joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, edx
mov ebx, ecx
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x431977
mov eax, dword [0x53ef48]
cmp eax, 0xffffffff
je 0x431a04
mov ebx, 0x100000
test eax, eax
jne 0x431977
mov ebx, 0x80000
push 0x10
call fcn.0049a900
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x543db4]
bt ecx, eax
jae 0x4319f6
push edi
call fcn.00468b00
add esp, 4
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x431d80
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x431aa5
test edi, edi
je 0x431a28
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x54bdb4], 1
jmp 0x4319a2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x53ef48
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x431b0b
mov eax, dword [0x53ef48]
jmp 0x431969
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x4319dd
mov eax, dword [0x54c5c4]
mov ecx, dword [0x540070]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x431b1a
lea ebx, [ebp - 0x24]
push edi
push ebx
call fcn.0042f0b0
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
js 0x431a70
and eax, 0x7f
jmp 0x431a76
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
lea edi, [ebp - 0x18]
mov ecx, edi
push eax
push ebx
call fcn.004530e0
push dword [edi + 4]
push dword [edi]
push dword [0x54c5c0]
call fcn.00431f20
add esp, 0xc
cmp byte [ebp - 0x19], 0
jns 0x431ace
push dword [ebp - 0x24]
call fcn.0049a930
jmp 0x431acb
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x431ac5
mov edi, eax
cmp eax, 0x5af
je 0x431ac5
cmp edi, 0xe
jne 0x431a35
push ebx
call fcn.004deca0
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x28]
je 0x4319dd
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x543db4]
bt edx, ecx
jae 0x431afa
push eax
call fcn.00468c00
add esp, 4
push esi
call fcn.0049a930
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x4319dd
mov dword [0x53ef48], 0
jmp 0x431972
push 0x54c5c4
call fcn.0049a9a7
add esp, 4
cmp dword [0x54c5c4], 0xffffffff
jne 0x431a56
push 0x20
push str.create_thread_last_error
call fcn.00431ee0
add esp, 8
mov dword [0x54c5c0], eax
push 0x54c5c4
call fcn.0049aa1d
add esp, 4
jmp 0x431a56
Function at 0x432120
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x220]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
test eax, eax
js 0x43226d
mov dword [ebp - 0x224], eax
mov ebx, 0xff
mov edi, 0x54c9d2
push ebx
push dword [ebp - 0x21c]
push edi
call fcn.004b3a5b
add esp, 0xc
push edi
call fcn.004b3661
add esp, 4
sub ebx, eax
push ebx
push 0x524fd8
push edi
call fcn.004b3a5b
add esp, 0xc
push esi
call sub.ntdll.dll_RtlFreeUnicodeString
lea esi, [ebp - 0x218]
push 0x208
push 0
push esi
call fcn.0049e890
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push 0x104
push esi
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x4321df
push eax
push esi
push edi
call fcn.004b3aa0
add esp, 0xc
test eax, eax
je 0x432289
push 0x104
push esi
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x43220a
push eax
push esi
push edi
call fcn.004b3aa0
add esp, 0xc
test eax, eax
je 0x432289
xor eax, eax
mov byte [0x54c5d1], al
mov dword [ebp - 0x218], 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x52d978
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432290
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov ecx, edi
call dword [section..00cfg]
push esi
push ebx
call edi
test eax, eax
je 0x432290
cmp dword [ebp - 0x218], 0
setne cl
mov eax, dword [ebp - 0x224]
mov byte [0x54cbd2], cl
mov byte [0x54c5d0], 1
test eax, eax
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x43220c
xor ecx, ecx
jmp 0x43225a
Function at 0x432520
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x432545
mov eax, dword [ecx + 4]
test eax, eax
je 0x432605
bt ebx, 8
jae 0x432560
mov eax, ebx
and eax, 0x200
jne 0x432605
cmp edi, 2
mov eax, 0x54c5d2
mov ecx, 0x54c7d2
cmove ecx, eax
cmp word [ecx], 0
jne 0x432605
xorps xmm0, xmm0
lea esi, [ebp - 0x34]
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x432605
cmp byte [0x54cbd2], 0
setne al
bt ebx, 8
jb 0x432605
shr ebx, 9
and ebx, 1
or bl, al
je 0x432605
cmp edi, 2
