joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100283fd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10069089
call fcn.10049974
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x10028426
cmp dword [0x100a1f88], edi
je 0x10028510
push 2
pop ebx
jmp 0x10028440
cmp edi, 1
jne 0x10028510
mov eax, ebx
call fcn.100292ee
test al, al
je 0x10028510
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.10029310
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x100284f2
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x10028487
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
call fcn.10028ae7
test eax, eax
je 0x10028524
push 0x1c049f
push 0
call fcn.10042cf5
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x10070898], 0
push ebx
mov ecx, 0x100a1f98
call fcn.1002827c
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.10028bfe
mov esi, eax
test esi, esi
je 0x10028473
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.10029331
inc edi
cmp edi, 2
jl 0x1002840e
mov eax, esi
call fcn.10049a4c
ret 0x18
push ebx
mov ecx, 0x100a1f98
call fcn.100281e0
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x10028504
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x1002855f
cmp dword [ebp - 0x20], 3
jne 0x1002855a
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x1002855a
and cl, 0xf
cmp cl, 4
je 0x1002855f
push 2
pop esi
jmp 0x10028504
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.10029331
xor eax, eax
jmp 0x1002851c
Function at 0x100289e8
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x100690fa
call fcn.10049974
mov esi, dword [ebp + 8]
cmp esi, dword [0x100a1f90]
jne 0x10028a06
xor al, al
jmp 0x10028adf
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x10028a17
xor ecx, ecx
cmp dword [0x100a1f88], ecx
jmp 0x10028a22
mov eax, esi
call fcn.100292ee
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x100289ff
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.10029310
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x10028aa0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10028a56
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.10028ae7
test eax, eax
je 0x10028ac5
push 0x1c04c2
xor ebx, ebx
push ebx
call fcn.10042cf5
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x100a1f98
mov dword [eax + 0x10070898], ebx
call fcn.1002827c
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.10028bfe
mov ebx, eax
test ebx, ebx
je 0x10028a4a
jmp 0x10028ad2
push dword [ebp + 8]
mov ecx, 0x100a1f98
call fcn.100281e0
lea ecx, [ebp + 0xf]
call fcn.10029331
test ebx, ebx
sete al
call fcn.10049a4c
ret 8

Function at 0x10029242
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
test ecx, ecx
jne 0x10029254
mov ecx, dword [edi]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push 0xffff
push dword [ebp + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [ebp - 4], 2
mov esi, eax
jae 0x10029285
cmp dword [ebp + 0xc], 1
je 0x10029282
cmp dword [ebp + 0xc], 2
jne 0x10029285
push 2
pop esi
mov eax, esi
call fcn.10028ae7
test eax, eax
je 0x100292a9
push 0x1c0491
push 0
call fcn.10042cf5
push edi
mov ecx, 0x100a1f98
call fcn.1002827c
jmp 0x100292e6
test esi, esi
jne 0x100292db
mov ecx, dword [ebp + 0xc]
cmp ecx, 2
je 0x100292ba
cmp ecx, 1
jne 0x100292c9
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x10]
push eax
push ecx
call fcn.100289be
test eax, eax
jne 0x100292db
push 2
pop esi
push edi
mov ecx, 0x100a1f98
call fcn.100281e0
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10029352
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10069150
call fcn.10049974
mov esi, dword [ebp + 8]
cmp esi, dword [0x100a1f90]
jne 0x10029370
xor eax, eax
jmp 0x100294d5
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x10029393
cmp dword [0x100a1f88], ebx
je 0x10029495
push 2
pop edi
jmp 0x100293ad
cmp ebx, 1
jne 0x10029495
mov eax, esi
call fcn.100292ee
test al, al
je 0x10029495
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.10029310
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x10029458
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x100293e1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x1002940d
cmp dword [ebp - 0x1c], 1
je 0x1002940a
cmp dword [ebp - 0x1c], 2
jne 0x1002940d
push 2
pop edi
mov eax, edi
call fcn.10028ae7
test eax, eax
je 0x10029475
push 0x1c0496
xor edi, edi
push edi
call fcn.10042cf5
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x100a1f98
mov dword [eax + 0x10070898], edi
call fcn.1002827c
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.10028bfe
mov edi, eax
test edi, edi
je 0x100293d5
jmp 0x10029486
push dword [ebp - 0x10]
mov ecx, 0x100a1f98
call fcn.100281e0
test edi, edi
je 0x100294a1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.10029331
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x1002937b
jmp 0x100294b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.10029331
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x100294cb
cmp dword [ebp - 0x1c], 2
je 0x100294c3
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x100294d3
push ecx
call fcn.10027a84
jmp 0x100294d1
push esi
call fcn.1002705b
mov ecx, eax
mov eax, ecx
call fcn.10049a4c
ret 4
Function at 0x100314ca
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.10049a7e
mov eax, dword [0x1001c40c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x1c9181
mov dword [ebp - 0x1054], ebx
call fcn.10042c89
add ebx, 0xb0
mov eax, dword [ebx]
push ebx
xor edi, edi
mov dword [ebp - 0x105c], ebx
call dword [eax + 0xc]
push 0x824
lea ecx, [ebp - 0x1050]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
test esi, esi
jne 0x100315f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1003166b
mov ebx, dword [ebp - 0x1054]
add ebx, 0xb0
mov esi, dword [ebx]
push ebx
mov dword [ebp - 0x1058], ebx
call dword [esi + 0x18]
push eax
push ebx
call dword [esi + 0xb8]
mov esi, eax
mov eax, dword [ebx]
push ebx
mov dword [ebp - 0x1060], esi
call dword [eax + 0x18]
push 0x5c
pop ecx
push ecx
push eax
push esi
call fcn.1002450a
mov ebx, eax
test ebx, ebx
je 0x1003166b
xor eax, eax
mov word [ebx], ax
push 0x824
lea eax, [ebp - 0x1050]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
lea eax, [esi - 1]
cmp eax, 0x823
ja 0x100315db
mov eax, ebx
sub eax, dword [ebp - 0x1060]
sar eax, 1
cmp esi, eax
jbe 0x100315bb
push 0x1c9183
call fcn.10042c89
mov eax, 0x825
sub eax, esi
push eax
lea eax, [ebp - 0x1050]
lea eax, [eax + esi*2]
push eax
push ebx
call fcn.10025bd5
push ebx
call fcn.10021fbf
add esi, eax
mov ecx, dword [ebp - 0x1058]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
mov ebx, dword [ebp - 0x105c]
lea eax, [esi - 1]
cmp eax, 0x823
ja 0x1003166b
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.10029d08
test eax, eax
je 0x1003166b
cmp esi, 0x104
ja 0x1003166b
mov edi, dword [ebp - 0x1054]
push esi
lea ecx, [ebp - 0x1050]
add edi, 0xb0
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x28]
test eax, eax
jne 0x1003163e
mov eax, 0x8007000e
jmp 0x1003166d
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x1054]
push eax
push esi
mov ecx, ebx
call fcn.1003081b
mov edi, eax
test edi, edi
js 0x1003166b
mov ecx, ebx
call fcn.1002e7c9
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10048c09
leave
ret 4
Function at 0x1003167e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x105c
call fcn.10049a7e
mov eax, dword [0x1001c40c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x105c], 0
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0xb0]
mov eax, dword [ebx]
push ebx
mov dword [ebp - 0x1058], edi
call dword [eax + 0xc]
add edi, 0xb0
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
push eax
push esi
call fcn.10030f69
test eax, eax
je 0x10031837
push 0x1c9185
call fcn.10042c89
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
push 0x824
lea ecx, [ebp - 0x1050]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
test ebx, ebx
jne 0x100317b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10031837
mov esi, dword [edi]
push edi
call dword [esi + 0x18]
push eax
push edi
call dword [esi + 0xb8]
mov esi, eax
mov eax, dword [edi]
push edi
mov dword [ebp - 0x1054], esi
call dword [eax + 0x18]
push 0x5c
pop ecx
push ecx
push eax
push esi
call fcn.1002450a
mov esi, eax
test esi, esi
je 0x100317af
xor eax, eax
mov word [esi], ax
push 0x824
lea eax, [ebp - 0x1050]
push eax
push dword [ebp - 0x1054]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
push 0x5c
pop eax
mov word [esi], ax
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x100317af
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ecx, eax
mov eax, esi
sub eax, dword [ebp - 0x1054]
sar eax, 1
sub ecx, eax
lea eax, [ebx + ecx]
mov dword [ebp - 0x1054], eax
cmp eax, 0x824
ja 0x100317ad
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1050]
lea eax, [eax + ebx*2]
push esi
push eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 0x1054]
add esp, 0xc
mov ebx, eax
mov eax, dword [edi]
push edi
call dword [eax + 0xbc]
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x10031837
mov esi, dword [ebp - 0x1058]
add esi, 0xb0
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.10029d08
test eax, eax
je 0x10031837
cmp ebx, 0x104
ja 0x10031837
mov eax, dword [edi]
push ebx
lea ecx, [ebp - 0x1050]
push ecx
push edi
call dword [eax + 0x28]
test eax, eax
jne 0x10031806
mov eax, 0x8007000e
jmp 0x1003183d
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
push dword [ebp + 8]
mov esi, eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x1058]
push eax
push esi
mov ecx, ebx
call fcn.1003081b
mov dword [ebp - 0x105c], eax
test eax, eax
js 0x1003183d
mov ecx, ebx
call fcn.1002e7c9
mov eax, dword [ebp - 0x105c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10048c09
leave
ret 4
Function at 0x10032cf7
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push Ordinal_4
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10032d57
test eax, eax
je 0x10032d57
push edi
push edi
push edi
push 2
push edi
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, 0xffffffff
je 0x10032d57
test eax, eax
je 0x10032d57
push edi
push edi
push edi
push 4
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
inc eax
jmp 0x10032d59
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x10039dc1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1001c40c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100a32a0], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x10039dea
mov esi, 0x8ff000ff
jmp 0x10039e2f
test ebx, ebx
je 0x10039e2a
call fcn.1003a991
mov esi, eax
test esi, esi
js 0x10039e2f
push edi
call fcn.1003a956
mov edi, eax
test edi, edi
je 0x10039e2a
test byte [edi + 0x1f], 4
jne 0x10039e21
push edi
call fcn.1003c096
mov esi, eax
test esi, esi
jns 0x10039e21
cmp esi, 0x8007000e
je 0x10039e2f
xor esi, esi
mov eax, dword [ebp + 0xc]
dec eax
je 0x10039e42
dec eax
je 0x10039e5a
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10048c09
leave
ret 0xc
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10039e5a
cmp byte [edi + 0x1e], 0
jbe 0x10039e5a
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x10039e2f
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10039e2a
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push ebx
push eax
call fcn.10039cd1
mov esi, eax
jmp 0x10039e2f
Function at 0x1003b643
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1001c40c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
and dword [ebp - 0x220], 0
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x100a3288
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [edi + 0x1f]
test byte [ebx], 2
jne 0x1003b830
cmp dword [edi + 0x14], 0
je 0x1003b69b
push dword [edi + 0x14]
mov ecx, 0x100a32a4
call fcn.10040161
and dword [edi + 0x14], 0
mov byte [edi + 0x1d], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [edi + 4]
call esi
test eax, eax
je 0x1003b79e
lea eax, [ebp - 0x238]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x10014fd0
push 0
call fcn.1003cea7
mov dword [ebp - 0x218], eax
test eax, eax
js 0x1003b79e
mov eax, dword [ebp - 0x234]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or ecx, eax
push ecx
mov ecx, 0x100a32a4
call fcn.10040137
mov dword [edi + 0x14], eax
test eax, eax
je 0x1003b7b1
xor ebx, ebx
cmp dword [ebp - 0x234], ebx
jbe 0x1003b763
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x238]
push dword [eax + ebx*4]
call fcn.10038591
mov dword [ebp - 0x218], eax
test eax, eax
js 0x1003b753
movzx edx, byte [edi + 0x1d]
mov ecx, dword [edi + 0x14]
mov eax, dword [ebp - 0x21c]
mov dword [ecx + edx*4], eax
inc byte [edi + 0x1d]
jmp 0x1003b75a
cmp eax, 0x8007000e
je 0x1003b784
inc ebx
cmp ebx, dword [ebp - 0x234]
jb 0x1003b71f
cmp byte [edi + 0x1d], 0
lea ebx, [edi + 0x1f]
jne 0x1003b81c
mov eax, dword [ebp - 0x220]
mov byte [edi + 0x1d], al
mov eax, dword [edi + 0x14]
and dword [eax], 0
jmp 0x1003b81c
push dword [edi + 0x14]
mov ecx, 0x100a32a4
call fcn.10040161
and dword [edi + 0x14], 0
mov byte [edi + 0x1d], 0
jmp 0x1003b82f
push 4
mov ecx, 0x100a32a4
call fcn.10040137
mov dword [edi + 0x14], eax
test eax, eax
jne 0x1003b7bd
mov dword [ebp - 0x218], 0x8007000e
jmp 0x1003b82f
mov byte [edi + 0x1d], 1
and dword [eax], 0
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [edi + 4]
call esi
test eax, eax
je 0x1003b81c
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.1003b2a9
test eax, eax
je 0x1003b810
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.1003e9ea
mov ecx, dword [edi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x1003b82f
cmp dword [edi + 8], 0xc00
je 0x1003b828
or byte [ebx], 2
and dword [ebp - 0x218], 0
pop esi
push 0x100a3288
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], 0
pop edi
pop ebx
je 0x1003b852
lea eax, [ebp - 0x238]
push eax
call fcn.1003cf1a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.10048c09
leave
ret 4
Function at 0x1003cb1e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, 0x100a3288
push ebx
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100a32a0], 0
je 0x1003cb48
mov esi, 0x100001
jmp 0x1003cbd4
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x1003cb56
mov esi, 0x8ff00003
jmp 0x1003cbd4
mov eax, dword [ecx]
mov dword [0x100a3248], eax
cmp dword [ecx], 0
push edi
jne 0x1003cbf5
cmp dword [ecx + 4], 0
je 0x1003cbce
mov eax, dword [ecx + 0x10]
mov dword [0x100a32ec], eax
mov eax, dword [ecx + 8]
mov dword [0x10070e10], eax
mov eax, dword [ecx + 0xc]
mov dword [0x10070e14], eax
push dword [ecx + 4]
call fcn.1005398a
mov edx, eax
pop ecx
mov dword [0x100a3244], edx
test edx, edx
jne 0x1003cbe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1003cbce
cmp eax, 3
jbe 0x1003cbc9
cmp eax, 0x1f
je 0x1003cbc9
cmp eax, 0x7e
je 0x1003cbc9
cmp eax, 0xc1
je 0x1003cbc9
cmp eax, 0x3ee
je 0x1003cbc9
cmp eax, 0x485
jne 0x1003cbce
mov esi, 0x8ff00004
call fcn.1003d6e7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
leave
ret 4
mov eax, dword [0x10070e10]
mov edi, dword [0x10070e14]
mov ecx, 0x315
jmp 0x1003cc20
cmp dword [ecx], 1
jne 0x1003cbd3
mov eax, dword [ecx + 0x14]
mov dword [0x100a32ec], eax
mov eax, dword [ecx + 0xc]
mov dword [0x10070e10], eax
mov edi, dword [ecx + 0x10]
mov dword [0x10070e14], edi
mov edx, dword [ecx + 4]
mov dword [0x100a3244], edx
movzx ecx, word [ecx + 8]
test eax, eax
je 0x1003cbce
test edi, edi
je 0x1003cbce
mov edi, dword [0x100a32cc]
lea eax, [ebp - 4]
push eax
movzx eax, cx
push 0xa
push eax
push edx
call fcn.1005399b
mov ecx, eax
mov eax, dword [ebp - 4]
add esp, 0x10
mov dword [0x100a32cc], ecx
cmp eax, 6
jae 0x1003cc5c
mov dword [0x100a32cc], edi
jmp 0x1003cbce
lea edx, [ecx + eax]
mov ax, word [0x100150fc]
mov dword [0x100a32d0], edx
cmp ax, word [ecx]
jne 0x1003cbce
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
add eax, 4
cmp eax, edx
jae 0x1003cc84
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.1003d97b
mov esi, eax
test esi, esi
js 0x1003cbce
call fcn.1003d735
mov esi, eax
test esi, esi
js 0x1003cbce
push 7
xor eax, eax
pop ecx
mov edi, 0x100a324c
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [0x100a32a0], 1
jmp 0x1003cbd3
Function at 0x100418f3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1001c40c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], eax
mov eax, dword [0x10070e50]
push ebx
mov ebx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x10041ace
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov dword [ebp - 0x2a0], edi
test edi, edi
je 0x10041acd
push esi
xor esi, esi
cmp dword [edi], esi
jne 0x10041acc
mov dword [edi], 1
cmp ebx, 0x7e
ja 0x10041aca
mov ebx, dword [edi + ebx*4 + 4]
mov dword [ebp - 0x2a4], ebx
test ebx, ebx
je 0x10041aca
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0x14]
and eax, 3
add esp, 0xc
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x298], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push ebx
mov dword [ebp - 0x294], eax
call fcn.10041bf6
cmp eax, dword [ebx + 0x24]
jg 0x100419ef
mov ecx, dword [ebx + 0x48]
cmp ecx, dword [ebx + 0x44]
jae 0x100419ef
test byte [ebx + 4], 1
jne 0x100419ef
test dword [ebx + 4], 0x400
jne 0x100419ef
test byte [ebp + 0x14], 0x10
jne 0x100419ef
cmp dword [0x100a3354], esi
je 0x100419ef
push esi
lea eax, [ebp - 0x28c]
push eax
push 0x20
push 1
call dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
movzx eax, ax
mov dword [ebp - 0x290], eax
jmp 0x100419f1
mov eax, esi
mov edi, dword [ebp - 0x298]
mov esi, ebx
mov ebx, dword [ebp - 0x29c]
push ebx
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.10041ceb
test byte [esi + 4], 2
jne 0x10041a30
mov esi, dword [esi]
mov eax, dword [ebp - 0x290]
test esi, esi
jne 0x100419ff
mov ebx, dword [ebp - 0x2a4]
test edi, edi
mov edi, dword [ebp - 0x2a0]
jne 0x10041a77
test byte [0x100a3340], 2
je 0x10041a77
push dword [ebp - 0x29c]
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push dword [ebx + 8]
push dword [ebx + 0x38]
push dword [ebx + 0x34]
push 0x10015110
push dword [0x100a334c]
push dword [0x100a3348]
call fcn.10041add
mov esi, dword [ebx + 0xc]
cmp esi, 0xffffffff
je 0x10041ac5
mov esi, dword [edi + esi*4 + 4]
test esi, esi
je 0x10041ac5
mov edi, dword [ebp - 0x298]
mov ebx, dword [ebp - 0x290]
push 0
push ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.10041ceb
test byte [esi + 4], 2
jne 0x10041abf
mov esi, dword [esi]
test esi, esi
jne 0x10041a93
mov edi, dword [ebp - 0x2a0]
and dword [edi], 0
jmp 0x10041acc
mov dword [edi], esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10048c09
leave
ret 0x10