joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a3680
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172bd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x10
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 0
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 2
call fcn.1004a4d0
sub esp, 0x18
mov byte [ebp - 4], 4
lea eax, [ebx + 0x1c]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.1004bb60
sub esp, 0x18
mov ecx, esp
mov dword [ecx], 0
push 4
push str.open
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 5
call fcn.1004a4d0
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
push 0
sub esp, 0x14
mov byte [ebp - 4], 0
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
call fcn.100acdc0
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100a3799
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a378f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a37ac
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3

Function at 0x100a3880
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172c38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 8
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 0
call fcn.1004a4d0
sub esp, 0x18
mov byte [ebp - 4], 2
lea eax, [ebx + 0x1c]
mov ecx, esp
push eax
call fcn.1004bb60
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
push 0
sub esp, 0x14
mov byte [ebp - 4], 0
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
call fcn.100ad210
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100a3941
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a3937
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a3954
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3
Function at 0x100a4560
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebx + 0x1c]
mov ecx, esp
push eax
call fcn.1004bb60
push 0x6429ed8
lea ecx, [ebp - 0x28]
call fcn.100d2140
push 0
sub esp, 0xc
mov dword [ebp - 0x1c], 1
mov ecx, esp
mov dword [ebp - 0x18], 0x6429ed8
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x1c]
push ecx
push eax
push edx
call fcn.1004ac80
push 0x56a0c0
lea ecx, [ebp - 0x28]
call fcn.100d2300
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
sub esp, 0x14
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0x28]
call fcn.100d2af0
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.1004b8d0
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100a464f
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a4645
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a4662
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3

Function at 0x100a5e40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172f55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov edi, ecx
call fcn.101387b7
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], edi
mov dword [eax + 4], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b4570
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a5ec6
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a5ec1
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3

Function at 0x100a5fb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172f85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 8
mov esi, ecx
movss dword [ebp - 0x10], xmm1
call fcn.101387b7
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [eax], esi
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b45c0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100a6037
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100a6032
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1013ff0f
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
int3
Function at 0x100a6050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172fb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 4
mov esi, ecx
call fcn.101387b7
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [eax], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b4700
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a60cc
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a60c7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3

Function at 0x100a7910
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172f55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov edi, ecx
call fcn.101387b7
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], edi
mov dword [eax + 4], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b49a0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a7996
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a7991
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3

Function at 0x100a7e90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101731c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push 4
call fcn.101387b7
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b4a40
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a7f0d
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a7f08
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3

Function at 0x100a8350
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172f55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov edi, ecx
call fcn.101387b7
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], edi
mov dword [eax + 4], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b4ae0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a83d6
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a83d1
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3
Function at 0x100a8590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172f55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov edi, ecx
call fcn.101387b7
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], edi
mov dword [eax + 4], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b4b80
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a8616
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a8611
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3

Function at 0x100a87d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172fb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 4
mov esi, ecx
call fcn.101387b7
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [eax], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b4c20
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a884c
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a8847
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3

Function at 0x100a8920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10172fb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 4
mov esi, ecx
call fcn.101387b7
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [eax], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100b4c70
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100a899c
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1009c440
cmp dword [ebp - 0x14], 0
jne 0x100a8997
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1013ff0f
push 6
mov dword [ebp - 0x14], 0
call fcn.1013646a
int3
Function at 0x100a8f90
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101732d0
push eax
mov dword fs:[0], esp
mov eax, 0x1030
push ebx
call fcn.10139af0
push esi
push edi
mov dword [ebp - 4], 0
lea esi, [ebx + 0x1c]
cmp dword [ebx + 0x30], 0x10
mov dword [ebp - 0x2c], 0
cmovae esi, dword [ebx + 0x1c]
push 0xa
push str._s__c___s_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 2
call fcn.1004a4d0
sub esp, 0x18
lea eax, [ebp - 0x1040]
mov edi, esp
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x30], edi
push 0x1000
push 0
push eax
call fcn.1013a920
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push esi
push eax
lea eax, [ebp - 0x1040]
push eax
call fcn.1004ef00
add esp, 0xc
mov dword [edi], 0
lea ecx, [ebp - 0x1040]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov byte [ebp - 4], 4
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a9093
sub ecx, edx
lea eax, [ebp - 0x1040]
push ecx
push eax
mov ecx, edi
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x30], esp
mov dword [ecx], 0
push 8
push 0x10747454
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 6
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ecx], 0
push 4
push str.open
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 8
call fcn.1004a4d0
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
push 0
sub esp, 0x14
mov byte [ebp - 4], 2
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
call fcn.100acdc0
mov edx, dword [ebp - 0x18]
mov byte [ebp - 0x11], al
cmp edx, 0x10
jb 0x100a9150
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9146
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a91aa
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x100a9192
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9188
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a91aa
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3
Function at 0x100a93b0
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101732d0
push eax
mov dword fs:[0], esp
mov eax, 0x1030
push ebx
call fcn.10139af0
push esi
push edi
mov dword [ebp - 4], 0
lea esi, [ebx + 0x1c]
cmp dword [ebx + 0x30], 0x10
mov dword [ebp - 0x2c], 0
cmovae esi, dword [ebx + 0x1c]
push 0x11
push str._c_del__f__q___s_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 2
call fcn.1004a4d0
sub esp, 0x18
lea eax, [ebp - 0x1040]
mov edi, esp
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x30], edi
push 0x1000
push 0
push eax
call fcn.1013a920
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push esi
push eax
lea eax, [ebp - 0x1040]
push eax
call fcn.1004ef00
add esp, 0xc
mov dword [edi], 0
lea ecx, [ebp - 0x1040]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov byte [ebp - 4], 4
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a94b3
sub ecx, edx
lea eax, [ebp - 0x1040]
push ecx
push eax
mov ecx, edi
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x30], esp
mov dword [ecx], 0
push 3
push 0x10747160
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 6
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ecx], 0
push 4
push str.open
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 8
call fcn.1004a4d0
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
push 0
sub esp, 0x14
mov byte [ebp - 4], 2
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
call fcn.100acdc0
mov edx, dword [ebp - 0x18]
mov byte [ebp - 0x11], al
cmp edx, 0x10
jb 0x100a9570
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9566
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a95ca
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x100a95b2
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a95a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a95ca
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3
Function at 0x100a96f0
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10173308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x18
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 0
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 2
call fcn.1004a4d0
sub esp, 0x18
mov byte [ebp - 4], 4
lea eax, [ebx + 0x1c]
mov dword [ebp - 0x20], esp
mov ecx, esp
push eax
call fcn.1004bb60
sub esp, 0x18
mov ecx, esp
mov dword [ecx], 0
push 4
push str.open
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 5
call fcn.1004a4d0
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
push 5
sub esp, 0x14
mov byte [ebp - 4], 0
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
call fcn.100acdc0
mov edx, dword [ebx + 0x30]
mov byte [ebp - 0x11], al
cmp edx, 0x10
jb 0x100a980f
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9802
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a9822
push edx
push ecx
call fcn.10138c1b
mov al, byte [ebp - 0x11]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3
Function at 0x100a9a30
Capabilities:
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101732d0
push eax
mov dword fs:[0], esp
mov eax, 0x1030
push ebx
call fcn.10139af0
push esi
push edi
mov dword [ebp - 4], 0
lea esi, [ebx + 0x1c]
cmp dword [ebx + 0x30], 0x10
mov dword [ebp - 0x2c], 0
cmovae esi, dword [ebx + 0x1c]
push 0xb
push str._f__im___s_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
mov dword [ecx], 0
push 0
push 0x10744e17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 2
call fcn.1004a4d0
sub esp, 0x18
lea eax, [ebp - 0x1040]
mov edi, esp
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x30], edi
push 0x1000
push 0
push eax
call fcn.1013a920
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push esi
push eax
lea eax, [ebp - 0x1040]
push eax
call fcn.1004ef00
add esp, 0xc
mov dword [edi], 0
lea ecx, [ebp - 0x1040]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov byte [ebp - 4], 4
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a9b33
sub ecx, edx
lea eax, [ebp - 0x1040]
push ecx
push eax
mov ecx, edi
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x30], esp
mov dword [ecx], 0
push 8
push str.taskkill
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 6
call fcn.1004a4d0
sub esp, 0x18
mov ecx, esp
mov dword [ecx], 0
push 4
push str.open
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ebp - 4], 8
call fcn.1004a4d0
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
push 0
sub esp, 0x14
mov byte [ebp - 4], 2
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
call fcn.100acdc0
mov edx, dword [ebp - 0x18]
mov byte [ebp - 0x11], al
cmp edx, 0x10
jb 0x100a9bf0
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9be6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a9c4a
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x100a9c32
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9c28
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a9c4a
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3
Function at 0x100a9d40
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10173368
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebx + 0x1c]
mov ecx, esp
push eax
call fcn.1004bb60
push 0x6429ed8
lea ecx, [ebp - 0x24]
call fcn.100d2140
sub esp, 0xc
mov dword [ebp - 0x14], 0x6429ed8
mov ecx, esp
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x14]
push ecx
push eax
push edx
call fcn.1004ac80
push 0x100d30b0
push ecx
lea ecx, [ebp - 0x24]
call fcn.100d25c0
movups xmm0, xmmword [ebx + 8]
mov eax, dword [ebx + 0x18]
sub esp, 0x14
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0x24]
call fcn.100d2af0
add esp, 0x14
lea ecx, [ebp - 0x24]
call fcn.1004b8d0
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100a9e27
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9e1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a9e3a
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
call fcn.1013d33f
int3