joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
test ebx, ebx
je 0x40d277
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x40d272
mov eax, dword [ebx]
jmp 0x40d274
mov eax, ebx
mov byte [eax], 0
call fcn.004083b0
test al, al
je 0x40d289
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x48cbf4
push esi
call fcn.0040cc50
mov edi, eax
add esp, 8
mov dword [ebp - 0xc], edi
test edi, edi
je 0x40d280
push 0x10000
call fcn.00449e27
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
push edi
push 0x10000
push 1
push esi
call fcn.00453bd8
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40d316
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x40d2ec
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00404490
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x40d32c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.00453bd8
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x40d2d0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00453749
add esp, 4
test eax, eax
jne 0x40d32f
mov byte [ebp - 1], 1
jmp 0x40d333
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.0044f627
add esp, 4
test esi, esi
je 0x40d349
push esi
call fcn.00449e22
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d380
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0040c9f0
Function at 0x40d390
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x491094]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 8
jb 0x40d3b4
mov eax, dword [esi]
jmp 0x40d3b6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d3c9
shr eax, 4
and al, 1
jmp 0x40d3cb
xor al, al
test al, al
mov dword [esp + 0xc], 0
mov ecx, 0x4001
mov dword [esp + 0x24], 7
mov edi, 0x24001
mov dword [esp + 0x20], 0
cmove edi, ecx
mov ecx, dword [0x493a3c]
xor eax, eax
mov word [esp + 0x10], ax
test ecx, ecx
je 0x40d40d
mov eax, dword [ecx]
lea edx, [esp + 0x28]
push edx
call dword [eax + 8]
push edi
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0
mov word [esp + 0x38], 0
mov byte [esp + 0x3a], 0
call fcn.00414fc0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d456
cmp eax, 0xffffffff
je 0x40d456
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0xc]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
call fcn.00414800
mov bl, al
jmp 0x40d458
xor bl, bl
lea ecx, [esp + 0xc]
call fcn.004145f0
mov ecx, dword [0x493a3c]
test ecx, ecx
je 0x40d475
mov eax, dword [ecx]
lea edx, [esp + 0x28]
push edx
call dword [eax + 0xc]
mov eax, dword [esp + 0x24]
cmp eax, 8
jb 0x40d48d
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.004055c0
xor eax, eax
mov dword [esp + 0x24], 7
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call fcn.0040d0f0
mov ecx, dword [esp + 0x34]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00449be1
mov esp, ebp
pop ebp
ret
Function at 0x40f920
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x40f97b
mov ecx, esi
jmp 0x40f980
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x40f9a5
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x40f98f
mov eax, dword [eax]
jmp 0x40f973
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40fd10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x40fd8c
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x40fd8c
mov ecx, dword [edi]
nop word [eax + eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x40fdd4
cmp esi, eax
jne 0x40fd80
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x40fdba
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x40fe3d
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x40fe5f
mov edx, dword [ebp + 0x10]
lea edi, [edx + 0xc]
mov dword [esp + 0xc], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x40fe07
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.004055c0
mov edx, dword [esp + 0xc]
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x40fe1d
mov edi, dword [edi]
xor eax, eax
push edx
mov word [edi], ax
call fcn.00449974
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x40fe45
mov dword [ecx], edi
jmp 0x40fe5f
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x40fe5f
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.0040fe80
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 4], 0
mov esi, edx
cmp dword [ecx + 0x14], 8
push edi
jb 0x41106a
mov ecx, dword [ecx]
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4110ee
mov edi, dword [ebp - 4]
test edi, edi
je 0x4110ee
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 8
jb 0x4110a8
mov edx, dword [edx]
cmp dword [esi + 0x14], 8
jb 0x4110b0
mov esi, dword [esi]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4110b5
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411100
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 4], 0
mov esi, edx
cmp dword [ecx + 0x14], 8
push edi
jb 0x41111a
mov ecx, dword [ecx]
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41119e
mov edi, dword [ebp - 4]
test edi, edi
je 0x41119e
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 8
jb 0x411158
mov edx, dword [edx]
cmp dword [esi + 0x14], 8
jb 0x411160
mov esi, dword [esi]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411165
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411c30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x491094]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x492b50], 0
push esi
je 0x411c60
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00449be1
mov esp, ebp
pop ebp
ret
push 0x20
call fcn.00449941
mov ecx, eax
call fcn.00411b60
mov dword [0x492b50], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x411c9b
xor ecx, ecx
jmp 0x411caf
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411ca0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.00403ea0
lea eax, [esp + 4]
push eax
call fcn.00412690
mov eax, dword [esp + 0x18]
cmp eax, 8
jb 0x411cdc
inc eax
lea ecx, [esp + 4]
push eax
push dword [esp + 8]
call fcn.004055c0
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.00449be1
mov esp, ebp
pop ebp
ret

Function at 0x412690
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov edx, str._t_n_v_f_r
push esi
mov dword [ebp - 0x24], 0
xor eax, eax
push edi
mov edi, dword [0x492b50]
lea esi, [edx + 2]
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4126d0
sub edx, esi
lea eax, [ebp - 0x20]
sar edx, 1
push edx
push str._t_n_v_f_r
push eax
call fcn.004102c0
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x412728
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0
cmovae eax, dword [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [ebp - 0x24]
call fcn.00411d10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x41273d
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004055c0
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00449be1
mov esp, ebp
pop ebp
ret 4
Function at 0x414670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
push edi
test ebx, ebx
jns 0x41469d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x493a3c]
xor edi, edi
test ecx, ecx
je 0x4146e3
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x4146e3
mov ecx, dword [0x493a3c]
lea edi, [esi + 0x1c]
mov eax, ebx
mov dword [esp + 0x14], str.File::ReadAtCurrentPos
cdq
push edx
mov esi, dword [ecx]
push eax
mov eax, dword [esp + 0x18]
add eax, 4
push eax
push edi
push str.File::ReadAtCurrentPos
call dword [esi + 0x10]
mov esi, dword [esp + 0x10]
jmp 0x4146eb
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x414708
mov esi, dword [esp + 0x18]
jmp 0x41471a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x414717
xor esi, esi
jmp 0x41471a
or esi, 0xffffffff
test edi, edi
je 0x414732
mov ecx, dword [0x493a3c]
test ecx, ecx
je 0x414732
mov edx, dword [ecx]
push edi
push dword [esp + 0x18]
call dword [edx + 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x414740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 0
test edi, edi
jns 0x41476d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x493a3c]
xor ebx, ebx
test ecx, ecx
je 0x4147b3
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x4147b3
mov ecx, dword [0x493a3c]
lea ebx, [esi + 0x1c]
mov eax, edi
mov dword [esp + 0x14], str.File::WriteAtCurrentPos
cdq
push edx
mov esi, dword [ecx]
push eax
mov eax, dword [esp + 0x18]
add eax, 4
push eax
push ebx
push str.File::WriteAtCurrentPos
call dword [esi + 0x10]
mov esi, dword [esp + 0x10]
jmp 0x4147bb
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, 0xffffffff
test eax, eax
cmovne esi, dword [esp + 0x18]
test ebx, ebx
je 0x4147f0
mov ecx, dword [0x493a3c]
test ecx, ecx
je 0x4147f0
mov edx, dword [ecx]
push ebx
push dword [esp + 0x18]
call dword [edx + 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41cbe0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0044a600
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x100c], 0
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1010], 1
push eax
push 0
push str.UserAppDataPath
push dword [ecx]
mov dword [ebp - 0x100c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41cd2f
mov ecx, dword [ebp - 0x1010]
cmp ecx, 1
jne 0x41ccc2
cmp word [ebp - 0x808], ax
jne 0x41cc81
xor ecx, ecx
lea eax, [ebp - 0x808]
push ecx
push eax
mov ecx, edi
call fcn.00403ea0
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449be1
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x808]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cc90
sub ecx, edx
lea eax, [ebp - 0x808]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00403ea0
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449be1
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x41cd2a
push 0x400
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x41cd13
cmp eax, 0x400
ja 0x41cd13
lea eax, [ebp - 0x1008]
mov ecx, edi
push eax
call fcn.00402310
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449be1
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449be1
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00449be1
mov esp, ebp
pop ebp
ret 8
Function at 0x41d480
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push 0xffffffffffffffff
lea ecx, [edi + 4]
push 0
mov dword [edi], 0x48d418
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00404360
push 0x7d0
lea eax, [edi + 0x20]
mov dword [edi + 0x1c], 0
push eax
mov dword [edi], 0x48d3b4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
cmp dword [esi + 0x14], 0x10
jb 0x41d4e1
mov ecx, dword [esi]
jmp 0x41d4e3
mov ecx, esi
mov eax, dword [esi + 0x10]
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x68], eax
call fcn.0041ffa0
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x74]
call fcn.004200c0
push dword [ebp - 0x70]
push dword [ebp - 0x74]
call fcn.0041ec50
add esp, 8
lea ecx, [edi + 0x38]
push edx
push eax
call fcn.0041ecf0
push 0
push 0
lea ecx, [edi + 0x68]
call fcn.0041ecf0
mov ecx, dword [ebp - 8]
mov eax, edi
mov dword [edi + 0x68], 0x48d4b0
xor ecx, ebp
pop edi
pop esi
call fcn.00449be1
mov esp, ebp
pop ebp
ret 4
Function at 0x41df70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
sub esp, 8
mov dword [ebp - 0x38], esi
mov edx, esp
mov dword [edx], edi
test edi, edi
jne 0x41df9f
xor ecx, ecx
jmp 0x41dfbc
cmp byte [edi], 0
jne 0x41dfa8
xor ecx, ecx
jmp 0x41dfbc
mov ecx, edi
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41dfb0
sub ecx, esi
mov esi, dword [ebp - 0x38]
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x1c]
call fcn.00410ac0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x41dfd2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 8]
mov ebx, eax
cmp ecx, 8
jb 0x41dff0
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.004055c0
test ebx, ebx
jne 0x41e009
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449be1
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x41e0e8
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00449e27
add esp, 4
mov esi, eax
push ebx
push esi
sub esp, 8
mov edx, esp
mov dword [edx], edi
test edi, edi
je 0x41e050
cmp byte [edi], 0
jne 0x41e044
xor edi, edi
jmp 0x41e050
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41e047
sub edi, ecx
lea ecx, [ebp - 0x1c]
mov dword [edx + 4], edi
call fcn.00410ac0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x41e066
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x41e082
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.004055c0
push esi
lea ecx, [ebp - 0x1c]
call fcn.004023a0
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.004108d0
mov ecx, dword [ebp - 0x38]
push eax
call fcn.00405a90
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x41e0b4
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.00404930
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
cmp eax, 8
jb 0x41e0db
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.004055c0
test esi, esi
je 0x41e0e8
push esi
call fcn.00449e22
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449be1
mov esp, ebp
pop ebp
ret 8
Function at 0x41e2f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x491094]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x491a60]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00449e22
add esp, 4
mov edi, 0x100
nop word [eax + eax]
mov esi, dword [0x493a40]
xor dl, dl
test esi, esi
jle 0x41e388
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x41e383
mov eax, dword [esi*4 + 0x4934a0]
test eax, eax
je 0x41e383
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x41e360
dec edi
test edi, edi
jle 0x41e391
test dl, dl
jne 0x41e350
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00449be1
mov esp, ebp
pop ebp
ret

Function at 0x4223d9
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x491d00]
mov ecx, eax
inc eax
mov dword [0x491d00], eax
test ecx, ecx
je 0x422404
xor eax, eax
jmp 0x42248a
push ebx
mov ebx, dword [ebp + 8]
mov dword [section..data], 0x4546e7
mov dword [fcn.00452146], 0x452146
mov dword [fcn.0045461c], 0x45461c
mov dword [0x49100c], 0x4574c4
mov dword [fcn.0044f6ea], 0x44f6ea
test bl, 2
je 0x42246e
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x422477
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x422466
shr eax, 8
cmp al, 2
je 0x42246e
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x422477
call fcn.00403070
test eax, eax
je 0x42247c
push 2
pop eax
jmp 0x422489
mov dword [0x491d04], ebx
call fcn.0042c16b
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449be1
mov esp, ebp
pop ebp
ret