joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, ebx
mov edi, dword [0x1001c0eb]
mov ecx, dword [0x1001c133]
mov edx, dword [0x1001c0d7]
mov eax, dword [eax + edi*8 + 0x78]
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], ecx
mov edx, dword [eax + ebx + 0x20]
add edx, ebx
mov dword [esp + 0x18], edx
mov ecx, dword [eax + ebx + 0x24]
mov edx, dword [eax + ebx + 0x1c]
add ecx, ebx
mov eax, dword [eax + ebx + 0x18]
add edx, ebx
test eax, eax
jbe 0x10001885
mov dword [esp + 0x1c], ebp
xor edi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
je 0x10001836
invalid
mov edx, dword [esp + 0x30]
add edx, dword [ebp + edi*4]
cmp byte [edx], 0
je 0x10001cd7
xor ebx, ebx
inc ebx
cmp byte [ebx + edx], 0
jne 0x10001826
xor ecx, ecx
test ebx, ebx
je 0x1000186a
mov dword [esp + 0x24], ebx
xor eax, eax
mov dword [esp + 0x20], edi
mov ebp, dword [esp + 0xc]
invalid
movzx esi, byte [eax + edx]
xor ebx, ebx
test ebp, ebp
jbe 0x10001854
xor edi, edi
inc edi
add ebx, ecx
cmp edi, ebp
jb 0x1000184d
inc eax
lea ecx, [ebx + esi]
cmp eax, dword [esp + 0x24]
jb 0x10001841
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, esi
je 0x10001cb6
inc edi
cmp edi, dword [esp + 8]
jb 0x10001813
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
xor eax, eax
push 0
push esi
call eax
mov ecx, eax
test ecx, ecx
jne 0x1000189c
xor eax, eax
add esp, 0x38
pop ebp
pop ebx
pop edi
pop esi
ret
mov edi, dword [ebx + 0x3c]
add edi, ebx
mov eax, dword [0x1001c0eb]
mov edx, dword [0x1001c0df]
mov dword [esp + 0x24], edx
mov edi, dword [edi + eax*8 + 0x78]
mov edx, dword [0x1001c0d7]
mov dword [esp + 0x18], edx
invalid
push esp
Function at 0x10001840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, ebx
mov edi, dword [0x1001c0eb]
mov ecx, dword [0x1001c133]
mov edx, dword [0x1001c0d7]
mov eax, dword [eax + edi*8 + 0x78]
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], ecx
mov edx, dword [eax + ebx + 0x20]
add edx, ebx
mov dword [esp + 0x18], edx
mov ecx, dword [eax + ebx + 0x24]
mov edx, dword [eax + ebx + 0x1c]
add ecx, ebx
mov eax, dword [eax + ebx + 0x18]
add edx, ebx
test eax, eax
jbe 0x10001885
mov dword [esp + 0x1c], ebp
xor edi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
je 0x10001836
invalid
mov edx, dword [esp + 0x30]
add edx, dword [ebp + edi*4]
cmp byte [edx], 0
je 0x10001cd7
xor ebx, ebx
inc ebx
cmp byte [ebx + edx], 0
jne 0x10001826
xor ecx, ecx
test ebx, ebx
je 0x1000186a
mov dword [esp + 0x24], ebx
xor eax, eax
mov dword [esp + 0x20], edi
mov ebp, dword [esp + 0xc]
invalid
movzx esi, byte [eax + edx]
xor ebx, ebx
test ebp, ebp
jbe 0x10001854
xor edi, edi
inc edi
add ebx, ecx
cmp edi, ebp
jb 0x1000184d
inc eax
lea ecx, [ebx + esi]
cmp eax, dword [esp + 0x24]
jb 0x10001841
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, esi
je 0x10001cb6
inc edi
cmp edi, dword [esp + 8]
jb 0x10001813
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
xor eax, eax
push 0
push esi
call eax
mov ecx, eax
test ecx, ecx
jne 0x1000189c
xor eax, eax
add esp, 0x38
pop ebp
pop ebx
pop edi
pop esi
ret
mov edi, dword [ebx + 0x3c]
add edi, ebx
mov eax, dword [0x1001c0eb]
mov edx, dword [0x1001c0df]
mov dword [esp + 0x24], edx
mov edi, dword [edi + eax*8 + 0x78]
mov edx, dword [0x1001c0d7]
mov dword [esp + 0x18], edx
invalid
push esp

Function at 0x100018c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ds
and byte [ebx], al
ror dword [ecx - 0x74ebdbac], cl
inc esp
pop ds
and al, 0x8b
push esp
pop ds
sbb al, 3
ret
Function at 0x10001940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, dword [esp + 0x30]
add ebp, dword [edx + edi*4]
cmp byte [ebp], 0
je 0x10001caf
mov eax, ecx
inc eax
cmp byte [eax + ebp], 0
jne 0x10001916
mov esi, ecx
test eax, eax
je 0x10001958
mov dword [esp + 0x28], eax
mov ebx, ecx
mov dword [esp + 0x20], edi
mov edx, dword [esp + 0x18]
movzx ecx, byte [ebx + ebp]
xor eax, eax
test edx, edx
jbe 0x10001944
xor edi, edi
inc edi
add eax, esi
cmp edi, edx
jb 0x1000193d
inc ebx
lea esi, [eax + ecx]
cmp ebx, dword [esp + 0x28]
jb 0x10001931
mov edi, dword [esp + 0x20]
xor ecx, ecx
mov edx, dword [esp + 0x14]
cmp esi, dword [esp + 0x24]
je 0x10001c8a
inc edi
cmp edi, dword [esp + 0xc]
jb 0x10001903
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0x10]
xor eax, eax
xor edx, edx
lea edi, [esp + 0x14]
mov dword [edi], edx
push edx
push edi
push ecx
push ebp
push esi
call eax
mov eax, dword [esp + 0x14]
mov edx, dword [0x1001c113]
add eax, ebp
add ebp, edx
mov dword [esp + 0x18], eax
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
test edx, edx
jbe 0x100019ce
mov ecx, edx
shr ecx, 1
je 0x10001c80
xor esi, esi
add dword [ebp + esi*8 + 8], eax
add dword [ebp + esi*8 + 0xc], eax
inc esi
cmp esi, ecx
jb 0x100019b2
lea esi, [esi + esi + 1]
lea ecx, [esi - 1]
cmp ecx, edx
jae 0x100019ce
add dword [ebp + esi*4 + 4], eax
invalid
inc ebx

Function at 0x100019d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 3
ret
Function at 0x10001c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x78
mov ebx, dword [esp + 0x30]
mov eax, ebx
mov edx, dword [esp]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 8]
dec esp
and al, 8
mov esi, dword [esp + 0x10]
add eax, dword [edx + edi*4]
jmp 0x1000197b

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x434754b1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x2df26906
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x46d020
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
call fcn.0046fed0
test al, al
je 0x46d067
mov esi, dword [fcn.0046fa90]
push 2
call esi
add esp, 4
push ebp
push ebx
push edi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.00474010
add esp, 0x14
push 2
call esi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0046ffc0

Function at 0x46f910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x46f921
jmp dword [eax*4 + 0x49d314]
cmp dword [0x4a378c], 0
je 0x46fa30
push 0x4a3790
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4a37a8]
test edi, edi
je 0x46fa25
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46f96b
mov edi, dword [edi + 8]
test edi, edi
je 0x46fa25
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x46f960
test esi, esi
je 0x46f960
mov ecx, dword [edi + 4]
call dword [0x4a24bc]
push esi
call ecx
add esp, 4
jmp 0x46f960
call fcn.0046bf40
jmp case.default.0x46f921
cmp dword [0x4a378c], 0
je case.default.0x46f921
push 0x4a3790
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4a37a8]
test edi, edi
je 0x46fa18
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46f9d7
mov edi, dword [edi + 8]
test edi, edi
je 0x46fa18
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x46f9d0
test esi, esi
je 0x46f9d0
mov ecx, dword [edi + 4]
call dword [0x4a24bc]
push esi
call ecx
add esp, 4
jmp 0x46f9d0
cmp dword [0x4a378c], 0
jne 0x46fa0c
push 0x4a3790
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4a378c], 1
jmp case.default.0x46f921
push 0x4a3790
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x46f921
push 0x4a3790
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4a378c]
cmp eax, 1
jne case.default.0x46f921
mov eax, dword [0x4a37a8]
test eax, eax
je 0x46fa62
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.00498f4e
add esp, 4
mov eax, esi
test esi, esi
jne 0x46fa50
mov dword [0x4a37a8], 0
mov dword [0x4a378c], 0
push 0x4a3790
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46fbb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x49a004]
xor eax, eax
cmp word [esi], 0x5a4d
jne 0x46fc16
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x46fc16
add esi, ecx
cmp word [esi + 0x18], 0x10b
jne 0x46fc16
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x46fc16
mov edx, dword [esp + 0xc]
sub edx, dword [0x49a004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x46fc06
add esi, 0x28
dec ecx
je 0x46fc16
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x46fc00
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x46fc00
mov eax, esi
pop esi
pop edi
ret

Function at 0x46fe10
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x4a49df], 1
jne 0x46fe2f
test byte [0x4a49de], 1
jne 0x46fe4e
jmp 0x46fe7b
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x46fe7b
mov ebx, dword [fcn.0046fa90]
push 2
call ebx
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.00474010
add esp, 0x10
push 2
call ebx
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov dword [esi], 0x49d500
mov dword [esi + 4], 0x4a483c
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.00470b50
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x46fed0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x4a49df], 1
jne 0x46fee3
movzx eax, byte [0x4a49de]
and al, 1
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x4a49de]
mov byte [0x4a49df], 1
and al, 1
ret

Function at 0x46ff10
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x4a49df], 1
jne 0x46ff34
test byte [0x4a49de], 1
jne 0x46ff53
jmp 0x46ff81
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x46ff81
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.00474010
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x46ffb4
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46ffc0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x4a49df], 1
jne 0x46ffe7
test byte [0x4a49de], 1
jne 0x470006
jmp 0x470034
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x470034
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.00474010
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push ebx
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x4700c8
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push ebp
push ebx
call edi
xor eax, eax
cmp ebx, 0xffffffff
jne 0x4700c8
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x4a24bc]
mov eax, esp
mov ecx, esi
push eax
call edi
mov eax, dword [esi]
mov edi, dword [eax + 0x34]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push 0
call edi
cmp dword [esp + 0x10], 0
je 0x4700c6
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push 0xfffffffffffffffe
call edi
mov edi, eax
add edi, dword [esp + 0x10]
mov eax, dword [esi]
mov ebx, dword [eax + 0x10]
mov ecx, ebx
call dword [0x4a24bc]
mov ecx, esi
push edi
push 0xfffffffffffffffe
call ebx
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4700d0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x4a49df], 1
jne 0x4700ea
test byte [0x4a49de], 1
jne 0x470109
jmp 0x470135
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x470135
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.00474010
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x470150
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x4a49df], 1
jne 0x47016a
test byte [0x4a49de], 1
jne 0x470189
jmp 0x4701b5
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x4701b5
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.00474010
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x4701d0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x4a49df], 1
jne 0x4701ef
test byte [0x4a49de], 1
jne 0x47020e
jmp 0x47023b
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x47023b
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.00474010
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x470260
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x4a49df], 1
jne 0x47027a
test byte [0x4a49de], 1
jne 0x470299
jmp 0x4702c5
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x4702c5
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.00474010
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x4702e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x4a49df], 1
jne 0x470304
test byte [0x4a49de], 1
jne 0x470323
jmp 0x470351
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49df], 1
test eax, eax
setne byte [0x4a49de]
je 0x470351
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.00474010
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [0x4a24bc]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x470800
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x4a49dd], 1
jne 0x470813
movzx eax, byte [0x4a49dc]
and al, 1
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x4a49dc]
mov byte [0x4a49dd], 1
and al, 1
ret
Function at 0x4739f0
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1014
call fcn.0046c3b4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x473b1a
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x473b83
shr ecx, 2
mov dword [esp + 8], ecx
jmp 0x473a53
mov edx, dword [esp + 0xc]
inc edx
xor eax, eax
mov ecx, dword [esp + 8]
cmp edx, ecx
je 0x473b83
mov dword [esp + 0xc], edx
mov esi, dword [esp + edx*4 + 0x14]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x102c]
mov dword [edx], esi
mov dword [esp], esi
movzx ebx, word [esi + eax + 6]
test ebx, ebx
je 0x473a40
add eax, dword [esp]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp + 4], 0
xor ecx, ecx
jmp 0x473aa2
mov ecx, esi
mov eax, ecx
and al, byte [esp + 4]
test al, 1
jne 0x473b16
add ebp, 0x28
dec ebx
je 0x473a40
mov esi, ecx
mov edi, dword [ebp + 0xc]
add edi, dword [esp]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x473af0
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x473a90
mov ecx, dword [esp + 0x102c]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp + 4], eax
jmp 0x473a90
mov eax, dword [ebp + 8]
add eax, edi
mov edx, dword [esp + 0x1028]
cmp edi, edx
setbe cl
cmp eax, edx
seta al
and al, cl
mov ecx, esi
or cl, al
mov eax, ecx
and al, byte [esp + 4]
test al, 1
je 0x473a9c
mov al, 1
jmp 0x473b83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x4a49dd], 1
jne 0x473b36
test byte [0x4a49dc], 1
jne 0x473b55
jmp 0x473b81
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x4a49dd], 1
test eax, eax
setne byte [0x4a49dc]
je 0x473b81
mov edi, dword [fcn.0046fa90]
push 2
call edi
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.00474010
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
xor eax, eax
add esp, 0x1014
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4017c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404004]
jne 0x4017ce
repz ret
jmp fcn.00401b99

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4792b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.fxp_
lea edi, [esi - 0x4e000]
mov dword [edi + 0x5e89c], 0xb02eb037
push edi
or ebp, 0xffffffff
jmp 0x4792da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4792e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4792d0
mov eax, 1
add ebx, ebx
jne 0x4792f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x479304
jne 0x479314
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479314
dec eax
add ebx, ebx
jne 0x479310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4792e8
xor ecx, ecx
sub eax, 3
jb 0x47932c
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47939e
sar eax, 1
mov ebp, eax
jmp 0x479337
add ebx, ebx
jne 0x479337
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x479344
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x479368
inc ecx
add ebx, ebx
jne 0x479354
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x479349
jne 0x479365
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x479349
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x479388
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x479379
jmp 0x4792d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x479388
add edi, ecx
jmp 0x4792d6
pop esi
mov edi, esi
mov ecx, 0x2a60
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4793a6
cmp byte [edi], 0xd
jne 0x4793a6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4793ab
lea edi, [esi + 0x76000]
mov eax, dword [edi]
or eax, eax
je 0x47941a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x79d34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x79dd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4793d8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x79dd8]
or eax, eax
je 0x479414
mov dword [ebx], eax
add ebx, 4
jmp 0x4793f5
call dword [esi + 0x79ddc]
popal
jmp section.Fpt_