joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40417c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovaps xmm0, xmmword [str.FeuCnmlaodMioeV]
vmovups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xf
jne 0x4041bc
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4041ee
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._wfeum_]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x73616f69
mov word [ecx + 0xc], 0x7267
mov byte [ecx + 0xe], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xe
jne 0x40423f
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x40426c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._feum_i]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x6773616f
mov word [ecx + 0xc], 0x72
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xd
jne 0x4042b9
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4042ec
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [0x438cd0]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x7767
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xa
jne 0x404336
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404362
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._q__va]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x776773
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xb
jne 0x4043a9
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x4043dc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str._p_as]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x6267
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xa
jne 0x404426
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404452
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x75697965
mov byte [ecx + 4], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 4
jne 0x404490
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4044bc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x6979455e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 5
jne 0x4044fc
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x40452e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x6979655e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 5
jne 0x40456e
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4045a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.qtibkey]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x7569
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xa
jne 0x4045ea
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x404616
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.DxhtQrnc]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x727364
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xb
jne 0x40465d
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404690
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.otelm.el]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x6d
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 9
jne 0x4046d6
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404708
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [0x438d3d]
vmovsd qword [ecx + 0xd], xmm0
vmovups xmm0, xmmword [str.NuUom_pWidwNfRebthoo]
vmovups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0x14
jne 0x404755
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x405721
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov esi, dword [0x441070]
imul ebp, ecx, 0x2c
mov eax, dword [esi + ebp]
movzx ecx, byte [esi + ebp + 0x14]
xor edx, edx
and ecx, 1
sete dl
lea edx, [edx + edx*4]
lea edi, [eax + edx]
add edi, 0xfffffffb
lea eax, [ecx + ecx + 5]
mov ecx, esp
push ecx
push 0x40
mov dword [esp + 0x10], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x405794
lea ecx, [esi + ebp]
add ecx, 0x14
test ebx, ebx
mov dword [esp + 4], ecx
je 0x40579b
mov byte [edi], 0xe9
mov eax, dword [esi + ebp + 4]
sub eax, edi
add eax, 0xfffffffb
mov dword [edi + 1], eax
test byte [ecx], 1
mov edx, esp
je 0x4057bc
add esi, ebp
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x4057bc
mov eax, 0xa
jmp 0x4057f6
test byte [ecx], 1
lea eax, [esi + ebp + 0xc]
mov edx, esp
jne 0x4057b2
mov cl, byte [eax + 4]
mov byte [edi + 4], cl
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x4057bc
mov ecx, dword [eax]
mov eax, dword [eax + 3]
mov dword [edi + 3], eax
mov dword [edi], ecx
push edx
push dword [esp + 4]
mov esi, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp + 4]
mov al, byte [edx]
and bl, 1
mov ecx, ebx
add cl, bl
and al, 0xf9
or al, cl
shl bl, 2
or bl, al
mov byte [edx], bl
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4057fe
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
test eax, eax
je 0x40584e
mov esi, ecx
cmp dword [ecx + 8], 0
je 0x40583f
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call ebp
test eax, eax
je 0x405837
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x405818
mov eax, dword [esi]
push eax
push 0
push dword [0x44106c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408cf0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
call fcn.0040a4d0
test al, al
je 0x408d24
push 2
call dword [0x440e8c]
add esp, 4
push ebx
push edi
push esi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.004085b0
add esp, 0x14
pop esi
pop edi
pop ebx
jmp fcn.0040a5d0

Function at 0x409ee0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x409ef1
jmp dword [eax*4 + 0x43a240]
cmp dword [0x4410c4], 0
je 0x409ff3
push 0x4410c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4410e0]
test edi, edi
je 0x409fe8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409f3b
mov edi, dword [edi + 8]
test edi, edi
je 0x409fe8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x409f30
test esi, esi
je 0x409f30
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x409f30
cmp dword [0x4410c4], 0
jne 0x409f70
push 0x4410c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4410c4], 1
jmp case.default.0x409ef1
call fcn.00407cc0
jmp case.default.0x409ef1
cmp dword [0x4410c4], 0
je case.default.0x409ef1
push 0x4410c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4410e0]
test edi, edi
je 0x40a043
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x409fc7
mov edi, dword [edi + 8]
test edi, edi
je 0x40a043
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x409fc0
test esi, esi
je 0x409fc0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x409fc0
push 0x4410c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4410c4]
cmp eax, 1
jne case.default.0x409ef1
mov eax, dword [0x4410e0]
test eax, eax
je 0x40a022
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.0042cb76
add esp, 4
mov eax, esi
test esi, esi
jne 0x40a010
mov dword [0x4410e0], 0
mov dword [0x4410c4], 0
push 0x4410c8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x409ef1
push 0x4410c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40a180
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x42d004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x40a1e6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x40a1e6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x40a1e6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x40a1e6
mov edx, dword [esp + 0xc]
sub edx, dword [0x42d004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x40a1d6
add esi, 0x28
dec ecx
je 0x40a1e6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x40a1d0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x40a1d0
mov eax, esi
pop esi
pop edi
ret
Function at 0x40a420
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
cmp byte [0x442093], 1
jne 0x40a43e
cmp byte [0x442092], 0
jne 0x40a45d
jmp 0x40a478
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a478
push 2
call dword [0x440e8c]
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.0040a510
add esp, 0x10
mov dword [esi], 0x43a430
mov dword [esi + 4], 0x442088
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.0040b0f0
xor eax, eax
pop esi
pop edi
ret

Function at 0x40a4d0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x442093], 1
jne 0x40a4e4
cmp byte [0x442092], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x442092]
mov byte [0x442093], 1
ret

Function at 0x40a530
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x442093], 1
jne 0x40a554
cmp byte [0x442092], 0
jne 0x40a573
jmp 0x40a58f
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a58f
push 2
call dword [0x440e8c]
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.0040a510
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x40a5c2
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a5d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x442093], 1
jne 0x40a5f7
cmp byte [0x442092], 0
jne 0x40a616
jmp 0x40a632
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a632
push 2
call dword [0x440e8c]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.0040a510
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
mov edi, 0xffffe672
test al, al
je 0x40a6c2
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
push ebx
call edi
xor edi, edi
cmp ebx, 0xffffffff
jne 0x40a6c2
mov eax, dword [esi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov eax, esp
mov ecx, esi
push eax
call ebx
mov eax, dword [esi]
mov ebx, dword [eax + 0x34]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0
call ebx
cmp dword [esp + 0x10], 0
je 0x40a6c2
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0xfffffffffffffffe
call ebx
mov ebx, eax
add ebx, dword [esp + 0x10]
mov eax, dword [esi]
mov ebp, dword [eax + 0x10]
mov ecx, ebp
call dword [section..00cfg]
mov ecx, esi
push ebx
push 0xfffffffffffffffe
call ebp
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40a6d0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x442093], 1
jne 0x40a6ea
cmp byte [0x442092], 0
jne 0x40a709
jmp 0x40a723
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a723
push 2
call dword [0x440e8c]
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.0040a510
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x40a740
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x442093], 1
jne 0x40a75a
cmp byte [0x442092], 0
jne 0x40a779
jmp 0x40a793
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a793
push 2
call dword [0x440e8c]
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.0040a510
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x40a7b0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x442093], 1
jne 0x40a7cf
cmp byte [0x442092], 0
jne 0x40a7ee
jmp 0x40a809
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a809
push 2
call dword [0x440e8c]
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.0040a510
add esp, 0x10
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x40a830
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x442093], 1
jne 0x40a84a
cmp byte [0x442092], 0
jne 0x40a869
jmp 0x40a883
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a883
push 2
call dword [0x440e8c]
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.0040a510
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x40a8a0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x442093], 1
jne 0x40a8c4
cmp byte [0x442092], 0
jne 0x40a8e3
jmp 0x40a8ff
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442093], 1
test eax, eax
setne byte [0x442092]
je 0x40a8ff
push 2
call dword [0x440e8c]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.0040a510
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40ada0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x442091], 1
jne 0x40adb4
cmp byte [0x442090], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x442090]
mov byte [0x442091], 1
ret
Function at 0x40dfb0
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x101c
call fcn.004082c4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x40e112
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x40e169
shr ecx, 2
cmp ecx, 2
mov eax, 1
cmovae eax, ecx
mov dword [esp + 0xc], eax
mov bl, 1
mov dword [esp + 0x10], ecx
jmp 0x40e02a
mov edx, dword [esp + 0x14]
inc edx
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setb bl
xor eax, eax
cmp edx, dword [esp + 0xc]
je 0x40e169
mov byte [esp + 3], bl
mov dword [esp + 0x14], edx
mov esi, dword [esp + edx*4 + 0x1c]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x1034]
mov dword [edx], esi
mov dword [esp + 8], esi
movzx esi, word [esi + eax + 6]
test esi, esi
je 0x40e010
add eax, dword [esp + 8]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp + 4], 0
xor ebx, ebx
jmp 0x40e076
add ebp, 0x28
dec esi
je 0x40e010
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 8]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x40e0b0
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x40e0e0
test bl, 1
jne 0x40e0ff
jmp 0x40e070
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1030]
cmp eax, ecx
movzx eax, bl
mov ebx, eax
mov edx, 1
cmova ebx, edx
cmp edi, ecx
cmova ebx, eax
test bl, 1
jne 0x40e0ff
jmp 0x40e070
mov ecx, dword [esp + 0x1034]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp + 4], eax
test bl, 1
je 0x40e070
mov eax, dword [esp + 4]
and al, 1
je 0x40e070
movzx eax, byte [esp + 3]
jmp 0x40e169
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x442091], 1
jne 0x40e12e
cmp byte [0x442090], 0
jne 0x40e14d
jmp 0x40e167
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x442091], 1
test eax, eax
setne byte [0x442090]
je 0x40e167
push 2
call dword [0x440e8c]
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.0040a510
add esp, 0xc
xor eax, eax
and al, 1
add esp, 0x101c
pop esi
pop edi
pop ebx
pop ebp
ret 8