joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42be1d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4d6366
call fcn.004b8118
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x51eee0
mov dword [ebp - 4], ebx
call fcn.00424d3a
lea eax, [ebp + 8]
mov esi, 0x51ec80
push eax
mov ecx, esi
call fcn.00424d3a
push 1
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push esi
call fcn.00424d19
lea edi, [ebp - 0x14]
call fcn.004669e0
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00424d3a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004247d4
mov edi, 0x4e1f68
push edi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00424c44
test eax, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0xd], bl
je 0x42bebd
push edi
mov ecx, esi
call fcn.0042b47b
mov esi, dword [0x51ec80]
call fcn.00469260
push dword [0x51ec80]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42bf0a
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Diff_Init:_Cannot_create_TempDir
call fcn.0042462c
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.General
mov byte [ebp - 4], 3
call fcn.0042462c
push 3
mov byte [ebp - 4], bl
call fcn.0046b810
add esp, 0xc
push 0x51ecac
call fcn.0042bf63
mov esi, 0x4e3948
push esi
mov ecx, 0x51ec84
call fcn.00425210
push esi
mov ecx, 0x51ec8c
call fcn.00425210
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042462c
mov esi, 0x51ecdc
call fcn.0042c01b
call fcn.00452430
call fcn.00457020
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
inc eax
call fcn.004b81f0
ret
Function at 0x42c673
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x518f10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [esi], ebx
je 0x42c695
inc eax
jmp 0x42c863
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x32c], ebx
call fcn.004b25f0
push 0x110
lea eax, [ebp - 0x31c]
push ebx
push eax
call fcn.004b25f0
add esp, 0x18
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42c861
cmp dword [ebp - 0x310], 2
jne 0x42c861
cmp dword [ebp - 0x31c], 5
jb 0x42c861
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x42c861
lea eax, [ebp - 0x328]
push eax
push 0x4dca7c
push 1
push ebx
push 0x4dca8c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42c843
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x42c843
push edi
push dword [ebp - 0x324]
call fcn.004b4759
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop ecx
mov dword [esi + 8], eax
cmp dword [ebp - 0x324], ebx
je 0x42c77a
push dword [ebp - 0x324]
call edi
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x42c842
push dword [ebp - 0x324]
call fcn.004b4759
pop ecx
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x324], ebx
je 0x42c7b4
push dword [ebp - 0x324]
call edi
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push str.WinNT:___s
push 0x104
push eax
call fcn.004b49b1
add esp, 0x10
lea eax, [ebp - 0x32c]
push eax
push 0x4dc93c
lea eax, [ebp - 0x20c]
push eax
call sub.ACTIVEDS.dll_ADsGetObject
test eax, eax
jl 0x42c842
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x42c842
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x324]
push str.Domain
call fcn.004b1f00
pop ecx
pop ecx
test eax, eax
jne 0x42c82c
mov dword [esi + 4], 1
cmp dword [ebp - 0x324], ebx
je 0x42c83c
push dword [ebp - 0x324]
call edi
mov dword [esi], 1
pop edi
mov eax, dword [ebp - 0x328]
cmp eax, ebx
je 0x42c853
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
jne 0x42c85d
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esi]
jmp 0x42c863
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b134c
leave
ret
Function at 0x42f3c5
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x51f170], esi
jne 0x42f446
mov dword [0x51f170], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00465450
pop ecx
test eax, eax
jne 0x42f435
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x51ebac], eax
cmp dword [0x51f174], esi
jne 0x42f422
push esi
push esi
push 0x4e3948
call fcn.004b4759
pop ecx
push eax
push 0x42f045
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x51f174], eax
push 0x190
push dword [0x51ebac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret
push str.This_is_a_System_process__so_skipping_window_display.
push str.GfxServerInit
call fcn.00464cb0
pop ecx
pop ecx
pop esi
ret

Function at 0x42f84a
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ecx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call ebx
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
sub esi, dword [ebp - 0xc]
sub edi, dword [ebp - 8]
sub esi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x20]
add esi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x42f8e0
lea ecx, [ebp - 0x34]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
test eax, eax
jg 0x42f8d2
test ecx, ecx
jle 0x42f8e0
jmp 0x42f8d7
sub eax, dword [ebp - 0x28]
add edi, eax
test ecx, ecx
jle 0x42f8e0
sub ecx, dword [ebp - 0x2c]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42fa3d
Capabilities:
Create directory
Create thread

Disassembly:
push 0x30
mov eax, 0x4d48b2
call fcn.004b8118
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, 0x4e2490
push ebx
mov dword [ebp - 0x18], esi
call fcn.0042462c
lea eax, [ebp - 0x10]
push eax
call fcn.004661a0
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x10
call fcn.004a2eb2
mov edi, eax
pop ecx
cmp edi, esi
je 0x42faa4
lea ecx, [edi + 8]
call fcn.0042248a
lea ecx, [edi + 0xc]
call fcn.0042248a
mov dword [0x51ebb4], edi
jmp 0x42faaa
mov dword [0x51ebb4], esi
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Troubleshoot.log
call fcn.0042462c
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.0042462c
mov eax, dword [ebp - 0x14]
push eax
call fcn.004661a0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
call fcn.00466390
add esp, 0xc
call fcn.0042f466
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push 0x42f76a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x42fb39
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
jg 0x42fb25
mov eax, dword [ebp - 0x34]
call fcn.004b81f0
ret 4

Function at 0x430338
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [edx - 0xc]
push edi
or edi, 0xffffffff
cmp dword [0x51ec34], 0
jne 0x430354
call fcn.0048ea10
lea ecx, [esi + esi]
xor eax, eax
test ecx, ecx
jle 0x430378
movzx esi, byte [eax + edx]
xor esi, edi
and esi, 0xff
shr edi, 8
xor edi, dword [esi*4 + 0x51e7a8]
inc eax
cmp eax, ecx
jl 0x43035d
lea ecx, [edx - 0x10]
call fcn.0042201a
mov eax, edi
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x430388
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x4303a7
mov eax, dword [ebp + 8]
mov dl, cl
and dl, 0x7f
add eax, ecx
add dl, 0x21
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x430392
pop ebp
ret
Function at 0x430915
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
push 0x4c
mov eax, 0x4d1b24
call fcn.004b8118
push 9
xor eax, eax
xor esi, esi
pop ecx
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.0046c740
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.0046c830
add esp, 4
mov byte [ebp - 4], 1
lea eax, [ebx + 4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00424617
call fcn.00430338
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.00430338
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.00430338
mov dword [ebx + 0x20], eax
lea eax, [ebx + 8]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00424617
call fcn.00430338
mov dword [ebx + 0x24], eax
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebx + 0x30]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
or edx, 0xffffffff
cmp dword [0x51ec34], esi
jne 0x4309db
call fcn.0048ea10
movzx eax, byte [ebx + esi + 0x18]
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x51e7a8]
inc esi
cmp esi, 0x24
jl 0x4309db
lea esi, [ebx + 0x14]
push 0xa
not edx
mov dword [esi], edx
pop ecx
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor eax, eax
mov cl, al
and cl, 0x7f
add cl, 0x21
xor byte [ebp + eax - 0x58], cl
inc eax
cmp eax, 0x28
jb 0x430a0a
push dword [ebx + 4]
lea eax, [ebp - 0x1c]
push str.Cameyo.AuthToken.AppId._s
push eax
call fcn.00466ad0
add esp, 0xc
push dword [eax]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov dword [ebp - 0x10], eax
call fcn.0042201a
cmp dword [ebp - 0x10], esi
je 0x430a58
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x28
pop edi
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00424617
call fcn.004674a0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x430abd
push 0x5c
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00424617
lea eax, [ebp - 0x20]
push eax
call fcn.00466ee0
mov esi, dword [eax]
add esp, 0xc
call fcn.00469260
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00424617
call fcn.004674a0
pop ecx
pop ecx
mov esi, eax
cmp dword [ebp - 0x10], 0
je 0x430ad5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, esi
call fcn.004b81f0
ret
Function at 0x430af3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
or edx, 0xffffffff
cmp dword [0x51ec34], 0
push esi
mov esi, eax
jne 0x430b0b
call fcn.0048ea10
xor eax, eax
movzx ecx, byte [esi + eax + 4]
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x51e7a8]
inc eax
cmp eax, 0x24
jl 0x430b0d
mov esi, dword [esi]
not edx
cmp esi, edx
je 0x430b52
push ecx
mov eax, esp
mov dword [ebp - 4], esp
push edx
push esi
push str._ValidateIntegrity:_incorrect_CRC:__x_vs__x
push eax
call fcn.00466ad0
add esp, 0x10
call fcn.00430308
pop ecx
xor eax, eax
jmp 0x430b55
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x431e16
Capabilities:
Move file

Disassembly:
push 0xc
mov eax, 0x4d747e
call fcn.004b8118
and dword [ebp - 4], 0
push 0
call fcn.004b514b
push eax
call fcn.004b5638
call fcn.004b564a
mov esi, eax
call fcn.004b564a
add esp, 4
mov dword [ebp - 0x18], esp
shl esi, 0x10
xor eax, esi
mov esi, esp
push eax
push 0x5c
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x18]
push eax
call fcn.00466e00
add esp, 0xc
mov byte [ebp - 4], 1
push dword [eax]
push str._s._x.ToDelete
push esi
call fcn.00466ad0
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
add esp, 0x10
push eax
call fcn.004779d0
pop ecx
pop ecx
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push 0
push ecx
mov dword [ebp + 0x10], esp
mov ecx, esp
push eax
call fcn.00424d19
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004776d0
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042201a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, esi
call fcn.004b81f0
ret

Function at 0x431ef5
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x4d33c2
call fcn.004b8181
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.004b25f0
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x26c], esp
push 0x4e97a8
call fcn.0042462c
lea eax, [ebp - 0x26c]
push eax
mov ecx, edi
call fcn.004779d0
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x26c]
mov esi, eax
cmp esi, 0xffffffff
setne byte [ebp - 0x261]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x261], 0
je 0x431ffd
push ecx
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call fcn.0042462c
lea eax, [ebp - 0x268]
push eax
mov ecx, edi
call fcn.004779d0
and dword [ebp - 4], 0
add esp, 4
mov eax, esp
mov dword [ebp - 0x270], esp
push dword [ebp - 0x268]
push str.DeleteSharingViolationRemains:_deleting__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x431f7a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004b8204
ret
Function at 0x4320d5
Capabilities:
Enumerate files on windows

Disassembly:
push 0x278
mov eax, 0x4d3364
call fcn.004b8181
xor eax, eax
mov dword [ebp - 4], eax
push 0x24c
push eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x25c]
push eax
call fcn.004b25f0
pop ecx
pop ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.00424d19
call fcn.00469bd0
push eax
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x268]
push eax
call fcn.0046d960
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
push dword [edi]
push dword [ebp + 8]
push str.DeleteRegDatFiles:__s____s__LE_d
push ecx
call fcn.00466ad0
add esp, 0x14
call fcn.00431948
pop ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x4e9988
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.0042487b
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x27c]
mov ebx, eax
cmp ebx, 0xffffffff
setne byte [ebp - 0x261]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x261], 0
je 0x4322e8
push 0x5c
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.00424d19
lea eax, [ebp - 0x268]
push eax
call fcn.00466ee0
add esp, 0xc
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
push 0x4e1f68
call fcn.0042462c
push ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x284], esp
push eax
call fcn.0042462c
push ecx
lea eax, [ebp - 0x268]
mov dword [ebp - 0x274], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 4
call fcn.00424d19
lea edi, [ebp - 0x278]
mov byte [ebp - 4], 2
call fcn.00466390
add esp, 8
mov eax, edi
mov dword [ebp - 0x274], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 5
call fcn.00424d19
call fcn.00469bd0
and dword [ebp - 0x26c], eax
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.0046d960
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 6
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
push dword [edi]
push dword [ebp + 8]
push str.DeleteRegDatFiles:_deleting_satellite_file:__s____s__LE_d
push ecx
call fcn.00466ad0
add esp, 0x14
call fcn.00431948
pop ecx
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4321e8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [ebp - 0x26c], 0
jne 0x43230d
push ecx
mov eax, esp
mov dword [ebp - 0x274], esp
push str.DeleteRegDatFiles_failed
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [ebp - 0x26c]
call fcn.004b8204
ret
Function at 0x43443b
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x1c
mov eax, 0x4d32dc
call fcn.004b8118
push ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x24], esp
push dword [ebp + 8]
push str.Loader_SetVirtEnvVariables:_in___s_
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
mov dword [ebp - 0x1c], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.::
lea edi, [ebp - 0x1c]
call fcn.0042462c
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x28], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 1
call fcn.00424d19
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
call fcn.0046a820
add esp, 8
mov eax, esp
mov dword [ebp - 0x28], esp
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
push str.Loader_SetVirtEnvVariables:_setting_Env_variable:__s
push eax
call fcn.00466ad0
add esp, 0xc
call fcn.00431948
pop ecx
push ebx
push 0x3d
lea ecx, [ebp - 0x10]
call fcn.00426cae
mov esi, eax
cmp esi, 0xffffffff
jne 0x4344f1
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
push str.Loader_SetVirtEnvVariables:__error:_Env_variable_doesnt_contain_
push eax
call fcn.00466ad0
pop ecx
pop ecx
call fcn.00431948
pop ecx
jmp 0x4345de
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.0042481b
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00424d19
push ebx
lea ecx, [ebp - 0x14]
lea eax, [esi + 1]
push ecx
mov byte [ebp - 4], 4
call fcn.004246c3
push str._ExistingValue_
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.0042473f
mov esi, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4345c3
call fcn.004a35be
push eax
lea ecx, [ebp - 0x18]
call fcn.0042249e
push ebx
push ebx
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
call edi
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x43458b
push eax
lea ecx, [ebp - 0x18]
call fcn.004224c6
push dword [ebp - 0x24]
push eax
push esi
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.0042493a
cmp edi, ebx
jne 0x43458b
push 0x4e3948
lea ecx, [ebp - 0x18]
call fcn.00425210
mov edi, dword [ebp - 0x18]
push edi
push str._ExistingValue_
lea eax, [ebp - 0x14]
push eax
call fcn.0042ad3b
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push str.Loader_SetVirtEnvVariables:_replacing__ExistingValue__with_existing_value:
push eax
call fcn.004248d0
add esp, 0xc
call fcn.00431948
pop ecx
lea ecx, [edi - 0x10]
call fcn.0042201a
mov edi, dword [ebp - 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [edi - 0x10]
call fcn.0042201a
lea ecx, [esi - 0x10]
call fcn.0042201a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x43446c
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
call fcn.004b81f0
ret