joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431549
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e1db
mov eax, dword fs:[0]
push eax
mov eax, 0x183c
call fcn.00437e70
mov eax, dword [0x45c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1830], ebx
lea eax, [ebp - 0x1840]
push eax
push 0x1000
lea eax, [ebp - 0x1810]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
mov eax, dword [ebp - 0x1840]
xor esi, esi
and dword [ebp - 0x1834], esi
xor edi, edi
shr eax, 2
mov dword [ebp - 0x182c], eax
mov dword [ebp - 0x183c], esi
mov dword [ebp - 0x1838], edi
and dword [ebp - 4], edi
test eax, eax
je 0x43169b
lea ebx, [ebp - 0x1810]
push dword [ebx]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x1844], esi
push 0x400
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x431670
xor eax, eax
lea ecx, [ebp - 0x1828]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x810]
push eax
call fcn.0040bb9e
mov eax, dword [ebp - 0x1830]
push ecx
add eax, 0x5c
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x1828]
call fcn.0040ba85
cmp eax, 0xffffffff
je 0x431665
cmp edi, dword [ebp - 0x1834]
je 0x431652
mov eax, dword [ebx]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x1838], edi
jmp 0x431665
push ebx
push edi
lea ecx, [ebp - 0x183c]
call fcn.004316fd
mov edi, dword [ebp - 0x1838]
lea ecx, [ebp - 0x1828]
call fcn.00402ab8
mov byte [ebp - 4], 0
test esi, esi
je 0x43167f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
sub dword [ebp - 0x182c], 1
jne 0x4315d2
mov esi, dword [ebp - 0x183c]
mov ebx, dword [ebp - 0x1830]
mov byte [ebx + 0x58], 0
jmp 0x4316ad
push dword [esi]
mov ecx, ebx
call fcn.00431338
add esi, 4
cmp esi, edi
jne 0x4316a1
mov bl, byte [ebx + 0x58]
lea ecx, [ebp - 0x183c]
call fcn.004316db
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043570c
leave
ret
Function at 0x43209f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x4320fd
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4320fd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4320cd
shr eax, 4
and eax, 1
jmp 0x4320ff
push esi
call dword [sym.imp.SHLWAPI.dll_StrDupW]
push 0x5c
mov edi, eax
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x432119
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push edi
call fcn.0043209f
push edi
test eax, eax
jne 0x432106
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4320fd
xor eax, eax
inc eax
jmp 0x4320ff
Function at 0x43211e
Capabilities:
Timestomp file

Disassembly:
push 0x4c
mov eax, 0x43e33f
call fcn.00437f7e
mov ebx, dword [ebp + 8]
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x38], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push ebx
push str.SetFileModTime_couldnt_open__S
push eax
call fcn.0040f0b3
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
mov edx, eax
setne cl
call fcn.0041c29f
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004027a6
push ebx
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_GetFileTime:__S
push eax
call fcn.0040f0b3
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edx, edi
mov ecx, eax
call fcn.0041c29f
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004027a6
push ebx
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_DosDateTimeToFileTime:__S
push eax
call fcn.0040f0b3
add esp, 0xc
mov edi, eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
push ecx
shr ecx, 0x10
push ecx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov edx, edi
mov ecx, eax
call fcn.0041c29f
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004027a6
push ebx
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_LocalFileTimeToFileTime:__S
push eax
call fcn.0040f0b3
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov edx, edi
mov ecx, eax
call fcn.0041c29f
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004027a6
push ebx
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_SetFileTime:__S
push eax
call fcn.0040f0b3
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edx, edi
mov ecx, eax
call fcn.0041c29f
lea ecx, [ebp - 0x2c]
call fcn.004027a6
test esi, esi
je 0x43227c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00437f2d
ret 8

Function at 0x432349
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebp + 8]
mov edx, dword [edi + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [esi + eax*4]
movzx eax, cl
add eax, dword [edi + 4]
mov dword [edi], ecx
imul ecx, eax, 0x8088405
mov eax, dword [ebp + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [esi + ecx*4]
mov dword [edi + 8], edx
pop edi
pop esi
pop ebp
ret
Function at 0x436280
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4362bf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4362bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4362bf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4362bf
cmp dword [ecx + 0x74], 0xe
jbe 0x4362bf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x437990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e4cd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x45c098]
cmp eax, 0xffffffff
jne 0x4379c4
xor ebx, ebx
jmp 0x4379cd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x437aad
nop
cmp dword [ebx + 0x18], 0
jne 0x4379f5
cmp dword [ebx + 0xc], 0
je 0x437a88
mov esi, dword [ebx + 0xc]
jmp 0x437a00
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x437a42
nop dword [eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x437a2b
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x437a00
cmp dword [ebx + 0x18], 0
je 0x4379e6
mov eax, dword [ebx + 0x14]
mov esi, dword [eax]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x437a65
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x437a65
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea ecx, [ebx + 0x14]
call fcn.00436b30
push 0x20
push eax
call fcn.00435a7b
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x18], 0
jne 0x437a48
jmp 0x4379e0
push 0x4370e0
push 0x45eb60
call fcn.00436ec0
mov eax, dword [0x45c098]
add esp, 8
cmp eax, 0xffffffff
je 0x437aad
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 2
test ebx, ebx
je 0x437ada
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x437ada
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437af0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x437b50
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x437b1a
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x437b38
cmp eax, 0xffffffff
je 0x437b38
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x401b70
Capabilities:
Parse credit card information

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
movzx eax, dl
sub esp, 0x2c
movzx edx, byte [esi]
mov byte [esp + 0x17], al
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov dword [esp + 0x1c], eax
cmp dl, 9
je 0x401c82
cmp dl, 0x20
je 0x401c82
cmp dl, 0x21
je 0x401d43
and edx, 0xfffffffd
cmp dl, 0x2c
jne 0x401bbc
add esi, 1
mov byte [esp + 0x16], 1
mov ebx, esi
jmp 0x401bc3
add ebx, 1
movzx eax, byte [ebx]
movzx edx, al
test word [edx + edx + 0x4d0620], 0x204
jne 0x401bc0
lea edx, [eax - 0x2b]
cmp dl, 3
jbe 0x401bc0
cmp al, 0x3d
je 0x401bc0
cmp al, 0x40
je 0x401bc0
cmp al, 0x2a
mov edi, ebx
je 0x401d66
cmp al, 0x20
jne 0x401d7a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401bf7
cmp al, 0x20
je 0x401bf7
cmp byte [esp + 0x16], 0
jne 0x401c71
mov eax, dword [0x4d70e0]
test eax, eax
jle 0x401c71
mov ebp, dword [0x4d70e4]
shl eax, 4
sub edi, esi
mov dword [esp + 0x18], ebx
add eax, ebp
mov ebx, ebp
mov dword [esp + 0x10], eax
mov ebp, esi
nop
mov esi, dword [ebx]
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x401c64
cmp byte [esp + 0x15], 0
jne 0x401c53
cmp byte [esi + edi], 0
jne 0x401c64
cmp byte [ebx + 0xc], 0
jne 0x401c60
cmp byte [esp + 0x17], 0
je 0x401c64
mov byte [ebx + 0xd], 1
add ebx, 0x10
cmp ebx, dword [esp + 0x10]
jne 0x401c30
mov ebx, dword [esp + 0x18]
movzx ecx, byte [ebx]
test cl, cl
jne 0x401c8e
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [esi + 1]
add esi, 1
jmp 0x401b91
movzx edx, byte [ebx + 1]
lea eax, [ebx + 1]
test dl, dl
je 0x401ccc
cmp cl, 0x26
je 0x401cd8
cmp cl, 0x7c
je 0x401cd8
cmp cl, 0x3a
jne 0x401ccc
cmp dl, 0x3b
je 0x401cc8
test dl, dl
nop
je 0x401cc8
cmp dl, 0x7d
je 0x401cdf
cmp dl, 0x25
je 0x401d03
movzx edx, byte [eax + 1]
add eax, 1
cmp dl, 0x3b
jne 0x401cad
test dl, dl
jne 0x401cdf
mov ebx, eax
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
jmp 0x401b91
movzx edx, byte [eax + 1]
lea esi, [eax + 1]
test dl, dl
je 0x401da5
cmp byte [eax], 0x3b
je 0x401b91
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [eax + 1]
lea ecx, [eax + 1]
cmp dl, 0x3c
je 0x401d1d
cmp dl, 0x7b
je 0x401d1d
cmp dl, 0x57
je 0x401d31
mov eax, ecx
jmp 0x401ca8
mov edx, dword [esp + 0x1c]
add eax, 2
call fcn.00401b70
movzx edx, byte [eax]
jmp 0x401ca8
cmp byte [eax + 2], 0x7b
je 0x401d87
mov eax, ecx
mov edx, 0x57
jmp 0x401ca8
movzx edx, byte [esi + 1]
lea eax, [esi + 1]
mov esi, eax
cmp dl, 0x20
jne 0x401d9b
add esi, 1
movzx edx, byte [esi]
cmp dl, 9
je 0x401d51
cmp dl, 0x20
je 0x401d51
jmp 0x401bac
movzx eax, byte [edi + 1]
add ebx, 1
mov byte [esp + 0x15], 1
cmp al, 0x20
je 0x401bf7
cmp al, 9
je 0x401bf7
jmp 0x401c05
mov edx, dword [esp + 0x1c]
add eax, 3
call fcn.00401b70
movzx edx, byte [eax]
jmp 0x401ca8
cmp dl, 9
je 0x401d51
jmp 0x401bac
mov eax, esi
mov ebx, eax
jmp 0x401cce
Function at 0x4028c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x9c
mov dword [esp], 0x2000
call fcn.004529f0
mov dword [esp], ebx
mov dword [esp + 4], 0
mov ebp, eax
call sub.msvcrt.dll__open_1
mov dword [esp + 4], 0
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll__open_1
mov dword [esp + 0x18], eax
shr eax, 0x1f
test al, al
jne 0x402912
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x402940
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll__close_1
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__close_1
xor eax, eax
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x30]
mov esi, dword [sym.imp.msvcrt.dll__fstati64]
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
test eax, eax
js 0x402912
lea eax, [esp + 0x60]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call esi
test eax, eax
js 0x402912
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
xor edx, edi
xor eax, esi
or edx, eax
jne 0x402912
mov eax, edi
or eax, esi
je 0x402a52
lea eax, [ebp + 0x1000]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ebx
cmp esi, 0x1000
mov ebp, esi
jg 0x4029e0
mov ebx, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll__read_1
cmp eax, ebp
je 0x402a00
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
jmp 0x402912
mov ebp, 0x1000
mov ebx, 0x1000
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x24], 0
jmp 0x4029b4
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__read_1
cmp ebp, eax
jne 0x4029d0
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4029d0
sub esi, dword [esp + 0x20]
sbb edi, dword [esp + 0x24]
mov eax, edi
or eax, esi
jne 0x4029a0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll__close_1
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__close_1
mov eax, 1
jmp 0x402930
Function at 0x402a80
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, 1
push ebx
mov ebx, edx
sub esp, 0x11c
mov dword [esp + 4], 0x4892df
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp], ebx
lea ebx, [esp + 0x10]
mov dword [esp + 4], 0x4892e2
mov ebp, eax
call sub.msvcrt.dll_fopen
mov edi, eax
jmp 0x402ae3
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
mov dword [esp + 4], 0xa
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
setne al
mov esi, eax
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
test eax, eax
je 0x402b23
mov eax, esi
test al, al
je 0x402ac0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x4892e5
call sub.msvcrt.dll_fwrite
jmp 0x402ac0
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x11c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404fd0
Capabilities:
Query environment variable

Disassembly:
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov dword [esp], ebx
call sub.msvcrt.dll_getenv
cmp byte [edi + 1], 0
mov esi, eax
je 0x40500c
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.env_manager::getenv___s______s_n
add eax, 0x40
mov dword [esp], eax
call fcn.0047d120
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop edi
ret 4
Function at 0x4050e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
cmp byte [ecx + 1], 0
mov edi, dword [esp + 0x40]
jne 0x405265
mov eax, dword [0x4d9094]
test eax, eax
jne 0x405244
cmp byte [esi], 0
je 0x405232
mov dword [esp + 4], 0x3d
mov dword [esp], edi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x405317
sub eax, edi
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00459250
mov dword [esp], eax
mov dword [esp + 0x14], eax
call sub.msvcrt.dll_getenv
cmp byte [esi + 1], 0
mov ebx, eax
jne 0x405286
test ebx, ebx
mov dword [esp + 0x10], 0
je 0x405163
mov dword [esp], ebx
call fcn.00452ac0
mov dword [esp + 0x10], eax
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x405306
mov ebp, dword [ebx]
mov edx, dword [ebx + 4]
and ebp, 0x7fffffff
cmp ebp, edx
jne 0x40521b
cmp byte [ebx + 3], 0
jns 0x4052a7
mov dword [esi + 4], 0
lea eax, [ebp + 1]
mov byte [esp + 0x1f], 1
cmp eax, 4
mov edx, 4
cmovae edx, eax
lea eax, [edx*8 + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x18], edx
call fcn.00452a70
mov edx, dword [esp + 0x18]
mov ecx, edx
and ecx, 0x7fffffff
mov edx, dword [eax]
mov dword [esi + 4], eax
mov dword [eax + 4], 0
and edx, 0x80000000
or edx, ecx
mov dword [eax], edx
shr edx, 0x18
and edx, 0x7f
cmp byte [esp + 0x1f], 0
mov byte [eax + 3], dl
je 0x405333
lea edx, [ebp*8]
add eax, 8
add ebx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov ebx, dword [esi + 4]
mov edx, ebp
mov dword [ebx + 4], ebp
mov ecx, dword [esp + 0x14]
lea eax, [edx + 1]
mov dword [ebx + 4], eax
lea eax, [ebx + edx*8]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov dword [esp], edi
call sub.msvcrt.dll__putenv
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x4894d8
add eax, 0x40
mov dword [esp], eax
call fcn.00423ff0
jmp 0x405104
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], str.env_manager::xput___s__n
add eax, 0x40
mov dword [esp], eax
call fcn.0047d120
jmp 0x4050f7
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.saving_old_value:__s_n
add eax, 0x40
mov dword [esp], eax
call fcn.0047d120
jmp 0x40514b
add ebp, 1
mov dword [esp + 4], ebp
mov eax, dword [ebx]
and eax, 0x7fffffff
mov dword [esp], eax
call fcn.0041efe0
mov ebp, eax
lea edx, [eax*8 + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x40533c
mov ebx, dword [eax + 4]
mov dword [esp + 4], edx
and ebp, 0x7fffffff
mov dword [esp], eax
call fcn.00452a70
mov edx, dword [eax]
mov dword [esi + 4], eax
mov dword [eax + 4], ebx
and edx, 0x80000000
or edx, ebp
mov dword [eax], edx
shr edx, 0x18
and edx, 0x7f
mov byte [eax + 3], dl
mov edx, ebx
mov ebx, eax
jmp 0x40521b
mov byte [esp + 0x1f], 0
xor ebp, ebp
mov eax, 1
jmp 0x40519a
mov dword [esp + 8], str.xput
mov dword [esp + 4], 0x7c
mov dword [esp], str..._.._gcc_gcc_gcc.c
call fcn.00424080
mov ebx, eax
xor edx, edx
jmp 0x40521b
xor ebx, ebx
jmp 0x4052d0
Function at 0x4072d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0x425700
mov dword [esp + 0xc], 0x4256c0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x4d71c0
call fcn.00458da0
mov eax, dword [0x4d71cc]
mov edx, dword [0x4d71d0]
sub edx, eax
cmp edx, 0xb
jbe 0x4073d0
mov dword [eax], 0x4c4c4f43
mov dword [eax + 4], 0x5f544345
mov dword [eax + 8], 0x3d434347
mov eax, dword [0x4d71cc]
mov dword [esp], esi
lea edi, [eax + 0xc]
mov dword [0x4d71cc], edi
call sub.msvcrt.dll_strlen
lea ebx, [eax + 1]
mov eax, dword [0x4d71d0]
sub eax, edi
cmp ebx, eax
ja 0x4073f0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_memcpy
mov eax, dword [0x4d71cc]
mov ecx, dword [0x4d71c8]
add eax, ebx
cmp eax, ecx
je 0x407410
mov edx, dword [0x4d71d8]
mov ebx, dword [0x4d71c4]
add eax, edx
not edx
and eax, edx
mov edx, dword [0x4d71d0]
mov esi, eax
sub esi, ebx
mov dword [0x4d71cc], eax
mov edi, edx
sub edi, ebx
cmp esi, edi
jbe 0x4073b0
mov dword [0x4d71cc], edx
mov eax, edx
mov dword [ebp + 8], ecx
mov ecx, 0x4d7268
mov dword [0x4d71c8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004050e0
mov dword [esp + 4], 0xc
mov dword [esp], 0x4d71c0
call fcn.00458e00
mov eax, dword [0x4d71cc]
jmp 0x40731e
mov dword [esp + 4], ebx
mov dword [esp], 0x4d71c0
call fcn.00458e00
mov edi, dword [0x4d71cc]
jmp 0x40735a
or byte [0x4d71e8], 2
jmp 0x40737f
Function at 0x41ebc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
movzx eax, byte [eax]
cmp al, 0x24
mov byte [ebp - 0x20], al
jne 0x41ed3b
movzx eax, byte [esi + 1]
lea ecx, [esi + 1]
test al, al
je 0x41eca0
cmp al, 0x2f
je 0x41eca0
cmp al, 0x5c
je 0x41eca0
lea edx, [esi + 2]
xor eax, eax
movzx ebx, byte [edx]
add eax, 1
mov edi, eax
mov dword [ebp - 0x1c], edx
test bl, bl
jne 0x41ecc0
mov ebx, eax
lea eax, [eax + 1]
add eax, 0x1e
mov edi, 0x10
xor edx, edx
div edi
shl eax, 4
call fcn.00470810
sub esp, eax
lea edi, [esp + 0x1b]
and edi, 0xfffffff0
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edi
call sub.msvcrt.dll_strncpy
cmp byte [ebp - 0x20], 0x40
mov byte [edi + ebx], 0
je 0x41ece0
mov dword [esp], edi
call sub.msvcrt.dll_getenv
mov edx, str._home_jenkins_mingw32_workspace_avr_gcc_staging_label_Ubuntu14.04x64_mingw32_objdir
test eax, eax
cmove eax, edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00452be0
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_free
movzx eax, byte [ebx]
cmp al, 0x24
mov byte [ebp - 0x20], al
jne 0x41ecb0
mov esi, ebx
movzx eax, byte [esi + 1]
lea ecx, [esi + 1]
test al, al
jne 0x41ebe8
nop
mov dword [ebp - 0x1c], ecx
mov eax, 1
xor ebx, ebx
jmp 0x41ec15
cmp al, 0x40
je 0x41ec8d
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add edx, 1
cmp bl, 0x5c
je 0x41ecd1
cmp bl, 0x2f
jne 0x41ebfd
mov ebx, edi
add eax, 1
jmp 0x41ec15
mov dword [esp], edi
mov dword [esp + 8], 0
mov dword [esp + 4], str._ROOT
call fcn.00452be0
mov dword [esp], eax
mov edi, eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x41ed19
mov dword [esp], edi
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x20]
jmp 0x41ec62
mov eax, dword [str._home_jenkins_mingw32_workspace_avr_gcc_staging_label_Ubuntu14.04x64_mingw32_objdir]
mov dword [esp], edi
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x20]
mov edx, str._home_jenkins_mingw32_workspace_avr_gcc_staging_label_Ubuntu14.04x64_mingw32_objdir
test eax, eax
cmove eax, edx
jmp 0x41ec62
cmp al, 0x40
je 0x41ebd9
lea esp, [ebp - 0xc]
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret