joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404300
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [esp + 4], edx
mov edx, dword [sym.imp.user32.dll_SendDlgItemMessageW]
mov dword [esp + 0x10], 0
mov dword [ebp - 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x147
mov dword [esp], eax
call edx
mov edx, dword [ebp - 0x10]
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x150
mov dword [esp + 4], esi
mov dword [esp], ebx
call edx
lea edx, [eax - 1]
sub esp, 0x14
cmp edx, 0xfffffffd
jbe 0x404390
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0
mov dword [esp + 4], str.SoftwareWineDrivers_
mov dword [esp], Ordinal_2
call sym._set_reg_key
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SoftwareWineDrivers_
mov dword [esp + 0xc], eax
mov dword [esp], Ordinal_2
call sym._set_reg_key
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ba60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
lea ebx, [ebp - 0x214]
sub esp, 0x66c
mov dword [esp + 4], 0x7f02
mov dword [esp], 0
call dword [sym.imp.user32.dll_LoadCursorW]
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.user32.dll_SetCursor]
mov dword [ebp - 0x664], eax
call eax
mov dword [ebp - 0x660], eax
mov eax, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 4
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str.WINEBUILDDIR
mov dword [ebp - 0x65c], eax
call eax
sub esp, 0xc
test eax, eax
jne 0x40bc40
xor eax, eax
lea esi, [ebp - 0x654]
jmp 0x40bb0d
xor ecx, ecx
mov edx, ebx
mov eax, edi
call sym._load_library_list_from_dir
mov dword [esp + 4], 0x41b1b0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, edi
xor ecx, ecx
mov edx, ebx
call sym._load_library_list_from_dir
mov eax, dword [ebp - 0x658]
mov dword [esp + 0xc], eax
lea ecx, [eax + 1]
mov dword [esp + 8], str.WINEDLLDIR_u
mov dword [esp + 4], 0x20
mov dword [esp], esi
mov dword [ebp - 0x658], ecx
call sym._swprintf_1
mov dword [esp + 4], ebx
mov edx, dword [ebp - 0x65c]
mov dword [esp + 8], 0x104
mov dword [esp], esi
call edx
sub esp, 0xc
test eax, eax
jne 0x40bae0
lea eax, [ebp - 0x614]
mov dword [esp], edi
mov ebx, 1
lea esi, [ebp - 0x414]
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.user32.dll_SendDlgItemMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x148
mov dword [esp + 4], 0x1f44
mov dword [ebp - 0x658], eax
call eax
sub esp, 0x14
mov dword [esp + 0x10], esi
mov eax, dword [ebp - 0x658]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x148
mov dword [esp + 4], 0x1f44
mov dword [esp], edi
call eax
sub esp, 0x14
test eax, eax
js 0x40bc20
lea eax, [ebp - 0x614]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
jne 0x40bc00
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x658]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x144
mov dword [esp + 4], 0x1f44
mov dword [esp], edi
call eax
sub esp, 0x14
jmp 0x40bb90
lea eax, [ebp - 0x614]
mov dword [esp + 4], esi
add ebx, 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
jmp 0x40bb90
mov eax, dword [ebp - 0x660]
mov dword [esp], eax
mov eax, dword [ebp - 0x664]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 4], ebx
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [esp + 4], str.dlls
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcscat]
mov ecx, 1
mov edx, esi
mov eax, edi
call sym._load_library_list_from_dir
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x40bad0
Function at 0x40dde0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x20c]
sub esp, 0x21c
call sym._free_theme_files
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x38
mov dword [esp], 0
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
sub esp, 0x14
test eax, eax
js 0x40de8e
mov dword [esp + 4], 1
mov dword [esp], 0x18
call dword [sym.imp.comctl32.dll_DSA_Create]
mov edx, ebx
sub esp, 8
cmp word [ebp - 0x20c], 0
mov dword [0x4282d0], eax
je 0x40de59
nop
add edx, 2
cmp word [edx], 0
jne 0x40de50
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [eax + str.Themes]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40de60
mov dword [esp + 8], 0
mov dword [esp + 4], sym._myEnumThemeProc_24
mov dword [esp], ebx
call sym._EnumThemes_12
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x40df60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x214]
push ebx
mov ebx, 0x417324
sub esp, 0x21c
mov edi, dword [sym.imp.shell32.dll_SHGetFolderPathW]
lea esi, [esi]
mov eax, dword [ebx - 4]
mov byte [ebx], 0
mov dword [esp + 0x10], esi
or ah, 0x40
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call edi
sub esp, 0x14
test eax, eax
js 0x40dfc5
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._query_shell_folder
add ebx, 0x108
cmp ebx, 0x417a5c
jne 0x40df80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4143a0
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
sub esp, 0x14
mov dword [esp + 8], 0x4282e8
mov dword [esp + 4], str.SoftwareWine
mov dword [esp], Ordinal_2
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
test eax, eax
jne 0x4143d8
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, 1
test byte [0x418888], 2
je 0x4143cd
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RegOpenKey_failed_on_wine_config_key___ld__n
mov dword [esp + 8], str.initialize
mov dword [esp + 4], 0x418888
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_8
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x415990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4159e8
cmp byte [esi + ebx - 1], 0xa
je 0x4159bc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x428384], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x416010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x4161e8
mov edi, dword [0x428384]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x4160f7
test byte [0x4188b0], 8
jne 0x416190
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x4188c0], 8
jne 0x416150
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x416099
cmp esi, 3
jbe 0x416108
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x4160aa
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x422be0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x416099
mov dword [esp], 0x4188c0
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x416070
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x416070
mov dword [esp], 0x4188b0
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x41605b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x416063
mov eax, 0xffffffff
jmp 0x4160f7

Function at 0x416260
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x4162d0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x41635b
cmp ax, 9
je 0x416348
cmp ax, 0x20
je 0x416348
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x4163b0
cmp ax, 0x22
je 0x4163c0
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x41635b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x416300
test edi, 1
jne 0x416300
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x416348
cmp ax, 0x20
je 0x416348
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x4163d8
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x41631b
and dword [ebp - 0x54], 1
jne 0x416314
xor edi, 1
jmp 0x41631b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x416374
Function at 0x4014b3
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x5de77e], 0
jne 0x4016ea
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00511260
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401505
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x401532
push 0xb8
push 0x4016185
push 6
call fcn.0050fc00
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401577
push ebx
call fcn.0050fbf4
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4015ab
push 0xb8
push 0x4016185
push 6
call fcn.0050fc00
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4015bb
push ebx
call fcn.0050fbf4
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4015ce
mov eax, 0x537282
push eax
push 1
mov ebx, 0x164
call fcn.005112a0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.0040148c
mov dword [0x5de77e], eax
cmp dword [0x5de77e], 0
jne 0x4016ea
call fcn.0040170a
mov dword [0x5de77e], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x401634
push 0x1c1
push 0x4016185
push 6
call fcn.0050fc00
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401679
push ebx
call fcn.0050fbf4
add esp, 4
push 0x80000301
push 0
push dword [0x5de77e]
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x4016ca
push 0x1d6
push 0x4016185
push 6
call fcn.0050fc00
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4016da
push ebx
call fcn.0050fbf4
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4016ea
push ebx
call fcn.0050fbf4
add esp, 4
mov eax, dword [0x5de77e]
jmp 0x4016f4
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401705
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4024d9
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x5de782], 0
jne 0x402584
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00402606
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40251a
push ebx
call fcn.0050fbf4
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x5de782], eax
cmp dword [0x5de782], 0
jne 0x402584
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x402558
push 0xd2
push 0x40161f4
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [0x5de782], eax
push dword [0x5de782]
mov eax, str._dbg.g_threadCallStack_tls
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00402a4c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402584
push ebx
call fcn.0050fbf4
add esp, 4
mov dword [ebp - 8], esp
push dword [0x5de782]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x4025b3
push 0x163
push 0x40161f4
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4025fa
call fcn.00402b47
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x5de782]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x4025fa
push 0x1e1
push 0x40161f4
push 6
call fcn.0050fc00
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x402602
mov esp, ebp
pop ebp
ret
Function at 0x402634
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x5de786], 0
jne 0x40286b
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.00511260
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402686
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x4026b3
push 0xb8
push 0x4016211
push 6
call fcn.0050fc00
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4026f8
push ebx
call fcn.0050fbf4
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40272c
push 0xb8
push 0x4016211
push 6
call fcn.0050fc00
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40273c
push ebx
call fcn.0050fbf4
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40274f
mov eax, 0x537282
push eax
push 1
mov ebx, 0x164
call fcn.005112a0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.0040148c
mov dword [0x5de786], eax
cmp dword [0x5de786], 0
jne 0x40286b
call fcn.0040288b
mov dword [0x5de786], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x4027b5
push 0x1c1
push 0x4016211
push 6
call fcn.0050fc00
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4027fa
push ebx
call fcn.0050fbf4
add esp, 4
push 0x80000301
push 0
push dword [0x5de786]
push 1
mov ebx, 0x168
call fcn.00510f20
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x40284b
push 0x1d6
push 0x4016211
push 6
call fcn.0050fc00
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40285b
push ebx
call fcn.0050fbf4
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40286b
push ebx
call fcn.0050fbf4
add esp, 4
mov eax, dword [0x5de786]
jmp 0x402875
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402886
push ebx
call fcn.0050fbf4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x402f39
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x402f7d
push 0x12
push 0x4016204
push 6
call fcn.0050fc00
add esp, 0xc
jmp 0x402f82
mov esp, ebp
pop ebp
ret 4

Function at 0x403849
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 4], esp
je 0x40388d
push 0x12
push 0x4016162
push 6
call fcn.0050fc00
add esp, 0xc
jmp 0x403892
mov esp, ebp
pop ebp
ret 4
Function at 0x407e21
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x5de79a], 0
jne 0x407ecc
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040145e
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x407e62
push ebx
call fcn.0050fbf4
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x5de79a], eax
cmp dword [0x5de79a], 0
jne 0x407ecc
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x407ea0
push 0xc6
push 0x4016181
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [0x5de79a], eax
push dword [0x5de79a]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040193b
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x407ecc
push ebx
call fcn.0050fbf4
add esp, 4
mov dword [ebp - 8], esp
push dword [0x5de79a]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x407efb
push 0x138
push 0x4016181
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x407f42
call fcn.0040170a
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x5de79a]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x407f42
push 0x1b6
push 0x4016181
push 6
call fcn.0050fc00
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x407f4a
mov esp, ebp
pop ebp
ret

Function at 0x4082de
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x5de79e], 0
jne 0x408389
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040840b
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40831f
push ebx
call fcn.0050fbf4
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x5de79e], eax
cmp dword [0x5de79e], 0
jne 0x408389
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x40835d
push 0xc6
push 0x40161e5
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [0x5de79e], eax
push dword [0x5de79e]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00408851
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408389
push ebx
call fcn.0050fbf4
add esp, 4
mov dword [ebp - 8], esp
push dword [0x5de79e]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x4083b8
push 0x138
push 0x40161e5
push 6
call fcn.0050fc00
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4083ff
call fcn.00408690
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x5de79e]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x4083ff
push 0x1b6
push 0x40161e5
push 6
call fcn.0050fc00
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x408407
mov esp, ebp
pop ebp
ret