joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100316b0
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x2028
call fcn.101737d0
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x2024], eax
push esi
mov edx, ecx
mov dword [esp + 0x10], 0
push edi
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.10053520
test eax, eax
js 0x10031876
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
push 5
push 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
cmp eax, 2
je 0x10031849
cmp eax, 3
je 0x10031849
test eax, eax
je 0x10031730
push str.failed_to_get_security_information
push 2
call fcn.10028740
add esp, 8
or edi, 0xffffffff
jmp 0x1003184e
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x10031755
push str.programdata_configuration_file_owner_is_unknown
push 3
call fcn.10028740
add esp, 8
or edi, 0xffffffff
jmp 0x1003184e
push 0x1a
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x10031845
push 0x16
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x10031845
lea eax, [esp + 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10031809
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x10031809
mov esi, dword [fcn.1005ed10]
mov ecx, esi
push 0x726
push str.D:DevelopmentMillennium_vendor_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_src_fs_path.c
push dword [esp + 0x14]
call dword [0x101a54ac]
call esi
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10031876
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x10031831
push esi
mov esi, dword [fcn.10032f00]
mov ecx, esi
call dword [0x101a54ac]
call esi
add esp, 4
xor esi, esi
push str.programdata_configuration_file_owner_is_not_valid
push 3
call fcn.10028740
add esp, 8
or edi, 0xffffffff
push esi
mov esi, dword [fcn.10032f00]
mov ecx, esi
call dword [0x101a54ac]
call esi
add esp, 4
jmp 0x1003184e
push dword [esi]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10031809
xor edi, edi
jmp 0x1003181b
xor edi, edi
jmp 0x1003184e
mov edi, 0xfffffffd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1003185d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x2024]
xor ecx, esp
call fcn.10172863
add esp, 0x2028
ret
mov ecx, dword [esp + 0x202c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.10172863
add esp, 0x2028
ret
Function at 0x1003abf0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x2018
call fcn.101737d0
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x2014], eax
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov edx, esi
call fcn.10053520
test eax, eax
js 0x1003ac58
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003ac58
mov ecx, eax
or ecx, 2
cmp eax, ecx
je 0x1003ac71
push ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1003ac71
push esi
push 0x101db2fc
push str.failed_to__s_hidden_bit_for__s
push 2
call fcn.10028740
add esp, 0x10
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.10172863
add esp, 0x2018
ret
mov ecx, dword [esp + 0x2018]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10172863
add esp, 0x2018
ret
Function at 0x1003f710
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [esp + 0xc], edx
push ebp
xor ebp, ebp
mov dword [esp + 8], 0
push esi
mov ecx, dword [ebx]
mov dword [esp + 0x10], 0xffffffff
mov dword [ebx + 8], ebp
push edi
test ecx, ecx
jne 0x1003f746
mov dword [ebx], 0x1020156d
mov ecx, 0x1020156d
mov dword [ebx + 4], ebp
cmp dword [ebx + 4], ebp
jbe 0x1003f74e
mov byte [ecx], 0
lea ecx, [esp + 0x10]
call fcn.1008c130
test eax, eax
js 0x1003f82d
mov esi, dword [esp + 0x10]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
je 0x1003f7c5
mov esi, dword [fcn.1005ed10]
lea eax, [edi + edi]
push 0x2ee
push str.D:DevelopmentMillennium_vendor_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_srcutil.c
push eax
mov ecx, esi
call dword [0x101a54ac]
call esi
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x1003f82d
mov esi, dword [esp + 0x10]
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
je 0x1003f7c5
push edi
mov edx, ebp
mov ecx, ebx
call fcn.1008bf30
add esp, 4
mov dword [esp + 0x14], eax
jmp 0x1003f7f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1003f7f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x1003f7f1
push dword [esp + 0x18]
push str.could_not_read_environment_variable__s
push 2
call fcn.10028740
add esp, 0xc
jmp 0x1003f7f9
mov dword [esp + 0x14], 0xfffffffd
push esi
mov esi, dword [fcn.10032f00]
mov ecx, esi
call dword [0x101a54ac]
call esi
mov esi, dword [fcn.10032f00]
add esp, 4
mov ecx, esi
push ebp
call dword [0x101a54ac]
call esi
