joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c259
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x84]
mov eax, dword [edi]
test eax, eax
mov dword [esi], 0x100adb4
mov dword [esi + 0x34], 0x100a958
je 0x101c27f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
lea edi, [esi + 0x88]
mov eax, dword [edi]
test eax, eax
je 0x101c294
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
pop edi
mov ecx, esi
pop esi
jmp fcn.0101b9d8

Function at 0x101c346
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push esi
xor eax, eax
mov esi, ecx
cmp dword [esi + 0x98], eax
setne cl
push ecx
push 0x100aeb0
push eax
push eax
push eax
push 0x100adc8
push dword [0x102256c]
push 4
call fcn.01020f34
mov ecx, esi
call fcn.0101c307
mov ecx, esi
call fcn.0101befa
mov ecx, esi
pop esi
jmp fcn.0101c0c1

Function at 0x101c440
Capabilities:
Get thread local storage value
Reference absolute stream path on windows
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x101c480
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x101c480
push edi
push 0x1001430
push edi
push edi
push edi
push 0x100aff0
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, ebx
or eax, dword [ebp + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
setne al
push eax
push 0x100afdc
push edi
push edi
push edi
push 0x100aef8
push dword [0x102256c]
push 4
call fcn.01020f34
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x101c4bd
Capabilities:
Get thread local storage value
Reference absolute stream path on windows
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x101c4fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x101c4fd
push edi
push 0x1001430
push edi
push edi
push edi
push 0x100b1c0
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
not eax
and eax, ebx
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
setne al
push eax
push 0x100afdc
push edi
push edi
push edi
push 0x100b0d8
push dword [0x102256c]
push 4
call fcn.01020f34
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x101c59a
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 4]
push edx
push 0x100aee4
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [ecx]
test eax, eax
jl 0x101c5c4
cmp dword [ebp - 4], ebx
je 0x101c5c4
mov al, 1
jmp 0x101c5c6
xor al, al
push eax
push 0x1002cd8
push ebx
push ebx
push ebx
push 0x100b2a8
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4

Function at 0x101c61d
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x4c]
push 4
pop ecx
xor edi, edi
xor ebx, ebx
cmp eax, ecx
je 0x101c64c
cmp eax, 5
jle 0x101c63c
cmp eax, 9
jle 0x101c64c
push edi
push 0x100b620
push edi
push edi
push edi
push 0x100b540
jmp 0x101c6a5
cmp dword [esi + 0x48], edi
je 0x101c697
cmp dword [esi + 0x44], edi
setne al
push eax
push 0x100b518
push edi
push edi
push edi
push 0x100b438
push dword [0x102256c]
push ecx
call fcn.01020f34
mov ecx, dword [esi + 0x48]
push dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp eax, edi
jge 0x101c689
or eax, 0x10000000
mov ebx, eax
jmp 0x101c6b6
push 1
mov ecx, 0x1022010
call fcn.0101c440
jmp 0x101c6b6
push edi
push 0x100430c
push edi
push edi
push edi
push 0x100b358
push dword [0x102256c]
mov ebx, 0xd0000010
push ecx
call fcn.01020f34
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x101c6c3
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp esi, eax
setne cl
push ecx
push 0x100b714
push eax
push eax
push eax
push 0x100b638
push dword [0x102256c]
push 4
call fcn.01020f34
lea eax, [esi - 1]
pop esi
pop ebp
ret 4

Function at 0x101c6fb
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [edi + 0x44]
xor eax, eax
shl esi, 2
cmp dword [esi + ecx], eax
setne cl
push ecx
push 0x100b820
push eax
push eax
push eax
push 0x100b748
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [edi + 0x44]
mov eax, dword [esi + eax]
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], eax
pop esi
pop ebp
ret 8

Function at 0x101c746
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, dword [esi + 0x58]
sete al
push eax
push 0x100b930
xor eax, eax
push eax
push eax
push eax
push 0x100b850
push dword [0x102256c]
push 4
call fcn.01020f34
add esi, 0x5c
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
ret 4
Function at 0x101c788
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 1
sete al
push eax
push 0x10022b4
xor eax, eax
push eax
push eax
push eax
push 0x100b948
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
mov dword [esi + 0x24], eax
mov ax, word [ebp + 0xc]
mov word [esi + 0x28], ax
mov ax, word [ebp + 0x10]
mov word [esi + 0x2a], ax
pop esi
pop ebp
ret 0xc

Function at 0x101c855
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1022568], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x101c8ae
cmp dword [esi + 0xc], 1
mov ebx, 0x10022b4
sete al
push eax
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x100bbc0
push dword [0x102256c]
push 4
call fcn.01020f34
xor eax, eax
cmp edi, eax
setne cl
push ecx
push ebx
push eax
push eax
push eax
push 0x100bb00
push dword [0x102256c]
push 4
call fcn.01020f34
lea ebx, [esi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov ecx, dword [esi + 4]
lea eax, [edi + 0x34]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
inc dword [esi + 8]
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x101c8e4
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
lea eax, [edi + 0x34]
cmp dword [eax], eax
jne 0x101c950
cmp dword [eax + 4], eax
jne 0x101c950
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101c93e
test byte [eax + 0x9c], 4
je 0x101c93e
cmp byte [eax + 0x99], 2
jb 0x101c93e
push edi
push 0x100aed4
push 0xb
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor eax, eax
push eax
push 0x10022b4
push eax
push eax
push eax
push 0x100bd40
jmp 0x101c9b8
cmp dword [esi], esi
je 0x101c971
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
dec dword [esi + 8]
xor esi, esi
inc esi
jmp 0x101c9c7
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101c9a8
test byte [eax + 0x9c], 4
je 0x101c9a8
cmp byte [eax + 0x99], 2
jb 0x101c9a8
push edi
push 0x100aed4
push 0xc
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor eax, eax
push eax
push 0x10022b4
push eax
push eax
push eax
push 0x100bc80
push dword [0x102256c]
xor esi, esi
push 4
call fcn.01020f34
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x101ca7a
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
setne al
mov esi, ecx
mov dword [ebp - 4], edi
push eax
push 0x100bee0
push edi
push edi
push edi
push 0x100be00
push dword [0x102256c]
push 4
call fcn.01020f34
and dword [ebx], edi
lea eax, [esi + 0x10]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
jmp 0x101cad7
mov ecx, dword [ebp + 8]
lea edi, [eax - 0x34]
cmp ecx, dword [edi + 0x78]
jne 0x101cad3
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edi + 0x7c]
je 0x101cadd
mov eax, dword [eax]
xor edi, edi
cmp eax, esi
jne 0x101cac0
jmp 0x101caeb
push dword [ebp + 0x14]
mov eax, dword [edi]
push edi
call dword [eax + 0x54]
mov dword [ebp - 4], eax
mov dword [ebx], edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
pop edi
pop esi
pop ebx
jne 0x101cb39
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101cb78
test byte [eax + 0x9c], 4
je 0x101cb78
cmp byte [eax + 0x99], 3
jb 0x101cb78
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x100aed4
push 0xe
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.0101c53c
jmp 0x101cb78
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101cb78
test byte [eax + 0x9c], 4
je 0x101cb78
cmp byte [eax + 0x99], 3
jb 0x101cb78
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x100aed4
push 0xf
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.0101c568
mov eax, dword [ebp - 4]
leave
ret 0x10

Function at 0x101cb84
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov eax, dword [ecx + 0x4c]
cmp eax, 4
push esi
je 0x101cbac
cmp eax, 5
jle 0x101cb97
cmp eax, 9
jle 0x101cbac
xor esi, esi
push esi
push 0x100b620
push esi
push esi
push esi
push 0x100c190
jmp 0x101cc63
xor esi, esi
cmp dword [ecx + 0x48], esi
je 0x101cc55
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x101cc34
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x101cbd6
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101cc11
test word [eax + 0xbc], 0x200
je 0x101cc11
cmp byte [eax + 0xb9], 2
jb 0x101cc11
push edi
push 0x100aed4
push 0x10
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.01013553
cmp edi, esi
setge al
push eax
push 0x100430c
push esi
push esi
push esi
push 0x100c0c0
push dword [0x102256c]
push 4
call fcn.01020f34
pop edi
pop esi
ret
push 1
mov ecx, 0x1022010
call fcn.0101c4bd
and eax, 0xffffff01
push eax
push 0x100c094
push esi
push esi
push esi
push 0x100bfc8
jmp 0x101cc63
push esi
push 0x100430c
push esi
push esi
push esi
push 0x100bef8
push dword [0x102256c]
push 4
call fcn.01020f34
pop esi
ret
Function at 0x101cc77
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4c], 1
push edi
jne 0x101cd23
lea eax, [esi + 0xc0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
cmp al, 0x16
jne 0x101cd23
mov eax, dword [esi + 0x80]
cmp eax, ebx
mov dword [ebp - 4], eax
setne al
push eax
push 0x10037f4
push ebx
push ebx
push ebx
push 0x100c600
push dword [0x102256c]
push 4
call fcn.01020f34
mov edi, dword [esi + 0x60]
cmp edi, ebx
setne al
push eax
push 0x100370c
push ebx
push ebx
push ebx
push 0x100c518
push dword [0x102256c]
push 4
call fcn.01020f34
mov edi, dword [edi + 0x50]
cmp edi, ebx
setne al
push eax
push 0x100361c
push ebx
push ebx
push ebx
push 0x100c430
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [0x1022574]
mov ecx, dword [eax]
push edi
push dword [ebp - 4]
push eax
call dword [ecx + 0xbc]
push esi
mov ecx, 0x1022074
call fcn.0101c8e4
cmp byte [0x1022568], bl
mov edi, 0x10022b4
je 0x101cd57
cmp eax, ebx
setne al
push eax
push edi
push ebx
push ebx
push ebx
push 0x100c348
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x5c]
mov eax, dword [esi + 0x40]
cmp eax, ebx
jne 0x101cd84
cmp dword [esi + 0x3c], ebx
sete al
push eax
push edi
push ebx
push ebx
push ebx
push 0x100c260
push dword [0x102256c]
push 4
call fcn.01020f34
jmp 0x101cd90
push dword [esi + 0x48]
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x101d080
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
dec eax
push eax
call fcn.01013db7
xor ebx, ebx
cmp dword [eax + 0x10], ebx
sete al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x100c7c8
push dword [0x102256c]
push 4
call fcn.01020f34
mov esi, dword [edi]
sub esi, 2
js 0x101d0ca
push esi
mov ecx, edi
call fcn.01013db7
cmp dword [eax + 0x10], ebx
jne 0x101d0d0
dec esi
jns 0x101d0ba
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, 1
jmp 0x101d0cc
Function at 0x101d90e
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x101d973
cmp dword [esi + 4], 0xffffffff
setne al
push eax
push 0x100da2c
push edi
push edi
push edi
push 0x100d948
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
setne al
push eax
push 0x10022b4
push edi
push edi
push edi
push 0x100d860
push dword [0x102256c]
push 4
call fcn.01020f34
or dword [esi + 4], 0xffffffff
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x101da9a
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
push ebx
lea edx, [ebp - 4]
push edx
push 0x100da44
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
call dword [eax]
test eax, eax
jl 0x101dac1
cmp dword [ebp - 4], ebx
je 0x101dac1
mov al, 1
jmp 0x101dac3
xor al, al
push eax
push 0x1002cd8
push ebx
push ebx
push ebx
push 0x100dc90
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
cmp eax, ebx
sete al
push eax
push 0x100dc48
push 0x85
push 2
push 3
push 0x100db58
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp - 4]
cmp eax, ebx
pop ebx
je 0x101db1e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
leave
ret 4
Function at 0x101dc79
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
mov dword [ebp - 0xc], ebx
call fcn.0101c59a
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push 0x1002d00
push esi
mov dword [ebp - 4], ebx
call dword [eax]
test eax, eax
jl 0x101dcaf
cmp dword [ebp - 4], ebx
je 0x101dcaf
mov al, 1
jmp 0x101dcb1
xor al, al
push edi
push eax
push 0x1002cd8
push ebx
push ebx
push ebx
push 0x100df70
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
push eax
call fcn.0101b940
mov esi, eax
mov eax, dword [ebp - 4]
cmp eax, ebx
lea edi, [esi + 0x4c]
je 0x101dcf4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], ebx
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, edi
call fcn.0101d97e
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0101b99d
cmp dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], eax
je 0x101dd23
push dword [ebp + 0xc]
push dword [ebp - 8]
push eax
call fcn.01016e74
mov dword [ebp - 0xc], eax
mov ecx, edi
call fcn.0101d90e
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
pop edi
je 0x101dd3e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0xc], ebx
pop esi
pop ebx
jne 0x101dd8c
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101dd8c
test word [eax + 0x9c], 0x8000
je 0x101dd8c
cmp byte [eax + 0x99], 4
jb 0x101dd8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
mov eax, dword [0x102200c]
push 0x100d84c
push 0xc
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.010134ae
leave
ret 8

Function at 0x101e051
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x101e06a
test esi, esi
je 0x101e06a
mov al, 1
jmp 0x101e06c
xor al, al
push eax
push 0x10054f0
push 0x34
push 1
push 3
push 0x100e158
push dword [0x102256c]
push 4
call fcn.01020f34
and dword [esi], edi
push 0x14
call fcn.0101fb27
test eax, eax
pop ecx
je 0x101e0a7
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.0101df4b
jmp 0x101e0a9
xor eax, eax
test eax, eax
jne 0x101e0ef
mov ecx, 0x8007000e
mov edi, ecx
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101e0f1
test word [eax + 0x9c], 0x8000
je 0x101e0f1
cmp byte [eax + 0x99], 2
jb 0x101e0f1
push ecx
push 0x100d84c
push 0xa
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
jmp 0x101e0f1
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x101e363
Capabilities:
Read file on windows
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp esi, ebx
setne al
mov dword [ebp - 4], ebx
push eax
push 0x100e714
push ebx
push ebx
push ebx
push 0x100e628
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
push esi
call dword [eax + 0xb0]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
mov eax, dword [esi]
push esi
mov dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
call dword [eax + 0x7c]
cmp eax, 3
sete al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x100e538
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push esi
call dword [eax + 0x9c]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [eax + 8], ecx
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 8]
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101e41e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x101e427
mov dword [ebp - 4], 1
jmp 0x101e47d
cmp eax, ebx
mov edi, eax
jle 0x101e439
and edi, 0xffff
or edi, 0x80070000
mov ecx, dword [0x102200c]
cmp ecx, 0x102200c
je 0x101e475
test dword [ecx + 0x9c], 0x10000
je 0x101e475
cmp byte [ecx + 0x99], 2
jb 0x101e475
push eax
push 0x100e310
push 0x10
push dword [ecx + 0x94]
push dword [ecx + 0x90]
call fcn.01013553
mov eax, dword [esi]
push ebx
push edi
push esi
call dword [eax + 0x10]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x101e48c
Capabilities:
Reference absolute stream path on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp esi, ebx
setne al
mov dword [ebp - 4], ebx
push eax
push 0x100e714
push 0x247
push 1
push 3
push 0x100e820
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
push esi
call dword [eax + 0xac]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
mov eax, dword [esi]
push esi
mov dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
call dword [eax + 0x7c]
cmp eax, 4
sete al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x100e730
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push esi
call dword [eax + 0xa4]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [eax + 8], ecx
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 8]
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101e54d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x101e556
mov dword [ebp - 4], 1
jmp 0x101e5ac
cmp eax, ebx
mov edi, eax
jle 0x101e568
and edi, 0xffff
or edi, 0x80070000
mov ecx, dword [0x102200c]
cmp ecx, 0x102200c
je 0x101e5a4
test dword [ecx + 0x9c], 0x10000
je 0x101e5a4
cmp byte [ecx + 0x99], 2
jb 0x101e5a4
push eax
push 0x100e310
push 0x11
push dword [ecx + 0x94]
push dword [ecx + 0x90]
call fcn.01013553
mov eax, dword [esi]
push ebx
push edi
push esi
call dword [eax + 0x10]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x101e5bb
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp esi, edi
setne al
mov dword [ebp - 4], edi
push eax
push 0x100e714
push 0x28c
push 1
push 3
push 0x100ea00
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
push esi
call dword [eax + 0xac]
mov ebx, eax
mov eax, dword [esi]
push esi
call dword [eax + 0xb0]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], edi
call dword [eax + 0x7c]
cmp eax, 5
sete al
push eax
push 0x10022b4
push edi
push edi
push edi
push 0x100e910
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push esi
call dword [eax + 0x94]
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x101e67b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x101e684
mov dword [ebp - 4], 1
jmp 0x101e6da
cmp eax, edi
mov ebx, eax
jle 0x101e696
and ebx, 0xffff
or ebx, 0x80070000
mov ecx, dword [0x102200c]
cmp ecx, 0x102200c
je 0x101e6d2
test dword [ecx + 0x9c], 0x10000
je 0x101e6d2
cmp byte [ecx + 0x99], 2
jb 0x101e6d2
push eax
push 0x100e310
push 0x12
push dword [ecx + 0x94]
push dword [ecx + 0x90]
call fcn.01013553
mov eax, dword [esi]
push edi
push ebx
push esi
call dword [eax + 0x10]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc