joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eb4b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42ebe8
push ebx
push esi
call fcn.0042eb14
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042eaa8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42eb95
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42ebe7
push edi
push eax
call fcn.0042d5e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42ebb5
call fcn.0042d62e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42ebe6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042eaa8
add esp, 0x20
test eax, eax
jne 0x42ebd4
push edi
call fcn.0042d62e
jmp 0x42ebdc
push ebx
call fcn.0042d62e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42fdf7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4389a0
push 0x438998
push str.FlsAlloc
push 0x1f
call fcn.0042fcb6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42fe2b
push dword [ebp + 8]
mov ecx, esi
call dword [0x43614c]
call esi
jmp 0x42fe31
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42fe75
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4389b0
push 0x4389a8
push str.FlsGetValue
push 0x21
call fcn.0042fcb6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42feac
push dword [ebp + 8]
mov ecx, esi
call dword [0x43614c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42feb4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4389b8
push 0x4389b0
push str.FlsSetValue
push 0x22
call fcn.0042fcb6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42feee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43614c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4351c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4351ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4351ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret