joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412572
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55c4ea
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebx]
mov esi, edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [esp + 0x98], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4125df
cmp eax, 1
je 0x4125df
xor al, al
jmp 0x4125e2
xor eax, eax
inc eax
push 0x49
push eax
mov edi, str.srcApplicationLaunchInfoCollector.cpp
call fcn.0049247f
pop ecx
pop ecx
xor eax, eax
push 7
pop ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x78], ecx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x58], eax
mov word [esp + 0x48], dx
mov dword [esp + 0x74], eax
mov word [esp + 0x64], cx
mov byte [esp + 0x98], 1
mov ecx, dword [esi + 0x20]
sub ecx, eax
je 0x4126db
dec ecx
jne 0x41271c
mov esi, dword [ebx + 0x24]
jmp 0x412668
mov edi, dword [esp + 0x14]
lea ecx, [esi + 0x14]
mov eax, edi
call fcn.00410051
test al, al
je 0x412665
mov eax, dword [esi + 0x10]
cmp eax, dword [edi + 0x1c]
jne 0x412665
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x412672
add esi, 0x50
cmp esi, dword [ebx + 0x28]
jne 0x412643
jmp 0x41271c
lea edi, [esp + 0x2c]
call fcn.00493216
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov eax, dword [eax + 4]
push esi
mov ecx, ebx
mov dword [esi + 0xc], eax
call fcn.0041275d
mov eax, dword [ebx + 0x28]
lea edi, [esi + 0x50]
mov dword [esp + 0x18], eax
cmp edi, eax
je 0x4126b9
mov dword [esp + 0x14], esi
sub dword [esp + 0x14], edi
mov esi, dword [esp + 0x14]
lea esi, [esi + edi]
call fcn.00413383
add edi, 0x50
cmp edi, dword [esp + 0x18]
jne 0x4126a4
mov esi, dword [ebx + 0x28]
lea edi, [esi - 0x50]
cmp edi, esi
je 0x4126d5
mov ebx, edi
call fcn.004133c0
add edi, 0x50
cmp edi, esi
jne 0x4126c3
mov ebx, dword [esp + 0x1c]
add dword [ebx + 0x28], 0xffffffb0
jmp 0x41271c
push 0xffffffffffffffff
push eax
mov eax, esi
lea ecx, [esp + 0x50]
call fcn.0040406a
mov eax, dword [esi + 0x1c]
lea edi, [esp + 0x24]
mov dword [esp + 0x44], eax
call fcn.00493216
mov ecx, dword [eax]
mov dword [esp + 0x34], ecx
mov eax, dword [eax + 4]
and dword [esp + 0x3c], 0
and dword [esp + 0x40], 0
lea esi, [ebx + 0x24]
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], eax
call fcn.00412f34
push 1
xor edi, edi
lea esi, [esp + 0x68]
call fcn.0040412d
push 1
lea esi, [esp + 0x4c]
call fcn.0040412d
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret
Function at 0x412ded
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56cda2
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
lea ebx, [esp + 0xb0]
call fcn.00412dab
and dword [esp + 0xf8], 0
mov eax, ebx
call fcn.004957ff
test al, al
je 0x412efb
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x412e63
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x412efb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00403689
mov esi, eax
push str.Cannot_delete_ApplicationLaunchInfoStatistics_file:
push esi
mov byte [esp + 0x100], 1
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
lea eax, [esp + 0xcc]
push eax
mov eax, esi
call fcn.004036f3
push 2
pop ecx
mov byte [esp + 0xf8], cl
cmp dword [esp + 0xe0], 8
mov eax, dword [esp + 0xcc]
jae 0x412ed3
lea eax, [esp + 0xcc]
push eax
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd0]
call fcn.0040412d
lea eax, [esp + 0x14]
mov byte [esp + 0xf8], 0
call fcn.0040262a
push 1
xor edi, edi
lea esi, [esp + 0xb4]
call fcn.0040412d
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret
Function at 0x418d07
Capabilities:
Delete file

Disassembly:
push 0xec
mov eax, 0x56cbe9
call fcn.005239fe
mov edi, ecx
push edi
lea eax, [ebp - 0x60]
push eax
mov esi, edx
call fcn.0049547c
xor ebx, ebx
push 0xa
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.00495520
test al, al
jne 0x418d80
lea eax, [ebp - 0xf8]
push eax
call fcn.00403689
mov esi, eax
push str.Cannot_open_file_for_writing:
push esi
mov byte [ebp - 4], 1
call fcn.00405d65
push esi
mov ecx, edi
call fcn.00411926
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 2
push 0x270
mov ecx, str.srcApplicationUsageCollector.cpp
lea eax, [ebp - 0x48]
call fcn.004025bc
push 0x2e
push str.__xml_version1.0_encodingUTF_8___n_Data__n
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004042d9
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x49], bl
jae 0x418daf
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x49]
push ecx
push ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x60]
call dword [eax + 0x24]
cmp byte [ebp - 0x49], bl
je 0x418e54
lea ecx, [ebp - 0x60]
call fcn.004955da
cmp dword [edi + 0x14], 8
jb 0x418dda
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x418e00
push str.Cannot_write_file_header.
