joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418b40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x42c]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x418b6c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x430]
mov eax, ecx
sar eax, 5
lea edi, [eax*4 + 0x430260]
mov eax, ecx
and eax, 0x1f
mov dword [esp + 0x24], edi
mov edx, dword [edi]
lea esi, [eax + eax*8]
shl esi, 2
mov dword [esp + 0x14], esi
test byte [esi + edx + 4], 0x20
je 0x418ba7
push 2
push ebp
push ecx
call fcn.00419090
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x418d09
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x418c51
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x418c02
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x418bef
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x418bd2
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x418cfa
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x418c4d
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x418bce
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x418ce9
mov eax, dword [esp + 0x18]
test eax, eax
je 0x418ca5
cmp eax, 5
jne 0x418c8e
call fcn.00418ff0
mov dword [eax], 9
call fcn.00419000
mov dword [eax], 5
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.00418f70
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x418cc5
cmp byte [ebp], 0x1a
jne 0x418cc5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
call fcn.00418ff0
mov dword [eax], 0x1c
call fcn.00419000
mov dword [eax], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x418c4d
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x418d3a
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x418c51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x418c51
Function at 0x419480
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.004170d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x42d4d8], eax
je 0x4194d8
push 0x74
push 1
call fcn.0041d0d0
mov esi, eax
add esp, 8
test esi, esi
je 0x4194d8
mov eax, dword [0x42d4d8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4194d8
push esi
call fcn.004194e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x419500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x42d4d8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x41956e
push 0x74
push 1
call fcn.0041d0d0
mov esi, eax
add esp, 8
test esi, esi
je 0x419564
mov ecx, dword [0x42d4d8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x419564
push esi
call fcn.004194e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.004169f0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
Function at 0x41add0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.00415980
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
push esi
push edi
xor ebp, ebp
push 1
push ebp
push ebx
call fcn.00419090
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x41af10
push 2
push ebp
push ebx
call fcn.00419090
add esp, 0xc
cmp eax, 0xffffffff
je 0x41af10
mov ecx, dword [esp + 0x101c]
mov esi, ecx
sub esi, eax
test esi, esi
jle 0x41aeb1
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x14]
push 0x8000
rep stosd dword es:[edi], eax
push ebx
call fcn.0041d8a0
add esp, 8
mov edi, eax
cmp esi, 0x1000
mov eax, 0x1000
jge 0x41ae56
mov eax, esi
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00418b40
add esp, 0xc
cmp eax, 0xffffffff
je 0x41ae72
sub esi, eax
test esi, esi
jle 0x41ae8a
jmp 0x41ae47
call fcn.00419000
cmp dword [eax], 5
jne 0x41ae87
call fcn.00418ff0
mov dword [eax], 0xd
or ebp, 0xffffffff
push edi
push ebx
call fcn.0041d8a0
mov edi, dword [esp + 0x18]
add esp, 8
push 0
push edi
push ebx
call fcn.00419090
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
jge 0x41aef7
push 0
push ecx
push ebx
call fcn.00419090
add esp, 0xc
push ebx
call fcn.0041aad0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebp, eax
neg ebp
sbb ebp, ebp
neg ebp
dec ebp
cmp ebp, 0xffffffff
jne 0x41aef7
call fcn.00418ff0
mov dword [eax], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00419000
mov dword [eax], esi
push 0
push edi
push ebx
call fcn.00419090
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1004
ret
Function at 0x41b7a0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x42f068]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x41b7e2
call edi
mov esi, eax
test esi, esi
je 0x41b7cc
mov eax, 1
jmp 0x41b7dd
call ebp
mov ebx, eax
test ebx, ebx
je 0x41b8ef
mov eax, 2
mov dword [0x42f068], eax
cmp eax, 1
jne 0x41b882
test esi, esi
jne 0x41b7fb
call edi
mov esi, eax
test esi, esi
je 0x41b8ef
cmp word [esi], 0
mov eax, esi
je 0x41b815
add eax, 2
cmp word [eax], 0
jne 0x41b803
add eax, 2
cmp word [eax], 0
jne 0x41b803
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x41b874
push edi
call fcn.00414d90
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41b874
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x41b866
push ebx
call fcn.00414d20
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x41b8ef
test ebx, ebx
jne 0x41b893
call ebp
mov ebx, eax
test ebx, ebx
je 0x41b8ef
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x41b8ab
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41b89b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41b89b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00414d90
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x41b8cd
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x41b940
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x42d6a8
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x41b964
add eax, 8
inc ebp
cmp eax, 0x42d738
jb 0x41b955
cmp ecx, dword [ebp*8 + 0x42d6a8]
jne 0x41bb0b
mov eax, dword [0x42eca4]
cmp eax, 1
je 0x41bacd
test eax, eax
jne 0x41b990
cmp dword [0x42ade4], 1
je 0x41bacd
cmp ecx, 0xfc
je 0x41bb0b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41b9cb
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x41ba14
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x428410
add ebx, ecx
push ebx
call fcn.00414c20
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4283f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x42d6ac]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0041d910
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x430260]
test eax, eax
je 0x41bade
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x41bae8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x42d6ac]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x41db50
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x42f0dc]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
test eax, eax
jne 0x41db98
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x41db78
mov eax, 1
jmp 0x41db93
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x41dc69
mov eax, 2
mov dword [0x42f0dc], eax
cmp eax, 1
jne 0x41dbb8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x41dc7b
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41dbd3
mov ecx, dword [0x42ed38]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test esi, esi
jne 0x41dbf2
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00414d90
mov edi, eax
add esp, 4
test edi, edi
jne 0x41dc06
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x41dc60
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x41dc44
mov edx, dword [esp + 0x24]
push eax
push eax
push 0xffffffffffffffff
push edi
push 1
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x41dc60
push edi
call fcn.00414d20
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push edi
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jne 0x41dc70
push edi
call fcn.00414d20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.00414d20
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41dc80
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x42f0e0]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
test eax, eax
jne 0x41dcc8
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x41dca8
mov eax, 2
jmp 0x41dcc3
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41dda8
mov eax, 1
mov dword [0x42f0e0], eax
cmp eax, 2
jne 0x41dce8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x41ddba
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41dd03
mov ecx, dword [0x42ed38]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jne 0x41dd22
pop edi
pop esi
pop ebp
pop ebx
ret
lea edx, [edi + edi]
push edx
call fcn.00414d90
mov esi, eax
add esp, 4
test esi, esi
jne 0x41dd39
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41dd9f
mov eax, dword [esp + 0x20]
push 0
test eax, eax
push 0
jne 0x41dd80
mov eax, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x41dd9f
push esi
call fcn.00414d20
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push 0xffffffffffffffff
push esi
push 0x220
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x41ddaf
push esi
call fcn.00414d20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00414d20
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41e230
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41e3ee
push 0x3d
push edi
call fcn.0041e6e0
mov esi, eax
add esp, 8
test esi, esi
je 0x41e3ee
cmp edi, esi
je 0x41e3ee
mov dl, byte [esi + 1]
mov ecx, dword [0x42ec5c]
xor eax, eax
test dl, dl
sete al
mov ebp, eax
mov eax, dword [0x42ec58]
cmp eax, ecx
jne 0x41e287
push eax
call fcn.0041e4c0
add esp, 4
mov dword [0x42ec58], eax
test eax, eax
jne 0x41e302
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41e2ae
mov eax, dword [0x42ec60]
test eax, eax
je 0x41e2ae
call fcn.0041dee0
test eax, eax
je 0x41e2fd
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x41e2ba
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 4
call fcn.00414d90
add esp, 4
mov dword [0x42ec58], eax
test eax, eax
je 0x41e3ee
mov dword [eax], 0
mov eax, dword [0x42ec60]
test eax, eax
jne 0x41e2fd
push 4
call fcn.00414d90
add esp, 4
mov dword [0x42ec60], eax
test eax, eax
je 0x41e3ee
mov dword [eax], 0
mov eax, dword [0x42ec58]
mov ebx, eax
mov eax, esi
sub eax, edi
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.0041e440
mov esi, eax
add esp, 8
test esi, esi
jl 0x41e3ff
cmp dword [ebx], 0
je 0x41e3ff
test ebp, ebp
je 0x41e3f7
mov ecx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push ecx
call fcn.00414d20
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x41e359
mov eax, edi
mov edx, dword [eax + 4]
add eax, 4
mov dword [edi], edx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x41e348
lea eax, [esi*4]
push eax
push ebx
call fcn.0041e530
add esp, 8
test eax, eax
je 0x41e373
mov dword [0x42ec58], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41e3e6
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00414d90
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41e3e6
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
neg ebp
rep movsb byte es:[edi], byte [esi]
sbb ebp, ebp
mov byte [ebx + eax], 0
lea eax, [ebx + eax + 1]
not ebp
and ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00414d20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov dword [ebx + esi*4], edi
jmp 0x41e377
test ebp, ebp
jne 0x41e3e6
test esi, esi
jge 0x41e409
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.0041e530
add esp, 8
test eax, eax
je 0x41e3ee
mov dword [eax + esi*4], edi
mov dword [eax + esi*4 + 4], 0
mov dword [0x42ec58], eax
jmp 0x41e377
Function at 0x41f0e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp + 8], 0x200
jmp 0x41f101
mov edx, edx
jae 0x41f104
nop
jb 0x41f104
jmp 0x41f0fa
lea eax, [ebp - 0xc]
lea ecx, [ebp + 8]
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x310]
push ecx
push edx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
jmp 0x41f12c
mov ebp, ebp
jg 0x41f12f
nop
jle 0x41f12f
jmp 0x41f125
jmp 0x41f138
mov edi, edi
jo 0x41f13b
nop
jno 0x41f13b
jmp 0x41f131
jmp 0x41f144
mov eax, eax
js 0x41f147
nop
jns 0x41f147
jmp 0x41f13d
test esi, esi
jne 0x41f210
lea eax, [ebp - 4]
lea ecx, [ebp - 0x110]
push eax
lea edx, [ebp - 0x310]
push ecx
push edx
push edi
mov dword [ebp - 4], 0x104
call fcn.0041f2c0
add esp, 0x10
mov esi, eax
jmp 0x41f17c
mov edi, edi
jae 0x41f17f
nop
jb 0x41f17f
jmp 0x41f175
jmp 0x41f188
mov ebp, ebp
jg 0x41f18b
nop
jle 0x41f18b
jmp 0x41f181
test esi, esi
jne 0x41f1ba
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x110], 0
jmp 0x41f1a3
mov ecx, ecx
jo 0x41f1a6
nop
jno 0x41f1a6
jmp 0x41f19c
lea ecx, [ebp - 0x110]
push ecx
call fcn.0041f220
add esp, 4
test ax, ax
jne 0x41f1d8
inc ebx
jmp 0x41f1c4
mov edx, edx
js 0x41f1c7
nop
jns 0x41f1c7
jmp 0x41f1bd
jmp 0x41f1d0
mov ebx, ebx
jae 0x41f1d3
nop
jb 0x41f1d3
jmp 0x41f1c9
jmp 0x41f0f1
jmp 0x41f1e1
mov ebx, ebx
jg 0x41f1e4
nop
jle 0x41f1e4
jmp 0x41f1da
jmp 0x41f1ed
mov eax, eax
jo 0x41f1f0
nop
jno 0x41f1f0
jmp 0x41f1e6
jmp 0x41f1f9
mov ebp, ebp
js 0x41f1fc
nop
jns 0x41f1fc
jmp 0x41f1f2
mov edx, dword [ebp + 0xc]
mov word [edx], 1
jmp 0x41f20d
mov edx, edx
jae 0x41f210
nop
jb 0x41f210
jmp 0x41f206
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5c
push esi
xor edi, edi
call fcn.00415430
add esp, 8
jmp 0x41f23e
mov ecx, ecx
jg 0x41f241
nop
jle 0x41f241
jmp 0x41f237
jmp 0x41f24a
mov ecx, ecx
jo 0x41f24d
nop
jno 0x41f24d
jmp 0x41f243
test eax, eax
jne 0x41f261
mov eax, esi
jmp 0x41f25c
mov esi, esi
js 0x41f25f
nop
jns 0x41f25f
jmp 0x41f255
jmp 0x41f26e
inc eax
jmp 0x41f26b
mov ebx, ebx
jae 0x41f26e
nop
jb 0x41f26e
jmp 0x41f264
push eax
push 0x4291d0
call 0x42026c
add esp, 8
test eax, eax
jne 0x41f29d
jmp 0x41f289
mov ebx, ebx
jg 0x41f28c
nop
jle 0x41f28c
jmp 0x41f282
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41f29d
mov edi, 1
jmp 0x41f2a6
mov edx, edx
jo 0x41f2a9
nop
jno 0x41f2a9
jmp 0x41f29f
jmp 0x41f2b2
mov eax, eax
js 0x41f2b5
nop
jns 0x41f2b5
jmp 0x41f2ab
mov ax, di
pop edi
pop esi
pop ebp
ret
Function at 0x41f2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push edi
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
jmp 0x41f2e8
mov ecx, ecx
jae 0x41f2eb
nop
jb 0x41f2eb
jmp 0x41f2e1
jmp 0x41f2f4
mov ecx, ecx
jg 0x41f2f7
nop
jle 0x41f2f7
jmp 0x41f2ed
jmp 0x41f300
mov edi, edi
jo 0x41f303
nop
jno 0x41f303
jmp 0x41f2f9
test edi, edi
jne 0x41f379
push esi
jmp 0x41f311
mov ecx, ecx
js 0x41f314
nop
jns 0x41f314
jmp 0x41f30a
jmp 0x41f31d
mov edi, edi
jae 0x41f320
nop
jb 0x41f320
jmp 0x41f316
push 0x4291c0
call fcn.00420230
mov esi, eax
add esp, 4
test esi, esi
je 0x41f36e
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 8]
push ecx
push edx
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
jmp 0x41f356
mov eax, eax
jg 0x41f359
nop
jle 0x41f359
jmp 0x41f34f
push esi
call fcn.00414d20
add esp, 4
jmp 0x41f36b
mov edx, edx
jo 0x41f36e
nop
jno 0x41f36e
jmp 0x41f364
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
jmp 0x41f382
mov ecx, ecx
js 0x41f385
nop
jns 0x41f385
jmp 0x41f37b
jmp 0x41f38e
mov eax, eax
jae 0x41f391
nop
jb 0x41f391
jmp 0x41f387
jmp 0x41f39a
mov ecx, ecx
jg 0x41f39d
nop
jle 0x41f39d
jmp 0x41f393
mov eax, edi
pop edi
pop ebp
ret