joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a471
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edx
inc edi
mov dword [ebp - 8], edx
cmp dword [ebx + 0x24], edx
mov ecx, 0x101
mov eax, edi
mov dword [ebp - 0xc], edx
cmovne eax, ecx
mov dword [ebp - 0x10], edx
push edx
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
push dword [ebp + 0xc]
call fcn.004074f2
mov esi, eax
test esi, esi
jns 0x40a4c6
push str.Failed_to_format_key_string.
push esi
call fcn.00440564
pop ecx
pop ecx
jmp 0x40a5c6
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.0044127b
mov esi, eax
test esi, esi
js 0x40a57a
cmp dword [ebx + 0x20], 0
je 0x40a596
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.004074f2
mov esi, eax
test esi, esi
jns 0x40a50a
push str.Failed_to_format_value_string.
jmp 0x40a4b9
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub ecx, 0
je 0x40a596
dec ecx
sub ecx, 1
je 0x40a563
test eax, eax
je 0x40a596
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x322
push str.search.cpp
call fcn.00403b3b
push str.Failed_to_query_registry_key_value.
jmp 0x40a4b9
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.00440a4f
add esp, 0x10
jmp 0x40a594
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x40a5b8
push str.Registry_key_not_found._Key___ls
push 2
call fcn.00440a4f
add esp, 0xc
xor edi, edi
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00408475
mov esi, eax
test esi, esi
jns 0x40a5dd
push str.Failed_to_set_variable.
jmp 0x40a4b9
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.00440564
add esp, 0xc
test esi, esi
jns 0x40a5dd
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.00440a4f
add esp, 0x10
push dword [ebp - 4]
call fcn.00402a9c
push dword [ebp - 8]
call fcn.00402a9c
cmp dword [ebp - 0xc], 0
je 0x40a5fc
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b3fa
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x40b44e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
push edi
push 0x140
push str.section.cpp
call fcn.00403b3b
push str.Failed_to_get_module_handle_to_process.
push edi
call fcn.00440564
pop ecx
pop ecx
jmp 0x40b59b
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x40b477
mov esi, 0x8007000d
push esi
push 0x14a
push str.section.cpp
mov edi, esi
call fcn.00403b3b
push str.Failed_to_find_valid_DOS_image_header_in_buffer.
push esi
jmp 0x40b442
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x40b4a1
mov esi, 0x8007000d
push esi
push 0x155
push str.section.cpp
mov edi, esi
call fcn.00403b3b
push str.Failed_to_find_valid_NT_image_header_in_buffer.
jmp 0x40b474
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44efe4
push ebx
call fcn.0042fac8
add esp, 0xc
test eax, eax
je 0x40b4e6
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x40b50d
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x40b4cd
cmp dword [ebx + 4], 0x6e727562
jne 0x40b4cd
cmp dword [ebx + 0x10], 0x34
jae 0x40b52b
mov esi, 0x8007000d
push esi
push 0x17a
push str.section.cpp
mov edi, esi
call fcn.00403b3b
push dword [ebx + 0x10]
push str.Failed_to_read_section_info__data_to_short:__u
jmp 0x40b555
mov esi, 0x8007000d
push esi
push 0x16e
push str.section.cpp
mov edi, esi
call fcn.00403b3b
push str.Failed_to_find_Burn_section.
jmp 0x40b592
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x40b560
mov esi, 0x8007000d
push esi
push 0x184
push str.section.cpp
mov edi, esi
call fcn.00403b3b
push dword [ebx + 4]
push str.Failed_to_read_section_info__unsupported_version:__08x
push esi
call fcn.00440564
add esp, 0xc
jmp 0x40b59a
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x40b576
inc ecx
cmp ecx, 4
jne 0x40b565
jmp 0x40b59a
mov esi, 0x8007000d
push esi
push 0x18a
push str.section.cpp
mov edi, esi
call fcn.00403b3b
push str.Bundle_guid_didnt_match_the_guid_in_the_PE_Header_in_memory.
push esi
call fcn.00440564
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x413cf1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0042f820
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x413d8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x271
push str.logging.cpp
call fcn.00403b3b
push str.Failed_to_get_temp_folder.
push esi
call fcn.00440564
pop ecx
pop ecx
jmp 0x413e7c
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401eca
mov esi, eax
test esi, esi
jns 0x413db0
push str.Failed_to_get_length_of_temp_folder.
jmp 0x413d82
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x413e54
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x453e34
push eax
call fcn.00402232
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x413df4
push str.Failed_to_format_session_id_as_a_string.
jmp 0x413e73
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.00401eca
mov esi, eax
test esi, esi
jns 0x413e18
push str.Failed_to_get_length_of_session_id_string.
jmp 0x413e73
push dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov esi, edi
sub esi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + esi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
cmove edi, esi
jmp 0x413e5a
mov edi, dword [ebp - 0x218]
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004024b5
mov esi, eax
test esi, esi
jns 0x413e7b
push str.Failed_to_copy_temp_folder.
push esi
call fcn.00440564
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x413e90
push dword [ebp - 0x210]
call fcn.0040296f
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042df6e
mov esp, ebp
pop ebp
ret 4
Function at 0x414a2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
and dword [ebp - 0xc], esi
and dword [ebp - 8], esi
and dword [ebp - 4], esi
xor ebx, ebx
push edi
push 0
lea eax, [ebp - 4]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [ebp - 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x414a8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x414a77
xor esi, esi
jmp 0x414a8e
cmp eax, 0x6d
je 0x414af3
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x414ad4
add ebx, dword [ebp - 4]
cmp ebx, 8
jb 0x414a44
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edi], ecx
mov dword [edi + 4], eax
test eax, eax
je 0x414b55
push 0
push eax
call fcn.00403c3c
mov dword [edi + 0xc], eax
test eax, eax
jne 0x414b02
mov esi, 0x8007000e
push esi
push 0x323
push str.pipe.cpp
call fcn.00403b3b
push str.Failed_to_allocate_data_for_message.
jmp 0x414ae9
push esi
push 0x318
push str.pipe.cpp
call fcn.00403b3b
push str.Failed_to_read_message_from_pipe.
push esi
call fcn.00440564
pop ecx
pop ecx
jmp 0x414b55
xor ecx, ecx
xor eax, eax
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
inc esi
jmp 0x414a9c
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi + 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414b4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x327
push str.pipe.cpp
call fcn.00403b3b
push str.Failed_to_read_data_for_message.
jmp 0x414ae9
mov dword [edi + 8], 1
cmp dword [edi + 8], 0
jne 0x414b69
cmp dword [edi + 0xc], 0
je 0x414b69
push dword [edi + 0xc]
call fcn.00403d03
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x414b74
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00414740
mov esi, eax
test esi, esi
jns 0x414ba6
push str.Failed_to_allocate_message_to_write.
jmp 0x414c07
mov dword [ebp + 0x14], edi
cmp dword [ebp - 4], edi
jbe 0x414c0f
push 0
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
sub eax, edi
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414bd4
add edi, dword [ebp + 0x14]
cmp edi, dword [ebp - 4]
jb 0x414bae
jmp 0x414c0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2f0
push str.pipe.cpp
call fcn.00403b3b
push str.Failed_to_write_message_type_to_pipe.
push esi
call fcn.00440564
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x414c1d
push dword [ebp - 8]
call fcn.00403d03
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x414fdc
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebp + 0xc], ebx
jne 0x415063
push ebx
lea eax, [ebp - 8]
push eax
push 1
push str.D:_A__GA___SY__A__GA___BA__A__GRGW0x00100000___WD_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x415053
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x116
push str.pipe.cpp
call fcn.00403b3b
push str.Failed_to_create_the_security_descriptor_for_the_connection_event_and_pipe.
push esi
call fcn.00440564
pop ecx
pop ecx
jmp 0x41519e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push dword [edi]
push str..pipe_ls
push eax
call fcn.00402232
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x415094
push dword [edi]
push str.Failed_to_allocate_full_name_of_pipe:__ls
push esi
call fcn.00440564
add esp, 0xc
jmp 0x41519e
xor ecx, ecx
lea eax, [ebp - 0x18]
cmp dword [ebp - 8], ecx
cmove eax, ecx
push eax
push 1
mov eax, 0x10000
push eax
push eax
push 1
push ebx
push 0x80003
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4150f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x126
push str.pipe.cpp
call fcn.00403b3b
push dword [ebp - 4]
push str.Failed_to_create_pipe:__ls
jmp 0x415086
cmp dword [ebp + 0xc], 0
je 0x41518f
push dword [edi]
lea eax, [ebp - 4]
push str..pipe_ls.Cache
push eax
call fcn.00402232
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x415125
push dword [edi]
push str.Failed_to_allocate_full_name_of_cache_pipe:__ls
jmp 0x41517d
push 0
push 1
mov eax, 0x10000
push eax
push eax
push 1
push 0
push 0x80003
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
jne 0x415192
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x132
push str.pipe.cpp
call fcn.00403b3b
push dword [ebp - 4]
push str.Failed_to_create_pipe:__ls
push esi
call fcn.00440564
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41519e
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], ebx
and dword [eax], 0
cmp dword [ebp - 4], 0
je 0x4151ac
push dword [ebp - 4]
call fcn.0040296f
cmp dword [ebp - 8], 0
je 0x4151bb
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418397
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x25c]
push esi
push edi
push 0x208
push 0
push eax
call fcn.0042f820
xor eax, eax
lea edi, [ebp - 0x26c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x46aad4]
test eax, eax
jne 0x4184aa
lea eax, [ebp - 0x25c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41842d
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x45b
push str.cache.cpp
call fcn.00403b3b
push str.Failed_to_get_temp_path_for_working_folder.
jmp 0x4184be
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov esi, eax
or esi, 1
jge 0x418448
push str.Failed_to_create_working_folder_guid.
jmp 0x4184be
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x41847b
mov esi, 0x8007000e
push esi
push 0x465
push str.cache.cpp
call fcn.00403b3b
push str.Failed_to_convert_working_folder_guid_into_string.
jmp 0x4184be
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x25c]
push eax
push str._ls_ls_
push 0x46aad4
call fcn.00402232
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x4184a5
push str.Failed_to_append_bundle_id_on_to_temp_path_for_working_folder.
jmp 0x4184be
mov eax, dword [0x46aad4]
push 0
push eax
push ebx
call fcn.004024b5
mov esi, eax
test esi, esi
jns 0x4184c6
push str.Failed_to_copy_working_folder_path.
push esi
call fcn.00440564
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042df6e
mov esp, ebp
pop ebp
ret 8
Function at 0x418e1f
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov eax, 0x20000004
push esi
push edi
mov edi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 8], ebx
je 0x418eb1
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.004182ec
mov esi, eax
test esi, esi
jns 0x418e62
push str.Failed_to_allocate_administrator_SID.
push esi
call fcn.00440564
mov edi, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x418eda
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x418ea9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x5f1
push str.cache.cpp
call fcn.00403b3b
push str.Failed_to_initialize_ACL.
jmp 0x418e55
mov edi, dword [ebp - 4]
mov eax, 0x20000005
push 0x7d0
push 3
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push edi
push eax
push 1
push dword [ebp + 0xc]
call fcn.004458fe
push 0x80
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test edi, edi
je 0x418ee4
push edi
call fcn.00403d03
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x419b78
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x250
push eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x254]
push eax
call fcn.0042f820
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push str..unverified
push dword [ebp + 8]
call fcn.0041a3c3
test eax, eax
js 0x419bd9
push 7
push dword [ebp - 0x258]
call fcn.00403f2e
cmp dword [ebp + 8], 0
jne 0x419cc0
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 0xc]
call fcn.00418397
test eax, eax
js 0x419cc0
lea eax, [ebp - 0x260]
push eax
push 0x44b830
push dword [ebp - 0x258]
call fcn.00403084
test eax, eax
js 0x419cc0
push esi
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x419cbf
test byte [ebp - 0x254], 0x10
jne 0x419ca6
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jbe 0x419c7e
push 0x2e
pop ecx
cmp cx, word [ebp + eax*2 - 0x22c]
jne 0x419c7e
movzx eax, word [ebp + eax*2 - 0x22a]
push 0x52
pop ecx
cmp cx, ax
je 0x419ca6
push 0x72
pop ecx
cmp cx, ax
je 0x419ca6
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
call fcn.00403084
test eax, eax
js 0x419ca6
push dword [ebp - 0x25c]
call fcn.00444433
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x419c38
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp dword [ebp - 0x25c], 0
je 0x419cd4
push dword [ebp - 0x25c]
call fcn.0040296f
cmp dword [ebp - 0x260], 0
je 0x419ce8
push dword [ebp - 0x260]
call fcn.0040296f
cmp dword [ebp - 0x258], 0
je 0x419cfc
push dword [ebp - 0x258]
call fcn.0040296f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df6e
mov esp, ebp
pop ebp
ret 8
Function at 0x41d252
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x2c
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.0042f820
push 0x2c
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.0042f820
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x2c]
mov edi, dword [ebp + 0x24]
mov esi, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x34], ecx
xor ecx, ecx
push ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
push ecx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x60]
push eax
push 0x41ad76
push ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0x20]
push ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x41d339
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x45c
push str.elevation.cpp
call fcn.00403b3b
push str.Failed_to_create_elevated_cache_thread.
push esi
call fcn.00440564
pop ecx
pop ecx
jmp 0x41d383
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x41c7d4
push dword [ebp + 0xc]
call fcn.004152a7
mov esi, eax
test esi, esi
jns 0x41d363
push str.Failed_to_pump_messages_in_child_process.
push esi
call fcn.00440564
pop ecx
pop ecx
jmp 0x41d37c
push dword [ebp - 8]
push edi
call fcn.0041cf2c
mov ecx, dword [ebp + 0x38]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x38
Function at 0x41e62c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x41e694
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x39
push str.splashscreen.cpp
call fcn.00403b3b
push str.Failed_to_create_modal_event.
push esi
call fcn.00440564
pop ecx
pop ecx
jmp 0x41e707
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x41e3af
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
test eax, eax
jne 0x41e6f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x42
push str.splashscreen.cpp
call fcn.00403b3b
push str.Failed_to_create_UI_thread.
jmp 0x41e68a
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x41e71a
push dword [ebp - 8]
call esi
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x41e724
push dword [ebp - 0xc]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc