joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x5120c8
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x45118d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x45118d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x53fb3c
mov dword [esp + 4], 0x53f798
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x45118d
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.00452ad0
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x451160
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x451116
test al, al
jne 0x451138
cmp dl, al
jne 0x451124
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x451116
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x451116
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x451106
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x451106
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x476290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov edi, dword [esi + 0xc]
mov eax, edi
and eax, 0xffffffb5
or eax, 8
mov dword [esi + 0xc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____std::num_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_int_unsigned_long__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::is
sub esp, 0x1c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
movzx eax, word [esp + 0x2c]
mov dword [esp + 0x28], edx
mov ecx, edx
mov edx, ebx
mov ebx, dword [esp + 0x3c]
or edx, eax
mov eax, dword [esp + 0x78]
mov dword [esi + 0xc], edi
mov dword [eax], ebx
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
Function at 0x481ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x5120c8
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x48202d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x48202d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x53fb3c
mov dword [esp + 4], 0x53f798
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x48202d
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.00483660
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x482000
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x481fb6
test al, al
jne 0x481fd8
cmp dl, al
jne 0x481fc4
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x481fb6
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x481fb6
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x481fa6
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x481fa6
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x482040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x5120c8
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call method.std::locale::id._M_id___const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x4821cd
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x4821cd
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x53fb3c
mov dword [esp + 4], 0x53f798
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x4821cd
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call fcn.00483660
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x4821a0
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x482156
test al, al
jne 0x482178
cmp dl, al
jne 0x482164
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x482156
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x482156
mov eax, dword [esi + 0xc]
xor edx, edx
cmp dword [esi + 8], eax
jb 0x482146
mov eax, dword [esi]
mov byte [esp + 0x38], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ebp
cmove esi, eax
jmp 0x482146
call method.std.__throw_bad_cast__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4a1220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x28]
push ebx
sub esp, 0x4c
mov dword [ebp - 0x38], 0
mov esi, dword [ebp + 8]
call method.std::_V2.system_category__
mov dword [ebp - 0x30], edi
mov edx, 0x400
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x28], ax
lea esi, [esi]
mov dword [esp + 4], 0
lea ecx, [ebp - 0x30]
mov dword [esp], edx
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.resize_unsigned_int__wchar_t_
mov eax, dword [ebp - 0x30]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call ebx
sub esp, 8
mov edx, eax
cmp dword [ebp - 0x2c], eax
jb 0x4a1260
test eax, eax
je 0x4a1320
mov dword [esp + 4], 0
lea ecx, [ebp - 0x30]
mov dword [esp], edx
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.resize_unsigned_int__wchar_t_
mov eax, dword [ebp - 0x30]
lea edx, [esi + 8]
mov ebx, dword [ebp - 0x2c]
sub esp, 8
mov dword [esi], edx
cmp eax, edi
je 0x4a1378
mov dword [esi], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
mov dword [esi + 4], ebx
lea ebx, [esi + 0x18]
xor eax, eax
mov ecx, ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x28], ax
call method.std::filesystem::__cxx11::path::_List._List__
mov ecx, esi
call method.std::filesystem::__cxx11::path._M_split_cmpts__
mov eax, dword [ebp - 0x30]
cmp eax, edi
je 0x4a1306
mov edx, dword [ebp - 0x28]
mov dword [esp], eax
lea edx, [edx + edx + 2]
mov dword [esp + 4], edx
call sym.operator_delete_void__unsigned_int_
mov edi, dword [ebp - 0x38]
test edi, edi
je 0x4a1340
cmp dword [esi + 4], 0
je method.std::filesystem.temp_directory_path_abi:cxx11_____clone_.cold_
jmp 0x5077c3
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
jmp 0x4a1297
lea eax, [ebp - 0x38]
mov dword [esp], esi
mov dword [esp + 4], eax
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x4a130d
cmp al, 2
je 0x4a136b
call method.std::_V2.generic_category__
mov dword [ebp - 0x38], 0x14
mov dword [ebp - 0x34], eax
jmp 0x4a130d
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + ebx + 2]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], edx
call sym._memcpy
jmp 0x4a12c8
Function at 0x4a1fd0
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 4], ebx
call method.std::filesystem.symlink_status_std::filesystem::__cxx11::path_const__std::error_code_
test al, al
je 0x4a202b
cmp al, 0xff
je 0x4a2038
mov dword [esp + 4], ebx
mov dword [esp], esi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
je 0x4a2050
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
jne 0x4a2062
mov eax, dword [ebx]
test eax, eax
jne 0x4a202b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call method.std::_V2.system_category__
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call method.std::_V2.system_category__
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x4a202b
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
sub esp, 4
test eax, eax
je 0x4a2001
call method.std::_V2.system_category__
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret

Function at 0x4a20d0
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], esi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 0xff
je 0x4a2138
mov ecx, dword [ebx]
test ecx, ecx
jne 0x4a212e
test al, al
jne 0x4a2150
mov dword [esp + 8], 3
mov eax, dword [esi]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x4a21a0
call method.std::_V2.system_category__
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call method.std::_V2.system_category__
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x4a20fc
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov edx, dword [ebx]
test edx, edx
jne 0x4a212e
mov ecx, dword [esp + 0x1c]
cmp cl, 2
je 0x4a2188
cmp al, 2
jne 0x4a20fc
call method.std::_V2.generic_category__
mov dword [ebx], 0x14
mov dword [ebx + 4], eax
jmp 0x4a212e
cmp al, 2
je 0x4a20fc
call method.std::_V2.generic_category__
mov dword [ebx], 0x15
mov dword [ebx + 4], eax
jmp 0x4a212e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp eax, 5
je 0x4a21d0
call edi
mov dword [eax], 5
call method.std::_V2.generic_category__
mov esi, eax
call edi
mov eax, dword [eax]
mov dword [ebx + 4], esi
mov dword [ebx], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call edi
mov dword [eax], 0xd
jmp 0x4a21b9
Function at 0x4a9d20
Capabilities:
Get disk size

Disassembly:
push esi
push ebx
sub esp, 0x34
lea eax, [esp + 0x28]
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x50]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x4a9de8
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, esi
or eax, ecx
je 0x4a9d9c
mov eax, dword [esp + 0x44]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, esi
or eax, ecx
je 0x4a9db3
mov eax, dword [esp + 0x48]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, esi
or eax, ecx
jne 0x4a9dd8
call method.std::_V2.system_category__
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret
mov eax, dword [esp + 0x4c]
mov dword [eax], esi
mov dword [eax + 4], ecx
jmp 0x4a9dc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call method.std::_V2.system_category__
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x4ae8f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sym._fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x4ae930
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x4ae901
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4ca1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x18c
movzx eax, byte [esp + 0x1a4]
mov ebx, dword [esp + 0x1a0]
jmp dword [eax*4 + 0x513c50]
Function at 0x4ec950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
test eax, eax
je 0x4eca20
bsr ecx, eax
lea esi, [ecx + 4]
mov ecx, edx
shr esi, 2
sub ecx, ebp
cmp ecx, esi
jb 0x4eca30
mov dword [esp + 4], 0x33323130
mov dword [esp + 8], 0x37363534
mov dword [esp + 0xc], 0x62613938
mov dword [esp + 0x10], 0x66656463
cmp eax, 0xff
jbe 0x4ec9e3
mov dword [esp], esi
movzx edi, word [0x51415a]
lea ebx, [ebp + esi - 2]
lea esi, [esi]
mov ecx, eax
mov esi, eax
mov edx, edi
shr eax, 8
shr ecx, 4
and esi, 0xf
sub ebx, 2
and ecx, 0xf
mov dl, byte [esp + ecx + 4]
mov dh, byte [esp + esi + 4]
mov word [ebx + 2], dx
cmp eax, 0xff
ja 0x4ec9b8
mov esi, dword [esp]
lea edx, [ebp + esi]
cmp eax, 0xf
jbe 0x4eca18
mov ecx, eax
shr eax, 4
and ecx, 0xf
movzx ecx, byte [esp + ecx + 4]
mov byte [ebp + 1], cl
movzx eax, byte [esp + eax + 4]
mov byte [ebp], al
xor ecx, ecx
add esp, 0x14
mov eax, edx
pop ebx
mov edx, ecx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esp + eax + 4]
jmp 0x4eca01
mov edx, ebp
mov eax, 0x30
jmp 0x4eca01
add esp, 0x14
mov ecx, 0x84
mov eax, edx
pop ebx
mov edx, ecx
pop esi
pop edi
pop ebp
ret
Function at 0x503c10
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x511038]
test eax, eax
jne 0x503d81
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x5114b8], 0
mov dword [0x5114bc], 0
mov dword [0x5114c0], 0
call sym._getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
je 0x503d53
lea esi, [esi]
nop
xor eax, eax
cmp byte [ebx], 0x3a
mov dword [esp + 8], 0xf
sete al
mov dword [esp], str.glibcxx.eh_pool
add ebx, eax
mov dword [esp + 4], ebx
call sym._memcmp
test eax, eax
jne 0x503cbc
cmp byte [ebx + 0xf], 0x2e
je 0x503d19
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sym._strchr
mov ebx, eax
test eax, eax
jne 0x503c90
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x5114c0], ebx
test ebx, ebx
jne 0x503d62
mov dword [esp], sym.___tcf_0_4
call sym._atexit
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
add ebx, 0x10
lea esi, [esp + 0x18]
lea ebp, [esp + 0x30]
mov edi, dword [esi]
mov eax, dword [esi + 4]
test edi, edi
je 0x503d41
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x503d47
cmp byte [ebx + edi], 0x3d
je 0x503d92
add esi, 0xc
cmp ebp, esi
jne 0x503d24
jmp 0x503cbc
mov dword [0x5114c0], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sym._malloc
mov dword [0x5114bc], eax
test eax, eax
je 0x503dd0
xor edx, edx
mov dword [0x5114b8], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x503d05
mov dword [esp], 0x5114a0
call dbg.__gthr_win32_mutex_init_function
jmp 0x503c24
lea eax, [esp + 0x14]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sym._strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x503dc0
test dl, dl
jne 0x503cbc
test eax, eax
js 0x503cbc
mov dword [esi + 8], eax
jmp 0x503cbc
xor ecx, ecx
mov dword [0x5114c0], ecx
jmp 0x503d05
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e004]
jne 0x40100a
repz ret
jmp fcn.00401a32

Function at 0x40947b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402662
and dword [ebp - 0x14], 0
cmp dword [0x420728], 0
mov dword [ebp - 0x18], eax
jne 0x40952e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4095d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4095d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x420728], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42072c], eax
call edi
push eax
call esi
push 0x41c8f8
push ebx
mov dword [0x420730], eax
call edi
push eax
call esi
mov dword [0x420738], eax
test eax, eax
je 0x40952e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420734], eax
mov eax, dword [0x420734]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409587
cmp dword [0x420738], ecx
je 0x409587
push eax
call esi
push dword [0x420738]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409587
test ebx, ebx
je 0x409587
call edi
test eax, eax
je 0x40957e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40957e
test byte [ebp - 8], 1
jne 0x409587
or dword [ebp + 0x10], 0x200000
jmp 0x4095ba
mov eax, dword [0x42072c]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4095ba
mov eax, dword [0x420730]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420728]
call esi
test eax, eax
je 0x4095d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4095d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x41a440
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x2b3bd3c]
push ebx
push esi
mov esi, dword [0x2b3ba5c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x41a462
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41f1d0]
call fcn.0041a310
cmp dword [0x2b3bd3c], 0x2f
jne 0x41a47d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.0041a350
add esp, 4
cmp dword [0x2b3bd3c], 0x568
pop esi
pop ebx
jne 0x41a4aa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret