joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40adc8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40ae65
push ebx
push esi
call fcn.0040ad91
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040ad25
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40ae12
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ae64
push edi
push eax
call fcn.00407f35
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40ae32
call fcn.004074d8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ae63
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040ad25
add esp, 0x20
test eax, eax
jne 0x40ae51
push edi
call fcn.004074d8
jmp 0x40ae59
push ebx
call fcn.004074d8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x412f20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412f4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412f4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10007900
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100734a4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
lea edi, [eax + 4]
mov ecx, edi
mov dword [eax], vtable.Z_supPartInfo.0
mov dword [ebp + 8], edi
lea esi, [ebx + 4]
push esi
call fcn.10021230
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.10021230
lea eax, [esi + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x30]
call fcn.10021230
mov dword [ebp - 4], 2
lea eax, [ebx + 0x4c]
mov esi, dword [ebp - 0x10]
push eax
lea ecx, [esi + 0x4c]
call fcn.10021230
lea eax, [ebx + 0x64]
mov byte [ebp - 4], 3
push eax
lea ecx, [esi + 0x64]
call fcn.10021230
lea eax, [ebx + 0x7c]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0x7c]
call fcn.10021230
mov eax, dword [ebx + 0x94]
mov dword [esi + 0x94], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c920
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1000c94c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000c96e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1000c970
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x1000ca10
jg 0x1000c98d
test esi, esi
je 0x1000ca10
test ecx, ecx
jl 0x1000c9da
jg 0x1000c997
test eax, eax
je 0x1000c9da
cmp ebx, ecx
jg 0x1000c9ab
jl 0x1000c9a1
cmp esi, eax
jae 0x1000c9ab
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x1000c9e1
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x1000ca10
jg 0x1000c9eb
test esi, esi
je 0x1000ca10
cmp dword [edi + 0x4c], 0
je 0x1000ca10
mov ecx, edi
call fcn.1000d340
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ca30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000ca5c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000ca7e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1000ca80
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1000cb05
jg 0x1000ca95
test esi, esi
je 0x1000cb05
test ecx, ecx
jl 0x1000cade
jg 0x1000ca9f
test eax, eax
je 0x1000cade
cmp edi, ecx
jg 0x1000cab3
jl 0x1000caa9
cmp esi, eax
jae 0x1000cab3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1000cae1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1000cb05
jg 0x1000caeb
test esi, esi
je 0x1000cb05
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000cb05
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100a800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1000d3a0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100702c8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1000d3d0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1000d3d0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100702c8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1000d4a5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1000d3f9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000d405
movsx eax, bl
jmp 0x1000d43c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1000d4a5
cmp eax, 1
jle 0x1000d466
cmp eax, 3
jne 0x1000d4a5
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100702c8
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000d484
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000d4a5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1000d4a5
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100702c8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100702c8
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1000d563
cmp byte [esi + 0x3d], 0
je 0x1000d563
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000d518
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000d52a
sub eax, 1
je 0x1000d52e
sub eax, 2
je 0x1000d563
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100702c8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000d54c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000d518
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100702c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100702c8
mov esp, ebp
pop ebp
ret
Function at 0x100182d0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
cmp dword [esi], 0
jne 0x100183fb
mov edx, dword [esi + 8]
sub edx, dword [esi + 4]
sar edx, 3
cmp edx, 2
jle 0x100183fb
mov edi, dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 8]
movq xmm0, qword [edi]
mov dword [ebp - 0x14], eax
mov eax, edx
shr eax, 1
add eax, edx
movq qword [ebp - 0x1c], xmm0
cmp eax, ecx
jbe 0x10018329
add ecx, ecx
cmp ecx, eax
jb 0x10018320
mov dword [ebp - 0xc], ecx
lea ebx, [ecx*4]
mov ecx, edi
push ebx
call fcn.100186e0
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x100183d0
push ebx
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esi + 4]
add esp, 0xc
mov ebx, ecx
mov dword [ebp + 8], ecx
cmp ebx, dword [esi + 8]
je 0x100183cd
nop
mov eax, dword [ebx + 4]
test eax, eax
je 0x1001836b
xor esi, esi
jmp 0x1001836d
mov esi, dword [ebx]
test eax, eax
cmovne esi, eax
test esi, esi
je 0x100183c2
mov edx, dword [ebp - 0xc]
mov eax, esi
shr eax, 0x10
dec edx
xor eax, esi
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, edx
xor ecx, ecx
nop
mov edx, dword [edi + eax*4]
lea edi, [edi + eax*4]
test edx, edx
je 0x100183e1
mov edi, dword [ebp - 8]
cmp edx, esi
je 0x100183bf
mov edx, dword [ebp - 0xc]
inc eax
add eax, ecx
dec edx
inc ecx
and eax, edx
cmp ecx, edx
jbe 0x100183a0
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
add ebx, 8
cmp ebx, dword [esi + 8]
jne 0x10018360
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x20]
call fcn.10018280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov dword [edi], esi
mov eax, dword [ebx]
mov edi, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
add ecx, 8
mov dword [ebp + 8], ecx
jmp 0x100183c2
mov ebx, dword [esi + 8]
mov edx, ebx
mov ecx, dword [esi + 4]
sub edx, ecx
mov eax, edx
mov dword [ebp + 8], ebx
and eax, 0xfffffff8
cmp eax, 8
jle 0x10018438
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
cmp ebx, edi
jne 0x10018423
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 0xc]
je 0x10018435
sub edx, 8
add ecx, 8
mov eax, edx
mov ebx, edi
and eax, 0xfffffff8
cmp eax, 8
jg 0x10018414
mov ebx, dword [ebp + 8]
cmp ecx, ebx
je 0x1001846a
mov edx, ecx
add ecx, 8
cmp ecx, ebx
je 0x10018467
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10018453
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
je 0x10018460
mov eax, dword [ecx]
add edx, 8
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
add ecx, 8
cmp ecx, ebx
jne 0x10018445
lea ecx, [edx + 8]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10031590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10075f4b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.10030ba0
mov dword [ebp - 4], 0
mov esi, eax
mov edi, dword [ebp + 8]
lea ebx, [esi + 0x14]
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
mov ecx, dword [edi]
mov dword [esi + 0x10], ecx
lea ecx, [ebx + 8]
mov dword [ebp + 8], ebx
mov eax, dword [edi + 4]
mov dword [ebx], eax
mov eax, dword [edi + 8]
mov dword [ebx + 4], eax
lea eax, [edi + 0xc]
push eax
call fcn.10021230
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x30]
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x2c], eax
lea eax, [edi + 0x34]
push eax
call fcn.10021230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003a4c0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076b3c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
lea ecx, [edi + 0x14]
mov dword [edi], vtable.Z_supAccessoryInfo.0
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
lea eax, [ebx + 0x14]
push eax
call fcn.10021230
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x2c]
call fcn.10021230
lea eax, [ebx + 0x44]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x44]
call fcn.10021230
mov byte [ebp - 4], 2
lea ecx, [edi + 0x68]
mov eax, dword [ebx + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
lea eax, [ebx + 0x68]
push eax
call fcn.10021230
lea eax, [ebx + 0x80]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x80]
call fcn.10021230
lea eax, [ebx + 0x98]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x98]
call fcn.10021230
lea eax, [ebx + 0xb0]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0xb0]
call fcn.1003a010
lea eax, [ebx + 0xbc]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0xbc]
call fcn.1003a010
add edi, 0xc8
mov byte [ebp - 4], 7
lea esi, [ebx + 0xc8]
mov dword [ebp + 8], edi
push esi
mov ecx, edi
call fcn.10021230
lea eax, [esi + 0x18]
mov byte [ebp - 4], 8
push eax
lea ecx, [edi + 0x18]
call fcn.10021230
lea eax, [esi + 0x30]
mov byte [ebp - 4], 9
push eax
lea ecx, [edi + 0x30]
call fcn.10021230
mov byte [ebp - 4], 0xa
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10021230
lea eax, [esi + 0x60]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [edi + 0x60]
call fcn.10021230
mov byte [ebp - 4], 0xc
lea esi, [ebx + 0x140]
mov edi, dword [ebp - 0x10]
add edi, 0x140
push esi
mov ecx, edi
mov dword [ebp + 8], edi
call fcn.10021230
lea eax, [esi + 0x18]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [edi + 0x18]
call fcn.10021230
lea eax, [esi + 0x30]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [edi + 0x30]
call fcn.10021230
lea eax, [ebx + 0x188]
mov byte [ebp - 4], 0xf
mov ebx, dword [ebp - 0x10]
push eax
lea ecx, [ebx + 0x188]
call fcn.1003a010
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100439c0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077cd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0x14]
mov bl, 1
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov ecx, dword [edx + 4]
mov byte [ebp - 0x14], bl
cmp byte [ecx + 0xd], 0
jne 0x10043a3d
mov eax, dword [ebp + 0x10]
mov esi, dword [eax]
nop dword [eax]
cmp esi, dword [ecx + 0x10]
mov edx, ecx
setl bl
mov byte [ebp - 0x14], bl
jge 0x10043a31
mov ecx, dword [ecx]
jmp 0x10043a34
mov ecx, dword [ecx + 8]
cmp byte [ecx + 0xd], 0
je 0x10043a20
mov eax, dword [ebp - 0x18]
test bl, bl
mov esi, edx
mov ebx, dword [ebp - 0x20]
je 0x10043adb
mov ecx, dword [ebx]
cmp edx, dword [ecx]
jne 0x10043a7e
push eax
push ecx
push edx
push 1
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10043c10
mov ecx, dword [eax]
mov eax, edi
mov dword [edi], ecx
mov byte [edi + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edx + 0xd], 0
je 0x10043a89
mov esi, dword [edx + 8]
jmp 0x10043adb
mov eax, dword [edx]
cmp byte [eax + 0xd], 0
je 0x10043ac0
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x10043ab6
mov ecx, edx
nop dword [eax]
mov edi, eax
cmp ecx, dword [eax]
jne 0x10043ab3
mov esi, eax
mov ecx, edi
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x10043aa0
mov edi, dword [ebp - 0x1c]
cmp byte [esi + 0xd], 0
jne 0x10043adb
mov esi, eax
jmp 0x10043adb
mov esi, eax
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x10043adb
nop dword [eax + eax]
mov esi, eax
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x10043ad0
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx]
jge 0x10043b16
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push ecx
push edx
push dword [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10043c10
mov eax, dword [eax]
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp - 0x18]
lea ecx, [ebx + 0x90]
call fcn.10021160
lea ecx, [ebx + 0x78]
call fcn.10021160
lea ecx, [ebx + 0x60]
call fcn.10021160
lea ecx, [ebx + 0x48]
call fcn.10021160
lea ecx, [ebx + 0x30]
call fcn.10021160
lea ecx, [ebx + 0x18]
call fcn.10021160
push 0xb0
push ebx
call fcn.100702e7
mov eax, dword [ebp - 0x1c]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100afe03
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.100ade28
mov eax, dword [0x1e5de0d6]
add bh, 0xc
test eax, 0xf2fbb
add byte [eax], al
popfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x54]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
je 0x101166ec
jne 0x101166ec
jmp 0x101166ea
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x3b]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0x50a60
xchg dword [esp], ecx
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x59]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], ecx
push ebp
mov ebp, esp
leave
xchg dword [esp], ecx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x4e]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
popfd
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x7e]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
jmp 0x100ad080
add byte [eax], al
xchg esi, eax
mov esi, dword [edx + edi + 0x20]
push eax
xchg esi, eax
pop esi
xor esi, esi
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x65]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
add eax, edi
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x4f]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [ebp + 0xc], edi
mov edi, eax
push dword [ebp + 0xc]
xchg dword [ebp + 0xc], edi
pop edi
cmp dword [edx + edi + 0x18], esi
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x22]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
jbe 0x100b061c
jmp 0x100acb64

Function at 0x100ba234
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x47]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0x3e036
xchg dword [esp], ebx
push ebp
mov ebp, esp
leave
xchg dword [esp + 4], ebx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x29]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], ebx
lea edx, [edx]
popfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x20]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x10100204

Function at 0x100fff0d
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x68]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0x6fff
xchg dword [esp], ebx
pushfd
add ebp, 0x50
popfd
lea ebp, [ebp - 0x50]
xchg dword [esp + 4], ebx
push ecx
mov ecx, eax
pop ecx
xchg dword [esp], ebx
pushfd
add ebp, 0x72
popfd
lea ebp, [ebp - 0x72]
popfd
push ebp
mov ebp, esp
leave
jmp 0x10106ecc
call fcn.100f9470
sbb cl, cl
ficomp word [edi + 0x3d]
xchg esi, eax
dec dword [edi]
push es