joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001040
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._J_API32.DLL___lu_:
lea eax, [esp + 0x10]
push eax
call fcn.10001630
lea eax, [esp + 0x41c]
mov ecx, dword [esp + 0x418]
lea edi, [esp + 0x14]
add esp, 0xc
push eax
push ecx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edi, 0x10009040
lea edx, [esp + ecx + 0xf]
push edx
call fcn.100015c0
add esp, 0xc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 8]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x400
ret

Function at 0x10003f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x10003f1f
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.10001d5b
in eax, dx
jae 0x10003ed5
inc edx
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.10001d5b
cmp ch, cl
imul eax, dword [ecx], 0x8b348b49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10003f48
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10003f48
call fcn.10001d5b
outsd dx, dword [esi]
aad 0xdd
imul ecx, dword [ebx - 0x20fcdba6], 0x66
mov ecx, dword [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.10001d5b
inc dword [eax]
shl byte [edx + 0x875ff43], 1
Function at 0x100066e0
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x1000b040]
push esi
test eax, eax
push edi
push ebp
jne 0x10006728
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 1
push 0
call esi
test eax, eax
je 0x10006708
mov eax, 2
jmp 0x1000672e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10006721
mov eax, 1
jmp 0x1000672e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [0x1000b040], eax
cmp eax, 2
jne 0x10006753
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x1000b040], eax
cmp eax, 1
jne 0x100067ef
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x1000676f
mov edi, dword [0x1000a410]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebp, eax
test ebp, ebp
jne 0x10006790
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
lea eax, [ebp*2]
push eax
call fcn.100046e0
add esp, 4
mov esi, eax
test esi, esi
jne 0x100067ad
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100067e4
mov eax, dword [esp + 0x20]
push 0
push 0
test eax, eax
jne 0x100067f4
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x1000680f
push esi
call fcn.10003f10
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x28]
push eax
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x100067e4
push esi
call fcn.10003f10
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10004500
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001895d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
xor eax, eax
mov dword [ebp - 0x54], vtable.PictureFan::FileStream.0
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0xffffffff
push edi
movups xmmword [ebp - 0x4c], xmm0
mov edi, edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], 0x1003bce0
mov dword [ebp - 0x28], 0x8000
mov dword [ebp - 0x24], eax
push 5
push ecx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], eax
call fcn.1000b3e0
test al, al
jne 0x1000458f
mov esi, 2
jmp 0x1000469b
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10004679
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10004696
mov esi, dword [ebp - 0x20]
cmp esi, 0x10000000
ja 0x10004696
test eax, eax
jne 0x100045fc
test esi, esi
jne 0x10004600
push 2
push esi
mov dword [edi + 4], esi
mov dword [edi + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [edi + 0x18], eax
test eax, eax
jne 0x100045ed
mov esi, 1
jmp 0x1000469b
xor ecx, ecx
xor esi, esi
mov word [eax], cx
mov dword [edi + 0x1c], ecx
jmp 0x1000469b
test esi, esi
je 0x100045e3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100045e3
cmp dword [ebp - 0x24], 0
jbe 0x1000463d
mov ecx, dword [ebp - 0x54]
mov eax, dword [ecx + 0x40]
lea ecx, [ebp - 0x54]
cmp eax, fcn.1000bb60
jne 0x10004634
call fcn.1000bb60
jmp 0x10004636
call eax
test al, al
je 0x10004663
mov eax, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push ecx
push esi
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000465d
xor al, al
jmp 0x10004663
cmp dword [ebp - 0x1c], esi
sete al
test al, al
jne 0x10004680
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, 3
jmp 0x1000469b
mov ecx, dword [ebp - 0x14]
mov edx, esi
push edi
call fcn.10004250
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000469b
jmp 0x1000469b
mov esi, 5
lea ecx, [ebp - 0x54]
call fcn.1000b2e0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000b7b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test edi, edi
je 0x1000b8e0
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1000b8e0
cmp dword [ecx + 0x24], 0
push esi
je 0x1000b899
mov esi, dword [ecx + 0x28]
mov dword [ebp - 0xc], esi
mov edx, dword [ecx + 0x30]
cmp edx, esi
jne 0x1000b7fd
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
call eax
test al, al
je 0x1000b87e
mov ecx, dword [ebp - 4]
jmp 0x1000b876
test edx, edx
jne 0x1000b82c
cmp ebx, esi
jb 0x1000b82c
push edx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edx
push eax
push esi
push edi
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000b87e
mov eax, dword [ebp + 0xc]
sub ebx, eax
cmp eax, esi
jb 0x1000b87e
mov ecx, dword [ebp - 4]
add edi, eax
jmp 0x1000b876
mov eax, esi
mov esi, ebx
sub eax, edx
cmp eax, ebx
cmovb esi, eax
add edx, dword [ecx + 0x24]
cmp edx, 0x10000
jb 0x1000b86c
mov eax, edx
not eax
cmp esi, eax
ja 0x1000b86c
cmp edi, 0x10000
jb 0x1000b86c
mov eax, edi
not eax
cmp esi, eax
ja 0x1000b86c
test esi, esi
je 0x1000b86c
push esi
push edi
push edx
call fcn.1000ddd0
mov ecx, dword [ebp - 4]
add esp, 0xc
add edi, esi
sub ebx, esi
add dword [ecx + 0x30], esi
mov esi, dword [ebp - 0xc]
test ebx, ebx
jne 0x1000b7e2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub ecx, ebx
test ebx, ebx
pop esi
mov dword [eax], ecx
sete cl
pop edi
mov byte [eax + 4], cl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
push ebx
push edi
push dword [ecx + 4]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000b8c8
mov dword [esi], eax
mov byte [esi + 4], al
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
cmp eax, ebx
mov dword [esi], eax
sete al
mov byte [esi + 4], al
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword [eax], 0
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000ba90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, 0xffffffff
jne 0x1000baba
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000bac0
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], 0
je 0x1000bad1
mov eax, dword [ebp + 8]
mov dword [eax], 0
xor al, al
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bb60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
cmp ecx, 0xffffffff
je 0x1000bbda
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1000bbe1
cmp eax, dword [esi + 0x28]
ja 0x1000bbda
push 0
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
push edx
push eax
push dword [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000bbda
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000bbda
mov ecx, dword [esi + 0x30]
sub ecx, eax
mov dword [esi + 0x30], ecx
je 0x1000bbe1
mov edx, dword [esi + 0x24]
lea esi, [edx + eax]
cmp edx, 0x10000
jb 0x1000bbda
or eax, 0xffffffff
sub eax, edx
cmp ecx, eax
ja 0x1000bbda
cmp esi, 0x10000
jb 0x1000bbda
mov eax, esi
not eax
cmp ecx, eax
ja 0x1000bbda
push ecx
push esi
push edx
call fcn.1000ddd0
add esp, 0xc
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000cd85
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x1000cdba
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x1000cdb7
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x1000cdc3
add edx, 0x28
cmp edx, esi
jne 0x1000cda5
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1000cdc0

Function at 0x10010727
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10010766
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010766
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010766
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10010766
cmp dword [ecx + 0x74], 0xe
jbe 0x10010766
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10011fd5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10038eb8
push 0x10038eb0
push str.FlsAlloc
push 0x1f
call fcn.10011ef1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012009
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019254]
call esi
jmp 0x1001200f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012053
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10038ec8
push 0x10038ec0
push str.FlsGetValue
push 0x21
call fcn.10011ef1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001208a
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019254]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10012092
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10038ed0
push 0x10038ec8
push str.FlsSetValue
push 0x22
call fcn.10011ef1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100120cc
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10019254]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10014765
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10014802
push ebx
push esi
call fcn.1001472e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100135ff
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100147af
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014801
push edi
push eax
call fcn.100121f7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100147cf
call fcn.10011b59
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014800
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100135ff
add esp, 0x20
test eax, eax
jne 0x100147ee
push edi
call fcn.10011b59
jmp 0x100147f6
push ebx
call fcn.10011b59
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100185d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100185fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100185fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4043e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b797
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x40448d
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404480
jmp 0x4044db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4044ee
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4044ee
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4044d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404580
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
Function at 0x40cbc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c210
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov ebx, dword [ebp + 0xc]
push 0x20a
push 0
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x224], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x40cc20
mov eax, dword [ebx]
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, eax
mov dword [ebp - 0x240], ecx
test ecx, ecx
je 0x40cdce
cmp ecx, 0x104
ja 0x40cc8c
xor eax, eax
mov dword [esi], 0
lea ecx, [ebp - 0x21c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cc70
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
jmp 0x40cded
lea eax, [ecx + 1]
mov dword [ebp - 0x234], 0
xor edi, edi
mov dword [ebp - 0x220], eax
xor ebx, ebx
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], ebx
test eax, eax
je 0x40cd45
cmp eax, 0x7fffffff
ja 0x40ce12
push eax
lea ecx, [ebp - 0x230]
call fcn.00401c70
mov ecx, dword [ebp - 0x220]
mov edi, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x230], edi
lea edx, [ecx + ecx]
lea ecx, [ebp - 0x234]
mov ax, word [ecx]
lea ebx, [edx + edi]
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], ebx
cmp ax, word [ecx]
mov ecx, dword [ebp - 0x220]
jne 0x40cd26
push edx
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x40cd37
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x240]
mov eax, ebx
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x40cd5a
mov eax, dword [eax]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, edi
mov dword [esi], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cd81
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00404580
test edi, edi
je 0x40cdf4
sub ebx, edi
mov eax, edi
and ebx, 0xfffffffe
cmp ebx, 0x1000
jb 0x40cdc2
mov edi, dword [edi - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40cdc2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebx
push edi
call fcn.004991fe
add esp, 8
jmp 0x40cdf4
xor eax, eax
mov dword [esi], 0
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x4a9810
mov ecx, esi
call fcn.00404580
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
call fcn.00401c60
int3
Function at 0x4102f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c840
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ce4bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
mov dword [ebp - 4], 0
and ecx, 0xfffffffc
xor al, al
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
mov edx, dword [esi + 0x24]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 1
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 8
test ecx, ecx
je 0x41036c
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x41037d
push 0x40
push esi
call fcn.004991fe
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4137c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x41387c
cmp byte [esi + 0x3d], 0
je 0x41387c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41386a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x413831
sub eax, 1
je 0x413835
sub eax, 2
jne 0x41386a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x413853
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x41386a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0049920c
mov esp, ebp
pop ebp
ret

Function at 0x413bd0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cf0d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x28]
mov edi, dword [ebp + 8]
push esi
push eax
call fcn.00411eb0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00413ca0
add esp, 0xc
test eax, eax
jne 0x413c25
xor esi, esi
jmp 0x413c42
cmp dword [esi + 0x14], 8
jb 0x413c2d
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x413c35
mov edi, dword [edi]
push dword [ebp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x413c7e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x413c74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x413c74
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004991fe
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret