joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403740
Capabilities:
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x403768
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x403760
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
xor eax, eax
pop ebp
ret
mov eax, 0xfffffff8
pop edi
pop ebp
ret
mov eax, dword [0x449030]
cmp eax, 0x10
je 0x403794
cmp eax, 6
je 0x403794
cmp eax, 7
je 0x403794
push 0
push 0
push 0x403710
push 0x449028
call fcn.00405ad0
add esp, 0x10
jmp 0x403799
mov eax, dword [0x449034]
test eax, eax
js 0x40380e
push esi
push str.D:_tinderbox_testsuite_srcVBoxRuntime_r3win_tls_win.cpp
push 0x10
call fcn.004051c0
mov esi, eax
add esp, 8
test esi, esi
je 0x403808
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x403808
mov ecx, dword [ebp + 8]
push 0x44ae38
mov dword [ecx], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
call fcn.00408df0
mov eax, dword [0x44ae6c]
mov dword [eax], esi
mov eax, dword [0x44ae6c]
mov dword [esi + 4], eax
mov dword [esi], 0x44ae68
mov dword [0x44ae6c], esi
lock inc dword [0x44ae30]
push 0x44ae38
call fcn.00408ef0
add esp, 8
xor eax, eax
pop esi
pop edi
pop ebp
ret
mov eax, 0xfffffff8
pop esi
pop edi
pop ebp
ret

Function at 0x403830
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x403847
xor eax, eax
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
pop ebp
ret

Function at 0x404450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0040e080
mov esi, eax
add esp, 0xc
test esi, esi
js 0x404497
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40448a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
mov esi, eax
push dword [ebp - 4]
call fcn.0040e070
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404510
Capabilities:
Clear file content
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x1c
push edi
test eax, eax
je 0x4048d0
mov dword [eax], 0xffffffff
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x404535
mov dword [eax], 0
mov edi, dword [ebp + 8]
test edi, edi
je 0x4048d0
lea eax, [ebp + 0xc]
push eax
call fcn.0040de60
add esp, 4
test eax, eax
js 0x404849
mov ecx, dword [ebp + 0xc]
mov eax, ecx
and eax, 0x700
push ebx
push esi
cmp eax, 0x300
ja 0x404590
je 0x404589
cmp eax, 0x100
je 0x404582
cmp eax, 0x200
jne 0x4048c4
mov edx, 1
jmp 0x4045b1
mov edx, 4
jmp 0x4045b1
mov edx, 2
jmp 0x4045b1
cmp eax, 0x700
jne 0x4048c4
mov eax, ecx
mov edx, 5
and eax, 0x1000
or eax, 0
jne 0x4045b1
mov edx, 3
mov eax, ecx
mov dword [ebp - 8], edx
and eax, 3
jmp dword [eax*4 + 0x4048dc]
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, 0xfffffff3
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4049a0
Capabilities:
Get disk size
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x449158]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
cmp ebx, 0xffffffff
je 0x4049c4
mov eax, ebx
jmp 0x4049c7
or eax, 0xffffffff
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
je 0x4049f4
mov ecx, dword [ebp - 0x24]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], ecx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401320
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
mov esi, eax
cmp ebx, 0xffffffff
je 0x404a0e
mov ecx, ebx
jmp 0x404a11
or ecx, 0xffffffff
push 0
lea eax, [ebp - 0x34]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0x70000
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x404ab0
mov eax, dword [ebp - 0x14]
cmp eax, 0xc
je 0x404a3e
cmp eax, 0xb
jne 0x404ab0
mov eax, dword [ebp - 8]
mul dword [ebp - 0xc]
push edi
push dword [ebp - 0x18]
mov ecx, eax
mov eax, edx
mul dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov edi, eax
mov eax, ecx
mul dword [ebp - 0x10]
add edi, edx
push edi
push eax
call fcn.004015a0
mov esi, dword [ebp - 0x20]
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
cmp ebx, 0xffffffff
jne 0x404a73
or ebx, 0xffffffff
push 0
lea eax, [ebp - 0x20]
push eax
push 8
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0x7405c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x404a9e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401320
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401320
mov esp, ebp
pop ebp
ret
Function at 0x404bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
je 0x404c22
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp ebx, 0xffffffff
je 0x404bf3
mov eax, ebx
jmp 0x404bf6
or eax, 0xffffffff
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push 0
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404cb9
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x404c2b
cmp eax, esi
jbe 0x404c20
mov eax, esi
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, esi
jae 0x404c22
nop
mov ecx, esi
mov dword [ebp - 8], 0
sub ecx, eax
lea edx, [eax + edi]
cmp ebx, 0xffffffff
je 0x404c47
mov eax, ebx
jmp 0x404c4a
or eax, 0xffffffff
push 0
lea esi, [ebp - 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x404c80
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x404d90
mov eax, dword [ebp - 4]
add eax, ecx
mov dword [ebp - 4], eax
cmp eax, esi
jb 0x404c30
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
cmp eax, 0xffffff68
jne 0x404c24
push ebx
call fcn.0040de10
xor ecx, ecx
sub esi, dword [ebp - 4]
sbb ecx, ecx
add eax, esi
adc edx, ecx
push edx
push eax
push ebx
call fcn.00404360
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x404dad
mov ebx, esi
xor eax, eax
shr ebx, 1
mov dword [ebp - 4], eax
cmp ebx, 0x8000
jbe 0x404ce0
mov ebx, 0x8000
jmp 0x404cf0
add ebx, 0xff
and ebx, 0xffffff00
lea esp, [esp]
mov edi, esi
sub edi, eax
cmp ebx, edi
ja 0x404cfa
mov edi, ebx
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x404d10
or eax, eax
push 0
lea edx, [ebp - 8]
push edx
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x404d5c
cmp ebx, eax
jbe 0x404d5c
mov eax, dword [ebp - 4]
shr ebx, 1
jmp 0x404d4f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, ecx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
test edx, edx
jne 0x404d9c
test ecx, ecx
je 0x404d90
cmp eax, esi
jb 0x404cf0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.00409060
add esp, 4
cmp eax, 0xffffff68
jne 0x404c24
mov esi, dword [ebp + 8]
push esi
call fcn.0040de10
add eax, edi
adc edx, 0
push edx
push eax
push esi
call fcn.00404360
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffff90
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, esi
jbe 0x404da2
mov eax, esi
pop edi
pop esi
mov dword [edx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.00409060
add esp, 4
cmp eax, 0xffffff68
jne 0x404c24
push ebx
call fcn.0040de10
add eax, esi
adc edx, 0
push edx
push eax
push ebx
call fcn.00404360
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405cd0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push 8
push 0
push eax
call sym.ntTimeSources.exe_nocrt_memset
push 0x28
push 0
push dword [ebp + 0xc]
call sym.ntTimeSources.exe_nocrt_memset
add esp, 0x18
lea eax, [ebp - 8]
push 0x18
push 0x28
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
setns al
mov esp, ebp
pop ebp
ret

Function at 0x405d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x405e1c
push edi
push 1
mov dword [ebp - 4], eax
lea edi, [esi + 0x14]
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x405e03
mov eax, dword [esi + 0x2c]
mov edx, dword [ebp - 4]
cmp edx, eax
jae 0x405da5
mov ecx, dword [esi + 0x28]
sub eax, edx
push eax
mov dword [esi + 0x2c], eax
lea eax, [ecx + edx]
push eax
push ecx
call sym.ntTimeSources.exe_nocrt_memmove
add esp, 0xc
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0x2c]
push dword [esi + 0x28]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405db1
mov eax, dword [esi + 0x2c]
mov edx, dword [ebp - 4]
cmp edx, eax
jb 0x405d64
mov byte [esi + 0xa], 0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x405dc9
pop edi
mov eax, 0x34
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xa], 0
cmp eax, 0xe8
jne 0x405de3
pop edi
mov byte [esi + 0xc], 1
mov eax, 0xfffffed3
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
cmp eax, 0xfffffed3
jne 0x405dab
pop edi
mov byte [esi + 0xc], 1
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xa], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x102
jne 0x405e2d
mov eax, 0x34
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xa], 0
cmp eax, 0x80
jne 0x405e42
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x1000]
cmp eax, 0x2000
jb 0x406449
cmp dword [edi], 0x19570528
jne 0x406449
cmp byte [edi + 8], 0
jne 0x40643f
push ebx
push esi
lea ebx, [edi + 0x38]
push ebx
call fcn.004038c0
mov esi, eax
add esp, 4
test esi, esi
js 0x406436
cmp dword [edi + 0x10], 0
jne 0x406428
cmp byte [edi + 0xa], 0
mov dword [edi + 0x10], 1
je 0x4062d8
push edi
call fcn.00405d20
mov esi, eax
add esp, 4
cmp esi, 0x34
jne 0x4062d0
mov esi, dword [edi + 0x24]
push ebx
call fcn.00403a60
add esp, 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.004038c0
add esp, 4
jmp 0x4062b0
test esi, esi
js 0x406407
xor edx, edx
mov byte [edi + 0xd], 0
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jbe 0x4063da
push dword [edi + 0x24]
lea esi, [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
mov byte [edi + 0xa], 1
call fcn.00403a60
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406333
push ebx
xor esi, esi
call fcn.004038c0
add esp, 4
mov byte [edi + 0xa], 0
jmp 0x40639f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x406370
push 0xffffffffffffffff
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
lea eax, [ebp - 4]
push eax
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x40637d
push ebx
xor esi, esi
call fcn.004038c0
add esp, 4
mov byte [edi + 0xa], 0
jmp 0x40639f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x4063c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409060
add esp, 4
mov esi, eax
push ebx
call fcn.004038c0
add esp, 4
mov byte [edi + 0xa], 0
test esi, esi
js 0x4063d7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jbe 0x4063ae
mov eax, ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
add dword [ebp + 0xc], eax
add edx, eax
sub ecx, eax
mov dword [ebp - 8], edx
mov dword [ebp + 0x10], ecx
je 0x4063da
jmp 0x4062ea
push ebx
mov esi, 0xfffffed3
call fcn.004038c0
add esp, 4
mov byte [edi + 0xa], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x406407
mov dword [eax], edx
test esi, esi
jns 0x406407
test edx, edx
je 0x406407
cmp esi, 0xfffffffa
je 0x406407
dec dword [edi + 0x10]
xor esi, esi
push ebx
call fcn.00403a60
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
cmp esi, 0xfffffed3
jne 0x406413
mov byte [edi + 0xc], 1
dec dword [edi + 0x10]
push ebx
call fcn.00403a60
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push ebx
mov esi, 0xffffffea
call fcn.00403a60
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffffda
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x408860
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
sub esp, 0xc
push esi
push edi
mov edi, dword [eax + 0x30]
push dword [edi + 8]
call fcn.00418050
add esp, 4
call fcn.004175f0
call fcn.00418170
call fcn.00418290
mov esi, eax
test esi, esi
jne 0x408944
mov ecx, dword [edi + 0x10]
lea esi, [eax + 3]
lea eax, [ecx + 0x40]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x40892d
push str.D:_tinderbox_testsuite_srcVBoxRuntime_r3win_nocrt_startup_exe_win.cpp
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
movzx eax, word [ecx]
shr eax, 1
push eax
push dword [ecx + 4]
call fcn.0040c670
add esp, 0x18
test eax, eax
js 0x40891b
push 0
push 4
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00417b80
add esp, 0x14
test eax, eax
js 0x408909
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.00401b20
add esp, 0xc
mov esi, eax
jmp 0x40893c
push eax
push 0x1c
push str.Error_parsing_command_line:
call fcn.00417740
add esp, 0xc
jmp 0x40893c
push eax
push 0x29
push str.Failed_to_convert_command_line_to_UTF_8:
call fcn.00417740
add esp, 0xc
jmp 0x40893c
push 0x11
push str.No_command_line_r_n
call fcn.00417700
add esp, 8
push 1
push esi
call fcn.00408830
push 0x1f
push str.A_C_static_initializor_failed__
call fcn.004177f0
push esi
call fcn.00417970
push 2
push 0x42266c
call fcn.004177f0
add esp, 0x14
push 0
push esi
call fcn.00408830
int3

Function at 0x409cc0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [0x449160]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x409cdd
mov eax, 0xffffffe8
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [ebp + 8]
call fcn.00409b90
add esp, 8
xor eax, eax
pop ebp
ret

Function at 0x409da0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
rdtsc
push 0
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
sub eax, esi
sbb edx, edi
pop edi
mov dword [ebp - 4], edx
pop esi
jne 0x409dd0
cmp eax, 0x5dc
ja 0x409dd0
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x40a260
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x44afb8], 0
push esi
mov esi, 0x1c
jne 0x40a2e1
push 0
push 1
push 0
push 1
push 0x44afb8
call fcn.004194f0
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40a2e1
call fcn.00409d40
mov esi, eax
test esi, esi
js 0x40a2c9
push 0x4226c4
push 8
push 0
push 4
call fcn.00409de0
mov esi, eax
add esp, 0x10
test esi, esi
js 0x40a2c9
push 4
call fcn.0040c740
mov esi, eax
add esp, 4
test esi, esi
js 0x40a2c9
mov byte [0x44afac], 1
xor eax, eax
pop esi
ret
push dword [0x44afb8]
call fcn.00419610
add esp, 4
mov dword [0x44afb8], 0
mov eax, esi
pop esi
ret
Function at 0x40a940
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 3
je 0x40a951
xor eax, eax
pop ebp
ret
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
and eax, 0xffffff35
add eax, 0xcb
pop ebp
ret

Function at 0x40a970
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x3d
push dword [ebp + 8]
call sym.ntTimeSources.exe_nocrt_strchr
add esp, 8
test eax, eax
jne 0x40a9c2
push str.D:_tinderbox_testsuite_srcVBoxRuntime_r3winenv_win.cpp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0040bd10
add esp, 0xc
test eax, eax
js 0x40a9c2
push ebx
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp - 4]
test eax, eax
setne bl
call fcn.00406590
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x40a9d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040a9e0
Function at 0x40cab0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 0x8001
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.SetDllDirectoryW
push dword [0x44b1e4]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40cb0d
push 0x422a10
mov ecx, ebx
call dword [section..rdata]
call ebx
test eax, eax
je 0x40cb08
mov dword [0x449164], 2
jmp 0x40cb0d
mov edi, 0xffffff1d
and esi, 4
cmp dword [0x44b0c4], 0x6c
jg 0x40cb1d
test esi, esi
je 0x40cb71
push str.SetDefaultDllDirectories
push dword [0x44b1e4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40cb71
neg esi
mov ecx, ebx
sbb esi, esi
and esi, 0xfffffe00
add esi, 0xa00
push esi
call dword [section..rdata]
call ebx
test eax, eax
je 0x40cb68
and esi, 0x200
neg esi
sbb esi, esi
add esi, 4
mov dword [0x449164], esi
jmp 0x40cb71
test edi, edi
js 0x40cb71
mov edi, 0xffffff1c
push str.GetCurrentThreadStackLimits
push dword [0x44b1e4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetUnhandledExceptionFilter
push dword [0x44b1e4]
mov dword [0x44b2b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UnhandledExceptionFilter
push dword [0x44b1e4]
mov dword [0x44b218], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x44b218]
mov dword [0x44b21c], eax
test esi, esi
je 0x40cbe9
cmp dword [0x44b2b8], 0
jne 0x40cbe9
push 0x40d150
mov ecx, esi
call dword [section..rdata]
call esi
mov ecx, eax
sub ecx, 0x40d150
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x44b2b8], ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40e080
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push str.D:_tinderbox_testsuite_srcVBoxRuntime_r3winpathint_win.cpp
push eax
push 0
push edi
push 0xffffffffffffffff
push esi
mov dword [edi], 0
mov dword [ebp - 4], 0
call fcn.0040bc30
mov ebx, eax
add esp, 0x18
test ebx, ebx
js 0x40e1ee
mov ecx, dword [ebp - 4]
cmp ecx, 0xf3
ja 0x40e167
mov dl, byte [esi]
movsx ebx, dl
lea eax, [ebx - 0x61]
cmp eax, 0x1a
jb 0x40e0e1
lea eax, [ebx - 0x41]
cmp eax, 0x1a
jae 0x40e110
cmp byte [esi + 1], 0x3a
jne 0x40e110
mov al, byte [esi + 2]
cmp al, 0x5c
je 0x40e1d5
cmp al, 0x2f
je 0x40e1d5
push edi
call fcn.0040dff0
add esp, 4
test al, al
je 0x40e167
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x5c
je 0x40e12e
cmp dl, 0x2f
je 0x40e12e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, dword [ebp - 4]
cmp eax, 0xf2
jmp 0x40e165
mov al, byte [esi + 1]
cmp al, 0x5c
je 0x40e139
cmp al, 0x2f
jne 0x40e15f
mov al, byte [esi + 2]
cmp al, 0x5c
je 0x40e15f
cmp al, 0x2f
je 0x40e15f
test al, al
je 0x40e15f
cmp al, 0x3f
jne 0x40e157
mov al, byte [esi + 3]
cmp al, 0x5c
je 0x40e157
cmp al, 0x2f
jne 0x40e1d5
cmp ecx, 0xf0
jmp 0x40e165
cmp ecx, 0xf1
jbe 0x40e1d5
push dword [edi]
call fcn.00406590
xor eax, eax
mov dword [edi], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040de00
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x40e1ee
cmp dword [ebp - 8], 0
jne 0x40e1de
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5c
jne 0x40e1de
cmp word [eax + 2], 0x3f
jne 0x40e1de
cmp word [eax + 4], 0x3f
jne 0x40e1de
cmp word [eax + 6], 0x5c
jne 0x40e1de
mov ecx, 0x5c
mov word [eax + 2], cx
movzx eax, word [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
shr eax, 1
cmp word [ecx + eax*2], 0
jne 0x40e1de
mov dword [edi], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040dde0
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret