joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421902
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x421771
mov dword [esp], 0x605aa4
call fcn.00420ee1
mov eax, dword [0x4c7360]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x421949
mov eax, dword [ebp - 0x20]
jmp 0x421a94
call fcn.004207bd
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x421960
cmp dword [ebp - 0x20], 0
jne 0x42196a
mov eax, 0
jmp 0x421a94
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004208b4
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x421a3c
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4c7360]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x421a91
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x421b58
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.00421902
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.00421795
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x421bb3
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x4c7360]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x421cdd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x421c45
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x421c02
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004206cb
mov dword [ebp - 0x10], 0
mov eax, dword [0x4c7360]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x421cdd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x421c75
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x421cdd
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004206cb
mov dword [ebp - 0x10], 0
mov eax, dword [0x4c7360]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x423910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4c7370
call fcn.00420062
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x42393c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x42397e
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.0041d9b0
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x4c7370
call fcn.004200da
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x490f80
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ecx + 4]
test eax, eax
je 0x490fa0
mov edx, dword [ecx]
mov dword [esp], edx
call eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, 4
lea esi, [esp + 0x2c]
nop
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [edi + 8]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
test eax, eax
jle 0x490fd0
sub ebx, eax
je 0x490ff8
add esi, eax
jmp 0x490fb0
cmp eax, 0xffffffff
jne 0x491004
mov dword [esp + 0x1c], ebp
call ebp
cmp dword [eax], 4
je 0x490fb0
mov eax, dword [esp + 0x1c]
call eax
mov edx, str.random_device_could_not_be_read
mov eax, dword [eax]
call fcn.004bfb80
lea esi, [esi]
mov eax, dword [esp + 0x2c]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [esp + 0x1c], eax
jmp 0x490fe0
Function at 0x4bff40
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4bcf32
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.004298e0
mov edx, eax
test eax, eax
je 0x4bff2c
jmp 0x4bcf09
call fcn.004be968
nop
nop
nop
call fcn.004be968
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x30
mov dword [esp + 4], 0
mov dword [esp], 0x4c76d0
call fcn.0041fd88
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x4c76d4], 0
mov dword [0x4c76d8], 0
mov dword [0x4c76dc], 0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
jne 0x4bffd6
jmp 0x4c0096
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov ebx, eax
test eax, eax
je 0x4c0050
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4bffc0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4bffc0
cmp byte [ebx + 0xf], 0x2e
jne 0x4bffc0
add ebx, 0x10
lea esi, [esp + 0x18]
mov edi, dword [esi]
test edi, edi
je 0x4c0033
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x4c003d
cmp byte [ebx + edi], 0x3d
je 0x4c00c4
add esi, 0xc
lea eax, [esp + 0x30]
cmp eax, esi
jne 0x4c0016
jmp 0x4bffc0
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4c76dc], ebx
test ebx, ebx
jne 0x4c00a5
mov dword [esp], 0x4bdd90
call fcn.00401494
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [0x4c76dc], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [0x4c76d8], eax
test eax, eax
je 0x4c0102
xor edx, edx
mov dword [0x4c76d4], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4c0083
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp], eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x4c00f2
test dl, dl
jne 0x4bffc0
test eax, eax
js 0x4bffc0
mov dword [esi + 8], eax
jmp 0x4bffc0
xor ecx, ecx
mov dword [0x4c76dc], ecx
jmp 0x4c0083
Function at 0x10007830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000ba65
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10011008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.1000a08d
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call sub.VCRUNTIME140.dll_memset
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012952
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10012a87
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], 1
xor eax, eax
inc eax
cmp eax, 0x8bb1
je 0x100129d4
mov dword [ebp - 0x44], 1
jmp 0x100129d8
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, 0xffff
test eax, eax
je 0x10012a02
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10012a02
mov dword [ebp - 8], 1
jmp 0x10012a06
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 8]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
add ecx, dword [eax]
je 0x10012a1e
mov dword [ebp - 0xc], 1
jmp 0x10012a22
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jg 0x10012a35
mov dword [ebp - 0x10], 1
jmp 0x10012a39
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0xffffffff
jle 0x10012a48
mov dword [ebp - 0x14], 1
jmp 0x10012a4c
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x71ce904c
jle 0x10012a5e
mov dword [ebp - 0x1c], 1
jmp 0x10012a62
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jl 0x10012a75
mov dword [ebp - 0x20], 1
jmp 0x10012a79
and dword [ebp - 0x20], 0
imul eax, dword [ebp - 0x20], 0x8b73
mov ecx, dword [ebp - 0x54]
mov dword [ecx], eax
jmp 0x10012a96
push 0x1f9e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x10016d40
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016d70
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10016d6e
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10016dcd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10016d92
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x10016dcd
mov dword [ebp - 8], 0
jmp 0x10016daa
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x10016dbd
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1c], 0xffffffff
jmp 0x10016da3
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1c], 0x17ad2
jmp 0x10016d87
mov esp, ebp
pop ebp
ret
Function at 0x100181e3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10018349
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x10018281
mov dword [ebp - 8], 1
jmp 0x10018285
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 8], eax
jle 0x100182a0
mov dword [ebp - 0x1c], 1
jmp 0x100182a4
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
add ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
imul ecx, dword [edx]
cmp dword [eax], ecx
jne 0x100182c2
mov dword [ebp - 0x20], 1
jmp 0x100182c6
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jge 0x100182d9
mov dword [ebp - 0x24], 1
jmp 0x100182dd
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 1
jne 0x100182ec
mov dword [ebp - 0x50], 1
jmp 0x100182f0
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x1001830d
mov dword [ebp - 0x28], 1
jmp 0x10018311
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x28], eax
jle 0x10018324
mov dword [ebp - 0x2c], 1
jmp 0x10018328
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2c]
jg 0x1001833b
mov dword [ebp - 0x30], 1
jmp 0x1001833f
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1001836e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x1001836e
push 0x1f9e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x10023dcb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10023dfe
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x10023e0d
push 0x1f9e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x10029c40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x7aa
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp + 8]
push eax
call fcn.10029bee
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10029c75
xor eax, eax
jmp 0x10029da8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10029c93
xor eax, eax
jmp 0x10029da8
push 1
push 0x72c5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.100299dc
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x10029cb6
xor eax, eax
jmp 0x10029da8
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.10029abe
add esp, 0x18
push dword [ebp - 4]
push dword [ebp + 8]
push dword [ebp - 8]
push 0
call fcn.10028d3c
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10029d21
push dword [ebp - 4]
push dword [ebp - 0x14]
push 0x793
push 0
push 0x333d
push 0x419b
push 0x30e4
push 0x798a
push 0x647
call fcn.100283d9
add esp, 0x24
push dword [ebp - 4]
call fcn.100298dc
pop ecx
test eax, eax
jne 0x10029d32
xor eax, eax
jmp 0x10029da8
push 0x2988
push 0x449
push dword [ebp - 4]
push 0
push 0x56d0
call fcn.10023e11
add esp, 0x14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10029d90
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10029d6d
xor eax, eax
jmp 0x10029da8
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10029d86
xor eax, eax
jmp 0x10029da8
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10029da1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10029da5
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1003c321
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003c368
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1003c383
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003c383
push 0x1f9e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret