joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abaf0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4abbce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004b9bd0
lea eax, [ebp - 0xc]
call fcn.004ba04c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004b9ffc
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4abbb8
mov eax, dword [ebp - 0x10]
call fcn.004b7a48
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4abbb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004b9ffc
push eax
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x4abb9b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4abbdc
mov eax, dword [ebp - 0x18]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4abb9b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abbb8
mov eax, dword [ebp - 0x18]
call fcn.004b7a64
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abbd5
lea eax, [ebp - 0xc]
call fcn.004b9b38
ret

Function at 0x4b7f04
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004b9b38
test esi, esi
jne 0x4b7f3a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004b9c28
jmp 0x4b7f58
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004b7da8
mov edi, eax
test esi, esi
je 0x4b7f58
cmp dword [ebx], 0
je 0x4b7f58
dec esi
jmp 0x4b7f41
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4b8b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4ed504]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4b8bb8
push reloc.OLEAUT32.DLL_SysReAllocString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4b8b98
xor eax, eax
push ebp
push 0x4b8b91
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4b8bd4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8b98
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
movzx eax, word [0x4ed504]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4ed504], ax
mov esp, ebp
pop ebp
ret
Function at 0x4b9904
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f58bc], 0
je 0x4b9965
cmp word [0x4f5a90], 0xd7b2
jne 0x4b992d
cmp dword [0x4f5a98], 0
jbe 0x4b992d
mov eax, 0x4f5a8c
call dword [0x4f5aa8]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4b998c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4ed510], 0
jne 0x4b9981
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret

Function at 0x4b9abc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4ed4f0], 0
je 0x4b9ae2
mov edx, esi
mov eax, ebx
call dword [0x4ed4f0]
jmp 0x4b9af1
mov eax, 8
call fcn.004b7a48
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4f58bd], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4b9a84
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4bb3ac
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4bb5dc
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4bb42f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4bb5dc
push reloc.OLEAUT32.DLL_SysReAllocString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4bb42f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4bb5f8
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4bb4b8
xor eax, eax
push ebp
push 0x4bb4b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004bb1e8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4bb496
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4bb618
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4bb496
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb4b8
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4bb5d2
cmp byte [ebp - 0xd], 0
jne 0x4bb4ff
cmp byte [ebp - 0x12], 0
je 0x4bb5d2
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4bb518
dec ebx
cmp byte [ebx], 0x2e
je 0x4bb527
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4bb517
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4bb5d2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4bb564
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4bb5d2
cmp byte [ebp - 0xd], 0
je 0x4bb5d2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4bb5d2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cd930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4cd94c
call fcn.004cea94
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4cd96b
test bl, 1
je 0x4cd96b
call fcn.004d499c
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4d1780
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004cc6d8
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004cc7a0
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004cc7a0
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4f1c0d
lea ecx, [ebp - 0x200]
push ecx
call fcn.004cc6d8
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004cc7a0
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004d29e8
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4d1891
push esi
call fcn.004cc7a0
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004cc7a0
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004cc368
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4d1868
xor eax, eax
jmp 0x4d1918
push esi
call fcn.004cc7a0
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004cc7a0
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004cc630
add esp, 0xc
jmp 0x4d18d1
mov edi, dword [ebx + 0x24]
push edi
call fcn.004cc7a0
pop ecx
push eax
push esi
call fcn.004cc7a0
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004cc7a0
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004cc388
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4d18d1
xor eax, eax
jmp 0x4d1918
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004cc6d8
add esp, 8
push 0x4f1c0f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004cc6d8
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004cc6d8
add esp, 8
push 0x4f1c11
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004cc6d8
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d4930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x4d495d
jmp 0x4d4994
call fcn.004d48e0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004cc7a0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004cc7a0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d4a14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4f2240], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4d4aee
cmp dword [0x4f223c], 0
jne 0x4d4aee
cmp dword [0x4f2420], 0
je 0x4d4aa8
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004d47e0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d4a8e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004d47e0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d4a8e
lea ebx, [ebp - 0x84]
jmp 0x4d4a8f
inc ebx
call fcn.004d49d0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4d4b29
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4f2244
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004cc7a0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4f2247
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4d4b29
cmp dword [0x4f223c], 0
je 0x4d4b08
cmp dword [0x4f223c], 0xffffffff
je 0x4d4b29
push esi
call dword [0x4f223c]
pop ecx
mov eax, dword [0x4f2240]
test eax, eax
je 0x4d4b29
cmp dword [0x4f2240], 0xffffffff
je 0x4d4b29
cmp byte [eax], 0
je 0x4d4b29
push esi
push eax
call fcn.004d4930
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401090
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4010d2
push str.CrashServerDamon_CommandLineToArgvW_Failed_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x401106
mov dword [ebp - 0x10], 0
jmp 0x4010e4
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 4]
jge 0x401106
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
push edx
push str.CrashServerDamon_Command__s_n
call dword [sym.imp.MSVCR90.dll_wprintf]
add esp, 8
jmp 0x4010db
cmp dword [ebp - 8], 0
je 0x40113e
cmp dword [ebp - 4], 2
jl 0x40113e
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str.CrashServerDamon_ProId__s_n
call dword [sym.imp.MSVCR90.dll_wprintf]
add esp, 8
mov byte [ebp - 9], 1
jmp 0x401142
mov byte [ebp - 9], 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x401160
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x40117d
xor al, al
jmp 0x4011f8
xor eax, eax
mov word [ebp - 0x88], ax
push 0x7e
push 0
lea ecx, [ebp - 0x86]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str.GlobalMutex_s
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x88]
push ecx
push str.CrashServerDamon_MutexName__s_n
call dword [sym.imp.MSVCR90.dll_wprintf]
add esp, 8
lea edx, [ebp - 0x88]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4011f6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4011f8
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040121e
mov esp, ebp
pop ebp
ret

Function at 0x40121e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401228
repz ret
jmp fcn.004014d9
Function at 0x401b70
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x463070]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.00437380
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x401bd2
cmp dword [esp + 8], 0
jne 0x401bd2
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00433af9
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.00433af9
add esp, 0x118
ret
Function at 0x4028d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x320
mov eax, dword [0x463070]
xor eax, esp
mov dword [esp + 0x31c], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40292b
push 0x104
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.ntdll.dll
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x402973
push str.RtlGetVersion
push eax
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402973
lea ecx, [esp]
push ecx
call eax
test eax, eax
jl 0x402973
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov dword [esi], edx
mov dword [edi], eax
mov eax, 1
mov ecx, dword [esp + 0x31c]
xor ecx, esp
call fcn.00433af9
add esp, 0x320
ret
mov ecx, dword [esp + 0x31c]
xor ecx, esp
xor eax, eax
call fcn.00433af9
add esp, 0x320
ret

Function at 0x402a40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20
mov eax, dword [0x463070]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
test esi, esi
je 0x402b41
cmp word [esi], 0
je 0x402b41
push edi
call fcn.00402a10
mov edi, eax
test edi, edi
je 0x402b2c
mov eax, esi
lea edx, [eax + 2]
jmp 0x402a80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402a80
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 2
push 0
push 0x4574f8
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
je 0x402b12
mov ecx, dword [str.Environment]
mov edx, dword [0x45746c]
mov eax, dword [0x457470]
mov dword [esp + 0xc], ecx
mov ecx, dword [0x457474]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 8]
push ecx
push 0xbb8
mov dword [esp + 0x18], edx
mov edx, dword [0x457478]
push 1
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
push edx
push 0
mov dword [esp + 0x28], eax
mov eax, dword [0x45747c]
push 0x1a
push 0xffff
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00433af9
add esp, 0x20
ret
xor esi, esi
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00433af9
add esp, 0x20
ret
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00433af9
add esp, 0x20
ret
Function at 0x402b60
Capabilities:
Get common file path
Set environment variable

Disassembly:
sub esp, 0x20c
mov eax, dword [0x463070]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.00437380
add esp, 0xc
call fcn.00402990
cmp eax, 5
ja case.default.0x402b9c
jmp dword [eax*4 + 0x402cdc]
push 0
push 0x28
lea edx, [esp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x402cc2
push esi
push edi
lea edi, [esp + 8]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402bc5
mov ecx, 0xa
mov esi, str.Local_SettingsTemp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
jmp case.default.0x402b9c
push 0
push 0x1a
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x402cc2
lea eax, [esp]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402c05
mov ecx, dword [str.LocalTemp]
mov edx, dword [0x4574d4]
mov dword [eax], ecx
mov ecx, dword [0x4574d8]
mov dword [eax + 4], edx
mov edx, dword [0x4574dc]
mov dword [eax + 8], ecx
mov ecx, dword [0x4574e0]
mov dword [eax + 0xc], edx
mov edx, dword [0x4574e4]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
jmp case.default.0x402b9c
push 0x208
lea eax, [esp + 4]
push 0
push eax
call fcn.00437380
lea eax, [esp + 0xc]
add esp, 0xc
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402c63
mov ecx, dword [str.C:Temp]
mov edx, dword [0x4574ec]
mov dword [eax], ecx
mov ecx, dword [0x4574f0]
mov dword [eax + 4], edx
mov edx, dword [0x4574f4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp]
push eax
push 0x4574f8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x402cc2
lea ecx, [esp]
call fcn.00402a40
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00433af9
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.00433af9
add esp, 0x20c
ret
Function at 0x402d00
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x463070]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
push esi
push edi
push 0x800
lea eax, [esp + 0x14]
push 0
push eax
mov esi, ecx
call fcn.00437380
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x400
call ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x10]
push edx
call ebp
mov edi, eax
cmp edi, 1
je 0x402d9c
call fcn.00402b60
mov edi, eax
test edi, edi
je 0x402da0
push 0x800
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00437380
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x400
call ebx
lea edx, [esp + 0x10]
push edx
call ebp
test eax, eax
jne 0x402d9c
push eax
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x402da0
test edi, edi
jne 0x402da4
xor eax, eax
jmp 0x402dbe
lea ecx, [esp + 0x10]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
call fcn.00409c70
mov eax, 1
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00433af9
add esp, 0x804
ret
Function at 0x406020
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [0x46b5e8]
cmp dword [eax - 8], 0
jne 0x4060e5
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push edi
call esi
mov ecx, 0x3ff
and ax, cx
movzx edi, ax
call esi
shr ax, 0xa
movzx ecx, ax
movzx eax, di
add eax, 0xfffffffc
cmp eax, 0x81
ja case.0x406062.5
movzx edx, byte [eax + 0x4060fc]
jmp dword [edx*4 + 0x4060e8]
mov eax, 2
cmp ax, cx
mov eax, 0x46b5e8
jne 0x406086
mov edi, 0x45759c
call fcn.00409cf0
pop edi
pop esi
pop ebx
ret
mov edi, str.zh_TW
call fcn.00409cf0
pop edi
pop esi
pop ebx
ret
push 0x4575b0
push 0x4575b0
jmp 0x4060d0
mov edi, 0x4575b8
mov eax, 0x46b5e8
call fcn.00409cf0
pop edi
pop esi
pop ebx
ret
mov edi, 0x4575c0
mov eax, 0x46b5e8
call fcn.00409cf0
pop edi
pop esi
pop ebx
ret
push 0x45759c
push 0x45759c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov esi, 0x46b5e8
call fcn.00409c70
pop edi
pop esi
pop ebx
ret