joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100111d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x30
mov eax, 4
mov dword [ebp - 0x14], eax
call fcn.1000f340
mov eax, esp
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, ecx
call fcn.1000f340
mov eax, esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [0x1008c0a0], 0x252d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [0x1008c0a4]
add eax, 0x253
mov dword [0x1008c0a0], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x10011273
jmp 0x1001126c
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
movzx ecx, word [ecx + esi*2 - 0x14]
cmp ecx, 0x64
je 0x1001135e
jmp 0x1001123e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
add ecx, 1
mov dword [eax], ecx
jmp 0x10011273
jmp 0x100113c5
jmp 0x100112e5
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
jl 0x100112c2
jmp 0x100112e5
mov dword [0x1008c0a0], 0x23b8
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
movzx ecx, word [ecx + esi*2 - 0xe]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x6c
je 0x100113ab
jmp 0x100113be
mov dword [0x1008c0a0], 0xbea
jmp 0x1001125d
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
movzx ecx, word [ecx + esi*2]
cmp ecx, 0
sete bl
mov byte [ebp - 0x25], bl
mov al, byte [ebp - 0x25]
test al, 1
jne 0x10011271
jmp 0x100112b6
mov dword [0x1008c0a4], 0x1ac
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
movzx ecx, word [ecx + esi*2 - 0x1a]
cmp ecx, 0x6c
jne 0x100113c7
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
shl esi, 1
add ecx, esi
add ecx, 0xffffffe8
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
cmp ecx, 0x6f
jne 0x100113c5
mov dword [0x1008c0a4], 0x198f
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
movzx ecx, word [ecx + esi*2 - 0x16]
cmp ecx, 0x61
je 0x10011240
jmp 0x1001126c
mov eax, dword [0x1008c0a0]
sub eax, 0x1325
mov dword [0x1008c0a0], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
movzx ecx, word [ecx + esi*2 - 0x12]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp eax, 0x64
jne 0x100113c0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx]
movzx ecx, word [ecx + esi*2 - 0x10]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x6c
je 0x10011287
jmp 0x100113be
mov dword [0x1008c0a4], 0xc8
mov dword [ebp - 0xc], 1
jmp 0x100113ce
jmp 0x100113c0
jmp 0x1001123e
jmp 0x100113c7
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x100115d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.100115d0]
mov dword [ebp - 8], eax
jmp 0x10011603
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
jne 0x1001161e
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1001164a
mov al, 1
test al, 1
jne 0x10011603
jmp 0x10011641
mov eax, dword [ebp - 8]
mov cx, word [eax]
mov word [ebp - 0xa], cx
mov ax, word [ebp - 0xa]
movzx ecx, ax
cmp ecx, 0x5a4d
je 0x100115e1
jmp 0x10011620
jmp 0x10011620
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x1008c0a0]
sub eax, 0x362
mov dword [0x1008c0a0], eax
jmp 0x100115fb
mov dword [ebp - 4], 0
jmp 0x1001164a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret
Function at 0x40386f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x208
push 0
push eax
call fcn.0042f8b0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4038d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4038cf
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403945
mov esi, 0x80004005
jmp 0x403945
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x403904
push 1
push 0x44b7a0
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004036e8
mov esi, eax
test esi, esi
js 0x403945
mov esi, 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00403737
mov esi, eax
test esi, esi
js 0x403945
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x4038b8
test edi, edi
je 0x403945
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0040221f
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dfc6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4040a1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40416b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4040d1
xor esi, esi
jmp 0x40416b
cmp eax, 3
je 0x4040e2
push 0
push edi
call fcn.00404173
test eax, eax
jne 0x4040ca
movzx ecx, word [edi]
mov eax, edi
push ebx
xor ebx, ebx
test cx, cx
je 0x404158
push 0x5c
pop edx
cmp cx, dx
jne 0x4040f9
mov ebx, eax
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4040f2
test ebx, ebx
je 0x404158
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.004040a1
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x40416a
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x404154
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x404145
xor esi, esi
inc esi
jmp 0x40416a
test esi, esi
jle 0x40416a
movzx esi, si
or esi, 0x80070000
jmp 0x40416a
xor esi, esi
jmp 0x40416a
mov esi, 0x80070003
push esi
push 0x72
push str.dirutil.cpp
call fcn.00403858
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x404173
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404197
test al, 0x10
je 0x404197
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x404194
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x409a6f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072ae
mov esi, eax
test esi, esi
jns 0x409a9a
push str.Failed_to_format_variable_string.
jmp 0x409b14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409ad5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409abf
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409acf
cmp esi, 0x80070003
jne 0x409ad1
xor esi, esi
xor eax, eax
jmp 0x409adf
xor eax, eax
xor ecx, ecx
test dl, 0x10
je 0x409ae1
inc eax
xor ecx, ecx
test esi, esi
jns 0x409afa
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0044041e
add esp, 0x10
jmp 0x409b1c
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408227
mov esi, eax
test esi, esi
jns 0x409b1c
push str.Failed_to_set_variable.
push esi
call fcn.0044041e
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00402815
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x409b2e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072ae
mov esi, eax
test esi, esi
jns 0x409b64
push str.Failed_to_format_variable_string.
push esi
call fcn.0044041e
pop ecx
pop ecx
jmp 0x409bef
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409b89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409baf
movzx esi, si
or esi, 0x80070000
jmp 0x409baf
test al, 0x10
je 0x409baa
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004081cb
mov esi, eax
test esi, esi
jns 0x409baf
push str.Failed_to_set_directory_search_path_variable.
jmp 0x409b57
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x409bd8
cmp esi, 0x80070003
je 0x409bd8
test esi, esi
jns 0x409bef
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0044041e
add esp, 0x10
jmp 0x409bef
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.0044090d
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.00402815
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x409c01
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072ae
mov esi, eax
test esi, esi
jns 0x409c2f
push str.Failed_to_format_variable_string.
jmp 0x409ccd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x409c8c
cmp esi, 3
je 0x409c8c
test esi, esi
je 0x409ca0
jle 0x409c62
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x409c69
mov esi, 0x80004005
push esi
push 0x28b
push str.search.cpp
call fcn.00403858
push dword [edi + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.0044041e
add esp, 0xc
jmp 0x409cd5
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0044090d
add esp, 0x10
xor eax, eax
jmp 0x409cb1
xor eax, eax
xor ecx, ecx
test edx, 0x10
jne 0x409cb3
inc eax
xor ecx, ecx
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408227
mov esi, eax
test esi, esi
jns 0x409cd5
push str.Failed_to_set_variable.
push esi
call fcn.0044041e
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00402815
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x409ce7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072ae
mov esi, eax
test esi, esi
jns 0x409d1d
push str.Failed_to_format_variable_string.
push esi
call fcn.0044041e
pop ecx
pop ecx
jmp 0x409da0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409d69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409d40
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409d8a
cmp esi, 0x80070003
je 0x409d8a
test esi, esi
jns 0x409da0
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.0044041e
add esp, 0x10
jmp 0x409da0
test al, 0x10
jne 0x409d8a
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004081cb
mov esi, eax
test esi, esi
jns 0x409d40
push str.Failed_to_set_variable_to_file_search_path.
jmp 0x409d10
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0044090d
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.00402815
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40a227
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push eax
mov edi, dword [ebx + 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
push dword [ebp + 0xc]
call fcn.004072ae
mov esi, eax
test esi, esi
jns 0x40a26c
push str.Failed_to_format_key_string.
push esi
call fcn.0044041e
pop ecx
pop ecx
jmp 0x40a371
neg edi
lea eax, [ebp - 0xc]
push eax
sbb edi, edi
and edi, 0x100
inc edi
push edi
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.00441153
mov esi, eax
test esi, esi
js 0x40a327
xor edi, edi
inc edi
cmp dword [ebx + 0x20], 0
je 0x40a343
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.004072ae
mov esi, eax
test esi, esi
jns 0x40a2bc
push str.Failed_to_format_value_string.
jmp 0x40a25f
xor ecx, ecx
lea eax, [ebp - 0x10]
push ecx
push ecx
push eax
push ecx
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
sub eax, 0
je 0x40a343
dec eax
sub eax, 1
je 0x40a310
test esi, esi
je 0x40a343
jle 0x40a2ef
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40a2f6
mov esi, 0x80004005
push esi
push 0x322
push str.search.cpp
call fcn.00403858
push str.Failed_to_query_registry_key_value.
jmp 0x40a25f
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.0044090d
add esp, 0x10
jmp 0x40a341
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x40a363
push str.Registry_key_not_found._Key___ls
push 2
call fcn.0044090d
add esp, 0xc
xor edi, edi
push 0
push 0
push edi
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00408227
mov esi, eax
test esi, esi
jns 0x40a388
push str.Failed_to_set_variable.
jmp 0x40a25f
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.0044041e
add esp, 0xc
test esi, esi
jns 0x40a388
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.0044090d
add esp, 0x10
push dword [ebp - 4]
call fcn.00402815
push dword [ebp - 8]
call fcn.00402815
cmp dword [ebp - 0xc], 0
je 0x40a3a7
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b1a4
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x40b1f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x40b1cf
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x40b1d6
mov edi, 0x80004005
push edi
push 0x140
push str.section.cpp
call fcn.00403858
push str.Failed_to_get_module_handle_to_process.
push edi
call fcn.0044041e
pop ecx
pop ecx
jmp 0x40b345
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x40b221
mov esi, 0x8007000d
push esi
push 0x14a
push str.section.cpp
mov edi, esi
call fcn.00403858
push str.Failed_to_find_valid_DOS_image_header_in_buffer.
push esi
jmp 0x40b1ec
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x40b24b
mov esi, 0x8007000d
push esi
push 0x155
push str.section.cpp
mov edi, esi
call fcn.00403858
push str.Failed_to_find_valid_NT_image_header_in_buffer.
jmp 0x40b21e
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44f01c
push ebx
call fcn.0042fb59
add esp, 0xc
test eax, eax
je 0x40b290
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x40b2b7
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x40b277
cmp dword [ebx + 4], 0x6e727562
jne 0x40b277
cmp dword [ebx + 0x10], 0x34
jae 0x40b2d5
mov esi, 0x8007000d
push esi
push 0x17a
push str.section.cpp
mov edi, esi
call fcn.00403858
push dword [ebx + 0x10]
push str.Failed_to_read_section_info__data_to_short:__u
jmp 0x40b2ff
mov esi, 0x8007000d
push esi
push 0x16e
push str.section.cpp
mov edi, esi
call fcn.00403858
push str.Failed_to_find_Burn_section.
jmp 0x40b33c
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x40b30a
mov esi, 0x8007000d
push esi
push 0x184
push str.section.cpp
mov edi, esi
call fcn.00403858
push dword [ebx + 4]
push str.Failed_to_read_section_info__unsupported_version:__08x
push esi
call fcn.0044041e
add esp, 0xc
jmp 0x40b344
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x40b320
inc ecx
cmp ecx, 4
jne 0x40b30f
jmp 0x40b344
mov esi, 0x8007000d
push esi
push 0x18a
push str.section.cpp
mov edi, esi
call fcn.00403858
push str.Bundle_guid_didnt_match_the_guid_in_the_PE_Header_in_memory.
push esi
call fcn.0044041e
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x413aee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0042f8b0
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x413b8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x413b63
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x413b6a
mov esi, 0x80004005
push esi
push 0x28d
push str.logging.cpp
call fcn.00403858
push str.Failed_to_get_temp_folder.
push esi
call fcn.0044041e
pop ecx
pop ecx
jmp 0x413c7d
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401c6f
mov esi, eax
test esi, esi
jns 0x413bad
push str.Failed_to_get_length_of_temp_folder.
jmp 0x413b7f
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x413c55
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x453f98
push eax
call fcn.00401f9d
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x413bf4
push str.Failed_to_format_session_id_as_a_string.
jmp 0x413c74
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.00401c6f
mov esi, eax
test esi, esi
jns 0x413c18
push str.Failed_to_get_length_of_session_id_string.
jmp 0x413c74
push dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov edi, esi
sub edi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + edi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x413c5b
mov esi, edi
jmp 0x413c5b
mov esi, dword [ebp - 0x218]
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0040221f
mov esi, eax
test esi, esi
jns 0x413c7c
push str.Failed_to_copy_temp_folder.
push esi
call fcn.0044041e
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x413c91
push dword [ebp - 0x210]
call fcn.004026e8
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dfc6
mov esp, ebp
pop ebp
ret 4
Function at 0x4148cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
and dword [ebp - 0xc], esi
and dword [ebp - 8], esi
and dword [ebp - 4], esi
xor ebx, ebx
push edi
push 0
lea eax, [ebp - 4]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [ebp - 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x414931
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xea
jne 0x41491b
xor esi, esi
jmp 0x414931
cmp esi, 0x6d
je 0x414996
test esi, esi
jle 0x41492f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x414977
add ebx, dword [ebp - 4]
cmp ebx, 8
jb 0x4148e5
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edi], ecx
mov dword [edi + 4], eax
test eax, eax
je 0x4149f8
push 0
push eax
call fcn.0040395a
mov dword [edi + 0xc], eax
test eax, eax
jne 0x4149a5
mov esi, 0x8007000e
push esi
push 0x323
push str.pipe.cpp
call fcn.00403858
push str.Failed_to_allocate_data_for_message.
jmp 0x41498c
push esi
push 0x318
push str.pipe.cpp
call fcn.00403858
push str.Failed_to_read_message_from_pipe.
push esi
call fcn.0044041e
pop ecx
pop ecx
jmp 0x4149f8
xor ecx, ecx
xor eax, eax
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
inc esi
jmp 0x41493f
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi + 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4149f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4149d3
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4149da
mov esi, 0x80004005
push esi
push 0x327
push str.pipe.cpp
call fcn.00403858
push str.Failed_to_read_data_for_message.
jmp 0x41498c
mov dword [edi + 8], 1
cmp dword [edi + 8], 0
jne 0x414a0c
cmp dword [edi + 0xc], 0
je 0x414a0c
push dword [edi + 0xc]
call fcn.00403a21
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x414a17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004145e2
mov esi, eax
test esi, esi
jns 0x414a49
push str.Failed_to_allocate_message_to_write.
jmp 0x414aaa
mov dword [ebp + 0x14], edi
cmp dword [ebp - 4], edi
jbe 0x414ab2
push 0
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
sub eax, edi
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414a77
add edi, dword [ebp + 0x14]
cmp edi, dword [ebp - 4]
jb 0x414a51
jmp 0x414ab2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x414a8e
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x414a95
mov esi, 0x80004005
push esi
push 0x2f0
push str.pipe.cpp
call fcn.00403858
push str.Failed_to_write_message_type_to_pipe.
push esi
call fcn.0044041e
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x414ac0
push dword [ebp - 8]
call fcn.00403a21
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10