joyce8/EMBER2024-capa huggingface dataset:
Function at 0x561cc0
Capabilities:
Check if file exists
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73dc21
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x2b4], 0x44
push 0
push eax
call fcn.006e9470
xor eax, eax
mov dword [ebp - 0x220], 0
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
push 0x104
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x561d98
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x561d98
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x561d76
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00426d40
lea ecx, [ebp - 0x260]
call fcn.00650c90
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x561ec5
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
push dword [ebp - 0x250]
cmovae eax, dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
mov edx, dword [ebp - 0x220]
cmovae ecx, dword [ebp - 0x230]
push eax
push 0
call fcn.00457810
add esp, 0xc
cmp eax, 0xffffffff
je 0x561ec5
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
push 0x27
push str.cmd__c_timeout_5__cd_..__rd__s__q__
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00426d40
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
call fcn.0044a2e0
push 1
push 0x79ece0
lea ecx, [ebp - 0x248]
call fcn.0044a2e0
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x2b4]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
lea ecx, [ebp - 0x248]
setne bl
call fcn.00426ce0
jmp 0x561ec7
xor bl, bl
lea ecx, [ebp - 0x260]
call fcn.00426ce0
lea ecx, [ebp - 0x230]
call fcn.00426ce0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
Function at 0x5622d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73dca9
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x799430
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00426d40
push 0xb
push 0x7eee18
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 1
call fcn.0044a2e0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x562354
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x234]
push eax
call fcn.0044a2e0
cmp byte [ebp + 8], 0
je 0x56237b
push 0x10
push str.___edtWorkFlow1
lea ecx, [ebp - 0x234]
call fcn.0044a2e0
push 0x38
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x2a0], 0x3c
push 0
push eax
call fcn.006e9470
xor eax, eax
mov dword [ebp - 0x29c], 0x540
add esp, 0xc
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
push 0x104
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x562406
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5623e4
sub eax, edx
lea ecx, [ebp - 0x24c]
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00426d40
cmp dword [ebp - 0x238], 8
lea eax, [ebp - 0x24c]
lea ecx, [ebp - 0x2ac]
cmovae eax, dword [ebp - 0x24c]
mov dword [ebp - 0x290], eax
call fcn.0065a8b0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x56245a
cmp dword [ebp - 0x2ac], 5
jne 0x56245a
mov eax, dword [ebp - 0x2a8]
cmp eax, 1
je 0x56244e
cmp eax, 2
jne 0x56245a
mov dword [ebp - 0x294], str.open
jmp 0x562464
mov dword [ebp - 0x294], str.runas
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x264]
cmovae eax, dword [ebp - 0x234]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00449230
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 3
call fcn.00651ab0
cmp dword [ebp - 0x250], 8
lea eax, [ebp - 0x264]
mov dword [ebp - 0x284], 0xa
cmovae eax, dword [ebp - 0x264]
xor bl, bl
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 0x268]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x264]
call fcn.00426ce0
lea ecx, [ebp - 0x24c]
call fcn.00426ce0
lea ecx, [ebp - 0x234]
call fcn.00426ce0
lea ecx, [ebp + 0xc]
call fcn.00426ce0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x562540
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73dcf9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
call fcn.005833d0
mov dword [ebp - 4], 0
cmp dword [edi + 0x10], 0
mov dword [ebp - 0x1c], 1
je 0x5625bd
push ecx
mov edx, edi
mov ecx, esi
call fcn.00651b80
mov ecx, esi
call fcn.00652e10
add esp, 4
push ecx
mov edx, ebx
mov ecx, esi
call fcn.00651b80
mov edi, dword [0x87c5b8]
add esp, 4
test edi, edi
je 0x56266d
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x56266d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x56266d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esi + 0x14], 8
mov ebx, eax
mov ecx, esi
jb 0x562619
mov ecx, dword [esi]
push 0
push 0x200080
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x56266d
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x562656
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x56266d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x562666
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x562677
mov eax, dword [esi]
push eax
push str.Extraction:_Extracted_resource_at__s
push 0x799430
push 0x799430
push str.ViewMediatorBase
push 0x799430
push 0xa
call fcn.0056c500
add esp, 0x1c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
Function at 0x56b080
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73e66b
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 4], 0
mov dword [esi], vtable.ATL::CComPolyObject_class_ATL::CAxHostWindow_.0
mov dword [esi + 0x58], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov dword [esi + 0xf0], 0
mov eax, dword [esi + 0xd0]
and dword [esi + 0xa0], 0xffffff40
and eax, 0xfffffffb
or eax, 3
mov dword [esi + 0x20], 0
push 8
mov dword [esi + 0x24], 0
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], 0
call dword [sym.imp.USER32.dll_GetSysColor]
and dword [esi + 0xa0], 0xffffffbf
mov ecx, esi
mov dword [esi + 0xd8], eax
xorps xmm0, xmm0
mov eax, dword [esi + 0xd0]
and eax, 0xffffffaf
mov dword [esi + 0xdc], 0x400
or eax, 0x28
mov dword [esi + 0x98], 0
mov dword [esi + 0xd0], eax
mov eax, dword [ebx + 8]
test eax, eax
movups xmmword [esi + 0x88], xmm0
cmovne ecx, eax
mov dword [esi + 0x9c], 0xcdcdcdcd
mov dword [esi + 0xe8], 4
mov dword [esi + 0xec], 0
mov dword [esi + 0x60], 0
mov byte [esi + 0x64], 1
mov dword [esi + 0xcc], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
movups xmmword [esi + 0xbc], xmm0
mov dword [esi + 8], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.7.0
mov dword [esi + 0x2c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.10.0
mov dword [esi + 0x30], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.1.0
mov dword [esi + 0x34], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.0
mov dword [esi + 0x38], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.2.0
mov dword [esi + 0x3c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.6.0
mov dword [esi + 0x40], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.4.0
mov dword [esi + 0x48], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.9.0
mov dword [esi + 0x4c], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.5.0
mov dword [esi + 0x50], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.3.0
mov dword [esi + 0x54], vtable.ATL::CComContainedObject_class_ATL::CAxHostWindow_.8.0
mov dword [esi + 0x58], ecx
mov dword [ebp - 4], 0
mov ecx, dword [0x87eaac]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x56d760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73eb50
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xf0
call fcn.006d0976
mov esi, eax
mov dword [ebp - 0x10], esi
push 0xf0
push 0
push esi
mov dword [ebp - 4], 0
call fcn.006e9470
mov ecx, dword [edi + 0x14]
add esp, 0x10
mov edx, dword [edi + 4]
mov eax, dword [edi + 0x18]
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
mov dword [esi], vtable.WorkFlowHelper.0
mov byte [esi + 0x1c], 0
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [esi + 0x48], 0
xor ecx, ecx
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 7
mov word [esi + 0x4c], cx
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], 7
mov word [esi + 0x64], cx
mov dword [esi + 0x90], ecx
mov dword [esi + 0x94], 7
mov word [esi + 0x80], cx
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xac], 7
mov word [esi + 0x98], cx
mov dword [esi + 0xc0], ecx
mov dword [esi + 0xc4], 7
mov word [esi + 0xb0], cx
mov dword [esi + 0xd8], ecx
mov dword [esi + 0xdc], 7
mov word [esi + 0xc8], cx
mov dword [esi + 0xe0], ecx
mov dword [esi + 0xe4], ecx
mov byte [ebp - 4], 0xa
mov dword [esi + 0xe8], eax
mov dword [esi + 0xec], edx
call fcn.00663750
mov dword [esi + 0x10], eax
call fcn.00663750
mov dword [esi + 0x14], eax
call fcn.00663750
mov dword [esi + 0x18], eax
mov dword [ebp - 4], 0xffffffff
push 0
mov dword [edi + 0x38], esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5705a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73f0a0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [edi + 4]
mov ecx, dword [edi + 0x1c]
lea eax, [ebp - 0x28]
push eax
call fcn.00576690
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x570711
push ecx
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x28]
call fcn.00653cd0
add esp, 4
test al, al
je 0x5706e2
mov ecx, dword [edi + 0x18]
lea eax, [ebp - 0x58]
push eax
call fcn.00552620
test al, al
jne 0x570651
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Failed_to_initialize_with_config_xml_at:__s
jmp 0x5706f3
push 0x11
xor eax, eax
mov dword [ebp - 0x60], 0
push str.hideProductLaunch
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.00426d40
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.005533d0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 4
call fcn.00426ce0
push 0x799430
lea ecx, [ebp - 0x40]
call fcn.00513340
test al, al
jne 0x5706d8
mov edi, dword [edi + 0x1c]
mov esi, dword [edi + 0x48]
cmp esi, dword [edi + 0x4c]
je 0x5706d8
mov ecx, dword [esi]
