joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491b14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x491b2e
call fcn.004078d6
mov esi, dword [eax + 0xc]
push dword [0x57b130]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x491b4c
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x491b44
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x491b79
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x491b46
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00491a42
mov esi, eax
jmp 0x491b6b

Function at 0x4e650b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4e6523
mov edi, dword [esi + 0xc]
jmp 0x4e6563
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4e653c
call fcn.0041b893
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4e6551
call fcn.0041b893
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4e6563
call fcn.0041b893
call fcn.004078d6
cmp dword [eax + 0x3c], 0
je 0x4e6578
push edi
mov ecx, ebx
call fcn.004e533f
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004e6425
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4e6596
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4e65a2
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x50558a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x575db0]
jne 0x505594
repz ret
jmp fcn.0050c9f8
Function at 0x519c8e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x575db0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0050d7d6
and dword [ebp - 0x14], 0
cmp dword [0x57d6b0], 0
mov dword [ebp - 0x18], eax
jne 0x519d41
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x519de9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x519de9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x554940
push ebx
mov dword [0x57d6b0], eax
call edi
push eax
call esi
push 0x55492c
push ebx
mov dword [0x57d6b4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x57d6b8], eax
call edi
push eax
call esi
mov dword [0x57d6c0], eax
test eax, eax
je 0x519d41
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x57d6bc], eax
mov eax, dword [0x57d6bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x519d9a
cmp dword [0x57d6c0], ecx
je 0x519d9a
push eax
call esi
push dword [0x57d6c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x519d9a
test ebx, ebx
je 0x519d9a
call edi
test eax, eax
je 0x519d91
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x519d91
test byte [ebp - 8], 1
jne 0x519d9a
or dword [ebp + 0x10], 0x200000
jmp 0x519dcd
mov eax, dword [0x57d6b4]
cmp eax, dword [ebp - 0x18]
je 0x519dcd
push eax
call esi
test eax, eax
je 0x519dcd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x519dcd
mov eax, dword [0x57d6b8]
cmp eax, dword [ebp - 0x18]
je 0x519dcd
push eax
call esi
test eax, eax
je 0x519dcd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x57d6b0]
call esi
test eax, eax
je 0x519de9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x519deb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050558a
leave
ret
Function at 0x402080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx]
sub esp, 0x200
xor eax, eax
push ebx
mov ebx, dword [ecx + 4]
add ebx, edx
cmp edx, ebx
je 0x4020d0
push esi
push edi
lea esp, [esp]
mov ecx, 0x80
lea edi, [ebp - 0x200]
mov esi, 0x442ff8
rep movsd dword es:[edi], dword [esi]
movzx ecx, byte [edx]
inc edx
xor ecx, eax
shr ax, 8
movzx ecx, cl
xor ax, word [ebp + ecx*2 - 0x200]
movzx eax, ax
cmp edx, ebx
jne 0x4020a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402330
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432d05
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x449140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x2d8], eax
mov edx, eax
mov dword [ebp - 0x2d0], 0
lea ecx, [ebp - 0x2e0]
call fcn.0040ac40
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0x2e0]
or edi, 0xffffffff
mov esi, eax
test ecx, ecx
je 0x4023a9
lea eax, [ecx - 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
jne 0x4023a9
push eax
call fcn.00417cf7
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x402420
call ebx
mov esi, eax
cmp esi, 0x20
je 0x4023c2
cmp esi, 5
jne 0x4023e2
mov edx, dword [ebp - 0x2d8]
lea ecx, [ebp - 0x2d4]
call fcn.0040a4e0
mov ecx, 1
cmp byte [eax + 4], 0
je 0x4023e8
xor bl, bl
jmp 0x4023ee
mov ecx, dword [ebp - 0x2d0]
mov bl, 1
test bl, cl
je 0x402416
cmp byte [ebp - 0x2d0], 0
je 0x402416
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x402416
lea ecx, [eax - 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x402416
push ecx
call fcn.00417cf7
add esp, 4
test bl, bl
jne 0x402534
jmp 0x40248b
mov edx, dword [ebp - 0x2d8]
lea ecx, [ebp - 0x2d4]
call fcn.0040a4e0
cmp byte [ebp - 0x2d0], 0
mov dl, byte [eax + 4]
mov byte [ebp - 0x2c9], dl
je 0x402468
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x402468
lea ecx, [eax - 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x402468
push ecx
call fcn.00417cf7
mov dl, byte [ebp - 0x2c9]
add esp, 4
test dl, dl
jne 0x402476
mov eax, 1
jmp 0x402518
test esi, 0x400
jne 0x402491
shr esi, 4
and esi, 1
mov eax, esi
jmp 0x402518
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x250
lea eax, [ebp - 0x2c8]
push 0
push eax
call fcn.004197c0
mov edx, dword [ebp - 0x2d8]
lea ecx, [ebp - 0x2d0]
add esp, 0xc
call fcn.0040ac40
lea ecx, [ebp - 0x2c8]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x2d0]
mov esi, eax
test ecx, ecx
je 0x4024e6
add ecx, 0xfffffff4
lock xadd dword [ecx], edi
dec edi
jne 0x4024e6
push ecx
call fcn.00417cf7
add esp, 4
cmp esi, 0xffffffff
je 0x402563
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x2c8]
test eax, 0x400
je 0x402512
test dword [ebp - 0x2a4], 0x20000000
je 0x402512
mov eax, 2
jmp 0x402518
shr eax, 4
and eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417a68
mov esp, ebp
pop ebp
ret
push 0x43de0c
lea ecx, [ebp - 0x28]
call fcn.00405e30
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402270
push 0x447b2c
lea eax, [ebp - 0x5c]
push eax
call fcn.004191cc
call ebx
push 0x43de20
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.00405e30
push esi
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.00402270
push 0x447b2c
lea eax, [ebp - 0x78]
push eax
call fcn.004191cc
int3
Function at 0x4026c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432d90
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x449140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], edi
push 0x20a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], edi
push 0
push eax
call fcn.004197c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x402743
lock inc dword [0x449bd0]
mov dword [edi], 0x449bdc
mov word [0x449bdc], ax
jmp 0x40281c
push ecx
mov edx, esp
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x224], edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402755
sub ecx, esi
lea eax, [ebp - 0x21c]
sar ecx, 1
lea eax, [eax + ecx*2]
mov ecx, edx
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00406f20
lea ecx, [ebp - 0x220]
call fcn.0040a610
add esp, 4
push 0x105
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x4027cc
lock inc dword [0x449bd0]
mov dword [edi], 0x449bdc
mov word [0x449bdc], ax
jmp 0x4027fc
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4027d5
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
lea eax, [eax + ecx*2]
mov ecx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00406f20
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x40281c
lea ecx, [eax - 0xc]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
jne 0x40281c
push ecx
call fcn.00417cf7
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417a68
mov esp, ebp
pop ebp
ret
Function at 0x402840
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432dfb
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x449140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, ebx
lea ecx, [ebp - 0xc0]
call fcn.0040ac40
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc0]
or edi, 0xffffffff
mov esi, eax
test ecx, ecx
je 0x4028a9
lea edx, [ecx - 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
jne 0x4028a9
push edx
call fcn.00417cf7
add esp, 4
test esi, esi
jne 0x402943
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 5
jne 0x402967
mov edx, ebx
lea ecx, [ebp - 0xc0]
call fcn.0040ac40
push 0x80
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], eax
test ecx, ecx
je 0x402907
lea edx, [ecx - 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
jne 0x402907
push edx
call fcn.00417cf7
mov eax, dword [ebp - 0xbc]
add esp, 4
test eax, eax
je 0x402967
mov edx, ebx
lea ecx, [ebp - 0xbc]
call fcn.0040ac40
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xbc]
mov esi, eax
test ecx, ecx
je 0x40293f
add ecx, 0xfffffff4
lock xadd dword [ecx], edi
dec edi
jne 0x40293f
push ecx
call fcn.00417cf7
add esp, 4
test esi, esi
je 0x40295f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417a68
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x43ded0
lea ecx, [ebp - 0x58]
call fcn.00405e30
push esi
lea edx, [ebp - 0x58]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x88]
call fcn.0040e0b0
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00405de0
cmp esi, 0x20
je 0x4029a7
cmp esi, 0x21
jne 0x402a4a
push ecx
mov edx, ebx
lea ecx, [ebp - 0x28]
call fcn.004051e0
add esp, 4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00405860
test al, al
jne 0x402a3e
push 0x43dee0
lea ecx, [ebp - 0x70]
call fcn.00405a30
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00401680
push 0xa
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb8]
call fcn.004068a0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.004067b0
add esp, 8
lea ecx, [ebp - 0x88]
push eax
call fcn.004059e0
lea ecx, [ebp - 0xa0]
call fcn.00401ff0
lea ecx, [ebp - 0xb8]
call fcn.00401ff0
lea ecx, [ebp - 0x40]
call fcn.00401ff0
lea ecx, [ebp - 0x70]
call fcn.00401ff0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401ff0
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401b80
push 0x447aac
lea eax, [ebp - 0x40]
push eax
call fcn.004191cc
int3
Function at 0x403a40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43307d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x449140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x14]
mov edx, dword [edi + 4]
xor ebx, ebx
cmp byte [eax], bl
setne bl
call fcn.0040ac40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
mov edx, dword [edi]
mov esi, dword [eax]
call fcn.0040ac40
push ebx
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x10]
or esi, 0xffffffff
mov edi, eax
test ecx, ecx
je 0x403abd
lea eax, [ecx - 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
jne 0x403abd
push eax
call fcn.00417cf7
add esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x403ad7
add eax, 0xfffffff4
lock xadd dword [eax], esi
dec esi
jne 0x403ad7
push eax
call fcn.00417cf7
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433a21
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x449140]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xc]
lea edx, [ebp - 0x124]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x128], ecx
test esi, esi
je 0x409c59
push 0
push edx
push esi
mov dword [ebp - 4], 5
push eax
push dword [ecx]
mov dword [ebp - 0x124], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409ce0
mov eax, dword [ebp - 0x124]
cmp eax, esi
jne 0x409d28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00417a68
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x124], 0x25a
call fcn.00406600
mov esi, eax
push 0x43e2bc
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.00405e30
push 0x5b
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00406590
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf0]
call fcn.00406570
add esp, 4
push 0x43e2a4
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x74]
call fcn.004063f0
add esp, 4
push eax
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 4
call fcn.00409080
push 0x447c68
lea eax, [ebp - 0x138]
push eax
call fcn.004191cc
call sub.KERNEL32.dll_GetLastError
push 0x43e0d8
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00405e30
push esi
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x74]
call fcn.0040e0b0
add esp, 4
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 7
call fcn.00401b80
push 0x447aac
lea eax, [ebp - 0x8c]
push eax
call fcn.004191cc
push 0x43e0e4
lea ecx, [ebp - 0x2c]
call fcn.00405a30
push 0x43ddb0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 8
call fcn.00405a30
push 0x43e0d8
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call fcn.00405e30
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.0040e1d0
add esp, 8
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0xb
call fcn.00401b80
push 0x447aac
lea eax, [ebp - 0xa4]
push eax
call fcn.004191cc
mov ecx, dword [ebp - 0x12c]
call fcn.00401ba0
push 0x43e07c
lea ecx, [ebp - 0xbc]
mov edi, eax
call fcn.00405a30
mov ecx, dword [ebp - 0x128]
mov byte [ebp - 4], 0xd
call fcn.00401d80
mov edx, eax
lea ecx, [ebp - 0x108]
call fcn.00401f30
mov esi, eax
sub esp, 0x18
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0xbc]
mov ecx, esp
call fcn.00401680
push esi
mov edx, 0x43dd20
lea ecx, [ebp - 0x120]
call fcn.00406910
add esp, 0x1c
push edi
push eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xf
call fcn.00401c30
push 0x447c58
lea eax, [ebp - 0xd8]
push eax
call fcn.004191cc
int3
Function at 0x40ab20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433ccd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x449140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push 0x10021
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00417a76
add esp, 4
test eax, eax
je 0x40ac32
lea edi, [eax + 0x23]
and edi, 0xffffffe0
push 0xfffe
push 0
push edi
lea esi, [edi + 0xfffe]
mov dword [edi - 4], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], esi
call fcn.004197c0
add esp, 0xc
mov dword [ebp - 0x20], esi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x7fff
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40ac11
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40ac18
lock inc dword [0x449bd0]
mov word [0x449bdc], ax
mov dword [ebx], 0x449bdc
mov byte [ebx + 4], 1
mov ecx, dword [edi - 4]
sub edi, ecx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x40ac32
push 0x10021
push ecx
call fcn.00417cfc
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x7fff
jb 0x40ac1e
mov byte [ebx + 4], 0
jmp 0x40abe2
lea eax, [edi + eax*2]
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.00406f20
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
jmp 0x40abde
call fcn.0041c7fe
int3
Function at 0x413960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43368d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x449140]

Function at 0x413979
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4139d6
mov eax, dword [edi + 0x3c]
xor esi, esi
mov ecx, dword [eax + edi + 0x78]
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov ebp, dword [ecx + 0x18]
test ebp, ebp
je 0x4139d6
mov ebx, dword [esp + 0x1c]
mov ch, byte [ebx]
mov edx, dword [eax + esi*4]
add edx, edi
mov cl, byte [edx]
cmp cl, ch
jne 0x4139d1
mov eax, ebx
sub edx, ebx
test cl, cl
je 0x4139de
cmp byte [eax], 0
je 0x4139de
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x4139bb
mov eax, dword [esp + 0x18]
inc esi
cmp esi, ebp
jb 0x4139ac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x413a09
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov edi, dword [edi]
mov eax, dword [edi + 0x30]
test eax, eax
je 0x413a1d
mov edx, dword [esp + 0x18]
test edx, edx
je 0x413a30
mov dword [edx], eax
test ecx, ecx
je 0x413a79
mov ebp, dword [edi + 0x30]
xor ebx, ebx
xor esi, esi
movzx eax, word [ebp]
mov edx, eax
test ax, ax
je 0x413a75
nop dword [eax]
movzx ecx, ax
lea esi, [esi + 1]
movzx eax, ax
lea edx, [ecx - 0x41]
add ecx, 0x20
cmp dx, 0x19
movzx ecx, cx
cmova ecx, eax
movzx eax, cx
add ebx, eax
movzx eax, word [ebp + esi*2]
test ax, ax
jne 0x413a49
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jne 0x413a1d
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x413a89
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ecx
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
add eax, 0xc
push edi
mov eax, dword [eax]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x413a9a
mov ebp, dword [eax + 0x18]
mov eax, dword [0x44a3e4]
push 0
push eax
call fcn.00413a09
mov edi, dword [0x44a3d0]
add esp, 8
mov ebx, eax
mov edx, dword [edi]
test edx, edx
je 0x413b0b
movzx eax, word [esi]
xor ecx, ecx
test ax, ax
je 0x413ad6
inc ecx
cmp word [esi + ecx*2], 0
jne 0x413ace
cmp cl, dl
je 0x413ae3
cmp cl, byte [edi + 1]
jne 0x413be3
xor edx, edx
xor ecx, ecx
test ax, ax
je 0x413afd
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2]
test ax, ax
jne 0x413aec
cmp edx, dword [edi + 4]
je 0x413b0b
cmp edx, dword [edi + 8]
jne 0x413be3
mov eax, dword [0x44a3f0]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov esi, eax
cmp dword [0x44a3bc], edx
jbe 0x413b54
nop dword [eax + eax]
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x44a3d4]
add edx, eax
cmp edx, dword [0x44a3bc]
jb 0x413b39
push esi
push ebx
call fcn.00413979
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x413be3
mov esi, dword [0x44a3d8]
lea eax, [esp + 0x10]
mov ecx, dword [0x44a3bc]
push eax
push ecx
mov ecx, dword [0x44a3c0]
push ecx
push esi
call ebx
mov edx, dword [0x44a3fc]
mov ecx, 8
mov edi, dword [edx + ebp + 4]
add edx, ebp
cmp dword [0x44a3c0], ecx
jbe 0x413bb0
mov eax, dword [edx + ecx]
add eax, edi
mov dword [esi + ecx], eax
mov eax, dword [0x44a3d4]
add ecx, eax
cmp ecx, dword [0x44a3c0]
jb 0x413b99
mov eax, dword [0x44a3cc]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
mov eax, dword [0x44a3c0]
push eax
push esi
call ebx
mov eax, dword [0x44a3ec]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x44a3ec]
add ecx, esi
add esi, eax
push esi
call ecx
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]