joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b79a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.00408feb
mov esi, eax
test esi, esi
jns 0x40b7c7
push str.Failed_to_format_variable_string.
jmp 0x40b83b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40b7fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x40b7f9
cmp esi, 0x80070003
jne 0x40b805
xor esi, esi
jmp 0x40b805
test al, 0x10
push 1
pop eax
cmovne edi, eax
test esi, esi
jns 0x40b81e
push dword [ebp - 4]
push dword [ebx]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00430fd9
add esp, 0x10
jmp 0x40b843
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00409f60
mov esi, eax
test esi, esi
jns 0x40b843
push str.Failed_to_set_variable.
push esi
call fcn.00430fd9
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.004028d4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40b856
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00408feb
mov esi, eax
test esi, esi
jns 0x40b881
push str.Failed_to_format_variable_string.
jmp 0x40b8c4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40b8a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x40b8d3
test al, 0x10
je 0x40b8ce
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00409f04
mov esi, eax
test esi, esi
jns 0x40b8d3
push str.Failed_to_set_directory_search_path_variable.
push esi
call fcn.00430fd9
pop ecx
pop ecx
jmp 0x40b913
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x40b8fc
cmp esi, 0x80070003
je 0x40b8fc
test esi, esi
jns 0x40b913
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00430fd9
add esp, 0x10
jmp 0x40b913
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.004314b2
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.004028d4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40b925
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.00408feb
mov esi, eax
test esi, esi
jns 0x40b955
push str.Failed_to_format_variable_string.
jmp 0x40b9ed
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40b9c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40b9b2
cmp eax, 3
je 0x40b9b2
test eax, eax
je 0x40b9d0
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28b
push str.search.cpp
call fcn.00403a8b
push dword [ebx + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.00430fd9
add esp, 0xc
jmp 0x40b9f5
push dword [ebp - 4]
push dword [ebx]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.004314b2
add esp, 0x10
jmp 0x40b9d0
test al, 0x10
push 1
pop eax
cmove edi, eax
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00409f60
mov esi, eax
test esi, esi
jns 0x40b9f5
push str.Failed_to_set_variable.
push esi
call fcn.00430fd9
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.004028d4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40ba08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00408feb
mov esi, eax
test esi, esi
jns 0x40ba33
push str.Failed_to_format_variable_string.
jmp 0x40ba9d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40ba7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x40baa7
cmp esi, 0x80070003
je 0x40baa7
test esi, esi
jns 0x40babd
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.00430fd9
add esp, 0x10
jmp 0x40babd
test al, 0x10
jne 0x40baa7
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00409f04
mov esi, eax
test esi, esi
jns 0x40ba55
push str.Failed_to_set_variable_to_file_search_path.
push esi
call fcn.00430fd9
pop ecx
pop ecx
jmp 0x40babd
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.004314b2
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.004028d4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40bf2f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edx
inc edi
mov dword [ebp - 8], edx
cmp dword [ebx + 0x24], edx
mov ecx, 0x101
mov eax, edi
mov dword [ebp - 0xc], edx
cmovne eax, ecx
mov dword [ebp - 0x10], edx
push edx
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
push dword [ebp + 0xc]
call fcn.00408feb
mov esi, eax
test esi, esi
jns 0x40bf7c
push str.Failed_to_format_key_string.
jmp 0x40c012
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.0040494e
mov esi, eax
test esi, esi
js 0x40c033
cmp dword [ebx + 0x20], 0
je 0x40c04f
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.00408feb
mov esi, eax
test esi, esi
jns 0x40bfc0
push str.Failed_to_format_value_string.
jmp 0x40c012
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub ecx, 0
je 0x40c04f
dec ecx
dec ecx
je 0x40c01c
test eax, eax
je 0x40c04f
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x322
push str.search.cpp
call fcn.00403a8b
push str.Failed_to_query_registry_key_value.
push esi
call fcn.00430fd9
pop ecx
pop ecx
jmp 0x40c07c
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.004314b2
add esp, 0x10
jmp 0x40c04d
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x40c06e
push str.Registry_key_not_found._Key___ls
push 2
call fcn.004314b2
add esp, 0xc
xor edi, edi
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00409f60
mov esi, eax
test esi, esi
jns 0x40c093
push str.Failed_to_set_variable.
jmp 0x40c012
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.00430fd9
add esp, 0xc
test esi, esi
jns 0x40c093
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.004314b2
add esp, 0x10
push dword [ebp - 4]
call fcn.004028d4
push dword [ebp - 8]
call fcn.004028d4
cmp dword [ebp - 0xc], 0
je 0x40c0b2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40ce80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x40ceca
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
push edi
push 0x140
push str.section.cpp
call fcn.00403a8b
push str.Failed_to_get_module_handle_to_process.
push edi
jmp 0x40cf1b
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x40cef2
mov esi, 0x8007000d
push esi
push 0x14a
push str.section.cpp
mov edi, esi
call fcn.00403a8b
push str.Failed_to_find_valid_DOS_image_header_in_buffer.
jmp 0x40cf1a
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x40cf27
mov esi, 0x8007000d
push esi
push 0x155
push str.section.cpp
mov edi, esi
call fcn.00403a8b
push str.Failed_to_find_valid_NT_image_header_in_buffer.
push esi
call fcn.00430fd9
pop ecx
pop ecx
jmp 0x40d021
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push str..wixburn
push ebx
call fcn.0043957a
add esp, 0xc
test eax, eax
je 0x40cf6c
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x40cf93
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x40cf53
cmp dword [ebx + 4], 0x6e727562
jne 0x40cf53
cmp dword [ebx + 0x10], 0x34
jae 0x40cfb1
mov esi, 0x8007000d
push esi
push 0x17a
push str.section.cpp
mov edi, esi
call fcn.00403a8b
push dword [ebx + 0x10]
push str.Failed_to_read_section_info__data_to_short:__u
jmp 0x40cfdb
mov esi, 0x8007000d
push esi
push 0x16e
push str.section.cpp
mov edi, esi
call fcn.00403a8b
push str.Failed_to_find_Burn_section.
jmp 0x40d018
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x40cfe6
mov esi, 0x8007000d
push esi
push 0x184
push str.section.cpp
mov edi, esi
call fcn.00403a8b
push dword [ebx + 4]
push str.Failed_to_read_section_info__unsupported_version:__08x
push esi
call fcn.00430fd9
add esp, 0xc
jmp 0x40d020
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x40cffc
inc ecx
cmp ecx, 4
jne 0x40cfeb
jmp 0x40d020
mov esi, 0x8007000d
push esi
push 0x18a
push str.section.cpp
mov edi, esi
call fcn.00403a8b
push str.Bundle_guid_didnt_match_the_guid_in_the_PE_Header_in_memory.
push esi
call fcn.00430fd9
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x4156ed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x466078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.00438fc0
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x415780
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x271
push str.logging.cpp
call fcn.00403a8b
push str.Failed_to_get_temp_folder.
jmp 0x41579f
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401c85
mov esi, eax
test esi, esi
jns 0x4157ac
push str.Failed_to_get_length_of_temp_folder.
push esi
call fcn.00430fd9
pop ecx
pop ecx
jmp 0x415878
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x415850
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x4511ac
push eax
call fcn.00402074
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4157f0
push str.Failed_to_format_session_id_as_a_string.
jmp 0x41586f
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.00401c85
mov esi, eax
test esi, esi
jns 0x415814
push str.Failed_to_get_length_of_session_id_string.
jmp 0x41586f
push dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov esi, edi
sub esi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + esi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
cmove edi, esi
jmp 0x415856
mov edi, dword [ebp - 0x218]
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004022f7
mov esi, eax
test esi, esi
jns 0x415877
push str.Failed_to_copy_temp_folder.
push esi
call fcn.00430fd9
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x41588c
push dword [ebp - 0x210]
call fcn.004027ab
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437d83
mov esp, ebp
pop ebp
ret 4
Function at 0x4163ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
and dword [ebp - 0xc], esi
and dword [ebp - 8], esi
and dword [ebp - 4], esi
xor ebx, ebx
push edi
push 0
lea eax, [ebp - 4]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [ebp - 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x41642e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x416417
xor esi, esi
jmp 0x41642e
cmp eax, 0x6d
je 0x41648b
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x416474
add ebx, dword [ebp - 4]
cmp ebx, 8
jb 0x4163e4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edi], ecx
mov dword [edi + 4], eax
test eax, eax
je 0x4164f5
push 0
push eax
call fcn.00403bb8
mov dword [edi + 0xc], eax
test eax, eax
jne 0x41649a
mov esi, 0x8007000e
push esi
push 0x323
push str.pipe.cpp
call fcn.00403a8b
push str.Failed_to_allocate_data_for_message.
jmp 0x4164e4
push esi
push 0x318
push str.pipe.cpp
call fcn.00403a8b
push str.Failed_to_read_message_from_pipe.
jmp 0x4164e4
xor ecx, ecx
xor eax, eax
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
inc esi
jmp 0x41643c
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi + 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4164ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x327
push str.pipe.cpp
call fcn.00403a8b
push str.Failed_to_read_data_for_message.
push esi
call fcn.00430fd9
pop ecx
pop ecx
jmp 0x4164f5
mov dword [edi + 8], 1
cmp dword [edi + 8], 0
jne 0x416509
cmp dword [edi + 0xc], 0
je 0x416509
push dword [edi + 0xc]
call fcn.00403c7f
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x416514
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004160e0
mov esi, eax
test esi, esi
jns 0x416546
push str.Failed_to_allocate_message_to_write.
jmp 0x4165a7
mov dword [ebp + 0x14], edi
cmp dword [ebp - 4], edi
jbe 0x4165af
push 0
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
sub eax, edi
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416574
add edi, dword [ebp + 0x14]
cmp edi, dword [ebp - 4]
jb 0x41654e
jmp 0x4165af
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2f0
push str.pipe.cpp
call fcn.00403a8b
push str.Failed_to_write_message_type_to_pipe.
push esi
call fcn.00430fd9
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x4165bd
push dword [ebp - 8]
call fcn.00403c7f
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x416971
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebp + 0xc], ebx
jne 0x4169f8
push ebx
lea eax, [ebp - 8]
push eax
push 1
push str.D:_A__GA___SY__A__GA___BA__A__GRGW0x00100000___WD_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x4169e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x116
push str.pipe.cpp
call fcn.00403a8b
push str.Failed_to_create_the_security_descriptor_for_the_connection_event_and_pipe.
push esi
call fcn.00430fd9
pop ecx
pop ecx
jmp 0x416b33
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push dword [edi]
push str..pipe_ls
push eax
call fcn.00402074
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x416a29
push dword [edi]
push str.Failed_to_allocate_full_name_of_pipe:__ls
push esi
call fcn.00430fd9
add esp, 0xc
jmp 0x416b33
xor ecx, ecx
lea eax, [ebp - 0x18]
cmp dword [ebp - 8], ecx
cmove eax, ecx
push eax
push 1
mov eax, 0x10000
push eax
push eax
push 1
push ebx
push 0x80003
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x416a8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x126
push str.pipe.cpp
call fcn.00403a8b
push dword [ebp - 4]
push str.Failed_to_create_pipe:__ls
jmp 0x416a1b
cmp dword [ebp + 0xc], 0
je 0x416b24
push dword [edi]
lea eax, [ebp - 4]
push str..pipe_ls.Cache
push eax
call fcn.00402074
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x416aba
push dword [edi]
push str.Failed_to_allocate_full_name_of_cache_pipe:__ls
jmp 0x416b12
push 0
push 1
mov eax, 0x10000
push eax
push eax
push 1
push 0
push 0x80003
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
jne 0x416b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x132
push str.pipe.cpp
call fcn.00403a8b
push dword [ebp - 4]
push str.Failed_to_create_pipe:__ls
push esi
call fcn.00430fd9
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416b33
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], ebx
and dword [eax], 0
cmp dword [ebp - 4], 0
je 0x416b41
push dword [ebp - 4]
call fcn.004027ab
cmp dword [ebp - 8], 0
je 0x416b50
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x419d32
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x466078]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x270], 0
lea eax, [ebp - 0x25c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x208
push 0
push eax
call fcn.00438fc0
xor eax, eax
lea edi, [ebp - 0x26c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x46751c]
test eax, eax
jne 0x419ef4
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00431604
cmp dword [ebp - 0x270], 0
lea eax, [ebp - 0x25c]
je 0x419e2f
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x419df0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x476
push str.cache.cpp
call fcn.00403a8b
push str.Failed_to_get_windows_path_for_working_folder.
jmp 0x419f08
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.00403465
mov esi, eax
test esi, esi
jns 0x419e0d
push str.Failed_to_ensure_windows_path_for_working_folder_ended_in_backslash.
jmp 0x419f08
push str.Temp_
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040396f
mov esi, eax
test esi, esi
jns 0x419e77
push str.Failed_to_concat_Temp_directory_on_windows_path_for_working_folder.
jmp 0x419f08
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x419e77
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x481
push str.cache.cpp
call fcn.00403a8b
push str.Failed_to_get_temp_path_for_working_folder.
jmp 0x419f08
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov esi, eax
or esi, 1
jge 0x419e92
push str.Failed_to_create_working_folder_guid.
jmp 0x419f08
push 0x27
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x419ec5
mov esi, 0x8007000e
push esi
push 0x48b
push str.cache.cpp
call fcn.00403a8b
push str.Failed_to_convert_working_folder_guid_into_string.
jmp 0x419f08
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x25c]
push eax
push str._ls_ls_
push 0x46751c
call fcn.00402074
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x419eef
push str.Failed_to_append_bundle_id_on_to_temp_path_for_working_folder.
jmp 0x419f08
mov eax, dword [0x46751c]
push 0
push eax
push ebx
call fcn.004022f7
mov esi, eax
test esi, esi
jns 0x419f10
push str.Failed_to_copy_working_folder_path.
push esi
call fcn.00430fd9
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437d83
mov esp, ebp
pop ebp
ret 8
Function at 0x41a8e7
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov eax, 0x20000004
push esi
push edi
mov edi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 8], ebx
je 0x41a979
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.00419c87
mov esi, eax
test esi, esi
jns 0x41a91f
push str.Failed_to_allocate_administrator_SID.
jmp 0x41a964
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x41a971
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x617
push str.cache.cpp
call fcn.00403a8b
push str.Failed_to_initialize_ACL.
push esi
call fcn.00430fd9
mov edi, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x41a9a2
mov edi, dword [ebp - 4]
mov eax, 0x20000005
push 0x7d0
push 3
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push edi
push eax
push 1
push dword [ebp + 0xc]
call fcn.004044aa
push 0x80
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test edi, edi
je 0x41a9ac
push edi
call fcn.00403c7f
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8