joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015c2
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
pushal
mov eax, 0x73
mov dword [ebp - 0x110], eax
add eax, 4
shr eax, 2
mov dword [ebp - 0x10c], 0x12c
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x4089b8
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4016b8
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x4016aa
cmp eax, dword [ebp - 0x110]
jb 0x4016a4
mov edx, 0x40000
cmp eax, edx
ja 0x40169e
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x401698
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x108], eax
jne 0x401692
lea edi, [ebp - 0x104]
mov ecx, dword [ebp - 0x110]
mov esi, str.Memory_Test_config_file_v0.02_r_nCopyrights_to_the_program_belong_to_me._r_nSerj_r_ntestmem.tz.ru_r_nserj_m_hotmail.com_r_n_r_nmt.log
mov al, byte [esi]
cmp al, byte [edi]
jne 0x401686
inc esi
inc edi
loop 0x401671
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
clc
jmp 0x4016fb
inc dword [ebp - 0x10c]
inc dword [ebp - 0x10c]
inc dword [ebp - 0x10c]
inc dword [ebp - 0x10c]
inc dword [ebp - 0x10c]
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push 0x4089b8
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
mov ecx, 0x73
lea edx, str.Memory_Test_config_file_v0.02_r_nCopyrights_to_the_program_belong_to_me._r_nSerj_r_ntestmem.tz.ru_r_nserj_m_hotmail.com_r_n_r_nmt.log
push 0
lea eax, [ebp - 0x108]
push eax
push ecx
push edx
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
stc
popal
leave
ret

Function at 0x401701
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push 0x4089b8
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x4016fe
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
leave
ret
Function at 0x4017ee
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x104
push 0x44921c
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov edi, 0x449424
call fcn.004024ff
push 0x449424
call sub.kernel32.dll_lstrlenA
mov edi, 0x449424
add edi, eax
mov al, byte [edi - 1]
cmp al, 0x5c
jne 0x401825
mov byte [edi - 1], 0
push 0x449528
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4018d2
mov dword [0x44953a], 0x104
push 0x44953a
push 0x449320
push 0
push 0
push str.Desktop
push dword [0x449528]
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0
jne 0x4018d2
push str.TestMem5.lnk
push 0x449320
call sub.kernel32.dll_lstrcatA
push 0x44953a
push 0x449320
call sub.kernel32.dll_GetCompressedFileSizeA
or eax, eax
jg 0x4018d2
push 0
call sub.ole32.dll_CoInitialize
mov eax, dword [0x4075e8]
or eax, eax
jl 0x4018ad
mov dword [0x40809f], eax
lea eax, str.The_program_checks_the_memory__run_carefully_
call fcn.004023b6
push eax
push 0x449424
push 0x449320
push 0x44921c
call fcn.004018d3
call sub.ole32.dll_CoUninitialize
ret

Function at 0x4018d3
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
call sub.kernel32.dll_GetProcessHeap
mov dword [ebp - 0x14], eax
push 0x208
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x408020
push 1
push 0
push 0x408010
call sub.ole32.dll_CoCreateInstance
mov dword [ebp - 0x10], eax
test eax, eax
js 0x4019ba
mov edx, dword [ebp - 8]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
push eax
push 0x408030
push dword [ebp - 8]
call dword [edx]
mov dword [ebp - 0x10], eax
test eax, eax
js 0x4019ac
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x50]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [edx + 0x24]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [edx + 0x1c]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x44]
mov dword [ebp - 0x10], eax
push 0x104
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push 1
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [edx + 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push dword [ebp - 0xc]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp - 8]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
leave
ret 0x10
Function at 0x401d85
Capabilities:
Read file on windows
Write file on windows

Disassembly:
pushal
call fcn.00403ced
mov ecx, eax
push ecx
push 0x40869c
call sub.kernel32.dll_lstrcpyA
push str.binCfg.link
push 0x40869c
call sub.kernel32.dll_lstrcatA
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x40869c
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401df8
mov ebx, eax
push 0
push 0x4082d8
push 0x200
push 0x4089b8
push ebx
call sub.kernel32.dll_ReadFile
push eax
push ebx
call sub.kernel32.dll_CloseHandle
pop eax
or eax, eax
je 0x401df8
cmp dword [0x4082d8], 5
jl 0x401df8
jmp 0x401e77
call fcn.00403ced
mov ecx, eax
push ecx
push 0x4081d8
call sub.kernel32.dll_lstrcpyA
push 0x4081d8
push 0x4089b8
call sub.kernel32.dll_lstrcpyA
push str.binCfg.link
push 0x4081d8
call sub.kernel32.dll_lstrcatA
push str.binMT.cfg
push 0x4089b8
call sub.kernel32.dll_lstrcatA
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
push 0x4081d8
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0x4089b8
call sub.kernel32.dll_lstrlenA
mov edx, eax
push 0
push 0x4082d8
push edx
push 0x4089b8
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
popal
ret

Function at 0x40253a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push 0x3ec
push dword [0x408330]
call sub.user32.dll_GetDlgItem
mov dword [0x448f6c], eax
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
push 0
push 0x80
push 4
lea eax, [ebp - 0x30]
push eax
push 3
push 0xc0000000
push str.Log.txt
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4025f7
mov dword [0x448f70], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4025df
push 2
push 0
push 0
push dword [0x448f70]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x407b65
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x407b65
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 0x27
push str._TestMem5_Log_File__r_n
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
leave
ret

Function at 0x4025f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
cmp dword [ebp + 0xc], 0x10000
jb 0x402666
cmp dword [ebp + 8], 0
je 0x402666
push dword [ebp + 0xc]
push 0
push 0x180
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
cmp dword [0x448f70], 0
je 0x402660
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrlenA
mov ecx, eax
push 0
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp + 0xc]
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x407b65
push dword [0x448f70]
call sub.kernel32.dll_WriteFile
inc dword [0x448f74]
leave
ret 8
Function at 0x4029dc
Capabilities:
Get memory capacity

Disassembly:
pushal
lea eax, [0x449da2]
mov dword [eax], 0x40
push 0x449da2
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [0x449daa]
mov esi, dword [0x449dae]
shr eax, 0x10
shl esi, 0x10
or eax, esi
add eax, 0xf
shr eax, 4
cmp al, 0xff
jne 0x402a11
inc eax
mov dword [0x448d04], eax
mov eax, dword [0x449db2]
mov esi, dword [0x449db6]
shr eax, 0x14
shl esi, 0xc
or eax, esi
mov dword [0x448d08], eax
mov eax, dword [0x449dba]
mov edx, dword [0x449dbe]
sub eax, dword [0x449dc2]
sbb edx, dword [0x449dc6]
push 0xf4240
call fcn.0040243b
mov dword [0x448d0c], eax
mov eax, dword [0x449dba]
mov edx, dword [0x449dbe]
push 0xf4240
call fcn.0040243b
mov dword [0x448d10], eax
mov eax, dword [0x449dba]
mov edx, dword [0x449dbe]
push 0x100000
call fcn.0040243b
mov dword [0x448d14], eax
popal
ret

Function at 0x40350a
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [0x449d92]
or esi, esi
je 0x403577
lea ebx, [esi + 0x88098]
lea edx, [esi + 0x88094]
mov ecx, 0
cmp ecx, dword [0x448f84]
je 0x403562
pushal
mov eax, dword [edx]
or eax, eax
je 0x40354b
mov dword [edx], 0
push 0
push 0
push 0x10
push eax
call sub.user32.dll_SendMessageA
popal
pushal
mov eax, dword [ebx]
or eax, eax
je 0x403561
mov dword [ebx], 0
push 2
push eax
call sub.kernel32.dll_TerminateProcess
popal
add ebx, 0x80
add edx, 0x80
inc ecx
cmp ecx, dword [0x408488]
jl 0x40352a
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4035c4
Capabilities:
Create process on windows

Disassembly:
pushal
mov esi, 0x4490e4
mov byte [esi], 0x20
mov byte [esi + 1], 0xd
mov byte [esi + 2], al
mov esi, dword [0x449d92]
mov dword [0x448fa0], 0x44
mov edx, 0x80
mul edx
lea edx, [eax + esi + 0x88098]
push edx
push 0x448fa0
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x4490e4
push 0x448fe4
call sub.kernel32.dll_CreateProcessA
push 0
call sub.kernel32.dll_Sleep
popal
ret
Function at 0x404db1
Capabilities:
Accept command line arguments
Check os version
Create thread
Get system information on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40832c], eax
call sub.kernel32.dll_GetVersion
mov dword [0x40845c], eax
mov eax, dword [0x40845c]
cmp al, 5
ja 0x404ddc
inc dword [0x448d9c]
push 0x408460
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [0x408474]
mov dword [0x408484], eax
call fcn.004023d9
mov dword [0x40848c], eax
mov dword [0x4075f4], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x408458], eax
call sub.kernel32.dll_GetVersion
mov dword [0x40845c], eax
mov esi, dword [0x408458]
call fcn.004023ec
je 0x404e45
mov eax, dword [esi]
mov ebx, eax
and ebx, 0xffffffff
and ebx, 0xdfdfdfdf
cmp ebx, 0x454c4449
jne 0x404e37
jmp 0x404e19
cmp al, 0xd
jne 0x404e43
mov al, byte [esi + 1]
mov byte [0x448f84], al
jmp 0x404e19
cmp byte [0x448f84], 0
jne 0x404e69
call fcn.00402bb4
call fcn.004029dc
call fcn.00402409
call fcn.00401b95
call fcn.00401ef9
jmp 0x404e6e
call fcn.00401c7d
mov esi, dword [0x449d92]
mov eax, 0x80
mul dword [0x448f84]
add eax, esi
mov dword [0x449d96], eax
mov eax, 0x880
mul dword [0x448f84]
mov dword [0x449d9e], eax
add eax, esi
mov dword [0x449d9a], eax
cmp eax, esi
je 0x404eea
mov byte [0x407ac3], 0
mov eax, dword [esi + 0x44]
mov dword [0x407588], eax
inc byte [esi + 0x6f]
movzx eax, byte [esi + 0x6f]
inc eax
pushal
mov ebx, dword [esi + 0x88094]
push eax
push 0x407a3b
push 0x408334
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x69
push ebx
call sub.user32.dll_GetDlgItem
push 0x408334
push 0
push 0xc
push eax
call sub.user32.dll_SendMessageA
popal
call fcn.0040436e
mov esi, dword [0x449d92]
mov eax, dword [esi + 0x40]
mov dword [0x408488], eax
mov esi, dword [0x449d92]
mov eax, 0x880
mul dword [0x448f84]
add esi, eax
mov eax, dword [0x449d92]
mov dword [esi + 0xe0], eax
mov ecx, dword [0x407588]
mov dword [esi + 0x160], eax
add esi, 0x80
loop 0x404f21
mov eax, fcn.00403825
push eax
push 0x64
push 0
push 0
call sub.user32.dll_SetTimer
mov esi, dword [0x449d96]
mov dword [esi + 0x880c0], eax
mov eax, 0x404481
push 0x44920c
push 0
push dword [0x448f84]
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, dword [0x449d96]
mov dword [esi + 0x880b8], eax
mov eax, dword [0x44920c]
mov dword [esi + 0x880bc], eax
cmp byte [0x448f84], 0
jne 0x404f9e
push 0xa
push 0
push dword [0x40832c]
call fcn.00404fbb
push 0
call sub.kernel32.dll_ExitThread
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0
push 0
push 0
call fcn.00403825
jmp 0x404f9e
Function at 0x405486
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
push 0x40889c
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jle 0x4054f6
call fcn.00403ced
mov ecx, eax
push ecx
push 0x40869c
call sub.kernel32.dll_lstrcpyA
push str.binCfg.link
push 0x40869c
call sub.kernel32.dll_lstrcatA
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
push 0x40869c
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x40889c
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
popal
leave
ret
Function at 0x4019f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x401b60
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0
mov eax, dword [eax + 4]
add eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0040ec20
test eax, eax
mov eax, dword [esp + 0x44]
js 0x401ba0
mov esi, dword [eax + 0xc]
mov dword [esp], esi
call sub.msvcrt.dll_malloc
mov dword [esp + 0x1c], eax
test eax, eax
je 0x401bcf
mov eax, dword [esp + 0x44]
cmp byte [eax + 0x10], 1
je 0x401b30
mov edx, esi
xor ecx, ecx
test esi, esi
je 0x401b0c
mov dword [esp + 0x40], ebx
mov ebp, dword [esp + 0x1c]
jmp 0x401a88
sub edx, esi
sbb ecx, edi
add ebp, esi
mov ebx, ecx
or ebx, edx
je 0x401b50
mov eax, 0x2000
mov esi, edx
mov edi, ecx
cmp eax, edx
mov eax, 0
sbb eax, ecx
jae 0x401aa3
mov esi, 0x2000
xor edi, edi
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov eax, dword [eax]
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], ebp
call sub.msvcrt.dll_fread
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x401a78
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], str.Failed_to_extract__s:_failed_to_read_data_chunk__n
mov dword [esp], str.fread
add eax, 0x12
mov dword [esp + 8], eax
call fcn.00403060
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x1c], 0
mov eax, dword [ebx]
test eax, eax
je 0x401b20
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx], 0
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x44]
xor ecx, ecx
mov dword [esp], eax
mov eax, ebx
call fcn.00401640
test eax, eax
jne 0x401af8
mov eax, dword [ebx]
test eax, eax
jne 0x401b12
jmp 0x401b20
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx]
test eax, eax
jne 0x401b12
jmp 0x401b20
lea eax, [ebx + 0x70]
mov dword [esp + 4], 0x418184
mov dword [esp], eax
call fcn.00404700
mov dword [esp + 0x1c], eax
mov dword [ebx], eax
test eax, eax
jne 0x401a09
mov eax, dword [esp + 0x44]
mov dword [esp], str.Failed_to_extract__s:_failed_to_open_archive_file__n
add eax, 0x12
mov dword [esp + 4], eax
call fcn.00402f00
jmp 0x401b20
add eax, 0x12
mov dword [esp + 4], str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
mov dword [esp + 8], eax
mov dword [esp], str.fseek
call fcn.00403060
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], esi
mov dword [esp + 4], str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
add eax, 0x12
mov dword [esp], 0x4180d2
mov dword [esp + 8], eax
call fcn.00403060
jmp 0x401b0c
Function at 0x407680
Capabilities:
Query environment variable

Disassembly:
push ebx
mov eax, 0x4018
call fcn.0040e2f0
sub esp, eax
mov eax, dword [esp + 0x4020]
mov dword [esp + 8], 0
lea ebx, [esp + 0x10]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00408910
mov dword [esp + 8], 0x2000
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x4076e0
add esp, 0x4018
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x2010]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00408730
test eax, eax
je 0x4076cc
cmp byte [eax], 0
je 0x4076cc
mov dword [esp], eax
call sub.msvcrt.dll__strdup
add esp, 0x4018
pop ebx
ret

Function at 0x4077a0
Capabilities:
Set environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00408910
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
Function at 0x4077f0
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov eax, 0x401c
push edi
push esi
push ebx
call fcn.0040e2f0
sub esp, eax
mov eax, dword [esp + 0x4030]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00408910
mov esi, eax
test eax, eax
je 0x407950
lea edi, [esp + 0x10]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
test ebx, ebx
je 0x407930
mov dword [esp], edi
call fcn.00408d30
test eax, eax
jne 0x407920
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__wfullpath]
mov esi, eax
test esi, esi
je 0x40795e
lea ebp, [esp + 0x2010]
xor eax, eax
mov ecx, 0x800
mov edi, ebp
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_wcschr
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test eax, eax
je 0x407902
lea esi, [esi]
nop
mov eax, ebx
mov dword [esp + 4], esi
add ebx, 2
sub eax, esi
mov dword [esp], ebp
sar eax, 1
add eax, 1
mov dword [esp + 8], eax
call sub.msvcrt.dll_wcsncpy
mov dword [esp + 4], 0
mov dword [esp], ebp
call edi
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_wcschr
mov ebx, eax
test eax, eax
jne 0x4078c0
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
sub esp, 8
add esp, 0x401c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__wcsdup]
mov esi, eax
jmp 0x407882
mov dword [esp], str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
xor esi, esi
call fcn.00402f00
add esp, 0x401c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.00402f00
jmp 0x407912
mov dword [esp], str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.00402f00
jmp 0x407912
Function at 0x407970
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebp
mov eax, 0x204c
push edi
push esi
push ebx
call fcn.0040e2f0
sub esp, eax
mov ecx, dword [esp + 0x2064]
test ecx, ecx
je 0x4079d7
mov dword [esp], 0x41a427
call fcn.00407680
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2064]
mov dword [esp], eax
call fcn.004077f0
mov ebx, eax
test eax, eax
je 0x407aba
mov dword [esp + 4], eax
mov dword [esp], 0x41a42c
call dword [sym.imp.msvcrt.dll__wputenv_s]
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_free
test esi, esi
jne 0x407ad0
lea edi, [esp + 0x40]
mov dword [esp], 0x1000
mov ebx, 5
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
call sub.msvcrt.dll__getpid
lea esi, [esp + 0x20]
mov dword [esp + 8], str._MEI_d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x10
mov dword [esp], esi
call fcn.004074f0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__wtempnam]
mov dword [esp], eax
mov ebp, eax
call fcn.00408b50
test eax, eax
je 0x407ae0
mov dword [esp], ebp
call sub.msvcrt.dll_free
sub ebx, 1
jne 0x407a19
mov eax, dword [esp + 0x2064]
test eax, eax
je 0x407aba
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x407a80
mov dword [esp + 4], edi
xor ebx, ebx
mov dword [esp], 0x41a427
call fcn.00407730
mov dword [esp], edi
call sub.msvcrt.dll_free
add esp, 0x204c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0x41a427
mov dword [esp], 0
call fcn.00408910
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x204c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
xor ebx, ebx
call fcn.00402f00
jmp 0x407a72
mov eax, dword [esp + 0x2060]
mov dword [esp + 4], ebp
mov ebx, 1
mov dword [esp + 8], 0x1000
mov dword [esp], eax
call fcn.00408730
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x2064]
test edx, edx
je 0x407a72
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x407b3c
mov dword [esp + 4], edi
mov dword [esp], 0x41a427
call fcn.00407730
mov dword [esp], edi
call sub.msvcrt.dll_free
jmp 0x407a72
mov dword [esp + 8], 0
mov dword [esp + 4], 0x41a427
mov dword [esp], 0
call fcn.00408910
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x407a72