joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100405b90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [0x10042d0c0]
mov dword [rsp + 0x20], Ordinal_260
mov rax, qword gs:[0x30]
mov esi, edx
add rax, rcx
cmp rcx, 0x1480
jge 0x100405bd3
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100405be4
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x100405c16
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x100405c0f
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x100405c29
mov rcx, qword [rax + 0x398]
jmp 0x100405c2b
xor ecx, ecx
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1090]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test byte [rax], 1
je 0x100405cbf
test rcx, rcx
je 0x100405cbf
lea rax, [rcx + 0x6d8]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100405cbf
inc qword [rax + 0x1fa8]
mov rcx, qword [rsp + 0x38]
mov edx, 0xfd
call qword [sym.imp.sqldk.dll_Ordinal_511_1]
mov rcx, qword [rsp + 0x38]
mov edx, 0xfd
mov rbx, rax
call qword [sym.imp.sqldk.dll_Ordinal_387]
mov r11, rax
test rbx, rbx
je 0x100405cbf
test rax, rax
je 0x100405cbf
xor edx, edx
mov rax, rbx
mov ecx, 0xfa
div r11
mov ebx, 0x61a8
shr rax, 1
cmp rax, rcx
cmova rcx, rax
cmp rcx, rbx
cmovb rbx, rcx
jmp 0x100405cc4
mov ebx, 0xfa
mov ebp, 0x989680
nop dword [rax]
xor ecx, ecx
test rbx, rbx
je 0x100405ce7
mov rax, rbx
mov rcx, rbx
nop dword [rax]
pause
dec rax
jne 0x100405ce0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x100405cf8
add qword [rax + 0x1fa0], rcx
xor eax, eax
lock cmpxchg dword [rdi], esi
je 0x100405d47
mov rcx, qword [rsp + 0x38]
inc dword [rsp + 0x40]
test rcx, rcx
je 0x100405d1b
movsxd rax, dword [rsp + 0x20]
shl rax, 5
inc dword [rax + rcx + 0x18]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.sqldk.dll_Ordinal_208]
test byte [rsp + 0x40], 0x1f
jne 0x100405d37
mov ebx, 0xfa
jmp 0x100405cd0
lea rax, [rbx + rbx]
mov rbx, rax
cmp rax, rbp
cmova rbx, rbp
jmp 0x100405cd0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x100407500
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x10042d0d0]
xor rax, rsp
mov qword [rsp + reloc.sqldk.dll_Ordinal_1088], rax
mov rax, qword [0x10042d108]
cmp dword [rax + 0x4f04], 0
jne 0x1004075b5
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1002]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + Ordinal_219]
mov rcx, rax
call qword [sym.imp.instapi120.dll_IsDefaultInstanceName]
test eax, eax
je 0x1004075b5
xor r9d, r9d
lea r8, str.SQL60_RUNNING
lea rax, [rsp + 0x30]
mov edx, 0x105
lea rcx, [rsp + 0x30]
sub r8, rax
mov ebx, r9d
nop
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x1004075a1
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1004075a1
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x100407570
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r9w
jmp 0x1004075fd
test rdx, rdx
jne 0x1004075af
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], r9w
jmp 0x1004075fd
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1002]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + Ordinal_219]
mov rbx, rax
call qword [sym.imp.sqldk.dll_Ordinal_403]
lea r8, str.SQL60_RUNNING
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x30]
lea r8, str._ls__ls
mov r9, rax
mov edx, 0x105
call fcn.100405260
mov ebx, eax
test ebx, ebx
jns 0x10040764f
mov ecx, ebx
call qword [sym.imp.sqlmin.dll_Ordinal_1457]
call qword [sym.imp.sqldk.dll_Ordinal_403]
mov dword [rsp + 0x28], ebx
lea rbx, str.String_operation_failure__status_block_name_
lea r8, str._hs__HRESULT_0x_x_
lea rcx, [rsp + 0x240]
mov r9, rax
mov edx, Ordinal_516
mov qword [rsp + 0x20], rbx
call fcn.10040d510
mov rcx, rbx
test eax, eax
js 0x10040764a
lea rcx, [rsp + 0x240]
call fcn.100411330
call qword [sym.imp.sqlmin.dll_Ordinal_780]
xor r9d, r9d
or rcx, 0xffffffffffffffff
mov rdx, rax
lea rax, [rsp + 0x30]
lea r8d, [r9 + 4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
je 0x1004076bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1004076b6
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 2]
mov qword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1004076b6
mov byte [rax], 1
jmp 0x1004076bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + reloc.sqldk.dll_Ordinal_1088]
xor rcx, rsp
call fcn.1004013c0
add rsp, 0x450
pop rbx
ret
Function at 0x10040a910
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2070
call fcn.100402360
sub rsp, rax
mov rax, qword [0x10042d0d0]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov rax, qword [0x10042d108]
mov edi, 2
cmp byte [rax + 0x805e], 0
je 0x10040a9c2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [rdi + 0x7e]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x10040a975
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10040a9b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov ecx, eax
call qword [sym.imp.sqldk.dll_Ordinal_479]
lea rdx, str.StartUp::BoostPriority
mov ecx, 0x429d
mov r8, rax
call fcn.1004137c0
mov edx, 0x429d
mov r8d, reloc.sqldk.dll_Ordinal_1066
or ecx, 0xffffffff
call qword [sym.imp.sqldk.dll_Ordinal_816]
mov ebx, Ordinal_132
mov ecx, 0x430b
jmp 0x10040aa39
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ebx, eax
cmp eax, 0x100
jne 0x10040aa26
mov rcx, qword [sym.imp.sqldk.dll_Ordinal_1075]
mov ecx, dword [rcx]
cmp ecx, 1
jne 0x10040aa34
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [rbx - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x10040aa13
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10040a9b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x1060]
jmp 0x10040a980
cmp eax, 0x80
jne 0x10040aa34
mov ecx, 0x430b
jmp 0x10040aa39
mov ecx, 0x430a
call fcn.1004137c0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_66
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xc2ef
shr rdx, 0x14
call fcn.1004137c0
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1052]
xor r11d, r11d
cmp ebx, 0x80
cmove r11d, edi
mov dword [rax], r11d
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1004013c0
mov rbx, qword [rsp + 0x2080]
add rsp, 0x2070
pop rdi
ret
Function at 0x10040c4b0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x10042d0d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
or rdi, 0xffffffffffffffff
mov rbx, rcx
test rcx, rcx
je 0x10040c57c
mov rax, qword [sym.imp.sqldk.dll_Ordinal_1002]
mov rcx, qword [rax]
mov eax, dword [rcx + 0x14]
cmp eax, 2
je 0x10040c4fa
cmp eax, 1
je 0x10040c4fa
call fcn.1004183e0
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x10040c500
cmp eax, 0x10
jbe 0x10040c51b
lea rcx, str.Error:_Instance_name_exceeds_maximum_length.
call fcn.100411330
lea r8, [0x100455a40]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.instapi120.dll_GetSvcInstanceIDFromName]
test eax, eax
jne 0x10040c53d
lea rcx, str.Error_getting_instance_ID_from_name.
call fcn.100411330
mov rdx, qword [0x10042d108]
lea r8, [rsp + 0x20]
lea rcx, [0x100455a40]
add rdx, 0x875a
mov dword [rsp + 0x20], Ordinal_267
call qword [sym.imp.instapi120.dll_GetInstanceNameFromID]
test eax, eax
jne 0x10040c575
lea rcx, str.Error_getting_instance_name.
call fcn.100411330
call fcn.10040c370
jmp 0x10040c588
lea rcx, str.SQL_Server_Instance_Name_not_set._Aborting_Initialization.
call fcn.100411330
mov rax, qword [0x10042d108]
xor esi, esi
cmp dword [rax + 0x4ed8], esi
jne 0x10040c5f8
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x24], Ordinal_23
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x10040c5ef
mov rdx, qword [0x10042d108]
lea r9, [rsp + 0x20]
lea rcx, [rsp + 0x28]
lea r8, [rdx + 0x8d78]
add rdx, 0x875a
mov dword [rsp + 0x20], Ordinal_267
call qword [sym.imp.instapi120.dll_GetSQLServerByName]
test eax, eax
jne 0x10040c659
lea rcx, str.Unable_to_determine_service_name.
jmp 0x10040c654
lea rcx, str.GetComputerName___initialization_failed._Aborting_Initialization
jmp 0x10040c654
mov edx, 0x105
lea rcx, [rax + 0x8d78]
mov r8d, esi
nop word [rax + rax]
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x10040c636
movzx eax, word [rbx]
test ax, ax
je 0x10040c636
mov word [rcx], ax
add rcx, 2
add rbx, 2
dec rdx
jne 0x10040c610
jmp 0x10040c63b
test rdx, rdx
jne 0x10040c645
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], si
test r8d, r8d
jns 0x10040c659
lea rcx, str.Instance_name_initialization_failed._Aborting_Initialization
call fcn.100411330
mov rax, qword [0x10042d108]
mov word [rax + 0x8f80], si
mov rax, qword [0x10042d108]
lea rdx, [rax + 0x8d78]
mov qword [rax + 0x3da0], rdx
nop dword [rax]
inc rdi
cmp word [rdx + rdi*2], si
jne 0x10040c680
mov rax, qword [0x10042d108]
add edi, edi
lea r9, [rsp + 0x20]
mov dword [rax + 0x3da8], edi
mov r8, qword [0x10042d108]
lea rcx, [0x100455a40]
xor edx, edx
add r8, 0x918c
mov dword [rsp + 0x20], Ordinal_267
call qword [sym.imp.instapi120.dll_GetSQLServiceByID]
test eax, eax
jne 0x10040c6d2
lea rcx, str.Unable_to_obtain_service_name.
call fcn.100411330
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1004013c0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x10040d280
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040d2a8
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040d2b9
mov rcx, qword [rax + 0xe8]
test rcx, rcx
jne 0x10040d2eb
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040d2e4
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0xe8]
mov rbx, qword [rcx + 0x210]
call qword [sym.imp.sqldk.dll_Ordinal_393]
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x90], edx
je 0x10040d312
lea rcx, [rbx + 0x90]
call fcn.100404cc0
mov rax, qword [0x10042d0c0]
mov rdx, qword gs:[0x30]
add rdx, rax
cmp rax, 0x1480
jge 0x10040d338
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
mov rax, qword [rdx + 0xe8]
xor ebx, ebx
mov qword [rdx + 0x18], rbx
mov rax, qword [rax + 0x38]
mov qword [rax + 0x18], rbx
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040d36f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040d380
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x10040d3b2
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040d3ab
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov rax, qword [rax + 0x210]
mov dword [rax + 0x90], ebx
add rsp, 0x20
pop rbx
ret

Function at 0x10040d5a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040d5c6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040d5d7
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x10040d609
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040d602
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov rax, qword [rax + 0x3a0]
add rsp, 0x28
ret

Function at 0x10040d620
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040d646
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040d657
mov rcx, qword [rax + 0xe8]
test rcx, rcx
jne 0x10040d689
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040d682
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0xe8]
mov eax, dword [rcx + 0x2e8]
shr eax, 3
and eax, 1
add rsp, 0x28
ret
Function at 0x10040d6a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x10042d0c0]
mov rbx, qword gs:[0x30]
mov rdi, rcx
add rbx, rax
cmp rax, 0x1480
jge 0x10040d6d3
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
call fcn.10040d620
test eax, eax
je 0x10040d72c
mov rax, qword [rbx + reloc.sqllang.dll_Ordinal_272]
test rax, rax
jne 0x10040d6f8
mov rcx, rbx
call qword [sym.imp.sqldk.dll_Ordinal_282]
mov rax, qword [rbx + reloc.sqllang.dll_Ordinal_272]
lea rcx, [0x10040d9e0]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
call fcn.10040d890
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x10040da70
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040da96
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040daa7
mov rcx, qword [rax + 0xe8]
test rcx, rcx
jne 0x10040dad9
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040dad2
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0xe8]
mov eax, dword [rcx + 0x220]
shr eax, 9
and eax, 1
add rsp, 0x28
ret

Function at 0x10040daf0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov ebx, ecx
mov rcx, qword [0x10042d0c0]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040db1a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040db2b
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x10040db5d
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040db56
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
test ebx, ebx
je 0x10040db71
or dword [rax + 0x220], 0x200
add rsp, 0x20
pop rbx
ret
and dword [rax + 0x220], 0xfffffdff
add rsp, 0x20
pop rbx
ret

Function at 0x10040db90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.10040da70
mov rcx, qword [0x10042d0c0]
mov dword [rbx], eax
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x10040dbc2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10040dbd3
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x10040dc05
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x10040dbfe
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
or dword [rax + 0x220], 0x200
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x100411760
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov ebx, ecx
mov rcx, qword [0x10042d0c0]
add rax, rcx
cmp rcx, 0x1480
jge 0x10041178a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0x18]
test byte [rax + 8], 1
je 0x10041179e
mov edx, 6
lea ecx, [rdx + 6]
jmp 0x1004117de
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x1004117c0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0x18]
test byte [rax + 8], 4
je 0x1004117d6
mov edx, 0xb
mov ecx, Ordinal_288
jmp 0x1004117de
mov edx, 0x26
lea ecx, [rdx + 1]
mov r9d, ebx
mov r8d, Ordinal_23
add rsp, 0x20
pop rbx
jmp qword [sym.imp.sqldk.dll_Ordinal_980]

Function at 0x100411b80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x100411ba6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100411bb7
mov rax, qword [rax + 0xe8]
test rax, rax
jne 0x100411be9
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x100411be2
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rax + 0xe8]
mov rax, qword [rax + 0x210]
mov eax, dword [rax + 0xb4]
shr eax, 2
and eax, 1
add rsp, 0x28
ret

Function at 0x100411c10
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, rcx
cmp rcx, 0x1480
jge 0x100411c36
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100411c47
mov rcx, qword [rax + 0xe8]
test rcx, rcx
jne 0x100411c79
call qword [sym.imp.sqldk.dll_Ordinal_7]
mov r11, qword [0x10042d0c0]
mov rax, qword gs:[0x30]
add rax, r11
cmp r11, 0x1480
jge 0x100411c72
mov ecx, r11d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax + 0xe8]
test byte [rcx + 0x220], 1
jne 0x100411c99
mov eax, dword [rcx + 0x2e8]
test al, al
js 0x100411c99
bt eax, 8
jb 0x100411c99
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x100417a80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov r15d, Ordinal_132
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x100417aa5
lea esi, [rbx + 0x80]
mov edi, esi
add rdi, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x100417b96
mov qword [rsp + 0x50], r12
lea r12, str._dp_
nop word [rax + rax]
mov r9d, ebx
mov r8, r14
mov edx, 1
mov ecx, reloc.sqldk.dll_Ordinal_1024
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x100417b37
mov edi, dword [0x100455184]
cmp edi, esi
ja 0x100417b4a
lea r8d, [rdi + rdi]
lea rdx, [0x1004555c0]
mov rcx, rbp
call sub.MSVCR100.dll_memcpy
jmp 0x100417b48
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
cmp edi, esi
jle 0x100417b8e
add r15d, r15d
lea esi, [rbx + r15]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, esi
add rdi, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
jne 0x100417af0
jmp 0x100417b91
mov rax, rbp
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x100417bc0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
mov edi, Ordinal_132
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, Ordinal_260
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x100417ceb
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
lea r15, [0x1004551a0]
lea r12, [0x1004553b0]
mov r14d, 0xffff
nop dword [rax]
test rbp, rbp
je 0x100417c65
test rsi, rsi
je 0x100417c65
lea r8, [0x100421b1c]
mov r9, rbx
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [rdi - 1]
mov r11d, eax
cmp eax, ecx
je 0x100417c60
cmp word [rbx], r14w
jne 0x100417c60
cmp word [rbx + 2], 0
je 0x100417c65
cmp eax, 0xffffffff
jne 0x100417c87
lea r8, [0x100421b1c]
mov r9, rbx
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov r11d, eax
test rbp, rbp
je 0x100417c94
lea eax, [rdi - 1]
test rsi, rsi
jne 0x100417c97
lea eax, [rdi - 2]
cmp r11d, eax
jne 0x100417cd9
add edi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, edi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x100417c20
jmp 0x100417cdc
mov rax, rbx
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x100417f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push r12
push r14
sub rsp, 0x48
cmp dword [0x100455180], 0
mov r14, r9
mov r12, r8
mov ebp, edx
mov rbx, rcx
je 0x10041810e
cmp qword [rsp + 0x90], 0
mov qword [rsp + 0x40], r15
je 0x100417f9d
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, rbx
call fcn.1004178f0
xor edx, edx
mov rcx, rax
call fcn.100417bc0
mov r15, rax
mov rdx, rax
test rax, rax
jne 0x100417fd7
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [r15 + 8]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop r14
pop r12
pop rbp
pop rbx
ret
movzx ecx, word [rax]
xor r8d, r8d
mov qword [rsp + 0x80], rdi
mov edi, Ordinal_260
test cx, cx
je 0x1004180d8
mov qword [rsp + 0x78], rsi
nop dword [rax + rax]
mov rsi, rdx
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x100418010
mov ebx, eax
cmp cx, 0x40
jne 0x100418032
cmp word [rdx + 2], 0
jne 0x100418032
lea rsi, [0x1004223e4]
xor ebx, ebx
cmp r8d, ebp
je 0x10041804f
inc r8d
inc eax
lea rdx, [rdx + rax*2]
mov ecx, eax
movzx ecx, word [rdx]
test cx, cx
jne 0x100418000
jmp 0x1004180d3
test r12, r12
je 0x100418081
lea eax, [rbx + 1]
cmp dword [r14], eax
ja 0x100418063
mov edi, Ordinal_236
jmp 0x100418078
lea r8d, [rbx*2 + 2]
mov rdx, rsi
mov rcx, r12
call sub.MSVCR100.dll_memcpy
xor edi, edi
mov dword [r14], ebx
test edi, edi
jne 0x1004180d3
jmp 0x10041808b
test r14, r14
je 0x1004180d3
mov dword [r14], ebx
xor edi, edi
mov r9, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
test r9, r9
jne 0x1004180b2
test rcx, rcx
jne 0x1004180b2
test rax, rax
je 0x1004180d3
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
call fcn.100417300
mov edi, eax
mov rsi, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x80]
add rsp, 0x48
pop r14
pop r12
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add rsp, 0x48
pop r14
pop r12
pop rbp
pop rbx
ret