joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403440
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
je 0x40347d
lea eax, [esp + 4]
push eax
push str.SystemCurrentControlSetControlProductOptions
push 0x80000002
call dword [0x40f034]
test eax, eax
je 0x403486
xor eax, eax
pop ebp
add esp, 0xc
ret 4
mov eax, dword [esp + 4]
push esi
mov esi, dword [0x40f038]
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 0
push str.ProductType
push eax
call esi
test eax, eax
je 0x4034c0
mov ecx, dword [esp + 8]
push ecx
call dword [0x40f03c]
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4034dd
mov edx, dword [esp + 8]
push edx
call dword [0x40f03c]
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 4
push edi
push eax
call fcn.00408929
mov edi, eax
mov eax, dword [esp + 0x10]
add esp, 4
test edi, edi
jne 0x403503
push eax
call dword [0x40f03c]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 4
lea ecx, [esp + 0x10]
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
push 0
push str.ProductType
push eax
call esi
test eax, eax
je 0x40353b
push edi
call fcn.00408870
mov ecx, dword [esp + 0x10]
add esp, 4
push ecx
call dword [0x40f03c]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 4
push ebp
push edi
call fcn.00407e52
mov esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call fcn.00408870
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [0x40f03c]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x403b10
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f8a8
push 0x408944
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], 0x80
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x24], edi
mov eax, dword [ebp + 0x14]
cmp eax, edi
jne 0x403b67
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [eax], edi
mov dword [ebp - 4], edi
push 0x80
push 8
mov ebx, dword [0x40f158]
call ebx
push eax
call dword [0x40f15c]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x403c26
mov eax, dword [ebp - 0x1c]
push eax
push 8
call ebx
push eax
call dword [0x40f15c]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x403c26
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push edi
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [esi]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x40f030]
test eax, eax
jne 0x403c1f
call dword [0x40f12c]
mov dword [ebp - 0x34], eax
cmp eax, 0x7a
jne 0x403c18
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [esi]
push edx
push 8
call ebx
push eax
call dword [0x40f104]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x403c26
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
push eax
push edi
push 8
call ebx
push eax
call dword [0x40f104]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x403c26
mov edi, eax
mov dword [ebp - 0x20], edi
jmp 0x403ba7
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x403c26
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00403c54
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4041a0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x412850]
push esi
push edi
mov edi, dword [esp + 0x2b0]
test edi, edi
mov dword [esp + 0x2a4], eax
mov eax, dword [esp + 0x2ac]
mov esi, ecx
mov dword [esp + 8], 0
jne 0x4041e9
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x29c]
call fcn.00407e0b
add esp, 0x2a0
ret 8
push ebx
push edi
lea ecx, [esp + 0x48]
push ecx
push eax
mov ecx, esi
mov dword [edi], 0
call fcn.00403df0
mov ebx, eax
test ebx, ebx
jne 0x40421e
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x29c]
call fcn.00407e0b
add esp, 0x2a0
ret 8
mov eax, dword [esi + 0xc]
test eax, eax
je 0x404204
push ebp
mov ebp, dword [0x40f11c]
push str.LsaClose
push eax
call ebp
test eax, eax
mov dword [esp + 0x14], eax
jne 0x40424b
call dword [0x40f12c]
mov dword [edi], eax
xor eax, eax
jmp 0x404392
mov edx, dword [esi + 0xc]
push str.LsaFreeMemory
push edx
call ebp
test eax, eax
mov dword [esp + 0x20], eax
je 0x40423c
mov eax, dword [esi + 0xc]
push str.LsaNtStatusToWinError
push eax
call ebp
mov ebp, eax
test ebp, ebp
je 0x40423c
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
push 0x80
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0xb0]
push ecx
push 0xffffffffffffffff
mov eax, 1
push ebx
push eax
lea edx, [esp + 0x38]
push 0
mov dword [esp + 0x3c], 0xc
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], al
mov byte [esp + 0x45], 0
mov dword [esp + 0x5c], edx
call dword [0x40f0f8]
lea edx, [esp + 0x10]
push edx
push 0xf0fff
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.00404050
test eax, eax
je 0x4042f2
push eax
call ebp
mov dword [edi], eax
xor eax, eax
jmp 0x404392
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 5
push eax
mov ecx, esi
call fcn.00403ae0
mov ebx, eax
test ebx, ebx
je 0x40431d
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x18]
push ebx
call ebp
mov dword [edi], eax
xor eax, eax
jmp 0x404392
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push 3
push eax
mov ecx, esi
call fcn.00403ae0
mov esi, eax
test esi, esi
je 0x404351
mov ecx, dword [esp + 0x18]
push ecx
call dword [esp + 0x24]
mov edx, dword [esp + 0x10]
push edx
call dword [esp + 0x18]
push esi
call ebp
mov dword [edi], eax
xor eax, eax
jmp 0x404392
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
push ecx
push eax
call dword [0x40f02c]
test eax, eax
jne 0x40437c
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x18]
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2ac]
pop ebp
pop ebx
pop edi
pop esi
call fcn.00407e0b
add esp, 0x2a0
ret 8
Function at 0x406f00
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
sub esp, 0x110
mov eax, dword [0x412850]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x118]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x120]
test eax, eax
push edi
mov edi, dword [esp + 0x11c]
mov dword [esp + 0xc], eax
mov ecx, 0x37c5d22a
mov esi, 0x77be9b9c
mov edx, 0x36456178
jle 0x406fb9
push ebx
lea ebx, [esp + 0x18]
push ebp
sub ebx, edi
mov dword [esp + 0x10], eax
mov eax, edx
or eax, 2
mov ebp, eax
xor ebp, 1
imul ebp, eax
movzx eax, bp
movsx ebp, byte [edi]
shr eax, 8
xor eax, ebp
mov ebp, eax
xor ebp, ecx
and ebp, 0xff
shr ecx, 8
xor ecx, dword [ebp*4 + 0x412450]
mov byte [ebx + edi], al
mov eax, dword [esp + 0x10]
mov ebp, ecx
and ebp, 0xff
add ebp, esi
imul ebp, ebp, 0x8088405
inc ebp
mov esi, ebp
shr ebp, 0x18
xor ebp, edx
and ebp, 0xff
shr edx, 8
xor edx, dword [ebp*4 + 0x412450]
inc edi
dec eax
mov dword [esp + 0x10], eax
jne 0x406f50
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
mov byte [esp + eax + 0x1c], 0
call dword [0x40f108]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
call fcn.00407e0b
add esp, 0x110
ret 0xc
Function at 0x40b079
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40b0a7
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x40b0ae
cmp ebx, dword [eax + 4]
jae 0x40b0ae
xor eax, eax
jmp 0x40b29e
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40b0bf
xor eax, eax
inc eax
jmp 0x40b29d
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40b0d5
cmp ecx, edx
jae 0x40b21a
cmp dword [eax + 4], 0
je 0x40b0de
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40b0c6
cmp dword [ebp + 8], 0
je 0x40b100
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40b21a
cmp eax, esi
jae 0x40b21a
mov eax, dword [0x4131d8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40b125
cmp dword [esi*4 + 0x4131e0], edi
je 0x40b21e
inc esi
cmp esi, eax
jl 0x40b113
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x40f174]
test eax, eax
je 0x40b29a
cmp dword [ebp - 8], 0x1000000
jne 0x40b29a
test byte [ebp - 0xc], 0xcc
je 0x40b1a3
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40b29a
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b29a
cmp word [eax + 0x18], 0x10b
jne 0x40b29a
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40b29a
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40b1a3
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40b1a3
test byte [ecx + 0x27], 0x80
jne 0x40b21a
push 1
push 0x413220
call dword [0x40f178]
test eax, eax
jne 0x40b0b7
mov ecx, dword [0x4131d8]
test ecx, ecx
mov edx, ecx
jle 0x40b1d7
lea eax, [ecx*4 + 0x4131dc]
cmp dword [eax], edi
je 0x40b1d7
dec edx
sub eax, 4
test edx, edx
jg 0x40b1cb
test edx, edx
jne 0x40b208
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40b1e4
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40b1fc
lea eax, [edx*4 + 0x4131e0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40b1ea
cmp ecx, 0x10
jge 0x40b208
inc ecx
mov dword [0x4131d8], ecx
push 0
push 0x413220
call dword [0x40f178]
jmp 0x40b0b7
xor eax, eax
jmp 0x40b29d
test esi, esi
jle 0x40b0b7
mov ebx, dword [0x40f178]
push 1
push 0x413220
call ebx
test eax, eax
jne 0x40b0b7
cmp dword [esi*4 + 0x4131e0], edi
je 0x40b274
mov eax, dword [0x4131d8]
lea esi, [eax - 1]
test esi, esi
jl 0x40b262
cmp dword [esi*4 + 0x4131e0], edi
je 0x40b25e
dec esi
jns 0x40b252
test esi, esi
jge 0x40b272
cmp eax, 0x10
jge 0x40b26d
inc eax
mov dword [0x4131d8], eax
lea esi, [eax - 1]
jmp 0x40b274
je 0x40b28c
xor ecx, ecx
test esi, esi
jl 0x40b28c
lea eax, [ecx*4 + 0x4131e0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40b27a
push 0
push 0x413220
call ebx
jmp 0x40b0b7
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019d6
push esp
mov dword [ebp - 0x24], 0x4016fe
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a75
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a56
pop ebp
ret 0x10
Function at 0x401690
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x84]
mov eax, dword [esi]
test eax, eax
je 0x401810
mov eax, dword [edi + 4]
mov ebx, dword [esi + 4]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp], eax
call ebp
sub esp, 4
add ebx, eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [edi + 8]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x4018c2
mov edx, dword [esi]
mov eax, dword [edi + 8]
mov dword [esp + 0x1c], edx
mov dword [esp], eax
call ebp
sub esp, 4
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp + 0xc], edx
mov dword [esp], ebx
call sub.msvcrt.dll_fread
test eax, eax
je 0x401840
cmp byte [edi + 0x10], 1
je 0x401758
mov eax, dword [esi]
test eax, eax
je 0x401747
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esi], 0
add esp, 0x6c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4018d3
mov eax, dword [edi + 8]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x28], ebx
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call ebp
sub esp, 4
lea ebp, [esp + 0x28]
mov dword [esp + 8], 0x38
mov dword [esp + 4], 0x4160e7
mov dword [esp], ebp
mov dword [esp + 0x38], eax
call fcn.00406850
test eax, eax
js 0x401860
mov dword [esp + 4], 4
mov dword [esp], ebp
call fcn.00406920
test eax, eax
js 0x4018a0
mov dword [esp], ebp
call fcn.00408b30
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov ebx, dword [esp + 0x1c]
jmp 0x401733
lea eax, [esi + 0x68]
mov dword [esp + 4], 0x416064
mov dword [esp], eax
call fcn.00403590
mov dword [esi], eax
mov ebx, eax
test eax, eax
jne 0x4016af
mov dword [esp], str.Cannot_open_archive_file_n
call fcn.004021e0
jmp 0x401747
mov dword [esp], str.Could_not_read_from_file_n
call fcn.004021e0
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_free
jmp 0x401747
mov edx, dword [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], str.Error__d_from_inflateInit:__s_n
mov dword [esp + 8], edx
call fcn.004021e0
mov dword [esp], ebx
call sub.msvcrt.dll_free
add edi, 0x12
mov dword [esp], str.Error_decompressing__s_n
xor ebx, ebx
mov dword [esp + 4], edi
call fcn.004021e0
jmp 0x401747
mov edx, dword [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], str.Error__d_from_inflate:__s_n
mov dword [esp + 8], edx
call fcn.004021e0
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x401880
mov dword [esp], str.Could_not_allocate_read_buffer_n
call fcn.004021e0
jmp 0x401747
mov dword [esp], str.Error_allocating_decompression_buffer_n
call fcn.004021e0
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x401880
Function at 0x4018f0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], edi
call fcn.00401690
mov dword [esp], ebx
mov esi, eax
call fcn.004052d0
cmp eax, 0xffffffff
je 0x401979
lea ebp, [edi + 0x12]
add ebx, 0x2068
mov dword [esp], ebx
mov dword [esp + 4], ebp
call fcn.00405560
mov ebx, eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohl]
sub esp, 4
mov edi, eax
test ebx, ebx
je 0x4019a7
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
cmp eax, 1
je 0x401967
test edi, edi
jne 0x401988
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], esi
call sub.msvcrt.dll_free
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebp
mov dword [esp + 4], str.Failed_to_write_all_bytes_for__s_n
mov dword [esp], str.fwrite
call fcn.004022e0
mov eax, 0xffffffff
jmp 0x401979
mov dword [esp + 8], ebp
mov dword [esp + 4], str._s_could_not_be_extracted__n
mov dword [esp], str.fopen
call fcn.004022e0
mov eax, 0xffffffff
jmp 0x401979
Function at 0x404df0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov eax, 0x4018
call fcn.0040b930
sub esp, eax
mov eax, dword [esp + 0x4020]
mov dword [esp + 8], 0
lea ebx, [esp + 0x10]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405ec0
mov dword [esp + 8], 0x2000
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x404e50
add esp, 0x4018
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x2010]
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00405ce0
test eax, eax
je 0x404e3c
cmp byte [eax], 0
je 0x404e3c
mov dword [esp], eax
call sub.msvcrt.dll__strdup
add esp, 0x4018
pop ebx
ret

Function at 0x404f10
Capabilities:
Set environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405ec0
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
Function at 0x404f60
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov eax, 0x401c
push edi
push esi
push ebx
call fcn.0040b930
sub esp, eax
mov eax, dword [esp + 0x4030]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405ec0
mov esi, eax
test eax, eax
je 0x4050a0
lea edi, [esp + 0x10]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
test ebx, ebx
je 0x405080
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__wfullpath]
mov esi, eax
test eax, eax
je 0x4050ae
lea ebp, [esp + 0x2010]
xor eax, eax
mov ecx, 0x800
mov edi, ebp
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_wcschr
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test eax, eax
je 0x405062
lea esi, [esi]
nop
mov eax, ebx
mov dword [esp + 4], esi
add ebx, 2
sub eax, esi
mov dword [esp], ebp
sar eax, 1
add eax, 1
mov dword [esp + 8], eax
call sub.msvcrt.dll_wcsncpy
mov dword [esp + 4], 0
mov dword [esp], ebp
call edi
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_wcschr
mov ebx, eax
test eax, eax
jne 0x405020
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
sub esp, 8
add esp, 0x401c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
xor esi, esi
call fcn.00402180
add esp, 0x401c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.00402180
jmp 0x405072
mov dword [esp], str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.00402180
jmp 0x405072
Function at 0x4050c0
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebp
mov eax, 0x204c
push edi
push esi
push ebx
call fcn.0040b930
sub esp, eax
mov ecx, dword [esp + 0x2064]
test ecx, ecx
je 0x405127
mov dword [esp], 0x4175d7
call fcn.00404df0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2064]
mov dword [esp], eax
call fcn.00404f60
mov ebx, eax
test eax, eax
je 0x40520a
mov dword [esp + 4], eax
mov dword [esp], 0x4175dc
call dword [sym.imp.msvcrt.dll__wputenv_s]
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_free
test esi, esi
jne 0x405220
lea edi, [esp + 0x40]
mov dword [esp], 0x1000
mov ebx, 5
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
call sub.msvcrt.dll__getpid
lea esi, [esp + 0x20]
mov dword [esp + 8], str._MEI_d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x10
mov dword [esp], esi
call fcn.00404c60
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__wtempnam]
mov dword [esp], eax
mov ebp, eax
call fcn.004061f0
test eax, eax
je 0x405230
mov dword [esp], ebp
call sub.msvcrt.dll_free
sub ebx, 1
jne 0x405169
mov eax, dword [esp + 0x2064]
test eax, eax
je 0x40520a
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4051d0
mov dword [esp + 4], edi
xor ebx, ebx
mov dword [esp], 0x4175d7
call fcn.00404ea0
mov dword [esp], edi
call sub.msvcrt.dll_free
add esp, 0x204c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4175d7
mov dword [esp], 0
call fcn.00405ec0
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x204c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
xor ebx, ebx
call fcn.00402180
jmp 0x4051c2
mov eax, dword [esp + 0x2060]
mov dword [esp + 4], ebp
mov ebx, 1
mov dword [esp + 8], 0x1000
mov dword [esp], eax
call fcn.00405ce0
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x2064]
test edx, edx
je 0x4051c2
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40528c
mov dword [esp + 4], edi
mov dword [esp], 0x4175d7
call fcn.00404ea0
mov dword [esp], edi
call sub.msvcrt.dll_free
jmp 0x4051c2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4175d7
mov dword [esp], 0
call fcn.00405ec0
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x4051c2