lea eax, [ebp - 0x40]
add ecx, 0xe4
cmp ecx, eax
je 0x5706d0
cmp dword [ebp - 0x2c], 8
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00426d40
add esi, 4
cmp esi, dword [edi + 0x4c]
jne 0x5706b0
lea ecx, [ebp - 0x40]
call fcn.00426ce0
jmp 0x570711
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Failed_to_load_file_content_at:__s
push 0x799430
push 0x799430
push str.ApplicationContext
push 0x799430
push 0x28
call fcn.0056c500
add esp, 0x1c
lea ecx, [ebp - 0x58]
call fcn.00426ce0
lea ecx, [ebp - 0x28]
call fcn.00426ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
Function at 0x57a990
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73c510
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
mov bh, 1
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x57aa10
push 0
push 0x799430
lea ecx, [ebp - 0x28]
call fcn.00426d40
lea edx, [ebp - 0x28]
lea ecx, [ebp + 8]
call fcn.006732f0
cmp dword [ebp - 0x18], 0
ja 0x57aa14
xor bl, bl
jmp 0x57aa24
lea ecx, [ebp - 0x28]
call fcn.0066c2d0
mov bl, al
neg bl
sbb bl, bl
and bl, bh
lea ecx, [ebp - 0x28]
call fcn.00426ce0
lea ecx, [ebp + 8]
call fcn.00426ce0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
Function at 0x57eaf0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x740d80
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0067aca0
mov dword [ebp - 0x10], eax
mov ebx, dword [eax + 0x6c]
test ebx, ebx
je 0x57ebea
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x57eb45
mov eax, dword [ecx]
push str.Waiting_for_the_async_thread_to_get_the_task_completed
push ecx
call dword [eax + 0x14]
add esp, 8
mov ecx, dword [ebx + 0x58]
mov dword [ebx], 3
call fcn.00663840
push 0xffffffffffffffff
push dword [ebx + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x57eb86
mov edx, dword [ebx + 4]
test edx, edx
je 0x57eb7b
mov ecx, dword [edx]
push eax
push dword [ebx + 0x4c]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged_or_timeout_occurs._Error____d
push edx
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [ebx + 0x4c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebx + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 4]
mov dword [ebx + 0x4c], 0
test ecx, ecx
je 0x57ebab
mov eax, dword [ecx]
push 0x80e1b0
push ecx
call dword [eax + 0xc]
add esp, 8
mov ecx, dword [ebx + 0x58]
call fcn.00663940
lea ecx, [ebx + 8]
call fcn.0067f4c0
lea eax, [ebx + 0x34]
mov dword [ebx + 0x50], 0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebx + 0x1c]
call fcn.00426ce0
lea ecx, [ebx + 8]
call fcn.004ac800
push 0x5c
push ebx
call fcn.006d0bf7
mov eax, dword [ebp - 0x10]
add esp, 8
cmp dword [0x87d0e8], 0
mov dword [eax + 0x6c], 0
je 0x57ec45
push 0x87e5e8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x87d0e8]
test esi, esi
je 0x57ec3a
mov dword [esi], vtable.AnalyticsFramework::ETSManager.0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, esi
call fcn.0067a350
push 0xe0
push esi
call fcn.006d0bf7
add esp, 8
mov dword [0x87d0e8], 0
push 0x87e5e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x580dc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x741120
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x580f80
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 0x5c]
mov eax, dword [eax + 0x54]
add eax, 0x3c
push eax
call fcn.00449230
push 1
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00580990
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00426ce0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x580e5a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
jmp 0x580e5d
mov al, byte [ebp - 0x41]
test al, al
jne 0x580f04
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 0x5c]
mov eax, dword [eax + 0x54]
add eax, 0x24
push eax
call fcn.00449230
push 1
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.00580990
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x580ec0
mov ecx, eax
call fcn.00426ce0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x40]
call fcn.00426ce0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00426ce0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x580f78
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x580f78
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
movq qword [ebp - 0x34], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push ecx
push 1
sub esp, 0xc
mov byte [ebp - 4], 4
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x28]
call fcn.00653180
add esp, 0x14
mov byte [ebp - 0x41], al
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00449880
cmp byte [ebp - 0x41], 0
jne 0x580f78
push str.Failed_to_delete_Shared_Resources_Directory.
push 0x799430
push 0x799430
push str.ViewMediatorBase
push 0x799430
push 0x28
call fcn.0056c500
add esp, 0x18
lea ecx, [ebp - 0x28]
call fcn.00426ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret