joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028a0
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x404458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x4072dc
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], esi
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esi + 0x44c]
mov dword [esp + 0x44], 0
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4028ed
call dword [sym.imp.MSVCRT.dll__getdrive]
jmp 0x402900
movsx eax, byte [eax]
cmp eax, 0x61
jl 0x4028fd
cmp eax, 0x7a
jg 0x4028fd
sub eax, 0x20
sub eax, 0x40
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x424]
push 0
push 0
push 0x14b
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, 3
push ebp
call dword [sym.imp.MSVCRT.dll__chdrive]
add esp, 4
test eax, eax
jne 0x402a35
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x402a35
lea ebx, [ebp + 0x40]
xor ecx, ecx
push ebx
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ecx
push 0x407068
push edx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x407064
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jle 0x402a35
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
test edx, edx
ja 0x4029da
jb 0x4029c5
cmp eax, 0x64
ja 0x4029da
push ebx
lea ecx, [esp + 0x18]
push str._c:_
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
jmp 0x4029f9
mov ecx, 0x14
call fcn.00403f70
push edx
push eax
push ebx
lea edx, [esp + 0x20]
push 0x407040
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push 0
mov edx, dword [ecx + 0x424]
push 0x143
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x10], ebp
jne 0x402a35
push 0
push eax
mov eax, dword [esp + 0x20]
push 0x14e
mov ecx, dword [eax + 0x424]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
inc ebp
cmp ebp, 0x1a
jle 0x40291f
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov edx, dword [eax + 0x44c]
pop ebx
mov ecx, dword [edx - 8]
test ecx, ecx
je 0x402a71
mov eax, dword [eax + 0x458]
movsx eax, byte [eax]
cmp eax, 0x61
jl 0x402a6a
cmp eax, 0x7a
jg 0x402a6a
sub eax, 0x20
sub eax, 0x40
mov dword [esp], eax
mov ecx, dword [esp]
push ecx
call dword [sym.imp.MSVCRT.dll__chdrive]
add esp, 4
lea ecx, [esp + 4]
mov dword [esp + 0x34], 0xffffffff
call fcn.00403cf4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x403510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40ccf0
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x4035a0
jmp 0x40358e
jbe 0x403634
cmp esi, 0x201
jae 0x4035a0
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x448]
mov edi, esi
jmp 0x4035db
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x4035cc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.00426af0
add esp, 4
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4035ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x403697
cmp esi, edi
jne 0x403580
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4036b6
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x40358e
jmp 0x4035a0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x4036d3
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.00405820
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x403681
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.004010b0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x403671
jmp 0x403681
mov dword [ebp - 0x10], 0
push 0x429dcc
push 0x28
push str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
call fcn.00427580
add esp, 0xc
jmp 0x4036e2
push 0x429dbc
push eax
push esi
call fcn.00427900
add esp, 0xc
ud2
Function at 0x40a040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x40a084
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x40a08a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x40a0c6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x40a0eb
test eax, eax
js 0x40a0d5
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x40a0e1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x42989c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.00405430
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00401a70
mov ecx, 7
int 0x29
ud2
Function at 0x40b220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40cf80
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x434a6c]
test al, al
je 0x40b3f1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40b26c
cmp eax, 3
jne 0x40b3ea
mov ebx, dword [0x434a70]
test ebx, ebx
je 0x40b3ea
mov dword [ebp - 0x20], 0
jmp 0x40b297
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40b2c8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40b43b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40b290
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40b290
test byte [ebp - 0x20], 1
je 0x40b3ea
mov ebx, dword [0x434a70]
test ebx, ebx
je 0x40b3ea
mov dword [ebp - 0x20], 0
jmp 0x40b2f7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40b328
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40b43b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40b2f0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40b2f0
test byte [ebp - 0x20], 1
je 0x40b3ea
mov ebx, dword [0x434a70]
test ebx, ebx
je 0x40b3ea
mov dword [ebp - 0x20], 0
jmp 0x40b357
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40b388
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40b43b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40b350
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40b350
test byte [ebp - 0x20], 1
je 0x40b3ea
mov ebx, dword [0x434a70]
test ebx, ebx
je 0x40b3ea
mov dword [ebp - 0x20], 0
jmp 0x40b3b7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40b3e4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40b43b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40b3b0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40b3b0
test byte [ebp - 0x20], 1
jne 0x40b404
movzx eax, byte [0x430d80]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x434a70]
jmp 0x40b40f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40b3ea
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40b43b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40b40c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x40b40c
mov dword [ebp - 0x10], 0
push 0x429d10
push 0x2b
push 0x4282c0
call fcn.00427580
add esp, 0xc
ud2
Function at 0x40c7d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x434038]
mov esi, ecx
test eax, eax
je 0x40c7f6
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40c80f
cmp dword [eax + 4], 0
je 0x40c80f
add eax, 8
pop esi
pop edi
ret
push 0x434038
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40c7ea
mov eax, dword [0x434038]
test eax, eax
je 0x40c8a6
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40c8c3
mov edi, eax
test eax, eax
jne 0x40c86f
movzx eax, byte [0x4349f9]
push 4
push 0x10
call fcn.004010a0
add esp, 8
test eax, eax
je 0x40c8d7
mov dword [eax], 0x434038
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x434038]
test eax, eax
je 0x40c8c8
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40c88f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x40c893
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x40c893
xor ecx, ecx
xor edx, edx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x434038
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40c82d
xor eax, eax
pop esi
pop edi
ret
push 0x434038
call fcn.00426e20
add esp, 4
jmp 0x40c867
push 0x10
push 4
call fcn.004273e0

Function at 0x40c8e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x434048]
mov esi, ecx
test eax, eax
je 0x40c9ba
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40c90d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x40c9b5
mov eax, dword [0x434048]
test eax, eax
je 0x40c9dc
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40c9f9
mov edi, eax
test eax, eax
jne 0x40c971
movzx eax, byte [0x4349f9]
push 4
push 0xc
call fcn.004010a0
add esp, 8
test eax, eax
je 0x40ca15
mov dword [eax], 0x434048
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x434048]
test eax, eax
je 0x40ca03
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40c986
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x40c988
mov eax, dword [esi + 4]
jmp 0x40c988
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x40c9b5
test ecx, ecx
je 0x40c9b5
lock dec dword [ecx]
jne 0x40c9b5
lea ecx, [esp + 4]
call fcn.00402690
add edi, 8
jmp 0x40c9fb
push 0x434048
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40c901
jmp 0x40c90d
push 0x434048
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40c92b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x434048
call fcn.00426e20
add esp, 4
jmp 0x40c969
push 0xc
push 4
call fcn.004273e0
int3
Function at 0x40ca20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x434058]
mov esi, ecx
test eax, eax
je 0x40ca46
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40ca5f
cmp byte [eax + 4], 0
je 0x40ca5f
add eax, 5
pop esi
pop edi
ret
push 0x434058
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40ca3a
mov eax, dword [0x434058]
test eax, eax
je 0x40cad2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40caeb
mov edi, eax
test eax, eax
jne 0x40cab0
movzx eax, byte [0x4349f9]
push 4
push 8
call fcn.004010a0
add esp, 8
test eax, eax
je 0x40caff
mov dword [eax], 0x434058
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x434058]
test eax, eax
je 0x40caf0
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x40cac5
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [edi + 5]
mov byte [edi + 4], 1
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x434058
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40ca75
xor eax, eax
pop esi
pop edi
ret
push 0x434058
call fcn.00426e20
add esp, 4
jmp 0x40caa8
push 8
push 4
call fcn.004273e0
int3

Function at 0x40cb10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x434068]
mov esi, ecx
test eax, eax
je 0x40cbea
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40cb3d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x40cbe5
mov eax, dword [0x434068]
test eax, eax
je 0x40cc0c
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40cc29
mov edi, eax
test eax, eax
jne 0x40cba1
movzx eax, byte [0x4349f9]
push 4
push 0xc
call fcn.004010a0
add esp, 8
test eax, eax
je 0x40cc45
mov dword [eax], 0x434068
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x434068]
test eax, eax
je 0x40cc33
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40cbb6
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x40cbb8
mov eax, dword [esi + 4]
jmp 0x40cbb8
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x40cbe5
test ecx, ecx
je 0x40cbe5
lock dec dword [ecx]
jne 0x40cbe5
lea ecx, [esp + 4]
call fcn.00402630
add edi, 8
jmp 0x40cc2b
push 0x434068
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40cb31
jmp 0x40cb3d
push 0x434068
call fcn.00426e20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40cb5b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x434068
call fcn.00426e20
add esp, 4
jmp 0x40cb99
push 0xc
push 4
call fcn.004273e0
int3
Function at 0x4176e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x417738
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x417730
cmp ebx, ebp
ja 0x4177ad
cmp ebp, dword [esp + 0x1c]
ja 0x4177b9
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x417732
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x417720
jmp 0x41778f
ja 0x417738
cmp edx, edi
mov ebx, ebp
jne 0x4176f5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x417793
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x417770
mov esi, edi
sub ecx, ebx
jns 0x417787
jmp 0x417795
cmp edi, edx
je 0x41779c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x417795
xor al, 1
cmp esi, edx
jne 0x417750
jmp 0x417795
xor eax, eax
jmp 0x417795
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x42b628
push 0x2b
push 0x42aecb
call fcn.00427580
push 0x42b638
push ebp
push ebx
call fcn.00427970
push 0x42b638
push dword [esp + 0x20]
push ebp
call fcn.00427900
int3

Function at 0x418b91
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x418bd0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418bd0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418bd0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x418bd0
cmp dword [ecx + 0x74], 0xe
jbe 0x418bd0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41fe43
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41fee0
push ebx
push esi
call fcn.0041fe0c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041fda0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41fe8d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fedf
push edi
push eax
call fcn.00420a60
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41fead
call fcn.0041e901
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fede
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041fda0
add esp, 0x20
test eax, eax
jne 0x41fecc
push edi
call fcn.0041e901
jmp 0x41fed4
push ebx
call fcn.0041e901
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4211dd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42df28
push 0x42df20
push str.FlsAlloc
push 0x1f
call fcn.0042109c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x421211
push dword [ebp + 8]
mov ecx, esi
call dword [0x428168]
call esi
jmp 0x421217
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42125b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42df38
push 0x42df30
push str.FlsGetValue
push 0x21
call fcn.0042109c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x421292
push dword [ebp + 8]
mov ecx, esi
call dword [0x428168]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42129a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42df40
push 0x42df38
push str.FlsSetValue
push 0x22
call fcn.0042109c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4212d4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x428168]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x426740
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42676d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42676d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x426e20
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x426ea1
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x426edc
cmp dword [esp + 4], 0
je 0x426ec3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x426efa
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x434a70]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x434a70], edi
jne 0x426e80
mov byte [0x434a6c], 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x426ed3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x426f3c
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x426ec7
mov esi, dword [esp]
jmp 0x426ed3
mov esi, dword [edi]
jmp 0x426ed2
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x429c8c
push 0x429cec
push eax
call fcn.00426a00
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 8], 0x429ca4
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x4282ec
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x429cdc
push eax
call fcn.004274a0
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x429ca4
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x4282ec
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004269d0
int3
Function at 0x427690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x4276e1
cmp eax, 1
jne 0x42775e
mov dword [esp], 0x42b08c
jmp 0x4276e8
mov dword [esp], 0x42b08a
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x42777a
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x42b0c8
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x418280
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x418260
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x418260
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.004274a0
mov edx, 7
mov dword [esp], 0x42b08e
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x4276fd
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x42b0fc
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x418280
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x415390
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x418260
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x418260
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.004274a0
int3