joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43278e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x432824
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43280a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x432802
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x432800
push 1
push 0
push 0
push 0x7ab9
push 0x558c
call fcn.00435296
add esp, 0x14
jmp 0x432808
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x432822
push 0x3132
push 1
push 1
push 0
push 0x4b59
call fcn.0042ef14
add esp, 0x14
jmp 0x432865
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x432854
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x47fb
push 1
call fcn.0042f40f
add esp, 0xc
jmp 0x432865
push 1
push 0x742c
push 0
call fcn.00434cc9
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x433c1f
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x433d74
lea eax, [ebp + 0x10]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x433d01
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x433cc8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
shl eax, 2
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [eax + 0x20], ecx
jmp 0x433cff
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x433cff
push 0
push 0x70b1
push 0x77ce
push 1
push 1
push 1
push 0x3c3c
push 0
push 0x1a25
push 0x7f35
call fcn.00433c1f
add esp, 0x28
jmp 0x433d72
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x433d60
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x433d39
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jg 0x433d5e
mov byte [ebp - 2], 0
lea eax, [ebp - 2]
push eax
push 1
push 0
push 0x427e
push 0
call fcn.00430fbd
add esp, 0x14
jmp 0x433d2e
jmp 0x433d72
push 0
push 0x2057
push 0x2243
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x433d94
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x60], eax
push dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
push eax
push 0
call fcn.00431caf
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43558c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x435648
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x435627
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x435607
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 0x1bc4
push 0x1a25
push 0x52b
push 1
push 0x5eea
push 1
push 0x51b3
call fcn.0043739f
add esp, 0x24
jmp 0x435625
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x435625
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x435646
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x81d
push dword [ebp - 0x28]
push 0
push 0x224b
push 1
call fcn.0043b204
add esp, 0x14
jmp 0x43566b
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push 0x5718
push 1
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
push eax
push 0
push 0x5a48
call fcn.004300ad
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x435b46
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x435b67
push 0xd85
push 1
call fcn.00435cc0
pop ecx
pop ecx
jmp 0x435cbc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x435c72
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x435c54
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x435c0b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xd
jle 0x435c52
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x48], 0xdac0faab
push 0x50e2
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push dword [ebp - 0x4c]
push 1
push 0
push dword [ebp - 0x50]
call fcn.00439bc8
add esp, 0x28
jmp 0x435c00
jmp 0x435c70
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x435c70
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x435cbc
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x435c97
push 0x601
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x435cbc
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jge 0x435cbc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0x100
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x435ca3
mov esp, ebp
pop ebp
ret
Function at 0x436059
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x436132
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x436105
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4360ee
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x436103
push 0
push 0x20e7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x436130
push 1
push 0xb7a
push 0x5efa
push 1
push 1
push 0
push 0x7e98
push 1
push 0x6b22
push 0x2bee
call fcn.00433c1f
add esp, 0x28
jmp 0x436187
lea eax, [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x436176
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0x128
push 0x598c
push 0x20ca
push dword [ebp - 0x48]
push 0x291e
push 0x3bbe
push 1
call fcn.004334a8
add esp, 0x1c
jmp 0x436187
push 1
push 1
push 0x1d1a
call fcn.0042ec3f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x437511
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43753a
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
push 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
call fcn.004375d2
pop ecx
pop ecx
jmp 0x4375ce
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43758a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x7487
push 0x1d4d
push 0
call fcn.0043731e
add esp, 0x14
jmp 0x4375ce
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4375ad
push 0x2504
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4375ce
push 0x1f13
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov esp, ebp
pop ebp
ret

Function at 0x4375f8
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4376d4
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4376ca
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4376be
mov dword [ebp - 0xc], 0xc64a6847
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xdfe924f6
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 0x8ef34ea8
mov dword [ebp - 0x1c], 0
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x3622
push 0x694
push 0x7d13
push 0x4c11
push 1
push 0x3272
push 0
call fcn.00439236
add esp, 0x2c
lea eax, [ebp - 4]
push eax
push 0x56ea
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004384a0
add esp, 0x20
jmp 0x4376c8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x4376d2
push 0
call fcn.0043a3ea
pop ecx
jmp 0x437706
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x34]
push 1
call fcn.00436034
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4390ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43915b
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x439133
push 0x51dd
push 0x31c1
push 0xb16
push 0x1ae0
push 1
call fcn.0043920c
add esp, 0x14
jmp 0x439156
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 0xc]
push 0x331e
push 0
push 0xde1
push 1
push 1
call fcn.00439a1e
add esp, 0x1c
jmp 0x439208
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43918d
push 1
push 0x5f45
call fcn.00434d4a
pop ecx
pop ecx
jmp 0x439208
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4391ce
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4391cc
push 0
push 0x151e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x439208
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x439208
push 0
push 0x114
push 0
push 0x13ae
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
mov esp, ebp
pop ebp
ret
Function at 0x43cb48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43cc9f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43cc85
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43cbbc
mov byte [ebp - 1], 0
push 1
push 1
push 1
push 0x62f3
lea eax, [ebp - 1]
push eax
call fcn.0042f314
add esp, 0x14
jmp 0x43cc83
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x43cbe5
mov dword [ebp - 0x14], 1
jmp 0x43cbe9
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
jge 0x43cbfa
mov dword [ebp - 0xc], 1
jmp 0x43cbfe
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
je 0x43cc11
mov dword [ebp - 0x10], 1
jmp 0x43cc15
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
imul eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
add eax, dword [ecx]
mov ecx, dword [ebp - 8]
add eax, dword [ecx]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx]
imul eax, eax, 0
test eax, eax
jl 0x43cc3d
mov dword [ebp - 0x18], 1
jmp 0x43cc41
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfc39
imul eax, ecx
cmp eax, dword [ebp - 0x18]
jge 0x43cc60
mov dword [ebp - 0x1c], 1
jmp 0x43cc64
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
je 0x43cc77
mov dword [ebp - 0x20], 1
jmp 0x43cc7b
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
jmp 0x43cc9d
push 1
push 0x6759
push 0x3c9a
push 1
push 0
call fcn.00433a5c
add esp, 0x14
jmp 0x43cd1e
lea eax, [ebp + 0x18]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x43cd04
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x43cce5
mov byte [ebp - 2], 0
push 1
push 1
push 0
push 0
lea eax, [ebp - 2]
push eax
call fcn.00433e99
add esp, 0x14
jmp 0x43cd02
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x43cd02
push 0x2108
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x43cd1e
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
push 1
push dword [ebp - 0x5c]
push 0
push 0x7c11
call fcn.00438b45
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43cd22
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43cd4f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push 0x453b
push 1
call fcn.0043cde2
add esp, 0x10
jmp 0x43cdde
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43cdc4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43cdab
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43cda9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x43cdc2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43cdde
push 1
push 0x6deb
push 0x717c
push 1
push 1
push 1
call fcn.0042e7c4
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x43d713
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43d79d
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43d75d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
push dword [ebp - 0x10]
push 0x61a3
call fcn.0043e12b
add esp, 0xc
jmp 0x43d79b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43d784
push 0x111e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x43d79b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43d80c
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43d7d2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0xa0f
push 1
push dword [ebp - 0x30]
push 0x6b57
call fcn.004329c9
add esp, 0x10
jmp 0x43d80c
push 0x4707
push 1
push 0x4d1e
push 0x626
push 0
push 0x6ebd
push 1
push 1
push 0
push 0x5c8
push 0x5fd9
push 0x19da
push 0x197e
call fcn.004332bf
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x4739e2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret