
push edi
call fcn.0040129e
push str.Failed_to_create_initialization_event.
push esi
push 0x100
push 5
push 0x38
push edi
call fcn.004012a1
mov eax, dword [ebp - 4]
add esp, 0x18
jmp 0x42c2b3
mov edi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0x42bdf0
push ebx
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42c296
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42c270
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42c277
mov esi, 0x80004005
push esi
push 0x41
mov edi, str.d:_awixwix_src_burnengineuithread.cpp
push edi
call fcn.0040129e
push str.Failed_to_create_the_UI_thread.
push esi
push 0x100
push 5
push 0x41
jmp 0x42c21f
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 4]
mov dword [edi + 0x478], eax
mov eax, ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x42c2c1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x42c2cf
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4389d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea ebx, [edi + 0x24]
push ebx
call fcn.0046ebe8
test eax, eax
je 0x438a0f
mov esi, 0x80070057
mov edi, str.d:_awixwix_src_burnengine_baengine.cpp
push esi
push 0x52
push edi
call fcn.0040129e
push str.Bootstrapper_application_engine_already_listening_on_a_pipe.
push esi
push 0x100
push 5
push 0x52
jmp 0x438a6c
push 1
push dword [ebp + 0xc]
push ebx
call fcn.0046ebbb
push esi
push esi
push edi
push 0x4373b0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x48], eax
test eax, eax
jne 0x438a75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x438a48
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x438a4f
mov esi, 0x80004005
push esi
push 0x58
mov edi, str.d:_awixwix_src_burnengine_baengine.cpp
push edi
call fcn.0040129e
push str.Failed_to_create_bootstrapper_application_engine_thread.
push esi
push 0x100
push 5
push 0x58
push edi
call fcn.004012a1
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8