lea esi, [ebp - 0x48]
call fcn.00403350
mov byte [ebp - 4], 4
push 0x27a
jmp 0x418d73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xf8]
push eax
call fcn.00403689
mov esi, eax
push str.Cannot_write_file_header_and_delete_incomplete_file__ec
push esi
mov byte [ebp - 4], 5
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
push 0x589be4
push esi
call fcn.00405d65
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 6
push 0x27f
jmp 0x418d73
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
mov edi, 0x1e8
mov dword [ebp - 0x50], ebx
cdq
mov ebx, edi
idiv ebx
test eax, eax
je 0x418e94
and dword [ebp - 0x54], 0
add ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x60]
push eax
call fcn.00415c61
mov eax, dword [esi + 4]
pop ecx
mov ecx, dword [esi]
sub eax, ecx
cdq
mov ebx, edi
idiv ebx
inc dword [ebp - 0x50]
add dword [ebp - 0x54], edi
cmp dword [ebp - 0x50], eax
jb 0x418e70
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403fde
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004954d3
call fcn.00523a81
ret
Function at 0x419dc7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5690ba
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xec], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
lea eax, [esp + 0xdc]
push eax
mov esi, ecx
call fcn.0048675c
pop ecx
and dword [esp + 0x108], 0
lea ecx, [esp + 0xa4]
push esi
push ecx
mov ecx, eax
call fcn.004102a9
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe0]
mov byte [esp + 0x10c], 2
call fcn.0040412d
lea eax, [esp + 0xa4]
call fcn.004957ff
test al, al
je 0x419f28
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x419e74
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x419f28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.00403689
mov esi, eax
push str.Cannot_delete_
push esi
mov byte [esp + 0x110], 3
call fcn.00405d65
push esi
lea ecx, [esp + 0xb0]
call fcn.00411926
add esp, 0xc
push 0x586c18
push esi
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.0041058a
lea eax, [esp + 0xc0]
push eax
mov eax, esi
call fcn.004036f3
mov byte [esp + 0x108], 4
cmp dword [esp + 0xd4], 8
mov eax, dword [esp + 0xc0]
jae 0x419efd
lea eax, [esp + 0xc0]
push eax
push 2
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xc4]
call fcn.0040412d
lea eax, [esp + 0xc]
mov byte [esp + 0x108], 2
call fcn.0040262a
push 1
xor edi, edi
lea esi, [esp + 0xa8]
call fcn.0040412d
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret
Function at 0x41ca09
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55c156
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x338], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x350]
mov dword fs:[0], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
lea edi, [esp + 0x154]
call fcn.00407c42
lea eax, [esp + 0x114]
push str.cmd.exe__c
xor ebx, ebx
push eax
lea edi, [esp + 0x22c]
mov dword [esp + 0x360], ebx
call fcn.0042943e
push 0x44
pop esi
push esi
lea eax, [esp + 0x40]
push ebx
push eax
mov byte [esp + 0x36c], 1
call fcn.00517bf0
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x14
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x128]
mov dword [esp + 0x38], esi
inc eax
lea esi, [esp + 0x18]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.004277f8
mov byte [esp + 0x358], 2
cmp dword [esp + 0x128], 8
mov ecx, dword [esp + 0x114]
mov eax, ecx
jae 0x41caee
lea eax, [esp + 0x114]
cmp dword [esp + 0x128], 8
mov edx, dword [esp + 0x124]
lea eax, [eax + edx*2]
jae 0x41cb09
lea ecx, [esp + 0x114]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push ecx
push dword [esp + 0x1c]
call fcn.005150f0
mov eax, dword [esp + 0x1d8]
add esp, 0xc
cmp dword [esp + 0x1e0], 8
jae 0x41cb35
lea eax, [esp + 0x1cc]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x38]
push ecx
push eax
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [esp + 0x34]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
jne 0x41cbe7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x7c]
push eax
call fcn.00403689
mov edi, eax
push str.CreateProcess_failed_with
push edi
mov byte [esp + 0x360], 3
call fcn.00405d65
pop ecx
pop ecx
push esi
push edi
call fcn.0041058a
lea eax, [esp + 0x130]
push eax
mov eax, edi
call fcn.004036f3
mov byte [esp + 0x358], 4
cmp esi, ebx
jle 0x41cbb3
and esi, 0xffff
or esi, 0x80070000
push 1
push 0x183
push str.srcAppManager.cpp
push esi
lea eax, [esp + 0x140]
push eax
lea eax, [esp + 0x2c8]
push eax
call fcn.00498954
push 0x5c9774
lea eax, [esp + 0x2b8]
push eax
call fcn.0051eb2a
push dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x24]
call esi
lea esi, [esp + 0x14]
call fcn.004e7046
push 1
xor edi, edi
lea esi, [esp + 0x118]
call fcn.0040412d
lea ebx, [esp + 0x14c]
call fcn.00407608
mov ecx, dword [esp + 0x350]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x338]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret 8
Function at 0x41ccfc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5723e2
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
push ebx
lea esi, [esp + 0x2c]
mov edi, ecx
call fcn.0042093e
xor esi, esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x30]
mov edx, edi
mov byte [esp + 0x80], 1
call fcn.004203da
mov eax, dword [esp + 0x20]
cmp eax, esi
jne 0x41cd9d
push str.Cannot_choose_recommended_settings
lea esi, [esp + 0x50]
call fcn.00403350
push 0x1a0
mov ecx, str.srcAppManager.cpp
mov eax, esi
mov byte [esp + 0x7c], 2
call fcn.004025bc
push dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
push eax
push eax
lea eax, [esp + 0x20]
call fcn.00426939
push eax
push ebx
mov ecx, edi
call fcn.0042261f
lea eax, [esp + 0x10]
call fcn.0041ccd6
push 1
xor edi, edi
lea esi, [esp + 0x34]
call fcn.0040412d
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret 4
Function at 0x42b47f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [esi]
call fcn.00515d5c
push dword [esi]
mov ebx, eax
push 1
push edi
push dword [ebp + 8]
call fcn.005167fa
add esp, 0x14
cmp eax, 1
jne 0x42b4b0
lea eax, [ebx + edi]
cmp eax, dword [esi + 8]
jbe 0x42b4ac
mov dword [esi + 8], eax
mov al, 1
jmp 0x42b4b2
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x42b7fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55c057
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov esi, dword [ebx]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x20], eax
cmp esi, eax
jne 0x42b854
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
jmp 0x42b927
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
call fcn.0042c6dd
mov esi, dword [esp + 0x1c]
xor ecx, ecx
push ecx
mov dword [esp + 0x54], ecx
mov eax, dword [ebx + 0xc]
push ecx
push eax
push dword [esi + 0x40]
call fcn.00516102
add esp, 0x10
test eax, eax
je 0x42b8ac
push str.Cannot_seek_to_data_position
lea esi, [esp + 0x28]
call fcn.00403350
mov byte [esp + 0x50], 1
push 0x105
mov ecx, str.srcBlobStorage.cpp
mov eax, esi
call fcn.004025bc
push dword [esi + 0x40]
mov ebx, dword [ebx]
push 1
push ebx
mov ebx, dword [esp + 0x18]
push ebx
call fcn.00516686
add esp, 0x10
cmp eax, 1
je 0x42b8e7
push str.Cannot_read_blob_data
lea esi, [esp + 0x28]
call fcn.00403350
mov byte [esp + 0x50], 2
push 0x109
mov ecx, str.srcBlobStorage.cpp
mov eax, esi
jmp 0x42b8a7
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea eax, [esp + 0xc]
cmp edi, eax
je 0x42b91e
mov esi, edi
call fcn.004e7046
mov eax, dword [esp + 0x10]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea esi, [esp + 0xc]
call fcn.004e7046
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret 4
Function at 0x42d6bd
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55eff9
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
push 0x190
mov esi, ecx
push 0
push esi
call fcn.00517bf0
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x42d772
lea eax, [esp + 0xc]
push eax
call fcn.00403689
mov esi, eax
and dword [esp + 0xd0], 0
push str.WSAStartup_failed_with
push esi
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.00404b9e
lea eax, [esp + 0xa4]
push eax
mov eax, esi
call fcn.004036f3
push 0x1b
mov ecx, 0x58cad4
lea eax, [esp + 0xa8]
mov byte [esp + 0xd4], 1
call fcn.004025bc
mov eax, esi
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret
Function at 0x42d79d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56c656
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
lea ebx, [esp + 0xac]
call fcn.00486c60
and dword [esp + 0x110], 0
lea eax, [esp + 0xc8]
push str..bak
push eax
call fcn.004100e9
pop ecx
pop ecx
push 8
mov byte [esp + 0x114], 1
mov eax, dword [esp + 0xcc]
pop esi
cmp dword [esp + 0xdc], esi
jae 0x42d827
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xc8]
cmp dword [esp + 0xdc], esi
jae 0x42d845
lea ecx, [esp + 0xc8]
mov eax, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x42d85c
lea eax, [esp + 0xac]
push ecx
push eax
call fcn.0051845f
pop ecx
pop ecx
push 3
pop edi
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 4
call fcn.00487ec3
test al, al
je 0x42d881
mov edi, dword [esp + 0x10]
push edi
call fcn.00492b5e
pop ecx
push esi
call fcn.00515827
mov ebx, eax
pop ecx
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x42d8cb
mov byte [esp + 0x110], 3
and dword [ebx + 4], 0
mov dword [ebx], vtable.GFE::FileTraceHandler.0
mov edi, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x42d8c2
lea edi, [esp + 0xac]
mov ecx, ebx
call fcn.00492ea8
jmp 0x42d8cd
xor ebx, ebx
push ebx
mov byte [esp + 0x114], 1
call fcn.00492c50
pop ecx
lea eax, [esp + 0x14]
push eax
call fcn.00403689
mov edi, eax
push str.Running
push edi
mov byte [esp + 0x118], 4
call fcn.00405d65
push 0x58cb50
push edi
call fcn.00405f19
push str._version
push edi
call fcn.00405d65
push 0x58cb74
push edi
call fcn.00405f19
add esp, 0x20
lea eax, [esp + 0xe4]
push eax
mov eax, edi
call fcn.004036f3
mov byte [esp + 0x110], 5
mov eax, dword [esp + 0xe4]
cmp dword [esp + 0xf8], esi
jae 0x42d94d
lea eax, [esp + 0xe4]
push eax
push 3
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe8]
call fcn.0040412d
lea eax, [esp + 0x14]
mov byte [esp + 0x110], 1
call fcn.0040262a
push 1
lea esi, [esp + 0xcc]
call fcn.0040412d
push 1
lea esi, [esp + 0xb0]
call fcn.0040412d
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret 4
Function at 0x42d9bd
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x454
mov eax, 0x55757e
call fcn.005239fe
xor eax, eax
mov edi, 0x206
xor ebx, ebx
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov byte [ebp - 0x441], bl
call fcn.00517bf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x42da1e
push str.GetSystemDirectory_failed.
push 2
pop ecx
call fcn.00492cc7
pop ecx
xor al, al
jmp 0x42dbf9
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x44c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x42da43
push str.IsWow64Process_failed.
jmp 0x42da0e
lea eax, [ebp - 0x21c]
push eax
lea esi, [ebp - 0x440]
call fcn.00403350
push str._nvcoproc.bin
mov eax, esi
push eax
mov dword [ebp - 4], ebx
call fcn.0040d9a0
cmp dword [ebp - 0x44c], 1
jne 0x42dbae
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00517bf0
add esp, 0xc
push str.kernel32.dll
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x42dacb
push str.PathCombine_failed.
push 2
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x440]
call fcn.0040412d
jmp 0x42da17
lea eax, [ebp - 0x424]
call fcn.004010fe
mov edi, eax
mov dword [ebp - 0x460], edi
mov byte [ebp - 4], 1
cmp edi, ebx
jne 0x42daed
push str.Failed_to_load_kernel32.dll.
jmp 0x42daae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
call esi
mov dword [ebp - 0x450], eax
cmp eax, ebx
jne 0x42db1f
push str.Wow64RevertWow64FsRedirection_not_supported.
push 2
pop ecx
call fcn.00492cc7
pop ecx
push edi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42dab7
push str.Wow64DisableWow64FsRedirection
push edi
call esi
cmp eax, ebx
jne 0x42db32
push str.Wow64DisableWow64FsRedirection_not_supported.
jmp 0x42db0a
lea ecx, [ebp - 0x448]
push ecx
mov dword [ebp - 0x448], ebx
call eax
cmp eax, 1
jne 0x42dba2
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0049547c
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x454]
call fcn.004957ff
push dword [ebp - 0x448]
mov byte [ebp - 0x441], al
call dword [ebp - 0x450]
test eax, eax
jne 0x42db93
push str.Enabling_back_Wow64_redirection_failed._Exiting.
xor ecx, ecx
call fcn.00492cc7
pop ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 1
call fcn.004954d3
push edi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42dbe4
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0049547c
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x454]
call fcn.004957ff
lea ecx, [ebp - 0x45c]
mov byte [ebp - 0x441], al
mov byte [ebp - 4], bl
call fcn.004954d3
push 1
xor edi, edi
lea esi, [ebp - 0x440]
call fcn.0040412d
mov al, byte [ebp - 0x441]
call fcn.00523a81
ret
Function at 0x43b82b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55b8cd
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x5f7350]
xor eax, esp
mov dword [esp + 0x174], eax
push esi
push edi
mov eax, dword [0x5f7350]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x14], 8
jb 0x43b876
mov eax, dword [edi]
jmp 0x43b878
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43b909
lea eax, [esp + 0xac]
push eax
call fcn.00403689
mov esi, eax
and dword [esp + 0x190], 0
push str.Feedback_erased:
push esi
call fcn.00405d65
push esi
mov ecx, edi
call fcn.00411926
add esp, 0xc
lea eax, [esp + 0x164]
push eax
mov eax, esi
call fcn.004036f3
mov byte [esp + 0x190], 1
cmp dword [esp + 0x178], 8
mov eax, dword [esp + 0x164]
jae 0x43b8e3
lea eax, [esp + 0x164]
push eax
push 3
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x168]
call fcn.0040412d
lea eax, [esp + 0xac]
jmp 0x43b9a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.00403689
mov esi, eax
push str.Cannot_erase_file
push esi
mov dword [esp + 0x198], 2
call fcn.00405d65
push esi
mov ecx, edi
call fcn.00411926
add esp, 0xc
push 0x586990
push esi
call fcn.00405d65
pop ecx
pop ecx
push dword [esp + 0x10]
push esi
call fcn.0041058a
lea eax, [esp + 0x148]
push eax
mov eax, esi
call fcn.004036f3
mov byte [esp + 0x190], 3
cmp dword [esp + 0x15c], 8
mov eax, dword [esp + 0x148]
jae 0x43b986
lea eax, [esp + 0x148]
push eax
push 2
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x14c]
call fcn.0040412d
lea eax, [esp + 0x14]
or dword [esp + 0x190], 0xffffffff
call fcn.0040262a
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.005146df
mov esp, ebp
pop ebp
ret