joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40baf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x4f4500]
xor eax, esp
mov dword [esp + 0x290], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x40bc58
cmp byte [0x4fa6fc], 0
je 0x40bc58
push 0x104
lea eax, [esp + 0x8c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x88]
push 0x5c
push ecx
call fcn.00445955
add esp, 8
test eax, eax
je 0x40bb55
xor edx, edx
mov word [eax + 2], dx
push str.debug_message.exe
lea eax, [esp + 0x8c]
push 0x104
push eax
call fcn.00445981
add esp, 0xc
cmp dword [esi + 0x18], 0x10
jb 0x40bb7e
mov ecx, dword [esi + 4]
mov dword [esp + 8], ecx
jmp 0x40bb85
lea edx, [esi + 4]
mov dword [esp + 8], edx
mov eax, dword [esi + 0x14]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x70]
push edx
mov dword [esp + 0x14], eax
call fcn.004112b0
add esp, 8
cmp dword [esp + 0x80], 0
je 0x40bc41
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.004435a0
mov eax, dword [esp + 0x7c]
add esp, 0xc
cmp dword [esp + 0x84], 8
mov dword [esp + 0x20], 0x44
jae 0x40bbd7
lea eax, [esp + 0x70]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40bc23
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
jmp 0x40bc41
push 0x40010
push str.Fatal_error
push 0
lea ecx, [esp + 0x78]
call fcn.00407360
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [esp + 0x84], 8
jb 0x40bc58
mov eax, dword [esp + 0x70]
push eax
call fcn.00443256
add esp, 4
mov ecx, dword [esp + 0x294]
pop esi
xor ecx, esp
call fcn.004436fd
mov esp, ebp
pop ebp
ret
Function at 0x40cfd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004524e0
mov eax, dword [0x4f4500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x1008]
push edx
lea edx, [ebp - 0x804]
push edx
lea edx, [ebp - 0x100c]
push edx
push 0
mov dword [ebp - 0x1008], 0
push eax
mov eax, dword [ecx]
push eax
mov dword [ebp - 0x100c], 1
mov dword [ebp - 0x1008], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40d0ef
mov eax, dword [ebp - 0x100c]
cmp eax, 1
jne 0x40d082
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d050
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x804]
push ecx
mov ecx, edi
call fcn.00408ab0
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004436fd
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
jne 0x40d0ea
push 0x400
lea edx, [ebp - 0x1004]
push edx
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x40d0d3
cmp eax, 0x400
ja 0x40d0d3
lea ecx, [ebp - 0x1004]
push ecx
mov ecx, edi
call fcn.0040c780
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004436fd
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0xea
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004436fd
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004436fd
mov esp, ebp
pop ebp
ret 8

Function at 0x40d110
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
mov dword [ebp - 4], 0
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40d125
mov edx, dword [ebp + 8]
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ecx]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40d160
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push esi
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d1aa
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [ebp + 0xc]
push edx
push eax
push eax
push eax
mov dword [ebp + 0xc], eax
mov eax, dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esi]
test eax, eax
je 0x40d1bf
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [esi + 8], ax
mov dword [esi], 0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
dec eax
mov dword [esi + 4], eax
test ecx, ecx
je 0x40d1f3
test eax, eax
jl 0x40d1f3
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
lea edx, [ebp + 0xc]
push edx
lea edx, [esi + 8]
push edx
push eax
push ecx
mov dword [ebp + 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40d1f9
xor eax, eax
mov word [esi + 8], ax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40db50
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x170
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
lea eax, [esp]
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0x24], 0xc3d2e1f0
call fcn.0040d5b0
call fcn.0040d4d0
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [eax], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40dc90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x40dcab
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x40dcc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4f4500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x40de06
push ebx
push edi
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x264]
call fcn.00407290
push 0xffffffffffffffff
xor edi, edi
push edi
lea eax, [ebp - 0x264]
xor edx, edx
mov ebx, 7
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], edi
mov word [ebp - 0x244], dx
call fcn.00407d30
push 0xffffffffffffffff
xor ecx, ecx
push edi
lea edx, [ebp - 0x248]
mov word [ebp - 0x228], cx
push edx
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], edi
call fcn.00407d30
lea eax, [ebp - 0x22c]
call fcn.00414550
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.00407d30
mov esi, 8
cmp dword [ebp - 0x214], esi
jb 0x40dd9b
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.00443256
add esp, 4
xor edx, edx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], edi
mov word [ebp - 0x228], dx
cmp dword [ebp - 0x230], esi
jb 0x40ddc7
mov eax, dword [ebp - 0x244]
push eax
call fcn.00443256
add esp, 4
mov dword [ebp - 0x234], edi
xor ecx, ecx
pop edi
mov dword [ebp - 0x230], ebx
mov word [ebp - 0x244], cx
pop ebx
cmp dword [ebp - 0x24c], esi
jb 0x40ddf5
mov edx, dword [ebp - 0x260]
push edx
call fcn.00443256
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004436fd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.004436fd
mov esp, ebp
pop ebp
ret
Function at 0x40df20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x40df36
mov eax, dword [eax + 4]
jmp 0x40df39
add eax, 4
push esi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40df5b
test esi, esi
jne 0x40df63
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push edi
push 0
lea eax, [ebp - 4]
push eax
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40df90
mov edi, dword [ebp - 4]
cmp edi, ebx
jne 0x40df90
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40dfa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x4f4500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea ecx, [ebp - 0x20c]
push ecx
xor eax, eax
push 0x104
mov word [ebp - 0x20c], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40e0ef
cmp eax, 0x104
ja 0x40e0ef
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x228]
call fcn.00407290
xor eax, eax
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x248], 7
mov dword [ebp - 0x24c], 0
mov word [ebp - 0x25c], ax
call fcn.00407d30
xor edx, edx
push 0xffffffffffffffff
push edx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], dx
call fcn.00407d30
lea eax, [ebp - 0x244]
call fcn.00414550
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x244]
push ecx
mov ecx, esi
call fcn.00407d30
mov esi, 8
cmp dword [ebp - 0x22c], esi
jb 0x40e093
mov edx, dword [ebp - 0x240]
push edx
call fcn.00443256
add esp, 4
xor eax, eax
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
cmp dword [ebp - 0x248], esi
jb 0x40e0c7
mov ecx, dword [ebp - 0x25c]
push ecx
call fcn.00443256
add esp, 4
cmp dword [ebp - 0x210], esi
jb 0x40e0de
mov edx, dword [ebp - 0x224]
push edx
call fcn.00443256
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004436fd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.004436fd
mov esp, ebp
pop ebp
ret
Function at 0x40e100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov dword [esp + 0x1c], 0
call fcn.004152f0
cmp eax, 1
mov eax, dword [ebp + 8]
jle 0x40e203
push 0
push 0x8000000
push 3
push 0
push 7
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x40e18a
test esi, esi
je 0x40e18a
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
cmp eax, 0x100000
mov dword [esp + 0x18], 0x100000
lea eax, [esp + 0x18]
jb 0x40e16b
lea eax, [esp + 0x1c]
mov ebx, dword [eax]
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40e193
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
xor esi, esi
push esi
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e1e1
lea esp, [esp]
mov ecx, dword [esp + 0x14]
test ecx, ecx
jbe 0x40e1e1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40e1c7
cmp esi, eax
sbb eax, eax
neg eax
je 0x40e1e1
push 0
lea eax, [esp + 0x18]
push eax
push ebx
add esi, ecx
mov ecx, dword [esp + 0x1c]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e1b0
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x40e18a
mov ecx, dword [eax + 0x3c]
mov esi, dword [ebp + 0xc]
add ecx, eax
test esi, esi
jne 0x40e225
mov esi, dword [ecx + 0x50]
xor ecx, ecx
test esi, esi
jbe 0x40e239
mov edi, dword [ebp + 0x10]
mov edi, edi
mov dl, byte [ecx + eax]
add ecx, edi
cmp ecx, esi
jb 0x40e230
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f590
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
test dword [0x4fa77c], 0xfffffffe
push esi
mov dword [ebp - 4], 0
jne 0x40f61f
push 0
push 1
push 0x4fa77c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x40f5e7
cmp dword [0x4fa77c], 1
jne 0x40f61f
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0
call esi
cmp dword [0x4fa77c], 1
je 0x40f5d0
mov eax, dword [0x4fa77c]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x4fa780], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4fa780], eax
cmp eax, 0xffffffff
jne 0x40f606
call fcn.00415470
push 0
push 0x4fa77c
push 0x4fa780
push 0x4fa77c
call fcn.00419470
add esp, 0x10
mov eax, dword [0x4fa77c]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410d40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], eax
test edi, edi
jne 0x410d59
xor ebx, ebx
jmp 0x410d6b
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410d60
sub eax, edx
mov ebx, eax
xor ecx, ecx
push edi
lea esi, [ebp - 0x24]
mov eax, ebx
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], cx
call fcn.00419cd0
add esp, 4
push ebx
push edi
mov ebx, esi
call fcn.00411470
mov eax, dword [ebp - 0x20]
mov ebx, 8
add esp, 8
cmp dword [ebp - 0xc], ebx
jae 0x410da9
lea eax, [ebp - 0x20]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp dword [ebp - 0xc], ebx
jb 0x410dc7
mov edx, dword [ebp - 0x20]
push edx
call fcn.00443256
add esp, 4
test esi, esi
jne 0x410dd6
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 8], 0
je 0x410ebc
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00442a0d
add esp, 4
mov ebx, eax
mov dword [ebp - 0x2c], edi
test edi, edi
jne 0x410e09
mov dword [ebp - 0x28], edi
jmp 0x410e1c
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410e10
sub eax, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.004112b0
mov edi, 8
add esp, 8
cmp dword [eax + 0x18], edi
jb 0x410e3b
mov eax, dword [eax + 4]
jmp 0x410e3e
add eax, 4
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 0x30], edi
jb 0x410e58
mov edx, dword [ebp - 0x44]
push edx
call fcn.00443256
add esp, 4
push ebx
lea ecx, [ebp - 0x48]
call fcn.00407290
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00411240
mov ecx, dword [ebp - 8]
add esp, 8
push 0xffffffffffffffff
push 0
push eax
call fcn.00402720
cmp dword [ebp - 0xc], 0x10
jb 0x410e90
mov edx, dword [ebp - 0x20]
push edx
call fcn.00443256
add esp, 4
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x30], edi
jb 0x410eb3
mov eax, dword [ebp - 0x44]
push eax
call fcn.00443256
add esp, 4
push ebx
call fcn.00443640
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x410ed0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
push ebx
push esi
push edi
mov dword [esp + 0x14], ecx
jb 0x410eee
mov edx, dword [eax + 4]
jmp 0x410ef1
lea edx, [eax + 4]
mov ebx, dword [eax + 0x14]
mov dword [esp + 0xc], edx
test ecx, ecx
jne 0x410f00
xor edi, edi
jmp 0x410f10
mov eax, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410f05
sub eax, edx
mov edi, eax
mov ecx, dword [esp + 0xc]
xor eax, eax
mov word [esp + 0x38], ax
push ecx
lea esi, [esp + 0x38]
mov eax, ebx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
call fcn.00419cd0
mov edx, dword [esp + 0x10]
add esp, 4
push ebx
push edx
mov ebx, esi
call fcn.00411470
add esp, 8
cmp dword [esp + 0x4c], 8
jb 0x410f5b
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
jmp 0x410f63
lea ecx, [esp + 0x38]
mov dword [esp + 0xc], ecx
mov ebx, dword [esp + 0x14]
xor edx, edx
push ebx
lea esi, [esp + 0x1c]
mov eax, edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
call fcn.00419cd0
add esp, 4
push edi
push ebx
mov ebx, esi
call fcn.00411470
mov eax, dword [esp + 0x24]
mov esi, 8
add esp, 8
cmp dword [esp + 0x30], esi
jae 0x410fac
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne bl
cmp dword [esp + 0x30], esi
jb 0x410fd0
mov edx, dword [esp + 0x1c]
push edx
call fcn.00443256
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp dword [esp + 0x4c], esi
jb 0x410ffa
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00443256
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411010
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
jne 0x411026
xor edi, edi
jmp 0x41103b
mov eax, ebx
lea edx, [eax + 1]
jmp 0x411030
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411030
sub eax, edx
mov edi, eax
xor eax, eax
mov word [esp + 0x10], ax
push ebx
lea esi, [esp + 0x10]
mov eax, edi
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
call fcn.00419cd0
add esp, 4
push edi
push ebx
mov ebx, esi
call fcn.00411470
mov eax, dword [esp + 0x18]
mov esi, 8
add esp, 8
cmp dword [esp + 0x24], esi
jae 0x411080
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne bl
cmp dword [esp + 0x24], esi
jb 0x4110a1
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00443256
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414950
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp dword [eax + 0x18], 8
push ebx
push esi
jb 0x414966
mov ebx, dword [eax + 4]
jmp 0x414969
lea ebx, [eax + 4]
lea eax, [ebp - 4]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x41497f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 1
push esi
call fcn.00446804
mov edi, eax
add esp, 8
test edi, edi
je 0x4149f4
mov ecx, dword [ebp - 4]
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4149eb
lea edx, [ebp - 8]
push edx
lea eax, [ebp + 8]
push eax
push 0x4ee56c
push edi
mov dword [ebp + 8], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4149eb
cmp dword [ebp + 8], 0
je 0x4149eb
push 0x14
call fcn.0044353b
mov esi, eax
add esp, 4
test esi, esi
je 0x4149f4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
call fcn.004148b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.004445a5
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414c30
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4f4500]
xor eax, ebp
mov dword [ebp - 4], eax
movzx ecx, word [edi + 8]
mov eax, dword [ebp + 8]
mov dx, word [edi + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x224], eax
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], dx
call esi
movzx ecx, word [edi + 8]
mov word [ebp - 0x10], ax
mov ax, word [edi + 0xc]
mov edx, 0x4e4
mov word [ebp - 0xe], ax
mov word [ebp - 0xc], cx
mov word [ebp - 0xa], dx
call esi
mov word [ebp - 8], ax
mov eax, 0x4e4
mov word [ebp - 6], ax
xor esi, esi
movzx eax, word [ebp + esi*2 - 0x14]
movzx ecx, word [ebp + esi*2 - 0x12]
inc esi
push ebx
movzx ecx, cx
push ecx
movzx edx, ax
push edx
push 0x4ee778
push 0x104
lea eax, [ebp - 0x21c]
push 0x104
push eax
inc esi
call fcn.00445214
mov eax, dword [edi + 4]
add esp, 0x1c
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x220], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x414cfc
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x414d14
cmp esi, 8
jb 0x414c93
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004436fd
mov esp, ebp
pop ebp
ret 4
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414d20
mov ecx, dword [ebp - 0x224]
sub eax, esi
sar eax, 1
push eax
push edx
call fcn.00408ab0
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.004436fd
mov esp, ebp
pop ebp
ret 4
Function at 0x415140
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x4f4500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
push edi
mov dword [esi], ebx
mov dword [esi + 0x18], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x41518d
xor eax, eax
jmp 0x4151b3
lea ecx, [ebp - 0x12c]
push ecx
push edi
mov dword [ebp - 0x12c], ebx
call eax
test eax, eax
jne 0x4151a8
mov eax, 2
jmp 0x4151b3
xor eax, eax
cmp dword [ebp - 0x12c], ebx
setne al
push 0x118
lea edx, [ebp - 0x124]
push ebx
push edx
mov dword [esi + 0x24], eax
mov dword [ebp - 0x128], 0x11c
call fcn.004435a0
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x11c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp eax, 5
jne 0x415213
cmp ecx, ebx
jle 0x41524b
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
jmp 0x41524b
cmp eax, 6
jne 0x415243
cmp byte [ebp - 0xe], 1
jne 0x41523b
sub ecx, ebx
je 0x415233
sub ecx, 1
je 0x41522b
mov dword [esi], eax
jmp 0x41524b
mov dword [esi], 5
jmp 0x41524b
mov dword [esi], 3
jmp 0x41524b
mov dword [esi], 4
jmp 0x41524b
jle 0x41524b
mov dword [esi], 7
movzx ecx, word [ebp - 0x14]
movzx edx, word [ebp - 0x12]
xor eax, eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x150]
push eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
mov dword [ebp - 0x150], ebx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x150]
cmp eax, ebx
je 0x4152c5
cmp eax, 6
je 0x4152bc
cmp eax, 9
jne 0x4152c8
mov dword [esi + 0x18], 1
jmp 0x4152c8
mov dword [esi + 0x18], 2
jmp 0x4152c8
mov dword [esi + 0x18], ebx
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x134]
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [esi + 0x20], edx
mov eax, esi
pop ebx
call fcn.004436fd
mov esp, ebp
pop ebp
ret