joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4038d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x208
push 0
push eax
call fcn.0042f600
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40393a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403931
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4039a7
mov esi, 0x80004005
jmp 0x4039a7
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x403966
push 1
push 0x44a800
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0040374e
mov esi, eax
test esi, esi
js 0x4039a7
mov esi, 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040379b
mov esi, eax
test esi, esi
js 0x4039a7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x40391a
test edi, edi
je 0x4039a7
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0040229e
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd1f
leave
ret 0xc
Function at 0x40415f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x404230
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40418f
xor esi, esi
jmp 0x404230
cmp eax, 3
je 0x4041a0
push 0
push edi
call fcn.00404238
test eax, eax
jne 0x404188
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x40421d
push 0x5c
mov edx, eax
pop edi
cmp dx, di
jne 0x4041b9
mov ebx, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x4041b2
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x40421d
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.0040415f
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x40422f
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x404219
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x40420a
xor esi, esi
inc esi
jmp 0x40422f
test esi, esi
jle 0x40422f
movzx esi, si
or esi, 0x80070000
jmp 0x40422f
xor esi, esi
jmp 0x40422f
mov esi, 0x80070003
push esi
push 0x72
push str.c:_agent_work66_s_srclibsdutildirutil.cpp
call fcn.004038ba
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x404238
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40425c
test al, 0x10
je 0x40425c
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x404259
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x409a9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409aca
push str.Failed_to_format_variable_string.
jmp 0x409b44
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409b05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409aef
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409aff
cmp esi, 0x80070003
jne 0x409b01
xor esi, esi
xor eax, eax
jmp 0x409b0f
xor eax, eax
xor ecx, ecx
test dl, 0x10
je 0x409b11
inc eax
xor ecx, ecx
test esi, esi
jns 0x409b2a
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409b4c
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408274
mov esi, eax
test esi, esi
jns 0x409b4c
push str.Failed_to_set_variable.
push esi
call fcn.0043fb09
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x409b5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409b92
push str.Failed_to_format_variable_string.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x409c1d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409bb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409bdd
movzx esi, si
or esi, 0x80070000
jmp 0x409bdd
test al, 0x10
je 0x409bd8
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040821a
mov esi, eax
test esi, esi
jns 0x409bdd
push str.Failed_to_set_directory_search_path_variable.
jmp 0x409b85
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x409c06
cmp esi, 0x80070003
je 0x409c06
test esi, esi
jns 0x409c1d
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409c1d
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.0043fff0
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x409c2d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409c5b
push str.Failed_to_format_variable_string.
jmp 0x409cf9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409cd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x409cb8
cmp esi, 3
je 0x409cb8
test esi, esi
je 0x409ccc
jle 0x409c8e
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x409c95
mov esi, 0x80004005
push esi
push 0x28b
push str.c:_agent_work66_s_src_burnengine_search.cpp
call fcn.004038ba
push dword [edi + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.0043fb09
add esp, 0xc
jmp 0x409d01
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0043fff0
add esp, 0x10
xor eax, eax
jmp 0x409cdd
xor eax, eax
xor ecx, ecx
test edx, 0x10
jne 0x409cdf
inc eax
xor ecx, ecx
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408274
mov esi, eax
test esi, esi
jns 0x409d01
push str.Failed_to_set_variable.
push esi
call fcn.0043fb09
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x409d11
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409d47
push str.Failed_to_format_variable_string.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x409dca
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409d93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409d6a
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409db4
cmp esi, 0x80070003
je 0x409db4
test esi, esi
jns 0x409dca
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409dca
test al, 0x10
jne 0x409db4
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040821a
mov esi, eax
test esi, esi
jns 0x409d6a
push str.Failed_to_set_variable_to_file_search_path.
jmp 0x409d3a
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0043fff0
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x40a249
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push eax
mov edi, dword [ebx + 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x40a286
push str.Failed_to_format_key_string.
