joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d40
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x402edc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402df0
xor eax, eax
push ebp
push 0x402de9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x402dd2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x402efc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402df0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x402ed1
cmp byte [ebp - 0xd], 0
jne 0x402e32
cmp byte [ebp - 0x12], 0
je 0x402ed1
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x402e4b
dec ebx
cmp byte [ebx], 0x2e
je 0x402e5a
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x402e4a
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x402ed1
inc ebx
cmp byte [ebp - 0x12], 0
je 0x402e87
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x402ed1
cmp byte [ebp - 0xd], 0
je 0x402ed1
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x402ed1
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423aa4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419328
and dword [ebp - 4], 0
cmp dword [0x43879c], 0
mov ebx, eax
jne 0x423b55
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423c06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x423c06
push eax
call fcn.004192b6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43879c], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4387a0], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4387a4], eax
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387ac], eax
test eax, eax
je 0x423b55
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387a8], eax
mov eax, dword [0x4387a8]
cmp eax, ebx
je 0x423bad
cmp dword [0x4387ac], ebx
je 0x423bad
push eax
call fcn.00419331
push dword [0x4387ac]
mov esi, eax
call fcn.00419331
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423bad
test edi, edi
je 0x423bad
call esi
test eax, eax
je 0x423ba4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423ba4
test byte [ebp - 0xc], 1
jne 0x423bad
or dword [ebp + 0x10], 0x200000
jmp 0x423be6
mov eax, dword [0x4387a0]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423be6
mov eax, dword [0x4387a4]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43879c]
call fcn.00419331
pop ecx
test eax, eax
je 0x423c06
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423c08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401300
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x42c00c]
mov dword [eax], 0
jmp fcn.00401120
Function at 0x401510
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x3c
mov eax, dword [0x44123c]
xor ecx, ecx
mov dword [esp], 0xfde9
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [esp], eax
mov dword [esp + 4], 2
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov dword [0x441240], eax
mov edx, dword [0x44123c]
mov ecx, dword [0x441240]
mov eax, dword [ebp - 8]
xor esi, esi
mov dword [esp], 0xfde9
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
mov ecx, dword [0x441240]
lea eax, [0x441230]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
mov dword [0x441238], eax
mov eax, dword [0x441230]
shl eax, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x441230]
jge 0x40165a
mov eax, dword [0x441238]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esp], 0xfde9
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x4015e0
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
sub esp, 8
mov dword [0x441234], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x441230]
shl ecx, 2
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [0x441234]
mov ecx, dword [0x441230]
shl ecx, 2
add eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [0x441230]
jge 0x401734
mov eax, dword [0x441238]
mov ecx, dword [ebp - 0x20]
mov edx, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor esi, esi
mov dword [esp], 0xfde9
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x441234]
mov ecx, dword [ebp - 0x20]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
jmp 0x4016a3
mov dword [0x441228], 1
add esp, 0x3c
pop esi
pop ebp
ret
Function at 0x401750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp dword [ebp + 8], 0
jne 0x40176f
mov dword [ebp - 4], 0
jmp 0x4017e5
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x401792
mov dword [ebp - 4], 0
jmp 0x4017e5
mov dword [ebp - 0xc], 0x400
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x400
jle 0x4017bb
mov dword [ebp - 4], 0
jmp 0x4017e5
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x4550
je 0x4017df
mov dword [ebp - 4], 0
jmp 0x4017e5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0x14
pop ebp
ret
Function at 0x40ce30
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
call fcn.0040e6a0
test al, al
je 0x40ce77
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push ebp
push ebx
push edi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.0040e1f0
add esp, 0x14
push 2
call esi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0040e790

Function at 0x40e070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x40e081
jmp dword [eax*4 + 0x43994c]
cmp dword [0x440268], 0
je 0x40e190
push 0x44026c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x440284]
test edi, edi
je 0x40e185
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e0cb
mov edi, dword [edi + 8]
test edi, edi
je 0x40e185
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40e0c0
test esi, esi
je 0x40e0c0
mov ecx, dword [edi + 4]
call dword [0x43e440]
push esi
call ecx
add esp, 4
jmp 0x40e0c0
call fcn.0040bcd0
jmp case.default.0x40e081
cmp dword [0x440268], 0
je case.default.0x40e081
push 0x44026c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x440284]
test edi, edi
je 0x40e178
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e137
mov edi, dword [edi + 8]
test edi, edi
je 0x40e178
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40e130
test esi, esi
je 0x40e130
mov ecx, dword [edi + 4]
call dword [0x43e440]
push esi
call ecx
add esp, 4
jmp 0x40e130
cmp dword [0x440268], 0
jne 0x40e16c
push 0x44026c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x440268], 1
jmp case.default.0x40e081
push 0x44026c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x40e081
push 0x44026c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x440268]
cmp eax, 1
jne case.default.0x40e081
mov eax, dword [0x440284]
test eax, eax
je 0x40e1c2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.0042b95e
add esp, 4
mov eax, esi
test esi, esi
jne 0x40e1b0
mov dword [0x440284], 0
mov dword [0x440268], 0
push 0x44026c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e320
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x42c004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x40e386
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x40e386
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x40e386
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x40e386
mov edx, dword [esp + 0xc]
sub edx, dword [0x42c004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x40e376
add esi, 0x28
dec ecx
je 0x40e386
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x40e370
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x40e370
mov eax, esi
pop esi
pop edi
ret

Function at 0x40e5e0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x441213], 1
jne 0x40e5ff
cmp byte [0x441212], 0
jne 0x40e61e
jmp 0x40e64b
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40e64b
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call ebx
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.0040e1f0
add esp, 0x10
push 2
call ebx
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov dword [esi], 0x439b38
mov dword [esi + 4], 0x441208
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.0040f320
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x40e6a0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x441213], 1
jne 0x40e6b4
cmp byte [0x441212], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x441212]
mov byte [0x441213], 1
ret
Function at 0x40e6e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x441213], 1
jne 0x40e704
cmp byte [0x441212], 0
jne 0x40e723
jmp 0x40e751
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40e751
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.0040e1f0
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x40e784
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40e790
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x441213], 1
jne 0x40e7b7
cmp byte [0x441212], 0
jne 0x40e7d6
jmp 0x40e804
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40e804
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.0040e1f0
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push ebx
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x40e898
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push ebp
push ebx
call edi
xor eax, eax
cmp ebx, 0xffffffff
jne 0x40e898
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x43e440]
mov eax, esp
mov ecx, esi
push eax
call edi
mov eax, dword [esi]
mov edi, dword [eax + 0x34]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push 0
call edi
cmp dword [esp + 0x10], 0
je 0x40e896
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push 0xfffffffffffffffe
call edi
mov edi, eax
add edi, dword [esp + 0x10]
mov eax, dword [esi]
mov ebx, dword [eax + 0x10]
mov ecx, ebx
call dword [0x43e440]
mov ecx, esi
push edi
push 0xfffffffffffffffe
call ebx
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e8a0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x441213], 1
jne 0x40e8ba
cmp byte [0x441212], 0
jne 0x40e8d9
jmp 0x40e905
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40e905
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.0040e1f0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x40e920
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x441213], 1
jne 0x40e93a
cmp byte [0x441212], 0
jne 0x40e959
jmp 0x40e985
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40e985
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.0040e1f0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret

Function at 0x40e9a0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x441213], 1
jne 0x40e9bf
cmp byte [0x441212], 0
jne 0x40e9de
jmp 0x40ea0b
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40ea0b
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.0040e1f0
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40ea30
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x441213], 1
jne 0x40ea4a
cmp byte [0x441212], 0
jne 0x40ea69
jmp 0x40ea95
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40ea95
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.0040e1f0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x40eab0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x441213], 1
jne 0x40ead4
cmp byte [0x441212], 0
jne 0x40eaf3
jmp 0x40eb21
push str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441213], 1
test eax, eax
setne byte [0x441212]
je 0x40eb21
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.0040e1f0
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [0x43e440]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40efd0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x441211], 1
jne 0x40efe4
cmp byte [0x441210], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x441210]
mov byte [0x441211], 1
ret