joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001873
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10011c0
call fcn.01001a94
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10018ae
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10018ae
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10018c6
cmp eax, 0x20b
je 0x10018b3
mov dword [ebp - 0x1c], edi
jmp 0x10018da
cmp dword [ecx + 0x84], 0xe
jbe 0x10018ae
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10018d4
cmp dword [ecx + 0x74], 0xe
jbe 0x10018ae
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1003038], 0xffffffff
or dword [0x100303c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1003034]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1003030]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1003040], eax
call fcn.01001a8e
cmp dword [0x1003020], edi
jne 0x1001935
push fcn.01001a8e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001a7c
push 0x10010dc
push 0x10010d8
call sub.msvcrt.dll__initterm
mov eax, dword [0x100302c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1003028]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x10010d4
push 0x10010d0
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.010017be
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x10019ac
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10019e1
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001acd
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x21f03eb5
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2e501d2f
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4016b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push ecx
mov dword [ebp - 0xc], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
jne 0x4016da
lea eax, [edi + 0xb]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jge 0x4016fa
push esi
mov dword [ebp - 8], 0xc
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push 0xa
lea edx, [ebp - 0x10]
push edx
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.MSVCR90.dll_wcstoul]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ecx], eax
cmp word [edx], di
jne 0x401844
cmp eax, 0xffffffff
ja 0x401844
jne 0x40173a
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0x22
je 0x401844
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401743
mov edi, dword [ebp + 0xc]
sub eax, edx
push 0x2e
sar eax, 1
mov esi, eax
push str..pipeFileAssistant_
push edi
mov dword [ebp - 0x18], esi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x14], 0xec
lea eax, [ebp - 0x14]
cmp esi, 0xec
ja 0x40177f
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
push ebx
mov ebx, dword [eax]
lea eax, [ebx + ebx]
push eax
push ecx
lea edx, [edi + 0x2e]
push edx
call sub.MSVCR90.dll_memcpy
xor eax, eax
push 0x3c
mov word [edi + ebx*2 + 0x2e], ax
add edi, 0x208
push str.LocalFileAssistantReadyEvent_
push edi
mov dword [ebp - 0x14], esi
call sub.MSVCR90.dll_memcpy
add esp, 0x18
mov dword [ebp - 0x18], 0xe5
lea eax, [ebp - 0x18]
cmp esi, 0xe5
ja 0x4017c8
lea eax, [ebp - 0x14]
mov ebx, dword [eax]
mov edx, dword [ebp - 4]
lea ecx, [ebx + ebx]
push ecx
push edx
lea eax, [edi + 0x3c]
push eax
call sub.MSVCR90.dll_memcpy
xor ecx, ecx
mov word [edi + ebx*2 + 0x3c], cx
mov edi, dword [ebp + 0xc]
push 0x46
add edi, 0x410
push str.LocalFileAssistantClientExitEvent_
push edi
mov dword [ebp - 0x14], esi
call sub.MSVCR90.dll_memcpy
add esp, 0x18
mov dword [ebp - 0x18], 0xe0
pop ebx
lea eax, [ebp - 0x18]
cmp esi, 0xe0
ja 0x401814
lea eax, [ebp - 0x14]
mov esi, dword [eax]
mov eax, dword [ebp - 4]
lea edx, [esi + esi]
push edx
push eax
lea ecx, [edi + 0x46]
push ecx
call sub.MSVCR90.dll_memcpy
xor edx, edx
mov word [edi + esi*2 + 0x46], dx
mov esi, dword [ebp - 0x1c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
mov dword [ebp - 8], 0xd
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401c20
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
push eax
push 0
push 2
push 0x40000000
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401c57
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x401c86
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x401c86
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
test eax, eax
jne 0x401c8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x41642c
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], ecx
push edi
push 0x44
push eax
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebp - 8], eax
mov ebx, edx
lea eax, [ebp - 0x6c]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0xc], edi
test ebx, ebx
jne 0x41646e
mov esi, 0x80070057
jmp 0x4164e0
cmp dword [ebp + 8], esi
je 0x416542
lea eax, [ebp - 8]
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4164d1
push edi
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x6c], 0x44
push eax
mov dword [ebp - 0x64], 0x406dc0
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x4164d1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push dword [ebp - 0xc]
push 0x408
push edi
push edi
push edi
push ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4164e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov esi, eax
mov ecx, esi
call fcn.00419094
cmp dword [ebp - 0x20], edi
je 0x4164f5
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], edi
je 0x416503
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], edi
je 0x416511
push dword [ebp - 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, esi
call fcn.004190b1
cmp dword [ebp - 8], edi
je 0x416529
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], edi
cmp dword [ebp - 0x10], edi
je 0x416537
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x4164d1
lea eax, [ebp - 8]
push eax
push 1
push 2
push edi
push 0xb
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x41648a
Function at 0x416575
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x472008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x214], edi
mov ebx, edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x218], edi
test esi, esi
jne 0x4165b9
mov esi, 0x80070057
jmp 0x416748
push ecx
call fcn.0041621f
test al, al
jne 0x4165cd
mov esi, 0x80004001
jmp 0x416748
push esi
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.004145b1
mov esi, eax
test esi, esi
js 0x416748
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x416614
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov esi, eax
jmp 0x416748
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x416735
lea eax, [ebp - 0x224]
xor edx, edx
push eax
inc edx
mov ecx, 0x406de0
call fcn.004162e6
mov esi, eax
test esi, esi
js 0x416748
xor edx, edx
lea eax, [ebp - 0x218]
inc edx
mov ecx, 0x406e14
push eax
mov dword [ebp - 0x22c], edx
call fcn.004162e6
mov esi, eax
test esi, esi
jns 0x41666c
mov ecx, esi
call fcn.00419094
jmp 0x4166f7
lea eax, [ebp - 0x21c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x214]
inc ebx
push eax
push ebx
push edi
push edi
mov dword [ebp - 0x220], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x4166a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov esi, eax
jmp 0x416660
mov eax, dword [ebp - 0x21c]
mov ebx, edi
test eax, eax
je 0x4166f1
mov edx, dword [ebp - 0x214]
mov ecx, dword [edi + edx]
test ecx, ecx
je 0x4166e0
mov edx, dword [edi + edx + 8]
test edx, edx
je 0x4166c7
cmp edx, 4
jne 0x4166e0
push 0
lea edx, [ebp - 0x210]
call fcn.0041642c
mov esi, eax
test esi, esi
js 0x4166ea
mov eax, dword [ebp - 0x21c]
inc ebx
add edi, 0xc
cmp ebx, eax
jb 0x4166ad
jmp 0x4166f1
mov ecx, esi
call fcn.00419094
mov ebx, dword [ebp - 0x220]
cmp dword [ebp - 0x224], 0
jne 0x416713
lea eax, [ebp - 0x22c]
xor edx, edx
push eax
mov ecx, 0x406de0
call fcn.004162e6
test ebx, ebx
je 0x41674f
cmp dword [ebp - 0x218], 0
jne 0x41674f
lea eax, [ebp - 0x218]
xor edx, edx
push eax
mov ecx, 0x406e14
call fcn.004162e6
jmp 0x41674f
push 1
lea edx, [ebp - 0x210]
call fcn.0041642c
mov esi, eax
test esi, esi
jns 0x41674f
mov ecx, esi
call fcn.00419094
cmp dword [ebp - 0x214], 0
je 0x416764
push dword [ebp - 0x214]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ecx, esi
call fcn.004190b1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451d90
mov esp, ebp
pop ebp
ret
Function at 0x4197ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419808
movzx eax, al
shr eax, 4
and eax, 1
jmp 0x41980a
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
call fcn.004190b1
xor ecx, ecx
call fcn.004190b1
xor eax, eax
pop esi
ret

Function at 0x419823
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419841
not al
movzx eax, al
shr eax, 4
and eax, 1
jmp 0x419843
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
call fcn.004190b1
xor ecx, ecx
call fcn.004190b1
xor eax, eax
pop esi
ret
Function at 0x41985c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x472008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x63c]
mov edx, 0x104
push eax
mov edi, ecx
call fcn.004146a8
mov esi, eax
test esi, esi
js 0x419a9c
push edi
mov edx, 0x105
lea ecx, [ebp - 0x428]
call fcn.004145b1
mov esi, eax
test esi, esi
js 0x419a9c
mov edi, dword [ebp - 0x63c]
mov ecx, 0x80070216
lea eax, [edi - 1]
cmp eax, edi
ja 0x4198c4
mov edi, eax
xor esi, esi
jmp 0x4198cb
mov esi, ecx
call fcn.00419094
mov ecx, esi
call fcn.004190b1
test esi, esi
js 0x419a9c
add edi, edi
push 0x5c
pop ecx
cmp word [ebp + edi - 0x428], cx
jne 0x4198ff
cmp edi, 0x20a
jae 0x419ac6
xor eax, eax
mov word [ebp + edi - 0x428], ax
xor eax, eax
lea edi, [ebp - 0x428]
and dword [ebp - 0x63c], eax
mov word [ebp - 0x218], ax
cmp word [ebp - 0x428], cx
jne 0x419923
lea edi, [ebp - 0x426]
push ecx
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov ebx, eax
mov edx, 0x105
mov dword [ebp - 0x640], ebx
pop ecx
lea ecx, [ebp - 0x638]
test ebx, ebx
jne 0x419960
push edi
call fcn.004145b1
mov esi, eax
test esi, esi
js 0x419a9c
mov dword [ebp - 0x63c], 1
jmp 0x41999f
sub ebx, edi
sar ebx, 1
push ebx
push edi
call fcn.004145ef
mov esi, eax
test esi, esi
js 0x419a9c
cmp dword [ebp - 0x640], edi
jb 0x419abd
add ebx, ebx
cmp ebx, 0x20a
jae 0x419ac6
xor eax, eax
mov word [ebp + ebx - 0x638], ax
mov ebx, dword [ebp - 0x640]
lea eax, [ebp - 0x648]
mov edx, 0x105
push eax
lea ecx, [ebp - 0x218]
call fcn.00414726
mov esi, eax
test esi, esi
js 0x419a9c
push 0x7ffffffe
lea eax, [ebp - 0x638]
mov edx, 0x105
push eax
mov eax, dword [ebp - 0x648]
sub edx, eax
push ecx
lea ecx, [ebp - 0x218]
lea ecx, [ecx + eax*2]
call fcn.0041476d
mov esi, eax
test esi, esi
js 0x419a9c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419a08
test al, 0x10
jne 0x419a2d
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x419a8d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419a8d
test ebx, ebx
je 0x419a7c
lea edi, [ebx + 2]
mov ebx, 0x105
lea eax, [ebp - 0x644]
mov edx, ebx
push eax
lea ecx, [ebp - 0x218]
call fcn.00414726
mov esi, eax
test esi, esi
js 0x419a9c
mov eax, dword [ebp - 0x644]
mov edx, ebx
push 0x7ffffffe
push 0x406428
push ecx
lea ecx, [ebp - 0x218]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0041476d
mov esi, eax
test esi, esi
js 0x419a9c
cmp dword [ebp - 0x63c], 0
jne 0x419aa3
push 0x5c
pop ecx
jmp 0x419923
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov esi, eax
mov ecx, esi
call fcn.00419094
mov ecx, esi
call fcn.004190b1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451d90
mov esp, ebp
pop ebp
ret
mov ecx, 0x80070216
mov esi, ecx
jmp 0x419a9e
call fcn.00452175
int3
Function at 0x419e1f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x472008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x424], ecx
push 0x410
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], esi
push esi
mov edi, esi
push eax
mov dword [ebp - 0x420], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push eax
push 0x407848
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x419e98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov ebx, eax
mov ecx, ebx
call fcn.00419094
jmp 0x419f3e
lea eax, [ebp - 0x41c]
mov edx, 0x406f24
push eax
push ecx
lea ecx, [ebp - 0x418]
call fcn.00419ad1
mov ebx, eax
test ebx, ebx
jns 0x419ec5
mov ecx, ebx
call fcn.00419094
mov esi, dword [ebp - 0x41c]
jmp 0x419f3e
mov esi, dword [ebp - 0x41c]
lea edx, [ebp - 0x41c]
mov ecx, esi
call fcn.004197ec
mov ebx, eax
test ebx, ebx
js 0x419e8c
cmp dword [ebp - 0x41c], edi
jne 0x419ef3
mov ecx, esi
call fcn.0041985c
mov ebx, eax
test ebx, ebx
js 0x419e8c
lea eax, [ebp - 0x420]
mov edx, 0x40785c
push eax
push ecx
mov ecx, esi
call fcn.00419ad1
mov ebx, eax
test ebx, ebx
jns 0x419f1c
mov ecx, ebx
call fcn.00419094
mov edi, dword [ebp - 0x420]
jmp 0x419f3e
mov edi, dword [ebp - 0x420]
mov ecx, edi
call fcn.00449904
test eax, eax
je 0x419e7d
mov eax, dword [ebp - 0x424]
mov dword [eax + 8], 1
mov ecx, ebx
call fcn.004190b1
test edi, edi
je 0x419f50
mov ecx, edi
call fcn.00418f57
test esi, esi
je 0x419f5b
mov ecx, esi
call fcn.00418f57
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451d90
mov esp, ebp
pop ebp
ret
Function at 0x41ac1f
Capabilities:
Identify system language via api

Disassembly:
push 0x38
mov eax, 0x46d2d2
call fcn.0046cebd
mov eax, ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
mov dword [ebp - 0x14], edi
and dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 0x10], esi
lea ebx, [eax + 8]
mov byte [ebp - 4], 1
mov ecx, dword [ebx]
test ecx, ecx
je 0x41ac51
call fcn.00418f57
and dword [ebx], esi
push ebx
call fcn.0041db94
mov ebx, eax
test ebx, ebx
jns 0x41ac69
mov ecx, ebx
call fcn.00419094
jmp 0x41adc5
mov ebx, dword [ebp - 0x1c]
cmp dword [ebx + 8], 0
jne 0x41ac87
mov ebx, 0x80070002
mov ecx, 0x407b20
push 2
mov edx, ebx
call fcn.0041a2dd
jmp 0x41ac5d
push 0xaa
lea eax, [ebx + 0xc]
push 0
push eax
mov dword [ebp - 0x18], eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebx + 0xb6]
push 0x55
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
jne 0x41acc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov ebx, eax
jmp 0x41ac5d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edx, dword [ebp - 0x18]
movzx ecx, ax
push 0x55
call fcn.00422bdf
test eax, eax
je 0x41acb0
lea eax, [ebp - 0x14]
push eax
call fcn.0041c802
mov ebx, eax
test ebx, ebx
jns 0x41acf6
mov ecx, ebx
call fcn.00419094
mov edi, dword [ebp - 0x14]
jmp 0x41adc5
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push eax
push 0x55
pop edx
call fcn.004146a8
mov ebx, eax
test ebx, ebx
js 0x41ace7
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x44]
push 9
xor eax, eax
and dword [ebp - 0x20], eax
and dword [esi + 0x160], 0
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041b003
mov edi, dword [ebp - 0x14]
mov ebx, eax
test ebx, ebx
jns 0x41ad44
mov ecx, ebx
call fcn.00419094
mov esi, dword [ebp - 0x10]
jmp 0x41adba
cmp dword [ebp - 0x20], 0
jne 0x41ad5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov ebx, eax
jmp 0x41ad38
lea ebx, [esi + 0x160]
mov ecx, ebx
call fcn.00422efb
mov edx, dword [esi + 8]
lea eax, [ebp - 0x44]
push eax
mov ecx, ebx
call fcn.00422c78
mov ebx, eax
test ebx, ebx
js 0x41ad38
mov ebx, dword [ebp - 0x44]
test ebx, ebx
js 0x41ad38
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x41ad9d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp - 0x18]
call fcn.0041c901
mov ebx, eax
test ebx, ebx
jns 0x41adba
mov ecx, ebx
call fcn.00419094
test esi, esi
je 0x41adc5
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, ebx
call fcn.004190b1
mov byte [ebp - 4], 0
test esi, esi
je 0x41addf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x41adf2
mov ecx, edi
call fcn.00418f57
and dword [ebp - 0x14], 0
mov eax, ebx
call fcn.0046ce90
ret 0xc
Function at 0x41b003
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push edi
test eax, eax
jne 0x41b02e
mov ecx, 0x80070057
mov esi, ecx
call fcn.00419094
jmp 0x41b0e0
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x41b01d
mov dword [eax], esi
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0x407b4c
mov dword [ebx], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x41b062
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00418df2
mov esi, eax
mov ecx, esi
jmp 0x41b024
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0x407b78
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x41b04f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41b0da
cmp eax, 0x80
je 0x41b0da
cmp eax, 0x102
je 0x41b0d3
cmp eax, 0xffffffff
je 0x41b0ba
mov esi, 0x80004005
jmp 0x41b05e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00418e0f
mov esi, dword [ebp - 8]
test eax, eax
jne 0x41b0e0
jmp 0x41b05e
mov esi, 0x800705b4
jmp 0x41b05e
mov dword [ebx], 1
mov ecx, esi
call fcn.004190b1
cmp dword [ebp - 4], 0
je 0x41b0f6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41c33f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 2
mov ecx, 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.0041c3cd
mov edi, eax
test edi, edi
js 0x41c39a
xor ecx, ecx
mov dword [ebp - 0xc], ebx
call fcn.004190b1
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00418e0f
mov edi, dword [ebp - 8]
test eax, eax
jne 0x41c3a1
mov ecx, edi
call fcn.00419094
mov ecx, edi
call fcn.004190b1
lea ecx, [ebp - 0xc]
call fcn.0041b95f
cmp dword [ebp - 4], ebx
je 0x41c3be
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c5e7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 2
mov ecx, 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.0041c3cd
mov edi, eax
test edi, edi
js 0x41c643
xor ecx, ecx
mov dword [ebp - 0xc], ebx
call fcn.004190b1
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
mov dword [ebp - 8], ebx
push eax
push 4
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00418e0f
mov edi, dword [ebp - 8]
test eax, eax
jne 0x41c64a
mov ecx, edi
call fcn.00419094
mov ecx, edi
call fcn.004190b1
lea ecx, [ebp - 0xc]
call fcn.0041b95f
cmp dword [ebp - 4], ebx
je 0x41c667
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc