joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed10
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40ed73
jmp 0x40ee8c
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40eda5
jmp 0x40ee8c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push str._d._d._d._d
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401e80
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40ee0a
jmp 0x40ee8c
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.mst
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040e360
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40ee40
jmp 0x40ee8c
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040d600
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40ee8c
cmp dword [ebp + 0x10], 1
jne 0x40ee8c
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ed10
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a1b
mov esp, ebp
pop ebp
ret
Function at 0x40eea0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x260]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x54]
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40ef03
jmp 0x40f01c
push 0x27
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40ef35
jmp 0x40f01c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa0]
shr edx, 0x10
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x9c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x9c]
shr eax, 0x10
push eax
push 0x41443c
push 0x24
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401e80
add esp, 0x1c
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40ef9a
jmp 0x40f01c
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._lsApplicationsCache_lsv_ls.msi
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040e360
add esp, 0x14
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40efd0
jmp 0x40f01c
push 1
push 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040d600
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jge 0x40f01c
cmp dword [ebp + 0x10], 1
jne 0x40f01c
mov eax, dword [ebp + 0x14]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040eea0
add esp, 0x10
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a1b
mov esp, ebp
pop ebp
ret
Function at 0x411450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
call fcn.00410d30
push eax
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebp - 0x214]
push eax
call fcn.0040e360
add esp, 0xc
mov dword [ebp - 0x218], 0
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00402bd0
add esp, 0xc
mov dword [ebp - 0x21c], 0x206
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x214]
push ecx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411548
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0
push str.Local_AppData
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41153b
lea eax, [ebp - 0x210]
push eax
push str._sTemp
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040e360
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call fcn.00402ba9
add esp, 4
jmp 0x41154a
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a1b
mov esp, ebp
pop ebp
ret

Function at 0x411560
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x411674
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb7
jne 0x4115a6
mov dword [ebp - 8], 0
jmp 0x411674
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
jmp 0x4115be
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
test edx, edx
je 0x4115db
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x4115d9
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
jmp 0x4115b5
cmp dword [ebp - 0xc], 0
jne 0x411602
push 3
call fcn.00401df0
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0x7e
push 0x413ff8
call fcn.0040d330
jmp 0x411674
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov word [edx], cx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00411560
mov dword [ebp - 8], eax
mov edx, 0x5c
mov eax, dword [ebp - 0xc]
mov word [eax], dx
cmp dword [ebp - 8], 0
jge 0x41162f
jmp 0x411674
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41166d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb7
jne 0x41165c
mov dword [ebp - 8], 1
jmp 0x41166b
mov eax, dword [ebp - 4]
push eax
call fcn.00401df0
add esp, 4
mov dword [ebp - 8], eax
jmp 0x411674
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x411680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4170a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x4116d4
cmp dword [ebp - 0x41c], 0x104
jb 0x411725
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.00401df0
add esp, 4
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jl 0x411708
mov dword [ebp - 0x420], 0x80004005
mov edx, dword [ebp - 0x420]
push edx
push 0x4e
push 0x413fd8
call fcn.0040d330
jmp 0x4117a8
lea eax, [ebp - 0x418]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x41178e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
push eax
call fcn.00401df0
add esp, 4
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jl 0x411777
mov dword [ebp - 0x420], 0x80004005
mov ecx, dword [ebp - 0x420]
push ecx
push 0x53
push 0x413fe8
call fcn.0040d330
jmp 0x4117a8
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401e30
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a1b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008280
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10024008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x100083b8
push 0xc
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
push str.wintrust.dll
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call fcn.10003e60
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
call fcn.100135a0
mov ecx, eax
call fcn.10013660
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x10008340
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10008336
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10008336
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10017568
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
test ebx, ebx
jne 0x10008371
mov dword [edi + 0x18], 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], edx
test edi, edi
jne 0x1000e7b1
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret 0x10
test byte [ebp + 0x14], 2
push esi
je 0x1000e846
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x1000e7ce
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
mov ecx, dword [ebx + 0x38]
mov esi, dword [ecx]
cmp esi, ecx
je 0x1000e7ee
mov eax, dword [esi + 8]
cmp dword [eax], edi
je 0x1000e7e6
mov esi, dword [esi]
cmp esi, ecx
jne 0x1000e7d7
jmp 0x1000e7ee
mov edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x1000e7ff
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 0xc]
cmp edx, 1
jne 0x1000e838
mov eax, dword [esi + 8]
add eax, 4
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
cmp ebx, 1
jne 0x1000e859
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 8]
add eax, 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x1000e857
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
jmp 0x1000e850
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test byte [ebp + 0x14], 1
pop esi
je 0x1000e867
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 4]
cmp ebx, 1
pop edi
sete al
xor ecx, ebp
pop ebx
call fcn.10017527
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000f250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x1000f289
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ebx, dword [ebp + 0x10]
test bl, 2
je 0x1000f2e1
cmp dword [esi + 0x24], 0
je 0x1000f2e1
push 0x14
call fcn.10017538
add esp, 4
mov dword [eax], 0
push 0x1000f1b0
push eax
push dword [ebp + 0xc]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
push edi
mov dword [eax + 0x10], esi
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push 1
push 1
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x1000f2f4
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test bl, 1
pop ebx
je 0x1000f303
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 4]
cmp edi, 1
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.10017527
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000f480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019a38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x1000f4c3
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [edi + 4], 0
je 0x1000f4de
mov eax, dword [edi + 0x10]
test eax, eax
je 0x1000f4d7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x1000f654
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x10024a58], 0
mov esi, eax
mov dword [ebp - 0x30], esi
je 0x1000f5f0
push 0
mov ecx, 0x10024a58
call fcn.10016260
mov eax, dword [0x10024a58]
cmp byte [eax + 0x54], 0
je 0x1000f5f0
cmp dword [eax + 0x58], 5
jb 0x1000f5f0
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push dword [ebp - 0x14]
push esi
push str.creat_thread_handle:_0x_x__id__d
push eax
call fcn.10017130
add esp, 0x10
lea eax, [ebp - 0x2c]
mov ecx, 0x10024a58
push 0x39
push str.RC::DmAvCore::RCImplThreadPoolSimple::Excute
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_framework_src_vbaselib_src_rcimplthreadpoolsimple.cpp
push eax
push 5
call fcn.10016bc0
test bl, bl
je 0x1000f599
lea eax, [ebp - 0x2c]
mov ecx, 0x10024a58
push eax
call fcn.10016f60
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x1000f5dc
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000f5d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000f5d2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10017568
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp byte [ebp + 0x10], 0
je 0x1000f608
test esi, esi
je 0x1000f601
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x1000f644
mov ebx, dword [edi + 8]
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [ebx + 4]
push eax
push ebx
mov dword [ebp - 0x34], eax
call fcn.1000ea50
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [edi + 0xc]
sub ecx, eax
cmp ecx, 1
jae 0x1000f638
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
inc eax
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 4], edx
mov dword [eax], edx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x1000f652
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100107a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019ca5
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10024008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.10017538
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call sub.VCRUNTIME140.dll_memset
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012230
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019da1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
cmp dword [esi + 0x14], 8
jb 0x10012273
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1001228e
mov eax, edx
nop dword [eax]
cmp word [eax], 0x25
je 0x100122c1
add eax, 2
sub ecx, 1
jne 0x10012280
push esi
mov ecx, edi
call fcn.10006390
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1001228e
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x1001228e
push esi
lea ecx, [ebp - 0x28]
call fcn.10006390
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100122e8
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x10012362
push esi
mov ecx, edi
call fcn.10006390
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10012349
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001233f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001233f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10017568
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x100122a4
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10017ea3
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 8
jb 0x10012389
mov esi, dword [esi]
mov ecx, dword [ebp - 0x34]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x100123c9
cmp eax, dword [ebp - 0x34]
ja 0x100123c9
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100123b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10003e60
push esi
call fcn.10017c27
movups xmm0, xmmword [ebp - 0x28]
mov dword [edi + 0x10], 0
add esp, 4
mov dword [edi + 0x14], 0
xor eax, eax
movups xmmword [edi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x100122a4
Function at 0x10015060
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x10024008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x100150e2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x100150e2
test ecx, ecx
je 0x100150de
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x100150a0
xor eax, eax
jmp 0x100150e7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x100150f1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10017527
add esp, 0xc
ret 0xc

Function at 0x10015820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019878
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10015856
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10015906
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.10015930
test al, al
je 0x100158af
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100158f2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100158e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100158e8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10017568
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret