joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d4c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push ebx
push edi
push esi
nop
test eax, eax
nop
xor edi, edi
xor ebx, ebx
dec ebx
mov ebp, 0xfde9
push edi
push edi
push ebx
push dword [0x441f44]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
nop
test eax, eax
nop
inc eax
push 2
push eax
call sub.msvcrt.dll_calloc
add esp, 8
mov dword [0x441f48], eax
nop
test eax, eax
nop
push esi
push dword [0x441f48]
push ebx
push dword [0x441f44]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
test eax, eax
nop
push 0x441f20
push dword [0x441f48]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [0x441f40], eax
nop
test eax, eax
nop
mov esi, dword [0x441f20]
shl esi, 2
nop
test eax, eax
nop
cmp dword [0x441f20], edi
jle 0x403e22
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ebp, ebp
mov eax, dword [0x441f40]
mov eax, dword [eax + ebp*4]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x438bb0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0xfde9
call ebx
nop
test eax, eax
nop
add esi, eax
nop
test eax, eax
nop
inc ebp
cmp ebp, dword [0x441f20]
jl 0x403de1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x441f3c], eax
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp dword [0x441f20], 0
jle 0x403ea9
mov eax, dword [0x441f20]
mov ecx, dword [0x441f3c]
mov edx, dword [0x441f20]
lea edi, [ecx + edx*4]
shl eax, 2
sub esi, eax
xor ebx, ebx
xor ebp, ebp
mov eax, dword [0x441f40]
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [eax + ebp*4]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
test eax, eax
nop
mov ecx, dword [0x441f3c]
mov dword [ecx + ebp*4], edi
nop
test eax, eax
nop
add edi, eax
nop
test eax, eax
nop
sub esi, eax
nop
test eax, eax
nop
inc ebp
cmp ebp, dword [0x441f20]
jl 0x403e65
mov dword [0x441f1c], 1
nop
test eax, eax
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403ebd
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
je 0x403f0d
nop
test eax, eax
nop
nop
test eax, eax
nop
movzx edx, word [ecx]
nop
test eax, eax
nop
cmp edx, 0x5a4d
jne 0x403f0d
mov edx, dword [ecx + 0x3c]
nop
test eax, eax
nop
cmp edx, 0x400
jg 0x403f0d
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp dword [ecx + edx], 0x4550
jne 0x403f0d
add ecx, edx
nop
test eax, eax
nop
mov eax, ecx
ret
Function at 0x405535
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov esi, dword [0x440ee0]
imul ebp, ecx, 0x2c
mov eax, dword [esi + ebp]
movzx ecx, byte [esi + ebp + 0x14]
xor edx, edx
and ecx, 1
sete dl
lea edx, [edx + edx*4]
lea edi, [eax + edx]
add edi, 0xfffffffb
lea eax, [ecx + ecx + 5]
mov ecx, esp
push ecx
push 0x40
mov dword [esp + 0x10], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4055a8
lea ecx, [esi + ebp]
add ecx, 0x14
test ebx, ebx
mov dword [esp + 4], ecx
je 0x4055af
mov byte [edi], 0xe9
mov eax, dword [esi + ebp + 4]
sub eax, edi
add eax, 0xfffffffb
mov dword [edi + 1], eax
test byte [ecx], 1
mov edx, esp
je 0x4055d0
add esi, ebp
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x4055d0
mov eax, 0xa
jmp 0x40560a
test byte [ecx], 1
lea eax, [esi + ebp + 0xc]
mov edx, esp
jne 0x4055c6
mov cl, byte [eax + 4]
mov byte [edi + 4], cl
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x4055d0
mov ecx, dword [eax]
mov eax, dword [eax + 3]
mov dword [edi + 3], eax
mov dword [edi], ecx
push edx
push dword [esp + 4]
mov esi, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp + 4]
mov al, byte [edx]
and bl, 1
mov ecx, ebx
add cl, bl
and al, 0xf9
or al, cl
shl bl, 2
or bl, al
mov byte [edx], bl
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405612
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
test eax, eax
je 0x405662
mov esi, ecx
cmp dword [ecx + 8], 0
je 0x405653
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call ebp
test eax, eax
je 0x40564b
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x40562c
mov eax, dword [esi]
push eax
push 0
push dword [0x440edc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408b70
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
call fcn.0040a310
test al, al
je 0x408ba4
push 2
call dword [0x440cfc]
add esp, 4
push ebx
push edi
push esi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.00408430
add esp, 0x14
pop esi
pop edi
pop ebx
jmp fcn.0040a410

Function at 0x409d20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x409d31
jmp dword [eax*4 + 0x43a220]
cmp dword [0x440f34], 0
je 0x409e33
push 0x440f38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x440f50]
test edi, edi
je 0x409e28
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409d7b
mov edi, dword [edi + 8]
test edi, edi
je 0x409e28
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x409d70
test esi, esi
je 0x409d70
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x409d70
cmp dword [0x440f34], 0
jne 0x409db0
push 0x440f38
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x440f34], 1
jmp case.default.0x409d31
call fcn.00407b40
jmp case.default.0x409d31
cmp dword [0x440f34], 0
je case.default.0x409d31
push 0x440f38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x440f50]
test edi, edi
je 0x409e83
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409e07
mov edi, dword [edi + 8]
test edi, edi
je 0x409e83
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x409e00
test esi, esi
je 0x409e00
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x409e00
push 0x440f38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x440f34]
cmp eax, 1
jne case.default.0x409d31
mov eax, dword [0x440f50]
test eax, eax
je 0x409e62
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.0042c9bc
add esp, 4
mov eax, esi
test esi, esi
jne 0x409e50
mov dword [0x440f50], 0
mov dword [0x440f34], 0
push 0x440f38
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x409d31
push 0x440f38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x409fc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x42d004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x40a026
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x40a026
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x40a026
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x40a026
mov edx, dword [esp + 0xc]
sub edx, dword [0x42d004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x40a016
add esi, 0x28
dec ecx
je 0x40a026
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x40a010
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x40a010
mov eax, esi
pop esi
pop edi
ret
Function at 0x40a260
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
cmp byte [0x441f03], 1
jne 0x40a27e
cmp byte [0x441f02], 0
jne 0x40a29d
jmp 0x40a2b8
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a2b8
push 2
call dword [0x440cfc]
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.0040a350
add esp, 0x10
mov dword [esi], 0x43a410
mov dword [esi + 4], 0x441ef8
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.0040af30
xor eax, eax
pop esi
pop edi
ret

Function at 0x40a310
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x441f03], 1
jne 0x40a324
cmp byte [0x441f02], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x441f02]
mov byte [0x441f03], 1
ret

Function at 0x40a370
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x441f03], 1
jne 0x40a394
cmp byte [0x441f02], 0
jne 0x40a3b3
jmp 0x40a3cf
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a3cf
push 2
call dword [0x440cfc]
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.0040a350
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x40a402
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a410
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x441f03], 1
jne 0x40a437
cmp byte [0x441f02], 0
jne 0x40a456
jmp 0x40a472
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a472
push 2
call dword [0x440cfc]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.0040a350
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
mov edi, 0xffffe672
test al, al
je 0x40a502
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
push ebx
call edi
xor edi, edi
cmp ebx, 0xffffffff
jne 0x40a502
mov eax, dword [esi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov eax, esp
mov ecx, esi
push eax
call ebx
mov eax, dword [esi]
mov ebx, dword [eax + 0x34]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0
call ebx
cmp dword [esp + 0x10], 0
je 0x40a502
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0xfffffffffffffffe
call ebx
mov ebx, eax
add ebx, dword [esp + 0x10]
mov eax, dword [esi]
mov ebp, dword [eax + 0x10]
mov ecx, ebp
call dword [section..00cfg]
mov ecx, esi
push ebx
push 0xfffffffffffffffe
call ebp
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40a510
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x441f03], 1
jne 0x40a52a
cmp byte [0x441f02], 0
jne 0x40a549
jmp 0x40a563
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a563
push 2
call dword [0x440cfc]
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.0040a350
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x40a580
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x441f03], 1
jne 0x40a59a
cmp byte [0x441f02], 0
jne 0x40a5b9
jmp 0x40a5d3
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a5d3
push 2
call dword [0x440cfc]
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.0040a350
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x40a5f0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x441f03], 1
jne 0x40a60f
cmp byte [0x441f02], 0
jne 0x40a62e
jmp 0x40a649
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a649
push 2
call dword [0x440cfc]
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.0040a350
add esp, 0x10
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x40a670
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x441f03], 1
jne 0x40a68a
cmp byte [0x441f02], 0
jne 0x40a6a9
jmp 0x40a6c3
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a6c3
push 2
call dword [0x440cfc]
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.0040a350
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x40a6e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x441f03], 1
jne 0x40a704
cmp byte [0x441f02], 0
jne 0x40a723
jmp 0x40a73f
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f03], 1
test eax, eax
setne byte [0x441f02]
je 0x40a73f
push 2
call dword [0x440cfc]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.0040a350
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40abe0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x441f01], 1
jne 0x40abf4
cmp byte [0x441f00], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x441f00]
mov byte [0x441f01], 1
ret
Function at 0x40ddf0
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x101c
call fcn.00408144
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x40df52
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x40dfa9
shr ecx, 2
cmp ecx, 2
mov eax, 1
cmovae eax, ecx
mov dword [esp + 0xc], eax
mov bl, 1
mov dword [esp + 0x10], ecx
jmp 0x40de6a
mov edx, dword [esp + 0x14]
inc edx
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setb bl
xor eax, eax
cmp edx, dword [esp + 0xc]
je 0x40dfa9
mov byte [esp + 3], bl
mov dword [esp + 0x14], edx
mov esi, dword [esp + edx*4 + 0x1c]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x1034]
mov dword [edx], esi
mov dword [esp + 8], esi
movzx esi, word [esi + eax + 6]
test esi, esi
je 0x40de50
add eax, dword [esp + 8]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp + 4], 0
xor ebx, ebx
jmp 0x40deb6
add ebp, 0x28
dec esi
je 0x40de50
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 8]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x40def0
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x40df20
test bl, 1
jne 0x40df3f
jmp 0x40deb0
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1030]
cmp eax, ecx
movzx eax, bl
mov ebx, eax
mov edx, 1
cmova ebx, edx
cmp edi, ecx
cmova ebx, eax
test bl, 1
jne 0x40df3f
jmp 0x40deb0
mov ecx, dword [esp + 0x1034]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp + 4], eax
test bl, 1
je 0x40deb0
mov eax, dword [esp + 4]
and al, 1
je 0x40deb0
movzx eax, byte [esp + 3]
jmp 0x40dfa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x441f01], 1
jne 0x40df6e
cmp byte [0x441f00], 0
jne 0x40df8d
jmp 0x40dfa7
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x441f01], 1
test eax, eax
setne byte [0x441f00]
je 0x40dfa7
push 2
call dword [0x440cfc]
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.0040a350
add esp, 0xc
xor eax, eax
and al, 1
add esp, 0x101c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x454000
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x64757374
mov byte [ecx + 4], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 4
jne 0x454050
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x4540fe
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.SiovAqpr]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x7573684c
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xc
jne 0x45415b
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454194
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [0x42d080]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x56797361
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xc
jne 0x4541f1
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x4542a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov word [ecx], 0x7472
mov byte [ecx + 2], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor edx, edx
mov al, 1
xor ecx, ecx
inc ecx
nop
test eax, eax
nop
nop
test eax, eax
nop
xor byte [esi + edx], dl
nop
test eax, eax
nop
nop
test eax, eax
nop
mov edx, ecx
test al, 1
mov eax, 0
jne 0x4542f4
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret
Function at 0x4543a2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.10103544]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x37353035
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xc
jne 0x4543ff
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454438
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [0x42d0a0]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x64726564
mov word [ecx + 0xc], 0x7273
mov byte [ecx + 0xe], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xe
jne 0x45449b
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x45454a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.kdroem33]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x6d6c652e
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xc
jne 0x4545a7
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x4545e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movups xmm0, xmmword [str.GdtLoeumeIaodme_]
movups xmmword [ecx], xmm0
mov byte [ecx + 0x10], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0x10
jne 0x454634
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret