joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d71d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
jne 0x40d737
mov eax, 0x80070057
jmp 0x40d7c8
cmp dword [ebp + 0xc], ebx
jne 0x40d746
mov eax, 0x80004003
jmp 0x40d7c8
push esi
push 0x404fb8
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll_wcsstr]
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x40d764
mov eax, 0x80004005
jmp 0x40d7c7
push edi
push 0x404fd0
push esi
call dword [sym.imp.MSVCR80.dll_wcscspn]
mov word [esi + eax*2], bx
lea eax, [ebp - 4]
push eax
mov edi, 0x404fd8
push edi
push esi
mov esi, dword [sym.imp.MSVCR80.dll_wcstok_s]
call esi
add esp, 0x14
test eax, eax
je 0x40d7a0
lea eax, [ebp - 4]
push eax
push edi
push ebx
call esi
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x40d7a7
mov eax, 0x80004005
jmp 0x40d7c6
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push 0x105
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40d855
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
xor ecx, ecx
cmp dword [esi], ecx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x78], eax
jne 0x40d88c
mov eax, 0x8000ffff
jmp 0x40d956
cmp eax, ecx
jne 0x40d89a
mov eax, 0x80004003
jmp 0x40d956
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov dword [eax], ecx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
push ecx
push edx
push dword [esi]
mov dword [ebp - 0x74], 0x208
mov dword [ebp - 0x70], ecx
call ebx
mov edi, eax
test edi, edi
je 0x40d8ce
cmp edi, 0xea
jne 0x40d942
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x40d942
cmp dword [ebp - 0x70], 1
je 0x40d8ee
cmp dword [ebp - 0x70], 7
je 0x40d8ee
cmp dword [ebp - 0x70], 2
je 0x40d8ee
mov edi, 0x3f4
jmp 0x40d946
and word [ebp + 0x19a], 0
test edi, edi
jne 0x40d90b
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
jmp 0x40d952
shr eax, 1
dec eax
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
mov dword [ebp - 0x7c], eax
je 0x40d96d
lea ecx, [ebp - 0x74]
push ecx
push eax
push 0
push 0
push dword [ebp - 0x80]
push dword [esi]
call ebx
mov edi, eax
test edi, edi
jne 0x40d939
mov eax, dword [ebp - 0x7c]
jmp 0x40d904
push dword [ebp - 0x7c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jle 0x40d952
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp + 0x19c]
xor ecx, ebp
call fcn.00413c2a
add ebp, 0x1a0
leave
ret 4
mov eax, 0x8007000e
jmp 0x40d954
Function at 0x40db26
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
push ebx
push esi
push edi
mov esi, 0x206
xor ebx, ebx
push esi
lea eax, [ebp + 0x39a]
push ebx
push eax
mov edi, ecx
mov word [ebp + 0x398], bx
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp - 0x76]
push ebx
push eax
mov word [ebp - 0x78], bx
call sub.MSVCR80.dll_memset
add esp, 0x18
push edi
mov edi, 0x104
push edi
lea eax, [ebp + 0x398]
push eax
mov byte [ebp - 0x79], 1
mov dword [ebp - 0x80], ebx
call fcn.0040da3b
test eax, eax
jge 0x40db99
xor eax, eax
jmp 0x40dd02
lea eax, [ebp + 0x398]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x40dba2
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 + 0x396]
cmp word [eax], 0x5c
jne 0x40dbc0
mov word [eax], bx
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40dc7c
test al, 0x10
jne 0x40dcff
push esi
lea eax, [ebp + 0x192]
push ebx
push eax
mov word [ebp + 0x190], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
xor esi, esi
cmp esi, ebx
lea eax, [ebp + 0x398]
jne 0x40dc1a
push eax
push 0x405d88
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.0040da14
add esp, 0x10
jmp 0x40dc31
push esi
push eax
push 0x405d98
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.0040da14
add esp, 0x14
test eax, eax
jl 0x40db92
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40dc54
inc esi
cmp esi, 0x400
jl 0x40dbf8
cmp esi, 0x400
je 0x40db92
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40db92
cmp word [ebp + 0x398], 0x5c
lea edi, [ebp + 0x398]
jne 0x40dc99
cmp word [ebp + 0x39a], 0x5c
jne 0x40dc99
mov byte [ebp - 0x79], bl
cmp word [ebp + 0x398], bx
lea esi, [ebp - 0x78]
je 0x40dcff
jmp 0x40dccd
cmp ax, 0x5c
jne 0x40dcc6
mov word [esi], ax
inc esi
inc esi
inc edi
inc edi
cmp byte [ebp - 0x79], bl
jne 0x40dcd5
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 3
sete byte [ebp - 0x79]
jmp 0x40dccd
mov word [esi], ax
inc esi
inc esi
inc edi
inc edi
movzx eax, word [edi]
cmp ax, bx
jne 0x40dca7
lea eax, [ebp - 0x78]
push eax
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40dcfa
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40db92
cmp word [edi], bx
jne 0x40dccd
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x5a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
add ebp, 0x5a4
leave
ret
Function at 0x40e713
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x210
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push edi
mov esi, ecx
call dword [0x419018]
push 0xfffffffffffffff5
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
mov dword [ebp - 0x7c], eax
je 0x40e77a
cmp eax, 0xffffffff
je 0x40e77a
cmp eax, 7
je 0x40e77a
xor eax, eax
mov byte [ebp - 0x74], 0
lea edi, [ebp - 0x73]
stosb byte es:[edi], al
push 2
lea eax, [ebp - 0x74]
push eax
push 0x405ea0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
cmp byte [ebp - 0x74], 0x31
sete al
jmp 0x40e77c
xor eax, eax
test eax, eax
je 0x40e7ca
test ebx, ebx
je 0x40e793
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40e797
xor esi, esi
jmp 0x40e7b0
lea esi, [eax + eax]
mov eax, esi
call fcn.00416a60
mov eax, esp
push dword [ebp - 0x78]
push esi
push ebx
push eax
call fcn.00408faf
mov esi, eax
push 0
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40e7f4
and word [ebp - 0x70], 0
push 0x100
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x19c]
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea eax, [ebp - 0x70]
push eax
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x84]
pop edi
pop esi
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.00413c2a
add ebp, 0x194
leave
ret 4
Function at 0x40e98a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
push ebx
push esi
push edi
mov esi, 0x4028b8
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 0x74], 1
xor esi, esi
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
cmp eax, ebx
mov dword [ebp - 0x68], eax
jge 0x40e9e3
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xf
jl 0x40e9bf
jmp 0x40eaad
lea eax, [ebp - 0x6c]
push eax
push 0x20019
push ebx
push 0x4048d8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
push 4
pop edi
jne 0x40ea7a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x405eb0
push dword [ebp - 0x6c]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
jne 0x40ea36
cmp dword [ebp - 0x70], edi
jne 0x40ea36
cmp dword [ebp - 0x7c], ebx
sete al
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x405ed0
push dword [ebp - 0x6c]
mov dword [ebp - 0x80], 0x208
call esi
test eax, eax
jne 0x40ea6c
cmp dword [ebp - 0x70], 1
jne 0x40ea6c
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x74], ebx
je 0x40eaad
mov ecx, edi
mov edi, 0x4028b8
lea esi, [ebp - 0x64]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
push ebx
je 0x40ea9a
push 8
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x64]
push eax
jmp 0x40eaa4
push ebx
push ebx
push 2
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp + 0x1b4]
mov eax, dword [ebp - 0x68]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
add ebp, 0x1b8
leave
ret
Function at 0x40fdd2
Capabilities:
Parse pe header

Disassembly:
test esi, esi
jne 0x40fdd9
xor al, al
ret
cmp dword [esi + 0x10], 0
jne 0x40fe0a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x40fdd6
cmp word [eax], 0x5a4d
jne 0x40fdd6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fdd6
mov dword [esi + 0xc], eax
mov ecx, dword [ecx + 0x50]
add ecx, eax
mov dword [esi + 0x10], ecx
cmp dword [esi + 0xc], edi
ja 0x40fe18
cmp edi, dword [esi + 0x10]
jae 0x40fe18
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x40ffc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 9
pop ecx
push 0x404970
mov esi, edx
push 0x104
mov ebx, eax
mov dword [0x419b88], 0x41a3a0
mov edi, 0x419da0
rep movsd dword es:[edi], dword [esi]
push 0x419b94
mov dword [0x419b8c], 0x404a38
mov dword [0x419b90], ebx
call fcn.0040da3b
push 0x40fede
mov dword [0x419d9c], 0x11
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x40ffb8
mov dword [0x41a36c], eax
call sub.MSVCR80.dll__set_purecall_handler
mov dword [esp], 0x405fa0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
cmp eax, esi
je 0x4100db
push 0x40627c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x4100db
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4100db
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x406298
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x4100a3
cmp dword [ebp - 4], esi
jne 0x4100d2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x4062d8
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call edi
test eax, eax
jne 0x4100c3
cmp dword [ebp - 4], esi
jne 0x4100c9
mov dword [0x4195a4], esi
push 0x40fe6d
push esi
call dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411393
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub esp, 0xc
push esi
xor esi, esi
cmp eax, esi
jne 0x4113af
mov eax, 0x8000ffff
jmp 0x411461
push ebx
push edi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push esi
push esi
push esi
push esi
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, eax
cmp edi, esi
jne 0x411447
cmp dword [ebp + 0x10], esi
je 0x41140a
push dword [ebp - 4]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
cmp edi, esi
push esi
je 0x4113f8
call ebx
inc dword [ebp - 4]
mov dword [ebp - 8], edi
jmp 0x41140d
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push esi
call edi
mov eax, 0x8007000e
jmp 0x41145f
mov dword [ebp - 4], esi
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
jne 0x411447
cmp dword [ebp + 0x10], esi
je 0x411455
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x411455
jle 0x411455
and edi, 0xffff
or edi, 0x80070000
push esi
call ebx
push dword [ebp - 8]
call ebx
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x411dd7
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [0x41a118]
push edi
add esi, 0x3c
lea edi, [ebp - 0x10]
call fcn.00412a7b
xor esi, esi
push 0x406d68
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
call fcn.0040f93b
cmp dword [ebp - 0x10], esi
je 0x411f08
push ebx
lea eax, [ebp - 0x14]
push eax
push 9
push esi
push dword [ebp - 0x10]
mov edi, SysReAllocStringLen
push edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x411e40
lea esi, [ebp - 4]
call fcn.0040d7cd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor esi, esi
cmp dword [ebp - 0xc], edi
je 0x411e4e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
mov edi, 0x80070000
jle 0x411e61
and ebx, 0xffff
or ebx, edi
cmp ebx, esi
jl 0x411f07
cmp dword [ebp - 4], esi
je 0x411f07
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jle 0x411e94
and eax, 0xffff
or eax, edi
cmp eax, esi
jl 0x411f07
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
jbe 0x411f07
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x411ea8
xor esi, esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call fcn.00411393
cmp dword [ebp - 8], esi
je 0x411eeb
mov ebx, dword [ebp - 4]
push 2
push dword [ebp - 8]
lea eax, [ebp - 0x14]
call fcn.0040f857
test eax, eax
jl 0x411eeb
mov ebx, dword [ebp - 0x14]
cmp ebx, esi
je 0x411eeb
mov esi, 0x406d7c
push esi
push ebx
call edi
push esi
push ebx
call edi
lea esi, [ebp - 0x14]
call fcn.0040d7cd
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jb 0x411ea6
pop ebx
lea esi, [ebp - 4]
call fcn.0040d7cd
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
pop esi
leave
ret
Function at 0x41257a
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
cmp esi, ecx
je 0x412684
mov eax, dword [edi + 0xc8]
cmp eax, ecx
je 0x412684
cmp dword [ebx], ecx
je 0x412684
push esi
push ecx
push ecx
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4125e1
cmp dword [edi + 0xb0], eax
je 0x412684
push dword [edi + 0x94]
mov eax, edi
call fcn.00411bd0
jmp 0x412684
push dword [ebx]
lea ecx, [ebp - 0x90]
call fcn.00410cd2
cmp dword [ebp - 0x90], 0
je 0x412654
mov eax, dword [ebp - 0x90]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412600
sub eax, ecx
inc eax
push eax
push dword [ebp - 0x90]
call sub.MSVCR80.dll__strlwr_s
mov ebx, dword [ebp - 0x90]
pop ecx
pop ecx
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x412654
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x90], eax
je 0x41264f
push dword [ebp - 0x90]
call sub.MSVCR80.dll_free
pop ecx
xor eax, eax
inc eax
jmp 0x412686
cmp dword [edi + 0xb0], 0
je 0x41266a
push dword [edi + 0x98]
mov eax, edi
call fcn.00411bd0
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x90], eax
je 0x412684
push dword [ebp - 0x90]
call sub.MSVCR80.dll_free
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00413c2a
leave
ret
Function at 0x41369f
Capabilities:
Get common file path

Disassembly:
cmp dword [esp + 8], 0x104
jge 0x4136b3
mov eax, dword [esp + 4]
and word [eax], 0
jmp 0x4136d9
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
push dword [esp + 0xc]
xor edi, edi
push edi
push edi
push 0x1a
push edi
call esi
test eax, eax
je 0x4136d7
push dword [esp + 0xc]
push edi
push edi
push 5
push edi
call esi
pop edi
pop esi
ret 8

Function at 0x41378e
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x419010]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4138c1
mov dword [esp + 0x20], esi
or dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0xc], esi
mov ebx, 0x407298
mov edi, 0x4072a8
mov esi, 0x103
push 0x407290
push ebx
push dword [esp + 0x14]
lea eax, [esp + 0x5c]
push dword [esp + 0x28]
push edi
push esi
push eax
call fcn.0040da14
add esp, 0x1c
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x413843
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41387d
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], 0xf
jmp 0x413879
mov edx, dword [esp + 0x10]
or edx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
jne 0x41385f
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
jmp 0x41387d
cmp dword [esp + 0x14], ecx
jb 0x41387d
ja 0x41386d
cmp dword [esp + 0x10], eax
jbe 0x41387d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
jl 0x4138b2
push 0x407290
push ebx
push dword [esp + 0x14]
lea eax, [esp + 0x5c]
push dword [esp + 0x28]
push edi
push esi
push eax
call fcn.0040da14
add esp, 0x1c
push 0
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xf
jl 0x4137f8
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00413c2a
mov esp, ebp
pop ebp
ret 8

Function at 0x413c2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419010]
jne 0x413c34
repz ret
jmp fcn.00413fb8
Function at 0x414393
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004142d2
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4143e2
cmp dword [ebp - 0x1c], 5
jb 0x4143fa
jmp 0x4143f6
cmp dword [ebp - 0x10], 1
jne 0x4143fa
cmp dword [ebp - 0x1c], 4
ja 0x4143f6
jne 0x4143fa
cmp dword [ebp - 0x18], 0
jbe 0x4143fa
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4014a4
call fcn.00409ae4
test eax, eax
jge 0x41441b
mov byte [0x41a3d8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00413c2a
add ebp, 0x78
leave
ret

Function at 0x414562
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x80004005
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
jne 0x414587
cmp edi, 0x104
jl 0x4145e3
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x4025cc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4145e3
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], edi
push esi
push esi
push 0x4025c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x4145e3
cmp dword [ebp + 0x10], esi
je 0x4145e1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4145e3
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x414632
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 0x10]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x20019
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push SysReAllocStringLen
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4146ba
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], edi
jne 0x4146ba
cmp dword [ebp + 8], 4
jne 0x4146ba
cmp dword [ebp - 8], 4
jne 0x4146ba
mov eax, dword [ebp - 0xc]
cmp eax, 0xfffffffd
jne 0x4146b5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esi + 0x40], eax
jmp 0x4146c1
mov dword [esi + 0x40], 0x409
pop edi
pop esi
leave
ret 0xc