joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a1280
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1028e8b5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1036413c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ecx, 0x10478ad6
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], ebx
call fcn.102758d0
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.101a3780
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x101a1314
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x101a1454
cmp dword [edi + 0xc], 0xfffffff
je 0x101a146a
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.101d5af0
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x24]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10342e10]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10342e10]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x101a1407
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call fcn.102711c0
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.10275a00
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [edi + 0x24]
cmp eax, ecx
jae 0x101a13e8
cmp eax, 0x200
jae 0x101a13e6
shl eax, 3
cmp eax, ecx
jae 0x101a13e8
mov eax, ecx
push eax
mov ecx, edi
call fcn.101a1ff0
mov ebx, dword [ebp - 0x14]
lea eax, [esi + 8]
push ebx
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.101a3780
mov edx, dword [eax]
jmp 0x101a140d
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [edi + 0xc]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [edi + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi + 8]
jne 0x101a1435
mov dword [ecx + eax*8], esi
jmp 0x101a1447
cmp ebx, edx
jne 0x101a143e
mov dword [ecx + eax*8], esi
jmp 0x101a144b
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x101a144b
mov dword [ecx + eax*8 + 4], esi
mov ebx, dword [ebp - 0x18]
mov dword [ebx], esi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.101a6b20
int3
Function at 0x101a1ff0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
mov ecx, 0x10478ad6
push edi
mov dword [ebp - 0x10], ebx
call fcn.102758d0
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x101a215d
lea eax, [ecx - 1]
mov esi, dword [ebx + 8]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0x10]
lea eax, [edi + edi]
push eax
call fcn.101a0140
lea eax, [edi - 1]
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x101a2130
nop dword [eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x20]
and edi, edx
mov edx, dword [ebx + 0x14]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x101a20b2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x101a211f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x101a20ec
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x101a20e4
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x101a211f
cmp ebx, edx
je 0x101a20fc
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x101a2139
cmp ebx, edx
jne 0x101a20f0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0x10]
mov eax, ecx
cmp ecx, esi
jne 0x101a2060
nop dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x101a211f
push str.invalid_hash_bucket_count
call fcn.101a6b20
int3
Function at 0x101ea4d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.101ea0f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101ea502
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x102952c4]
call dword [ebp - 8]
jmp 0x101ea50c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10246640
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10274f60
mov eax, dword [0x1036413c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10366d50]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10246818
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10246767
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10246767
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10246745
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x102466c9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x102467d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10246838
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10246813
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10246838
jmp 0x102466a2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d57a0
mov esp, ebp
pop ebp
ret
Function at 0x10246850
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10274f60
mov eax, dword [0x1036413c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10366d50]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x10246a3b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10246986
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10246986
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10246962
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x102468d9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x102469f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10246a5b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x10246a36
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x10246a5b
jmp 0x102468b2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d57a0
mov esp, ebp
pop ebp
ret
Function at 0x1024c670
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1024bd30
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1024c6a4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x102952c4]
call dword [ebp - 8]
jmp 0x1024c6aa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1024c700
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1024bd70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1024c734
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x102952c4]
call dword [ebp - 8]
jmp 0x1024c73e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1024c750
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1024bd90
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1024c788
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x102952c4]
call dword [ebp - 8]
jmp 0x1024c796
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1024c860
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1024be30
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1024c8a0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x102952c4]
call dword [ebp - 8]
jmp 0x1024c8be
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1024cbd0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1025d6a0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.1025d540
lea ecx, [ebp - 4]
call fcn.1025d670
movzx eax, al
test eax, eax
jne 0x1025d6dd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x18]
jmp 0x1025d805
lea ecx, [ebp - 4]
call fcn.1025d640
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1025d600
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.1025d640
push eax
push 0
push 0
call fcn.10251bf0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1025d743
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x20]
jmp 0x1025d805
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.101f14c0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.101da970
lea ecx, [ebp - 8]
call fcn.101da9f0
movzx edx, al
test edx, edx
jne 0x1025d78c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.101da9b0
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x24]
jmp 0x1025d805
lea ecx, [ebp - 8]
call fcn.101daad0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.1025d640
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.10251bf0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1025d7e7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.101da9b0
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x34]
jmp 0x1025d805
lea ecx, [ebp - 8]
call fcn.10226690
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.101da9b0
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x1025d810
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.1025d540
lea ecx, [ebp - 4]
call fcn.1025d580
movzx eax, al
test eax, eax
jne 0x1025d84d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x14]
jmp 0x1025d907
lea ecx, [ebp - 4]
call fcn.1025d640
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1025d600
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.101f14c0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.101aaea0
lea ecx, [ebp - 8]
call fcn.101aaf80
movzx ecx, al
test ecx, ecx
jne 0x1025d8bd
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.101aaf10
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x1c]
jmp 0x1025d907
lea ecx, [ebp - 4]
call fcn.1025d640
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.101ab440
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.101d8af0
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.10235780
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.101aaf10
lea ecx, [ebp - 4]
call fcn.1025d560
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x10270f00
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.102285e0
lea ecx, [ebp - 0x34]
call fcn.102285e0
call fcn.1023f310
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10228530
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10270f53
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.10228680
lea ecx, [ebp - 0x4c]
call fcn.10228680
mov eax, dword [ebp - 8]
jmp 0x10270fc8
call fcn.1023f310
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10228530
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10270f8e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.10228680
lea ecx, [ebp - 0x4c]
call fcn.10228680
mov eax, dword [ebp - 0x10]
jmp 0x10270fc8
lea ecx, [ebp - 0x34]
call fcn.10228970
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.10228970
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.10228680
lea ecx, [ebp - 0x4c]
call fcn.10228680
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x401500
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x870
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x86c], eax
push ebp
push esi
push edi
xor eax, eax
push 0x7fe
mov edi, ecx
push eax
lea ecx, [esp + 0x82]
push ecx
mov word [esp + 0x84], ax
call fcn.00408040
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401540
sub eax, edx
inc eax
push eax
call fcn.00401e06
mov esi, eax
add esp, 4
mov ecx, edi
sub esi, edi
lea esp, [esp]
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x401560
mov ecx, eax
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x401570
sub ecx, esi
cmp byte [ecx + eax - 1], 0x5c
lea ecx, [ecx + eax - 1]
je 0x40158e
cmp ecx, eax
jbe 0x401596
dec ecx
cmp byte [ecx], 0x5c
jne 0x401584
cmp ecx, eax
jbe 0x401596
mov byte [ecx + 1], 0
push eax
push str._hsusb2http.inf
lea edx, [esp + 0x80]
push 0x400
push edx
call fcn.00401b74
add esp, 0x10
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4015fa
push str.Error_opening_setup_file
call fcn.00401aaf
add esp, 4
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x86c]
xor ecx, esp
call fcn.004016cc
add esp, 0x870
ret
xor edi, edi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jle 0x4016ad
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x10], eax
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea esi, [esp + edi + 0x24]
push esi
push ebp
call ebx
mov al, byte [esi]
cmp al, 0xd
je 0x40163a
cmp al, 0xa
je 0x40163a
cmp edi, 0x62
jg 0x401692
inc edi
jmp 0x401694
test edi, edi
jle 0x401692
mov byte [esi], 0
cmp byte [esp + 0x18], 0x23
je 0x401692
lea edx, [esp + 0x18]
push 0x40e90c
push edx
call fcn.00401c50
mov esi, eax
add esp, 8
test esi, esi
je 0x401692
push 4
lea eax, [esp + 0x1c]
push str.Port
push eax
call fcn.00401cd6
add esp, 0xc
test eax, eax
jne 0x401692
inc esi
push esi
call fcn.00401dac
push eax
push str.Port___d_n
mov dword [0x411a64], eax
call fcn.00401aaf
add esp, 0xc
xor edi, edi
sub dword [esp + 0x10], 1
jne 0x401617
pop ebx
test edi, edi
jle 0x4016ad
lea edi, [esp + 0x14]
call fcn.004014b0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x878]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004016cc
add esp, 0x870
ret

Function at 0x4016cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x4016d6
repz ret
jmp fcn.00402080
Function at 0x40aa7d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403ae4
and dword [ebp - 4], 0
cmp dword [0x411990], 0
mov ebx, eax
jne 0x40ab2e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40abdf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40abdf
push eax
call fcn.00403a72
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411990], eax
call esi
push eax
call fcn.00403a72
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411994], eax
call esi
push eax
call fcn.00403a72
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411998], eax
call esi
push eax
call fcn.00403a72
pop ecx
mov dword [0x4119a0], eax
test eax, eax
je 0x40ab2e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403a72
pop ecx
mov dword [0x41199c], eax
mov eax, dword [0x41199c]
cmp eax, ebx
je 0x40ab86
cmp dword [0x4119a0], ebx
je 0x40ab86
push eax
call fcn.00403aed
push dword [0x4119a0]
mov esi, eax
call fcn.00403aed
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ab86
test edi, edi
je 0x40ab86
call esi
test eax, eax
je 0x40ab7d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ab7d
test byte [ebp - 0xc], 1
jne 0x40ab86
or dword [ebp + 0x10], 0x200000
jmp 0x40abbf
mov eax, dword [0x411994]
cmp eax, ebx
je 0x40abbf
push eax
call fcn.00403aed
pop ecx
test eax, eax
je 0x40abbf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40abbf
mov eax, dword [0x411998]
cmp eax, ebx
je 0x40abbf
push eax
call fcn.00403aed
pop ecx
test eax, eax
je 0x40abbf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411990]
call fcn.00403aed
pop ecx
test eax, eax
je 0x40abdf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40abe1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret