joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004e90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
call fcn.100043d0
mov esi, eax
mov dword [eax + 4], edi
push dword [eax + 0xb4]
call fcn.10004c20
add esp, 4
test byte [esi + 0x20], 0x30
jne 0x10004ec0
add esi, 0x70
push 1
push esi
call dword [sym.imp.msvcrt.dll_longjmp]
push dword [0x1007f01c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10004f48
mov esi, eax
cmp dword [eax + 0x14], 0
jne 0x10004ef8
mov dword [esi], 0xdeadbeef
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10004eec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov edi, dword [esi + 4]
jmp 0x10004f33
mov edi, dword [esi + 4]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x68], 1
test eax, eax
je 0x10004f10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
test byte [esi + 0x24], 4
je 0x10004f48
mov dword [esi], 0xdeadbeef
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
mov ecx, esi
call fcn.10004f50
push 0
push dword [0x1007f01c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
call dword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x100094ea
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
push edi
push esi
nop
mov al, byte [0x100802d0]
test al, al
je 0x1000962f
mov ecx, 0x10083460
call fcn.1001b7a0
push 0x1d4
push 0x50ab34
push 0x370
push 0x10083460
call fcn.100077cc
add esp, 0x10
nop
mov al, byte [0x100802d8]
test al, al
je 0x10009690
mov ecx, 0x10083490
call fcn.1001b7ea
push 0x5f94
push 0x3aef2
push 0x6e8
push 0x10083490
call fcn.100077cc
add esp, 0x10
nop
mov al, byte [0x100802e0]
test al, al
je 0x100096e2
mov ecx, 0x100834b0
call fcn.1001b7a0
push 0x1d4
push 0x516684
push 0x378
push 0x100834b0
call fcn.100077cc
add esp, 0x10
nop
mov al, byte [0x100802e8]
test al, al
je 0x10009743
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, 0x100834e0
call fcn.1001b7ea
push 0x5f94
push 0x3b776
push 0x6f8
push 0x100834e0
call fcn.100077cc
add esp, 0x10
mov al, byte [0x100802f0]
test al, al
je 0x10009795
mov ecx, 0x10083500
call fcn.1001b7a0
push 0x44
push 0x104748
push 0x540
push 0x10083500
call fcn.100077cc
sub esp, 0x18
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x14], 4
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
pop esi
pop edi
pop ebx
ret
push 0x100802d0
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x100094fb
mov byte [0x10083484], 1
movaps xmm0, xmmword [0x10074410]
movaps xmmword [0x10083460], xmm0
movaps xmm0, xmmword [0x10074420]
movaps xmmword [0x10083470], xmm0
mov dword [0x10083480], 0x226611f2
push 0x10017e1b
call fcn.100013b0
add esp, 4
push 0x100802d0
call fcn.1001be53
add esp, 4
jmp 0x100094fb
push 0x100802d8
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x10009530
movaps xmm0, xmmword [0x10074430]
movaps xmmword [0x10083490], xmm0
movsd xmm0, qword [0x10074440]
movsd qword [0x100834a0], xmm0
push 0x10017e37
call fcn.100013b0
add esp, 4
push 0x100802d8
call fcn.1001be53
add esp, 4
jmp 0x10009530
push 0x100802e0
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x10009564
mov byte [0x100834d4], 1
movaps xmm0, xmmword [0x10074410]
movaps xmmword [0x100834b0], xmm0
movaps xmm0, xmmword [0x10074420]
movaps xmmword [0x100834c0], xmm0
mov dword [0x100834d0], 0x226611f2
push 0x10017e4d
call fcn.100013b0
add esp, 4
push 0x100802e0
call fcn.1001be53
add esp, 4
jmp 0x10009564
push 0x100802e8
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x10009599
movaps xmm0, xmmword [0x10074430]
movaps xmmword [0x100834e0], xmm0
movsd xmm0, qword [0x10074440]
movsd qword [0x100834f0], xmm0
push 0x10017e69
call fcn.100013b0
add esp, 4
push 0x100802e8
call fcn.1001be53
add esp, 4
jmp 0x10009599
push 0x100802f0
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x100095d8
mov byte [0x10083524], 1
movaps xmm0, xmmword [0x10074410]
movaps xmmword [0x10083500], xmm0
movaps xmm0, xmmword [0x10074450]
movaps xmmword [0x10083510], xmm0
mov dword [0x10083520], 0x226611f2
push 0x10017e7f
call fcn.100013b0
add esp, 4
push 0x100802f0
call fcn.1001be53
add esp, 4
jmp 0x100095d8
Function at 0x1000a35d
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
nop
mov al, byte [0x10080190]
test al, al
je 0x1000a480
mov ecx, 0x10082de0
call fcn.1001b7a0
push 0x1e1
push 0x71b4e2
push 0x3e8
push 0x10082de0
call fcn.100077cc
add esp, 0x10
nop
mov al, byte [0x10080198]
test al, al
je 0x1000a4e1
mov ecx, 0x10082e10
call fcn.1001b7ea
push 0x5fa1
push 0x53069
push 0x7d8
push 0x10082e10
call fcn.100077cc
add esp, 0x10
nop
mov al, byte [0x100801a0]
test al, al
je 0x1000a533
mov ecx, 0x10082e30
call fcn.1001b7a0
push 0x1e1
push 0x729d4a
push 0x3f0
push 0x10082e30
call fcn.100077cc
add esp, 0x10
nop
mov al, byte [0x100801a8]
test al, al
je 0x1000a594
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov ecx, 0x10082e60
call fcn.1001b7ea
push 0x5fa1
push 0x53afa
push 0x7e8
push 0x10082e60
call fcn.100077cc
add esp, 0x10
mov al, byte [0x100801b0]
test al, al
je 0x1000a5e6
mov ecx, 0x10082e80
call fcn.1001b7a0
push 0x51
push 0x16e574
push 0x5f4
push 0x10082e80
call fcn.100077cc
add esp, 0x10
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
pop esi
pop edi
ret
push 0x10080190
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x1000a36d
mov byte [0x10082e04], 1
movaps xmm0, xmmword [0x10074510]
movaps xmmword [0x10082de0], xmm0
movaps xmm0, xmmword [0x10074520]
movaps xmmword [0x10082df0], xmm0
mov dword [0x10082e00], 0x226611f2
push 0x1001809b
call fcn.100013b0
add esp, 4
push 0x10080190
call fcn.1001be53
add esp, 4
jmp 0x1000a36d
push 0x10080198
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x1000a3a2
movaps xmm0, xmmword [0x10074530]
movaps xmmword [0x10082e10], xmm0
movsd xmm0, qword [0x10074540]
movsd qword [0x10082e20], xmm0
push 0x100180b7
call fcn.100013b0
add esp, 4
push 0x10080198
call fcn.1001be53
add esp, 4
jmp 0x1000a3a2
push 0x100801a0
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x1000a3d6
mov byte [0x10082e54], 1
movaps xmm0, xmmword [0x10074510]
movaps xmmword [0x10082e30], xmm0
movaps xmm0, xmmword [0x10074520]
movaps xmmword [0x10082e40], xmm0
mov dword [0x10082e50], 0x226611f2
push 0x100180cd
call fcn.100013b0
add esp, 4
push 0x100801a0
call fcn.1001be53
add esp, 4
jmp 0x1000a3d6
push 0x100801a8
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x1000a40b
movaps xmm0, xmmword [0x10074530]
movaps xmmword [0x10082e60], xmm0
movsd xmm0, qword [0x10074540]
movsd qword [0x10082e70], xmm0
push 0x100180e9
call fcn.100013b0
add esp, 4
push 0x100801a8
call fcn.1001be53
add esp, 4
jmp 0x1000a40b
push 0x100801b0
call fcn.1001bdac
add esp, 4
test eax, eax
je 0x1000a446
mov byte [0x10082ea4], 1
movaps xmm0, xmmword [0x10074510]
movaps xmmword [0x10082e80], xmm0
movaps xmm0, xmmword [0x10074550]
movaps xmmword [0x10082e90], xmm0
mov dword [0x10082ea0], 0x226611f2
push 0x100180ff
call fcn.100013b0
add esp, 4
push 0x100801b0
call fcn.1001be53
add esp, 4
jmp 0x1000a446
Function at 0x1001783c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x10017884
push ebx
push edi
push esi
sub esp, 8
movsd xmm0, qword [0x10074cc0]
movsd qword [esp], xmm0
xor eax, eax
xor esi, esi
xor edx, edx
xor edi, edi
mov ebx, eax
and ebx, 7
mov bl, byte [esp + ebx]
xor byte [ecx + eax], bl
add edx, 1
adc edi, 0
cmp eax, 0xb
sbb esi, 0
mov eax, edx
mov esi, edi
jb 0x1001785d
mov byte [ecx + 0xc], 0
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x10019eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x79697728
mov word [ecx + 4], 0x796f
mov byte [ecx + 6], 0
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x2fa0be83
mul edx
shr edx, 5
imul eax, edx, 0xac
sub ecx, eax
mov dword [0x10080b70], ecx
xor eax, eax
mov ecx, eax
add cl, 6
xor byte [esi + eax], cl
inc eax
cmp eax, 6
jne 0x10019ee4
pop esi
ret

Function at 0x1001b7a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x24], 0
je 0x1001b7e8
push ebx
push edi
push esi
sub esp, 8
movsd xmm0, qword [0x10074f60]
movsd qword [esp], xmm0
xor eax, eax
xor esi, esi
xor edx, edx
xor edi, edi
mov ebx, eax
and ebx, 7
mov bl, byte [esp + ebx]
xor byte [ecx + eax], bl
add edx, 1
adc edi, 0
cmp eax, 0x23
sbb esi, 0
mov eax, edx
mov esi, edi
jb 0x1001b7c1
mov byte [ecx + 0x24], 0
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x1001b7ea
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x17], 0
je 0x1001b832
push ebx
push edi
push esi
sub esp, 8
movsd xmm0, qword [0x10074f70]
movsd qword [esp], xmm0
xor eax, eax
xor esi, esi
xor edx, edx
xor edi, edi
mov ebx, eax
and ebx, 7
mov bl, byte [esp + ebx]
xor byte [ecx + eax], bl
add edx, 1
adc edi, 0
cmp eax, 0x16
sbb esi, 0
mov eax, edx
mov esi, edi
jb 0x1001b80b
mov byte [ecx + 0x17], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x10043f30
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push esi
push 0x21c
call sub.msvcrt.dll_malloc
add esp, 4
mov edi, eax
push eax
push 0x10e
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, 0x10f
jb 0x10043f85
mov ebx, eax
add eax, eax
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov esi, eax
test edi, edi
je 0x10043f73
push edi
call sub.msvcrt.dll_free
add esp, 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10043f8b
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov esi, edi
test eax, eax
jne 0x10043f7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10043190
add esp, 4
mov edi, eax
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], edi
xor eax, eax
test esi, esi
je 0x10043f81
push esi
call sub.msvcrt.dll_free
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x100457c0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
call fcn.1004fa50
test al, al
je 0x10045807
mov esi, dword [fcn.10048b90]
push 2
call esi
add esp, 4
push ebp
push ebx
push edi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.10044ec0
add esp, 0x14
push 2
call esi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1004fb40
Function at 0x1004f470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x1004f481
jmp dword [eax*4 + 0x10078738]
cmp dword [0x1007f318], 0
je 0x1004f590
push 0x1007f31c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x1007f334]
test edi, edi
je 0x1004f585
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1004f4cb
mov edi, dword [edi + 8]
test edi, edi
je 0x1004f585
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x1004f4c0
test esi, esi
je 0x1004f4c0
mov ecx, dword [edi + 4]
call dword [0x1007d68c]
push esi
call ecx
add esp, 4
jmp 0x1004f4c0
call fcn.100445d0
jmp case.default.0x1004f481
cmp dword [0x1007f318], 0
je case.default.0x1004f481
push 0x1007f31c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x1007f334]
test edi, edi
je 0x1004f578
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1004f537
mov edi, dword [edi + 8]
test edi, edi
je 0x1004f578
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x1004f530
test esi, esi
je 0x1004f530
mov ecx, dword [edi + 4]
call dword [0x1007d68c]
push esi
call ecx
add esp, 4
jmp 0x1004f530
cmp dword [0x1007f318], 0
jne 0x1004f56c
push 0x1007f31c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1007f318], 1
jmp case.default.0x1004f481
push 0x1007f31c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x1004f481
push 0x1007f31c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1007f318]
cmp eax, 1
jne case.default.0x1004f481
mov eax, dword [0x1007f334]
test eax, eax
je 0x1004f5c2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x1004f5b0
mov dword [0x1007f334], 0
mov dword [0x1007f318], 0
push 0x1007f31c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1004f6f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x10077610]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x1004f756
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x1004f756
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x1004f756
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x1004f756
mov edx, dword [esp + 0xc]
sub edx, dword [0x10077610]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x1004f746
add esi, 0x28
dec ecx
je 0x1004f756
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x1004f740
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x1004f740
mov eax, esi
pop esi
pop edi
ret
Function at 0x1004f990
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x1008133b], 1
jne 0x1004f9af
cmp byte [0x1008133a], 0
jne 0x1004f9ce
jmp 0x1004f9fb
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004f9fb
mov ebx, dword [fcn.10048b90]
push 2
call ebx
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.10048d00
add esp, 0x10
push 2
call ebx
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov dword [esi], 0x10078924
mov dword [esi + 4], 0x10081198
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.100506d0
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x1004fa50
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x1008133b], 1
jne 0x1004fa64
cmp byte [0x1008133a], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x1008133a]
mov byte [0x1008133b], 1
ret

Function at 0x1004fa90
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x1008133b], 1
jne 0x1004fab4
cmp byte [0x1008133a], 0
jne 0x1004fad3
jmp 0x1004fb01
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004fb01
mov edi, dword [fcn.10048b90]
push 2
call edi
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.10048d00
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x1004fb34
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004fb40
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x1008133b], 1
jne 0x1004fb67
cmp byte [0x1008133a], 0
jne 0x1004fb86
jmp 0x1004fbb4
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004fbb4
mov edi, dword [fcn.10048b90]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.10048d00
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push ebx
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x1004fc48
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push ebp
push ebx
call edi
xor eax, eax
cmp ebx, 0xffffffff
jne 0x1004fc48
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x1007d68c]
mov eax, esp
mov ecx, esi
push eax
call edi
mov eax, dword [esi]
mov edi, dword [eax + 0x34]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push 0
call edi
cmp dword [esp + 0x10], 0
je 0x1004fc46
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push 0xfffffffffffffffe
call edi
mov edi, eax
add edi, dword [esp + 0x10]
mov eax, dword [esi]
mov ebx, dword [eax + 0x10]
mov ecx, ebx
call dword [0x1007d68c]
mov ecx, esi
push edi
push 0xfffffffffffffffe
call ebx
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1004fc50
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x1008133b], 1
jne 0x1004fc6a
cmp byte [0x1008133a], 0
jne 0x1004fc89
jmp 0x1004fcb5
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004fcb5
mov edi, dword [fcn.10048b90]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.10048d00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x1004fcd0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x1008133b], 1
jne 0x1004fcea
cmp byte [0x1008133a], 0
jne 0x1004fd09
jmp 0x1004fd35
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004fd35
mov edi, dword [fcn.10048b90]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.10048d00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x1004fd50
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x1008133b], 1
jne 0x1004fd6f
cmp byte [0x1008133a], 0
jne 0x1004fd8e
jmp 0x1004fdbb
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004fdbb
mov edi, dword [fcn.10048b90]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.10048d00
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x1004fde0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x1008133b], 1
jne 0x1004fdfa
cmp byte [0x1008133a], 0
jne 0x1004fe19
jmp 0x1004fe45
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004fe45
mov edi, dword [fcn.10048b90]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.10048d00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x1004fe60
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x1008133b], 1
jne 0x1004fe84
cmp byte [0x1008133a], 0
jne 0x1004fea3
jmp 0x1004fed1
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x1008133b], 1
test eax, eax
setne byte [0x1008133a]
je 0x1004fed1
mov edi, dword [fcn.10048b90]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.10048d00
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [0x1007d68c]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10050380
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x10081339], 1
jne 0x10050394
cmp byte [0x10081338], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x10081338]
mov byte [0x10081339], 1
ret