joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a5a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x100a5ab0
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x100a5b60
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x100a5b90
cmp eax, 3
jne 0x100a5a9a
mov eax, dword [0x100ba0d0]
cmp eax, 0xffffffff
je 0x100a5a9a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x100a5a9a
test byte [eax + 0x20], 0x30
je 0x100a5bc0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x100a5af3
call fcn.100a5990
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x100a5b25
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x100a5b17
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.100a4f30
lea eax, [ebx + 0x38]
call fcn.100a56c0
mov eax, ebx
call fcn.100a53a0
mov eax, dword [0x100ba0d0]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x100a5a9a
mov eax, dword [0x100fc17c]
test eax, eax
je 0x100a5a9a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x100fc17c], 0
sub esp, 4
jmp 0x100a5a9a
mov dword [esp + 4], 0x100a50e0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x100fc17c], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x100a5c32
test eax, eax
je 0x100a5bda
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x100a5bf7
call fcn.100a5990
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x100a5c61
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x100a5c1c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.100a4f30
mov eax, esi
jmp 0x100a5b33
test eax, eax
je 0x100a5c42
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.100a4f30
lea eax, [ebx + 0x38]
call fcn.100a56c0
jmp 0x100a5a9a
mov dword [esp], edi
call fcn.100a4f30
mov eax, esi
call fcn.100a56c0
jmp 0x100a5a9a
Function at 0x100a65f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.100a5800
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x100a6612
call fcn.100a5990
test byte [ebx + 0x20], 0x30
jne 0x100a662b
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x100ba0d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x100a666e
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x100a66b2
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
test eax, eax
je 0x100a6661
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x100a6677
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call fcn.100a53a0
mov eax, dword [0x100ba0d0]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x100a666e
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x100a66c6
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x100a6691

Function at 0x100aa250
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.100a9e60
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.100a9e60
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x100aa2b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x100fc1d4]
test esi, esi
jle 0x100aa3d0
mov edi, dword [0x100fc1d8]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x100aa2e4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x100aa369
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x100aa2d0
mov dword [esp], eax
mov ebx, eax
call fcn.100aaaa0
mov edi, eax
test eax, eax
je 0x100aa3f7
mov eax, dword [0x100fc1d8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.100aabb0
mov edx, dword [0x100fc1d8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x100aa3d7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x100aa362
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x100aa370
add dword [0x100fc1d4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x100fc1d8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x100aa362
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.100aa250
lea esi, [esi]
lea edi, [edi]
xor esi, esi
jmp 0x100aa2ee
mov eax, dword [0x100fc1d8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.100aa250
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.100aa250
mov esi, esi
lea edi, [edi]

Function at 0x100aa6e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x100fc1e4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x100fc1dc]
sub esp, 4
test ebx, ebx
je 0x100aa735
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x100aa72e
test esi, esi
je 0x100aa72e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x100aa710
mov dword [esp], 0x100fc1e4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100b1adc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push esi
push ebx
mov ebx, dword [ebp + 0xc]
not eax
mov ecx, ebx
lea esi, [edi + ebx]
mov edx, esi
sub edx, ecx
cmp edx, 3
jbe 0x100b1b47
mov edx, eax
xor al, byte [ecx]
add ecx, 4
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x100e0980]
mov eax, edx
xor dl, byte [ecx - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x100e0980]
mov edx, eax
xor al, byte [ecx - 2]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x100e0980]
mov eax, edx
xor dl, byte [ecx - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x100e0980]
jmp 0x100b1af2
mov edx, edi
and edi, 3
and edx, 0xfffffffc
add edx, ebx
add edi, edx
cmp edx, edi
je 0x100b1b6d
mov ecx, eax
xor al, byte [edx]
inc edx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x100e0980]
mov eax, ecx
jmp 0x100b1b53
pop ebx
not eax
pop esi
pop edi
pop ebp
ret
Function at 0x401214
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
call fcn.00401334
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
add esp, 0xc
test ebx, ebx
je 0x40127f
jmp 0x40123d
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x40123c
cmp al, 9
je 0x40123c
mov al, byte [ebx]
cmp al, 0x22
jne 0x401263
lea esi, [esi]
inc ebx
mov al, byte [ebx]
cmp al, 0x22
je 0x401274
test al, al
jne 0x401250
jmp 0x401275
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x401274
cmp al, 9
je 0x401275
test al, al
jne 0x401260
jmp 0x401275
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x401274
cmp al, 9
je 0x401274
mov eax, 0xa
test byte [ebp - 0x24], 1
je 0x40128e
movzx eax, word [ebp - 0x20]
push eax
push ebx
push 0
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
push eax
call fcn.00401a10
mov ebx, dword [ebp - 0x68]
mov esp, ebp
pop ebp
ret

Function at 0x4013cc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
add esp, 0xfffffff4
push 0
lea esi, [ebp - 4]
push esi
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401398
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x401439
add esp, 0xfffffff8
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push ebx
push 1
push 0
push 0x4013bc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xfffffffc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffff4
push 0
push esi
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401398
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x401494
add esp, 0xfffffff8
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push ebx
push 1
push 0
push 0x4013bc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xfffffffc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4014e4
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.00401f60
push ebx
add esp, 0xfffffffc
push dword [ebp + 8]
push 0x4014d1
lea ebx, [ebp - 0x2000]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__rmdir
add esp, 0x20
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__mkdir
add esp, 0x10
test eax, eax
jne 0x40154d
add esp, 0xfffffff4
push ebx
call fcn.0040149c
add esp, 0x10
test al, al
je 0x401544
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__rmdir
mov al, 1
jmp 0x40154f
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__rmdir
mov al, 0
mov ebx, dword [ebp - 0x2018]
leave
ret
Function at 0x4015a4
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.00401f60
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
add esp, 0xfffffff8
push esi
push 0x2000
call sub.KERNEL32.dll_GetTempPathA
mov edx, eax
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
add esp, 8
cmp ecx, 0xfffffffe
jne 0x401628
add esp, 0xfffffffc
push 0x2000
push esi
push 0x401557
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx + 0x1fff]
push eax
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esi + ecx - 1]
push eax
push 0x401561
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 4
jmp 0x401638
test edx, edx
jle 0x401638
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll__mkdir
add esp, 0x10
xor edi, edi
add esp, 0xfffffff4
push 0x40156a
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
test eax, eax
je 0x401661
add esp, 0xfffffff8
push 0x401577
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
add esp, 8
test edi, edi
je 0x401770
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x2000]
push ebx
push esi
call edi
add esp, 0xfffffffc
push 0x3f
push ebx
call sub.msvcrt.dll_strchr
add esp, 0x10
test eax, eax
je 0x401770
add esp, 0xfffffff8
push 0x2000
lea ebx, [ebp - 0x4000]
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
add esp, 0xfffffff4
push ebx
push 0x401588
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x20
add esp, 0xfffffff4
push esi
call fcn.004014e4
add esp, 0x10
test al, al
jne 0x401770
mov eax, dword [0x401590]
mov dword [esi], eax
mov eax, dword [0x401594]
mov dword [esi + 4], eax
add esp, 0xfffffff4
push esi
call fcn.004014e4
add esp, 0x10
test al, al
jne 0x401770
mov edi, 0x401598
mov eax, dword [0x401598]
mov dword [esi], eax
movzx eax, word [edi + 4]
mov word [esi + 4], ax
mov al, byte [edi + 6]
mov byte [esi + 6], al
add esp, 0xfffffff4
push esi
call fcn.004014e4
add esp, 0x10
test al, al
jne 0x401770
add esp, 0xfffffff8
push ebx
push esi
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff4
push esi
call fcn.004014e4
add esp, 0x20
test al, al
jne 0x401770
mov eax, dword [0x40159f]
mov dword [esi], eax
add esp, 0xfffffff4
push esi
call fcn.004014e4
add esp, 0x10
test al, al
je 0x401770
mov eax, dword [0x401598]
mov dword [esi], eax
movzx eax, word [edi + 4]
mov word [esi + 4], ax
mov al, byte [edi + 6]
mov byte [esi + 6], al
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll__mkdir
add esp, 0xfffffff4
push esi
call fcn.004014e4
lea esp, [ebp - 0x4018]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x401788
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.00401f60
push esi
push ebx
mov esi, dword [ebp + 8]
add esp, 0xfffffff4
lea ebx, [ebp - 0x2000]
push ebx
call fcn.004015a4
push esi
push 0
push 0x40177b
push ebx
call sub.KERNEL32.dll_GetTempFileNameA
add esp, 0x10
test eax, eax
jne 0x4017e6
add esp, 0xfffffff4
add esp, 0xfffffff4
push 0
call sub.msvcrt.dll_time
push eax
call sub.msvcrt.dll_srand
add esp, 0x20
call sub.msvcrt.dll_rand
push eax
push ebx
push 0x40177f
push esi
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0x2018]
pop ebx
pop esi
leave
ret

Function at 0x401850
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x401c
call fcn.00401f60
push edi
push esi
push ebx
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x2000]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffff4
lea eax, [ebp - 0x4004]
push eax
lea esi, [ebp - 0x4000]
push esi
push 0x2000
push ebx
call sub.KERNEL32.dll_GetFullPathNameA
mov eax, dword [ebp - 0x4004]
mov byte [eax], 0
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
add esp, 0x10
cmp eax, 3
jbe 0x4018c6
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov byte [esi + ecx - 2], al
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_SetCurrentDirectoryA
lea esp, [ebp - 0x4028]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4018f0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
mov dword [ebp - 0xa0], 0x94
add esp, 0xfffffff4
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.dll_GetVersionExA
add esp, 0xc
test eax, eax
je 0x401997
cmp dword [ebp - 0x90], 2
jne 0x40199c
add esp, 0xfffffffc
lea eax, [ebp - 0xb4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
add esp, 4
test eax, eax
je 0x401997
add esp, 0xfffffffc
lea ebx, [ebp - 0xb0]
lea eax, [ebp - 0xac]
push eax
push 0x4018da
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa4], 2
add esp, 0xfffffffc
push 0
push 0
push 0
push ebx
push 0
push dword [ebp - 0xb4]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
add esp, 0x10
test eax, eax
je 0x40199c
mov al, 0
jmp 0x4019ad
add esp, 0xfffffff8
push 0
push 2
call sub.USER32.dll_ExitWindowsEx
test eax, eax
setne al
mov ebx, dword [ebp - 0xd8]
leave
ret
Function at 0x401817
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401856
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401856
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401856
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401856
cmp dword [ecx + 0x74], 0xe
jbe 0x401856
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4029e0
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x402a5b
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.0056395e
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x402a17
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x402a2e
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.0056395e
add esp, 4
test eax, eax
jbe 0x402a5b
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.0056395e
add esp, 4
cmp esi, eax
jb 0x402a40
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4037b0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x5e4358]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
test eax, eax
push esi
jne 0x4037dd
push eax
push str.Setupapi.dll
call fcn.00403120
add esp, 8
test eax, eax
mov dword [0x5e4358], eax
je 0x403916
cmp dword [0x5e435c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x403806
push str.SetupDiGetClassDevsW
push eax
call esi
test eax, eax
mov dword [0x5e435c], eax
je 0x403916
mov eax, dword [0x5e4358]
cmp dword [0x5e4360], 0
jne 0x403829
push str.SetupDiEnumDeviceInfo
push eax
call esi
test eax, eax
mov dword [0x5e4360], eax
je 0x403916
mov eax, dword [0x5e4358]
cmp dword [0x5e4368], 0
jne 0x40384c
push str.SetupDiGetDeviceRegistryPropertyW
push eax
call esi
test eax, eax
mov dword [0x5e4368], eax
je 0x403916
mov eax, dword [0x5e4358]
cmp dword [0x5e4364], 0
jne 0x40386f
push str.SetupDiGetDeviceInterfaceDetailW
push eax
call esi
test eax, eax
mov dword [0x5e4364], eax
je 0x403916
mov eax, dword [0x5e4358]
cmp dword [0x5e4370], 0
jne 0x40388d
push str.SetupDiDestroyDeviceInfoList
push eax
call esi
test eax, eax
mov dword [0x5e4370], eax
je 0x403916
push 6
push 0
push 0
push 0
call dword [0x5e435c]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x403918
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
push edi
push eax
mov dword [ecx + 0x18], eax
push esi
mov dword [edi], 0x1c
call dword [0x5e4360]
test eax, eax
je 0x40390f
lea ecx, [ecx]
push esi
push ebp
mov eax, edi
call fcn.00402d50
add esp, 8
cmp eax, 1
je 0x40391c
xor edx, edx
mov eax, edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
push edi
add ebx, 1
mov dword [eax + 0x14], edx
push ebx
mov dword [eax + 0x18], edx
push esi
mov dword [edi], 0x1c
call dword [0x5e4360]
test eax, eax
jne 0x4038d0
push esi
call dword [0x5e4370]
xor eax, eax
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov dword [ecx], esi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x404150
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp dword [0x5e4420], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x24
mov dword [esp + 0x14], 0x26
mov dword [esp + 0x18], 0x2a
jne 0x4041e6
push 3
push 0x20
push 3
push 1
push 3
push 2
push esi
push esi
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
push 0x23
push 0x5e4420
mov dword [0x5e4420], 0x11c
mov dword [0x5e4424], 6
mov dword [0x5e4428], 1
mov word [0x5e4534], si
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x5d77bc], eax
jmp 0x4041eb
mov eax, dword [0x5d77bc]
cmp eax, esi
je 0x4041fa
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret
cmp ebp, esi
je 0x40431a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push esi
push esi
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x404318
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x404318
push 0
mov ecx, eax
push ecx
push edi
push ebp
call ebx
cmp edi, eax
jbe 0x404318
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
jmp 0x404250
mov eax, dword [esp + ebx*4 + 0x18]
cmp eax, 0x26
jne 0x4042cf
push 0
push 0
push str._ProgramW6432_
call ebp
mov edi, eax
test edi, edi
je 0x404318
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x404318
push edi
push esi
push str._ProgramW6432_
call ebp
cmp edi, eax
jne 0x404318
push esi
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4042b6
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x59b234
push 0x26
jmp 0x4042d5
cmp word [esi + edi*2 - 4], 0x5c
je 0x4042e3
push 0x59b514
add edi, 1
push edi
push esi
call fcn.00403fc0
jmp 0x4042e3
push 0x59b234
push eax
call fcn.00404060
mov esi, eax
add esp, 8
test esi, esi
je 0x404318
push esi
call fcn.0056395e
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.00564283
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jne 0x404318
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 1
xor esi, esi
cmp ebx, 3
jl 0x404250
pop edi
pop ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x4046c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
call fcn.00404550
mov esi, eax
add esp, 4
test esi, esi
je 0x404702
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4046e4
test al, 0x50
je 0x404702
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4046f7
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret