joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b51b
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41b557
test dword [eax + 0x1c], 0x100
je 0x41b557
cmp byte [eax + 0x19], 4
jb 0x41b557
push dword [eax + 0x14]
mov edx, 0x408f98
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.00414ca8
mov eax, dword [0x475014]
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
je 0x41b5cb
cmp dword [ebp + 0xc], edi
je 0x41b5cb
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ecx, esi
call fcn.0041dbba
mov edx, eax
test edx, edx
jne 0x41b5aa
test esi, esi
je 0x41b5aa
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41b5fb
test dword [eax + 0x1c], 0x100
je 0x41b5fb
cmp byte [eax + 0x19], 2
jb 0x41b5fb
push 8
push 0x408f48
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
jmp 0x41b5f0
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x41b5ad
sub esi, ecx
mov dword [ebx], edx
mov ecx, dword [ebp + 0xc]
xor edi, edi
sar esi, 1
inc edi
lea eax, [esi + 1]
mov dword [ecx], eax
jmp 0x41b5fb
cmp eax, 0x475014
je 0x41b5fb
test dword [eax + 0x1c], 0x100
je 0x41b5fb
cmp byte [eax + 0x19], 2
jb 0x41b5fb
push 0x57
push 0x408f04
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
mov edx, 0x408f98
pop ecx
call fcn.00414cf4
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x41b73a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 8
mov dword [ebp - 4], esi
mov edi, esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
test eax, eax
jne 0x41b771
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41b7c7
mov eax, dword [ebp - 4]
push ebx
push 2
pop ebx
test eax, eax
je 0x41b790
xor ecx, ecx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00469ab4
pop ecx
mov edi, eax
xor eax, eax
test edi, edi
setne al
test eax, eax
je 0x41b7c6
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
test eax, eax
je 0x41b7c6
cmp word [edi], si
je 0x41b7c6
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20000070
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
pop ebx
cmp dword [ebp - 0xc], 1
jne 0x41b7d0
xor esi, esi
inc esi
test edi, edi
je 0x41b7db
push edi
call sub.msvcrt.dll_free
pop ecx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bf3f
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, ecx
mov edi, edx
xor edx, edx
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push edx
lea ecx, [ebp - 8]
mov esi, edx
push ecx
push edx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x41bfb7
cmp eax, 2
jne 0x41bfaf
test ebx, ebx
je 0x41bf9c
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41bf81
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
mov dword [ebp - 4], ecx
jmp 0x41bfc3
push 2
push 0x4090d0
call fcn.0041e5c8
pop ecx
pop ecx
jmp 0x41c0dd
push eax
push 0x409160
jmp 0x41bfa3
cmp dword [ebp - 8], edi
jne 0x41c136
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x41bfcd
push 0x20
pop ecx
mov dword [ebp - 4], ecx
mov edi, ecx
and edi, 1
add edi, ecx
lea ecx, [edi + 2]
call fcn.0041c805
mov esi, eax
test esi, esi
je 0x41c0dd
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [edi + esi], cx
test byte [ebp - 4], 1
je 0x41c00e
mov byte [edi + esi - 1], cl
test eax, eax
je 0x41c072
cmp eax, 2
jne 0x41bfaf
test ebx, ebx
je 0x41c063
push ebx
lea edx, [edi + 2]
mov ecx, esi
call fcn.0041be2c
test eax, eax
jns 0x41c035
push eax
push 0x4091a0
jmp 0x41bfa3
push dword [ebp - 4]
mov edi, dword [ebp - 0x10]
xor eax, eax
push esi
push edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x41c077
push eax
push dword [ebp + 8]
push 0x409238
call fcn.0041e5c8
add esp, 0xc
jmp 0x41c0dd
push 0x4091e0
call fcn.0041e5c8
jmp 0x41bfa9
mov edi, dword [ebp - 0x10]
jmp 0x41c079
xor ecx, ecx
cmp edi, 2
jne 0x41c0bc
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x41c0dd
lea ecx, [edi*2 + 2]
mov dword [ebp - 4], ecx
call fcn.0041c805
mov ebx, eax
test ebx, ebx
je 0x41c0da
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41c0c0
cmp eax, edi
jg 0x41c0c0
mov ecx, esi
call fcn.0041c919
mov esi, ebx
mov eax, esi
jmp 0x41c138
mov ecx, ebx
call fcn.0041c919
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409280
call fcn.0041e5c8
pop ecx
pop ecx
mov ebx, dword [ebp + 0xc]
mov ecx, esi
call fcn.0041c919
test ebx, ebx
je 0x41c136
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41c0ef
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
mov dword [ebp - 4], ecx
call fcn.0041c805
mov esi, eax
test esi, esi
je 0x41c136
mov edx, dword [ebp - 4]
mov ecx, esi
push ebx
call fcn.0041be2c
test eax, eax
jns 0x41c0bc
push eax
push 0x4092d4
call fcn.0041e5c8
pop ecx
pop ecx
mov ecx, esi
call fcn.0041c919
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c146
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], 4
push edi
mov edi, edx
test ebx, ebx
jne 0x41c171
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x41c1d9
push esi
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
jne 0x41c1b1
mov eax, dword [ebp + 0xc]
push 4
push ebx
push 4
push 0
push edi
push dword [ebp - 8]
mov dword [ebx], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x41c1bb
push esi
push edi
push 0x409238
jmp 0x41c1c7
test esi, esi
jne 0x41c1c0
cmp dword [ebp - 0xc], 4
jne 0x41c1c0
xor eax, eax
inc eax
jmp 0x41c1d8
push esi
push edi
push 0x409318
call fcn.0041e5c8
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41c22f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x41c25e
mov edx, dword [ebp + 0xc]
push ebx
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x41c245
sub edx, ebx
sar edx, 1
pop ebx
lea edx, [edx*2 + 2]
jmp 0x41c260
mov edx, ecx
push edx
push dword [ebp + 0xc]
push 1
push ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
je 0x41c28b
push eax
push dword [ebp + 8]
push 0x409238
call fcn.0041e5c8
add esp, 0xc
xor eax, eax
jmp 0x41c28e
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x41c297
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x20019
xor edi, edi
xor ebx, ebx
and dword [ebp - 0xc], ebx
mov edx, 0x40ee38
push edi
mov ecx, SysReAllocString
call fcn.0041be9e
mov esi, eax
test esi, esi
je 0x41c38c
xor ecx, ecx
lea eax, [ebp - 0xc]
push ecx
push ecx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x41c2f4
push eax
push 0x409360
jmp 0x41c37e
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push 0
push esi
call fcn.0045a327
test eax, eax
je 0x41c385
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
cmp ecx, 0x7ffffffe
ja 0x41c385
lea ecx, [ecx*2 + 2]
call fcn.0041c805
mov edi, eax
test edi, edi
je 0x41c385
push dword [ebp - 4]
push edi
push 0
jmp 0x41c366
push 0x20019
push 0
mov edx, edi
mov ecx, esi
call fcn.0041be9e
mov dword [ebp - 8], eax
test eax, eax
je 0x41c361
push dword [ebp + 0x10]
push ebx
push edi
push eax
call fcn.0045a327
push dword [ebp - 8]
test eax, eax
je 0x41c39e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
push dword [ebp - 4]
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x41c331
cmp eax, 0x103
je 0x41c385
push eax
push 0x4093a0
call fcn.0041e5c8
pop ecx
pop ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.0041c919
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c385
Function at 0x41c3ab
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41c3f9
test byte [eax + 0x1c], 2
je 0x41c3f9
cmp byte [eax + 0x19], 5
jb 0x41c3f9
push dword [eax + 0x14]
mov edx, 0x409404
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00414ca8
lea eax, [ebp - 0x214]
push eax
push 0x3001f
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x41c46d
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x41c525
test byte [ecx + 0x1c], 2
je 0x41c525
cmp byte [ecx + 0x19], 2
jb 0x41c525
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xb
mov edx, 0x409404
pop ecx
call fcn.00414ccb
jmp 0x41c525
mov ecx, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.0041c3ab
test eax, eax
je 0x41c52c
xor ecx, ecx
mov dword [ebp - 0x218], 0x104
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push ecx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x41c454
cmp esi, 0x103
jne 0x41c4ed
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
je 0x41c4e8
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x41c525
test byte [ecx + 0x1c], 2
je 0x41c525
cmp byte [ecx + 0x19], 2
jb 0x41c525
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xd
jmp 0x41c444
xor eax, eax
inc eax
jmp 0x41c52e
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41c519
test byte [eax + 0x1c], 2
je 0x41c519
cmp byte [eax + 0x19], 2
jb 0x41c519
push esi
push dword [eax + 0x14]
mov edx, 0x409404
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.00414ccb
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x41c544
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], 4
push edi
mov edi, ecx
mov dword [ebp - 8], esi
mov eax, dword [0x475014]
push 2
pop ebx
cmp eax, 0x475014
je 0x41c589
test byte [eax + 0x1c], bl
je 0x41c589
cmp byte [eax + 0x19], 5
jb 0x41c589
push dword [eax + 0x14]
mov edx, 0x409404
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.00414ca8
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x409650
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x41c5d4
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x41c653
test byte [ecx + 0x1c], bl
je 0x41c653
cmp byte [ecx + 0x19], bl
jb 0x41c653
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xf
jmp 0x41c648
cmp dword [ebp - 4], 4
je 0x41c60a
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41c603
test byte [eax + 0x1c], bl
je 0x41c603
cmp byte [eax + 0x19], bl
jb 0x41c603
push dword [eax + 0x14]
mov edx, 0x409404
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.00414ca8
mov esi, 0x3f1
jmp 0x41c653
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push 0x409650
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x41c653
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41c653
test byte [eax + 0x1c], bl
je 0x41c653
cmp byte [eax + 0x19], bl
jb 0x41c653
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
mov edx, 0x409404
pop ecx
call fcn.00414ccb
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41c663
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, dword [0x475014]
push 2
pop ebx
cmp eax, 0x475014
je 0x41c6a7
test byte [eax + 0x1c], bl
je 0x41c6a7
cmp byte [eax + 0x19], 5
jb 0x41c6a7
push dword [eax + 0x14]
mov edx, 0x409404
push dword [eax + 0x10]
push 0x30
pop ecx
call fcn.00414ca8
xor eax, eax
xor esi, esi
push 0x7e
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push esi
push eax
mov dword [ebp - 0x88], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x8c], 0x7e
lea eax, [ebp - 0x88]
push eax
push 0x20019
push esi
push 0x40e67c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41c731
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41c72a
test byte [eax + 0x1c], bl
je 0x41c72a
cmp byte [eax + 0x19], bl
jb 0x41c72a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x475014]
mov edx, 0x409404
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.00414ccb
xor eax, eax
jmp 0x41c7c1
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x90]
push eax
push esi
push esi
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41c78f
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41c7b3
test byte [eax + 0x1c], bl
je 0x41c7b3
cmp byte [eax + 0x19], bl
jb 0x41c7b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x475014]
mov edx, 0x409404
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.00414ccb
jmp 0x41c7b3
cmp dword [ebp - 0x90], 1
jne 0x41c7b3
lea eax, [ebp - 0x84]
push 0x4093e0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41c7b3
xor esi, esi
inc esi
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x41d298
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x128], 0
lea eax, [ebp - 0x124]
push ebx
push esi
push edi
push 0x118
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x475014]
mov esi, 0x475014
mov edi, 0x4096a8
push 2
pop ebx
cmp eax, esi
je 0x41d2fe
test byte [eax + 0x1c], bl
je 0x41d2fe
cmp byte [eax + 0x19], 5
jb 0x41d2fe
push dword [eax + 0x14]
mov edx, edi
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00414ca8
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41d34f
mov eax, dword [0x475014]
cmp eax, esi
je 0x41d348
test byte [eax + 0x1c], bl
je 0x41d348
cmp byte [eax + 0x19], bl
jb 0x41d348
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x475014]
mov edx, edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.00414ccb
xor eax, eax
jmp 0x41d403
cmp dword [ebp - 0x118], ebx
je 0x41d37d
mov eax, dword [0x475014]
cmp eax, esi
je 0x41d348
test byte [eax + 0x1c], bl
je 0x41d348
cmp byte [eax + 0x19], 3
jb 0x41d348
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xd
mov edx, edi
pop ecx
call fcn.00414ca8
jmp 0x41d348
cmp dword [ebp - 0x124], 5
jae 0x41d3a4
mov eax, dword [0x475014]
cmp eax, esi
je 0x41d348
test byte [eax + 0x1c], bl
je 0x41d348
cmp byte [eax + 0x19], 3
jb 0x41d348
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xe
jmp 0x41d373
mov eax, dword [ebp - 0x10]
test al, 0x40
je 0x41d3bd
xor eax, eax
cmp byte [ebp - 0xe], 1
setne al
dec eax
and eax, 0xffffffe0
add eax, 0x40
jmp 0x41d403
test eax, 0x200
je 0x41d3c9
xor eax, eax
inc eax
jmp 0x41d403
test bl, al
je 0x41d3d1
push 8
jmp 0x41d402
test al, al
jns 0x41d3d9
push 0x10
jmp 0x41d402
test eax, 0x400
je 0x41d3e7
mov eax, 0x80
jmp 0x41d403
mov cl, byte [ebp - 0xe]
cmp cl, 1
jne 0x41d3f3
mov eax, ebx
jmp 0x41d403
cmp cl, 3
je 0x41d400
cmp cl, bl
jne 0x41d348
push 4
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x41e045
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [0x475014]
mov edi, 0x475014
mov esi, 0x409764
cmp eax, edi
je 0x41e07b
test byte [eax + 0x1c], 2
je 0x41e07b
cmp byte [eax + 0x19], 5
jb 0x41e07b
push dword [eax + 0x14]
mov edx, esi
push dword [eax + 0x10]
push 0x17
pop ecx
call fcn.00414ca8
push 0x25
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x41e0cf
mov ecx, ebx
call fcn.0041dbba
test eax, eax
jne 0x41e1ac
mov eax, dword [0x475014]
cmp eax, edi
je 0x41e1aa
test byte [eax + 0x1c], 2
je 0x41e1aa
cmp byte [eax + 0x19], 2
jb 0x41e1aa
push dword [eax + 0x14]
mov edx, esi
push dword [eax + 0x10]
push 0x18
pop ecx
call fcn.00414ca8
jmp 0x41e1aa
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41e121
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x475014]
cmp ecx, edi
je 0x41e1aa
test byte [ecx + 0x1c], 2
je 0x41e1aa
cmp byte [ecx + 0x19], 2
jb 0x41e1aa
push eax
push dword [ecx + 0x14]
mov edx, 0x409764
push dword [ecx + 0x10]
push 0x19
pop ecx
call fcn.00414ccb
jmp 0x41e1aa
inc esi
lea ecx, [esi + esi]
call fcn.0041c805
mov edi, eax
test edi, edi
jne 0x41e15a
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41e1aa
test byte [eax + 0x1c], 2
je 0x41e1aa
cmp byte [eax + 0x19], 2
jb 0x41e1aa
push dword [eax + 0x14]
mov edx, 0x409764
push dword [eax + 0x10]
push 0x1a
jmp 0x41e0c4
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41e16f
cmp eax, esi
ja 0x41e16f
mov eax, edi
jmp 0x41e1ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x41e1a3
test byte [ecx + 0x1c], 2
je 0x41e1a3
cmp byte [ecx + 0x19], 2
jb 0x41e1a3
push eax
push dword [ecx + 0x14]
mov edx, 0x409764
push dword [ecx + 0x10]
push 0x1b
pop ecx
call fcn.00414ccb
mov ecx, edi
call fcn.0041c919
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x41e207
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x28], 0x10
mov eax, dword [0x475014]
mov ebx, 0x475014
cmp eax, ebx
je 0x41e252
test byte [eax + 0x1c], 2
je 0x41e252
cmp byte [eax + 0x19], 5
jb 0x41e252
push dword [eax + 0x14]
mov edx, 0x409764
push dword [eax + 0x10]
push 0x27
pop ecx
call fcn.00414ca8
test esi, esi
jne 0x41e25e
xor eax, eax
inc eax
jmp 0x41e306
mov ecx, esi
xor edx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, dx
jne 0x41e265
sub ecx, edi
sar ecx, 1
je 0x41e256
mov ecx, esi
mov eax, 0x40972c
mov di, word [eax]
cmp di, word [ecx]
jne 0x41e2a1
test di, di
je 0x41e2a6
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x41e2a1
add eax, 4
add ecx, 4
test di, di
jne 0x41e27d
jmp 0x41e2a6
sbb edx, edx
or edx, 1
test edx, edx
je 0x41e256
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x41e2f4
mov eax, dword [0x475014]
cmp eax, ebx
je 0x41e2f0
test byte [eax + 0x1c], 2
je 0x41e2f0
cmp byte [eax + 0x19], 2
jb 0x41e2f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x475014]
mov edx, 0x409764
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x28
pop ecx
call fcn.00414ccb
xor eax, eax
jmp 0x41e306
lea eax, [ebp - 0x24]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret

Function at 0x41e557
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x409774
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41e582
xor eax, eax
jmp 0x41e5bf
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4097b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e5af
cmp dword [ebp - 0x10], 4
je 0x41e5b3
and dword [ebp - 8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x41e5c8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
xor esi, esi
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x476ca0], esi
jne 0x41e61c
call fcn.0041e557
mov dword [0x47505c], eax
mov dword [0x476ca0], 1
jmp 0x41e621
mov eax, dword [0x47505c]
test eax, eax
jle 0x41e6ad
lea eax, [ebp + 0xc]
mov edx, 0x400
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x804]
call fcn.0041e4f0
test eax, eax
js 0x41e6ad
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41e64d
sub ecx, edx
mov eax, 0x3fd
sar ecx, 1
cmp ecx, eax
jb 0x41e667
mov ecx, eax
push 0xa
pop edx
cmp word [ebp + ecx*2 - 0x806], dx
je 0x41e6a0
push 0xd
pop eax
mov word [ebp + ecx*2 - 0x804], ax
mov word [ebp + ecx*2 - 0x802], dx
lea ecx, [ecx*2 + 4]
cmp ecx, 0x800
jae 0x41e6bc
xor eax, eax
mov word [ebp + ecx - 0x804], ax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
call fcn.0046940e
int3

Function at 0x41eec4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x41ef0b
test byte [eax + 0x1c], 2
je 0x41ef0b
cmp byte [eax + 0x19], 5
jb 0x41ef0b
push dword [eax + 0x14]
mov edx, 0x409858
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.00414ca8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov edi, eax
test edi, edi
js 0x41ef6b
lea eax, [ebp - 8]
push eax
push 4
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edi, eax
test edi, edi
js 0x41ef58
push esi
push dword [ebp - 8]
push 0x3000
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 0xc]
push dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x478f64]
call esi
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x478f64]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00468ba0
mov esp, ebp
pop ebp
ret