joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a7c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x423f10]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402af7
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x402afe
cmp dword [ebp + 0x10], ebx
jne 0x402aeb
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a7c
test eax, eax
jne 0x402afe
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x402abe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405e06
cmp eax, ebx
je 0x402b23
push ebx
push dword [0x423f10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402af7
cmp dword [0x423f10], ebx
jne 0x402af4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402af4
jmp 0x402af7

Function at 0x402c74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x7f3df55f
xor ecx, ebp
loop 0x402c7c
pop ebp
ret
Function at 0x404300
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a1bb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42107c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004156c1
push 4
mov dword [ebp - 4], 0
call fcn.00406e57
mov edi, eax
add esp, 4
test edi, edi
je 0x40437c
call fcn.004154bc
mov dword [edi], eax
call fcn.0041527b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00415682
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404372
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004156aa
jmp 0x40437e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406390
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0x40
push 0x1000
push 1
xor ebx, ebx
push ebx
push edi
mov byte [ebp - 1], 0xc3
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
je 0x4063de
lea eax, [ebp - 8]
push eax
push 1
lea ecx, [ebp - 1]
push ecx
push esi
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [ebp - 8], ebx
jne 0x4063e6
push 0x4000
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push esi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, 0xffffffff
je 0x406408
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bl, 1
push 0x8000
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406722
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42107c]
jne 0x40672c
repz ret
jmp fcn.0040746f
Function at 0x4104a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42107c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00408d1b
and dword [ebp - 0x14], 0
cmp dword [0x4244b8], 0
mov dword [ebp - 0x18], eax
jne 0x410556
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4105fe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4105fe
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4244b8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4244bc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4244c0], eax
call edi
push eax
call esi
mov dword [0x4244c8], eax
test eax, eax
je 0x410556
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4244c4], eax
mov eax, dword [0x4244c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4105af
cmp dword [0x4244c8], ecx
je 0x4105af
push eax
call esi
push dword [0x4244c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4105af
test ebx, ebx
je 0x4105af
call edi
test eax, eax
je 0x4105a6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4105a6
test byte [ebp - 8], 1
jne 0x4105af
or dword [ebp + 0x10], 0x200000
jmp 0x4105e2
mov eax, dword [0x4244bc]
cmp eax, dword [ebp - 0x18]
je 0x4105e2
push eax
call esi
test eax, eax
je 0x4105e2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4105e2
mov eax, dword [0x4244c0]
cmp eax, dword [ebp - 0x18]
je 0x4105e2
push eax
call esi
test eax, eax
je 0x4105e2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4244b8]
call esi
test eax, eax
je 0x4105fe
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410600
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406722
leave
ret
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rcr esi, 0x86
rol edx, 0xcd
or eax, 0x8c
imul eax
sub eax, 0xd2
inc esi
rcr eax, 0x4f
rol edx, 0xd9
bswap eax
bswap edx
mov ebx, 0xa7
add edi, 0x5f
sbb edi, 0xd3
rcr edi, 0x3f
ror edi, 0x62
inc edx
mov edi, 0x79
neg ebx
rol ebx, 0x54
mov edx, 0xd
dec ebx
dec edx
neg esi
bswap eax
rcr eax, 0xdf
ror edi, 0x6f
ror edx, 0x82
bswap eax
mov esi, 0xed
add esi, 0x29
rcr esi, 0x62
and ebx, 0
rol esi, 0x4a
rcr eax, 0x3c
ror edx, 0x7b
rol edx, 0x39
dec edx
imul ebx
rol esi, 0xe8
rcl eax, 0x8a
imul edx
imul edi
sbb esi, 0x6a
rol edx, 0xe
rcl esi, 0x7e
not edx
rol edx, 0x5d
rcr ebx, 0x8a
ror ebx, 7
mov edi, 0xf3
xor ecx, ecx
xor edi, edi
neg ebx
dec edx
imul edx
and eax, 0x7c
sub edi, 0x46
rcr eax, 0x13
rcr edi, 0xb
inc ebx
or esi, 0x63
inc eax
ror ebx, 0x72
bswap eax
and edx, 0x28
and esi, 2
rcr esi, 0x49
not edi
sbb eax, 0x9c
ror edi, 0xa9
neg esi
imul edi
ror edi, 0x39
rol edx, 0xb2
add edi, 0xeb
sbb esi, 0x54
rcl esi, 0x27
add edi, 0xe8
bswap esi
sbb edx, 0x83
inc ebx
rol edi, 0x97
not eax
mov esi, 0xac
or ebx, 0xe0
rol esi, 0x92
and esi, 0x6d
add eax, 0x82
ror edi, 0xf6
mov edi, 0xef
rcl ebx, 0xb1
not esi
rcr ebx, 0xb2
and ebx, 0xaa
dec edx
rcr esi, 0x4e
rcl ebx, 0xec
imul edi
inc edx
sub edi, 0xd6
add ebx, 0x91
neg eax
mov ecx, dword [ebp + 0xc]
bswap ebx
inc eax
sub esi, 0xfa
rcr ebx, 0xda
bswap edi
rcl edi, 0x7a
inc ebx
imul eax
rcl esi, 6
rcl ebx, 0x6e
bswap edx
add eax, 0xcd
bswap edi
ror eax, 0x56
rcr edx, 0x67
rcl eax, 0xf
not edx
add edi, 0x3d
dec ebx
inc edx
sbb edx, 0x68
add esi, 0x99
or eax, 0x18
not eax
not esi
mov eax, 0x2d
rcl edi, 0xe2
bswap esi
sbb edx, 0x21
inc esi
neg edx
sbb edi, 0xf5
rcl esi, 0x5e
sub edi, 0xd6
rcr esi, 0x2e
dec edi
not eax
imul eax
sub esi, 0x24
dec eax
not eax
mov eax, 0x20
sbb edx, 0xe7
rcl eax, 0xc1
imul esi
bswap esi
sbb eax, 0xef
ror ebx, 0xe7
bswap esi
rol edx, 0x3a
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, esi
mov esi, esi
mov eax, ebx
mov esi, esi
mov eax, esi
mov eax, eax
xor eax, ebx
xor ebx, esi
xor ebx, ebx
xor eax, eax
xor ebx, eax
not byte [edi]
xor eax, esi
mov ebx, eax
mov esi, eax
mov esi, esi
xor esi, eax
mov ebx, eax
mov ebx, esi
xor eax, ebx
mov eax, eax
sub byte [edi], 0x89
mov ebx, ebx
xor esi, esi
xor esi, ebx
mov ebx, esi
xor ebx, ebx
mov ebx, eax
mov esi, esi
mov esi, esi
xor eax, esi
add byte [edi], 0x43
xor eax, esi
mov ebx, eax
xor eax, eax
mov eax, esi
mov ebx, ebx
mov ebx, ebx
xor esi, eax
mov eax, esi
xor eax, ebx
imul byte [edi]
inc edi
loop 0x4011d3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403353
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402249
and dword [ebp - 4], 0
cmp dword [0x492688], 0
mov ebx, eax
jne 0x403404
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4034b5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4034b5
push eax
call fcn.004021d7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x492688], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x49268c], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x492690], eax
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x492698], eax
test eax, eax
je 0x403404
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x492694], eax
mov eax, dword [0x492694]
cmp eax, ebx
je 0x40345c
cmp dword [0x492698], ebx
je 0x40345c
push eax
call fcn.00402252
push dword [0x492698]
mov esi, eax
call fcn.00402252
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40345c
test edi, edi
je 0x40345c
call esi
test eax, eax
je 0x403453
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403453
test byte [ebp - 0xc], 1
jne 0x40345c
or dword [ebp + 0x10], 0x200000
jmp 0x403495
mov eax, dword [0x49268c]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403495
mov eax, dword [0x492690]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x492688]
call fcn.00402252
pop ecx
test eax, eax
je 0x4034b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4034b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4051be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x491df8]
jne 0x4051c8
repz ret
jmp fcn.004068e5
Function at 0x406bdd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x406beb
push 0xd
pop eax
jmp 0x406c1e
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x406bf2
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40709b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
push ecx
push dword [esi]
mov dword [ebp - 0x21c], ecx
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.0040705d
mov ebx, eax
cmp ebx, edi
je 0x407101
cmp dword [ebp - 0x214], edi
je 0x4070fa
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x407199
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x407129
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.0040709b
mov dword [ebp - 0x220], eax
cmp eax, edi
jne 0x4071aa
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x407109
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], edi
je 0x407174
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], edi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call fcn.00407217
mov esi, eax
cmp dword [ebp - 0x214], edi
je 0x407197
push dword [ebp - 0x214]
call ebx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458424
leave
ret 4
cmp dword [ebp - 0x214], edi
je 0x4071be
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x407199

Function at 0x407217
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x499864], 0
jne 0x407247
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407240
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x499868], eax
mov byte [0x499864], 1
mov eax, dword [0x499868]
test eax, eax
je 0x40725f
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x40726b
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x40860f
Capabilities:
Hide graphical window

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], 1
push edi
mov edi, ecx
jne 0x408651
push str.tray_click__
lea ecx, [edi + 0x3c]
call fcn.00409132
mov ebx, eax
pop ecx
test ebx, ebx
jge 0x408651
push esi
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [edi + 0x94]
cmp byte [esi], 0
je 0x40864c
call fcn.004109c7
and dword [edi + 8], 0
pop esi
pop edi
mov eax, ebx
pop ebx
ret 4
Function at 0x4090c1
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00458bb0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40911a
cmp dword [ebp - 0x7c], 5
jae 0x409116
cmp dword [ebp - 0x7c], 4
jne 0x40911a
cmp dword [ebp - 0x78], 0x5a
jb 0x40911a
xor eax, eax
jmp 0x40911d
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00458424
add ebp, 0x98
leave
ret
Function at 0x40fa49
Capabilities:
Get file version info

Disassembly:
push 8
mov eax, 0x46bcfa
call fcn.0045c852
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
je 0x40fa67
mov eax, 0x800700b7
jmp 0x40faed
cmp dword [ebp + 8], ebx
jne 0x40fa73
mov eax, 0x80070057
jmp 0x40faed
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x40fa8f
mov eax, 0x80040007
jmp 0x40faed
push edi
mov dword [ebp - 4], ebx
call fcn.00453499
pop ecx
push edi
push ebx
push eax
mov dword [esi], eax
call fcn.00458bb0
add esp, 0xc
push dword [esi]
push edi
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40fade
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
mov edi, eax
call fcn.00458419
cmp edi, ebx
pop ecx
mov dword [esi], ebx
jle 0x40fada
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
jmp 0x40faed
xor eax, eax
jmp 0x40faed
call fcn.0045c8f7
ret
Function at 0x410d67
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x46bd80
call fcn.0045c81f
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push str.dummy
push eax
push ecx
call fcn.00410a04
mov edi, eax
add esp, 0xc
test edi, edi
jl 0x410ddd
push 0x498be8
lea ecx, [ebp - 0x10]
call fcn.00401ed0
and dword [ebp - 4], 0
push dword [esi + 4]
push dword [esi]
lea esi, [ebp - 0x10]
call fcn.00410a4d
mov esi, dword [ebp - 0x10]
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x410dd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x410dd1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0040267a
mov eax, edi
call fcn.0045c8f7
ret

Function at 0x41110f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.00458bb0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41115d
cmp dword [ebp - 0x7c], 6
jb 0x41115d
xor eax, eax
inc eax
jmp 0x41115f
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00458424
add ebp, 0x98
leave
ret

Function at 0x411be8
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.0045c550
push 0xffffffffffffffff
push 0x46e50c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x498be8
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call fcn.00401ed0
xor edi, edi
lea eax, [ebp - 0x10]
push 0x75cd
mov dword [ebp - 4], ebx
inc edi
push eax
mov dword [ebp - 0x14], edi
call fcn.00450a40
xor eax, eax
mov dword [ebp - 4], edi
push 0xffe
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.00458bb0
add esp, 0x14
push 0x800
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0040218d
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040267a
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x411cc9
lea eax, [ebp - 0x10]
push 0x75ce
push eax
call fcn.00450a40
pop ecx
pop ecx
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0040c85c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040267a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.00458424
add ebp, 0x1004
leave
ret
Function at 0x4124d3
Capabilities:
Query environment variable

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0xc
mov eax, 0x46cf0b
call fcn.0045c81f
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push 0x498be8
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.00401ed0
and dword [ebp - 4], 0
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
mov dword [ebp - 0x14], 1
call fcn.00458bb0
lea eax, [ebp - 0x10]
push 0x75d7
push eax
call fcn.00450a40
mov eax, dword [eax]
add esp, 0x14
push 0x400
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040267a
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0040218d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00458424
add ebp, 0x804
leave
ret

Function at 0x412626
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.0045c550
push 0xffffffffffffffff
push 0x46ce89
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push 0x498be8
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00401ed0
and dword [ebp - 4], 0
xor eax, eax
push 0xffe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
mov dword [ebp - 0x10], 1
call fcn.00458bb0
add esp, 0xc
push 0x800
lea eax, [ebp]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0040218d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.00458424
add ebp, 0x1004
leave
ret

Function at 0x4126da
Capabilities:
Query environment variable

Disassembly:
push 0x50
mov eax, 0x46ce4b
call fcn.0045c888
and dword [ebp - 4], 0
and dword [ebp - 0x58], 0
push 0x498be8
mov ecx, esi
mov dword [ebp - 0x5c], esi
call fcn.00401ed0
and dword [ebp - 4], 0
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x4e]
push eax
mov dword [ebp - 0x58], 1
call fcn.00458bb0
lea eax, [ebp - 0x54]
push 0x75d8
push eax
call fcn.00450a40
mov eax, dword [eax]
add esp, 0x14
push 0x20
lea ecx, [ebp - 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
call fcn.0040267a
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.0040218d
mov eax, esi
call fcn.0045c90b
ret
Function at 0x412758
Capabilities:
Get disk information

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x492fb4]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x18
mov eax, 0x46db13
call fcn.0045c81f
mov eax, dword [ebp + 0x40c]
xor ebx, ebx
lea esi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
call fcn.004126da
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
jne 0x4127ac
push 0x47f940
mov ecx, esi
call fcn.0040218d
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi - 0xc]
lea eax, [ecx - 1]
cmp eax, ebx
jl 0x4128b5
cmp eax, ecx
jg 0x4128b5
movzx eax, word [edi + eax*2]
cmp ax, 0x5c
je 0x4127dc
push 0x47f760
lea ecx, [ebp - 0x10]
call fcn.00404413
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esi, 0x1fc
push esi
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
call fcn.00458bb0
xor eax, eax
push esi
mov word [ebp + 0x200], ax
lea eax, [ebp + 0x202]
push ebx
push eax
call fcn.00458bb0
add esp, 0x18
mov eax, 0xff
push eax
lea ecx, [ebp + 0x200]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 0x498be8
cmp eax, ebx
je 0x4128ab
lea ecx, [ebp - 0x18]
call fcn.00401ed0
mov byte [ebp - 4], 1
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push 0x47f948
push eax
call fcn.00404d0a
mov ecx, dword [ebp - 0x14]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call fcn.00401f8d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040267a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040267a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.00458424
add ebp, 0x404
leave
ret
mov ecx, dword [ebp - 0x14]
call fcn.00401ed0
jmp 0x41287a
push 0x80070057
call fcn.004027d4
int3