mov eax, 0x52d9bc
mov edx, 0x52d9d0
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x4326a5
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
xor esi, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
jmp 0x432620
cmp dword [ebp - 0x44], 0
jne 0x4326af
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
add edx, 0x14
inc esi
cmp esi, dword [ebp - 0x4c]
jae 0x4325fb
mov edi, dword [edx + 4]
mov ebx, eax
sub ebx, edi
jb 0x432617
push edi
push dword [edx]
push dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], eax
call fcn.004af4c1
mov edx, dword [ebp - 0x50]
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0x48]
jne 0x432617
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + edi*2]
mov eax, dword [ebp - 0x48]
cmp ecx, 0x5c
jne 0x4326d2
mov eax, dword [ebp - 0x38]
lea eax, [eax + edi*2]
mov esi, dword [edx + 8]
cmp esi, 2
je 0x43266b
cmp esi, 1
jne 0x432675
jmp 0x4326df
mov dword [ebp - 0x40], str.WOW6432Node
mov dword [ebp - 0x3c], eax
cmp cx, 0x5c
mov dword [ebp - 0x44], esi
jne 0x4326a0
lea ecx, [eax + 2]
dec ebx
cmp word [eax + 2], 0x5c
mov dword [ebp - 0x38], ecx
mov eax, ecx
je 0x43267e
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x4c], eax
mov edx, dword [edx + 0xc]
xor esi, esi
mov eax, ebx
jmp 0x43261b
mov dword [ebp - 0x38], eax
jmp 0x43268e
mov dword [ebp - 0x38], eax
mov eax, ecx
jmp 0x4325dc
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
jns 0x4326ba
mov eax, dword [eax]
mov edx, dword [ebp - 0x3c]
sub edx, eax
sar edx, 1
mov ecx, dword [ebp + 8]
push dword [ebp - 0x40]
push edx
call fcn.004d93f0
jmp 0x432605
test ecx, ecx
jne 0x432617
jmp 0x432656
mov dword [ebp - 0x40], str.WOW6432Node_
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edi
jmp 0x432675
Function at 0x435bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x435c63
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x435c4d
cmp dword [ebp - 0x18], 4
jne 0x435c4d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x435c4d

Function at 0x435c70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.0049bdb0
mov esi, ecx
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.0049e890
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x435cff
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x435d03
mov ecx, esi
push edi
call fcn.0041fe30
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x435ce6
cmp eax, 2
jne 0x435d45
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.0049e890
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x435d4c
mov ecx, esi
push ebx
jmp 0x435cdf
mov esi, 0x3f4
jmp 0x435ce6
mov esi, 0xea
jmp 0x435ce6
Function at 0x438740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [edx + 4]
test eax, eax
je 0x438899
mov edi, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx]
xor edx, edx
xor esi, esi
or esi, dword [ecx + edx*4]
inc edx
cmp eax, edx
jne 0x43875f
test esi, esi
mov esi, dword [ebp - 0x10]
je 0x438899
test eax, eax
jle 0x4388d5
mov ecx, dword [edi]
test byte [ecx], 1
je 0x4388d5
cmp dword [edi + 0xc], 0
jne 0x438919
cmp eax, 0x801
jae 0x4388f1
lea ebx, [esi + 0x14]
cmp ebx, edi
je 0x4387dc
push eax
push ebx
call fcn.00437100
add esp, 8
test eax, eax
je 0x4388e3
mov eax, dword [edi + 4]
lea ecx, [eax*4]
test ecx, ecx
je 0x4387d1
push ecx
push dword [edi]
push dword [ebx]
call fcn.0049e310
add esp, 0xc
mov eax, dword [edi + 4]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x20], eax
mov edi, ebx
test edi, edi
je 0x4388e3
mov eax, dword [esi + 0x18]
test eax, eax
jle 0x4388b5
mov ecx, dword [ebx]
cmp dword [ecx + eax*4 - 4], 0
jne 0x438807
lea edx, [eax - 1]
cmp eax, 1
mov eax, edx
jg 0x4387f1
jmp 0x4388b9
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
cmp eax, 2
jb 0x4388ce
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
xor eax, eax
xor esi, esi
inc esi
mov edi, 0x40
mov dword [ebp - 0x18], 0
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edi
and esi, 1
neg esi
mov edi, 0
sbb edi, edi
mov edx, ecx
and edx, edi
and esi, dword [ebp - 0x1c]
mov ecx, edx
xor ecx, eax
and edx, eax
mov eax, esi
xor eax, dword [ebp - 0x14]
and esi, dword [ebp - 0x14]
shrd eax, ecx, 1
shr ecx, 1
add esi, eax
adc edx, ecx
mov ecx, dword [ebp - 0x20]
and edi, 0x80000000
shrd dword [ebp - 0x18], ebx, 1
shr ebx, 1
or ebx, edi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x14], esi
mov eax, edx
dec edi
jne 0x438837
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ebx
xor eax, eax
inc eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xaa
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x69
push 0
push 3
call fcn.00501490
add esp, 0x14
xor eax, eax
jmp 0x438891
jne 0x4388ca
jmp 0x4388c0
mov dword [esi + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
mov eax, dword [ebx]
mov edx, dword [eax]
xor ecx, ecx
jmp 0x43881b
push 0xae
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x68
jmp 0x4388a5
push 0xbc
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x44
jmp 0x4388a5
xor edx, edx
mov esi, 0x800
or edx, dword [ecx + esi*4]
inc esi
cmp eax, esi
jne 0x4388f8
test edx, edx
mov esi, dword [ebp - 0x10]
je 0x43879a
push 0xb6
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x66
jmp 0x4388a5
push 0xb2
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x6d
jmp 0x4388a5
Function at 0x43a5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x43a722
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [section..00cfg]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x43a6c1
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x43a6b5
lea edi, [esi + 0xf4]
push 1
call fcn.00471690
add esp, 4
bt eax, 0x19
jae 0x43a726
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403380
add esp, 0xc
mov ecx, section..text
mov eax, 0x401b90
test edi, edi
lea edx, [ebp - 0x20]
mov ebx, dword [ebp - 0x44]
je 0x43a6ff
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edx]
movups xmmword [ebx], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x43a70e
bt eax, 9
jae 0x43a747
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x43a6f3
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.004e4f20
add esp, 0xc
mov ecx, 0x4e4e30
mov eax, 0x4e56b0
jmp 0x43a6f3
Function at 0x43bfa0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x43bfb9
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x43bfd1
cmp byte [esi + 0x28], 0
jne 0x43c042
or ebx, 0x20000000
test bl, 8
jne 0x43c04a
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x43bfeb
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x43bff9
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 0
jne 0x43c09c
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x43c0b2
test ecx, ecx
jne 0x43c06f
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x43c066
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x43bfd1
cmp byte [esi + 0x34], 0
je 0x43c05b
or ebx, 0x40000000
jmp 0x43bfd6
or ebx, 0x10000000
jmp 0x43bfd6
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43c033
cmp ecx, 4
jne 0x43c07b
mov ecx, 6
jmp 0x43c01c
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x43c08c
mov ecx, 7
jmp 0x43c01c
cmp esi, 1
jne 0x43c098
mov ecx, 4
jmp 0x43c01c
xor ecx, ecx
jmp 0x43c01c
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.004216c0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x43c006
mov ecx, esi
mov esi, edx
call fcn.004216c0
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x43c015
Function at 0x43c0d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x43c0fa
cmp byte [esi + 0x28], 0
jne 0x43c180
or ebx, 0x20000000
test bl, 8
jne 0x43c18b
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x43c113
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x43c121
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 0
jne 0x43c1a7
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x43c1bd
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x43c16f
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x43c1b4
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x43c1cd
mov edx, 7
jmp 0x43c149
or ebx, 0x80000000
jmp 0x43c0fa
cmp byte [esi + 0x34], 0
je 0x43c19c
or ebx, 0x40000000
jmp 0x43c103
or ebx, 0x10000000
jmp 0x43c103
lea ecx, [esi + 0x10]
call fcn.004216c0
jmp 0x43c12a
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43c160
mov ecx, esi
mov esi, edx
call fcn.004216c0
mov edx, esi
jmp 0x43c13c
test esi, esi
jne 0x43c1d9
xor edx, edx
inc edx
jmp 0x43c149
mov edx, esi
cmp esi, 1
jne 0x43c1ea
mov edx, 4
jmp 0x43c149
xor edx, edx
jmp 0x43c149
Function at 0x43cb40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.00460760
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x43cb6e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x43cb8c
push dword [ebp - 0x1c]
call fcn.0049a930
add esp, 4
cmp dword [ebp + 8], 0
je 0x43cc25
test esi, esi
je 0x43cc25
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.0049a963
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.00460760
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x43cbcf
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x43cbe9
push dword [ebp - 0x1c]
call fcn.0049a930
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x43cc4a
push edi
call fcn.004b3661
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.00460790
add esp, 0xc
cmp byte [ebx + 0xb], 0
js 0x43cc3e
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.0049a96c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b483
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebx]
call fcn.0049a930
add esp, 4
jmp 0x43cc0d
push str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
push str.__s___nullptr
push 0x109
push str....._third_partylibc_srcinclude_string_view
push str._s:_d:_assertion__s_failed:__s_n
call fcn.004c59e0
int3
Function at 0x43d020
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [0x53d010]
xor eax, ebp
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x43d21c
cmp dword [0x53efc8], 0xe69e32f3
jne 0x43d21f
mov esi, 0x308
mov edx, 0x20
mov edi, 0x20
add esi, dword [ecx + 8]
mov byte [esp + 0xf], 0xff
mov al, byte [ecx + 2]
je 0x43d074
bsr edi, esi
xor edi, 0x1f
mov ecx, 0x52fff8
sub ecx, edi
mov cl, byte [ecx]
mov ebx, esi
shr ebx, cl
sub edx, edi
and ebx, 7
lea ecx, [ebx + edx*8]
mov edx, dword [edx*4 + 0x52fffc]
and edx, esi
cmp edx, 1
mov edx, dword [ebp + 8]
lea edi, [edx + 0x48]
sbb ecx, 0xffffffff
movzx ecx, word [ecx + ecx + 0x52fdc4]
test al, al
mov dword [esp], esi
jne 0x43d0c3
cmp esi, 0x41
setae al
cmp cx, 0x76
setb dl
and dl, al
movzx eax, dl
or eax, ecx
mov ecx, eax
movzx ebx, cx
shl ebx, 5
mov dword [esp + 4], edi
lea esi, [edi + ebx]
mov eax, dword [ebp + 8]
lea edi, [eax + 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x43d1c0
mov dword [esp + 8], edi
mov eax, dword [esi]
mov edi, dword [eax]
test edi, edi
je 0x43d1cc
mov byte [esp + 0xf], 0
mov edx, dword [edi]
test edx, edx
je 0x43d1b9
mov ecx, dword [esp + 4]
mov ebx, dword [ecx + ebx + 0xc]
mov ecx, edx
bswap ecx
mov esi, ecx
xor esi, edi
cmp esi, 0x1fffff
ja 0x43d222
mov esi, ecx
and esi, 0x1fc000
je 0x43d222
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov esi, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0x117c]
add ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x1180]
mov dword [esi + 0x117c], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [esi + 0x1180], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, edi
push esi
call fcn.00473c90
push edi
push dword [0x551fb0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x540070]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0xac], edi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.0049b483
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
jmp 0x43d131
mov ecx, edi
call fcn.00474570
jmp 0x43d0e5
lea eax, [esp + 0xf]
mov ecx, esi
push eax
push 0x4000
push dword [esp + 8]
push 2
mov esi, dword [ebp + 8]
push esi
call fcn.00475950
test eax, eax
je 0x43d24c
mov edi, eax
and eax, 0xffe00000
mov ecx, edi
shr ecx, 9
and ecx, 0x1fe0
or ecx, eax
mov eax, ecx
or eax, 0x1000
or ecx, 0x101e
movzx ecx, byte [ecx]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
jmp 0x43d14d
int3
int3
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi], xmm0
mov ecx, esi
push 0
push edx
push str.first
call fcn.004e3790
push esi
call fcn.004106c0
add esp, 4
push ebx
call fcn.00500b30
xor edi, edi
jmp 0x43d170