joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488f50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf79a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0x4dd75c
xor esi, esi
push eax
mov dword [ebp - 0x18], esi
call fcn.004a878a
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x488fb8
mov ecx, dword [0x4f3c90]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp ecx, esi
je 0x488fa6
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push esi
push ebx
call fcn.004a8d2a
add esp, 0xc
push ebx
call fcn.004a8bfb
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], esi
cmp edi, esi
jne 0x489009
push ebx
call fcn.004a8e26
mov edx, dword [0x4f3c90]
mov eax, dword [ebp + 8]
mov ecx, edx
add esp, 4
mov dword [eax], edx
cmp ecx, esi
je 0x489129
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push esi
push ebx
call fcn.004a8d2a
lea eax, [edi + 4]
add esp, 0xc
push eax
call fcn.004a5222
add esp, 4
push ebx
push edi
mov esi, eax
push 1
push esi
call fcn.004a8a41
push ebx
mov edi, eax
call fcn.004a8e26
add esp, 0x14
push 0
push edi
push esi
mov byte [esi + edi], 0
mov byte [esi + edi + 1], 0
mov byte [esi + edi + 2], 0
mov byte [esi + edi + 3], 0
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test al, al
jne 0x48909b
cmp byte [esi], 0xef
mov eax, 2
jne 0x489076
cmp byte [esi + 1], 0xbb
jne 0x489076
cmp byte [esi + 2], 0xbf
jne 0x489076
lea ecx, [eax + 1]
lea eax, [ecx - 2]
jmp 0x489079
mov ecx, dword [ebp - 0x10]
push eax
lea ebx, [esi + ecx]
call fcn.004876e0
add esp, 4
push esi
mov edi, eax
call fcn.004a5105
add esp, 4
mov esi, edi
mov dword [ebp - 0x10], 0
jmp 0x4890bf
mov al, byte [esi]
cmp al, 0xef
jne 0x4890ae
cmp byte [esi + 1], 0xff
jne 0x4890ae
mov dword [ebp - 0x10], 2
cmp al, 0xff
jne 0x4890bf
cmp byte [esi + 1], 0xfe
jne 0x4890bf
mov dword [ebp - 0x10], 2
test esi, esi
jne 0x4890e7
mov ecx, dword [0x4f3c90]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x489129
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0
lea ecx, [esi + edx]
push eax
call fcn.00488d70
push esi
call fcn.004a5105
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x489110
inc dword [eax + 0x30]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
mov dword [ebp - 0x18], 1
call fcn.004897c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ca50
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf708
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0xc]
cmp eax, edi
jne 0x48cac0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48caab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x84000000
push edi
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
push ecx
mov edx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
push eax
push str.CHttpRemoteFile::SetLocation:_InternetOpenUrl__s__d
push edx
call fcn.00462190
add esp, 0x10
call fcn.0048c9e0
mov esi, dword [esi + 0x10]
add esp, 4
cmp esi, edi
je 0x48cb30
push edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x20000013
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x48cb6b
cmp eax, 0xc8
jne 0x48cb6b
mov edi, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cb56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push str.CHttpRemoteFile::SetLocation:_return_code:__d
push ecx
call fcn.00462190
add esp, 0xc
call fcn.0048c9e0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x48ca9f

Function at 0x48cbb0
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push 0
lea edx, [ebp - 4]
push edx
push eax
mov dword [eax], 0
mov eax, dword [ecx + 0x10]
push 0x20000005
push eax
mov dword [ebp - 4], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x48cbe9
mov eax, 1
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x48d1b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbfe8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4eec64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x48d22b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d217
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.00423fab
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004657a0
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
test eax, eax
mov eax, dword [ebp + 8]
jne 0x48d2a1
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d217
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d2ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x48d2d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf6b1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, ebx
call fcn.0048c880
lea esi, [ebx + 0x18]
mov dword [ebp - 4], 0
call fcn.00430714
mov byte [ebp - 4], 1
call fcn.004964ca
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d32f
push 0x80004005
call fcn.00421000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx + 0x98], eax
mov byte [ebp - 4], 2
call fcn.0048d420
push ecx
mov dword [ebx + 0x94], 0
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x48]
mov ecx, esp
mov dword [ebp - 0x10], esp
push edx
mov edx, dword [edi + 0x44]
push eax
mov eax, dword [edi + 0x30]
push edx
push eax
push str.CVirtAutoUpdate:_AutoUpdate_s__BaseDirName_s__CarrierExe_s__CloudPkgId_s
push ecx
call fcn.00462190
add esp, 0x18
call fcn.0048c9e0
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x497e48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x497e6c
cmp dword [edi + 0x54], 0
jne 0x497e6c
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0049883f
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00497e09
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x49e01d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x49e064
call fcn.0049883f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x49e064
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x49e080
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0049db95
mov esi, eax
test edi, edi
je 0x49e07e
test ebx, ebx
je 0x49e07e
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4a4220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4eec64]
jne 0x4a422a
repz ret
jmp fcn.004ab33e
Function at 0x4019a0
Capabilities:
Manipulate user privileges

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x4019b3
xor eax, eax
pop ebx
add esp, 0x14
ret
lea eax, [esp + 0x1c]
push eax
call fcn.00401000
add esp, 4
test eax, eax
je 0x4019ce
mov eax, 1
pop ebx
add esp, 0x14
ret
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x10]
push edx
push ebx
call fcn.00401190
add esp, 0xc
test eax, eax
je 0x4019f9
mov eax, dword [esp + 0x1c]
push eax
call sub.ADVAPI32.dll_LsaClose
mov eax, 2
pop ebx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.00401140
add esp, 4
test eax, eax
je 0x401a20
mov ecx, dword [esp + 0x20]
push ecx
call sub.ADVAPI32.dll_LsaClose
pop edi
mov eax, 3
pop ebx
add esp, 0x14
ret
mov eax, str.SeServiceLogonRight
mov dword [esp + 0x18], eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401a30
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push esi
mov word [esp + 0x18], dx
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
add eax, 2
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x2c]
push edi
push eax
mov dword [esp + 0x20], 0xffffffff
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
je 0x401ac0
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov esi, eax
cmp esi, 2
je 0x401ac0
push edi
call dword [0x42103f]
mov ecx, dword [esp + 0x24]
push ecx
call sub.ADVAPI32.dll_LsaClose
push esi
call fcn.004020f0
add esp, 4
push eax
push ebx
push 0x40000209
call fcn.0041438a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0x10
pop esi
pop edi
mov eax, 4
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0xc]
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x401b02
lea esp, [esp]
mov dx, word [eax + esi*8]
cmp dx, word [esp + 0x18]
jne 0x401afb
movzx ecx, word [esp + 0x1a]
mov edx, dword [esp + 0x1c]
mov eax, dword [eax + esi*8 + 4]
push ecx
push edx
push eax
call fcn.00414a36
add esp, 0xc
test eax, eax
je 0x401b63
mov eax, dword [esp + 0xc]
inc esi
cmp esi, dword [esp + 0x10]
jb 0x401ad0
push eax
call sub.ADVAPI32.dll_LsaFreeMemory
mov ecx, dword [esp + 0x24]
push 1
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
call sub.ADVAPI32.dll_LsaAddAccountRights
push edi
mov esi, eax
call dword [0x42103f]
mov edx, dword [esp + 0x24]
push edx
call sub.ADVAPI32.dll_LsaClose
test esi, esi
je 0x401b87
push esi
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
call fcn.004020f0
add esp, 4
push eax
push 0x4000020a
call fcn.0041438a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0xc
pop esi
pop edi
mov eax, 5
pop ebx
add esp, 0x14
ret
push edi
call dword [0x42103f]
mov ecx, dword [esp + 0xc]
push ecx
call sub.ADVAPI32.dll_LsaFreeMemory
mov edx, dword [esp + 0x24]
push edx
call sub.ADVAPI32.dll_LsaClose
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x14
ret
push ebx
push 0x40000204
call fcn.0041438a
add eax, 0x20
push eax
call fcn.004022a0
add esp, 0xc
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x401ca0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
jne 0x401cdd
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push ebx
push 0xc00003fe
push 1
call fcn.00402230
add esp, 0x14
pop edi
xor eax, eax
pop ebx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
lea eax, [edi + edi]
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x401d1b
push eax
push str.expand_environment_string
push str.ExpandEnvironmentStrings__
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
ret
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x401d5c
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push ebx
push 0xc00003fe
push 1
call fcn.00402230
add esp, 0x14
push esi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
ret
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x401d70
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, dword [esp + 8]
xor eax, eax
mov dword [esp + 8], eax
cmp word [ebp], ax
je 0x401e2e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
push edi
mov edi, edi
cmp word [ebp], 0
mov esi, ebp
je 0x401daf
lea esp, [esp]
cmp word [esi], 0x3d
je 0x401db5
add esi, 2
cmp word [esi], 0
jne 0x401da0
cmp word [esi], 0x3d
jne 0x401e19
xor eax, eax
mov word [esi], ax
cmp byte [esp + 0x18], al
je 0x401df3
add esi, 2
push esi
call fcn.00401ca0
mov edi, eax
add esp, 4
test edi, edi
je 0x401df0
push edi
push ebp
call ebx
test eax, eax
invalid
jne 0x401dde
inc dword [esp + 0x14]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x401e00
push esi
jmp 0x401df5
push 0
push ebp
call ebx
test eax, eax
jne 0x401e00
inc dword [esp + 0x14]
add esi, 2
cmp word [esi], 0
je 0x401e19
lea esp, [esp]
add esi, 2
cmp word [esi], 0
jne 0x401e10
cmp word [esi + 2], 0
lea ebp, [esi + 2]
jne 0x401d90
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401dd7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, dword [esp + 8]
xor eax, eax
mov dword [esp + 8], eax
cmp word [ebp], ax
je 0x401e2e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
push edi
mov edi, edi
cmp word [ebp], 0
mov esi, ebp
je 0x401daf
lea esp, [esp]
cmp word [esi], 0x3d
je 0x401db5
add esi, 2
cmp word [esi], 0
jne 0x401da0
cmp word [esi], 0x3d
jne 0x401e19
xor eax, eax
mov word [esi], ax
cmp byte [esp + 0x18], al
je 0x401df3
add esi, 2
push esi
call fcn.00401ca0
mov edi, eax
add esp, 4
test edi, edi
je 0x401df0
push edi
push ebp
call ebx
test eax, eax
invalid
jne 0x401dde
inc dword [esp + 0x14]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x401e00
push esi
jmp 0x401df5
push 0
push ebp
call ebx
test eax, eax
jne 0x401e00
inc dword [esp + 0x14]
add esi, 2
cmp word [esi], 0
je 0x401e19
lea esp, [esp]
add esi, 2
cmp word [esi], 0
jne 0x401e10
cmp word [esi + 2], 0
lea ebp, [esi + 2]
jne 0x401d90
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401e50
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
push esi
call fcn.00401c60
add esp, 4
call fcn.00401e40
mov edi, eax
test esi, esi
je 0x401e77
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop esi
ret

Function at 0x401ea0
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x54
push esi
call fcn.00408800
push 0x44
mov esi, eax
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00414af0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x68]
push eax
push 0x404
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
test eax, eax
je 0x401f11
mov ecx, dword [esp]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add esp, 0x54
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0x57
sete dl
lea edx, [edx + edx - 1]
mov eax, edx
add esp, 0x54
ret

Function at 0x401f60
Capabilities:
Query environment variable

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x401f6f
pop esi
ret
push edi
push esi
call fcn.00401c30
add esp, 4
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop esi
ret
Function at 0x4020f0
Capabilities:
Get thread local storage value
Identify system language via api
Set thread local storage value

Disassembly:
mov eax, dword [0x429600]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x40212b
push 0xffff
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x40211d
mov eax, str._out_of_memory_for_error_message_
pop esi
ret
mov ecx, dword [0x429600]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
push 0
push 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_FormatMessageW]
movzx edx, ax
push edx
push edi
push 0
push 0x1200
call ebx
test eax, eax
jne 0x40218c
push eax
push 0xffff
push esi
push eax
push edi
push eax
push 0x1200
call ebx
test eax, eax
jne 0x40218c
push edi
push str.system_error__lu
push 0xffffffffffffffff
push 0xffff
push esi
call fcn.0041453f
add esp, 0x14
test eax, eax
jge 0x40218c
pop edi
pop ebx
xor eax, eax
pop esi
ret
pop edi
pop ebx
mov eax, esi
pop esi
ret

Function at 0x4021a0
Capabilities:
Identify system language via api

Disassembly:
push ecx
push esi
push edi
push 0
push 0xffff
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
movzx ecx, ax
push ecx
push esi
push 0
push 0xb00
call edi
test eax, eax
jne 0x40221e
push eax
push 0xffff
lea edx, [esp + 0x10]
push edx
push eax
push esi
push eax
push 0xb00
call edi
test eax, eax
jne 0x40221e
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push str.system_error__lu
push 0xffffffffffffffff
push 0xffff
push eax
mov dword [esp + 0x1c], eax
call fcn.0041453f
add esp, 0x14
test eax, eax
jge 0x40221e
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret

Function at 0x402230
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x40
push esi
push str.nssm
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x402296
mov ecx, dword [esp + 0x50]
xor eax, eax
test ecx, ecx
je 0x402268
lea edx, [esp + 0x50]
cmp eax, 0xf
jge 0x402268
add edx, 4
mov dword [esp + eax*4 + 4], ecx
mov ecx, dword [edx]
inc eax
test ecx, ecx
jne 0x402255
mov edx, dword [esp + 0x4c]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push eax
push 0
push edx
mov dword [esp + eax*4 + 0x1c], 0
mov eax, dword [esp + 0x60]
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x40
ret
Function at 0x402430
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceExW]
movzx eax, ax
push eax
push esi
push 5
push 0
call edi
test eax, eax
jne 0x40246a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x717
je 0x40245d
xor eax, eax
pop edi
ret
push 0
push esi
push 5
push 0
call edi
test eax, eax
je 0x402459
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402459
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
pop edi
ret