jmp 0x40a38d
neg edi
lea eax, [ebp - 0xc]
push eax
sbb edi, edi
and edi, 0x100
inc edi
push edi
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.00440823
mov esi, eax
test esi, esi
jns 0x40a2d9
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x40a2c6
push str.Registry_key_not_found._Key___ls
push 2
call fcn.0043fff0
add esp, 0xc
jmp 0x40a36f
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.0043fb09
add esp, 0xc
jmp 0x40a395
xor edi, edi
xor eax, eax
inc edi
cmp dword [ebx + 0x20], eax
je 0x40a373
push eax
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x40a307
push str.Failed_to_format_value_string.
jmp 0x40a38d
xor ecx, ecx
lea eax, [ebp - 0x10]
push ecx
push ecx
push eax
push ecx
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
sub eax, 0
je 0x40a371
dec eax
sub eax, 1
je 0x40a35a
xor eax, eax
test esi, esi
je 0x40a373
jle 0x40a33c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40a343
mov esi, 0x80004005
push esi
push 0x322
push str.c:_agent_work66_s_src_burnengine_search.cpp
call fcn.004038ba
push str.Failed_to_query_registry_key_value.
jmp 0x40a38d
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.0043fff0
add esp, 0x10
xor edi, edi
xor eax, eax
push 0
push eax
push edi
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00408274
mov esi, eax
test esi, esi
jns 0x40a3ac
push str.Failed_to_set_variable.
push esi
call fcn.0043fb09
pop ecx
pop ecx
test esi, esi
jns 0x40a3ac
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.0043fff0
add esp, 0x10
push dword [ebp - 4]
call fcn.0040287d
push dword [ebp - 8]
call fcn.0040287d
cmp dword [ebp - 0xc], 0
je 0x40a3cb
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x40b1d7
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x40b22b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x40b202
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x40b209
mov edi, 0x80004005
push edi
push 0x140
push str.c:_agent_work66_s_src_burnengine_section.cpp
call fcn.004038ba
push str.Failed_to_get_module_handle_to_process.
push edi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x40b378
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x40b254
mov esi, 0x8007000d
push esi
push 0x14a
push str.c:_agent_work66_s_src_burnengine_section.cpp
mov edi, esi
call fcn.004038ba
push str.Failed_to_find_valid_DOS_image_header_in_buffer.
push esi
jmp 0x40b21f
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x40b27e
mov esi, 0x8007000d
push esi
push 0x155
push str.c:_agent_work66_s_src_burnengine_section.cpp
mov edi, esi
call fcn.004038ba
push str.Failed_to_find_valid_NT_image_header_in_buffer.
jmp 0x40b251
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44e178
push ebx
call fcn.0042f8c3
add esp, 0xc
test eax, eax
je 0x40b2c3
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x40b2ea
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x40b2aa
cmp dword [ebx + 4], 0x6e727562
jne 0x40b2aa
cmp dword [ebx + 0x10], 0x34
jae 0x40b308
mov esi, 0x8007000d
push esi
push 0x17a
push str.c:_agent_work66_s_src_burnengine_section.cpp
mov edi, esi
call fcn.004038ba
push dword [ebx + 0x10]
push str.Failed_to_read_section_info__data_to_short:__u
jmp 0x40b332
mov esi, 0x8007000d
push esi
push 0x16e
push str.c:_agent_work66_s_src_burnengine_section.cpp
mov edi, esi
call fcn.004038ba
push str.Failed_to_find_Burn_section.
jmp 0x40b36f
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x40b33d
mov esi, 0x8007000d
push esi
push 0x184
push str.c:_agent_work66_s_src_burnengine_section.cpp
mov edi, esi
call fcn.004038ba
push dword [ebx + 4]
push str.Failed_to_read_section_info__unsupported_version:__08x
push esi
call fcn.0043fb09
add esp, 0xc
jmp 0x40b377
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x40b353
inc ecx
cmp ecx, 4
jne 0x40b342
jmp 0x40b377
mov esi, 0x8007000d
push esi
push 0x18a
push str.c:_agent_work66_s_src_burnengine_section.cpp
mov edi, esi
call fcn.004038ba
push str.Bundle_guid_didnt_match_the_guid_in_the_PE_Header_in_memory.
push esi
call fcn.0043fb09
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x413ad7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0042f600
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x413b75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x413b4c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x413b53
mov esi, 0x80004005
push esi
push 0x28d
push str.c:_agent_work66_s_src_burnenginelogging.cpp
call fcn.004038ba
push str.Failed_to_get_temp_folder.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x413c66
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401ca7
mov esi, eax
test esi, esi
jns 0x413b96
push str.Failed_to_get_length_of_temp_folder.
jmp 0x413b68
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x413c3e
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x453228
push eax
call fcn.00402022
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x413bdd
push str.Failed_to_format_session_id_as_a_string.
jmp 0x413c5d
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.00401ca7
mov esi, eax
test esi, esi
jns 0x413c01
push str.Failed_to_get_length_of_session_id_string.
jmp 0x413c5d
push dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov edi, esi
sub edi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + edi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x413c44
mov esi, edi
jmp 0x413c44
mov esi, dword [ebp - 0x218]
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0040229e
mov esi, eax
test esi, esi
jns 0x413c65
push str.Failed_to_copy_temp_folder.
push esi
call fcn.0043fb09
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x413c7a
push dword [ebp - 0x210]
call fcn.00402762
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd1f
leave
ret 4
Function at 0x4148b9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
and dword [ebp - 0xc], esi
and dword [ebp - 8], esi
and dword [ebp - 4], esi
xor ebx, ebx
push edi
push 0
lea eax, [ebp - 4]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [ebp - 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x41491b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xea
jne 0x414905
xor esi, esi
jmp 0x41491b
cmp esi, 0x6d
je 0x414980
test esi, esi
jle 0x414919
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x414961
add ebx, dword [ebp - 4]
cmp ebx, 8
jb 0x4148cf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edi], ecx
mov dword [edi + 4], eax
test eax, eax
je 0x4149e2
push 0
push eax
call fcn.004039df
mov dword [edi + 0xc], eax
test eax, eax
jne 0x41498f
mov esi, 0x8007000e
push esi
push 0x323
push str.c:_agent_work66_s_src_burnenginepipe.cpp
call fcn.004038ba
push str.Failed_to_allocate_data_for_message.
jmp 0x414976
push esi
push 0x318
push str.c:_agent_work66_s_src_burnenginepipe.cpp
call fcn.004038ba
push str.Failed_to_read_message_from_pipe.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x4149e2
xor ecx, ecx
xor eax, eax
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
inc esi
jmp 0x414929
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi + 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4149db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4149bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4149c4
mov esi, 0x80004005
push esi
push 0x327
push str.c:_agent_work66_s_src_burnenginepipe.cpp
call fcn.004038ba
push str.Failed_to_read_data_for_message.
jmp 0x414976
mov dword [edi + 8], 1
cmp dword [edi + 8], 0
jne 0x4149f6
cmp dword [edi + 0xc], 0
je 0x4149f6
push dword [edi + 0xc]
call fcn.00403aa4
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4149ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004145ce
mov esi, eax
test esi, esi
jns 0x414a31
push str.Failed_to_allocate_message_to_write.
jmp 0x414a92
mov dword [ebp + 0x14], edi
cmp dword [ebp - 4], edi
jbe 0x414a9a
push 0
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
sub eax, edi
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414a5f
add edi, dword [ebp + 0x14]
cmp edi, dword [ebp - 4]
jb 0x414a39
jmp 0x414a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x414a76
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x414a7d
mov esi, 0x80004005
push esi
push 0x2f0
push str.c:_agent_work66_s_src_burnenginepipe.cpp
call fcn.004038ba
push str.Failed_to_write_message_type_to_pipe.
push esi
call fcn.0043fb09
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x414aa8
push dword [ebp - 8]
call fcn.00403aa4
pop edi
mov eax, esi
pop esi
leave
ret 0x10