joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x46a264]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 8]
push edi
call fcn.00407750
add esp, 4
lea eax, [esp + 0x10]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.00406180
mov eax, dword [0x46c240]
test eax, eax
je 0x404189
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x404288
cmp dword [ebx], 2
jl 0x4041cd
cmp dword [esp + 0x24], 0x10
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x20]
cmovae edi, dword [esp + 0x10]
push 2
call fcn.00438b2e
add esp, 4
push eax
push 1
push esi
push edi
call fcn.00439b33
push 2
call fcn.00438b2e
add esp, 0x14
push eax
call fcn.0043901b
add esp, 4
lea esi, [ebx + 0xc]
lea edi, [ebx + 8]
call fcn.00403ee0
test al, al
je 0x4041fc
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
push dword [0x46c244]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], 3
jne 0x404288
mov ecx, 0x400
lea eax, [esp + 0x10]
cmp dword [esp + 0x20], ecx
cmovb ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 0x10
cmovae eax, dword [esp + 0x10]
test ecx, ecx
je 0x404234
push ecx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00430020
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.0040e4e0
add esp, 4
cmp dword [0x46c250], 0
je 0x40427e
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00406180
lea eax, [esp + 0x28]
push eax
call dword [0x46c250]
mov eax, dword [esp + 0x40]
add esp, 4
cmp eax, 0x10
jb 0x404288
inc eax
lea ecx, [esp + 0x28]
push eax
push dword [esp + 0x2c]
call fcn.004023f0
jmp 0x404288
cmp byte [0x46d188], 0
jne 0x4042da
int3
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x4042a0
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.004023f0
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.004047e0
push esi
mov dword [esi], vtable.std::ios_base.0
call fcn.0042c2ec
mov ecx, dword [esp + 0x448]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
push 1
call fcn.0043be47
int3

Function at 0x409d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x409d5e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x409d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x248
mov eax, dword [0x46a264]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x34]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x409e87
sub esp, 8
lea eax, [esp + 0x40]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x40], 0
jne 0x409dc2
xor ecx, ecx
jmp 0x409ddf
lea ecx, [esp + 0x40]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409dd0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [esp + 0x28]
call fcn.00408120
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x409dfa
mov ecx, dword [eax]
jmp 0x409dfc
mov ecx, eax
mov dword [edx], ecx
lea ecx, [esp + 0x10]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00408120
lea ecx, [esp + 8]
call fcn.00408a90
lea eax, [esp + 8]
cmp esi, eax
je 0x409e2a
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00405f10
mov eax, dword [esp + 0x1c]
cmp eax, 8
jb 0x409e42
inc eax
lea ecx, [esp + 8]
push eax
push dword [esp + 0xc]
call fcn.00402680
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 0
cmp eax, 8
jb 0x409e71
inc eax
lea ecx, [esp + 0x20]
push eax
push dword [esp + 0x24]
call fcn.00402680
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
Function at 0x409ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x46a264]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x1c]
push edi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x409f4f
cmp word [esp + 0x20], 0
je 0x409f4f
sub esp, 8
lea eax, [esp + 0x28]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x28], 0
jne 0x409f13
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00408120
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x28]
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409f20
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00408120
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x1c], 0
call fcn.00409d70
add esp, 4
mov ecx, esi
test al, al
je 0x409f9b
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
push eax
mov word [esi], ax
lea eax, [esp + 0x10]
push eax
call fcn.00405f10
jmp 0x409fb2
sub esp, 8
mov eax, esp
mov dword [eax], 0x464c24
mov dword [eax + 4], 3
call fcn.00408120
mov eax, dword [esp + 0x1c]
cmp eax, 8
jb 0x409fca
inc eax
lea ecx, [esp + 8]
push eax
push dword [esp + 0xc]
call fcn.00402680
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
Function at 0x40a080
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40a1d2
cmp eax, 0x104
ja 0x40a1d2
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x240]
call fcn.00404750
sub esp, 8
lea eax, [ebp - 0x240]
cmp dword [ebp - 0x22c], 8
mov ecx, esp
cmovae eax, dword [ebp - 0x240]
mov dword [ecx], eax
mov eax, dword [ebp - 0x230]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x258]
call fcn.00408120
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x40a114
mov ecx, dword [eax]
jmp 0x40a116
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x228]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00408120
lea ecx, [ebp - 0x228]
call fcn.00408a90
lea eax, [ebp - 0x228]
cmp esi, eax
je 0x40a14a
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00405f10
mov eax, dword [ebp - 0x214]
cmp eax, 8
jb 0x40a168
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.00402680
xor eax, eax
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x218], 0
cmp eax, 8
jb 0x40a1a3
inc eax
lea ecx, [ebp - 0x258]
push eax
push dword [ebp - 0x258]
call fcn.00402680
mov eax, dword [ebp - 0x22c]
cmp eax, 8
jb 0x40a1c1
inc eax
lea ecx, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
call fcn.00402680
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
Function at 0x40b510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x40b536
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 0x10
jb 0x40b531
mov eax, dword [ebx]
jmp 0x40b533
mov eax, ebx
mov byte [eax], 0
call fcn.00408990
test al, al
je 0x40b547
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.00409fe0
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40b561
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.0042d35b
push edi
push 0x10000
mov esi, eax
mov dword [ebp - 8], 0
push 1
push esi
call fcn.0043b89f
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40b5d6
mov eax, dword [ebp + 8]
nop
test ebx, ebx
je 0x40b5ac
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00402130
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x40b5ec
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.0043b89f
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x40b590
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0043aefe
add esp, 4
test eax, eax
jne 0x40b5ef
mov byte [ebp - 1], 1
jmp 0x40b5f3
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.0043af9f
add esp, 4
test esi, esi
je 0x40b609
push esi
call fcn.0042d2ae
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x46a264]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40c19b
cmp byte [edi + 0x3d], 0
je 0x40c19b
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40c0ad
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edi + 0x38]
lea ebx, [esp + 0x14]
cmp ecx, 0x10
lea esi, [esp + 0x14]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x40c1af
mov dword [esp + 0xc], esi
xor eax, eax
sub eax, 0
je 0x40c122
sub eax, 1
je 0x40c126
sub eax, 2
je 0x40c174
xor bl, bl
jmp 0x40c176
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x40c159
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00439b33
mov ecx, dword [esp + 0x38]
add esp, 0x10
mov edx, dword [esp + 0x14]
cmp esi, eax
jne 0x40c11e
cmp byte [edi + 0x3d], 0
je 0x40c174
test esi, esi
jne 0x40c0e4
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00407000
jmp 0x40c0dc
mov bl, 1
cmp ecx, 0x10
jb 0x40c187
inc ecx
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.004023f0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x28]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [esp + 0x20]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
jmp 0x40c10f
Function at 0x40ca50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x40caab
mov ecx, esi
jmp 0x40cab0
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x40cad5
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x40cabf
mov eax, dword [eax]
jmp 0x40caa3
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40cf30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x40cfac
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x40cfac
mov ecx, dword [edi]
nop word [eax + eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x40cff4
cmp esi, eax
jne 0x40cfa0
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x40cfda
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x40d055
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x40d077
mov edx, dword [ebp + 0x10]
lea edi, [edx + 0xc]
mov dword [esp + 0xc], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x40d027
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00402680
mov edx, dword [esp + 0xc]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push edx
mov word [edi], ax
call fcn.00429c11
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x40d05d
mov dword [ecx], edi
jmp 0x40d077
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x40d077
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.0040d090
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40dc50
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0042d2d0
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x100c], 0
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1010], 1
push eax
push 0
push str.CurrentBuildNumber
push dword [ecx]
mov dword [ebp - 0x100c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40dd9f
mov ecx, dword [ebp - 0x1010]
cmp ecx, 1
jne 0x40dd32
cmp word [ebp - 0x808], ax
jne 0x40dcf1
xor ecx, ecx
lea eax, [ebp - 0x808]
push ecx
push eax
mov ecx, edi
call fcn.00405e00
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x808]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dd00
sub ecx, edx
lea eax, [ebp - 0x808]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00405e00
