joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e970
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x61c
push 0xffffffffffffffff
push 0x1008231d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100c6034]
xor eax, ebp
mov dword [ebp + 0x618], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x624]
mov dword [esi], 0
call fcn.10030390
test al, al
je 0x1002eb12
lea eax, [ebp + 0x410]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
mov eax, edi
cmp word [edi], cx
je 0x1002e9eb
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1002e9e1
xor edx, edx
lea eax, [ebp + 0x410]
cmp word [ebp + 0x410], dx
je 0x1002ea12
nop dword [eax]
lea eax, [eax + 2]
inc edx
cmp word [eax], 0
jne 0x1002ea00
cmp ecx, edx
jb 0x1002eb12
lea ecx, [ebp + 0x410]
xor edx, edx
call fcn.10028ea0
mov ecx, eax
test ecx, ecx
je 0x1002ea47
nop word [eax + eax]
mov ax, word [edi + edx*2]
cmp ax, word [ebp + edx*2 + 0x410]
jne 0x1002eb12
inc edx
cmp edx, ecx
jb 0x1002ea30
push 0x208
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.1005e790
add esp, 0xc
lea eax, [ebp + 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [ebp]
push 0
push eax
call fcn.1005e790
add esp, 0xc
lea eax, [ebp]
push eax
push 0
push str.shim_clone
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp]
mov ecx, esi
push eax
call fcn.1002ebb0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
movzx ecx, byte [ebp - 0x10]
test eax, eax
push 0
push dword [esi]
mov edx, 1
cmovne ecx, edx
push edi
mov byte [ebp - 0x10], cl
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
sete al
mov byte [esi + 4], al
je 0x1002eaf0
push edi
mov ecx, esi
call fcn.1002ebb0
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x10], 0
je 0x1002eb1e
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
test eax, eax
mov eax, esi
je 0x1002eb20
mov byte [ebp - 0x10], 0
jmp 0x1002eb20
push edi
mov ecx, esi
call fcn.1002ebb0
mov byte [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.1005c4e7
lea esp, [ebp + 0x61c]
pop ebp
ret 4
Function at 0x1002ed00
Capabilities:
Delete file
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082365
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100c6034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], edx
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.1002e970
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
mov ebx, dword [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1002edbe
push eax
lea ecx, [ebp - 0x10]
call fcn.1002ee10
mov esi, dword [ebp - 0x10]
test al, al
jne 0x1002ed71
mov edi, 8
jmp 0x1002edc6
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1002edbe
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x100a5d9c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1002edc6
cmp dword [ebp - 0x20], 0
je 0x1002edc6
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
test ecx, ecx
je 0x1002edb0
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1002edc6
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
jmp 0x1002edc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov byte [ebp - 4], 0
cmp byte [ebp - 0x28], 0
je 0x1002edd7
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call fcn.1005c4f5
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.1005c4f5
add esp, 8
mov dword [ebp - 0x10], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100831ff
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100c6034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.1004aa80
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x10034211
push eax
push esi
call fcn.1004a93e
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.10046f0c
int3

Function at 0x10038ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083ee6
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
push edi
mov eax, dword [0x100c6034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.10029330
mov ecx, eax
test ecx, ecx
je 0x10038fed
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x1c], edi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 2
movups xmm0, xmmword [ebp - 0x28]
mov dword [ebp - 0x50], 0x100a6e30
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 4], 3
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 0x50]
push eax
push 0x10039000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x18], 0x100a4f9c
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], 0x100a4f9c
test esi, esi
je 0x10038fb2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x10038fd8
mov esi, dword [ecx]
lea eax, [ebp - 0x50]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov dword [ebp - 0x2c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.100269b0
int3
Function at 0x1003f590
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085935
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100c6034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push 1
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0
push 0
call dword [sym.imp.NETAPI32.dll_NetLocalGroupGetMembers]
or esi, 0xffffffff
test eax, eax
jne 0x1003f6d0
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
jbe 0x1003f6c7
mov edi, dword [ebp - 0x18]
add edi, 8
mov esi, dword [edi]
call fcn.10029330
test eax, eax
je 0x1003f703
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
push esi
call fcn.1002b120
test al, al
jne 0x1003f669
test esi, esi
jne 0x1003f645
xor eax, eax
jmp 0x1003f65f
mov eax, esi
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1003f650
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.1002b490
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.100403c0
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003f698
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
call fcn.1002b570
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.1003f590
inc ebx
add edi, 0xc
cmp ebx, dword [ebp - 0x14]
jb 0x1003f610
or esi, 0xffffffff
push dword [ebp - 0x18]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1003f6ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.100269b0
int3
Function at 0x10040170
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
mov eax, dword [0x100c6034]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push SysReAllocString
push dword [eax]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x100401df
lea ecx, [esp]
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
push ecx
push eax
movups xmmword [esp + 8], xmm0
movq qword [esp + 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100401df
mov eax, dword [esp + 4]
cmp eax, 4
je 0x100401cc
cmp eax, 2
jne 0x100401df
mov al, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1005c4e7
add esp, 0x20
ret 8
mov ecx, dword [esp + 0x1c]
xor al, al
xor ecx, esp
call fcn.1005c4e7
add esp, 0x20
ret 8
Function at 0x10040de0
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0xcc]
sub esp, 0xcc
push 0xffffffffffffffff
push 0x10085e06
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100c6034]
xor eax, ebp
mov dword [ebp + 0xc8], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10040e61
call fcn.10029330
test eax, eax
je 0x10040f86
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
jmp 0x10040f62
push 0x100a7a20
push dword [edi]
lea eax, [ebp - 0x14]
push eax
call fcn.1006b8cd
add esp, 0xc
test eax, eax
je 0x10040ea4
call fcn.10029330
test eax, eax
je 0x10040f86
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
jmp 0x10040f62
call fcn.10029330
mov ecx, eax
test ecx, ecx
je 0x10040f86
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 4
push dword [ebp - 0x14]
call fcn.1006b914
add esp, 4
test eax, eax
jne 0x10040f1b
push dword [ebp - 0x14]
lea eax, [ebp]
push 0x64
push eax
call fcn.1006ba02
add esp, 0xc
test eax, eax
je 0x10040f1b
lea eax, [ebp]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10040ef0
sub eax, edx
lea ecx, [ebp - 0x10]
sar eax, 1
push eax
lea eax, [ebp]
push eax
call fcn.1002ae70
push dword [ebp - 0x14]
call fcn.1006b914
add esp, 4
test eax, eax
je 0x10040ed4
push dword [ebp - 0x14]
call fcn.1006bb32
add esp, 4
lea ecx, [ebp - 0x10]
call fcn.1002c870
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.1002c320
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10040f62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0xc8]
xor ecx, ebp
call fcn.1005c4e7
lea esp, [ebp + 0xcc]
pop ebp
ret
push 0x80004005
call fcn.100269b0
int3
Function at 0x10040fa0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085e9e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100c6034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], esi
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0
call fcn.10029330
test eax, eax
je 0x10041173
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
lea edx, [ebp - 0x14]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.100405a0
mov esi, dword [ebp - 0x14]
add esp, 8
cmp dword [esi - 0xc], 0
jne 0x10041052
call fcn.10029330
test eax, eax
je 0x10041173
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jmp 0x10041155
lea ecx, [ebp - 0x10]
call fcn.10041310
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x100410b1
call fcn.10029330
test eax, eax
je 0x10041173
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100410ac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10041143
push 0x11
push str.__o_enumsolutions
lea ecx, [ebp - 0x10]
call fcn.1002ae70
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.1002bf90
push 1
push 0x100a5d9c
mov ecx, edi
call fcn.1002ae70
push 0xe
push str.Solutions.list
mov ecx, edi
call fcn.1002ae70
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100410fe
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x10]
push ecx
push dword [edi]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.1003ef20
add esp, 0xc
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1002c320
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041143
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x1004115f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100269b0
int3
Function at 0x100417b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100860ee
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100c6034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 0
call fcn.10041900
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.1002ae70
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004189a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.1002c320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push 1
push 0x100a7a54
call fcn.1002b490
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.1002ae70
push 1
push 0x100a7a54
lea ecx, [ebp - 0x10]
call fcn.1002ae70
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041871
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.1002c320
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jmp 0x100418d2
call fcn.10029330
mov ecx, eax
test ecx, ecx
je 0x100418ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100418dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100269b0
int3
Function at 0x10041900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086156
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100c6034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push 0
push 0
push 0
push 0x2b
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.10029330
test eax, eax
je 0x100419f1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 0
call fcn.1002b120
test al, al
jne 0x1004197e
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.1002b490
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jne 0x100419b0
call fcn.10029330
test eax, eax
je 0x100419f1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], 1
jmp 0x100419bf
push esi
mov ecx, edi
call fcn.1002b570
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100419de
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100269b0
int3

Function at 0x10071fd4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009be48
push 0x1009be40
push str.FlsAlloc
push 0x1e
call fcn.10071e3e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10072008
push dword [ebp + 8]
mov ecx, esi
call dword [0x10097308]
call esi
jmp 0x1007200e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10072052
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009be58
push 0x1009be50
push str.FlsGetValue
push 0x20
call fcn.10071e3e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10072089
push dword [ebp + 8]
mov ecx, esi
call dword [0x10097308]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10077251
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100772ee
push ebx
push esi
call fcn.1007721a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10075e9b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1007729b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100772ed
push edi
push eax
call fcn.1007034c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100772bb
call fcn.1006e3d8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100772ec
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10075e9b
add esp, 0x20
test eax, eax
jne 0x100772da
push edi
call fcn.1006e3d8
jmp 0x100772e2
push ebx
call fcn.1006e3d8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100772f1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10077302
pop esi
ret
push ebx
push edi
push esi
call fcn.1007721a
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1007034c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1007732a
push ebx
push esi
push edi
call fcn.1005e210
add esp, 0xc
push 0
call fcn.1006e3d8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100776ee
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007733f

Function at 0x1007bd02
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007b9a4

Function at 0x1007bd0d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007bb33
Function at 0x1007ed08
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100d1a90]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1007ed48
cmp byte [ebx], 0xa
jne 0x1007ed48
or byte [eax + edi + 0x28], 4
jmp 0x1007ed4d
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1007ee4b
mov al, byte [edx]
cmp al, 0x1a
je 0x1007ee2d
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1007ed7c
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1007eda1
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1007edab
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1007ed5e
jmp 0x1007ee4b
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007ee28
cmp dword [ebp - 0xc], 0
je 0x1007ee28
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x100d1a90]
test byte [eax + edi + 0x28], 0x48
je 0x1007ee02
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1007eded
mov byte [esi], dl
jmp 0x1007edfe
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100d1a90]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1007ee4b
cmp byte [ebp - 1], 0xa
jne 0x1007ee11
cmp esi, ebx
jne 0x1007ee11
mov byte [esi], 0xa
jmp 0x1007ee4a
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1007eca4
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1007ee4b
mov byte [esi], 0xd
jmp 0x1007ee4a
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x100d1a90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1007ee47
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1007ee4b
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret