joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1009a774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x10a9215e
call fcn.1004081d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10033257
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x1003325e
mov al, 1
jmp 0x10033347
call fcn.10038810
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x7c], eax
call fcn.10038810
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x80]
push edx
call fcn.10038900
add esp, 8
movzx eax, al
test eax, eax
je 0x1003329a
xor al, al
jmp 0x10033347
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 8]
add eax, 0x40
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x38]
call fcn.1003b880
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x100332e2
cmp dword [ebp - 0x84], 1
je 0x100332e9
cmp dword [ebp - 0x84], 3
je 0x10033341
jmp 0x10033345
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x10033318
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x30]
push eax
call fcn.1006208f
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10033318
xor al, al
jmp 0x10033347
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x1003332f
mov dword [ebp - 0x84], 1
jmp 0x10033339
mov dword [ebp - 0x84], 0
mov al, byte [ebp - 0x84]
jmp 0x10033347
mov al, 1
jmp 0x10033347
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004084f
mov esp, ebp
pop ebp
ret

Function at 0x100395a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1009a774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x10a92165
call fcn.1004081d
mov dword [ebp - 8], 0x400
lea eax, [ebp - 8]
push eax
push 0x10a8f790
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, 1
imul eax, eax, 0
add eax, 0x10a8f790
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004084f
mov esp, ebp
pop ebp
ret

Function at 0x10039600
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1009a774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x10a92165
call fcn.1004081d
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x100829c4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 8]
shr eax, 0x10
add eax, dword [ebp - 8]
and eax, 0xffff
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004084f
mov esp, ebp
pop ebp
ret
Function at 0x10039f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1009a774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x10a9215e
call fcn.1004081d
call fcn.10038810
mov dword [ebp - 0x84], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.10038900
add esp, 8
movzx edx, al
test edx, edx
je 0x10039f69
lea eax, [ebp + 8]
push eax
call fcn.10039e40
add esp, 4
jmp 0x1003a10b
mov ecx, dword [ebp - 8]
call fcn.1003a300
test eax, eax
je 0x10039fab
mov ecx, dword [ebp - 8]
call fcn.1003a300
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.10038860
cmp esi, eax
jae 0x10039fab
lea eax, [ebp + 8]
push eax
call fcn.1003b300
add esp, 4
mov bl, al
mov ecx, dword [ebp - 8]
call fcn.10035370
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x1003a10b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
jne 0x10039fbe
call fcn.10038810
jmp 0x1003a10b
mov ecx, dword [ebp - 8]
call fcn.100354d0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x1003a016
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.1003b300
add esp, 4
movzx eax, al
push eax
call fcn.100260f0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1003a000
mov edx, dword [ebp + 8]
mov dword [ebp - 0x88], edx
jmp 0x1003a00b
call fcn.10038810
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
jmp 0x1003a10b
mov dword [ebp - 0xc], 0x20
lea eax, [ebp + 8]
push eax
call fcn.1003b300
add esp, 4
mov byte [ebp - 0x32], al
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x31]
push ecx
lea edx, [ebp - 0x32]
push edx
mov eax, dword [ebp - 8]
add eax, 0x40
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x38]
call fcn.10039ec0
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x1003a106
cmp dword [ebp - 0x88], 1
jle 0x1003a080
cmp dword [ebp - 0x88], 3
je 0x1003a0cd
jmp 0x1003a106
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
sub eax, ecx
mov dword [ebp - 0x40], eax
je 0x1003a0b2
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 1
lea eax, [ebp - 0x30]
push eax
call fcn.1006208f
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x1003a0b2
call fcn.10038810
jmp 0x1003a10b
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 1
lea eax, [ebp - 0x32]
cmp dword [ebp - 0x38], eax
je 0x1003a0c6
mov eax, dword [ebp + 8]
jmp 0x1003a10b
call fcn.10038810
jmp 0x1003a10b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x32]
push edx
call fcn.100260f0
add esp, 8
movzx eax, al
test eax, eax
je 0x1003a0f3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x88], ecx
jmp 0x1003a0fe
call fcn.10038810
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
jmp 0x1003a10b
call fcn.10038810
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004084f
mov esp, ebp
pop ebp
ret 4
Function at 0x1003baf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x10a9215e
call fcn.1004081d
mov eax, 1
test eax, eax
je 0x1003bc23
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x1003bb35
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.1003bc40
jmp 0x1003bc37
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.100341b0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x10], 0
jl 0x1003bbc9
jg 0x1003bb5d
cmp dword [ebp + 0xc], 0
jbe 0x1003bbc9
cmp dword [ebp - 0x10], 0
jl 0x1003bbc9
jg 0x1003bb6b
cmp dword [ebp - 0x14], 0
jbe 0x1003bbc9
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jg 0x1003bb89
jl 0x1003bb7d
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x1003bb89
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.10039760
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10002f90
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.100393f0
cmp dword [ebp + 0x10], 0
jl 0x1003bc13
jg 0x1003bbd7
cmp dword [ebp + 0xc], 0
jbe 0x1003bc13
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x1003bc13
mov ecx, dword [ebp - 4]
call fcn.100354d0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10061a16
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
sbb edx, dword [ebp + 0x10]
jmp 0x1003bc37
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.1003bc40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003bd80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x10a9215e
call fcn.1004081d
mov eax, 1
test eax, eax
je 0x1003beab
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x1003bdc5
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.1003bed0
jmp 0x1003bebf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.10035330
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x10], 0
jl 0x1003be59
jg 0x1003bded
cmp dword [ebp + 0xc], 0
jbe 0x1003be59
cmp dword [ebp - 0x10], 0
jl 0x1003be59
jg 0x1003bdfb
cmp dword [ebp - 0x14], 0
jbe 0x1003be59
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jg 0x1003be19
jl 0x1003be0d
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x1003be19
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1003a300
push eax
call fcn.10002f90
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.1003a2b0
cmp dword [ebp + 0x10], 0
jl 0x1003be9b
jg 0x1003be67
cmp dword [ebp + 0xc], 0
jbe 0x1003be9b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x1003be9b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1006208f
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
sbb edx, dword [ebp + 0x10]
jmp 0x1003bebf
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.1003bed0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003c060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x1009a774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x10a92168
call fcn.1004081d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x1003c198
cmp dword [ebp - 0x2a0], 1
je 0x1003c0a4
jmp 0x1003c1e4
call fcn.1002eba0
test eax, eax
jne 0x1003c11b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10c]
push eax
push str.powershell__Command_Start_Process__s__ArgumentList_blacknull__Verb_runAs
lea ecx, [ebp - 0x210]
push ecx
call fcn.1003c470
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.10060a8c
add esp, 4
push 0
call fcn.1005f886
jmp 0x1003c1e4
push 0
call fcn.1003c560
add esp, 4
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], edx
lea eax, [ebp - 0x218]
push eax
call fcn.1003c3f0
add esp, 4
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 0x14]
add ecx, 0x76c
cmp ecx, 0x7e8
jg 0x1003c16e
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 0x10]
add ecx, 1
cmp ecx, 0xa
jle 0x1003c184
push str.Start_https:__www.facebook.com_bn550
call fcn.10060a8c
add esp, 4
push 0
call fcn.1005f886
jmp 0x1003c196
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x10a8e574], eax
call fcn.1002e090
jmp 0x1003c1e4
mov eax, dword [0x10a8f6f8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x10a8f6f8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [0x10a8e56a]
test eax, eax
je 0x1003c1c1
call dword [sym.imp.KERNEL32.dll_FreeConsole]
cmp dword [0x100d3734], 0
je 0x1003c1df
mov ecx, dword [0x100d3734]
call fcn.1002bc30
mov dword [0x100d3734], 0
call fcn.10002590
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004084f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003ef7f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1009a774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x1003efa4
xor eax, eax
jmp 0x1003f000
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x1003efd1
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x1003efd1
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x1003f085
cmp dword [edi + 0x4c], 0
je 0x1003effa
mov ecx, edi
call fcn.1003e9c9
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x1003f010
push dword [edi + 0x4c]
push ebx
call fcn.1003e20c
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x1003efff
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1004084f
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x10080344]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x1003effa
cmp eax, 1
jle 0x1003f058
cmp eax, 3
jne 0x1003effa
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x1003efec
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x1003f075
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.1006208f
add esp, 0x10
cmp esi, eax
jne 0x1003effa
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x1003effa
mov ax, bx
jmp 0x1003efff

Function at 0x10043c69
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100706ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100703ad

Function at 0x100706f5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007052e

Function at 0x10075783
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10075443
Function at 0x4019be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ecx + 0x3c]
mov esi, ecx
mov dword [esp + 4], edx
mov eax, dword [eax + ecx + 0x78]
mov edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov ecx, dword [eax + ecx + 0x1c]
add edi, esi
add ebx, esi
mov dword [esp], ecx
mov ebp, dword [edi]
add ebp, esi
push ebp
call fcn.0041be90
pop ecx
inc eax
lea ecx, [esp + 8]
mov edx, ebp
push eax
call fcn.0040893a
pop eax
cmp dword [esp + 8], 1
je 0x401a35
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
call fcn.00404aec
cmp eax, dword [esp + 4]
je 0x401a20
add edi, 4
add ebx, 2
jmp 0x4019e5
mov ecx, dword [esp]
movzx eax, word [ebx]
add ecx, esi
add esi, dword [ecx + eax*4]
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0xc]
lea eax, [esp + 0x14]
movsd qword [eax], xmm0
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x4273f0
push 0x42721c
push eax
call fcn.0042605f
int3
Function at 0x4054f0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, esp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], esp
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0x417600
lea eax, [esi + 0x60]
mov ecx, dword fs:[0]
mov dword [esi + 0x60], ecx
mov dword fs:[0], eax
push 0x412ad9
push 0
call dword [sym.imp.kernel32.dll_AddVectoredExceptionHandler]
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], 0x5000
push eax
call dword [sym.imp.kernel32.dll_SetThreadStackGuarantee]
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov ecx, dword [0x437054]
push 0x42f214
push eax
call ecx
lea ecx, [esi + 0x3c]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x68], 0
call fcn.00411d8d
movsd xmm0, qword [eax + 8]
mov ebx, eax
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x30], eax
movsd qword [esi + 0x18], xmm0
mov eax, dword [0x437a10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
movzx eax, byte [eax + 0x34]
test eax, eax
je 0x4055cb
cmp eax, 1
je 0x405611
lea ecx, [esi + 0x2c]
call fcn.00411d38
lea eax, [esi + 4]
mov ecx, 0x42dd93
mov edx, 0x46
push 0x42de50
push 0x42d948
push eax
call fcn.0042605f
add esp, 0xc
ud2
mov dword [esi + 8], ebx
mov byte [esi + 3], 1
mov dword [esi + 0x68], 1
mov edx, 0x411f0b
mov eax, dword [0x437a10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0x30]
call fcn.00411f18
mov eax, dword [0x437a10]
mov ecx, dword fs:[0x2c]
mov ebx, dword [esi + 8]
mov eax, dword [ecx + eax*4]
mov byte [eax + 0x34], 1
mov eax, dword [0x437a10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
cmp dword [eax + 0x30], 0
jne 0x4056a2
mov eax, dword [0x437a10]
mov ecx, dword fs:[0x2c]
mov edi, dword [ecx + eax*4]
lea ecx, [edi + 0x30]
call fcn.00411d83
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [edi + 0x30], ebx
mov dword [esi + 0xc], 0
mov dword [edi + 0x2c], ecx
lea ecx, [esi + 0xc]
mov dword [edi + 0x28], eax
call fcn.00411d83
mov ecx, 0x401a5c
mov dword [esi + 0x68], 7
call fcn.0040110d
mov dword [esi + 8], 0
mov dword [esi + 0x68], 0xe
call fcn.00412510
mov eax, dword [esi + 0x60]
mov dword fs:[0], eax
mov eax, dword [esi + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [esi + 0x3c]
lea eax, [esi + 4]
mov dword [esi + 0x10], 0
mov dword [esi + 0x3c], 0x42df24
mov dword [esi + 0x40], 1
mov dword [esi + 0x4c], 0
mov dword [esi + 0xc], ebx
mov byte [esi + 0x14], 0
mov dword [esi + 0x68], 2
lea ecx, [esi + 0x34]
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
lea eax, [esi + 0x10]
push edx
push eax
push ecx
call fcn.00411786
add esp, 0xc
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x38]
call fcn.00411204
mov ecx, 7
int 0x29
ud2
Function at 0x40beb5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ecx + 0x3c]
mov esi, ecx
mov dword [esp + 4], edx
mov eax, dword [eax + ecx + 0x78]
mov edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov ecx, dword [eax + ecx + 0x1c]
add edi, esi
add ebx, esi
mov dword [esp], ecx
mov ecx, dword [edi]
add ecx, esi
call fcn.0040bf59
mov ebp, edx
lea ecx, [esp + 8]
mov edx, eax
push ebp
call fcn.0040893a
pop eax
cmp dword [esp + 8], 1
je 0x40bf33
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push dword [esp + 0x30]
push dword [esp + 8]
call fcn.0041475e
pop ecx
pop edx
test al, al
jne 0x40bf1e
add edi, 4
add ebx, 2
jmp 0x40bedc
mov ecx, dword [esp]
movzx eax, word [ebx]
add ecx, esi
add esi, dword [ecx + eax*4]
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0xc]
lea eax, [esp + 0x14]
movsd qword [eax], xmm0
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x42cdf4
push 0x42cc48
push eax
call fcn.0042605f
Function at 0x414e8a
Capabilities:
Terminate process

Disassembly:
call fcn.00412510
call 0x414e94
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x418097
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x4180d6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4180d6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4180d6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4180d6
cmp dword [ecx + 0x74], 0xe
jbe 0x4180d6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41f2e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41f383
push ebx
push esi
call fcn.0041f2af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041f1f8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41f330
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f382
push edi
push eax
call fcn.0041fee6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41f350
call fcn.0041de21
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f381
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041f1f8
add esp, 0x20
test eax, eax
jne 0x41f36f
push edi
call fcn.0041de21
jmp 0x41f377
push ebx
call fcn.0041de21
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x420669
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431a70
push 0x431a68
push str.FlsAlloc
push 0x1e
call fcn.0042052a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42069d
push dword [ebp + 8]
mov ecx, esi
call dword [0x42715c]
call esi
jmp 0x4206a3
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4206e7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431a80
push 0x431a78
push str.FlsGetValue
push 0x20
call fcn.0042052a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42071e
push dword [ebp + 8]
mov ecx, esi
call dword [0x42715c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]
Function at 0x425ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425bcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425bcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret