joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c8ea
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4dd58c
call fcn.004bee78
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x528f18
mov dword [ebp - 4], ebx
call fcn.00424f1e
lea eax, [ebp + 8]
mov esi, 0x528cb8
push eax
mov ecx, esi
call fcn.00424f1e
push 1
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push esi
call fcn.00424efd
lea edi, [ebp - 0x14]
call fcn.0046aa00
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00424f1e
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0042499b
mov edi, 0x4e8fa8
push edi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00424e28
test eax, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0xd], bl
je 0x42c98a
push edi
mov ecx, esi
call fcn.0042bc86
mov esi, dword [0x528cb8]
call fcn.0046d280
push dword [0x528cb8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42c9d7
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Diff_Init:_Cannot_create_TempDir
call fcn.004247f3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.General
mov byte [ebp - 4], 3
call fcn.004247f3
push 3
mov byte [ebp - 4], bl
call fcn.0046f830
add esp, 0xc
push 0x528ce4
call fcn.0042ca30
mov esi, 0x4eaa5c
push esi
mov ecx, 0x528cbc
call fcn.004253f4
push esi
mov ecx, 0x528cc4
call fcn.004253f4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.004247f3
mov esi, 0x528d14
call fcn.0042cae8
call fcn.00456200
call fcn.0045ae00
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
xor eax, eax
inc eax
call fcn.004bef50
ret
Function at 0x42d140
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x522f10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [esi], ebx
je 0x42d162
inc eax
jmp 0x42d330
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x32c], ebx
call fcn.004b9350
push 0x110
lea eax, [ebp - 0x31c]
push ebx
push eax
call fcn.004b9350
add esp, 0x18
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42d32e
cmp dword [ebp - 0x310], 2
jne 0x42d32e
cmp dword [ebp - 0x31c], 5
jb 0x42d32e
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x42d32e
lea eax, [ebp - 0x328]
push eax
push 0x4e3abc
push 1
push ebx
push 0x4e3acc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42d310
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x42d310
push edi
push dword [ebp - 0x324]
call fcn.004bb4b9
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop ecx
mov dword [esi + 8], eax
cmp dword [ebp - 0x324], ebx
je 0x42d247
push dword [ebp - 0x324]
call edi
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x42d30f
push dword [ebp - 0x324]
call fcn.004bb4b9
pop ecx
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x324], ebx
je 0x42d281
push dword [ebp - 0x324]
call edi
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push str.WinNT:___s
push 0x104
push eax
call fcn.004bb711
add esp, 0x10
lea eax, [ebp - 0x32c]
push eax
push 0x4e397c
lea eax, [ebp - 0x20c]
push eax
call sub.ACTIVEDS.dll_ADsGetObject
test eax, eax
jl 0x42d30f
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x42d30f
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x324]
push str.Domain
call fcn.004b8c60
pop ecx
pop ecx
test eax, eax
jne 0x42d2f9
mov dword [esi + 4], 1
cmp dword [ebp - 0x324], ebx
je 0x42d309
push dword [ebp - 0x324]
call edi
mov dword [esi], 1
pop edi
mov eax, dword [ebp - 0x328]
cmp eax, ebx
je 0x42d320
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
jne 0x42d32a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esi]
jmp 0x42d330
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b80af
leave
ret
Function at 0x42ff44
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x529200], esi
jne 0x42ffc5
mov dword [0x529200], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00469470
pop ecx
test eax, eax
jne 0x42ffb4
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x528be4], eax
cmp dword [0x529204], esi
jne 0x42ffa1
push esi
push esi
push 0x4eaa5c
call fcn.004bb4b9
pop ecx
push eax
push 0x42fbc4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x529204], eax
push 0x190
push dword [0x528be4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret
push str.This_is_a_System_process__so_skipping_window_display.
push str.GfxServerInit
call fcn.00468cd0
pop ecx
pop ecx
pop esi
ret

Function at 0x431500
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ecx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call ebx
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
sub esi, dword [ebp - 0xc]
sub edi, dword [ebp - 8]
sub esi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x20]
add esi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x431596
lea ecx, [ebp - 0x34]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
test eax, eax
jg 0x431588
test ecx, ecx
jle 0x431596
jmp 0x43158d
sub eax, dword [ebp - 0x28]
add edi, eax
test ecx, ecx
jle 0x431596
sub ecx, dword [ebp - 0x2c]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4316f3
Capabilities:
Create directory
Create thread

Disassembly:
push 0x30
mov eax, 0x4dba02
call fcn.004bee78
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, 0x4e94d0
push ebx
mov dword [ebp - 0x18], esi
call fcn.004247f3
lea eax, [ebp - 0x10]
push eax
call fcn.0046a1c0
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x10
call fcn.004a9bd2
mov edi, eax
pop ecx
cmp edi, esi
je 0x43175a
lea ecx, [edi + 8]
call fcn.00422487
lea ecx, [edi + 0xc]
call fcn.00422487
mov dword [0x528bec], edi
jmp 0x431760
mov dword [0x528bec], esi
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4e8fa8
call fcn.004247f3
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Troubleshoot.log
call fcn.004247f3
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.004247f3
mov eax, dword [ebp - 0x14]
push eax
call fcn.0046a1c0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
call fcn.0046a3b0
add esp, 0xc
call fcn.0043111c
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push 0x431420
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4317ef
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
jg 0x4317db
mov eax, dword [ebp - 0x34]
call fcn.004bef50
ret 4
Function at 0x432497
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [edx - 0xc]
push edi
or edi, 0xffffffff
cmp dword [0x528c6c], 0
jne 0x4324b3
call fcn.00494f50
lea ecx, [esi + esi]
xor eax, eax
test ecx, ecx
jle 0x4324d7
movzx esi, byte [eax + edx]
xor esi, edi
and esi, 0xff
shr edi, 8
xor edi, dword [esi*4 + 0x5287e0]
inc eax
cmp eax, ecx
jl 0x4324bc
lea ecx, [edx - 0x10]
call fcn.0042201a
mov eax, edi
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x4324e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x432506
mov eax, dword [ebp + 8]
mov dl, cl
and dl, 0x7f
add eax, ecx
add dl, 0x21
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x4324f1
pop ebp
ret
Function at 0x432a74
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
push 0x4c
mov eax, 0x4d894c
call fcn.004bee78
push 9
xor eax, eax
xor esi, esi
pop ecx
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00470760
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.00470850
add esp, 4
mov byte [ebp - 4], 1
lea eax, [ebx + 4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004247de
call fcn.00432497
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00424efd
call fcn.00432497
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.00424efd
call fcn.00432497
mov dword [ebx + 0x20], eax
lea eax, [ebx + 8]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004247de
call fcn.00432497
mov dword [ebx + 0x24], eax
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebx + 0x30]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
or edx, 0xffffffff
cmp dword [0x528c6c], esi
jne 0x432b3a
call fcn.00494f50
movzx eax, byte [ebx + esi + 0x18]
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x5287e0]
inc esi
cmp esi, 0x24
jl 0x432b3a
lea esi, [ebx + 0x14]
push 0xa
not edx
mov dword [esi], edx
pop ecx
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor eax, eax
mov cl, al
and cl, 0x7f
add cl, 0x21
xor byte [ebp + eax - 0x58], cl
inc eax
cmp eax, 0x28
jb 0x432b69
push dword [ebx + 4]
lea eax, [ebp - 0x1c]
push str.Cameyo.AuthToken.AppId._s
push eax
call fcn.0046aaf0
add esp, 0xc
push dword [eax]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov dword [ebp - 0x10], eax
call fcn.0042201a
cmp dword [ebp - 0x10], esi
je 0x432bb7
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x28
pop edi
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.004247de
call fcn.0046b4c0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x432c1c
push 0x5c
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.004247de
lea eax, [ebp - 0x20]
push eax
call fcn.0046af00
mov esi, dword [eax]
add esp, 0xc
call fcn.0046d280
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.004247de
call fcn.0046b4c0
pop ecx
pop ecx
mov esi, eax
cmp dword [ebp - 0x10], 0
je 0x432c34
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, esi
call fcn.004bef50
ret
Function at 0x432c52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
or edx, 0xffffffff
cmp dword [0x528c6c], 0
push esi
mov esi, eax
jne 0x432c6a
call fcn.00494f50
xor eax, eax
movzx ecx, byte [esi + eax + 4]
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x5287e0]
inc eax
cmp eax, 0x24
jl 0x432c6c
mov esi, dword [esi]
not edx
cmp esi, edx
je 0x432cb1
push ecx
mov eax, esp
mov dword [ebp - 4], esp
push edx
push esi
push str._ValidateIntegrity:_incorrect_CRC:__x_vs__x
push eax
call fcn.0046aaf0
add esp, 0x10
call fcn.00432467
pop ecx
xor eax, eax
jmp 0x432cb4
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x434272
Capabilities:
Move file

Disassembly:
push 0xc
mov eax, 0x4de767
call fcn.004bee78
and dword [ebp - 4], 0
push 0
call fcn.004bbfcc
push eax
call fcn.004bc4b9
call fcn.004bc4cb
mov esi, eax
call fcn.004bc4cb
add esp, 4
mov dword [ebp - 0x18], esp
shl esi, 0x10
xor eax, esi
mov esi, esp
push eax
push 0x5c
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00424efd
lea eax, [ebp - 0x18]
push eax
call fcn.0046ae20
add esp, 0xc
mov byte [ebp - 4], 1
push dword [eax]
push str._s._x.ToDelete
push esi
call fcn.0046aaf0
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
add esp, 0x10
push eax
call fcn.0047bce0
pop ecx
pop ecx
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push 0
push ecx
mov dword [ebp + 0x10], esp
mov ecx, esp
push eax
call fcn.00424efd
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0047b9e0
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042201a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042201a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, esi
call fcn.004bef50
ret

Function at 0x434351
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x4da341
call fcn.004beee1
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.004b9350
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x26c], esp
push 0x4f14f8
call fcn.004247f3
lea eax, [ebp - 0x26c]
push eax
mov ecx, edi
call fcn.0047bce0
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x26c]
mov esi, eax
cmp esi, 0xffffffff
setne byte [ebp - 0x261]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x261], 0
je 0x434459
push ecx
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call fcn.004247f3
lea eax, [ebp - 0x268]
push eax
mov ecx, edi
call fcn.0047bce0
and dword [ebp - 4], 0
add esp, 4
mov eax, esp
mov dword [ebp - 0x270], esp
push dword [ebp - 0x268]
push str.DeleteSharingViolationRemains:_deleting__s
push eax
call fcn.0046aaf0
add esp, 0xc
call fcn.00433da4
pop ecx
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4343d6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004bef64
ret
Function at 0x434531
Capabilities:
Enumerate files on windows

Disassembly:
push 0x278
mov eax, 0x4da2e3
call fcn.004beee1
xor eax, eax
mov dword [ebp - 4], eax
push 0x24c
push eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x25c]
push eax
call fcn.004b9350
pop ecx
pop ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.00424efd
call fcn.0046dbf0
push eax
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x268]
push eax
call fcn.00471b80
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
push dword [edi]
push dword [ebp + 8]
push str.DeleteRegDatFiles:__s____s__LE_d
push ecx
call fcn.0046aaf0
add esp, 0x14
call fcn.00433da4
pop ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042201a
push 0x4f16d8
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00424a42
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x27c]
mov ebx, eax
cmp ebx, 0xffffffff
setne byte [ebp - 0x261]
add ecx, 0xfffffff0
call fcn.0042201a
cmp byte [ebp - 0x261], 0
je 0x434744
push 0x5c
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.00424efd
lea eax, [ebp - 0x268]
push eax
call fcn.0046af00
add esp, 0xc
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
push 0x4e8fa8
call fcn.004247f3
push ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x284], esp
push eax
call fcn.004247f3
push ecx
lea eax, [ebp - 0x268]
mov dword [ebp - 0x274], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 4
call fcn.00424efd
lea edi, [ebp - 0x278]
mov byte [ebp - 4], 2
call fcn.0046a3b0
add esp, 8
mov eax, edi
mov dword [ebp - 0x274], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 5
call fcn.00424efd
call fcn.0046dbf0
and dword [ebp - 0x26c], eax
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.00471b80
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 6
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
push dword [edi]
push dword [ebp + 8]
push str.DeleteRegDatFiles:_deleting_satellite_file:__s____s__LE_d
push ecx
call fcn.0046aaf0
add esp, 0x14
call fcn.00433da4
pop ecx
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.0042201a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
call fcn.0042201a
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x434644
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [ebp - 0x26c], 0
jne 0x434769
push ecx
mov eax, esp
mov dword [ebp - 0x274], esp
push str.DeleteRegDatFiles_failed
push eax
call fcn.0046aaf0
pop ecx
pop ecx
call fcn.00433da4
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
mov eax, dword [ebp - 0x26c]
call fcn.004bef64
ret
Function at 0x436d14
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x1c
mov eax, 0x4da253
call fcn.004bee78
push ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x24], esp
push dword [ebp + 8]
push str.Loader_SetVirtEnvVariables:_in___s_
push eax
call fcn.0046aaf0
add esp, 0xc
call fcn.00433da4
pop ecx
mov dword [ebp - 0x1c], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.::
lea edi, [ebp - 0x1c]
call fcn.004247f3
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x28], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 1
call fcn.00424efd
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
call fcn.0046e840
add esp, 8
mov eax, esp
mov dword [ebp - 0x28], esp
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
push str.Loader_SetVirtEnvVariables:_setting_Env_variable:__s
push eax
call fcn.0046aaf0
add esp, 0xc
call fcn.00433da4
pop ecx
push ebx
push 0x3d
lea ecx, [ebp - 0x10]
call fcn.00426ece
mov esi, eax
cmp esi, 0xffffffff
jne 0x436dca
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
push str.Loader_SetVirtEnvVariables:__error:_Env_variable_doesnt_contain_
push eax
call fcn.0046aaf0
pop ecx
pop ecx
call fcn.00433da4
pop ecx
jmp 0x436eb7
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.004249e2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00424efd
push ebx
lea ecx, [ebp - 0x14]
lea eax, [esi + 1]
push ecx
mov byte [ebp - 4], 4
call fcn.0042488a
push str._ExistingValue_
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00424906
mov esi, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x436e9c
call fcn.004aa2e3
push eax
lea ecx, [ebp - 0x18]
call fcn.0042249b
push ebx
push ebx
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
call edi
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x436e64
push eax
lea ecx, [ebp - 0x18]
call fcn.004224cd
push dword [ebp - 0x24]
push eax
push esi
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.00424b01
cmp edi, ebx
jne 0x436e64
push 0x4eaa5c
lea ecx, [ebp - 0x18]
call fcn.004253f4
mov edi, dword [ebp - 0x18]
push edi
push str._ExistingValue_
lea eax, [ebp - 0x14]
push eax
call fcn.0042b4aa
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push str.Loader_SetVirtEnvVariables:_replacing__ExistingValue__with_existing_value:
push eax
call fcn.00424a97
add esp, 0xc
call fcn.00433da4
pop ecx
lea ecx, [edi - 0x10]
call fcn.0042201a
mov edi, dword [ebp - 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [edi - 0x10]
call fcn.0042201a
lea ecx, [esi - 0x10]
call fcn.0042201a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042201a
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x436d45
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042201a
call fcn.004bef50
ret