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x40dd9a
push 0x400
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x40dd83
cmp eax, 0x400
ja 0x40dd83
lea eax, [ebp - 0x1008]
mov ecx, edi
push eax
call fcn.00404700
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 8

Function at 0x40f760
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ecx
push edi
mov dword [ebp - 4], ebx
mov edi, 8
mov eax, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 0xffffffff
or ecx, 0xffffffff
cmp edi, 0xffffffff
mov esi, edi
cmova esi, ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x40f7a1
mov byte [0], al
test bl, 1
je 0x40f7b4
lea ecx, [ebp - 0xc0]
and ebx, 0xfffffffe
call fcn.00404120
mov eax, dword [ebp - 8]
sub edi, esi
add eax, esi
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov ecx, 0xffffffff
test edi, edi
jne 0x40f788
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fb40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
lea ecx, [esi + 4]
mov dword [esi], 0x464ccc
call fcn.00410ff0
mov al, byte [ebp + 8]
mov byte [esi + 0x100], al
mov dword [esi + 0x104], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 0x104], eax
cmp eax, 0xffffffff
jne 0x40fb8b
mov byte [0], 0
call fcn.004100b0
mov dword [esi + 0x108], eax
lea eax, [esp + 4]
push ecx
push eax
lea ecx, [esi + 0x10c]
mov dword [esp + 0xc], 0
call fcn.00410220
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x410130
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push dword [ebp + 8]
xor ebx, ebx
push dword [ecx]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x41018f
cmp dword [0x46c238], 3
jg 0x41017f
push 3
push 0x23
push str.d:_buildagentwork_fe2b0740eca6e700_src_base_threading_thread_local_win.cc
lea ecx, [ebp - 0xbc]
lea ebx, [eax + 1]
call fcn.00404060
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.004026e0
add esp, 8
test bl, 1
je 0x41018f
lea ecx, [ebp - 0xbc]
call fcn.00404120
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411130
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x46a264]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x46abdc]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.0042d2ae
add esp, 4
mov edi, 0x100
nop word [eax + eax]
mov esi, dword [0x46d18c]
xor dl, dl
test esi, esi
jle 0x4111c8
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x4111c3
mov eax, dword [esi*4 + 0x46cc30]
test eax, eax
je 0x4111c3
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x4111a0
dec edi
test edi, edi
jle 0x4111d1
test dl, dl
jne 0x411190
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
Function at 0x411bb0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
mov eax, edi
test edi, edi
jle 0x411c77
test esi, esi
je 0x411c77
push ebx
mov ebx, edi
sar edi, 2
and ebx, 3
test edi, edi
jle 0x411bf9
movzx ecx, word [esi]
dec edi
movzx edx, word [esi + 2]
add eax, ecx
mov ecx, eax
add esi, 4
shl ecx, 5
xor edx, ecx
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test edi, edi
jg 0x411bd5
sub ebx, 1
je 0x411c35
sub ebx, 1
je 0x411c22
sub ebx, 1
jne 0x411c47
movzx ecx, word [esi]
add eax, ecx
movsx ecx, byte [esi + 2]
shl ecx, 2
xor ecx, eax
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 0xb
jmp 0x411c45
movzx ecx, word [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x411c45
movsx ecx, byte [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [eax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
pop ebx
shr ecx, 6
pop edi
add eax, ecx
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x412270
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push dword [ebp + 0xc]
push eax
call fcn.0040a720
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4122a0
mov eax, dword [eax]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
mov ebx, eax
cmp ecx, 8
jb 0x4122c2
inc ecx
push ecx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call fcn.00402680
test ebx, ebx
jne 0x4122db
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 0xc
test edi, edi
je 0x4123c7
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042d35b
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0040a720
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41231a
mov eax, dword [eax]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x412338
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.00402680
push esi
lea ecx, [ebp - 0x20]
call fcn.00404750
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0040a620
mov ebx, eax
cmp edi, ebx
je 0x41237e
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x412365
inc ecx
push ecx
push dword [edi]
mov ecx, edi
call fcn.004023f0
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], 0
push ebx
mov byte [edi], 0
call fcn.00402320
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x412393
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.004023f0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
cmp eax, 8
jb 0x4123ba
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.00402680
test esi, esi
je 0x4123c7
push esi
call fcn.0042d2ae
add esp, 4
mov ecx, dword [ebp - 8]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 0xc