joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a16d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3286
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x4a1784
sub esp, 8
lea eax, [ebp - 0x21c]
mov edx, esp
xor ecx, ecx
mov dword [edx], eax
cmp word [ebp - 0x21c], cx
je 0x4a173b
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x4a1731
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x250]
call fcn.0040a2c0
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.0049d280
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00462860
lea ecx, [ebp - 0x238]
call fcn.0040a580
lea ecx, [ebp - 0x250]
call fcn.0040a580
mov al, 1
jmp 0x4a1786
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret

Function at 0x4a1880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a32f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push 0
push str.D:BTImportsOpenChromeChrome_src_base_files_file_util_win.cc
push eax
call fcn.004593e0
add esp, 8
lea ecx, [ebp - 0x38]
push eax
call fcn.00459410
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x4a18d8
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x38]
setne bl
call fcn.0045a290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x4a1ae0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3330
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x62cf50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.004a1a70
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4a1b6a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x4a1cc4
cmp dword [ebx + 8], 0x71c71c7
je 0x4a1cda
lea eax, [ebx + 4]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
push 0x24
lfence
call fcn.00406b5e
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
call fcn.00462840
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5bd150]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x5bd150]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
seta al
test al, al
je 0x4a1c73
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.00575b00
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.00552d50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4a1c55
cmp eax, 0x200
jae 0x4a1c53
shl eax, 3
cmp eax, ecx
jae 0x4a1c55
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004a2210
push dword [ebp - 0x1c]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004a1a70
mov edx, dword [eax]
jmp 0x4a1c76
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov edi, dword [ebp - 0x20]
mov dword [ebx + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx + 0xc]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x4a1ca5
mov dword [ecx + eax*8], esi
jmp 0x4a1cb7
cmp ebx, edx
jne 0x4a1cae
mov dword [ecx + eax*8], esi
jmp 0x4a1cbb
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4a1cbb
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00550857
int3
Function at 0x4a2210
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x4a236a
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0046ce50
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x4a233c
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x4a22c3
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x4a232f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x4a22fa
mov eax, dword [eax]
cmp eax, ecx
je 0x4a22f2
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x4a232f
cmp ebx, eax
je 0x4a230c
nop
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x4a2345
cmp ebx, eax
jne 0x4a2300
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x4a2272
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x4a232f
push str.invalid_hash_bucket_count
call fcn.00550857
int3
Function at 0x4a3500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4a35db
cmp byte [ebx + 0x3d], 0
je 0x4a35db
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5b1854]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x4a35c9
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x5b1854]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x4a358e
sub eax, 1
je 0x4a3592
sub eax, 2
jne 0x4a35c9
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4a35b2
lfence
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.00576283
add esp, 0x10
cmp esi, eax
jne 0x4a35c9
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x4a3a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x4a3ac0
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4a3afc
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x4a3afc
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x4a3bf7
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x4a3b24
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x4a3b5a
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.005782cb
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov esi, dword [eax]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x5b1854]
mov ecx, dword [ebp - 0x34]
call esi
test eax, eax
js 0x4a3bf7
cmp eax, 1
jle 0x4a3bc7
cmp eax, 3
jne 0x4a3bf7
lfence
push dword [edi + 0x4c]
push dword [ebp - 0x28]
call fcn.004a2a00
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4a3be7
lfence
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.00576283
add esp, 0x10
cmp esi, eax
jne 0x4a3bf7
lea eax, [ebp - 0x28]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4a3ae7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004016cd
mov esp, ebp
pop ebp
ret 4
Function at 0x4a4590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x4a4671
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
jl 0x4a4660
jg 0x4a45c8
test edx, edx
je 0x4a4660
call fcn.0042cb40
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x4a4616
jg 0x4a45de
test esi, esi
je 0x4a4616
cmp ebx, eax
jg 0x4a45ed
jl 0x4a45e8
cmp edi, esi
jae 0x4a45ed
mov esi, edi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
push esi
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.0056a3d0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4a4645
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov eax, dword [ebp - 4]
push ecx
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5b1854]
mov ecx, dword [ebp - 4]
call esi
cmp eax, 0xffffffff
je 0x4a465a
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp - 8], esi
test ebx, ebx
jg 0x4a45c8
jl 0x4a465a
test edi, edi
jne 0x4a45c8
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [eax]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x4a4690
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4a4692
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x4a470b
jg 0x4a46a4
test esi, esi
je 0x4a470b
test eax, eax
jl 0x4a46e5
jg 0x4a46ae
test ebx, ebx
je 0x4a46e5
cmp edi, eax
jg 0x4a46bd
jl 0x4a46b8
cmp esi, ebx
jae 0x4a46bd
mov ebx, esi
mov dword [ebp - 0xc], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0056a3d0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp - 0xc]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x4a46e8
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4a470b
jg 0x4a46f2
test esi, esi
je 0x4a470b
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4a470b
push eax
push esi
push 1
push edx
call fcn.00576283
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a5e20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
mov ebx, dword [eax + 0x3c]
xor esi, esi
add ebx, eax
mov dword [ebp - 4], eax
xor edi, edi
movzx ecx, word [ebx + 6]
cmp esi, ecx
jae 0x4a5e7c
movzx eax, word [ebx + 0x14]
lea edx, [ebx + 0x18]
add eax, edi
add edx, eax
je 0x4a5e7c
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
add ecx, eax
neg eax
sbb eax, eax
and eax, ecx
cmp eax, dword [ebp + 8]
ja 0x4a5e68
mov ecx, dword [edx + 8]
add ecx, eax
cmp ecx, dword [ebp + 8]
ja 0x4a5e6e
inc esi
add edi, 0x28
jmp 0x4a5e36
pop edi
pop esi
lfence
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a60e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3928
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x62cf50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push eax
call fcn.00412230
add esp, 0xc
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x4a612e
mov eax, dword [eax]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x4a6157
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.0040a5e0
mov dword [ebp - 4], 0xffffffff
test edi, edi
jne 0x4a6177
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
je 0x4a6260
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00415d06
mov esi, eax
mov dword [ebp - 0x2c], esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push dword [ebp + 8]
push eax
call fcn.00412230
add esp, 0x10
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 3
jb 0x4a61c1
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x4a61e3
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040a5e0
sub esp, 8
mov byte [ebp - 4], 2
mov edx, esp
xor ecx, ecx
mov dword [edx], esi
test esi, esi
je 0x4a620a
mov eax, esi
cmp word [esi], cx
je 0x4a620a
nop dword [eax + eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x4a6200
lea eax, [ebp - 0x48]
mov dword [edx + 4], ecx
push eax
call fcn.0040bf90
mov ecx, dword [ebp - 0x10]
mov edi, eax
add esp, 0xc
cmp ecx, edi
je 0x4a624b
call fcn.0040c7f0
movups xmm0, xmmword [edi]
mov eax, dword [ebp - 0x10]
movups xmmword [eax], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [eax + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0x48]
call fcn.0040c7f0
test esi, esi
je 0x4a6260
push esi
call fcn.0041e935
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a9340
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3c06
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edi, dword [ebp + 0xc]
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push 0x8023
mov dword [ebp - 0x234], eax
lfence
call fcn.00406b5e
add esp, 4
test eax, eax
je 0x4a95ce
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
push 0x8000
push 0
push ecx
lea esi, [ecx + 0x8000]
mov dword [ebp - 0x230], ecx
mov dword [ecx - 4], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x220], esi
call fcn.0056aed0
add esp, 0xc
mov dword [ebp - 0x224], esi
mov eax, dword [ebp - 0x234]
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x229], 0
test eax, eax
je 0x4a95a2
lea ecx, [ebp - 0x21c]
push ecx
push 0x8000
push dword [ebp - 0x230]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4a95a2
mov eax, dword [ebp - 0x21c]
shr eax, 2
mov dword [ebp - 0x23c], eax
cmp eax, 0x2000
ja 0x4a959b
xor esi, esi
mov byte [ebp - 0x229], 1
test eax, eax
je 0x4a95a2
nop dword [eax]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056aed0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
mov eax, dword [ebp - 0x230]
mov eax, dword [eax + esi*4]
push eax
push dword [ebp - 0x234]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x4a959b
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0041020f
mov edx, eax
add esp, 8
test edx, edx
je 0x4a94cb
add edx, 2
jmp 0x4a94d1
lea edx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x244], 0
mov word [ebp - 0x254], ax
mov eax, edx
mov dword [ebp - 0x240], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x238], ecx
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a9500
sub eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x254]
sar eax, 1
push eax
push edx
call fcn.00409db0
mov eax, dword [edi + 4]
mov byte [ebp - 4], 1
cmp eax, dword [edi + 8]
je 0x4a9557
movups xmm0, xmmword [ebp - 0x254]
xor ecx, ecx
mov word [ebp - 0x254], cx
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x244]
movq qword [eax + 0x10], xmm0
mov eax, 7
add dword [edi + 4], 0x18
jmp 0x4a956c
lea ecx, [ebp - 0x254]
push ecx
push eax
mov ecx, edi
call fcn.004325a0
mov eax, dword [ebp - 0x240]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x4a9588
inc eax
lea ecx, [ebp - 0x254]
push eax
push dword [ebp - 0x254]
call fcn.0040a5e0
inc esi
mov byte [ebp - 4], 0
cmp esi, dword [ebp - 0x23c]
jb 0x4a9470
jmp 0x4a95a2
mov byte [ebp - 0x229], 0
lea ecx, [ebp - 0x228]
call fcn.0045bd90
mov al, byte [ebp - 0x229]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
call fcn.0056e2db
int3
Function at 0x4a95e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3c38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x4a96be
test edi, edi
je 0x4a96be
mov dword [edi + 0x10], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4a9634
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4a9643
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x4a96be
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x14], 0
push ecx
lea eax, [ebx + 1]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.00443b40
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x4a9682
mov esi, dword [esi]
lea eax, [ebx + 1]
push eax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4a96b0
cmp eax, ebx
ja 0x4a96b0
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.0040bef0
lea ecx, [ebp - 0x1c]
mov bl, 1
call fcn.0040bf20
mov al, bl
jmp 0x4a96c0
lea ecx, [ebp - 0x1c]
xor bl, bl
call fcn.0040bf20
mov al, bl
jmp 0x4a96c0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret