joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x437380
je 0x42711c
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427104
mov esi, dword [ebx + 4]
jmp 0x4270fe
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4270ee
cmp dword [ebp - 0xc], 4
jne 0x4270ee
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x4270e6
or dword [eax + 0x9c], ecx
jmp 0x4270ee
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x4270b2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x427095
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x427509
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x42b28a
call fcn.0041220c
sub esp, 0x11c
mov eax, dword [0x438180]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x427602
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x4275d6
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00402240
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00427509
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004011c0
test bl, bl
jne 0x4275d6
or dword [ebp - 4], 0xffffffff
jmp 0x427547
cmp esi, 0x103
je 0x4275e6
cmp esi, 0x3f2
jne 0x4275f6
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0041092e
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4287b5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4287ea
cmp edi, dword [esi + 0xc]
jge 0x4287ea
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4287ea
cmp edi, dword [eax + 8]
jge 0x4287ea
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4287ec
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4288f0
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x428924
jmp fcn.0041d42d
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x428995
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x428a8e
cmp eax, dword [edi + 0xc]
jge 0x428a8e
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4289e6
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x428a77
cmp dword [ebp + 0xc], ebx
je 0x428a77
jmp 0x428a10
push 0x10
call fcn.00428681
cmp eax, ebx
je 0x4289fc
mov ecx, eax
call fcn.004288e7
mov esi, eax
jmp 0x4289fe
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x428a27
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x428a37
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x428a49
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041d42d
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004126c0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x428a89
cmp ecx, dword [esi + 8]
jge 0x428a89
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x428a8f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x428b4e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x428b7c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x428b9a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00428ab8
jmp 0x428b9a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x428b9a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00428ab8
test edi, edi
mov eax, edi
jne 0x428b84
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x43b024]
test ecx, ecx
je 0x428c4d
jmp 0x428b4d
ret 8
Function at 0x406ccd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x74d290]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x406cd7
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x406d1d
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x406cfc
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x406d3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00436910
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x406dcc
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x406d82
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x406d98
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x406dbf
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x406d71
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x45eb40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x36000]
push edi
jmp 0x45eb5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45eb61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45eb50
mov eax, 1
add ebx, ebx
jne 0x45eb73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45eb68
jne 0x45eb84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45eb68
xor ecx, ecx
sub eax, 3
jb 0x45eb98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45ec0a
mov ebp, eax
add ebx, ebx
jne 0x45eba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45ebb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45ebd4
inc ecx
add ebx, ebx
jne 0x45ebc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45ebb5
jne 0x45ebd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ebb5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45ebf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45ebe5
jmp 0x45eb56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45ebf4
add edi, ecx
jmp 0x45eb56
pop esi
lea edi, [esi + 0x5c000]
mov eax, dword [edi]
or eax, eax
je 0x45ec53
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5e25c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5e2d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45ec11
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5e2d8]
or eax, eax
je 0x45ec4d
mov dword [ebx], eax
add ebx, 4
jmp 0x45ec2e
call dword [esi + 0x5e2d4]
mov ebp, dword [esi + 0x5e2dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45ec87
sub esp, 0xffffff80
jmp 0x42c0f0
Function at 0x10003cc0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x100593bc], 0
push ebx
mov ebx, 1
jne 0x10003cf7
add dword [0x100593b8], ebx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x100593b8], ebx
cmp eax, 0xffffffff
mov dword [0x100592a0], eax
jne 0x10003cef
xor eax, eax
pop ebx
ret
mov dword [0x100593bc], ebx
jmp 0x10003cfc
mov eax, dword [0x100592a0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x10003d55
test edi, edi
jne 0x10003dfe
push 0xc
call fcn.10041469
mov edi, eax
add esp, 4
test edi, edi
je 0x10003dfe
mov eax, dword [0x100503a4]
mov dword [edi], eax
mov ecx, dword [0x100503a8]
mov eax, dword [0x100592a0]
mov dword [edi + 4], ecx
mov edx, dword [0x100503ac]
push edi
push eax
mov dword [edi + 8], edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
pop edi
pop ebx
ret
test edi, edi
je 0x10003dfe
test eax, eax
jge 0x10003dfe
push ebp
mov eax, 0xc
mov ecx, 0x100503a4
mov edx, edi
push esi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10003d8b
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10003d73
test eax, eax
je 0x10003ddc
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10003dd1
sub eax, ebx
add ecx, ebx
add edx, ebx
test eax, eax
je 0x10003ddc
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10003dd1
sub eax, ebx
add ecx, ebx
add edx, ebx
test eax, eax
je 0x10003ddc
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10003dd1
sub eax, ebx
add ecx, ebx
add edx, ebx
test eax, eax
je 0x10003ddc
movzx esi, byte [edx]
movzx ecx, byte [ecx]
sub esi, ecx
je 0x10003ddc
test esi, esi
mov eax, ebx
jg 0x10003dde
or eax, 0xffffffff
jmp 0x10003dde
xor eax, eax
test eax, eax
pop esi
pop ebp
jne 0x10003dfe
push edi
call fcn.100417c0
mov edx, dword [0x100592a0]
add esp, 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor edi, edi
mov eax, edi
pop edi
pop ebx
ret
Function at 0x100075f0
Capabilities:
Reference sql statements

Disassembly:
cmp edi, 2
jge 0x100075fb
mov eax, 0x17
ret
movzx ecx, byte [ebx]
movzx eax, byte [ebx + edi - 1]
movzx eax, byte [eax + 0x10050020]
movzx edx, byte [ecx + 0x10050020]
add edx, edx
lea eax, [eax + eax*2]
add edx, edx
xor eax, edx
xor eax, edi
cdq
mov ecx, 0x7f
idiv ecx
push esi
movzx esi, byte [edx + str._OjZ]
sub esi, 1
js 0x10007664
movzx edx, byte [esi + 0x10052c50]
cmp edx, edi
jne 0x10007658
movzx eax, word [esi*2 + 0x10052cc8]
push edi
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHEREVIRTUAL
push ebx
push eax
call fcn.100029d0
add esp, 0xc
test eax, eax
je 0x1000766b
movzx esi, byte [esi + 0x10052bd8]
sub esi, 1
jns 0x10007631
mov eax, 0x17
pop esi
ret
movzx eax, byte [esi + 0x10052db0]
pop esi
ret

Function at 0x10008e30
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp dword [0x100593bc], 0
push esi
jne 0x10008e63
mov esi, 1
add dword [0x100593b8], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x100593b8], esi
cmp eax, 0xffffffff
mov dword [0x100592a0], eax
je 0x10008e73
mov dword [0x100593bc], esi
jmp 0x10008e68
mov eax, dword [0x100592a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10008e78
mov eax, 0x10050120
pop esi
ret

Function at 0x100099d0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp dword [0x100593bc], 0
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [edi + 4]
jne 0x10009a15
add dword [0x100593b8], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x100592a0], eax
jne 0x10009a02
sub dword [0x100593b8], 1
jmp 0x10009a25
mov ecx, 1
sub dword [0x100593b8], ecx
mov dword [0x100593bc], ecx
jmp 0x10009a1a
mov eax, dword [0x100592a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10009a2a
mov eax, 0x10050120
cmp byte [eax + 4], 0
je 0x10009a6a
mov eax, dword [edi]
test eax, eax
je 0x10009a49
test dword [eax + 8], 0x4000
je 0x10009a49
cmp bl, 2
je 0x10009a49
cmp ebp, 1
jne 0x10009a6a
mov eax, dword [esi + 0x40]
test eax, eax
je 0x10009a6a
cmp dword [eax], edi
je 0x10009a63
cmp dword [eax + 4], ebp
jne 0x10009a63
cmp byte [eax + 8], bl
jne 0x10009a6f
cmp bl, 1
jne 0x10009a6f
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x10009a50
pop esi
xor eax, eax
pop ebp
ret
pop esi
mov eax, 6
pop ebp
ret
Function at 0x1000b1f0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ecx
push esi
push edi
mov dword [esp + 8], 0
call fcn.10003970
test eax, eax
je 0x1000b215
mov eax, dword [esp + 0x10]
push eax
call fcn.1000af90
add esp, 4
mov edi, eax
jmp 0x1000b239
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1000af90
mov esi, eax
add esp, 4
test esi, esi
je 0x1000b23d
push esi
call fcn.1000b150
push esi
mov edi, eax
call fcn.100417c0
add esp, 8
test edi, edi
jne 0x1000b246
pop edi
mov eax, 7
pop esi
pop ecx
ret
push ebx
push ebp
call fcn.10003970
test eax, eax
push edi
je 0x1000b293
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebx
mov esi, eax
test esi, esi
jne 0x1000b2d2
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000b2d2
mov eax, dword [esp + 0x10]
mov edx, eax
add eax, 1
cmp edx, 3
mov dword [esp + 0x10], eax
jge 0x1000b2d2
push 0x64
call ebp
push edi
call ebx
mov esi, eax
test esi, esi
je 0x1000b266
jmp 0x1000b2d2
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call ebx
mov esi, eax
test esi, esi
jne 0x1000b2d2
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000b2d2
mov eax, dword [esp + 0x10]
mov ecx, eax
add eax, 1
cmp ecx, 3
mov dword [esp + 0x10], eax
jge 0x1000b2d2
push 0x64
call ebp
push edi
call ebx
mov esi, eax
test esi, esi
je 0x1000b2a7
push edi
call fcn.100417c0
add esp, 4
mov eax, esi
neg eax
pop ebp
sbb eax, eax
pop ebx
and eax, 0xfffffff6
pop edi
add eax, 0xa
pop esi
pop ecx
ret

Function at 0x1000b2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
call fcn.10003970
test eax, eax
je 0x1000b30c
mov eax, dword [esp + 0xc]
push eax
call fcn.1000af90
add esp, 4
mov esi, eax
jmp 0x1000b330
mov ecx, dword [esp + 0xc]
push ecx
call fcn.1000af90
mov edi, eax
add esp, 4
test edi, edi
je 0x1000b334
push edi
call fcn.1000b150
push edi
mov esi, eax
call fcn.100417c0
add esp, 8
test esi, esi
jne 0x1000b33c
pop edi
mov eax, 7
pop esi
ret
call fcn.10003970
test eax, eax
push esi
je 0x1000b364
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
push esi
mov edi, edx
call fcn.100417c0
add esp, 4
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push esi
mov edi, ecx
call fcn.100417c0
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x1000b390
Capabilities:
Get common file path

Disassembly:
sub esp, 0x3a8
mov eax, dword [0x10058040]
xor eax, esp
mov dword [esp + 0x3a4], eax
mov eax, dword [0x100593cc]
test eax, eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x3b8]
je 0x1000b3d7
push 0x118
push eax
lea eax, [esp + 0x14]
push eax
call fcn.10041ba0
add esp, 0xc
mov byte [esp + 0x124], 0
jmp 0x1000b480
call fcn.10003970
test eax, eax
je 0x1000b422
lea ecx, [esp + 0x144]
push ecx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x144]
call fcn.1000b020
mov esi, eax
test esi, esi
jne 0x1000b45f
pop edi
pop esi
mov eax, 7
pop ebx
mov ecx, dword [esp + 0x3a4]
xor ecx, esp
call fcn.100408e7
add esp, 0x3a8
ret
lea eax, [esp + 0x144]
push eax
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x144]
push ecx
call fcn.1000b0b0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000b405
call fcn.1000b020
push ebx
mov esi, eax
call fcn.100417c0
add esp, 4
test esi, esi
je 0x1000b405
push 0x118
lea edx, [esp + 0x10]
push esi
push edx
call fcn.10041ba0
push esi
mov byte [esp + 0x134], 0
call fcn.100417c0
add esp, 0x10
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000b487
sub eax, edx
test eax, eax
jle 0x1000b4ad
lea ecx, [esp + 0xc]
sub ecx, 1
lea ecx, [ecx]
cmp byte [ecx + eax], 0x5c
jne 0x1000b4ad
sub eax, 1
test eax, eax
jg 0x1000b4a0
mov byte [esp + eax + 0xc], 0
push ebp
lea eax, [esp + 0x10]
push eax
push str._setilqs_
push edi
call fcn.1004086c
mov esi, edi
add esp, 0xc
lea ecx, [esi + 1]
jmp 0x1000b4d0
mov al, byte [esi]
add esi, 1
test al, al
jne 0x1000b4d0
sub esi, ecx
add dword [0x100593b8], 1
mov ebx, 0xf
lea ebp, [edi + esi]
lea ebx, [ebx]
sub ebx, 1
call fcn.10008cc0
mov byte [ebp], al
add ebp, 1
test ebx, ebx
jne 0x1000b4f0
sub dword [0x100593b8], 1
lea ecx, [ebx + 3]
lea esp, [esp]
movzx eax, byte [edi + esi]
xor edx, edx
mov ebx, 0x3e
div ebx
movzx eax, byte [edi + esi + 1]
add esi, 5
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 5], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 4], al
movzx eax, byte [edi + esi - 3]
xor edx, edx
div ebx
movzx eax, byte [edi + esi - 2]
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 3], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 2], al
movzx eax, byte [edi + esi - 1]
xor edx, edx
div ebx
sub ecx, 1
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], dl
jne 0x1000b510
push edi
mov byte [edi + esi], cl
call fcn.1000b2f0
add esp, 4
test eax, eax
jne 0x1000b4b3
mov ecx, dword [esp + 0x3b4]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100408e7
add esp, 0x3a8
ret
Function at 0x1000b5b0
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1000b5bd
xor eax, eax
pop esi
ret
call fcn.10003970
test eax, eax
jne 0x1000b5e2
mov eax, esi
lea edx, [eax + 1]
jmp 0x1000b5d0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000b5d0
sub eax, edx
cmp eax, 0x104
ja 0x1000b5b9
push edi
call fcn.10003970
test eax, eax
push esi
je 0x1000b5f9
call fcn.1000af90
add esp, 4
mov esi, eax
jmp 0x1000b618
call fcn.1000af90
mov edi, eax
add esp, 4
test edi, edi
je 0x1000b61c
push edi
call fcn.1000b150
push edi
mov esi, eax
call fcn.100417c0
add esp, 8
test esi, esi
jne 0x1000b624
pop edi
mov eax, 7
pop esi
ret
push ebx
call fcn.10003970
test eax, eax
push esi
je 0x1000b637
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1000b63d
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov ebx, eax
call fcn.100417c0
add esp, 4
xor eax, eax
cmp ebx, 0xffffffff
je 0x1000b658
and bl, 0x10
cmp bl, 0x10
sete al
pop ebx
pop edi
pop esi
ret

Function at 0x1000c2e0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp dword [0x100593bc], 0
push ebp
mov ebp, dword [edi + 4]
push esi
mov esi, 1
jne 0x1000c317
add dword [0x100593b8], esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub dword [0x100593b8], esi
cmp eax, 0xffffffff
mov dword [0x100592a0], eax
je 0x1000c327
mov dword [0x100593bc], esi
jmp 0x1000c31c
mov eax, dword [0x100592a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1000c32c
mov eax, 0x10050120
cmp byte [eax + 4], 0
je 0x1000c3e4
mov eax, dword [edi]
test eax, eax
je 0x1000c354
test dword [eax + 8], 0x4000
je 0x1000c354
cmp byte [esp + 0xc], 1
jne 0x1000c354
cmp ebx, esi
jne 0x1000c3e4
mov eax, dword [ebp + 0x40]
test eax, eax
je 0x1000c370
jmp 0x1000c360
cmp dword [eax + 4], ebx
jne 0x1000c369
cmp dword [eax], edi
je 0x1000c3d8
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x1000c360
mov esi, dword [0x100593ac]
xor eax, eax
test esi, esi
je 0x1000c384
cmp dword [0x100593b8], eax
jg 0x1000c3be
push 0x10
call fcn.10041469
add esp, 4
test eax, eax
jne 0x1000c3b1
test esi, esi
je 0x1000c39e
cmp dword [0x100593b8], eax
jg 0x1000c3be
mov ecx, 1
add dword [0x100593b8], ecx
mov dword [0x100593ac], ecx
jmp 0x1000c3be
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
test eax, eax
jne 0x1000c3ca
pop esi
mov eax, 7
pop ebp
ret
mov dword [eax + 4], ebx
mov dword [eax], edi
mov ecx, dword [ebp + 0x40]
mov dword [eax + 0xc], ecx
mov dword [ebp + 0x40], eax
mov cl, byte [esp + 0xc]
cmp cl, byte [eax + 8]
jbe 0x1000c3e4
mov byte [eax + 8], cl
pop esi
xor eax, eax
pop ebp
ret