joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4074c0
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x414176], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x414175], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x414174], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x414173], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x414172], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x414171], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x414170], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEF]
mov byte [0x41416f], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x4075cb
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x4075cd
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x4075e0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.00407eaa
cmp dword [0x413a0c], ecx
jne 0x4076e5
mov ecx, fcn.0040822e
cmp dword [0x413a10], ecx
jne 0x4076e5
mov ecx, fcn.00408426
cmp dword [0x413a14], ecx
jne 0x4076e5
mov ecx, fcn.00408740
cmp dword [0x413a18], ecx
jne 0x4076e5
mov ecx, 0x4067e0
cmp dword [0x413a1c], ecx
jne 0x4076e5
xor eax, eax
mov ecx, 0x4067f0
cmp dword [0x413a20], ecx
jne 0x4076e5
mov ecx, dword [0x417450]
test ecx, ecx
jne 0x4076e5
call fcn.004074c0
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x4076e5
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0x417450], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.00407eaa
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret
Function at 0x4095ac
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
cmp dword [0x414670], esi
jbe 0x4091ac
mov edx, dword [esp + 0x44]
lea ecx, [edx + 1]
xor eax, eax
cmp ecx, 2
jb 0x4091b8
mov eax, dword [esi*4 + 0x414674]
test ah, 0x40
je 0x4091c0
xor edi, edi
test ah, 2
je 0x4091cc
xor eax, eax
jmp 0x4091b8
mov dword [esp], 0xfffffffa
call fcn.00409dc0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
jmp 0x4095ac
test edx, edx
jne 0x4091d4
xor eax, eax
jmp 0x4091b8
mov ebx, dword [esp + 0x40]
sub edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call 0x4095ac
mov ebp, eax
test ebp, ebp
je 0x40932d
mov dword [esp + 0x18], edi
mov eax, 0xffffffff
cmp ebp, 0xffffffff
je 0x4091b8
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], 0x1a
call fcn.0040893c
test eax, eax
je 0x409230
or byte [esi*4 + 0x414675], 2
mov ebp, eax
sub ebp, ebx
je 0x409329
mov dword [esp + 0x1c], eax
lea edi, [ebp + ebx - 1]
cmp byte [ebp + ebx - 1], 0xd
jne 0x409263
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], 1
call 0x4095ac
mov ecx, eax
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x4091b8
mov dword [esp + 0x24], edi
lea eax, [ebx + ebp]
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ebp
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x14], ebx
jmp 0x409289
add edi, ebp
inc ebx
mov esi, ebx
mov ebp, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0xd
call fcn.0040893c
mov ebx, eax
test ebx, ebx
cmove ebx, ebp
mov ebp, ebx
sub ebp, esi
cmp esi, edi
je 0x4092c4
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00408994
mov eax, dword [esp + 0x24]
cmp ebx, eax
jb 0x409284
mov ebx, dword [esp + 0x14]
sub edi, ebx
add ebp, edi
mov edi, dword [esp + 0x18]
add edi, ebp
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x10]
jae 0x409305
cmp dword [esp + 0x1c], 0
sete al
mov esi, dword [esp + 0x3c]
test byte [esi*4 + 0x414675], 0x20
sete cl
test ebp, ebp
jne 0x40932d
and cl, al
jne 0x409319
jmp 0x40932d
cmp dword [esp + 0x1c], 0
sete al
test ebp, ebp
mov esi, dword [esp + 0x3c]
jne 0x40932d
test al, al
je 0x40932d
add ebx, ebp
mov edx, dword [esp + 0x44]
cmp edi, edx
jb 0x4091d8
jmp 0x40932d
mov edi, dword [esp + 0x18]
mov eax, edi
jmp 0x4091b8
push esi
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp dword [0x414670], eax
jbe 0x4095f9
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x4196f4]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_ReadFile
sub esp, 0x14
cmp eax, 1
jne 0x409607
mov eax, dword [esp + 0x14]
jmp 0x40961d
mov dword [esp], 6
call fcn.00409dc0
jmp 0x40961d
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x40961d
mov dword [esp], ecx
call fcn.00409dc0
add esp, 0x18
pop esi
ret
jmp 0x409174
Function at 0x409634
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp dword [0x414670], eax
jbe 0x409681
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x4196f4]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
cmp eax, 1
jne 0x40968f
mov eax, dword [esp + 0x14]
jmp 0x409694
mov dword [esp], 6
call fcn.00409dc0
jmp 0x409694
call fcn.00409e40
add esp, 0x18
pop esi
ret
Function at 0x40b740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x48]
test ah, 0xc0
je 0x408f60
mov ebx, eax
jmp 0x408f6f
mov ecx, dword [0x414740]
mov ebx, 0xc000
and ebx, dword [ecx]
or ebx, eax
mov edi, ebx
shr edi, 1
and edi, 0x4000
xor edi, 0x4000
or edi, ebx
mov eax, ebx
and eax, 0x700
cmp eax, 0x1ff
ja 0x408f9d
cmp eax, 0x100
jne 0x408fe3
mov ebp, 4
jmp 0x408fe8
cmp eax, 0x2ff
ja 0x408fad
cmp eax, 0x200
jne 0x408fe3
jmp 0x408fd5
cmp eax, 0x4ff
ja 0x408fc2
cmp eax, 0x300
jne 0x408fe3
mov ebp, 2
jmp 0x408fe8
mov ebp, 1
cmp eax, 0x500
je 0x408fe8
cmp eax, 0x600
jne 0x408fdc
mov ebp, 5
jmp 0x408fe8
cmp eax, 0x700
je 0x408fe8
mov ebp, 3
mov eax, ebx
and eax, 0x100
mov dword [esp + 0x1c], eax
je 0x409020
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
and eax, dword [0x4141bc]
mov edx, 1
mov ecx, 0x80
test al, 0x80
cmove ecx, edx
jmp 0x409037
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, 0x80000000
mov edx, ebx
and edx, 3
je 0x409059
cmp edx, 2
jne 0x40904f
mov eax, 0xc0000000
jmp 0x409059
cmp edx, 1
jne 0x40907f
mov eax, 0x40000000
mov edx, ebx
mov esi, edx
and ebx, 0x70
xor edx, edx
cmp ebx, 0x10
je 0x409095
cmp ebx, 0x30
jne 0x409073
mov edx, 2
jmp 0x409095
cmp ebx, 0x20
jne 0x409090
mov edx, 1
jmp 0x409095
mov dword [esp], 1
call fcn.00409dc0
jmp 0x40916b
mov edx, 3
mov ebx, esi
test bl, 4
je 0x4090a7
cmp eax, 0x80000000
sete dl
movzx edx, dl
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x28], 0
shr ebx, 7
and ebx, 1
xor ebx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x409144
mov dword [esp], esi
call fcn.00408ebc
mov dword [esp], esi
mov ecx, edi
or ecx, 0x2000
test eax, eax
cmove ecx, edi
and ecx, 0xfffff8ff
mov dword [esp + 4], ecx
call fcn.00409a00
cmp eax, 0xffffffff
jne 0x40916b
mov dword [esp], 4
call fcn.00409dc0
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov eax, 0xffffffff
jmp 0x40916b
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
cmp eax, 0x6e
jne 0x409163
mov ecx, 0x50
mov eax, 2
cmp dword [esp + 0x1c], 0
cmovne eax, ecx
mov dword [esp], eax
call fcn.00409dc0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x408f4c
Function at 0x40b750
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
cmp dword [0x414670], esi
jbe 0x4091ac
mov edx, dword [esp + 0x44]
lea ecx, [edx + 1]
xor eax, eax
cmp ecx, 2
jb 0x4091b8
mov eax, dword [esi*4 + 0x414674]
test ah, 0x40
je 0x4091c0
xor edi, edi
test ah, 2
je 0x4091cc
xor eax, eax
jmp 0x4091b8
mov dword [esp], 0xfffffffa
call fcn.00409dc0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
jmp 0x4095ac
test edx, edx
jne 0x4091d4
xor eax, eax
jmp 0x4091b8
mov ebx, dword [esp + 0x40]
sub edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call 0x4095ac
mov ebp, eax
test ebp, ebp
je 0x40932d
mov dword [esp + 0x18], edi
mov eax, 0xffffffff
cmp ebp, 0xffffffff
je 0x4091b8
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], 0x1a
call fcn.0040893c
test eax, eax
je 0x409230
or byte [esi*4 + 0x414675], 2
mov ebp, eax
sub ebp, ebx
je 0x409329
mov dword [esp + 0x1c], eax
lea edi, [ebp + ebx - 1]
cmp byte [ebp + ebx - 1], 0xd
jne 0x409263
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], 1
call 0x4095ac
mov ecx, eax
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x4091b8
mov dword [esp + 0x24], edi
lea eax, [ebx + ebp]
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ebp
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x14], ebx
jmp 0x409289
add edi, ebp
inc ebx
mov esi, ebx
mov ebp, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0xd
call fcn.0040893c
mov ebx, eax
test ebx, ebx
cmove ebx, ebp
mov ebp, ebx
sub ebp, esi
cmp esi, edi
je 0x4092c4
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00408994
mov eax, dword [esp + 0x24]
cmp ebx, eax
jb 0x409284
mov ebx, dword [esp + 0x14]
sub edi, ebx
add ebp, edi
mov edi, dword [esp + 0x18]
add edi, ebp
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x10]
jae 0x409305
cmp dword [esp + 0x1c], 0
sete al
mov esi, dword [esp + 0x3c]
test byte [esi*4 + 0x414675], 0x20
sete cl
test ebp, ebp
jne 0x40932d
and cl, al
jne 0x409319
jmp 0x40932d
cmp dword [esp + 0x1c], 0
sete al
test ebp, ebp
mov esi, dword [esp + 0x3c]
jne 0x40932d
test al, al
je 0x40932d
add ebx, ebp
mov edx, dword [esp + 0x44]
cmp edi, edx
jb 0x4091d8
jmp 0x40932d
mov edi, dword [esp + 0x18]
mov eax, edi
jmp 0x4091b8
push esi
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp dword [0x414670], eax
jbe 0x4095f9
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x4196f4]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_ReadFile
sub esp, 0x14
cmp eax, 1
jne 0x409607
mov eax, dword [esp + 0x14]
jmp 0x40961d
mov dword [esp], 6
call fcn.00409dc0
jmp 0x40961d
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x40961d
mov dword [esp], ecx
call fcn.00409dc0
add esp, 0x18
pop esi
ret
jmp 0x409174
Function at 0x40f05c
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
test esi, esi
je 0x40f17f
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetLocalTime
sub esp, 4
movzx eax, word [esp + 0x2e]
mov dword [esp + 0x24], eax
movzx ecx, word [esp + 0x32]
movzx edx, word [esp + 0x2c]
movzx ebx, word [esp + 0x34]
movzx ebp, word [esp + 0x36]
movzx edi, word [esp + 0x38]
movzx eax, word [esp + 0x3a]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str._02d__02d__04d__02d:_02d:_02d._03d
mov dword [esp], 0x4199d0
call sub.USER32.DLL_wsprintfA
mov dword [esp], 0x4199d0
call fcn.00408c74
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0x4199d0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov edi, dword [esp + 0x54]
mov dword [esp], edi
call fcn.00408c74
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f190
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x9c
mov ecx, dword [0x4199f0]
mov eax, dword [0x4199f4]
mov edi, dword [esp + 0xac]
test eax, eax
jne 0x40f285
test ecx, ecx
jne 0x40f285
cmp dword [0x415844], 0
je 0x40f2c7
lea esi, [esp + 0x18]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x80
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call fcn.0040ef24
test eax, eax
jne 0x40f212
mov dword [esp], esi
mov dword [esp + 4], 0x3a
call fcn.0040ef24
test eax, eax
je 0x40f215
inc eax
mov esi, eax
mov dword [esp + 0x98], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x40f265
call sub.KERNEL32.DLL_GetCurrentThreadId
lea ecx, [esp + 0x98]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x40f390
call sub.USER32.DLL_EnumThreadWindows
sub esp, 0xc
mov ecx, 0x12010
cmp dword [esp + 0x98], 0
jne 0x40f265
mov ecx, 0x11010
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.USER32.DLL_MessageBoxA
sub esp, 0x10
jmp 0x40f351
test ecx, ecx
je 0x40f29c
cmp ecx, 0xffffffff
je 0x40f351
mov dword [esp], edi
call ecx
mov eax, dword [0x4199f4]
test eax, eax
je 0x40f351
cmp eax, 0xffffffff
je 0x40f351
cmp byte [eax], 0
je 0x40f351
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0040f05c
jmp 0x40f351
mov dword [esp], 0xfffffff4
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov esi, eax
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x415694
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], edi
call fcn.00408c74
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x415694
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
add esp, 0x9c
pop esi
pop edi
pop ebx
ret
Function at 0x4101dc
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x41da24]
test eax, eax
je 0x410223
mov ecx, dword [eax]
xor edi, edi
test ecx, ecx
je 0x4102ae
add eax, 4
xor edi, edi
nop word cs:[eax + eax]
cmp byte [ecx], 1
sbb ecx, ecx
lea edi, [edi + ecx + 1]
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x41020c
jmp 0x4102ae
mov esi, dword [0x41da60]
test esi, esi
jne 0x410250
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x41da60], esi
test esi, esi
jne 0x410250
mov dword [esp], str.GetEnvironmentStrings_failed
call fcn.0040f370
mov esi, dword [0x41da60]
mov dword [esp], esi
call fcn.00408c74
xor ebx, ebx
mov ebp, 1
xor edi, edi
test eax, eax
je 0x410284
mov ebp, esi
nop dword [eax + eax]
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
lea ebx, [eax + ebx + 1]
inc edi
call fcn.00408c74
test eax, eax
jne 0x41026c
inc ebx
mov ebp, ebx
mov dword [esp], ebp
call fcn.00406488
mov ecx, eax
mov dword [0x41da20], ecx
xor eax, eax
test ecx, ecx
je 0x410359
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.00408994
lea eax, [edi + 4]
mov dword [0x41da28], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.00406470
mov esi, eax
xor eax, eax
test esi, esi
je 0x410359
mov edi, dword [0x41da24]
test edi, edi
je 0x41030b
mov edx, dword [edi]
test edx, edx
je 0x410346
lea eax, [edi + 4]
xor ecx, ecx
nop
cmp byte [edx], 0
jne 0x4102fc
dec ecx
jmp 0x4102ff
mov dword [esi + ecx*4], edx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x4102ec
jmp 0x410342
mov ebx, dword [0x41da20]
mov dword [esp], ebx
call fcn.00408c74
test eax, eax
je 0x41034e
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [eax + ebx + 1]
mov dword [esp], ebx
add ebp, 4
call fcn.00408c74
test eax, eax
jne 0x41032c
test edi, edi
je 0x41034e
mov dword [esp], edi
call fcn.00406498
mov dword [0x41da24], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
cmp word [0x400000], 0x5a4d
mov dword [0x4d01ac], 1
mov dword [0x4d01a8], 1
mov dword [0x4d01a4], 1
jne 0x401059
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x4d000c], eax
mov eax, dword [0x4d01b8]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x4d01cc]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x4d01b4]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x49e0d8], 1
je 0x4010e0
leave
xor eax, eax
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401073
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f0
cmp dx, 0x20b
jne 0x401059
cmp dword [ecx + 0x84], 0xe
jbe 0x401059
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401059
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
leave
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401059
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401059
Function at 0x425070
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4250a4
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4250b4
mov eax, dword [0x4a3120]
mov ecx, dword [0x4a3124]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x4264e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 2
cmp esi, 0x201
jae 0x426540
jmp 0x42652e
jbe 0x4265b0
cmp esi, 0x201
jae 0x426540
mov dword [ebp - 0x20], 0x200
lea edi, [ebp - 0x434]
mov ebx, esi
jmp 0x42656a
mov ebx, dword [ebp - 0x24]
sub esi, ebx
je 0x42655e
mov edx, ebx
lea ecx, [ebp - 0x18]
push esi
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::reserve::do_reserve_and_handle::h20e2001013f05adb
add esp, 4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push ebx
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x426587
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x426600
cmp esi, ebx
jne 0x426520
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x42661e
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x42652e
jmp 0x426540
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x426634
lea eax, [ebp - 0x34]
push esi
push edi
push eax
call sym.__LT_std..ffi..os_str..OsString_u20_as_u20_std..os..windows..ffi..OsStringExt_GT_::from_wide::hdc9efc66b333cddc
add esp, 0xc
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4265f2
add eax, eax
push 2
push eax
push dword [ebp - 0x14]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4265e2
jmp 0x4265f2
push 0x4a3250
push 0x28
push str.internal_error:_entered_unreachable_code_f
call sym.core::panicking::panic::h2de0902fd6c3d9b1
add esp, 0xc
jmp 0x426643
push 0x4a3240
push eax
push esi
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
add esp, 0xc
ud2

Function at 0x426670
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
call sub.KERNEL32.dll_GetEnvironmentStringsW
test eax, eax
je 0x42668a
mov edx, eax
add esp, 0x28
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x30], 0x4a2af0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], sym.__LT_std..io..error..Error_u20_as_u20_core..fmt..Display_GT_::fmt::hb3a737c4f0103051
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x30]
push 0x4a2af8
push eax
call sym.core::panicking::panic_fmt::h653fda680bf9012e
add esp, 8
ud2