joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010080
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001011f
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
test esi, esi
je 0x100100e8
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x100100e8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x1001011f
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001011f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ff78c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x10013390
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001342f
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
test esi, esi
je 0x100133f8
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x100133f8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x1001342f
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001342f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ff7a0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x10013450
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x100134ef
mov ebx, dword [sym.imp.MSVCR90.dll__wcsicmp]
test esi, esi
je 0x100134b8
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x100134b8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x100134ef
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x100134ef
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ff7b0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x10013780
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x1001381f
mov ebx, dword [sym.imp.MSVCR90.dll__wcsicmp]
test esi, esi
je 0x100137e8
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x100137e8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push eax
mov ecx, ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test ebp, ebp
je 0x1001381f
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x1001381f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
push edx
push ebp
push esi
call dword [0x100ff7c0]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x10013840
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x100138d5
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
test esi, esi
je 0x100138a3
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x100138a3
mov ecx, dword [esp + 0x10]
mov eax, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test ebp, ebp
je 0x100138d5
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x100138d5
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push ebp
push esi
call dword [0x100ff794]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x100138f0
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
push edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov ecx, esi
call edx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test edi, edi
je 0x10013985
mov ebx, dword [sym.imp.MSVCR90.dll__wcsicmp]
test esi, esi
je 0x10013953
push esi
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x10013953
mov ecx, dword [esp + 0x10]
mov eax, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test ebp, ebp
je 0x10013985
push ebp
push edi
call ebx
add esp, 8
neg eax
sbb eax, eax
inc eax
test al, al
je 0x10013985
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push ebp
push esi
call dword [0x100ff79c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x10019310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100bf870
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0x78
push str._Config::User::UpdateProtection_
lea edx, [esp + 0x14]
lea ecx, [esp + 0x18]
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebx
call fcn.1000b520
mov byte [esp + 0x30], 1
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
mov ecx, dword [esi]
mov edx, dword [eax]
mov edx, dword [edx + 8]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov ecx, dword [esi]
mov edx, dword [eax]
mov edx, dword [edx + 8]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
mov ecx, eax
mov edx, dword [edx + 8]
call edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 1
mov byte [esp + 0x30], bl
call fcn.1000b690
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001dd50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100bf870
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0x78
push str._Config::General::UpdateProtection_
lea edx, [esp + 0x14]
lea ecx, [esp + 0x18]
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], ebx
call fcn.1000b520
mov byte [esp + 0x30], 1
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x1c]
mov ecx, edi
call edx
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x24]
mov ecx, edi
call edx
mov ecx, dword [esi + 8]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x2c]
mov ecx, edi
call edx
mov ecx, dword [esi + 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 1
mov byte [esp + 0x30], bl
call fcn.1000b690
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10026bd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100c2176
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x14], vtable.SpeedBit::Utils::XML::BuilderHelper.0
mov dword [esp + 0x18], 0xfde9
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc8], esi
mov eax, dword [edi]
mov edx, dword [eax + 0x30]
mov ecx, edi
mov dword [esp + 0xc], esi
call edx
mov dword [esp + 0x10], eax
cmp eax, esi
je 0x10026d0c
mov ecx, dword [esp + 0xc]
mov eax, dword [edi]
mov edx, dword [eax + 0x34]
push ecx
mov ecx, edi
call edx
mov esi, eax
test esi, esi
je 0x10026cf9
push str.Library
lea eax, [esp + 0x28]
push eax
call fcn.1002fbd0
mov ecx, eax
mov eax, ebx
mov byte [esp + 0xc8], 1
call fcn.1002fa30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x14]
call eax
lea ecx, [esp + 0x24]
mov edi, eax
mov byte [esp + 0xc8], 0
call fcn.1002fc80
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
push eax
push edi
mov ecx, str.Name
lea edx, [esp + 0x1c]
call fcn.1003d3c0
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
push eax
push edi
mov ecx, str.Publisher
lea edx, [esp + 0x1c]
call fcn.1003d3c0
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
push eax
push edi
mov ecx, str.Signature
lea edx, [esp + 0x1c]
call fcn.1003d3c0
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
push eax
push edi
mov ecx, str.Checksum
lea edx, [esp + 0x1c]
call fcn.1003d3c0
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, dword [esp + 0x10]
jne 0x10026c3e
mov eax, 1
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1002cc90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100bcf20
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], 0x78
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov dword [esp + 0x20], 1
mov ecx, dword [eax + 4]
push edx
mov dword [esp + 0x30], 0
call ecx
mov edi, eax
test esi, esi
je 0x1002ccf3
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esi], ecx
jmp 0x1002ccf7
mov eax, dword [esp + 0x24]
xor edx, edx
test edi, edi
sete dl
mov esi, edx
test eax, eax
je 0x1002cd0b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x1002cd30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100bcf20
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], 0x78
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov dword [esp + 0x20], 1
mov ecx, dword [eax + 0x14]
push edx
mov dword [esp + 0x30], 0
call ecx
mov edi, eax
test esi, esi
je 0x1002cd93
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esi], ecx
jmp 0x1002cd97
mov eax, dword [esp + 0x24]
xor edx, edx
test edi, edi
sete dl
mov esi, edx
test eax, eax
je 0x1002cdab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x1002f3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100be124
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
mov dword [esp + 0x14], edi
lea ecx, [esi + 0x14]
mov dword [esi], vtable.TiXmlAttribute.0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esi + 0x10], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x10033fc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100bbc59
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100fc018]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov eax, dword [ebx]
mov edx, dword [eax + 4]
push ebp
mov esi, ecx
push edi
mov ecx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0
call edx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0
push 0
push ebp
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCP90.dll_protected:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Tidy_bool__unsigned_int_]
mov edx, dword [esp + 0xc]
push 0
push edx
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_unsigned_int__wchar_t_]
mov dword [esp + 0x40], 0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x1003405e
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 4]
push ecx
push eax
mov eax, dword [esi]
push ebp
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1003409f
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x10034086
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push ecx
push eax
mov ecx, ebx
call edx
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
jmp 0x100340a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ba2f9
add esp, 0x38
ret 4
Function at 0x100341c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100bbc19
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100fc018]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov eax, dword [ebx]
mov edx, dword [eax + 4]
push ebp
mov esi, ecx
push edi
mov ecx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
call edx
mov eax, dword [esi + 8]
mov ecx, dword [esi]
push 0
push 0
push 0
push 0
push ebp
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCP90.dll_protected:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool__unsigned_int_]
mov edx, dword [esp + 0xc]
push 0
push edx
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_unsigned_int__char_]
mov dword [esp + 0x40], 0
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x10034262
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 8]
push 0
push 0
push ecx
push eax
mov eax, dword [esi]
push ebp
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x100342a7
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x1003428e
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ebx]
mov edx, dword [edx + 8]
push ecx
push eax
mov ecx, ebx
call edx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jmp 0x100342af
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ba2f9
add esp, 0x38
ret 4
Function at 0x100354f0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x100bdf1b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x100fc018]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
mov ebx, ecx
push 0x80
xor edi, edi
mov ecx, eax
push edi
push ecx
mov dword [ebx], 0x2710
mov dword [esp + 0x20], vtable.SpeedBit::Utils::StackBufferEx_128_.0
mov dword [esp + 0xac], 0x80
mov dword [esp + 0xa8], eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esp + 0xb0], edi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
lea ecx, [esp + 0x14]
call eax
mov edx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [edx + 8]
lea ecx, [esp + 0x14]
call eax
push esi
push eax
push str.SB_VAR_F3B44D29_36CA_4481_9EA7_B31ADA3C649E
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x100355c0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
lea ecx, [esp + 0x14]
call eax
cmp esi, eax
jae 0x100355c0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 8]
lea ecx, [esp + 0x14]
call eax
mov esi, eax
call fcn.10035430
mov edi, eax
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], vtable.SpeedBit::Utils::StackBufferEx_128_.0
cmp eax, ecx
je 0x100355e2
test eax, eax
je 0x100355e2
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.100ba2f9
add esp, 0xa4
ret