joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x50], 0x2b1
mov dword [ebp - 0x54], 0x366
mov dword [ebp - 0x58], 0x285
mov dword [ebp - 0x5c], 0x30d
mov dword [ebp - 0x28], 0x1c8
mov dword [ebp - 0x44], 0x2f2
mov dword [ebp - 0x60], 0x34c
mov dword [ebp - 0x20], 0x13d
mov dword [ebp - 0x64], 0xb1
mov dword [ebp - 0x68], 0x38d
mov dword [ebp - 0x24], 0x53
mov dword [ebp - 4], 0x7b
mov dword [ebp - 0x2c], 0x1bf
mov dword [ebp - 0x30], 0x311
mov dword [ebp - 0x3c], 0x6c
mov dword [ebp - 0x1c], 0x21a
mov dword [ebp - 0xc], 0x22d
mov dword [ebp - 8], 0x10c
mov dword [ebp - 0x48], 0x207
mov dword [ebp - 0x6c], 0x264
mov dword [ebp - 0x70], 0x345
mov dword [ebp - 0x74], 0xbf
mov dword [ebp - 0x4c], 0x2da
mov dword [ebp - 0x14], 0x208
mov dword [ebp - 0x78], 0x257
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x40d5d9
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x38]
jge 0x40d5a6
mov dword [ebp - 0x18], 1
jmp 0x40d5ad
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0xc]
and edx, eax
or edx, dword [ebp - 0x18]
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0xc]
nop
nop
dec ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x40], 0
je 0x40d5d9
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], 0
jmp 0x40d5eb
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x18992
cmp dword [ebp - 0x10], ecx
jge 0x40d61d
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp + 0x14]
test edx, edx
je 0x40d61b
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x48]
jge 0x40d615
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40d5e2
mov edx, dword [ebp - 4]
nop
inc edx
nop
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 8]
add ecx, 0x340
push ecx
mov edx, dword [ebp + 8]
add edx, 0x30d
push edx
mov eax, dword [ebp - 0x14]
sub eax, 0xc0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x15f
push ecx
mov edx, dword [ebp - 0x4c]
sub edx, 0x162
push edx
mov eax, dword [ebp - 4]
add eax, 0xfd
push eax
call fcn.0041df50
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x40e180
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x3c], 0x36
mov dword [ebp - 0x44], 0x320
mov dword [ebp - 0x48], 0x2ae
mov dword [ebp - 0x4c], 0x2d2
mov dword [ebp - 0x30], 0x33d
mov dword [ebp - 0x50], 0x3a0
mov dword [ebp - 0x20], 0x231
mov dword [ebp - 0x54], 0x3a1
mov dword [ebp - 0x58], 0x329
mov dword [ebp - 0x28], 0xd8
mov dword [ebp - 8], 0xf5
mov dword [ebp - 0x38], 0x2ad
mov dword [ebp - 0x5c], 0x331
mov dword [ebp - 0x18], 0x12
mov dword [ebp - 0xc], 0x8e
mov dword [ebp - 0x10], 0x1dd
mov dword [ebp - 0x60], 0xb9
mov dword [ebp - 0x2c], 0x224
mov dword [ebp - 0x1c], 0x175
mov dword [ebp - 0x40], 0xef
mov dword [ebp - 0x14], 0xb0
mov dword [ebp - 0x64], 0xce
mov dword [ebp - 0x24], 0x32
mov dword [ebp - 0x68], 0x2fe
mov dword [ebp - 0x34], 0x2c9
mov eax, dword [ebp - 0x10]
add eax, 0x149
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x29e
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x3c1
push edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x15
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xa0
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0x373
push edx
mov eax, dword [ebp - 8]
add eax, 0x57
push eax
call fcn.00412d50
add esp, 0x1c
mov ecx, dword [ebp - 8]
add ecx, 0x257
push ecx
mov edx, dword [ebp - 0x28]
add edx, 0x66
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffebd
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x79
push ecx
mov edx, dword [ebp - 0x30]
add edx, 0x94
push edx
mov eax, dword [ebp + 0x1c]
sub eax, 0x12
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x24
push ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x28f
push edx
mov eax, dword [ebp - 0x38]
sub eax, 0x26d
push eax
call fcn.004096e0
add esp, 0x24
call fcn.00424580
mov dword [ebp - 4], 0
jmp 0x40e2e7
mov ecx, dword [ebp - 4]
inc ecx
nop
nop
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x3c]
sub edx, 0x186d6
cmp dword [ebp - 4], edx
jge 0x40e306
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [ebp + 0x1c]
nop
nop
inc eax
mov dword [ebp + 0x1c], eax
jmp 0x40e2de
mov ecx, dword [ebp - 0x40]
sub ecx, 0x8c
push ecx
mov edx, dword [ebp + 8]
add edx, 0x53
push edx
call fcn.0041e580
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x40f550
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x14], 0x21b
mov dword [ebp - 0x20], 0xb3
mov dword [ebp - 0x18], 0x3e8
mov dword [ebp - 0x24], 0x124
mov dword [ebp - 0x28], 0x9b
mov dword [ebp - 0x2c], 0x2ed
mov dword [ebp - 0x30], 0x380
mov dword [ebp - 0x34], 0x57
mov dword [ebp - 0x38], 0x85
mov dword [ebp - 0xc], 0x40
mov dword [ebp - 0x3c], 0x174
mov dword [ebp - 0x40], 0x2c1
mov dword [ebp - 0x44], 0x2c1
mov dword [ebp - 0x48], 0xc4
mov dword [ebp - 0x4c], 0x24d
mov dword [ebp - 0x10], 0xf6
mov dword [ebp - 0x1c], 0x302
mov dword [ebp - 0x50], 0x164
mov dword [ebp - 0x54], 0x1b9
mov dword [ebp - 0x58], 0x284
mov dword [ebp - 0x5c], 0x3de
mov dword [ebp - 0x60], 0x2d2
mov dword [ebp - 4], 0
jmp 0x40f602
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x18796
cmp dword [ebp - 4], ecx
jge 0x40f62d
mov edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x1c]
jge 0x40f62b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [ebp + 0x10]
nop
nop
inc eax
mov dword [ebp + 0x10], eax
jmp 0x40f5f9
mov dword [ebp - 8], 0
jmp 0x40f63f
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, 0x30e
cmp dword [ebp - 8], edx
jge 0x40f658
mov eax, dword [ebp - 0xc]
nop
nop
dec eax
mov dword [ebp - 0xc], eax
jmp 0x40f636
mov esp, ebp
pop ebp
ret
Function at 0x413d80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x54], 0x203
mov dword [ebp - 0x48], 0x3b6
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x24], 0x2dd
mov dword [ebp - 0x2c], 0x9b
mov dword [ebp - 0x44], 0x272
mov dword [ebp - 0x1c], 0x1f
mov dword [ebp - 0x58], 0x139
mov dword [ebp - 0x5c], 0x222
mov dword [ebp - 0x60], 0x32b
mov dword [ebp - 0x64], 0x3c5
mov dword [ebp - 0x68], 0x14a
mov dword [ebp - 0x6c], 0x12e
mov dword [ebp - 0x70], 0x28a
mov dword [ebp - 0x10], 0x1b9
mov dword [ebp - 0x30], 0xdc
mov dword [ebp - 0x28], 0x45
mov dword [ebp - 0x20], 0x3c9
mov dword [ebp - 0x74], 0x83
mov dword [ebp - 0x50], 0x382
mov dword [ebp - 4], 0x360
mov dword [ebp - 0x4c], 0x179
mov dword [ebp - 0x38], 0x1d
mov eax, dword [ebp - 0x24]
add eax, 0x60
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x49
push ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x15
push edx
mov eax, dword [ebp - 0x2c]
sub eax, 0xfffffe59
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x290
push ecx
mov edx, dword [ebp - 0x30]
add edx, 0x20a
push edx
call fcn.00409f10
add esp, 0x18
mov dword [ebp - 8], 0
jmp 0x413e73
mov eax, dword [ebp - 8]
nop
nop
inc eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x186a6
cmp dword [ebp - 8], ecx
jge 0x413ef9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 4]
nop
inc ecx
nop
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x40]
jge 0x413ef4
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x48]
jge 0x413eb8
mov dword [ebp - 0x14], 1
jmp 0x413ebf
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
sub ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x4c]
jge 0x413ed9
mov dword [ebp - 0x18], 1
jmp 0x413ee0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 4]
and eax, dword [ebp - 0x18]
je 0x413ef4
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x413e6a
mov dword [ebp - 0xc], 0
jmp 0x413f0b
mov edx, dword [ebp - 0xc]
inc edx
nop
nop
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x50]
add eax, 0xfffffc7f
cmp dword [ebp - 0xc], eax
jge 0x413f23
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x413f02
mov esp, ebp
pop ebp
ret
Function at 0x415400
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x28], 0x3ca
mov dword [ebp - 0x34], 0xec
mov dword [ebp - 0x10], 0x18d
mov dword [ebp - 8], 0x3e6
mov dword [ebp - 0x1c], 0x33e
mov dword [ebp - 0x38], 0x3d6
mov dword [ebp - 0x3c], 0x2a1
mov dword [ebp - 0x40], 0xc9
mov dword [ebp - 0x20], 0xfa
mov dword [ebp - 0x44], 0x247
mov dword [ebp - 0x48], 0x9b
mov dword [ebp - 0x4c], 0x32a
mov dword [ebp - 0x50], 0x322
mov dword [ebp - 0x54], 0x307
mov dword [ebp - 0x2c], 0xaf
mov dword [ebp - 0x24], 0x15b
mov dword [ebp - 0x58], 0x79
mov dword [ebp - 0xc], 0x47
mov dword [ebp - 0x5c], 0x152
mov dword [ebp - 0x60], 0x2b5
mov dword [ebp - 0x30], 0x1c7
mov dword [ebp - 0x64], 0x54
mov dword [ebp - 0x68], 0x3aa
mov dword [ebp - 0x6c], 0x3e5
mov eax, dword [ebp - 0xc]
add eax, 0x211
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x245
push ecx
mov edx, dword [ebp + 0x14]
add edx, 9
push edx
mov eax, dword [ebp - 0x20]
add eax, 3
push eax
mov ecx, dword [ebp + 0x10]
sub ecx, 0x118
push ecx
mov edx, dword [ebp + 0x14]
sub edx, 0x1b5
push edx
mov eax, dword [ebp - 0x24]
sub eax, 0xfffffebd
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0xbe
push ecx
call fcn.0041d0b0
add esp, 0x20
mov edx, dword [ebp - 0xc]
add edx, 0x33c
push edx
mov eax, dword [ebp + 0x10]
sub eax, 0x3f
push eax
call fcn.004246a0
add esp, 8
mov dword [ebp - 4], 0
jmp 0x415529
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x1c]
sub edx, 0x18a39
cmp dword [ebp - 4], edx
jge 0x415588
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jge 0x415548
mov dword [ebp - 0x14], 1
jmp 0x41554f
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x10]
jge 0x415560
mov dword [ebp - 0x18], 1
jmp 0x415567
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
or edx, dword [ebp - 0x18]
je 0x415586
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x30]
je 0x415586
mov ecx, dword [ebp - 8]
inc ecx
nop
nop
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x415520
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov esp, ebp
pop ebp
ret
Function at 0x4175c0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x10], 0x198
mov dword [ebp - 0x44], 0x30a
mov dword [ebp - 0x1c], 0x393
mov dword [ebp - 0xc], 0x293
mov dword [ebp - 4], 0x103
mov dword [ebp - 0x28], 0x37e
mov dword [ebp - 0x48], 0x242
mov dword [ebp - 0x18], 0x34a
mov dword [ebp - 0x4c], 0x368
mov dword [ebp - 0x50], 0x3e4
mov dword [ebp - 0x54], 0x206
mov dword [ebp - 0x58], 0x265
mov dword [ebp - 0x3c], 0x390
mov dword [ebp - 0x5c], 0x32c
mov dword [ebp - 0x60], 0x1ae
mov dword [ebp - 0x64], 0xa9
mov dword [ebp - 0x68], 0x215
mov dword [ebp - 0x6c], 0x182
mov dword [ebp - 0x70], 0x276
mov dword [ebp - 0x40], 0x185
mov dword [ebp - 0x14], 0x3b5
mov dword [ebp - 0x2c], 0x3ce
mov dword [ebp - 0x74], 0x2dd
mov dword [ebp - 0x38], 0x28
mov dword [ebp - 0x78], 0x2ae
call fcn.00425ab0
mov eax, dword [ebp + 0x1c]
sub eax, 0x82
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x17d
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x193
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xfffffe58
push eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x17d
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x249
push edx
mov eax, dword [ebp + 0x1c]
add eax, 0x199
push eax
mov ecx, dword [ebp + 0x14]
sub ecx, 0xd8
push ecx
call fcn.0040c4d0
add esp, 0x20
mov dword [ebp - 8], 0
jmp 0x4176e1
mov edx, dword [ebp - 8]
inc edx
nop
nop
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, 0xfffe76cd
cmp dword [ebp - 8], eax
jge 0x41771c
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x34]
jge 0x41771a
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
jmp 0x4176d8
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x38]
jge 0x417736
mov dword [ebp - 0x20], 1
jmp 0x41773d
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x3c]
jge 0x41774e
mov dword [ebp - 0x24], 1
jmp 0x417755
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x24]
je 0x417769
mov ecx, dword [ebp + 0x20]
nop
inc ecx
nop
mov dword [ebp + 0x20], ecx
mov esp, ebp
pop ebp
ret
Function at 0x419830
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x48], 0x341
mov dword [ebp - 0x38], 0x4d
mov dword [ebp - 0x4c], 0x71
mov dword [ebp - 0x50], 0x10e
mov dword [ebp - 0x2c], 0x278
mov dword [ebp - 0x54], 0xc7
mov dword [ebp - 0x58], 0x1a8
mov dword [ebp - 0x5c], 0x2ba
mov dword [ebp - 0x40], 0x32c
mov dword [ebp - 0x60], 0x3ae
mov dword [ebp - 0x64], 0x2d4
mov dword [ebp - 0x30], 0x15d
mov dword [ebp - 0xc], 0x318
mov dword [ebp - 0x28], 0x266
mov dword [ebp - 0x68], 0x353
mov dword [ebp - 8], 0x2d6
mov dword [ebp - 0x10], 0xe
mov dword [ebp - 0x1c], 0x91
mov dword [ebp - 0x6c], 0x17
mov dword [ebp - 0x70], 0x377
mov dword [ebp - 0x74], 0x39a
mov dword [ebp - 0x44], 0x3e8
mov dword [ebp - 0x34], 0x1f7
mov dword [ebp - 0x78], 0x84
mov dword [ebp - 4], 0
jmp 0x4198f0
mov eax, dword [ebp - 4]
nop
inc eax
nop
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x18731
cmp dword [ebp - 4], ecx
jge 0x419959
mov edx, dword [ebp - 0x2c]
or edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0xc]
jge 0x419912
mov dword [ebp - 0x14], 1
jmp 0x419919
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
nop
inc eax
nop
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x34]
jge 0x419933
mov dword [ebp - 0x18], 1
jmp 0x41993a
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 8]
and edx, dword [ebp - 0x14]
xor edx, dword [ebp - 0x38]
or edx, dword [ebp - 0x18]
je 0x419951
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4198e7
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp + 0x20]
jge 0x419973
mov dword [ebp - 0x20], 1
jmp 0x41997a
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0x18]
jge 0x41998b
mov dword [ebp - 0x24], 1
jmp 0x419992
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x24]
je 0x4199bb
mov edx, dword [ebp + 0x28]
and edx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x28]
nop
dec eax
nop
mov dword [ebp + 0x28], eax
cmp dword [ebp - 0x3c], 0
je 0x4199bb
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x40]
add edx, 0x56
push edx
mov eax, dword [ebp - 0x44]
add eax, 0xffffff13
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa1
push ecx
call fcn.00416cc0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41b650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x48], 0x2b0
mov dword [ebp - 8], 0x9c
mov dword [ebp - 0x70], 0x1fa
mov dword [ebp - 0x64], 0x187
mov dword [ebp - 0x74], 0x314
mov dword [ebp - 0x30], 0x379
mov dword [ebp - 0x78], 0x31e
mov dword [ebp - 0x7c], 0x2e3
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x60], 0x341
mov dword [ebp - 0x1c], 0x1d0
mov dword [ebp - 0x34], 0x1f2
mov dword [ebp - 0x4c], 0x13
mov dword [ebp - 4], 0x384
mov dword [ebp - 0x80], 0xe6
mov dword [ebp - 0x6c], 0x1dd
mov dword [ebp - 0x10], 0x17d
mov dword [ebp - 0x44], 0x374
mov dword [ebp - 0x84], 0xda
mov dword [ebp - 0x68], 0x20c
mov dword [ebp - 0x2c], 0x1a9
mov dword [ebp - 0x88], 0x2a4
mov dword [ebp - 0xc], 0x260
mov dword [ebp - 0x40], 0x6e
mov eax, dword [ebp - 4]
sub eax, 0x5c
push eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x146
push ecx
call fcn.004116d0
add esp, 8
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x30]
jge 0x41b731
mov dword [ebp - 0x24], 1
jmp 0x41b738
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 4]
jge 0x41b749
mov dword [ebp - 0x28], 1
jmp 0x41b750
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x48]
jge 0x41b761
mov dword [ebp - 0x20], 1
jmp 0x41b768
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x10]
inc edx
nop
nop
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 0x10]
and edx, dword [ebp - 0x28]
or edx, ecx
je 0x41b796
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 0
jmp 0x41b7a8
mov ecx, dword [ebp - 0x14]
inc ecx
nop
nop
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0x18a19
cmp dword [ebp - 0x14], edx
jge 0x41b858
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 4]
nop
nop
inc edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x54]
jge 0x41b853
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
xor edx, dword [ebp - 4]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 4]
nop
nop
dec ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x5c]
jge 0x41b80f
mov dword [ebp - 0x38], 1
jmp 0x41b816
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x64]
jge 0x41b82a
mov dword [ebp - 0x3c], 1
jmp 0x41b831
mov dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x38]
or ecx, dword [ebp - 0x3c]
je 0x41b853
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x68]
jge 0x41b853
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jmp 0x41b79f
mov edx, dword [ebp - 0x40]
add edx, 0x355
push edx
mov eax, dword [ebp - 0x6c]
add eax, 0xfffffe95
push eax
call fcn.0041f770
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41d450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x18], 0x1f7
mov dword [ebp - 0x1c], 0x33d
mov dword [ebp - 0x20], 0x8e
mov dword [ebp - 0x24], 0x1c9
mov dword [ebp - 0x28], 0x21c
mov dword [ebp - 0x2c], 0x1e3
mov dword [ebp - 0x30], 0x1c3
mov dword [ebp - 0x34], 0x16e
mov dword [ebp - 0x38], 0x221
mov dword [ebp - 0x3c], 0x38b
mov dword [ebp - 0x40], 0x4f
mov dword [ebp - 0x44], 0x3b0
mov dword [ebp - 0x48], 0x368
mov dword [ebp - 0x10], 0x1c7
mov dword [ebp - 0xc], 0xb7
mov dword [ebp - 4], 0x9e
mov dword [ebp - 0x4c], 0xb7
mov dword [ebp - 0x50], 0x26c
mov dword [ebp - 0x54], 0x189
mov dword [ebp - 0x58], 0xe3
mov dword [ebp - 0x14], 0x219
mov dword [ebp - 0x5c], 0x196
mov dword [ebp - 0x60], 0x12
mov eax, dword [ebp - 4]
nop
nop
dec eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x41d512
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x18867
cmp dword [ebp - 8], edx
jge 0x41d531
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x41d509
mov ecx, dword [ebp - 4]
add ecx, 0x147
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x38
push edx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffe86
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x22e
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x112
push edx
mov eax, dword [ebp - 0x14]
sub eax, 0xbd
push eax
call fcn.0040ef50
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x41efa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x50], 0x3e2
mov dword [ebp - 0x18], 0x3ab
mov dword [ebp - 0x54], 0x54
mov dword [ebp - 0x58], 0x49
mov dword [ebp - 0x38], 0x380
mov dword [ebp - 0x3c], 0xaf
mov dword [ebp - 0xc], 0x177
mov dword [ebp - 0x5c], 0x371
mov dword [ebp - 0x24], 0x345
mov dword [ebp - 0x2c], 0x392
mov dword [ebp - 0x1c], 0x10f
mov dword [ebp - 0x20], 0x42
mov dword [ebp - 0x60], 0xc3
mov dword [ebp - 0x64], 0x1ac
mov dword [ebp - 0x40], 0x31b
mov dword [ebp - 0x68], 0x273
mov dword [ebp - 0x34], 0x30e
mov dword [ebp - 0x6c], 0x34e
mov dword [ebp - 0x28], 0x255
mov dword [ebp - 0x14], 0x378
mov dword [ebp - 0x30], 0x225
mov dword [ebp - 0x70], 0x235
mov dword [ebp - 4], 0x31b
mov dword [ebp - 0x4c], 0x242
mov dword [ebp - 0x74], 0x204
mov eax, dword [ebp + 8]
add eax, 0x114
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xf
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0xe7
push edx
call fcn.00424b40
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, 0xfffffe1e
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x1ae
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0x157
push edx
mov eax, dword [ebp - 0x18]
add eax, 0xfffffdb6
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x2a
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x61
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0xea
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x19
push ecx
call fcn.0040d110
add esp, 0x20
mov dword [ebp - 8], 0
jmp 0x41f0d5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x38]
add eax, 0xfffe75e0
cmp dword [ebp - 8], eax
jge 0x41f0f3
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x41f0cc
mov dword [ebp - 0x10], 0
jmp 0x41f105
mov edx, dword [ebp - 0x10]
inc edx
nop
nop
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x18a18
cmp dword [ebp - 0x10], eax
jge 0x41f14b
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 4]
nop
inc eax
nop
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jge 0x41f149
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x4c]
jge 0x41f149
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
mov eax, dword [ebp - 4]
nop
inc eax
nop
mov dword [ebp - 4], eax
jmp 0x41f0fc
mov ecx, dword [ebp - 0x1c]
add ecx, 0x273
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0x2b9
push edx
mov eax, dword [ebp - 4]
sub eax, 0x26f
push eax
call fcn.00416cc0
add esp, 0xc
mov esp, ebp
pop ebp
ret