joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100020f6
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x1000210c
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000210c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push dword [ebp - 0x1838]
push esi
push str.CreateDirectoryExA__hs__hs_______x_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x100023ae
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x100023c4
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100023c4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push dword [ebp - 0x3038]
push esi
push str.CreateDirectoryExW__ls__ls_______x_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x1000253b
Capabilities:
Set thread local storage value

Disassembly:
test esi, esi
je 0x10002551
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10002551
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
push str.CreateDirectoryA__hs_______x_n
push 1
call fcn.1001b460
add esp, 0x10
ret

Function at 0x100026d2
Capabilities:
Set thread local storage value

Disassembly:
test esi, esi
je 0x100026e8
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100026e8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
push str.CreateDirectoryW__ls_______x_n
push 1
call fcn.1001b460
add esp, 0x10
ret

Function at 0x10002dde
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x2448], 0
je 0x10002df9
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10002df9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push str.CreateFileA__hs____________p:_x_n
push dword [ebp - 0x246c]
call fcn.1001b460
add esp, 0x14
ret

Function at 0x1000353e
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x2444], 0
je 0x10003559
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10003559
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.CreateFileW__ls____________p:_x_n
push dword [ebp - 0x246c]
call fcn.1001b460
add esp, 0x14
ret

Function at 0x10003976
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x1000398c
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000398c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.OpenFile__hs________p:_x_n
push dword [ebp - 0xc58]
call fcn.1001b460
add esp, 0x14
ret

Function at 0x10003b5c
Capabilities:
Set thread local storage value

Disassembly:
test esi, esi
je 0x10003b72
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10003b72
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push dword [ebp + 0xc]
push edi
push str._lcreat__hs__x______p:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret
Function at 0x10003f13
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0xc3c], 0
je 0x10003f2e
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10003f2e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push dword [ebp + 0xc]
push edi
push str._lopen__hs__x______p:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret

Function at 0x10004127
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x1000413d
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000413d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push esi
push str.GetFileAttributesA__ls______x_n
push dword [ebp - 0xc3c]
call fcn.1001b460
add esp, 0x10
ret

Function at 0x10004340
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x10004356
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10004356
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push esi
push str.GetFileAttributesW__ls______x_n
push dword [ebp - 0x183c]
call fcn.1001b460
add esp, 0x10
ret

Function at 0x10004503
Capabilities:
Set thread local storage value

Disassembly:
test esi, esi
je 0x10004519
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10004519
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
push str.DeleteFileA__hs______x_n
push dword [ebp - 0xc3c]
call fcn.1001b460
add esp, 0x10
ret

Function at 0x100046cc
Capabilities:
Set thread local storage value

Disassembly:
test esi, esi
je 0x100046e2
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100046e2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
push str.DeleteFileW__ls______x_n
push dword [ebp - 0x183c]
call fcn.1001b460
add esp, 0x10
ret

Function at 0x100049cd
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x100049e3
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100049e3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, dword [ebp - 0x184c]
push edi
push ebx
push esi
push str.CopyFileExA__hs__hs__________x:_x_n
push dword [ebp - 0x1850]
call fcn.1001b460
add esp, 0x18
ret

Function at 0x10004ce1
Capabilities:
Set thread local storage value

Disassembly:
test edi, edi
je 0x10004cf7
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10004cf7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, dword [ebp - 0x304c]
push edi
push ebx
push esi
push str.CopyFileExW__ls__ls__________x:_x_n
push dword [ebp - 0x3050]
call fcn.1001b460
add esp, 0x18
ret

Function at 0x10004ff1
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x1834], 0
je 0x1000500c
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000500c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push ebx
push str.MoveFileA__hs__hs______x:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret
Function at 0x10005307
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x3034], 0
je 0x10005322
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10005322
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push ebx
push str.MoveFileW__ls__ls______x:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret

Function at 0x10005618
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x1838], 0
je 0x10005633
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10005633
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push ebx
push str.MoveFileExA__hs__hs_______x:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret

Function at 0x1000592e
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x3038], 0
je 0x10005949
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10005949
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push ebx
push str.MoveFileExW__ls__ls_______x:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret

Function at 0x10005c72
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x1840], 0
je 0x10005c8d
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10005c8d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push ebx
push str.MoveFileWithProgressA__hs__hs_______x:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret

Function at 0x10005fb8
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x3040], 0
je 0x10005fd3
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10005fd3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push ebx
push str.MoveFileWithProgressW__ls__ls_______x:_x_n
push 1
call fcn.1001b460
add esp, 0x18
ret

Function at 0x1000638d
Capabilities:
Set thread local storage value

Disassembly:
test ebx, ebx
je 0x100063a3
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100063a3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ebx, dword [ebp - 0x2450]
push ebx
push dword [ebp - 0x2424]
push esi
push edi
push str.ReplaceFileA__hs__hs__hs_________x:_x_n
push 1
call fcn.1001b460
add esp, 0x1c
ret

Function at 0x10006773
Capabilities:
Set thread local storage value

Disassembly:
test ebx, ebx
je 0x10006789
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10006789
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ebx, dword [ebp - 0x4850]
push ebx
push dword [ebp - 0x4824]
push esi
push edi
push str.ReplaceFileW__ls__ls__ls_________x:_x_n
push 1
call fcn.1001b460
add esp, 0x1c
ret
Function at 0x10006b3b
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0xc34], 0
je 0x10006b56
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10006b56
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebx + 0x2c]
push eax
push esi
push edi
push str.FindFirstFileA__hs___________p:_hs_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x10006f61
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x1e34], 0
je 0x10006f7c
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10006f7c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebx + 0x2c]
push eax
push edi
push esi
push str.FindFirstFileW__ls___________p:_ls_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x100073b3
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0xc40], 0
je 0x100073ce
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100073ce
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebx + 0x2c]
push eax
mov ebx, dword [ebp - 0xc30]
push ebx
push edi
push str.FindFirstFileExA__hs___________p:_hs_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x10007871
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x1e40], 0
je 0x1000788c
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000788c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebx + 0x2c]
push eax
mov ebx, dword [ebp - 0x1e30]
push ebx
push edi
push str.FindFirstFileExW__ls___________p:_ls_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x10007ccc
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x1e38], 0
je 0x10007ce7
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10007ce7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push esi
push edi
push str.FindFirstFileNameW__ls___________p:_ls_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x1000802c
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0xc2c], 0
je 0x10008047
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10008047
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x10008052
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x10008058
mov ecx, dword [ebp - 0xc28]
lea eax, [ebx + 0x2c]
push eax
push edi
push ecx
push str.FindNextFileA__p_______x:_hs_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x1000845b
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x2a30], 0
je 0x10008476
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10008476
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x10008481
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x10008487
mov ecx, dword [ebp - 0x2a2c]
lea eax, [ebx + 0x2c]
push eax
mov eax, 0x1004f6f8
mov edx, dword [ebp - 0x2a3c]
test edx, edx
cmovne eax, edx
push eax
push edi
push ecx
push str.FindNextFileW__p_______x:_ls:_ls_n
push 1
call fcn.1001b460
add esp, 0x18
ret
Function at 0x1000887c
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x2a34], 0
je 0x10008897
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10008897
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x100088a2
mov eax, dword [esi + 4]
test eax, eax
jne 0x100088a8
mov eax, dword [ebp - 0x2a30]
push ebx
push edi
push eax
push str.FindNextFileNameW__p_______x:_ls_n
push 1
call fcn.1001b460
add esp, 0x14
ret

Function at 0x10008d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe28
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, edx
call fcn.1000e800
mov ebx, eax
test ebx, ebx
je 0x10008e7a
mov cx, word [ebx]
lea eax, [ebp - 0x21c]
push 0x208
push 0
push eax
mov word [ebp - 0x10], cx
mov dword [ebp - 0xe], 0x3a
call fcn.1002ea90
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10008e7a
push 0xc00
lea eax, [ebp - 0xe1c]
push 0
push eax
call fcn.1002ea90
add esp, 0xc
lea eax, [ebx + 4]
xorps xmm0, xmm0
movlpd qword [ebp - 0xe24], xmm0
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x1004f8a0
push 0xffffffffffffffff
lea eax, [ebp - 0xe1c]
push 0x600
push eax
call fcn.1000bc90
add esp, 0x18
lea eax, [ebp - 0xe1c]
push eax
lea eax, [ebp - 0xe24]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [esi], 0x18
test edi, edi
jne 0x10008e42
lea eax, [ebp - 0xe24]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea eax, [edi + 1]
mov dword [esi + 0xc], 0x40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0xe24]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, 1
mov dword [esi + 0x14], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret

Function at 0x1000968b
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x245c], 0
je 0x100096a6
mov eax, dword [0x1005aae4]
test eax, eax
js 0x100096a6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x2460]
push dword [eax]
push edi
push esi
push eax
push str.NtCreateFile__p___ls_________x:_p:_x_n
push 1
call fcn.1001b460
add esp, 0x1c
ret
Function at 0x10009c02
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x245c], 0
je 0x10009c1d
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10009c1d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x2460]
push dword [eax]
push edi
push esi
push eax
push str.NtOpenFile__p___ls_________x:_p:_x_n
push dword [ebp - 0x2470]
call fcn.1001b460
add esp, 0x1c
ret

Function at 0x1000a691
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [ebp - 0x48b8]
cmp dword [ebp - 0x48dc], eax
je 0x1000a6a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x48d0], 0
je 0x1000a6c1
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000a6c1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [ebp - 0x48bc]
mov eax, dword [ebp - 0x48e0]
add eax, 4
push eax
push dword [ebp - 0x48c0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push dword [ebp - 0x48b8]
push str.NtSetInformationFile__p___p________x:_d__d:_ls:_ls_n
push dword [ebp - 0x48d8]
call fcn.1001b460
add esp, 0x24
ret

Function at 0x1000ab8e
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0xc54], 0
je 0x1000aba9
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000aba9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebx + 4]
push eax
push dword [ebp - 0xc58]
mov ebx, dword [ebp - 0xc5c]
push ebx
push esi
push edi
push str.NtQueryInformationFile__p___p________x:_x:_ls_n
push dword [ebp - 0xc50]
call fcn.1001b460
add esp, 0x1c
ret

Function at 0x1000bb75
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [ebp - 0x1e34], 0
je 0x1000bb90
mov eax, dword [0x1005aae4]
test eax, eax
js 0x1000bb90
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push ebx
push edi
push str.NtQueryDirectoryFile__p_________wZ________x:_d_n
push dword [ebp - 0x1e88]
call fcn.1001b460
add esp, 0x18
ret
Function at 0x1000e8a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x1005035c]
push esi
mov word [ebp - 8], ax
mov esi, ecx
mov al, byte [0x1005035e]
mov dword [ebp - 0x18], esi
mov byte [ebp - 6], al
call fcn.1000e770
test eax, eax
jne 0x1000ea88
push ebx
push edi
push 0x10
push 0x10050360
push esi
call fcn.100378cd
add esp, 0xc
test eax, eax
je 0x1000e903
push 0xe
push 0x10050374
push esi
call fcn.100378cd
add esp, 0xc
test eax, eax
jne 0x1000ea84
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, eax
mov eax, dword [0x1008f2b0]
and eax, ecx
mov dword [ebp - 0x14], ecx
cmp eax, ecx
je 0x1000e9a1
mov esi, dword [ebp - 0x14]
mov dl, 0x41
mov dword [0x1008f2b0], ecx
mov edi, 0x4204
xor ecx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 0x10], ecx
mov ebx, 0x1008f248
nop word [eax + eax]
mov eax, 1
shl eax, cl
test esi, eax
je 0x1000e987
push 0x104
lea eax, [edi + 0x100895dc]
mov byte [ebp - 8], dl
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov dword [ebx], eax
test eax, eax
je 0x1000e981
nop word [eax + eax]
cmp byte [edi + eax + 0x100895db], 0
jne 0x1000e981
sub eax, 1
mov dword [ebx], eax
jne 0x1000e970
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 9]
inc dl
inc ecx
add edi, 0x104
mov byte [ebp - 9], dl
add ebx, 4
mov dword [ebp - 0x10], ecx
cmp dl, 0x5a
jle 0x1000e940
mov esi, dword [ebp - 0x18]
mov bl, 0x41
movsx ecx, bl
mov eax, 1
add ecx, 0xffffffbf
shl eax, cl
test dword [0x1008f2b0], eax
je 0x1000ea79
cmp dword [ecx*4 + 0x1008f248], 2
jbe 0x1000ea79
imul edx, ecx, 0x104
mov ecx, esi
add edx, 0x1008d7e0
call fcn.1000c610
mov edi, eax
test edi, edi
je 0x1000ea79
mov al, byte [edi]
cmp al, 0x5c
je 0x1000e9f5
test al, al
jne 0x1000ea79
push 4
push 0x1004fd6c
push esi
call fcn.10037070
add esp, 0xc
test eax, eax
je 0x1000ea70
push 4
push 0x1004fd5c
push esi
call fcn.10037070
add esp, 0xc
test eax, eax
je 0x1000ea70
push 4
push 0x1004fd64
push esi
call fcn.10037070
add esp, 0xc
test eax, eax
je 0x1000ea70
mov eax, edi
sub eax, esi
cmp eax, 2
jle 0x1000ea79
mov ecx, edi
mov byte [esi], bl
mov byte [esi + 1], 0x3a
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000ea45
sub ecx, edx
inc ecx
push ecx
lea ecx, [esi + 2]
push edi
push ecx
call fcn.1002e510
add esp, 0xc
mov eax, esi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
mov eax, edi
sub eax, esi
cmp eax, 6
jg 0x1000ea97
inc bl
cmp bl, 0x5a
jle 0x1000e9a3
pop edi
xor eax, eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov byte [esi + 4], bl
mov byte [esi + 5], 0x3a
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000eaa3
sub ecx, edx
inc ecx
push ecx
lea ecx, [esi + 6]
push edi
push ecx
call fcn.1002e510
mov ecx, dword [ebp - 4]
lea eax, [esi + 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop ebx
pop esi
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
Function at 0x10012e30
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa48
mov eax, dword [0x1005a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
mov edx, 0x1008a29c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10012f7d
push 0x10061238
push 0x100612f8
push str._S_S_tscon.bat
lea eax, [ebp - 0xa08]
push 0x600
push eax
call fcn.1001be70
add esp, 0x14
lea eax, [ebp - 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10012fa0
test al, 0x10
jne 0x10012fa0
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa0c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push dword [ebp - 0xa0c]
lea eax, [ebp - 0x408]
push 0x1004fda4
push 0x400
push eax
call fcn.1001be10
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa48], 0x3c
mov dword [ebp - 0xa38], eax
add esp, 0x10
lea eax, [ebp - 0x408]
mov dword [ebp - 0xa44], 0x40
xorps xmm0, xmm0
mov dword [ebp - 0xa34], eax
lea eax, [ebp - 0xa48]
movlpd qword [ebp - 0xa24], xmm0
push eax
movlpd qword [ebp - 0xa1c], xmm0
movlpd qword [ebp - 0xa14], xmm0
mov dword [ebp - 0xa40], 0
mov dword [ebp - 0xa3c], str.runas
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xa2c], 0
mov dword [ebp - 0xa28], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x10012f8d
push 0xffffffffffffffff
push dword [ebp - 0xa10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xa10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret

Function at 0x10016241
Capabilities:
Set thread local storage value

Disassembly:
test ebx, ebx
je 0x10016257
mov eax, dword [0x1005aae4]
test eax, eax
js 0x10016257
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.LoadLibraryExA__hs________p:_x_n
push 1
call fcn.1001b460
add esp, 0x14
test edi, edi
je 0x100162b1
mov ecx, edi
call fcn.1001b740
mov esi, eax
test esi, esi
je 0x100162b1
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [0x10089890]
test eax, eax
je 0x100162b1
push dword [esi + 0x58]
lea eax, [ebp - 0x22c]
push eax
push edi
push str.__08lx:___43.43ls__08x_n
push 0x60
call fcn.10029910
add esp, 0x14
ret