joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf05173f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push 0x110
call fcn.0f005706
mov edi, eax
pop ecx
mov dword [ebp - 4], edi
test edi, edi
je 0xf051843
push esi
push edi
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0xf051839
cmp eax, esi
jae 0xf051839
push 0x111
call fcn.0f005706
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0xf051839
push ebx
push eax
push 0
mov ebx, 0xf0046d8
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call edi
test eax, eax
jne 0xf0517dd
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0xf0517bd
cmp eax, esi
jb 0xf0517d2
push 0xf002f38
push 0x110
push dword [ebp - 4]
call fcn.0f00a32c
add esp, 0xc
push dword [ebp - 8]
push 0
push ebx
push dword [ebp - 4]
call edi
mov edi, dword [ebp - 8]
and dword [ebp - 0x10], 0
push 0
push 0x100
push 4
lea eax, [ebp - 0x14]
push eax
push 3
xor esi, esi
push 0xc0000000
inc esi
push edi
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop ebx
cmp eax, 0xffffffff
jne 0xf051823
push edi
call fcn.0f00996a
push dword [ebp - 4]
call fcn.0f00996a
pop ecx
jmp 0xf05183f
mov ecx, dword [ebp + 8]
push dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
call fcn.0f00996a
mov eax, esi
jmp 0xf051841
push edi
call fcn.0f00996a
xor eax, eax
pop ecx
pop esi
pop edi
leave
ret 8

Function at 0xf051a5e
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [0xf0899b8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp esi, ebx
je 0xf051b08
mov ecx, dword [ebp + 8]
cmp dword [esi + 4], ecx
je 0xf051a8c
mov esi, dword [esi]
cmp esi, ebx
jne 0xf051a7e
cmp esi, ebx
je 0xf051b08
mov eax, dword [esi + 0x20]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
cmp eax, ebx
jne 0xf051b1b
push 1
lea eax, [ebp - 4]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp + 0xc], eax
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x20]
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 0xc], eax
jne 0xf051adf
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0xf051adf
mov dword [esi + 0x24], 1
jmp 0xf051ae2
xor ebx, ebx
inc ebx
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0xf051b1b
push 0x37
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
and dword [esi + 0x24], 0
jmp 0xf051b11
mov edi, dword [ebp + 0xc]
mov dword [edi], 1
xor eax, eax
cmp ebx, eax
jne 0xf051b1b
cmp dword [edi], eax
je 0xf051b1e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xf051b9f
Capabilities:
Create thread
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0f05173f
test eax, eax
je 0xf051cef
push ebx
mov ebx, dword [ebp - 8]
push edi
xor edi, edi
push edi
push 0x100
push 3
push edi
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0xf051c00
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call fcn.0f00996a
pop ecx
xor eax, eax
jmp 0xf051ced
push esi
push 0x218
call fcn.0f005706
mov esi, eax
pop ecx
cmp esi, edi
jne 0xf051c34
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call fcn.0f00996a
jmp 0xf051cd5
push edi
push edi
lea eax, [esi + 0x18]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 8]
push edi
push edi
mov dword [esi + 0x10], 0x200
mov dword [esi], eax
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
cmp eax, edi
jne 0xf051c6a
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 8]
jmp 0xf051cbf
cmp word [ebp + 0xc], 1
mov edi, dword [ebp + 8]
jne 0xf051c85
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x24], esi
mov dword [edi + 0x10], eax
jmp 0xf051c93
mov eax, dword [edi]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x28], esi
mov dword [edi + 0xc], eax
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push esi
push 0xf0518f4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0xf051cda
push dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call fcn.0f00996a
push esi
call fcn.0f00996a
pop ecx
pop ecx
xor eax, eax
jmp 0xf051cec
cmp word [ebp + 0xc], 1
jne 0xf051ce6
mov dword [edi + 0x18], eax
jmp 0xf051ce9
mov dword [edi + 0x1c], eax
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0xf051cf8
Capabilities:
Create thread
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0f05173f
test eax, eax
je 0xf051e61
push ebx
mov ebx, dword [ebp - 8]
push edi
xor edi, edi
push edi
push 0x100
push 3
push edi
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0xf051d59
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call fcn.0f00996a
pop ecx
xor eax, eax
jmp 0xf051e5f
push esi
push 0x244
call fcn.0f005706
mov esi, eax
pop ecx
cmp esi, edi
jne 0xf051d8d
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call fcn.0f00996a
jmp 0xf051e3d
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
jne 0xf051dbb
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 8]
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call fcn.0f00996a
push esi
jmp 0xf051e37
lea ecx, [esi + 0x44]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 8]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], 0x200
mov dword [esi + 0x20], edi
mov dword [esi + 4], ecx
mov eax, dword [eax + 8]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x2c]
push eax
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0xf0519be
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
cmp eax, edi
jne 0xf051e42
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x10]
call edi
push dword [ebp - 4]
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.0f00996a
push ebx
call fcn.0f00996a
pop ecx
pop ecx
xor eax, eax
jmp 0xf051e5e
mov eax, dword [0xf0899b8]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [0xf0899b8], esi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x20], esi
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0xf051fb8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], esi
cmp dword [0xf0899bc], esi
je 0xf051fdd
xor eax, eax
inc eax
jmp 0xf052035
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0xf0046e4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf052016
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf0046dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 4], esi
je 0xf052024
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
jne 0xf052033
mov dword [0xf0899bc], eax
jmp 0xf052035
xor eax, eax
pop esi
leave
ret

Function at 0xf052293
Capabilities:
Set current directory
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov bl, byte [esi + 0x9a]
add bl, 0x41
cmp word [esi + 0x96], 0
push edi
mov dword [ebp - 4], 0x3a3f3d
je 0xf0522d2
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [esi + 0x28]
lea eax, [ebp - 4]
push eax
mov byte [ebp - 3], bl
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edi, dword [ebp + 8]
test edi, edi
je 0xf05232e
mov esi, dword [esi + 0x30]
add esi, edi
jmp 0xf052328
lea ecx, [edi + 2]
cmp ecx, esi
jae 0xf05232e
cmp al, 0x3d
jne 0xf05231b
movsx eax, byte [edi + 1]
push eax
call fcn.0f05eeb5
pop ecx
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0xf05231b
cmp byte [edi + 2], 0x3a
jne 0xf05231b
cmp al, bl
je 0xf05231b
mov byte [ebp - 3], al
lea eax, [edi + 4]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push edi
call fcn.0f05ef00
pop ecx
inc eax
pop ecx
mov edi, eax
mov al, byte [edi]
test al, al
jne 0xf0522e0
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0xf0523bf
Capabilities:
Resume thread

Disassembly:
cmp dword [0xf0899c0], 0
jne 0xf0523d7
mov dword [0xf0899c0], 1
jmp fcn.0f031155
ret
Function at 0xf0523fa
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, 0x104
push edi
mov dword [ebp - 8], 0x3a3f3d
mov dword [ebp - 0xc], 0x5c3a3f
call fcn.0f005706
xor ebx, ebx
mov esi, eax
pop ecx
mov dword [0xf0899a8], eax
mov dword [0xf0899ac], ebx
cmp esi, ebx
je 0xf0525bd
mov al, byte [ebp + 8]
add al, 0x41
push edi
mov byte [ebp - 7], al
push esi
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
mov dword [0xf0899ac], ecx
cmp ecx, ebx
je 0xf0525a5
cmp ecx, edi
ja 0xf0525a5
inc ecx
mov ebx, edi
sub ebx, ecx
mov dword [0xf0899ac], ecx
add esi, ecx
mov al, byte [ebp - 4]
cmp al, byte [ebp + 8]
je 0xf05251c
push dword [ebp - 4]
call sym.ntvdm.exe_demGetPhysicalDriveType
movzx eax, al
test eax, eax
jne 0xf0524a2
mov al, byte [ebp - 4]
add al, 0x41
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push eax
call fcn.0f056349
test eax, eax
je 0xf052516
cmp eax, 1
je 0xf052516
mov al, byte [ebp - 4]
add al, 0x41
push ebx
mov byte [ebp - 7], al
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebx
jbe 0xf0524fd
mov eax, dword [0xf0899ac]
lea eax, [eax + ebx + 0x104]
push eax
push dword [0xf0899a8]
call fcn.0f00ca76
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0xf052582
mov dword [0xf0899a8], esi
add esi, dword [0xf0899ac]
add ebx, edi
push ebx
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0xf052516
mov ecx, dword [0xf0899ac]
inc eax
add esi, eax
sub ebx, eax
add ecx, eax
mov dword [0xf0899ac], ecx
jmp 0xf05251c
mov ecx, dword [0xf0899ac]
inc byte [ebp - 4]
cmp byte [ebp - 4], 0x1a
jb 0xf052472
mov esi, dword [0xf0899a8]
inc ecx
push ecx
push esi
call fcn.0f00ca76
xor edi, edi
pop ecx
pop ecx
mov dword [0xf0899a8], eax
cmp eax, edi
je 0xf05259d
mov ecx, dword [0xf0899ac]
cmp ecx, edi
je 0xf05259d
mov byte [ecx + eax], 0
push dword [0xf0899a8]
inc dword [0xf0899ac]
push dword [0xf0899ac]
call sub.KERNEL32.dll_SetVDMCurrentDirectories
push dword [0xf0899a8]
call fcn.0f00996a
mov dword [0xf0899a8], edi
mov dword [0xf0899ac], edi
jmp 0xf0525bc
push dword [0xf0899a8]
call fcn.0f00996a
and dword [0xf0899a8], 0
and dword [0xf0899ac], 0
jmp 0xf0525bc
push esi
call fcn.0f00996a
jmp 0xf05257a
push dword [0xf0899a8]
call fcn.0f00996a
mov dword [0xf0899a8], ebx
mov dword [0xf0899ac], ebx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xf053a25
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
lea ecx, [ebp - 0x24]
push ecx
push eax
xor ebx, ebx
push ebx
push 0xf004894
push 0x80000002
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], 0xc
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf053b26
push edi
push 0x5c
push esi
call fcn.0f05f120
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
jne 0xf053a87
mov edi, esi
jmp 0xf053a88
inc edi
push 0x2e
push edi
call fcn.0f05ef00
pop ecx
pop ecx
cmp eax, ebx
jne 0xf053aa9
push 9
push edi
lea eax, [ebp - 0x10]
push 9
push eax
call fcn.0f00b4ab
mov byte [ebp - 8], bl
jmp 0xf053ac8
sub eax, edi
movzx eax, ax
cmp ax, 8
jg 0xf053b25
movsx esi, ax
push esi
push edi
lea eax, [ebp - 0x10]
push 9
push eax
call fcn.0f00b4ab
mov byte [ebp + esi - 0x10], bl
mov eax, dword [ebp - 0x34]
add esp, 0x10
mov byte [ebp + eax - 0x20], bl
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf053b25
cmp dword [ebp - 0x2c], 1
jne 0xf053b25
lea eax, [ebp - 0x20]
push eax
call fcn.0f05fdd0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push 0xf00488c
push eax
call fcn.0f05f263
add esp, 0x10
cmp eax, 1
jne 0xf053b25
test dword [ebp - 0x28], 0x8000000
je 0xf053b25
mov dword [ebp - 0x30], ebx
pop edi
cmp dword [ebp - 0x24], ebx
pop esi
pop ebx
je 0xf053b36
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0f0057d5
leave
ret 4
Function at 0xf0540e5
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0xf0ae3a0], eax
mov eax, dword [ebp + 0xc]
mov dword [0xf0ae3a8], eax
mov eax, dword [0xf082d9c]
push ebx
push esi
movzx ecx, ax
push edi
mov esi, 0xffff0000
inc ecx
and eax, esi
or ecx, eax
xor edi, edi
push edi
mov dword [0xf082d9c], ecx
call fcn.0f037406
mov eax, dword [0xf0ae38c]
mov dword [0xf0ae3ac], eax
mov dword [0xf089990], 1
call sym.ntvdm.exe_getSS
movzx ebx, ax
shl ebx, 4
call sym.ntvdm.exe_getBP
movzx eax, ax
lea ecx, [ebp + 8]
push ecx
push edi
add eax, ebx
push eax
push 0xf053e37
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0xf05416b
push edi
call sym.ntvdm.exe_setCF
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xf0541be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xa0
push edi
mov ebx, 0xf0ae280
push ebx
call fcn.0f0060e0
add esp, 0xc
mov eax, 0xc0
push ebx
mov word [0xf0ae318], ax
call sub.KERNEL32.dll_GetNextVDMCommand
cmp word [0xf0ae310], di
jbe 0xf0541b1
xor edi, edi
inc edi
push edi
call sym.ntvdm.exe_setCF
mov dword [0xf089988], edi
jmp 0xf0541da
push edi
call sym.ntvdm.exe_setCF
movzx eax, byte [0xf0ae39c]
push eax
call sym.ntvdm.exe_setAL
call fcn.0f037693
push dword [0xf0ae3ac]
call fcn.0f02a9b9
mov dword [0xf089990], edi
mov eax, dword [0xf082d9c]
movzx ecx, ax
and eax, esi
pop edi
dec ecx
or ecx, eax
pop esi
mov dword [0xf082d9c], ecx
pop ebx
pop ebp
ret 8
Function at 0xf054cc4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword fs:[0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x14]
add ebx, 0xbf8
cmp dword [0xf0899cc], 0
push edi
mov dword [ebp - 0x11c], eax
jne 0xf054d0c
call fcn.0f055498
mov eax, dword [0xf0899d0]
test eax, eax
je 0xf054d26
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push esi
call eax
mov esi, eax
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitString]
lea eax, [ebp - 0x110]
push eax
call esi
mov edi, dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
push 0
lea eax, [ebp - 0x110]
push eax
push ebx
call edi
test eax, eax
jge 0xf054d6f
cmp eax, 0x80000005
jne 0xf054d5a
push 0xce
jmp 0xf054d62
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf054ea2
push dword [ebp - 0x128]
lea eax, [ebp - 0x110]
push eax
call esi
push 1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x124]
push eax
call edi
xor edi, edi
cmp eax, edi
jl 0xf054d5a
mov eax, 0x208
mov ecx, eax
mov word [ebp - 0x116], cx
mov ecx, dword fs:[0x18]
push eax
mov eax, dword [ecx + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x114], eax
cmp eax, edi
jne 0xf054dda
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
jmp 0xf054d68
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x120]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
cmp ebx, edi
je 0xf054e4b
push dword [ebp - 0x114]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x10c], eax
mov esi, 0x104
mov eax, esi
mov word [ebp - 0x10e], ax
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
cmp eax, edi
jge 0xf054e50
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0xf054e50
mov esi, 0x104
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
push dword [ebp - 0x114]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp ebx, edi
je 0xf054ea0
cmp ebx, esi
jae 0xf054ea0
cmp dword [0xf0899cc], edi
jne 0xf054e8b
call fcn.0f055498
mov eax, dword [0xf0899d4]
cmp eax, edi
je 0xf054ea0
push esi
push ebx
push dword [ebp - 0x11c]
call eax
mov ebx, eax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 0x10
Function at 0xf054eb8
Capabilities:
Query environment variable

Disassembly:
push 0x2c
push 0xf06e278
call fcn.0f005d34
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
cmp eax, esi
jge 0xf054f2c
cmp eax, 0x80000005
jne 0xf054f04
push 0xce
jmp 0xf054f0c
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0xf072008
call fcn.0f009440
add esp, 0xc
xor eax, eax
jmp 0xf05500c
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
cmp eax, esi
jge 0xf054f53
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0xf054ffd
mov edi, dword [ebp + 0x10]
mov word [ebp - 0x2a], di
mov eax, dword fs:[0x18]
movzx ecx, di
push ecx
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x28], eax
cmp eax, esi
jne 0xf054f7f
push 0xc0000017
jmp 0xf054f41
movzx ecx, word [ebp - 0x2a]
push ecx
push eax
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0xf054ffd
cmp eax, edi
jae 0xf054ffd
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov dword [ebp - 0x20], esi
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
cmp eax, esi
jge 0xf054fcf
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov word [ebp - 0x32], di
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
cmp eax, esi
jge 0xf054ffd
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.0f055016
mov eax, dword [ebp - 0x1c]
call fcn.0f005d79
ret 0xc
Function at 0xf055058
Capabilities:
Set environment variable

Disassembly:
push 0x2c
push 0xf06e298
call fcn.0f005d34
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
mov esi, dword [sym.imp.ntdll.dll_RtlInitString]
call esi
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
mov edi, dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
call edi
cmp eax, ebx
jge 0xf0550d0
cmp eax, 0x80000005
jne 0xf0550a8
push 0xce
jmp 0xf0550b0
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0xf072008
call fcn.0f009440
add esp, 0xc
xor eax, eax
jmp 0xf055155
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ebx, dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
call ebx
test eax, eax
jge 0xf0550f6
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0xf055146
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
and dword [ebp - 0x20], 0
cmp dword [ebp + 0xc], 0
je 0xf055137
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
call esi
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
jl 0xf05509a
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
jl 0xf0550e6
push dword [ebp - 0x30]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0f05515d
mov eax, dword [ebp - 0x1c]
call fcn.0f005d79
ret 8