joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x45314c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x453150]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.00418140
jmp 0x4011d3
mov eax, dword [0x453150]
test eax, eax
jne 0x4011c9
mov dword [0x453150], 1
mov dword [esp + 4], 0x456014
mov dword [esp], 0x45600c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x45301c], 1
mov eax, dword [0x453150]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x456008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x453150], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x45314c
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.00412271
mov dword [esp], 0x41238c
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x45308c], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.00411c10
mov eax, dword [0x453004]
mov dword [esp + 4], 0x453008
mov dword [esp], eax
call fcn.004013c8
call fcn.00411a4c
mov eax, dword [0x43aa2c]
mov edx, dword [0x45300c]
mov dword [eax], edx
mov ecx, dword [0x45300c]
mov edx, dword [0x453008]
mov eax, dword [0x453004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00436a00
mov dword [0x453014], eax
mov eax, dword [0x453018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x453014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x45301c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x453014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x453064], 1
mov dword [0x453068], 1
mov dword [0x45306c], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x402283
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x10c]
sub esp, 0x124
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
sub esp, 0xc
cmp eax, 0x102
jbe 0x4022c1
mov dword [esp], 0x43b0e1
jmp 0x4022c4
mov dword [esp], ebx
mov ecx, dword [ebp + 8]
call fcn.00401606
mov ebx, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
leave
ret

Function at 0x4022d5
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
mov edx, eax
shr eax, 4
leave
and eax, 1
inc edx
mov dl, 0
cmove eax, edx
movzx eax, al
ret
Function at 0x4022fd
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x220]
push ebx
xor ebx, ebx
sub esp, 0x26c
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edx
push edx
test eax, eax
je 0x402413
mov dword [esp], esi
lea ebx, [ebp - 0x238]
mov ecx, ebx
call fcn.00401592
mov ecx, ebx
push eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.00432960
push ecx
lea ecx, [ebp - 0x250]
mov dword [esp], eax
call fcn.00434130
mov ecx, ebx
push esi
call fcn.004318a0
xor eax, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40000000
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
jne 0x4023a9
xor ebx, ebx
jmp 0x4023e3
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 8], edi
mov eax, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
test ebx, ebx
je 0x4023a5
cmp dword [ebp - 0x238], edi
sete bl
lea ecx, [ebp - 0x250]
call fcn.004318a0
jmp 0x402413
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40241d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [esp], 0x43a684
call fcn.00417d10
mov dword [esp], 0x43a674
mov ebx, eax
call fcn.00417d10
cmp byte [ebx], 0
mov edx, eax
jne 0x40246e
xor ecx, ecx
lea eax, [eax + 0xc]
mov esi, 0x43b53c
mov dword [eax - 0xc], ecx
mov dword [eax - 8], ecx
mov dword [eax - 4], ecx
mov ecx, 0xa
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 0xa], 0
jne 0x402501
mov ecx, dword [edx + 4]
lea eax, [ecx + 1]
lea edi, [ecx + 3]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + 2]
mov dword [ebp - 0x24], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x28], eax
lea eax, [ecx + 5]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 4]
mov word [ebp - 0x2e], ax
lea eax, [ecx + 2]
mov word [ebp - 0x20], ax
lea eax, [ecx + 1]
mov word [ebp - 0x1e], ax
xor eax, eax
mov ebx, dword [edx]
mov esi, dword [ebp - 0x1c]
cmp ebx, esi
jne 0x4024bc
mov si, word [ebp - 0x1e]
jmp 0x4024ec
mov esi, dword [ebp - 0x24]
cmp ebx, esi
jne 0x4024c8
mov esi, dword [ebp - 0x20]
jmp 0x4024ec
cmp ebx, ecx
jne 0x4024d6
lea ebx, [eax - 0x6d]
xor word [edx + eax*2 + 0xc], bx
jmp 0x4024fb
mov esi, dword [ebp - 0x28]
cmp ebx, esi
jne 0x4024e1
mov esi, edi
jmp 0x4024ec
mov esi, dword [ebp - 0x2c]
cmp ebx, esi
jne 0x4024fb
mov si, word [ebp - 0x2e]
xor si, word [edx + eax*2 + 0xc]
inc ebx
mov word [edx + eax*2 + 0xc], si
mov dword [edx], ebx
jmp 0x4024ad
inc eax
cmp eax, 5
jne 0x4024ad
xor eax, eax
mov byte [edx + 0xa], 1
add edx, 0xc
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], edx
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40361f
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x158]
push ebx
sub esp, 0x1ac
mov dword [esp + 8], 0x43b0e4
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x170]
mov dword [esp], eax
call fcn.00435770
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edx
mov ebx, eax
lea ecx, [ebp - 0x170]
push edx
call fcn.0042da30
cmp ebx, 0xffffffff
je 0x40379b
lea eax, [ebp - 0x12c]
lea esi, [ebp - 0x1a0]
mov dword [esp], eax
mov ecx, esi
call fcn.00401606
push eax
mov dword [esp + 4], 0x43b0e7
mov dword [esp], esi
call fcn.004355b0
test al, al
jne 0x403739
mov dword [esp + 4], 0x43b0e9
mov dword [esp], esi
call fcn.004355b0
test al, al
jne 0x403739
mov dword [esp + 8], 0x43b0e2
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x170]
mov dword [esp], eax
call fcn.00435770
mov dword [esp], esi
lea ecx, [ebp - 0x170]
call fcn.0042ed00
push esi
lea esi, [ebp - 0x188]
mov ecx, esi
mov dword [esp], eax
call fcn.00430590
lea ecx, [ebp - 0x170]
push eax
call fcn.0042da30
mov dword [esp + 4], 6
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ecx
push ecx
test byte [ebp - 0x158], 0x10
jne 0x40372f
mov ecx, esi
call fcn.0042da30
jmp 0x403739
mov dword [esp], esi
call fcn.0040361f
jmp 0x403726
lea ecx, [ebp - 0x1a0]
call fcn.0042da30
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edx
push edx
test eax, eax
jne 0x403679
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push eax
jmp 0x40379b
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x411c18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00417f60
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x4127ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x41280b
mov eax, 0
jmp 0x41284f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x41282e
mov eax, 0
jmp 0x41284f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x41284a
mov eax, 0
jmp 0x41284f
mov eax, 1
leave
ret

Function at 0x412851
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4128b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4128a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4128a8
mov eax, dword [ebp - 4]
jmp 0x4128c4
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x412885
mov eax, 0
leave
ret
Function at 0x419300
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0
je 0x4193c8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041d9dc
cmp eax, 1
jne 0x4193be
mov dword [ebp - 0x3d], 0
mov dword [ebp - 0x39], 0
mov dword [ebp - 0x35], 0
mov dword [ebp - 0x31], 0
mov dword [ebp - 0x2d], 0
mov dword [ebp - 0x29], 0
mov dword [ebp - 0x25], 0
mov dword [ebp - 0x21], 0
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov dword [ebp - 0x15], 0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 4], 0x35
lea eax, [ebp - 0x3d]
mov dword [esp], eax
call fcn.00423080
lea eax, [ebp - 0x3d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4193c9
nop
leave
ret
Function at 0x41a34e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x41a1bd
mov dword [esp], 0x4530fc
call fcn.0041992d
mov eax, dword [0x43aa78]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41a395
mov eax, dword [ebp - 0x20]
jmp 0x41a4e0
call fcn.00419209
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x41a3ac
cmp dword [ebp - 0x20], 0
jne 0x41a3b6
mov eax, 0
jmp 0x41a4e0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00419300
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x41a488
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x43aa78]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x41a4dd
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41a5a4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0041a34e
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.0041a1e1
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x41a5ff
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x43aa78]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41a729
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x41a691
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41a64e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00419117
mov dword [ebp - 0x10], 0
mov eax, dword [0x43aa78]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x41a729
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41a6c1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x41a729
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00419117
mov dword [ebp - 0x10], 0
mov eax, dword [0x43aa78]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x41c974
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x43aa88
call fcn.0041d9e6
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x41c9a0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x41c9e2
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.00417fec
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x43aa88
call fcn.0041da5e
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x438720
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x435ee2
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.00424740
mov edx, eax
test eax, eax
je 0x438708
jmp 0x435eb9
call fcn.004380ec
nop
nop
nop
call fcn.004380ec
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x30
mov dword [esp + 4], 0
mov dword [esp], 0x43aaf0
call fcn.00418890
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x43aaf4], 0
mov dword [0x43aaf8], 0
mov dword [0x43aafc], 0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
jne 0x4387b6
jmp 0x438876
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov ebx, eax
test eax, eax
je 0x438830
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4387a0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4387a0
cmp byte [ebx + 0xf], 0x2e
jne 0x4387a0
add ebx, 0x10
lea esi, [esp + 0x18]
mov edi, dword [esi]
test edi, edi
je 0x438813
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x43881d
cmp byte [ebx + edi], 0x3d
je 0x4388a4
add esi, 0xc
lea eax, [esp + 0x30]
cmp eax, esi
jne 0x4387f6
jmp 0x4387a0
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x43aafc], ebx
test ebx, ebx
jne 0x438885
mov dword [esp], 0x4369c0
call fcn.00401494
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [0x43aafc], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [0x43aaf8], eax
test eax, eax
je 0x4388e2
xor edx, edx
mov dword [0x43aaf4], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x438863
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp], eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x4388d2
test dl, dl
jne 0x4387a0
test eax, eax
js 0x4387a0
mov dword [esi + 8], eax
jmp 0x4387a0
xor ecx, ecx
mov dword [0x43aafc], ecx
jmp 0x438863