joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d955bc0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x6d955bb7
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
mov ebx, dword [esp + 0x2c]
mov dword [esp], 2
call dword [0x6d95e7bc]
mov dword [esp + 4], str.Erro:__s_n
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
add esp, 0x38
pop ebx
ret
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.6d9557d0
test eax, eax
je 0x6d955c00
mov dword [esp + 4], esi
mov ebx, eax
mov dword [esp], eax
call fcn.6d954d00
test eax, eax
je 0x6d955c40
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], 2
call dword [0x6d95e7bc]
mov dword [esp + 8], 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Erro_ao_carregar_a_DLL_em_memria._n
call sub.msvcrt.dll_fwrite
add esp, 0x14
pop ebx
pop esi
jmp 0x6d955b30
mov dword [esp], 2
call dword [0x6d95e7bc]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Erro_ao_obter_o_endereo_da_funo__s._n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
call 0x6d955b30
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp fcn.6d954e50

Function at 0x6d955cb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [0x6da2c3a8], eax
test eax, eax
je 0x6d955cf8
mov dword [esp], 0x6da2c3ac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp], 2
call dword [0x6d95e7bc]
mov dword [esp + 8], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x6d9564a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6da2c738]
test esi, esi
jle 0x6d9565b0
mov edi, dword [0x6da2c73c]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6d9564d4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6d956555
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x6d9564c0
mov dword [esp], eax
mov ebx, eax
call fcn.6d956bf0
test eax, eax
mov edi, eax
je 0x6d9565d7
mov eax, dword [0x6da2c73c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6d956cf0
add eax, dword [edi + 0xc]
mov edx, dword [0x6da2c73c]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d9565b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6d95654e
sub eax, 4
and eax, 0xfffffffb
jne 0x6d956560
add dword [0x6da2c738], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x6da2c73c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6d95654e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6d957220
lea esi, [esi]
xor esi, esi
jmp 0x6d9564de
mov eax, dword [0x6da2c73c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6d957220
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6d957220
mov esi, esi
lea edi, [edi]

Function at 0x6d956870
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6da2c748
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6da2c740]
sub esp, 4
test ebx, ebx
je 0x6d9568c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6d9568be
test esi, esi
je 0x6d9568be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d9568a0
mov dword [esp], 0x6da2c748
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6d957220
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6d957200
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6d957200
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.6d8c13e0
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x51403a88
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..rdata
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x640c323d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x6cc87b8d
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7e620456
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x433006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3f883304
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4696504
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4012a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
call fcn.0040d4f0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4012cf
mov eax, dword [ebp - 4]
and eax, 0x10
jne 0x4012cf
mov dword [ebp - 8], 1
jmp 0x4012d6
mov dword [ebp - 8], 0
movzx eax, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4012e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
call fcn.0040d4f0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40130f
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x40130f
mov dword [ebp - 8], 1
jmp 0x401316
mov dword [ebp - 8], 0
movzx eax, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401320
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x40134f
xor al, al
jmp 0x4013c1
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4013b2
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004045f0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40139b
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4013c1
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401370
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004144d6
mov esp, ebp
pop ebp
ret

Function at 0x4014d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x433364
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40150a
push 0x43337c
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 4], eax
push 0x407510
mov ecx, dword [ebp - 4]
call fcn.00409cb0
nop
jmp 0x401545
push 0x4333a0
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00409ae0
mov dword [ebp - 0x10], eax
push 0x407510
mov ecx, dword [ebp - 0x10]
call fcn.00409cb0
nop
mov esp, ebp
pop ebp
ret
Function at 0x401550
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x4333b8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40161d
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4015d7
push 0x4333e8
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00409ae0
push 0x4333d0
push eax
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x10], eax
push 0x407510
mov ecx, dword [ebp - 0x10]
call fcn.00409cb0
nop
jmp 0x401612
push 0x4333f8
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00409ae0
mov dword [ebp - 0x1c], eax
push 0x407510
mov ecx, dword [ebp - 0x1c]
call fcn.00409cb0
nop
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov esp, ebp
pop ebp
ret

Function at 0x401630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.example.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffff
je 0x40176b
push 0
lea eax, [ebp - 0x90]
push eax
push 0x80
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401710
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x80
jae 0x4016b3
jmp 0x4016b9
call fcn.004143f9
nop
mov ecx, dword [ebp - 0x8c]
mov byte [ebp + ecx - 0x84], 0
push 0x433444
push 0x442258
call fcn.00403f50
add esp, 8
lea edx, [ebp - 0x84]
push edx
push eax
call fcn.00403f50
add esp, 8
push str.__ReadFile_.
push eax
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x94], eax
push 0x407510
mov ecx, dword [ebp - 0x94]
call fcn.00409cb0
nop
jmp 0x40175d
push 0x433458
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x9c]
call fcn.00409ae0
mov dword [ebp - 0xa0], eax
push 0x407510
mov ecx, dword [ebp - 0xa0]
call fcn.00409cb0
nop
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004144d6
mov esp, ebp
pop ebp
ret
Function at 0x401780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push 0x433470
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40186a
mov dword [ebp - 8], 0x433488
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00419190
add esp, 4
push eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401824
push 0x4334b8
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00409ae0
push 0x433498
push eax
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x18], eax
push 0x407510
mov ecx, dword [ebp - 0x18]
call fcn.00409cb0
nop
jmp 0x40185f
push 0x4334c4
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00409ae0
mov dword [ebp - 0x24], eax
push 0x407510
mov ecx, dword [ebp - 0x24]
call fcn.00409cb0
nop
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov esp, ebp
pop ebp
ret

Function at 0x401870
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0x4334dc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4018ac
push 0x4334f8
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 4], eax
push 0x407510
mov ecx, dword [ebp - 4]
call fcn.00409cb0
nop
jmp 0x4018e7
push 0x433528
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00409ae0
mov dword [ebp - 0x10], eax
push 0x407510
mov ecx, dword [ebp - 0x10]
call fcn.00409cb0
nop
mov esp, ebp
pop ebp
ret

Function at 0x4018f0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push str.NewDirectory
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40192a
push 0x433564
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 4], eax
push 0x407510
mov ecx, dword [ebp - 4]
call fcn.00409cb0
nop
jmp 0x401965
push 0x433594
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00409ae0
mov dword [ebp - 0x10], eax
push 0x407510
mov ecx, dword [ebp - 0x10]
call fcn.00409cb0
nop
mov esp, ebp
pop ebp
ret
Function at 0x401970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4019ed
push 0x4335e4
push 0x4423c8
call fcn.00404280
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.00404280
add esp, 8
push str.__GetCurrentDirectory_.
push eax
call fcn.00404280
add esp, 8
mov dword [ebp - 0x214], eax
push 0x407550
mov ecx, dword [ebp - 0x214]
call fcn.00409cb0
nop
jmp 0x401a3a
push 0x433610
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.00409ae0
mov dword [ebp - 0x220], eax
push 0x407510
mov ecx, dword [ebp - 0x220]
call fcn.00409cb0
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004144d6
mov esp, ebp
pop ebp
ret

Function at 0x401a50
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x433638
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x401a8a
push 0x433650
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 4], eax
push 0x407510
mov ecx, dword [ebp - 4]
call fcn.00409cb0
nop
jmp 0x401ac5
push 0x43368c
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00409ae0
mov dword [ebp - 0x10], eax
push 0x407510
mov ecx, dword [ebp - 0x10]
call fcn.00409cb0
nop
mov esp, ebp
pop ebp
ret

Function at 0x401ad0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x441040]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x204]
push eax
push 0x4336b4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x401b52
push 0x4336f8
push 0x4423c8
call fcn.00404280
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
push eax
call fcn.00404280
add esp, 8
push str.__GetEnvironmentVariable_.
push eax
call fcn.00404280
add esp, 8
mov dword [ebp - 0x20c], eax
push 0x407550
mov ecx, dword [ebp - 0x20c]
call fcn.00409cb0
nop
jmp 0x401b9f
push 0x433730
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x214]
call fcn.00409ae0
mov dword [ebp - 0x218], eax
push 0x407510
mov ecx, dword [ebp - 0x218]
call fcn.00409cb0
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004144d6
mov esp, ebp
pop ebp
ret
Function at 0x401bb0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x433758
push str.MY_VAR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x401bef
push 0x433780
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 4], eax
push 0x407510
mov ecx, dword [ebp - 4]
call fcn.00409cb0
nop
jmp 0x401c2a
push 0x4337cc
push 0x442318
call fcn.00403f50
add esp, 8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00409ae0
mov dword [ebp - 0x10], eax
push 0x407510
mov ecx, dword [ebp - 0x10]
call fcn.00409cb0
nop
mov esp, ebp
pop ebp
ret

Function at 0x4027b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x433db4
push 0x442258
call fcn.00403f50
add esp, 8
mov dword [ebp - 4], eax
push 0x407510
mov ecx, dword [ebp - 4]
call fcn.00409cb0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x412856
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x412877
jl 0x41286e
test edi, edi
jne 0x412877
xor eax, eax
xor edx, edx
jmp 0x412938
cmp dword [ebx + 0x38], 0
je 0x41288c
push eax
push edi
push dword [ebp + 8]
call fcn.0041293e
jmp 0x412938
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4128d3
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4128d3
cmp eax, edi
jb 0x4128ad
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00415470
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4128d9
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x41292d
mov ecx, ebx
call fcn.004120a5
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x412918
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0041ca62
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x41292d
jmp 0x4128eb
test edx, edx
je 0x41292d
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0041ca62
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x4152f7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415336
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415336
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415336
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415336
cmp dword [ecx + 0x74], 0xe
jbe 0x415336
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret