joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0xffffffffffffffff
push 0x459d00
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call fcn.004158d0
add esp, 8
mov ebx, dword [ebp + 8]
cmp dword [0x4e120c], 0
jne 0x424d3c
push 0xffffffffffffffff
push 0x459d40
call fcn.004158d0
add esp, 8
cmp dword [0x4e120c], 0
jne 0x424d2d
xor eax, eax
mov dword [0x4e1000], 0x4e100c
mov dword [0x4e1004], 0x200
mov dword [0x4e1008], eax
mov byte [0x4e100c], al
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x424e7b
test eax, eax
je 0x424e7b
mov dword [0x4e1210], eax
mov dword [0x4e120c], 1
push 0xffffffffffffffff
push 0x459d40
call fcn.00415910
add esp, 8
cmp dword [0x4e1210], 0
je 0x424dd4
cmp dword [0x4e0e08], 0
je 0x424e39
mov edi, dword [0x4e0e10]
test edi, edi
je 0x424e39
cmp dword [0x4e0e0c], 0
jne 0x424d7d
mov eax, dword [0x4e0e14]
lea edx, [eax + 1]
mov dword [0x4e0e14], edx
jmp 0x424d92
push 1
push 0x4e0e14
call fcn.00411e70
add esp, 8
mov edi, dword [0x4e0e10]
cdq
mov ecx, dword [0x45954c]
idiv ecx
imul edx, dword [0x459550]
lea eax, [ebp + 0xc]
push eax
push ebx
add edi, edx
push edi
call fcn.0043c386
add esp, 0xc
mov ebx, eax
mov eax, dword [0x459550]
cmp ebx, eax
jl 0x424dd4
cmp ebx, dword [0x4e0e18]
jge 0x424ded
mov byte [edi + eax - 2], 0xa
mov eax, dword [0x459550]
mov byte [edi + eax - 1], 0
push 0xffffffffffffffff
push 0x459d00
call fcn.00415910
add esp, 8
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
inc ebx
push ebx
push str.OMP_warning:_Debugging_buffer_overflow__increase_KMP_DEBUG_BUF_CHARS_to__d_n
push 0x4e1000
call fcn.00425b10
add esp, 0xc
push 0
lea eax, [ebp - 0x10]
push eax
push dword [0x4e1008]
push dword [0x4e1000]
push dword [0x4e1210]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4e1000
call fcn.004255c0
add esp, 4
mov dword [0x4e0e18], ebx
mov eax, dword [0x459550]
jmp 0x424dc5
lea eax, [ebp + 0xc]
push eax
push ebx
push 0x4e1000
call fcn.00425980
add esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push dword [0x4e1008]
push dword [0x4e1000]
push dword [0x4e1210]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4e1000
call fcn.004255c0
add esp, 4
jmp 0x424dd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4e1210], 0
jmp 0x424d23
Function at 0x424e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
cmp dword [0x4e120c], 0
jne 0x424f1d
push 0xffffffffffffffff
push 0x459d40
call fcn.004158d0
add esp, 8
cmp dword [0x4e120c], 0
jne 0x424f0e
xor eax, eax
mov dword [0x4e1000], 0x4e100c
mov dword [0x4e1004], 0x200
mov dword [0x4e1008], eax
mov byte [0x4e100c], al
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x42504d
test eax, eax
je 0x42504d
mov dword [0x4e1210], eax
mov dword [0x4e120c], 1
push 0xffffffffffffffff
push 0x459d40
call fcn.00415910
add esp, 8
cmp dword [0x4e1210], 0
je 0x424fb5
cmp dword [0x4e0e08], 0
je 0x42500b
mov edi, dword [0x4e0e10]
test edi, edi
je 0x42500b
cmp dword [0x4e0e0c], 0
jne 0x424f5e
mov eax, dword [0x4e0e14]
lea edx, [eax + 1]
mov dword [0x4e0e14], edx
jmp 0x424f73
push 1
push 0x4e0e14
call fcn.00411e70
add esp, 8
mov edi, dword [0x4e0e10]
cdq
mov ecx, dword [0x45954c]
idiv ecx
imul edx, dword [0x459550]
lea eax, [ebp + 0xc]
push eax
push ebx
add edi, edx
push edi
call fcn.0043c386
add esp, 0xc
mov ebx, eax
mov eax, dword [0x459550]
cmp ebx, eax
jl 0x424fb5
cmp ebx, dword [0x4e0e18]
jge 0x424fbf
mov byte [edi + eax - 2], 0xa
mov eax, dword [0x459550]
mov byte [edi + eax - 1], 0
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
inc ebx
push ebx
push str.OMP_warning:_Debugging_buffer_overflow__increase_KMP_DEBUG_BUF_CHARS_to__d_n
push 0x4e1000
call fcn.00425b10
add esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push dword [0x4e1008]
push dword [0x4e1000]
push dword [0x4e1210]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4e1000
call fcn.004255c0
add esp, 4
mov dword [0x4e0e18], ebx
mov eax, dword [0x459550]
jmp 0x424fa6
lea eax, [ebp + 0xc]
push eax
push ebx
push 0x4e1000
call fcn.00425980
add esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push dword [0x4e1008]
push dword [0x4e1000]
push dword [0x4e1210]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4e1000
call fcn.004255c0
add esp, 4
jmp 0x424fb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4e1210], 0
jmp 0x424f04
Function at 0x427370
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
jne 0x42739b
xor eax, eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4273b7
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x427451
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xcb
je 0x42739b
push ebx
push 0x40011
lea eax, [ebp - 0x48]
push eax
call fcn.00416410
push edi
lea eax, [ebp - 0x38]
push eax
call fcn.00418700
add esp, 0x14
mov edi, dword [ebp - 0x48]
lea ecx, [esp + 4]
mov dword [esp], 2
mov dword [ecx], edi
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
lea edx, [esp + 0x14]
mov dword [ecx + 0xc], edi
mov ecx, dword [ebp - 0x38]
mov dword [edx], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov dword [edx + 4], eax
lea eax, [esp + 0x24]
mov dword [edx + 8], ecx
mov dword [edx + 0xc], edi
mov edx, dword [0x4e0ea0]
mov dword [eax], edx
mov edx, dword [0x4e0ea4]
mov ecx, dword [0x4e0ea8]
mov edi, dword [0x4e0eac]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
call fcn.00416830
jmp 0x42739b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
push 0x40012
lea eax, [ebp - 0x28]
push eax
call fcn.00416410
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00418700
add esp, 0x14
mov eax, dword [ebp - 0x28]
lea edi, [esp + 4]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 2
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ebx
lea edi, [esp + 0x14]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ebx
lea edi, [esp + 0x24]
mov eax, dword [0x4e0ea0]
mov edx, dword [0x4e0ea4]
mov ecx, dword [0x4e0ea8]
mov ebx, dword [0x4e0eac]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ebx
call fcn.00416830
jmp 0x4273ad
Function at 0x4274f0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x427516
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
push 0x40012
lea eax, [ebp - 0x28]
push eax
call fcn.00416410
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.00418700
add esp, 0x14
mov eax, dword [ebp - 0x28]
lea esi, [esp + 4]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 2
mov dword [esi], eax
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
lea esi, [esp + 0x14]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov dword [esi], eax
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
lea esi, [esp + 0x24]
mov eax, dword [0x4e0ea0]
mov edx, dword [0x4e0ea4]
mov ecx, dword [0x4e0ea8]
mov ebx, dword [0x4e0eac]
mov dword [esi], eax
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
call fcn.00416830
jmp 0x42750c
Function at 0x427b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x4ea434]
sub esp, 8
push esi
push edi
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x427b77
mov dword [esp + 0xc], 0x4e2260
mov edx, dword [esp + 0xc]
mov eax, 1
lock xadd dword [edx], eax
mov dword [esp + 8], eax
mov esi, dword [esp + 8]
mov ecx, dword [0x4ea434]
add esi, 1
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
cmp dword [edi], esi
pop edi
sete al
pop esi
add esp, 8
ret

Function at 0x427cb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, dword [0x4ea434]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
cmp edi, ebx
jne 0x427d00
mov dword [esp + 0x10], 0x4e2260
mov edx, dword [esp + 0x10]
mov eax, 1
lock xadd dword [edx], eax
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0xc]
mov ecx, dword [0x4ea434]
add edi, 1
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x18]
mov ecx, esi
mov dword [esi + 0x4c], edi
mov dword [esi + 0xc], edx
call fcn.00427c20
cmp dword [esi + 0x5c], ebx
je 0x427d26
mov ecx, esi
call fcn.00427bc0
pop edi
pop esi
pop ebx
add esp, 8
ret 4
mov eax, esi
sub eax, dword [esi + 0x48]
pop edi
add eax, 0x4000
mov dword [esi + 0x54], ebx
mov byte [esi + 0x60], bl
mov dword [esi + 0x50], eax
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x427e50
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x45b224]
push edi
xor edi, edi
lea ecx, [eax + 8]
mov dword [eax + 0x20b4], edi
mov dword [eax + 0x20b8], edi
mov dword [eax + 0x20bc], 0x1000
push 0x200000
mov dword [ecx], ecx
call fcn.00436380
test eax, eax
je 0x427ebb
mov eax, dword [0x45b224]
add eax, 8
push eax
call fcn.00438070
add esp, 4
test al, al
je 0x427ebb
push esi
mov esi, dword [0x45b224]
add esi, 0x20c0
cmp esi, edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
je 0x427eb1
call edi
mov dword [esi], eax
call edi
pop esi
mov dword [0x4ea434], eax
pop edi
ret
push 0x452fa8
call fcn.0043cbe7
add eax, 0x40
push eax
call fcn.0043a157
add esp, 8
push 1
call fcn.0043b2e6
int3
Function at 0x428010
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x20b8]
push esi
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4280b5
push edi
lea ecx, [esi + 0x174]
call fcn.00427de0
mov edi, esi
mov dword [esp + 0x10], 0x1f
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4280a5
cmp dword [ecx + 0x5c], ebx
jne 0x4280a5
mov esi, ecx
cmp esi, esi
jne 0x428062
mov eax, dword [esi + 0x44]
cmp eax, ebx
jne 0x428060
mov eax, dword [esi + 0x40]
mov dword [edi], eax
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x42806f
mov ecx, dword [esi + 0x40]
mov dword [eax + 0x40], ecx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x42807c
mov edx, dword [esi + 0x44]
mov dword [eax + 0x44], edx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
cmp dword [ebp + 0x20ac], ebx
jne 0x428096
mov eax, dword [esi + 0x58]
push eax
call fcn.00438250
add esp, 4
push 0x4000
push esi
mov ecx, ebp
call fcn.00436d20
mov al, 1
add edi, 0xc
sub dword [esp + 0x10], 1
jne 0x428045
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x4280c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 8]
cmp eax, dword [ecx]
je 0x428130
mov ecx, dword [eax + 0x44]
xor edx, edx
cmp ecx, edx
push esi
je 0x4280d8
mov esi, dword [eax + 0x40]
mov dword [ecx + 0x40], esi
mov ecx, dword [eax + 0x40]
cmp ecx, edx
je 0x4280e5
mov esi, dword [eax + 0x44]
mov dword [ecx + 0x44], esi
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x5c], edx
mov byte [eax + 0x60], dl
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x48], edx
mov edx, dword [esp + 8]
lea ecx, [eax + 0x4000]
push eax
mov dword [eax + 0x4c], 0xffffffff
mov dword [eax + 0x50], ecx
mov eax, dword [edx + 0x20c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
add ecx, 0x174
call fcn.00427d50
pop esi
ret 8
mov ecx, eax
sub ecx, dword [eax + 0x48]
xor edx, edx
add ecx, 0x4000
mov dword [eax + 0x50], ecx
mov dword [eax + 0x54], edx
mov byte [eax + 0x60], dl
ret 8
Function at 0x428470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, edi
mov esi, ecx
call fcn.004281a0
mov edx, edi
mov ebp, eax
call fcn.00428230
xor ebx, ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x60], bl
mov dword [esi + 8], ebx
mov dword [esi + 0x48], eax
mov eax, dword [0x4ea434]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
cmp edi, ebx
jne 0x4284e2
mov dword [esp + 0x10], 0x4e2260
mov edx, dword [esp + 0x10]
mov eax, 1
lock xadd dword [edx], eax
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x1c]
mov ecx, dword [0x4ea434]
add edi, 1
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esp + 0x18]
mov edx, esi
sub edx, dword [esi + 0x48]
mov dword [esi + 0x4c], edi
add edx, 0x4000
cmp eax, ebx
mov dword [esi + 0x50], edx
je 0x42850d
lea ecx, [ebp + ebp*2]
pop edi
lea eax, [eax + ecx*4]
mov dword [esi + 0xc], eax
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov dword [esi + 0xc], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x428650
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20c0]
push edi
push eax
mov dword [esp + 0x1c], esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [esp + 0x14], eax
je 0x4286cf
mov ecx, dword [eax + 0x174]
test ecx, ecx
je 0x4286a3
add dword [eax + 0x17c], 0xffffffff
mov edx, ecx
mov edx, dword [edx + 0x40]
test edx, edx
mov dword [eax + 0x174], edx
jne 0x42869a
mov dword [eax + 0x178], edx
mov byte [eax + 0x184], 0
jmp 0x4286aa
mov byte [eax + 0x184], 1
test ecx, ecx
mov dl, byte [eax + 0x184]
mov byte [esp + 0x20], dl
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
je 0x4286cb
mov esi, ecx
jmp 0x42880a
mov bl, byte [esp + 0x28]
xor eax, eax
test bl, bl
setne al
push 0
push 1
push 0x4000
lea ebx, [esi + 8]
mov ecx, ebx
add eax, 1
mov ebp, eax
mov eax, 0xffff
push ebp
mov word [esp + 0x34], ax
mov word [esp + 0x38], ax
call fcn.00436610
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
je 0x4287b8
cmp dword [esi + 0x20b4], 0
jne 0x428743
xor esi, esi
test ebp, ebp
jle 0x428743
jmp 0x428720
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00438140
mov edx, dword [eax]
add esp, 8
cmp dx, 0xffff
mov dword [esp + esi*4 + 0x24], edx
je 0x428778
add esi, 1
cmp esi, ebp
jl 0x428720
mov esi, dword [esp + 0x10]
xor edi, edi
test ebp, ebp
jle 0x428806
add esi, 0x58
lea ebx, [esp + 0x24]
jmp 0x428760
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x20b4], 0
je 0x4287c4
test esi, esi
je 0x4287d7
mov word [esi], 0xffff
jmp 0x4287d7
test esi, esi
jle 0x428797
lea edi, [esp + 0x24]
mov eax, dword [edi]
push eax
call fcn.00438250
add esp, 4
add edi, 4
sub esi, 1
jne 0x428780
mov edi, dword [esp + 0x10]
mov esi, edi
lea esp, [esp]
push 0x4000
push esi
mov ecx, ebx
call fcn.00436d20
add esi, 0x4000
sub ebp, 1
jne 0x4287a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [ebx]
lea edx, [esi - 0x58]
push edx
push eax
call fcn.00437ee0
mov ecx, dword [ebx]
add esp, 8
mov dword [esi], ecx
test edi, edi
jle 0x4287ee
mov ecx, dword [esp + 0x14]
lea edx, [esi - 0x58]
push edx
add ecx, 0x174
call fcn.00427d50
add edi, 1
add esi, 0x4000
add ebx, 4
cmp edi, ebp
jl 0x428760
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test esi, esi
je 0x42881b
mov ecx, dword [esp + 0x30]
push ecx
push eax
mov ecx, esi
call fcn.00428470
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x4288d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20c0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x428929
push 0x188
push esi
lea ecx, [esi + 0x81bc]
call fcn.00428830
mov edi, eax
test edi, edi
jne 0x428912
mov eax, dword [esp + 0xc]
call fcn.004281a0
lea eax, [eax + eax*2]
lea eax, [edi + eax*4]
pop edi
pop esi
ret 4
lea ecx, [esi + 8]
mov dword [edi + 0x180], ecx
mov edx, dword [esi + 0x20c0]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esp + 0xc]
call fcn.004281a0
lea eax, [eax + eax*2]
lea eax, [edi + eax*4]
pop edi
pop esi
ret 4

Function at 0x4379f0
Capabilities:
Query environment variable

Disassembly:
test edi, edi
push esi
je 0x437a60
mov eax, dword [0x45be24]
mov esi, 0x4eb48e
sub esi, eax
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, esi
jb 0x437a25
add esi, 0xffffffff
push esi
add eax, 0xffffffff
push eax
push edi
push 5
call fcn.004379d0
add esp, 0x10
xor eax, eax
pop esi
ret
test eax, eax
jbe 0x437a3c
mov ecx, dword [0x45be24]
lea eax, [ecx + eax + 1]
mov dword [0x45be24], eax
mov eax, ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x437a4d
mov eax, dword [0x45be24]
pop esi
ret
cmp eax, 0xcb
je 0x437a60
push eax
push edi
push 4
call fcn.004379d0
add esp, 0xc
xor eax, eax
pop esi
ret

Function at 0x43cf4f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45cdc0]
jne 0x43cf59
repz ret
jmp fcn.00445e5e
Function at 0x4499e8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45cdc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00440acf
and dword [ebp - 0x14], 0
cmp dword [0x4ec2a8], 0
mov dword [ebp - 0x18], eax
jne 0x449a9b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x449b43
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x449b43
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4ec2a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4ec2ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4ec2b0], eax
call edi
push eax
call esi
mov dword [0x4ec2b8], eax
test eax, eax
je 0x449a9b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4ec2b4], eax
mov eax, dword [0x4ec2b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x449af4
cmp dword [0x4ec2b8], ecx
je 0x449af4
push eax
call esi
push dword [0x4ec2b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x449af4
test ebx, ebx
je 0x449af4
call edi
test eax, eax
je 0x449aeb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x449aeb
test byte [ebp - 8], 1
jne 0x449af4
or dword [ebp + 0x10], 0x200000
jmp 0x449b27
mov eax, dword [0x4ec2ac]
cmp eax, dword [ebp - 0x18]
je 0x449b27
push eax
call esi
test eax, eax
je 0x449b27
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x449b27
mov eax, dword [0x4ec2b0]
cmp eax, dword [ebp - 0x18]
je 0x449b27
push eax
call esi
test eax, eax
je 0x449b27
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4ec2a8]
call esi
test eax, eax
je 0x449b43
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x449b45
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cf4f
leave
ret
Function at 0x1000b3f0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x1000b4df
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp dword [0x10051670], 0
mov dword [0x10051680], eax
jne 0x1000b44f
cmp al, 3
jne 0x1000b426
test eax, 0x80000000
je 0x1000b426
push 2
call fcn.1000c420
add esp, 4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000b44f
push str.IsTNT
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b44f
push 1
call fcn.1000c420
add esp, 4
call fcn.1000b780
test eax, eax
jne 0x1000b45d
xor eax, eax
ret 0xc
xor edx, edx
mov ecx, dword [0x10051680]
mov dl, ch
mov eax, ecx
shr ecx, 0x10
and eax, 0xff
mov dword [0x1005168c], edx
mov dword [0x10051688], eax
shl eax, 8
mov dword [0x10051680], ecx
add eax, edx
mov dword [0x10051684], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10053b34], eax
call 0x1005cd81
cmp dword [0x10053b34], 0
mov dword [0x10051660], eax
je 0x1000b4d5
test eax, eax
je 0x1000b4d5
call 0x1005cd81
call fcn.1000c050
call fcn.1000bb00
call fcn.1000ba10
call fcn.1000b620
inc dword [0x1005165c]
mov eax, 1
ret 0xc
call fcn.1000b7c0
xor eax, eax
ret 0xc
test eax, eax
jne 0x1000b4cd
mov eax, dword [0x1005165c]
test eax, eax
jle 0x1000b512
dec eax
cmp dword [0x100516b8], 0
mov dword [0x1005165c], eax
jne 0x1000b500
call fcn.1000b690
call fcn.1000b9e0
call fcn.1000b7c0
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x1000b6b0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100516bc], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x1000b6ce
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100516b8], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x100516b4], bl
jne 0x1000b728
cmp dword [0x10053b2c], 0
je 0x1000b716
mov edi, dword [0x10053b1c]
sub edi, 4
cmp edi, dword [0x10053b2c]
jb 0x1000b716
mov eax, dword [edi]
test eax, eax
je 0x1000b70b
call eax
sub edi, 4
cmp edi, dword [0x10053b2c]
jae 0x1000b703
push 0x1004f514
push 0x1004f410
call fcn.1000b760
add esp, 8
push 0x1004f71c
push 0x1004f618
call fcn.1000b760
add esp, 8
test ebx, ebx
jne 0x1000b74f
mov dword [0x100516bc], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret