joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ffb80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp edi, ecx
jne 0x101ffc59
test edi, edi
je 0x101ffc64
mov ecx, dword [esi]
test ecx, ecx
je 0x101ffbd5
mov eax, dword [esi + 0x18]
sub edi, eax
push ecx
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, dword [esi + 0x14]
add esp, 0x10
mov edi, dword [esi + 0x18]
mov eax, ecx
sub eax, edi
mov dword [esi + 0x10], edi
cmp eax, 1
jl 0x101ffc64
jmp 0x101ffc59
mov eax, dword [esi + 0xc]
sub edi, dword [esi + 0x18]
mov edx, dword [eax + 8]
mov ecx, edx
sar ecx, 3
cmp edx, 0x1000000
lea eax, [edx + 0x400]
cmovle ecx, eax
mov eax, 1
cmp ecx, eax
cmovg eax, ecx
mov dword [ebp - 4], eax
mov eax, 0x7fffffff
mov ecx, dword [ebp - 4]
sub eax, edx
cmp ecx, eax
jle 0x101ffc16
mov dword [esi + 4], 3
jmp 0x101ffc68
add edx, ecx
lea eax, [esi + 0xc]
push edx
push eax
mov dword [ebp - 4], edx
call sym.python310.dll__PyBytes_Resize
add esp, 8
test eax, eax
je 0x101ffc43
mov dword [esi + 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
jmp 0x101ffc68
mov ecx, dword [esi + 0xc]
mov eax, dword [ebp - 4]
add ecx, 0x10
add eax, ecx
mov dword [esi + 0x18], ecx
add edi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], edi
mov byte [edi], bl
inc dword [esi + 0x10]
mov edi, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp edi, ecx
jne 0x101ffc78
mov edx, 1
mov ecx, esi
call fcn.101ff910
test eax, eax
je 0x101ffc85
mov eax, dword [esi + 0x10]
mov ecx, ebx
sar ecx, 8
mov byte [eax], cl
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x101ffc9d
mov edx, 1
mov ecx, esi
call fcn.101ff910
test eax, eax
je 0x101ffcaa
mov eax, dword [esi + 0x10]
mov ecx, ebx
sar ecx, 0x10
mov byte [eax], cl
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jne 0x101ffcc2
mov edx, 1
mov ecx, esi
call fcn.101ff910
test eax, eax
je 0x101ffccd
mov eax, dword [esi + 0x10]
sar ebx, 0x18
mov byte [eax], bl
inc dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101ffd50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x103b1004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 1
lea eax, [ebp - 0xc]
movaps xmm0, xmm1
push eax
sub esp, 8
mov esi, ecx
movsd qword [esp], xmm0
call sym.python310.dll__PyFloat_Pack8
add esp, 0x10
test eax, eax
jns 0x101ffd96
mov dword [esi + 4], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1024a596
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x10]
test edx, edx
je 0x101ffe1c
mov eax, dword [esi + 0x14]
sub eax, edx
cmp dword [esi], 0
je 0x101ffdf3
cmp eax, 8
jl 0x101ffdca
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edx], eax
mov dword [edx + 4], ecx
add dword [esi + 0x10], 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1024a596
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.101ff8e0
push dword [esi]
lea eax, [ebp - 0xc]
push 8
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1024a596
mov esp, ebp
pop ebp
ret
cmp eax, 8
jge 0x101ffe0a
mov edx, 8
mov ecx, esi
sub edx, eax
call fcn.101ff910
test eax, eax
je 0x101ffe1c
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x10], 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1024a596
mov esp, ebp
pop ebp
ret

Function at 0x10200ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], eax
call fcn.101ffb80
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
sub eax, ecx
push eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10200b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x103b1004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
push 0x103657e0
push str.marshal.dumps
call sym.python310.dll_PySys_Audit
add esp, 0x10
test eax, eax
js 0x10200c13
lea eax, [ebp - 0x204]
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], eax
xorps xmm0, xmm0
lea eax, [ebp - 4]
movlpd qword [ebp - 0x220], xmm0
mov edx, edi
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x208], edi
call fcn.10200a10
test eax, eax
jne 0x10200c13
lea edx, [ebp - 0x228]
mov ecx, esi
call fcn.101ffeb0
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x10200bf2
push eax
call sym.python310.dll__Py_hashtable_destroy
add esp, 4
push dword [ebp - 0x228]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x210]
sub eax, ecx
push eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1024a596
mov esp, ebp
pop ebp
ret
Function at 0x10200c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10200cae
mov eax, dword [edi + 0x10]
sub eax, ecx
cmp eax, esi
jge 0x10200c9f
mov edx, 0x16
mov ecx, str.marshal_data_too_short
mov edi, dword [0x103fb118]
mov esi, dword [sym.python310.dll_PyExc_EOFError]
push 0
push 0
push 0
call fcn.101599e0
add esp, 0xc
mov ebx, eax
push ebx
push esi
push edi
call sym.python310.dll__PyErr_SetObject
add esp, 0xc
test ebx, ebx
je 0x10200c96
add dword [ebx], 0xffffffff
jne 0x10200c96
mov eax, dword [ebx + 4]
push ebx
mov eax, dword [eax + 0x18]
call eax
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + esi]
mov dword [edi + 0xc], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x10200d04
cmp esi, 0x7fffffff
jbe 0x10200cce
mov dword [edi + 0x14], eax
call sym.python310.dll_PyErr_NoMemory
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [0x103cc55c]
call dword [0x103cc560]
add esp, 8
mov dword [edi + 0x14], eax
test eax, eax
je 0x10200cc0
mov dword [edi + 0x18], esi
cmp dword [edi + 8], 0
jne 0x10200d2b
push dword [edi]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, eax
jmp 0x10200ddb
cmp dword [edi + 0x18], esi
jge 0x10200ce8
cmp esi, 0x7fffffff
ja 0x10200cc0
push esi
push eax
push dword [0x103cc55c]
call dword [0x103cc568]
add esp, 0xc
test eax, eax
je 0x10200cc0
mov dword [edi + 0x14], eax
jmp 0x10200ce5
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call sym.python310.dll_PyMemoryView_FromBuffer
add esp, 4
test eax, eax
je 0x10200c96
push eax
push 0x1036c644
push 0x103ce01c
push dword [edi + 8]
call sym.python310.dll__PyObject_CallMethodId_SizeT
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10200dd8
push dword [sym.python310.dll_PyExc_ValueError]
push ebx
call sym.python310.dll_PyNumber_AsSsize_t
add esp, 8
mov ecx, eax
add dword [ebx], 0xffffffff
mov dword [esp + 0x10], ecx
jne 0x10200ddb
mov eax, dword [ebx + 4]
push ebx
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [esp + 0x14]
add esp, 4
jmp 0x10200ddb
or ecx, 0xffffffff
cmp ecx, esi
je 0x10200e1f
mov eax, dword [0x103fb118]
cmp dword [eax + 0x34], 0
jne 0x10200c96
cmp ecx, esi
jle 0x10200e10
push ecx
push esi
push str.read___returned_too_much_data:__zd_bytes_requested___zd_returned
push dword [sym.python310.dll_PyExc_ValueError]
call sym.python310.dll_PyErr_Format
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x1b
mov ecx, str.EOF_read_where_not_expected
jmp 0x10200c5a
mov eax, dword [edi + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10202520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 2
push dword [0x103cc55c]
call dword [0x103cc560]
mov esi, eax
add esp, 8
mov dword [esp + 0x14], esi
test esi, esi
jne 0x10202556
call sym.python310.dll_PyErr_NoMemory
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push 2
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, 2
je 0x10202601
mov ecx, dword [0x103fb118]
cmp dword [ecx + 0x34], 0
jne 0x10202597
cmp eax, 2
jle 0x102025b9
push eax
push 2
push str.read___returned_too_much_data:__zd_bytes_requested___zd_returned
push dword [sym.python310.dll_PyExc_ValueError]
call sym.python310.dll_PyErr_Format
add esp, 0x10
or ecx, 0xffffffff
push dword [esp + 0x14]
movsx esi, cx
push dword [0x103cc55c]
call dword [0x103cc56c]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.python310.dll_PyExc_EOFError]
mov edx, 0x1b
mov edi, dword [0x103fb118]
mov ecx, str.EOF_read_where_not_expected
push 0
push 0
push 0
call fcn.101599e0
add esp, 0xc
mov ebx, eax
push ebx
push esi
push edi
call sym.python310.dll__PyErr_SetObject
add esp, 0xc
test ebx, ebx
je 0x10202597
add dword [ebx], 0xffffffff
jne 0x10202597
mov eax, dword [ebx + 4]
push ebx
mov eax, dword [eax + 0x18]
call eax
add esp, 4
jmp 0x10202597
movzx ecx, byte [esi + 1]
movzx eax, byte [esi]
shl cx, 8
or cx, ax
movzx eax, cx
mov dword [esp + 0x10], eax
and eax, 0xffff8000
mov ecx, dword [esp + 0x10]
neg eax
or ecx, eax
jmp 0x1020259a
Function at 0x10202630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 4
push dword [0x103cc55c]
or ebx, 0xffffffff
call dword [0x103cc560]
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
test esi, esi
jne 0x10202668
call sym.python310.dll_PyErr_NoMemory
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push 4
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, 4
je 0x10202714
mov ecx, dword [0x103fb118]
cmp dword [ecx + 0x34], 0
jne 0x102026fb
cmp eax, 4
jle 0x102026ab
push eax
push 4
push str.read___returned_too_much_data:__zd_bytes_requested___zd_returned
push dword [sym.python310.dll_PyExc_ValueError]
call sym.python310.dll_PyErr_Format
add esp, 0x10
jmp 0x102026fb
mov esi, dword [sym.python310.dll_PyExc_EOFError]
mov edx, 0x1b
mov edi, dword [0x103fb118]
mov ecx, str.EOF_read_where_not_expected
push 0
push 0
push 0
call fcn.101599e0
add esp, 0xc
mov dword [esp + 0x14], eax
push eax
push esi
push edi
call sym.python310.dll__PyErr_SetObject
mov ecx, dword [esp + 0x20]
add esp, 0xc
test ecx, ecx
je 0x102026f7
add dword [ecx], 0xffffffff
jne 0x102026f7
mov eax, dword [ecx + 4]
push ecx
mov eax, dword [eax + 0x18]
call eax
add esp, 4
mov esi, dword [esp + 0x10]
push esi
push dword [0x103cc55c]
call dword [0x103cc56c]
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ebx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
jmp 0x102026fb

Function at 0x10202740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
lea eax, [esp + 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
add esp, 4
push eax
call sym.python310.dll__Py_fstat_noraise
add esp, 8
test eax, eax
jne 0x102027d6
cmp dword [esp + 0x3c], eax
jg 0x102027d6
mov esi, dword [esp + 0x38]
jl 0x1020277f
cmp esi, 0x7fffffff
jae 0x102027d6
test esi, esi
jle 0x102027d6
cmp esi, 0x40000
jg 0x102027d6
cmp esi, 0x7fffffff
ja 0x102027d6
push esi
push dword [0x103cc55c]
call dword [0x103cc560]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x102027d6
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push eax
push ebx
call sym.python310.dll_PyMarshal_ReadObjectFromString
push ebx
push dword [0x103cc55c]
mov esi, eax
call dword [0x103cc56c]
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call sym.python310.dll_PyMarshal_ReadObjectFromFile
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10205c80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edx + 8]
sub esp, 0x1c
push esi
mov esi, ecx
push edi
cmp eax, 0xffffffff
je 0x10205c95
mov dword [esi + 0x10], eax
mov eax, dword [edx + 0xc]
lea edi, [esi + 0x14]
cmp eax, 0xffffffff
je 0x10205ca2
mov dword [edi], eax
mov eax, dword [edx + 0x24]
cmp eax, 0xffffffff
je 0x10205cad
mov dword [esi + 0x18], eax
cmp dword [edx + 4], 0
je 0x10205d74
mov edx, dword [esi + 4]
lea eax, [ebp - 8]
mov ecx, dword [esi]
push eax
mov dword [0x103bee8c], 1
mov dword [0x103ce9f4], 0
mov dword [0x103cdefc], 0x1036fa7c
mov dword [0x103bedbc], 0
mov dword [ebp - 8], 0xffffffff
call fcn.101f1870
add esp, 4
cmp eax, 0xffffffff
je 0x10205d74
nop dword [eax]
cmp eax, 0x63
je 0x10205d74
cmp eax, 0x6d
je 0x10205d74
cmp eax, 0x45
je 0x10205d50
cmp eax, 0x49
je 0x10205d47
cmp eax, 0x58
jne 0x10205d57
push dword [0x103ce9f4]
lea eax, [esi + 8]
push dword [eax]
push eax
lea eax, [ebp - 0x1c]
push eax
call sym.python310.dll_PyWideStringList_Insert
mov edx, eax
add esp, 0x10
cmp dword [edx], 0
je 0x10205d57
mov eax, dword [ebp + 8]
movups xmm0, xmmword [edx]
movups xmmword [eax], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10], 1
jmp 0x10205d57
mov dword [esi + 0x14], 0
mov edx, dword [esi + 4]
lea eax, [ebp - 8]
mov ecx, dword [esi]
push eax
mov dword [ebp - 8], 0xffffffff
call fcn.101f1870
add esp, 4
cmp eax, 0xffffffff
jne 0x10205d00
mov eax, dword [esi + 0x10]
test eax, eax
jns 0x10205e36
mov dword [esi + 0x10], 0
cmp dword [edi], 0
jge 0x10205d91
mov dword [edi], 0
cmp dword [esi + 0x18], 0
jge 0x10205ddb
lea eax, [esi + 8]
push 0x1038f264
push eax
call sym.python310.dll__Py_get_xoption
add esp, 8
test eax, eax
jne 0x10205dc7
cmp dword [edi], eax
je 0x10205dce
push str.PYTHONDEVMODE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x10205dce
cmp byte [eax], 0
je 0x10205dce
mov dword [esi + 0x18], 1
cmp dword [esi + 0x18], 0
jge 0x10205ddb
mov dword [esi + 0x18], 0
lea eax, [esi + 8]
push str.warn_default_encoding
push eax
call sym.python310.dll__Py_get_xoption
add esp, 8
test eax, eax
jne 0x10205e0b
cmp dword [edi], eax
je 0x10205e12
push str.PYTHONWARNDEFAULTENCODING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x10205e12
cmp byte [eax], 0
je 0x10205e12
mov dword [esi + 0x1c], 1
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov esp, ebp
pop ebp
ret
jle 0x10205d86
lea edi, [esi + 0x14]
jmp 0x10205d8b

Function at 0x102065b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x102065ce
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x102065ce
cmp byte [eax], 0
jne 0x102065d0
xor eax, eax
pop ebp
ret
Function at 0x10206630
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x10206698
push esi
push dword [ebp + 0x10]
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x10206697
cmp byte [esi], 0
je 0x10206697
mov dword [ebp + 8], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0xa
mov dword [eax], 0
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov ecx, dword [ebp + 8]
add esp, 0xc
mov esi, eax
cmp byte [ecx], 0
jne 0x10206689
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x22
je 0x10206689
test esi, esi
jns 0x1020668e
mov esi, 1
mov eax, dword [ebp + 0xc]
cmp dword [eax], esi
jge 0x10206697
mov dword [eax], esi
pop esi
pop ebp
ret
Function at 0x1020bb90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x103b1004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Fatal_Python_error:
mov edi, ecx
mov esi, 0x7f
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, edi
lea ecx, [ebx + 1]
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x1020bbc0
sub ebx, ecx
je 0x1020bcbc
nop
cmp esi, ebx
mov eax, ebx
cmovbe eax, esi
mov esi, eax
xor eax, eax
test esi, esi
je 0x1020bc92
cmp esi, 0x20
jb 0x1020bc80
lea ecx, [edi - 1]
lea edx, [ebp - 0x104]
add ecx, esi
cmp edx, ecx
lea edx, [ebp + esi*2 - 0x106]
ja 0x1020bc0a
cmp edx, edi
jae 0x1020bc80
mov edx, esi
lea ecx, [edi + 0x10]
and edx, 0xffffffe0
movq xmm0, qword [ecx - 0x10]
lea ecx, [ecx + 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ebp + eax*2 - 0x104], xmm0
movq xmm0, qword [ecx - 0x28]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ebp + eax*2 - 0xf4], xmm0
movq xmm0, qword [ecx - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ebp + eax*2 - 0xe4], xmm0
movq xmm0, qword [ecx - 0x18]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ebp + eax*2 - 0xd4], xmm0
add eax, 0x20
cmp eax, edx
jb 0x1020bc12
mov dword [ebp - 0x108], eax
cmp eax, esi
jae 0x1020bc92
nop
movsx cx, byte [eax + edi]
mov word [ebp + eax*2 - 0x104], cx
inc eax
cmp eax, esi
jb 0x1020bc80
add eax, eax
cmp eax, 0x100
jae 0x1020bcd8
xor ecx, ecx
mov word [ebp + eax - 0x104], cx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add edi, esi
sub ebx, esi
jne 0x1020bbd0
push 0x1038fce4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1024a596
mov esp, ebp
pop ebp
ret
call fcn.1024a6c6
int3

Function at 0x1020c630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x1020c644
push dword [ebp + 0x14]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp eax, 1
jne 0x1020c671
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
add esp, 4
mov edx, 1
mov ecx, eax
call fcn.1020c3c0
push str.Py_ExitStatusException___must_not_be_called_on_success
call sym.python310.dll_Py_FatalError
int3

Function at 0x1020efc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 8]
add ecx, 0x114
pop ebp
jmp fcn.1020fcc0
Function at 0x1020f440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x1020f511
mov esi, dword [ebx + 8]
test esi, esi
je 0x1020f51b
mov eax, dword [esi + 8]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [eax + 0x18]
mov dword [esp + 0x24], eax
call sym.python310.dll_PyThread_acquire_lock_timed
mov ecx, dword [ebx]
add esp, 0x10
mov eax, dword [ebx + 4]
test ecx, ecx
je 0x1020f48d
mov dword [ecx + 4], eax
jmp 0x1020f490
mov dword [esi + 4], eax
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x1020f49b
mov eax, dword [ebx]
mov dword [ecx], eax
mov esi, dword [esp + 0x14]
mov esi, dword [esi + 0x18]
test esi, esi
je 0x1020f4d3
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x20], 0
mov eax, dword [esi + 0x1c]
test eax, eax
jle 0x1020f4cc
push 0
push 1
push dword [esi + 0x18]
dec eax
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 8], 0
je 0x1020f50a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x1020f50a
mov eax, dword [esp + 0x10]
push 0
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.tstate_delete_common
call sym.python310.dll__Py_FatalError_TstateNULL
push str.NULL_interpreter
push str.tstate_delete_common
call sym.python310.dll__Py_FatalErrorFunc
int3

Function at 0x1020fdc0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x103fb124]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1020fe06
mov ecx, dword [0x103fb11c]
lea edx, [edi + 1]
call fcn.1020edb0
mov edi, eax
test edi, edi
je 0x1020fe35
mov dword [edi + 0x58], 0
mov ebx, 1
jmp 0x1020fe14
mov eax, dword [0x103fb118]
xor ebx, ebx
cmp edi, eax
setne bl
je 0x1020fe2c
mov ecx, edi
call fcn.101c8d20
mov eax, dword [edi + 8]
mov eax, dword [eax + 8]
add eax, 0x118
mov ecx, dword [eax]
mov ecx, edi
xchg dword [eax], ecx
inc dword [edi + 0x58]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
push str.Couldnt_create_thread_state_for_new_thread
push 0x10390390
call sym.python310.dll__Py_FatalErrorFunc
int3
Function at 0x1020fe50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x103fb124]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1020fead
mov eax, dword [0x103fb118]
cmp edi, eax
jne 0x1020febc
add dword [edi + 0x58], 0xffffffff
jne 0x1020fe9d
push edi
call sym.python310.dll_PyThreadState_Clear
add esp, 4
push edi
call sym.python310.dll__PyThreadState_DeleteCurrent
add esp, 4
pop edi
pop esi
pop ecx
pop ebp
ret
cmp dword [ebp + 8], 1
jne 0x1020fea8
call sym.python310.dll_PyEval_SaveThread
pop edi
pop esi
pop ecx
pop ebp
ret
push str.auto_releasing_thread_state__but_no_thread_state_for_this_thread
push 0x103903ec
call sym.python310.dll__Py_FatalErrorFunc
push edi
push str.thread_state__p_must_be_current_when_releasing
push 0x103903ec
call sym.python310.dll__Py_FatalErrorFormat
int3