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret

Function at 0x1003fa80
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003faad
test al, 1
jne 0x1003fa97
xor eax, eax
pop esi
ret
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1003faad
mov eax, 0xffffffe0
pop esi
ret
call fcn.1003f860
or eax, 0xffffffff
pop esi
ret

Function at 0x1003fac0
Capabilities:
Create directory

Disassembly:
mov eax, 0x2010
call fcn.101737d0
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x200c], eax
mov edx, ecx
lea ecx, [esp]
call fcn.10053520
test eax, eax
jns 0x1003fafe
or eax, 0xffffffff
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.10172863
add esp, 0x2010
ret
lea eax, [esp]
push eax
call fcn.10184b5e
mov ecx, dword [esp + 0x2010]
add esp, 4
xor ecx, esp
call fcn.10172863
add esp, 0x2010
ret
Function at 0x1003fb20
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x28
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003fbc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 5
jne 0x1003fb7b
lea eax, [esp + 8]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1003fb7b
mov eax, dword [esp + 8]
and eax, 0x410
cmp eax, 0x410
jne 0x1003fb7b
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1003fbc1
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x1003fbab
cmp eax, 5
je 0x1003fbab
call fcn.1003f860
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10172863
add esp, 0x28
ret
pop edi
mov eax, 0xffffffe0
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10172863
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10172863
add esp, 0x28
ret

Function at 0x1003fcc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x28
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
push 0
push edi
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1003fd1d
test esi, esi
jne 0x1003fcfd
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10172863
add esp, 0x28
ret
push edi
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.1003ac90
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10172863
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1003fd35
call fcn.10178834
mov dword [eax], 2
jmp 0x1003fd40
call fcn.10178834
mov dword [eax], 0xd
call fcn.10178834
cmp dword [eax], 2
jne 0x1003fdb8
cmp byte [esp + 0x34], 0
je 0x1003fdb8
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1003fd56
sub esi, ecx
sar esi, 1
sub esi, 1
je 0x1003fdb8
nop word [eax + eax]
movzx eax, word [edi + esi*2]
cmp eax, 0x2f
je 0x1003fd97
cmp eax, 0x5c
je 0x1003fd97
sub esi, 1
jne 0x1003fd70
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10172863
add esp, 0x28
ret
xor eax, eax
push edi
mov word [edi + esi*2], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003fd65
test al, 0x10
jne 0x1003fdb8
call fcn.10178834
mov dword [eax], 0x14
mov ecx, dword [esp + 0x2c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.10172863
add esp, 0x28
ret
Function at 0x1003ff00
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x2028
call fcn.101737d0
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x2024], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], 0
mov esi, 0x1020156d
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], esi
mov bl, 1
mov al, byte [edi]
cmp al, 0x41
jl 0x1003ff42
cmp al, 0x5a
jle 0x1003ff4a
cmp al, 0x61
jl 0x1003ff78
cmp al, 0x7a
jg 0x1003ff78
cmp byte [edi + 1], 0x3a
jne 0x1003ff78
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x1003ff5b
cmp al, 0x2f
jne 0x1003ff78
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.10053520
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
and bl, 0x10
jmp 0x1003ffce
lea ecx, [esp + 0x10]
call fcn.1002fc20
test eax, eax
js 0x1003ffca
push edi
push dword [esp + 0x14]
mov dl, 0x2f
lea ecx, [esp + 0x18]
call fcn.1002a950
add esp, 8
test eax, eax
jne 0x1003ffa5
lea ecx, [esp + 0x10]
call fcn.100307d0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
mov edx, esi
call fcn.10053520
test eax, eax
js 0x1003ffce
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
and bl, 0x10
jmp 0x1003ffce
mov esi, dword [esp + 0x10]
cmp dword [esp + 0x14], 0
jbe 0x1003fff5
test esi, esi
je 0x1003fff5
cmp esi, 0x1020156c
je 0x1003fff5
push esi
mov esi, dword [fcn.10032f00]
mov ecx, esi
call dword [0x101a54ac]
call esi
add esp, 4
mov ecx, dword [esp + 0x2030]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10172863
add esp, 0x2028
ret
Function at 0x10040350
Capabilities:
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2068
call fcn.101737d0
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x2064], eax
push esi
push edi
mov edi, edx
mov dword [esp + 0xc], 0
mov edx, ecx
lea ecx, [esp + 0x58]
call fcn.10053520
test eax, eax
js 0x100403c2
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x10], eax
test al, 1
je 0x100403d9
and eax, 0xfffffffe
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x100403d9
push str.failed_to_set_attributes
push 2
call fcn.10028740
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.10172863
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101f9238]
lea edx, [esp + 0x28]
lea ecx, [esp + 0x58]
mov dword [esp + 0x28], 0xc0000000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], 0x80
mov dword [esp + 0x44], 0
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.10040240
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
jns 0x10040439
or edi, 0xffffffff
jmp 0x1004054b
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
movlpd qword [esp + 0x14], xmm0
test edi, edi
jne 0x1004047c
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x10040516
movups xmm0, xmmword [edi]
push 0
push 0x989680
movd ecx, xmm0
psrldq xmm0, 4
movd eax, xmm0
add ecx, 0xb6109100
adc eax, 2
push eax
push ecx
call fcn.10173140
movups xmm0, xmmword [edi]
mov esi, eax
mov ecx, edx
mov edx, 0xa
psrldq xmm0, 8
movd eax, xmm0
movups xmm0, xmmword [edi + 0x10]
push 0
imul edx
push 0x989680
add esi, eax
mov dword [esp + 0x24], esi
adc ecx, edx
mov dword [esp + 0x28], ecx
movd ecx, xmm0
psrldq xmm0, 4
movd eax, xmm0
add ecx, 0xb6109100
adc eax, 2
push eax
push ecx
call fcn.10173140
movups xmm0, xmmword [edi + 0x10]
mov esi, eax
mov ecx, edx
mov edx, 0xa
psrldq xmm0, 8
movd eax, xmm0
imul edx
add esi, eax
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x24]
adc ecx, edx
mov dword [esp + 0x18], ecx
push esi
call fcn.10184f52
add esp, 4
cmp eax, 0xffffffff
jne 0x10040528
or edi, eax
jmp 0x10040542
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
neg eax
sbb edi, edi
neg edi
dec edi
push esi
call fcn.1018e2bc
add esp, 4
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xc]
je 0x10040573
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x10]
mov esi, eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x206c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10172863
mov esp, ebp
pop ebp
ret
Function at 0x10040a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x401c
call fcn.101737d0
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x4018], eax
push esi
mov esi, edx
mov edx, ecx
lea ecx, [esp + 0x2010]
call fcn.10053520
test eax, eax
js 0x10040a81
push 0
lea eax, [esp + 8]
push eax
push 0x1006
lea eax, [esp + 0x201c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x10040abc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10040a99
call fcn.10178834
mov dword [eax], 0x26
xor eax, eax
pop esi
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10172863
add esp, 0x401c
ret
call fcn.10178834
pop esi
mov dword [eax], 0x16
xor eax, eax
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10172863
add esp, 0x401c
ret
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10040aef
call fcn.10178834
pop esi
mov dword [eax], 2
xor eax, eax
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10172863
add esp, 0x401c
ret
test esi, esi
jne 0x10040b3e
mov esi, dword [fcn.1005ed10]
mov ecx, esi
push 0x32c
push str.D:DevelopmentMillennium_vendor_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_srcwin32posix_w32.c
push 0x2ffe
call dword [0x101a54ac]
call esi
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10040b3e
call fcn.10178834
pop esi
mov dword [eax], 0xc
xor eax, eax
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10172863
add esp, 0x401c
ret
lea edx, [esp + 4]
mov ecx, esi
call fcn.10053760
test eax, eax
js 0x10040a81
mov ecx, esi
call fcn.1003f840
mov ecx, dword [esp + 0x401c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10172863
add esp, 0x401c
ret

Function at 0x10040c90
Capabilities:
Move file

Disassembly:
mov eax, 0x401c
call fcn.101737d0
mov eax, dword [0x101f8740]
xor eax, esp
mov dword [esp + 0x4018], eax
push esi
mov esi, edx
mov edx, ecx
lea ecx, [esp + 0x2010]
call fcn.10053520
test eax, eax
js 0x10040d19
mov edx, esi
lea ecx, [esp + 4]
call fcn.10053520
test eax, eax
js 0x10040d19
mov esi, 0xa
push 3
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10040d39
call fcn.1003fa60
test al, al
je 0x10040d32
cmp esi, 1
jle 0x10040d0c
lea ecx, [esp + 4]
call fcn.1003fa80
test eax, eax
je 0x10040d0c
cmp eax, 0xffffffe0
jne 0x10040d1c
jmp 0x10040d14
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x10040cd1
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10172863
add esp, 0x401c
ret
call fcn.1003f860
jmp 0x10040d19
mov ecx, dword [esp + 0x401c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10172863
add esp, 0x401c
ret
Function at 0x10040d60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x18]
push 0
push 0x14
push esi
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
push edi
mov ebx, edx
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x44], 0
call fcn.1003ed50
add esp, 0x10
test eax, eax
je 0x10040db8
call fcn.10178834
mov dword [eax], 0x16
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], esi
call fcn.10184f52
add esp, 4
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
push ecx
push 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10040ded
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
call fcn.1003f860
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret
Function at 0x10052fc0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov edi, ecx
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
jne 0x10052ff9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov ecx, 0xd
mov esi, 2
cmove esi, ecx
call fcn.10178834
pop edi
mov dword [eax], esi
or eax, 0xffffffff
pop esi
ret
cmp esi, 0x1000
jle 0x10053012
call fcn.10178834
pop edi
pop esi
mov dword [eax], 0x26
or eax, 0xffffffff
ret
push 4
push str.__
push edi
call fcn.10185d96
add esp, 0xc
test eax, eax
jne 0x1005303a
sub esi, 4
lea eax, [esi + esi]
push eax
lea eax, [edi + 8]
push eax
push edi
call fcn.10174950
add esp, 0xc
pop edi
mov eax, esi
pop esi
ret
Function at 0x100532f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebx
mov eax, edx
push ebp
mov ebx, eax
mov dword [esp + 0x14], eax
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x14], ebp
lea esi, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10053310
push 0
push 0
sub ebx, esi
push str.PATH
sar ebx, 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x10053386
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x100533c2
xor esi, esi
mov dword [esp + 0x18], esi
nop dword [eax + eax]
xor edx, edx
test esi, esi
je 0x100534f3
movzx eax, word [esi]
test ax, ax
je 0x100534f3
cmp eax, 0x22
jne 0x100533dc
movzx eax, word [esi + 2]
lea edi, [edx + 0x22]
add esi, 2
mov dword [esp + 0x10], esi
mov ecx, esi
test ax, ax
je 0x1005340c
jmp 0x100533e5
mov esi, dword [fcn.1005ed10]
lea eax, [edi + edi]
push 0xc8
push str.D:DevelopmentMillennium_vendor_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_srcwin32path_w32.c
push eax
mov ecx, esi
call dword [0x101a54ac]
call esi
mov esi, eax
add esp, 0xc
mov dword [esp + 0x18], esi
test esi, esi
je 0x100533d1
push edi
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x10053350
push str.could_not_load_PATH
push 2
call fcn.10028740
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, 0x3b
mov dword [esp + 0x10], esi
movzx eax, word [esi]
mov ebp, esi
mov ecx, esi
nop dword [eax]
cmp ax, di
je 0x10053406
movzx eax, word [ebp + 2]
lea esi, [ebp + 2]
inc edx
mov ecx, esi
mov ebp, esi
test ax, ax
jne 0x100533f0
cmp di, 0x22
jne 0x10053415
cmp word [esi], 0
je 0x10053415
lea esi, [ecx + 2]
cmp word [esi], 0x3b
jne 0x10053429
nop dword [eax + eax]
add esi, 2
cmp word [esi], 0x3b
je 0x10053420
mov ecx, dword [esp + 0x10]
xor edi, edi
test edx, edx
je 0x10053445
test ebx, ebx
je 0x10053445
cmp word [ecx + edx*2 - 2], 0x5c
mov eax, 1
cmovne edi, eax
lea eax, [edi + edx]
mov dword [esp + 0x10], eax
add eax, ebx
mov dword [esp + 0x20], eax
cmp eax, 0x104
jbe 0x10053471
push str.path_too_long
push 3
call fcn.10028740
mov ebp, dword [esp + 0x1c]
add esp, 8
jmp 0x10053350
lea ebp, [edx + edx]
push ebp
push ecx
push dword [esp + 0x1c]
call fcn.10174950
add esp, 0xc
test edi, edi
je 0x10053493
mov eax, dword [esp + 0x14]
mov ecx, 0x5c
mov word [eax + ebp], cx
mov ebp, dword [esp + 0x14]
lea eax, [ebx + ebx]
push eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x20]
lea eax, [eax*2]
add eax, ebp
push eax
call fcn.10174950
mov eax, dword [esp + 0x2c]
add esp, 0xc
xor ecx, ecx
push ecx
push ebp
mov word [ebp + eax*2], cx
call fcn.10184a88
add esp, 8
test eax, eax
jne 0x10053350
push dword [esp + 0x18]
mov esi, dword [fcn.10032f00]
mov ecx, esi
call dword [0x101a54ac]
call esi
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push dword [esp + 0x18]
mov esi, dword [fcn.10032f00]
mov ecx, esi
call dword [0x101a54ac]
call esi
add esp, 4
xor eax, eax
mov word [ebp], ax
mov eax, 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret