joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad06d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4cfa1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call fcn.00447220
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x4d1b54]
mov edx, dword [0x4d1b58]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4663c0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad118
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x80
mov eax, dword [0x4cfa1c]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x8c]
call fcn.00474070
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x48], 0x906e4266
mov dword [ebp - 0x44], 0xfb7ab39e
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x48], 0xde0e8b6c
mov dword [ebp - 0x44], 0x51d41f93
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x48], 0xbd032f2b
mov dword [ebp - 0x44], 0xfb7ab39e
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x48], 0xde0e8b6c
mov dword [ebp - 0x44], 0x51d41f93
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
movaps xmm1, xmmword [ebp - 0x60]
pxor xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x60], xmm1
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x3c]
call fcn.00467c40
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c]
call fcn.00446fc0
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 0x10
cmovae eax, dword [ebp - 0x3c]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4664d2
push 0xb7
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 0x10
cmovae eax, dword [ebp - 0x3c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
mov dword [ebp - 0x44], esi
call fcn.0046aba0
test al, al
jne 0x466501
push 0x675
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00474310
mov byte [ebp - 4], 3
call fcn.00441280
mov dword [ebp - 4], 2
jmp 0x46652e
call fcn.004423d0
call fcn.00442930
call fcn.00443740
call fcn.004407e0
call fcn.00457200
call fcn.004596c0
call fcn.00439560
call fcn.0043ecd0
call fcn.0043d6c0
call fcn.004683b0
call fcn.0043fca0
call fcn.0043c640
call fcn.0043b040
mov byte [ebp - 4], 5
call fcn.0046db30
mov dword [ebp - 4], 2
jmp 0x466597
call fcn.00464780
test esi, esi
je 0x4665ae
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00446fc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.00497d9d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x469f60
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adc18
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x4cfa1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], edi
xor eax, eax
mov dword [ebp - 0x1c], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push edx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x46a0a9
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x18]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46a010
sub ecx, esi
sar ecx, 1
mov byte [ebp - 4], 3
xorps xmm0, xmm0
push ecx
push edx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0
call fcn.00449f10
mov esi, 5
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x1c], esi
and esi, 0xfffffffb
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 2
or esi, 2
lea eax, [ebp - 0x34]
mov dword [ebp - 0x1c], esi
cmp edi, eax
je 0x46a097
mov ecx, edi
call fcn.00446f30
movups xmm0, xmmword [ebp - 0x34]
xor eax, eax
mov word [ebp - 0x34], ax
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
and esi, 0xfffffffd
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00446f30
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497d9d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x46b590
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
xor esi, esi
test edi, edi
je 0x46b5e5
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov edx, closesocket
nop dword [eax]
push 0
cmp edi, 0x7fffffff
mov eax, edi
cmova eax, edx
push eax
lea eax, [esi + ecx]
push eax
push dword [0x4cfba8]
call ebx
test eax, eax
jle 0x46b5dc
mov ecx, dword [ebp - 4]
add esi, eax
mov edx, closesocket
sub edi, eax
jne 0x46b5b0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46e740
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a740e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4cfa1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 0
push 0
push 4
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetGeoInfoA]
xorps xmm0, xmm0
mov edi, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov ecx, esi
push 0
push edi
mov dword [ebp - 0x10], 1
call fcn.004459d0
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x46e7dd
mov eax, dword [esi]
push 0
push edi
push eax
push 4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetGeoInfoA]
push 0
lea eax, [edi - 1]
mov ecx, esi
push eax
call fcn.004459d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46ee10
Capabilities:
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aeba7
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10014
call fcn.00498e30
mov eax, dword [0x4cfa1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1001c], esi
lea eax, [ebp - 0x1001c]
mov dword [ebp - 0x10024], esi
push eax
lea eax, [ebp - 0x10018]
mov dword [ebp - 0x10020], 0
push eax
mov dword [ebp - 0x1001c], 0x7fff
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x46ee9d
lea edx, [ebp - 0x10018]
mov ecx, esi
call fcn.004637b0
jmp 0x46eec2
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10020], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497d9d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x46ef00
Capabilities:
Get hostname

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aeba7
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10014
call fcn.00498e30
mov eax, dword [0x4cfa1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1001c], esi
lea eax, [ebp - 0x1001c]
mov dword [ebp - 0x10024], esi
push eax
lea eax, [ebp - 0x10018]
mov dword [ebp - 0x10020], 0
push eax
mov dword [ebp - 0x1001c], 0x7fff
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x46ef8d
lea edx, [ebp - 0x10018]
mov ecx, esi
call fcn.004637b0
jmp 0x46efb2
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10020], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497d9d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4731b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aef42
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x438
mov eax, dword [0x4cfa1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x41c], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x428], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0x400
mov dword [ebp - 0x41c], 0xf003f
mov byte [esi], 0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x428], 1
jb 0x473272
mov eax, dword [eax]
lea ecx, [ebp - 0x420]
push ecx
push 0x20019
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x473355
cmp dword [edi + 0x14], 0x10
jb 0x473298
mov edi, dword [edi]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x473355
mov eax, dword [ebp - 0x424]
lea ecx, [ebp - 0x440]
dec eax
mov dword [ebp - 0x430], 0
push eax
lea eax, [ebp - 0x418]
mov dword [ebp - 0x42c], 0
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x440], xmm0
call fcn.00438600
mov dword [ebp - 4], 1
lea eax, [ebp - 0x440]
cmp esi, eax
je 0x473346
mov ecx, esi
call fcn.00446fc0
movups xmm0, xmmword [ebp - 0x440]
mov byte [ebp - 0x440], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x430]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.00446fc0
mov eax, dword [ebp - 0x420]
test eax, eax
je 0x473366
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497d9d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x475e00
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af6b1
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4cfa1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x58], ebx
mov ecx, dword [eax]
mov eax, dword [0x4d21a8]
cmp eax, dword [ecx + 4]
jle 0x475e87
push 0x4d21a8
call fcn.00497ee3
add esp, 4
cmp dword [0x4d21a8], 0xffffffff
jne 0x475e87
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [0x4d21d0], eax
mov dword [ebp - 4], 0xffffffff
push 0x4d21a8
call fcn.00497e99
add esp, 4
mov ecx, 0x42
lea eax, [ebp - 0x54]
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x475e90
lea eax, [ebp - 0x54]
push eax
push ecx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x475f8c
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x68]
push eax
push 1
push dword [ebp - 0x58]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x475f83
mov dword [ebp - 0x60], eax
mov ecx, 4
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x475ee1
mov esi, dword [sym.imp.RstrtMgr.DLL_RmGetList]
lea eax, [ebp - 0x60]
push eax
push ecx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x58]
call esi
cmp eax, 0xea
jne 0x475fc9
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x475fc9
xor ecx, ecx
mov edx, 0x29c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048583f
mov edi, eax
add esp, 4
test edi, edi
je 0x475fc9
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
push edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x58]
call esi
test eax, eax
jne 0x475fc0
cmp dword [ebp - 0x64], eax
je 0x475fc0
mov edx, dword [ebp - 0x5c]
test edx, edx
je 0x475f83
mov ebx, dword [0x4d21d0]
mov ecx, edi
nop dword [eax]
mov esi, dword [ecx]
cmp esi, ebx
jne 0x475faa
inc eax
add ecx, 0x29c
cmp eax, edx
jb 0x475f70
xor ebx, ebx
push dword [ebp - 0x58]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497d9d
mov esp, ebp
pop ebp
ret
push edi
call fcn.0047d501
add esp, 4
push dword [ebp - 0x58]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov ebx, esi
jmp 0x475f8c
push edi
call fcn.0047d501
add esp, 4
push dword [ebp - 0x58]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
xor eax, eax
jmp 0x475f8e
Function at 0x4763c0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af756
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x4cfa1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xorps xmm0, xmm0
mov edx, eax
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [ebp - 0x18], edx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x44], 1
mov esi, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x40], 0xa
cmp word [esi], 0
mov dword [ebp - 0x3c], eax
jne 0x4765ac
lea eax, [ecx + edx]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
cmp eax, esi
jne 0x4764a4
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
jmp 0x47653b
sub esi, eax
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x4765d9
mov dword [ebp - 0x1c], 7
cmp esi, 8
jae 0x4764dc
mov dword [ebp - 0x20], esi
add esi, esi
push esi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00499b70
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x30], ax
jmp 0x476538
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x4764ef
mov eax, 0x7ffffffe
jmp 0x4764f6
cmp eax, 0xa
cmovb eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x34], eax
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
lea ecx, [ebp - 0x30]
call fcn.0044bc90
mov edi, eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x34]
add esi, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x18]
push esi
push eax
push edi
mov dword [ebp - 0x30], edi
call fcn.00499b70
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x476575
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
jmp 0x476581
lea ecx, [ebp - 0x30]
push ecx
push eax
mov ecx, edi
call fcn.0047b110
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00446f30
mov eax, dword [ebp - 0x3c]
add esi, 2
mov ecx, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x38], ecx
cmp word [esi], 0
je 0x4765ba
mov edx, dword [ebp - 0x18]
add eax, 2
jmp 0x476462
add esi, 2
add eax, 2
mov dword [ebp - 0x14], esi
jmp 0x476462
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00433610
int3
Function at 0x479580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afd88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4cfa1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
lea eax, [esi + 0x70]
mov dword [esi], 0x4bf4c0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [eax + 8], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 1
lea edi, [esi + 0x10]
mov eax, dword [esi]
push 0
push edi
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004477c0
mov dword [ebp - 4], 4
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00465e30
mov byte [ebp - 4], 5
cmp dword [edi + 0x4c], 0
jne 0x4796dc
push 0x40
push 0x21
push dword [ebp + 8]
call fcn.0049e405
add esp, 0xc
test eax, eax
je 0x4796dc
push 1
push eax
mov ecx, edi
call fcn.004658e0
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x34]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 5
push eax
call fcn.00465b80
add esp, 4
mov ecx, edi
push eax
call fcn.00465780
mov eax, 5
mov dword [ebp - 0x10], eax
and eax, 0xfffffffb
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4796fd
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x4796fd
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
jmp 0x4796fd
mov eax, dword [esi]
push 0
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00434a00
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x489468
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4b389c
push str.FlsAlloc
push 0x1e
call fcn.004892d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48949c
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b1320]
call esi
jmp 0x4894a2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4894e6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x4b38c0
push str.FlsGetValue
push 0x20
call fcn.004892d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48951d
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b1320]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]