joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42060b
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x420724
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041fe28
cmp eax, 1
jne 0x42071a
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x4206d0
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x4206e7
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x4206cc
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x420705
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x420725
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4216ab
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x42151a
mov dword [esp], 0x51773c
call fcn.00420c80
mov eax, dword [0x4c3204]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4216f2
mov eax, dword [ebp - 0x20]
jmp 0x42183d
call fcn.00420514
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x421709
cmp dword [ebp - 0x20], 0
jne 0x421713
mov eax, 0
jmp 0x42183d
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0042060b
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4217e5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4c3204]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x42183a
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x421901
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004216ab
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.0042153e
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x42195c
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x4c3204]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x421a86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4219ee
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4219ab
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00420422
mov dword [ebp - 0x10], 0
mov eax, dword [0x4c3204]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x421a86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x421a1e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x421a86
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00420422
mov dword [ebp - 0x10], 0
mov eax, dword [0x4c3204]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x4236b8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4c3214
call fcn.0041fe32
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x4236e4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x423726
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.0041d80c
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x4c3214
call fcn.0041fe90
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x429220
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
call dword [esp + 0x20]
jmp 0x4b9fdc
Function at 0x480460
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x4804a0
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x480471
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4b8f20
Capabilities:
Write file on windows

Disassembly:
push ebx
mov edx, 1
sub esp, 0x18
mov eax, dword [esp + 0x20]
test eax, eax
cmovne edx, eax
mov ebx, edx
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4b8f45
add esp, 0x18
pop ebx
ret
call fcn.004b3290
test eax, eax
je 0x4b9ff0
call eax
jmp 0x4b8f34
Function at 0x401906
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401915
pop dword [ebp - 0x50]
mov eax, 0xf2f808bb
sub eax, 0xf2b7efa6
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x35a12
push 0
mov eax, 0x70216b59
sub eax, 0x6fe08a39
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x884d4e99
add ecx, 0x77b2ea8d
mov esi, eax
mov edx, 0x417800
add edx, dword [ebp - 0x50]
mov ebx, 0x13644a8
sub ebx, 0xd170e855
add dword [ebp - 0x3c], eax
mov edi, dword [edx]
sub dword [ebp - 4], 0xcaa9942b
sub edi, ebx
xor dword [ebp - 0x30], 0x10c1b7af
mov dword [esi], edi
add dword [ebp - 0x2c], 0xd88ffb84
add esi, 0xa941e0e8
add esi, 0x56be1f1c
add edx, 0xfbaa0749
add edx, 0x455f8bb
loop 0x40196e
add eax, 0xd76b
xor ebx, ebx
add ebx, eax
add eax, 0x88c7c772
add eax, 0x77383893
mov ecx, 0xe5ea1e8d
add ecx, 0x1a55e173
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401d25
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x412320]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
mov esi, dword [ebp + 0x1b0]
push 0x104
lea ecx, [ebp - 0x68]
push ecx
push 0xffffffffffffffff
push eax
xor ebx, ebx
push ebx
push 0xfde9
mov dword [ebp - 0x6c], 0xfffffffd
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x401e01
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x401e01
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x401e00
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401df3
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x40e484
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401df3
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 0xa]
mov dword [esi], ecx
movzx ecx, word [eax + 8]
mov dword [esi + 4], ecx
movzx ecx, word [eax + 0xe]
mov dword [esi + 8], ecx
movzx eax, word [eax + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x70]
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
pop edi
mov ecx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x6c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004024bc
add ebp, 0x1a4
leave
ret

Function at 0x4024bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412320]
jne 0x4024c6
repz ret
jmp fcn.00403ae7
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x434460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x43447b
xor eax, eax
jmp 0x4344d6
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00412b50
add esp, 8
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4344a8
mov eax, edi
and eax, 0x50
jne 0x4344a8
mov dword [ebp - 8], 1
jmp 0x4344af
mov dword [ebp - 8], 0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4344d4
push str.hb_fsFileExists
push 0x1a8
push str.C:xharbour_sourcecommonhbfsapi.c
mov eax, dword [ebp - 4]
push eax
call fcn.00412960
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436580
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x4365be
push str.hb_getenv
push 0x5c
push str.C:xharbour_sourcecommonhbgete.c
push esi
call fcn.00412910
add esp, 0x10
mov ebx, eax
push esi
push ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x439450
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
push str.hb_verPlatform
push 0x137
push str.C:xharbour_sourcecommonhbver.c
push 0x100
call fcn.00412910
add esp, 0x10
mov ebx, eax
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x43968c
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x9c], 0x4687ac
mov dword [ebp - 0xa0], 0x4687ac
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4394e2
push str.wine_get_version
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4394e2
mov dword [ebp - 0x9c], str.__Wine_
mov eax, dword [ebp - 0x84]
cmp eax, 3
jg case.default.0x4394f1
jmp dword [eax*4 + 0x4676c4]
cmp dword [ebp - 0x90], 4
jne 0x439519
cmp dword [ebp - 0x8c], 0xa
jae 0x439519
mov dword [ebp - 0xa0], 0x46878f
jmp case.default.0x4394f1
cmp dword [ebp - 0x90], 4
jne 0x43953a
cmp dword [ebp - 0x8c], 0xa
jne 0x43953a
mov dword [ebp - 0xa0], 0x46878b
jmp case.default.0x4394f1
mov dword [ebp - 0xa0], 0x468787
jmp case.default.0x4394f1
cmp dword [ebp - 0x90], 6
jne 0x439561
mov dword [ebp - 0xa0], 0x4687ac
jmp case.default.0x4394f1
cmp dword [ebp - 0x90], 5
jne 0x43957f
cmp dword [ebp - 0x8c], 2
jb 0x43957f
mov dword [ebp - 0xa0], str._Server_2003___XP_x64
jmp case.default.0x4394f1
cmp dword [ebp - 0x90], 5
jne 0x43959d
cmp dword [ebp - 0x8c], 1
jne 0x43959d
mov dword [ebp - 0xa0], 0x46876d
jmp case.default.0x4394f1
cmp dword [ebp - 0x90], 5
jne 0x4395b2
mov dword [ebp - 0xa0], str._2000
jmp case.default.0x4394f1
mov dword [ebp - 0xa0], 0x468763
jmp case.default.0x4394f1
mov dword [ebp - 0xa0], str._32s
jmp case.default.0x4394f1
mov dword [ebp - 0xa0], 0x46875a
mov eax, dword [ebp - 0x88]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
push str.Windows_s_s__lu._lu._04u
push 0x100
push ebx
call fcn.00439360
add esp, 0x20
lea eax, [ebp - 0x80]
test eax, eax
je 0x43969f
lea eax, [ebp - 0x80]
push eax
call fcn.00432630
pop ecx
mov edi, eax
xor esi, esi
jmp 0x43962b
inc esi
movsx eax, byte [edi + esi]
test eax, eax
je 0x439647
cmp eax, 0x20
je 0x43962a
cmp eax, 9
je 0x43962a
cmp eax, 0xa
je 0x43962a
cmp eax, 0xd
je 0x43962a
cmp byte [edi + esi], 0
je 0x439672
push 0xff
push 0x46873f
push ebx
call fcn.004339a0
add esp, 0xc
push 0xff
lea eax, [edi + esi]
push eax
push ebx
call fcn.004339a0
add esp, 0xc
push str.hb_verPlatform
push 0x21f
push str.C:xharbour_sourcecommonhbver.c
push edi
call fcn.00412960
add esp, 0x10
jmp 0x43969f
push str.Windows
push 0x100
push ebx
call fcn.00439360
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [0x49c924]
cmp eax, edx
jae 0x449fcf
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x49c928]
test byte [eax + edx*8 + 4], 1
jne 0x449fe1
mov dword [0x497450], 9
or eax, 0xffffffff
jmp 0x44a1b4
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x449ffc
xor eax, eax
jmp 0x44a1b4
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x49c928]
test byte [eax + edx*8 + 4], 0x20
je 0x44a025
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0044c8b0
add esp, 0xc
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x49c928]
test byte [eax + edx*8 + 4], 0x80
je 0x44a103
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
jmp 0x44a0ef
lea edi, [ebp - 0x411]
jmp 0x44a071
mov eax, esi
inc esi
mov bl, byte [eax]
cmp bl, 0xa
jne 0x44a06c
inc dword [ebp - 4]
mov eax, edi
inc edi
mov byte [eax], 0xd
mov eax, edi
inc edi
mov byte [eax], bl
lea eax, [ebp - 0x411]
mov edx, edi
sub edx, eax
mov eax, edx
cmp eax, 0x400
jge 0x44a092
mov eax, dword [ebp + 0xc]
mov edx, esi
sub edx, eax
mov eax, edx
cmp eax, dword [ebp + 0x10]
jb 0x44a059
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x411]
mov edx, edi
sub edx, eax
mov eax, edx
push eax
lea eax, [ebp - 0x411]
push eax
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x49c928]
mov eax, dword [eax + edx*8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44a0e4
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], eax
lea edx, [ebp - 0x411]
mov ecx, edi
sub ecx, edx
mov edx, ecx
cmp eax, edx
jge 0x44a0ef
jmp 0x44a149
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x44a149
mov eax, dword [ebp + 0xc]
mov edx, esi
sub edx, eax
mov eax, edx
cmp eax, dword [ebp + 0x10]
jb 0x44a051
jmp 0x44a149
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x49c928]
mov eax, dword [eax + edx*8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44a140
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x44a149
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x44a1ae
cmp dword [ebp - 0x10], 0
je 0x44a17a
cmp dword [ebp - 0x10], 5
jne 0x44a16b
mov dword [0x497450], 9
jmp 0x44a175
mov eax, dword [ebp - 0x10]
push eax
call fcn.0044c2e0
pop ecx
or eax, 0xffffffff
jmp 0x44a1b4
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x49c928]
test byte [eax + edx*8 + 4], 0x40
je 0x44a19f
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x44a19f
xor eax, eax
jmp 0x44a1b4
mov dword [0x497450], 0x1c
or eax, 0xffffffff
jmp 0x44a1b4
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret