joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101126a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2d4
mov dword [ebp - 0x2e0], edx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov al, byte [ecx + 0x2a1]
test al, 1
jne 0x101128ba
mov edi, ecx
movzx eax, byte [0x102b456f]
test al, al
jns 0x101126dc
mov eax, dword [0x102b4568]
test eax, eax
je 0x101128ba
push 0x102b4564
call fcn.10168750
add esp, 4
test al, al
je 0x101128ba
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.10208980
add esp, 0xc
mov ecx, esi
push 2
push 0
push 0x102b4564
call fcn.10170bc0
xor eax, eax
dec eax
lea ebx, [ebp - 0x2b0]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, esi
push ebx
call fcn.10170e80
mov ecx, ebx
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1011274b
mov eax, dword [ebp - 0x2ac]
test eax, eax
mov dword [ebp - 0x2dc], edi
je 0x10112888
mov dword [ebp - 0x2d8], 0
lea edi, [ebp - 0x2c8]
lea ebx, [ebp - 0x2bc]
mov esi, ebx
xor eax, eax
dec eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], eax
mov ebx, edi
lea edi, [ebp - 0x2d4]
push edi
call fcn.1014c7f0
mov ecx, edi
mov edi, ebx
push ebx
call fcn.1014d5f0
movzx eax, byte [ebp - 0x2bd]
mov edx, ebx
test al, al
jns 0x101127b7
mov edx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c4]
mov ebx, esi
mov ecx, esi
push eax
push edx
call fcn.10167540
cmp byte [ebp - 0x2bd], 0
jns 0x101127d9
push dword [ebp - 0x2c8]
call fcn.10205096
add esp, 4
lea ecx, [ebp - 0x2d4]
call fcn.1014bf30
mov ecx, ebx
call fcn.10167800
test al, al
je 0x10112841
cmp byte [ebp - 0x2e0], 0
jne 0x1011283b
lea esi, [ebp - 0x2b0]
push esi
call fcn.1014d680
add esp, 4
test al, al
jne 0x10112841
mov ecx, esi
push edi
call fcn.1014c7f0
cmp byte [ebp - 0x2bd], 0
mov eax, edi
jns 0x10112824
mov eax, dword [ebp - 0x2c8]
push eax
mov esi, dword [sym.imp.kernel32.dll_OutputDebugStringW]
call esi
mov ecx, edi
call fcn.1014bf30
push 0x1025b68c
call esi
inc dword [ebp - 0x2d8]
mov ecx, ebx
call fcn.100875b0
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.10170e80
lea ecx, [ebp - 0x2b0]
push ebx
call fcn.1014bfb0
mov ecx, ebx
call fcn.1014bf30
movzx eax, byte [ebp - 0x2a5]
test al, al
jns 0x10112878
mov eax, dword [ebp - 0x2ac]
test eax, eax
lea ecx, [ebp - 0x2b0]
jne 0x1011276f
jmp 0x10112892
mov dword [ebp - 0x2d8], 0
lea ecx, [ebp - 0x2b0]
call fcn.1014bf30
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x2d8]
mov dword [eax + 0x240], ecx
lea ecx, [ebp - 0x2a4]
call fcn.10170d40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
add esp, 0x2d4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101205f6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0xdd]
shl eax, 3
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [ecx + 0x1c]
call edi
movzx eax, byte [esi + 0xdd]
shl eax, 3
push eax
push dword [esi + 0xd8]
call edi
mov ecx, dword [esi + 0x54]
movzx eax, byte [esi + 0xdd]
push eax
call fcn.10080670
cmp byte [esi + 0xdd], 0
je 0x10120646
mov ecx, esi
call fcn.101241ca
pop esi
pop edi
pop ebp
ret 4

Function at 0x1012c030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push 0x102b4aa8
call fcn.1013c896
mov dword [esi + 0x24], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov byte [esi + 0x35], al
cmp dword [esi + 0x2c], 9
jge 0x1012c026
pop esi
pop ebp
ret 4
push str.unsupported_locale_for_standard_input
call fcn.10138809
push ebp
mov ebp, esp
xor edx, edx
pop ebp
jmp fcn.1012c132

Function at 0x1012c040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
inc edx
pop ebp
jmp fcn.1012c132

Function at 0x1012c310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push 0x102b4ab0
call fcn.1013c896
mov dword [esi + 0x24], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov byte [esi + 0x33], al
cmp dword [esi + 0x2c], 9
jge 0x1012c306
pop esi
pop ebp
ret 4
push str.unsupported_locale_for_standard_input
call fcn.10138809
push ebp
mov ebp, esp
xor edx, edx
pop ebp
jmp fcn.1012c416

Function at 0x1012c320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
inc edx
pop ebp
jmp fcn.1012c416

Function at 0x1012d060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1012d08f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x1012d071
pop esi
pop edi
pop ebp
ret 8

Function at 0x1012d180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1012d1b1
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x1012d191
pop esi
pop edi
pop ebp
ret 8
Function at 0x10131fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x10140380
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x1013200e
mov dl, byte [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movsx edx, dl
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x101320fb
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x2c]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x102b4ac8
call fcn.1013c896
mov esi, eax
xor edi, edi
dec edi
mov eax, edi
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x10132049
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x2c]
push ebx
call eax
mov al, byte [ebp - 0x21]
test al, al
mov esi, dword [ebp + 8]
jns 0x10132076
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0xc]
test al, al
js 0x1013208b
movzx eax, al
add eax, ebp
add eax, 0xffffffd4
cmp ebx, eax
jne 0x10132097
jmp 0x101320e1
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
add edx, eax
cmp ebx, edx
je 0x101320e5
test ecx, ecx
je 0x101320af
mov al, byte [ebx]
mov edi, dword [ecx + 0x18]
cmp edi, dword [ecx + 0x1c]
je 0x101320b3
lea edx, [edi + 1]
mov dword [ecx + 0x18], edx
mov byte [edi], al
jmp 0x101320db
xor ecx, ecx
jmp 0x101320db
mov dword [ebp - 0x20], ebx
movzx eax, al
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x30], ecx
push eax
call edx
xor ecx, ecx
cmp eax, 0xffffffff
je 0x101320d5
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x20]
inc ebx
mov al, byte [ebp - 0x21]
jmp 0x10132079
mov dword [esi], ecx
jmp 0x101320f0
mov dword [esi], ecx
push eax
call fcn.10205096
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10133750
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 4], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x101403f0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x14]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 8]
call fcn.1012ef50
mov dword [ebx], edi
mov dword [ebx + 4], 0x14
lea eax, [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x18], eax
call fcn.10142d0e
add esp, 0x1c
mov esp, dword [esi + 4]
mov dword [esi + 0x10], eax
lea edx, [esi + eax]
add edx, 0x50
mov ecx, edi
mov dword [esi + 0xc], edx
mov edi, dword [ebp + 0x10]
push edi
call fcn.10132356
add esp, 4
mov dword [esi + 8], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
mov eax, dword [edi + 0x1c]
lea ecx, [esi + 0x1c]
mov dword [ecx], eax
mov dword [esi + 4], eax
lock inc dword [eax + 4]
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
push 0x102b4aa0
call fcn.1013c896
mov ebx, eax
xor eax, eax
dec eax
mov ecx, dword [esi + 4]
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x10133841
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0xc]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 8]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 0x10]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.1002e431
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x101338d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x10140400
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x1013392f
movzx edx, word [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movzx edx, dx
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x10133a2b
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x2c]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x102b4ad0
call fcn.1013c896
mov esi, eax
xor edi, edi
dec edi
mov eax, edi
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x1013396a
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x2c]
push ebx
call eax
mov al, byte [ebp - 0x21]
test al, al
jns 0x10133994
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0xc]
test al, al
js 0x101339ad
movzx edx, al
lea edx, [edx*2 - 0x2c]
add edx, ebp
cmp ebx, edx
jne 0x101339ba
jmp 0x10133a0a
mov edi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
lea edx, [edi + edx*2]
cmp ebx, edx
je 0x10133a11
test ecx, ecx
je 0x101339d4
movzx eax, word [ebx]
mov esi, dword [ecx + 0x18]
cmp esi, dword [ecx + 0x1c]
je 0x101339d8
lea edx, [esi + 2]
mov dword [ecx + 0x18], edx
mov word [esi], ax
jmp 0x101339f6
xor edx, edx
jmp 0x10133a03
mov dword [ebp - 0x30], ebx
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
movzx eax, ax
mov dword [ebp - 0x20], ecx
push eax
call edx
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x30]
xor edx, edx
cmp ax, 0xffff
je 0x10133a00
mov edx, ecx
mov al, byte [ebp - 0x21]
add ebx, 2
mov ecx, edx
jmp 0x10133997
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x10133a21
mov esi, dword [ebp + 8]
mov dword [esi], ecx
push edi
call fcn.10205096
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10144a66
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.10208980
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push 0x104
push edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
xor eax, eax
dec eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
push edi
call fcn.1020d865
add esp, 4
cmp eax, 0x7ffffff0
jae 0x10144b8a
mov ebx, eax
cmp eax, 5
jae 0x10144aec
lea esi, [ebp - 0x224]
mov byte [esi + 0xb], bl
test ebx, ebx
jne 0x10144b1e
jmp 0x10144b2d
lea edi, [ebx + 8]
and edi, 0xfffffff8
lea eax, [edi + edi]
push eax
call fcn.1020d865
add esp, 4
mov esi, eax
mov dword [ebp - 0x224], eax
or edi, 0x80000000
mov dword [ebp - 0x21c], edi
lea edi, [ebp - 0x218]
mov dword [ebp - 0x220], ebx
mov eax, ebx
add eax, ebx
push eax
push edi
push esi
call fcn.10208400
add esp, 0xc
mov word [esi + ebx*2], 0
lea ecx, [ebp - 0x224]
push 0xa
push str.usp10.dll
call fcn.1014190a
cmp byte [eax + 0xb], 0
jns 0x10144b4d
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [ebp - 0x219], 0
jns 0x10144b6d
push dword [ebp - 0x224]
call fcn.10205096
add esp, 4
cmp esi, 0xffffffff
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x224]
call fcn.101407c4
int3
Function at 0x10146f20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x102b0014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x20]
push 3
push eax
push edx
push ecx
call fcn.1016cf60
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x101470e4
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov ebx, eax
test eax, eax
je 0x10146f96
push 0x10263abe
push ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x10146fa6
mov ecx, eax
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x10146fa1
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x28], eax
jmp 0x10146fad
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test eax, eax
je 0x101470a0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], edi
cmp eax, 0x15555556
jae 0x10147123
shl eax, 2
mov dword [ebp - 0x34], eax
lea edi, [eax + eax*2]
push edi
call fcn.1020d865
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
add eax, edi
mov dword [ebp - 0x18], eax
xor edi, edi
jmp 0x10147066
mov dword [ebp - 0x24], esi
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.1020d865
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [eax], ecx
or esi, 0x80000000
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], esi
mov esi, dword [ebp - 0x24]
mov dword [esi + 4], ebx
mov dword [ebp - 0x24], ecx
mov eax, ebx
add eax, ebx
push eax
push dword [ebp - 0x38]
push ecx
call fcn.10208400
mov ecx, dword [ebp - 0x24]
add esp, 0xc
mov word [ecx + ebx*2], 0
add esi, 0xc
add edi, 4
cmp dword [ebp - 0x34], edi
je 0x10147095
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + edi]
mov dword [ebp - 0x38], eax
push eax
call fcn.1020d865
add esp, 4
cmp eax, 0x7ffffff0
jae 0x1014711c
mov ebx, eax
cmp eax, 5
jae 0x10147010
mov byte [esi + 0xb], bl
mov ecx, esi
test ebx, ebx
jne 0x1014703e
jmp 0x10147055
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
jmp 0x101470a2
xor esi, esi
lea edx, [ebp - 0x20]
mov ecx, edi
call fcn.10146210
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_LocalFree]
test ebx, ebx
je 0x101470cd
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x101470e4
cmp esi, edi
jne 0x10147106
mov dword [ebp - 0x1c], edi
push edi
call fcn.10205096
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ebx
cmp edi, ebx
je 0x101470d8
lea ebx, [esi - 0xc]
cmp byte [esi - 1], 0
jns 0x10147100
push dword [esi - 0xc]
call fcn.10205096
add esp, 4
jmp 0x10147100
mov ecx, esi
call fcn.101407c4
lea ecx, [ebp - 0x20]
call fcn.1002bb40
int3
Function at 0x1014bca0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov ebx, edx
mov edi, ecx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov esi, esp
push esi
push edx
push ecx
call fcn.1015ee40
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x1014bce9
mov esi, dword [esp]
push 0
push 0
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [esp + 0xb], 0
jns 0x1014bd08
push dword [esp]
call fcn.10205096
add esp, 4
test esi, esi
je 0x1014bde3
cmp dword [ebp + 8], 0
je 0x1014bde3
mov eax, esi
add eax, esi
mov ecx, 0xffffffff
cmovae ecx, eax
push ecx
call fcn.1020d865
add esp, 4
mov ecx, edi
mov edi, eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov eax, ebx
mov ebx, esp
push ebx
push eax
push ecx
call fcn.1015ee40
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x1014bd63
mov ebx, dword [esp]
push esi
push edi
push ebx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
cmp byte [esp + 0xb], 0
jns 0x1014bd7e
push dword [esp]
call fcn.10205096
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x1014bd90
push edi
call fcn.1020d865
add esp, 4
jmp 0x1014bd92
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, esp
push ecx
push eax
push edi
call fcn.1015e8b0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x1014bdc6
push dword [ebx]
call fcn.10205096
add esp, 4
mov eax, dword [esp + 8]
mov dword [ebx + 8], eax
movsd xmm0, qword [esp]
movsd qword [ebx], xmm0
test edi, edi
je 0x1014bde3
push edi
call fcn.102050cc
add esp, 4
test esi, esi
setne bl
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101519d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x101519f2
cmp dword [esi], edi
jne 0x101519fe
jmp 0x10151a1d
call fcn.1014e410
mov eax, dword [ebp + 8]
cmp dword [esi], edi
je 0x10151a1d
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x10151a39
cmp ebx, 2
jae 0x10151a59
push eax
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 8]
movups xmm0, xmmword [eax + 4]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esi + 0x10], xmm1
movups xmmword [esi + 4], xmm0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.1014e410
push dword [esi]
call fcn.1016f280
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x10151a13
mov dword [esi], edi
mov edi, eax
call fcn.1014e410
mov eax, edi
jmp 0x10151a13

Function at 0x101608d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x102b528c]
cmp esi, 1
ja 0x10160936
push 0x102b528c
call fcn.1014e090
add esp, 4
test al, al
je 0x10160930
mov dword [0x102b5294], 0
mov dword [0x102b5290], 0
mov esi, 0x102b5290
mov ecx, 0x102b5290
push 0
call fcn.101620c0
push 0x102b528c
push 0
push 0x102b5290
push 0x102b528c
call fcn.1014e150
add esp, 0x10
jmp 0x10160936
mov esi, dword [0x102b528c]
mov ecx, esi
pop esi
pop ebp
jmp fcn.10162050
Function at 0x10161c70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.10206020
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x102b2028]
cmp eax, 0xffffffff
je 0x10161dcc
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x10161dcc
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.10208400
add esp, 0xc
mov ecx, dword [0x102b2028]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call dword [sym.imp.kernel32.dll_TlsSetValue]
test ebx, ebx
je 0x10161ce9
push ebx
call fcn.102050cc
add esp, 4
mov eax, dword [0x102b5eb8]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10161ded
mov esi, dword [0x102b5eb4]
push esi
call dword [sym.imp.kernel32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x10161de1
lea eax, [ebp - 0x1410]
push 0xc00
push 0x102b52b4
push eax
call fcn.10208400
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov esi, 0x100
test al, al
je 0x10161dbe
nop
nop
nop
nop
nop
nop
xor edi, edi
lea ebx, [ebp - 0x1408]
xor eax, eax
jmp 0x10161d6e
add edi, 1
add ebx, 0xc
cmp edi, 0x100
je 0x10161db0
mov ecx, dword [ebp + edi*8 - 0x810]
test ecx, ecx
je 0x10161d60
cmp dword [ebx - 8], 0
je 0x10161d60
mov edx, dword [ebp + edi*8 - 0x80c]
cmp edx, dword [ebx]
jne 0x10161d60
mov edx, dword [ebx - 4]
test edx, edx
je 0x10161d60
mov dword [ebp + edi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x10161d60
cmp esi, 2
jb 0x10161dbe
add esi, 0xffffffff
and al, 1
test al, al
jne 0x10161d50
push 2
push dword [ebp - 0x1414]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.1016d1b0
jmp 0x10161d1f
push 0x102b5eb8
call fcn.1020d865
add esp, 4
cmp dword [0x102b5eb8], 0xffffffff
jne 0x10161d0a
push 4
call fcn.1020d865
add esp, 4
mov dword [eax], 0
mov dword [0x102b5eb4], eax
push 0x102b5eb8
call fcn.1020d865
add esp, 4
jmp 0x10161d0a

Function at 0x10161e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102b2028]
cmp eax, 0xffffffff
je 0x10161e52
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret