joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100335b0
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x2028
call fcn.10177990
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x2024], eax
push esi
mov edx, ecx
mov dword [esp + 0x10], 0
push edi
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.10055920
test eax, eax
js 0x10033776
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
push 5
push 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
cmp eax, 2
je 0x10033749
cmp eax, 3
je 0x10033749
test eax, eax
je 0x10033630
push str.failed_to_get_security_information
push 2
call fcn.1002a5a0
add esp, 8
or edi, 0xffffffff
jmp 0x1003374e
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x10033655
push str.programdata_configuration_file_owner_is_unknown
push 3
call fcn.1002a5a0
add esp, 8
or edi, 0xffffffff
jmp 0x1003374e
push 0x1a
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x10033745
push 0x16
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x10033745
lea eax, [esp + 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10033709
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x10033709
mov esi, dword [fcn.10060f30]
mov ecx, esi
push 0x726
push str.C:UsersAdmin_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_src_fs_path.c
push dword [esp + 0x14]
call dword [0x101aa4d8]
call esi
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10033776
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x10033731
push esi
mov esi, dword [fcn.10034de0]
mov ecx, esi
call dword [0x101aa4d8]
call esi
add esp, 4
xor esi, esi
push str.programdata_configuration_file_owner_is_not_valid
push 3
call fcn.1002a5a0
add esp, 8
or edi, 0xffffffff
push esi
mov esi, dword [fcn.10034de0]
mov ecx, esi
call dword [0x101aa4d8]
call esi
add esp, 4
jmp 0x1003374e
push dword [esi]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10033709
xor edi, edi
jmp 0x1003371b
xor edi, edi
jmp 0x1003374e
mov edi, 0xfffffffd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1003375d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x2024]
xor ecx, esp
call fcn.10176e3f
add esp, 0x2028
ret
mov ecx, dword [esp + 0x202c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.10176e3f
add esp, 0x2028
ret
Function at 0x1003ca50
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x2018
call fcn.10177990
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x2014], eax
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov edx, esi
call fcn.10055920
test eax, eax
js 0x1003cab8
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003cab8
mov ecx, eax
or ecx, 2
cmp eax, ecx
je 0x1003cad1
push ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1003cad1
push esi
push 0x101e04ec
push str.failed_to__s_hidden_bit_for__s
push 2
call fcn.1002a5a0
add esp, 0x10
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.10176e3f
add esp, 0x2018
ret
mov ecx, dword [esp + 0x2018]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10176e3f
add esp, 0x2018
ret
Function at 0x10041550
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [esp + 0xc], edx
push ebp
xor ebp, ebp
mov dword [esp + 8], 0
push esi
mov ecx, dword [ebx]
mov dword [esp + 0x10], 0xffffffff
mov dword [ebx + 8], ebp
push edi
test ecx, ecx
jne 0x10041586
mov dword [ebx], 0x102069cd
mov ecx, 0x102069cd
mov dword [ebx + 4], ebp
cmp dword [ebx + 4], ebp
jbe 0x1004158e
mov byte [ecx], 0
lea ecx, [esp + 0x10]
call fcn.1008e1b0
test eax, eax
js 0x1004166d
mov esi, dword [esp + 0x10]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
je 0x10041605
mov esi, dword [fcn.10060f30]
lea eax, [edi + edi]
push 0x2ee
push str.C:UsersAdmin_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_srcutil.c
push eax
mov ecx, esi
call dword [0x101aa4d8]
call esi
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x1004166d
mov esi, dword [esp + 0x10]
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
je 0x10041605
push edi
mov edx, ebp
mov ecx, ebx
call fcn.1008dfb0
add esp, 4
mov dword [esp + 0x14], eax
jmp 0x10041639
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10041631
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x10041631
push dword [esp + 0x18]
push str.could_not_read_environment_variable__s
push 2
call fcn.1002a5a0
add esp, 0xc
jmp 0x10041639
mov dword [esp + 0x14], 0xfffffffd
push esi
mov esi, dword [fcn.10034de0]
mov ecx, esi
call dword [0x101aa4d8]
call esi
mov esi, dword [fcn.10034de0]
add esp, 4
mov ecx, esi
push ebp
call dword [0x101aa4d8]
call esi
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret

Function at 0x100418c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100418ed
test al, 1
jne 0x100418d7
xor eax, eax
pop esi
ret
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x100418ed
mov eax, 0xffffffe0
pop esi
ret
call fcn.100416a0
or eax, 0xffffffff
pop esi
ret

Function at 0x10041900
Capabilities:
Create directory

Disassembly:
mov eax, 0x2010
call fcn.10177990
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x200c], eax
mov edx, ecx
lea ecx, [esp]
call fcn.10055920
test eax, eax
jns 0x1004193e
or eax, 0xffffffff
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.10176e3f
add esp, 0x2010
ret
lea eax, [esp]
push eax
call fcn.101888ae
mov ecx, dword [esp + 0x2010]
add esp, 4
xor ecx, esp
call fcn.10176e3f
add esp, 0x2010
ret
Function at 0x10041960
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x28
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10041a01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 5
jne 0x100419bb
lea eax, [esp + 8]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x100419bb
mov eax, dword [esp + 8]
and eax, 0x410
cmp eax, 0x410
jne 0x100419bb
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x10041a01
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x100419eb
cmp eax, 5
je 0x100419eb
call fcn.100416a0
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10176e3f
add esp, 0x28
ret
pop edi
mov eax, 0xffffffe0
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10176e3f
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10176e3f
add esp, 0x28
ret

Function at 0x10041b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x28
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
push 0
push edi
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10041b5d
test esi, esi
jne 0x10041b3d
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10176e3f
add esp, 0x28
ret
push edi
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.1003caf0
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10176e3f
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x10041b75
call fcn.1017cc59
mov dword [eax], 2
jmp 0x10041b80
call fcn.1017cc59
mov dword [eax], 0xd
call fcn.1017cc59
cmp dword [eax], 2
jne 0x10041bf8
cmp byte [esp + 0x34], 0
je 0x10041bf8
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10041b96
sub esi, ecx
sar esi, 1
sub esi, 1
je 0x10041bf8
nop word [eax + eax]
movzx eax, word [edi + esi*2]
cmp eax, 0x2f
je 0x10041bd7
cmp eax, 0x5c
je 0x10041bd7
sub esi, 1
jne 0x10041bb0
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10176e3f
add esp, 0x28
ret
xor eax, eax
push edi
mov word [edi + esi*2], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10041ba5
test al, 0x10
jne 0x10041bf8
call fcn.1017cc59
mov dword [eax], 0x14
mov ecx, dword [esp + 0x2c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.10176e3f
add esp, 0x28
ret
Function at 0x10041d40
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x2028
call fcn.10177990
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x2024], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], 0
mov esi, 0x102069cd
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], esi
mov bl, 1
mov al, byte [edi]
cmp al, 0x41
jl 0x10041d82
cmp al, 0x5a
jle 0x10041d8a
cmp al, 0x61
jl 0x10041db8
cmp al, 0x7a
jg 0x10041db8
cmp byte [edi + 1], 0x3a
jne 0x10041db8
mov al, byte [edi + 2]
cmp al, 0x5c
je 0x10041d9b
cmp al, 0x2f
jne 0x10041db8
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.10055920
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
and bl, 0x10
jmp 0x10041e0e
lea ecx, [esp + 0x10]
call fcn.10031af0
test eax, eax
js 0x10041e0a
push edi
push dword [esp + 0x14]
mov dl, 0x2f
lea ecx, [esp + 0x18]
call fcn.1002c770
add esp, 8
test eax, eax
jne 0x10041de5
lea ecx, [esp + 0x10]
call fcn.100326a0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
mov edx, esi
call fcn.10055920
test eax, eax
js 0x10041e0e
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
and bl, 0x10
jmp 0x10041e0e
mov esi, dword [esp + 0x10]
cmp dword [esp + 0x14], 0
jbe 0x10041e35
test esi, esi
je 0x10041e35
cmp esi, 0x102069cc
je 0x10041e35
push esi
mov esi, dword [fcn.10034de0]
mov ecx, esi
call dword [0x101aa4d8]
call esi
add esp, 4
mov ecx, dword [esp + 0x2030]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10176e3f
add esp, 0x2028
ret
Function at 0x10042170
Capabilities:
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2068
call fcn.10177990
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x2064], eax
push esi
push edi
mov edi, edx
mov dword [esp + 0xc], 0
mov edx, ecx
lea ecx, [esp + 0x58]
call fcn.10055920
test eax, eax
js 0x100421e2
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x10], eax
test al, 1
je 0x100421f9
and eax, 0xfffffffe
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x100421f9
push str.failed_to_set_attributes
push 2
call fcn.1002a5a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.10176e3f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101fe1e8]
lea edx, [esp + 0x28]
lea ecx, [esp + 0x58]
mov dword [esp + 0x28], 0xc0000000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], 0x80
mov dword [esp + 0x44], 0
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.10042060
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
jns 0x10042259
or edi, 0xffffffff
jmp 0x1004236b
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
movlpd qword [esp + 0x14], xmm0
test edi, edi
jne 0x1004229c
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x10042336
movups xmm0, xmmword [edi]
push 0
push 0x989680
movd ecx, xmm0
psrldq xmm0, 4
movd eax, xmm0
add ecx, 0xb6109100
adc eax, 2
push eax
push ecx
call fcn.10176e50
movups xmm0, xmmword [edi]
mov esi, eax
mov ecx, edx
mov edx, 0xa
psrldq xmm0, 8
movd eax, xmm0
movups xmm0, xmmword [edi + 0x10]
push 0
imul edx
push 0x989680
add esi, eax
mov dword [esp + 0x24], esi
adc ecx, edx
mov dword [esp + 0x28], ecx
movd ecx, xmm0
psrldq xmm0, 4
movd eax, xmm0
add ecx, 0xb6109100
adc eax, 2
push eax
push ecx
call fcn.10176e50
movups xmm0, xmmword [edi + 0x10]
mov esi, eax
mov ecx, edx
mov edx, 0xa
psrldq xmm0, 8
movd eax, xmm0
imul edx
add esi, eax
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x24]
adc ecx, edx
mov dword [esp + 0x18], ecx
push esi
call fcn.10188ca2
add esp, 4
cmp eax, 0xffffffff
jne 0x10042348
or edi, eax
jmp 0x10042362
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
neg eax
sbb edi, edi
neg edi
dec edi
push esi
call fcn.1019232e
add esp, 4
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xc]
je 0x10042393
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x10]
mov esi, eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x206c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10176e3f
mov esp, ebp
pop ebp
ret
Function at 0x10042840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x401c
call fcn.10177990
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x4018], eax
push esi
mov esi, edx
mov edx, ecx
lea ecx, [esp + 0x2010]
call fcn.10055920
test eax, eax
js 0x100428a1
push 0
lea eax, [esp + 8]
push eax
push 0x1006
lea eax, [esp + 0x201c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x100428dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100428b9
call fcn.1017cc59
mov dword [eax], 0x26
xor eax, eax
pop esi
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10176e3f
add esp, 0x401c
ret
call fcn.1017cc59
pop esi
mov dword [eax], 0x16
xor eax, eax
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10176e3f
add esp, 0x401c
ret
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1004290f
call fcn.1017cc59
pop esi
mov dword [eax], 2
xor eax, eax
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10176e3f
add esp, 0x401c
ret
test esi, esi
jne 0x1004295e
mov esi, dword [fcn.10060f30]
mov ecx, esi
push 0x32c
push str.C:UsersAdmin_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_srcwin32posix_w32.c
push 0x2ffe
call dword [0x101aa4d8]
call esi
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1004295e
call fcn.1017cc59
pop esi
mov dword [eax], 0xc
xor eax, eax
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10176e3f
add esp, 0x401c
ret
lea edx, [esp + 4]
mov ecx, esi
call fcn.10055b60
test eax, eax
js 0x100428a1
mov ecx, esi
call fcn.10041680
mov ecx, dword [esp + 0x401c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10176e3f
add esp, 0x401c
ret

Function at 0x10042ab0
Capabilities:
Move file

Disassembly:
mov eax, 0x401c
call fcn.10177990
mov eax, dword [0x101fd700]
xor eax, esp
mov dword [esp + 0x4018], eax
push esi
mov esi, edx
mov edx, ecx
lea ecx, [esp + 0x2010]
call fcn.10055920
test eax, eax
js 0x10042b39
mov edx, esi
lea ecx, [esp + 4]
call fcn.10055920
test eax, eax
js 0x10042b39
mov esi, 0xa
push 3
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10042b59
call fcn.100418a0
test al, al
je 0x10042b52
cmp esi, 1
jle 0x10042b2c
lea ecx, [esp + 4]
call fcn.100418c0
test eax, eax
je 0x10042b2c
cmp eax, 0xffffffe0
jne 0x10042b3c
jmp 0x10042b34
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x10042af1
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x4018]
xor ecx, esp
call fcn.10176e3f
add esp, 0x401c
ret
call fcn.100416a0
jmp 0x10042b39
mov ecx, dword [esp + 0x401c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10176e3f
add esp, 0x401c
ret
Function at 0x10042b80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x18]
push 0
push 0x14
push esi
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
push edi
mov ebx, edx
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x44], 0
call fcn.10040b90
add esp, 0x10
test eax, eax
je 0x10042bd8
call fcn.1017cc59
mov dword [eax], 0x16
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], esi
call fcn.10188ca2
add esp, 4
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
push ecx
push 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10042c0d
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
call fcn.100416a0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret
Function at 0x100553c0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov edi, ecx
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
jne 0x100553f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov ecx, 0xd
mov esi, 2
cmove esi, ecx
call fcn.1017cc59
pop edi
mov dword [eax], esi
or eax, 0xffffffff
pop esi
ret
cmp esi, 0x1000
jle 0x10055412
call fcn.1017cc59
pop edi
pop esi
mov dword [eax], 0x26
or eax, 0xffffffff
ret
push 4
push str.__
push edi
call fcn.10189ae6
add esp, 0xc
test eax, eax
jne 0x1005543a
sub esi, 4
lea eax, [esi + esi]
push eax
lea eax, [edi + 8]
push eax
push edi
call fcn.101787d0
add esp, 0xc
pop edi
mov eax, esi
pop esi
ret
Function at 0x100556f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebx
mov eax, edx
push ebp
mov ebx, eax
mov dword [esp + 0x14], eax
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x14], ebp
lea esi, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10055710
push 0
push 0
sub ebx, esi
push str.PATH
sar ebx, 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x10055788
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x100557c4
xor esi, esi
mov dword [esp + 0x18], esi
nop dword [eax + eax]
xor edx, edx
test esi, esi
je 0x100558f3
movzx eax, word [esi]
mov ecx, eax
test ax, ax
je 0x100558f3
cmp eax, 0x22
jne 0x100557de
movzx ecx, word [esi + 2]
lea edi, [edx + 0x22]
add esi, 2
mov dword [esp + 0x10], esi
mov eax, esi
test cx, cx
je 0x1005580c
jmp 0x100557e7
mov esi, dword [fcn.10060f30]
lea eax, [edi + edi]
push 0xc8
push str.C:UsersAdmin_vcpkg_buildtreeslibgit2_src_v1.4.2_3f39c3e750.clean_srcwin32path_w32.c
push eax
mov ecx, esi
call dword [0x101aa4d8]
call esi
mov esi, eax
add esp, 0xc
mov dword [esp + 0x18], esi
test esi, esi
je 0x100557d3
push edi
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x10055750
push str.could_not_load_PATH
push 2
call fcn.1002a5a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, 0x3b
mov dword [esp + 0x10], esi
mov ebp, esi
movzx ecx, cx
mov eax, esi
nop
cmp cx, di
je 0x10055806
movzx ecx, word [ebp + 2]
lea esi, [ebp + 2]
inc edx
mov eax, esi
mov ebp, esi
test cx, cx
jne 0x100557f0
cmp di, 0x22
jne 0x10055815
cmp word [esi], 0
je 0x10055815
lea esi, [eax + 2]
cmp word [esi], 0x3b
jne 0x10055829
nop dword [eax + eax]
add esi, 2
cmp word [esi], 0x3b
je 0x10055820
mov ecx, dword [esp + 0x10]
xor edi, edi
test edx, edx
je 0x10055845
test ebx, ebx
je 0x10055845
cmp word [ecx + edx*2 - 2], 0x5c
mov eax, 1
cmovne edi, eax
lea eax, [edi + edx]
mov dword [esp + 0x10], eax
add eax, ebx
mov dword [esp + 0x20], eax
cmp eax, 0x104
jbe 0x10055871
push str.path_too_long
push 3
call fcn.1002a5a0
mov ebp, dword [esp + 0x1c]
add esp, 8
jmp 0x10055750
lea ebp, [edx + edx]
push ebp
push ecx
push dword [esp + 0x1c]
call fcn.101787d0
add esp, 0xc
test edi, edi
je 0x10055893
mov eax, dword [esp + 0x14]
mov ecx, 0x5c
mov word [eax + ebp], cx
mov ebp, dword [esp + 0x14]
lea eax, [ebx + ebx]
push eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x20]
lea eax, [eax*2]
add eax, ebp
push eax
call fcn.101787d0
mov eax, dword [esp + 0x2c]
add esp, 0xc
xor ecx, ecx
push ecx
push ebp
mov word [ebp + eax*2], cx
call fcn.101887d8
add esp, 8
test eax, eax
jne 0x10055750
push dword [esp + 0x18]
mov esi, dword [fcn.10034de0]
mov ecx, esi
call dword [0x101aa4d8]
call esi
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push dword [esp + 0x18]
mov esi, dword [fcn.10034de0]
mov ecx, esi
call dword [0x101aa4d8]
call esi
add esp, 4
xor eax, eax
mov word [ebp], ax
mov eax, 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret