joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a7825
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1021b91d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax]
push ecx
lea ecx, [esp + 0x30]
push dword [eax + 8]
add eax, 0xc
push eax
call fcn.100a948c
xor edi, edi
mov dword [esp + 0x14], edi
mov ebx, edi
mov dword [esp + 0x18], edi
jmp 0x100a792a
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
test eax, eax
je 0x100a787b
mov eax, dword [eax - 4]
jmp 0x100a787d
mov eax, edi
cmp ebx, eax
jge 0x100a7940
push ecx
mov ecx, esp
mov dword [esp + 0x20], edi
push dword [esp + 0x1c]
mov dword [esp + 0x2c], edi
push dword [esp + 0x1c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
call fcn.100023d5
lea ecx, [esp + 0x20]
call fcn.10085950
mov eax, dword [esi]
pop ecx
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x100a792a
cmp dword [esi + 0x38], 0
jne 0x100a78e8
call fcn.1002c931
mov dword [esp + 0x10], eax
mov dword [esp + 0x4c], edi
test eax, eax
je 0x100a78d8
mov ecx, eax
call fcn.1002c95e
jmp 0x100a78da
mov eax, edi
or dword [esp + 0x4c], 0xffffffff
lea ecx, [esi + 0x38]
push eax
call fcn.1000fd99
cmp dword [esp + 0x1c], 3
jne 0x100a7916
mov esi, dword [esi + 0x38]
movsx edi, word [esp + 0x20]
lea ecx, [esi + 0x438]
call fcn.1002b150
mov dword [esi + 0x43c], edi
xor edi, edi
mov dword [esi + 0x438], 4
jmp 0x100a7929
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x1c]
push eax
add ecx, 0x438
call fcn.1002b04d
inc ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
call fcn.100a1b1c
test al, al
jne 0x100a786d
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100b56b6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
lea eax, [esp + 0x20]
push ebx
push ebp
push esi
push edi
push eax
mov edi, ecx
call fcn.100303e8
mov ecx, dword [edi + 0x78]
mov edx, dword [edi + 0x7c]
add ecx, dword [eax]
add edx, dword [eax + 4]
sub dword [esp + 0x40], ecx
lea ecx, [esp + 0x30]
mov eax, dword [edi]
sub dword [esp + 0x44], edx
push ecx
mov ecx, edi
call dword [eax + 0x170]
xor ebp, ebp
mov ecx, dword [eax]
add dword [esp + 0x40], ecx
mov eax, dword [eax + 4]
add dword [esp + 0x44], eax
mov eax, dword [edi + 0xf0]
test eax, eax
je 0x100b5709
mov eax, dword [eax - 4]
jmp 0x100b570b
mov eax, ebp
test eax, eax
jne 0x100b5716
mov eax, edi
jmp 0x100b5827
lea ecx, [edi + 0xd0]
call fcn.1001af03
mov eax, dword [edi + 0xf4]
test eax, eax
je 0x100b5730
mov eax, dword [eax - 4]
jmp 0x100b5732
mov eax, ebp
dec eax
mov dword [esp + 0x30], eax
js 0x100b5825
mov eax, ebp
mov dword [esp + 0x1c], ebp
mov ecx, dword [edi + 0xf4]
add ecx, eax
mov dword [esp + 0x2c], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 0xc]
dec eax
add eax, edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0x18]
jg 0x100b580f
imul edx, eax, 0x1c
mov dword [esp + 0x18], edx
mov ebx, dword [edi + 0xf0]
add ebx, edx
mov dword [esp + 0x20], ebx
movsx ecx, word [ebx + 0x14]
movsx esi, word [ebx + 0xc]
movsx edx, word [ebx + 0x12]
movzx eax, word [ebx + 0xe]
add edx, esi
mov ebx, dword [ebx]
add edx, ecx
push ecx
push ecx
dec eax
mov ecx, esp
add edx, eax
sub esp, 0x10
mov eax, dword [esp + 0x58]
mov dword [ecx], eax
mov eax, dword [esp + 0x5c]
mov dword [ecx + 4], eax
mov eax, esp
mov ecx, dword [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.10083457
add esp, 0x18
test al, al
je 0x100b57ee
cmp ebx, edi
je 0x100b5844
mov ecx, ebx
call fcn.1001741e
test al, al
jne 0x100b57ee
push dword [esp + 0x3c]
mov ecx, ebx
call fcn.10004b2c
test al, al
jne 0x100b5831
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
inc ecx
mov edx, dword [esp + 0x18]
add edx, 0x1c
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
cmp ecx, dword [eax + 0x18]
jle 0x100b5776
mov eax, dword [esp + 0x1c]
inc ebp
add eax, 0x20
mov dword [esp + 0x1c], eax
cmp ebp, dword [esp + 0x30]
jle 0x100b5743
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0xc
mov edx, dword [ebx]
mov ecx, ebx
push dword [esp + 0x3c]
call dword [edx + 0x3e4]
cmp eax, 1
jne 0x100b584c
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
jmp 0x100b5827
mov eax, dword [esp + 0x40]
push ecx
push ecx
mov edx, esp
mov ecx, ebx
push dword [esp + 0x44]
mov dword [edx], eax
mov eax, dword [esp + 0x50]
mov dword [edx + 4], eax
mov eax, dword [ebx]
call dword [eax + 0x3f0]
test eax, eax
cmovne edi, eax
jmp 0x100b570f
Function at 0x100b913a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, edx
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
cmp dword [esp + 0x30], ebp
je 0x100b91f0
mov eax, dword [ebp + 0x2c]
test eax, eax
jne 0x100b9169
mov eax, dword [0x102b7738]
jmp 0x100b917c
cmp eax, dword [0x102b7738]
jne 0x100b917c
push 0
push ecx
push esi
mov ecx, ebp
call fcn.10079533
mov eax, dword [eax + 0x3f4]
cmp eax, 0x80000000
je 0x100b91f0
test eax, eax
je 0x100b91f0
push esi
mov ecx, ebp
call fcn.10004b2c
test al, al
je 0x100b91f0
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
mov edx, ebp
push eax
call fcn.100b8c9c
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
mov edx, ebp
push eax
call fcn.100b8d34
mov eax, dword [esp + 0x48]
pop ecx
pop ecx
mov ecx, esp
push dword [esp + 0x3c]
push dword [esp + 0x24]
mov dword [ecx], eax
push dword [esp + 0x2c]
mov eax, dword [esp + 0x50]
push dword [esp + 0x38]
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x48]
push ebp
push esi
push edi
call fcn.100b834c
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x4b0]
mov ecx, eax
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x34], eax
test ecx, ecx
jle 0x100b9309
mov edx, dword [ebp]
mov ecx, ebp
push eax
call dword [edx + 0x4ac]
mov ebx, eax
mov eax, dword [ebx + 0x2c]
test eax, eax
jne 0x100b922b
mov eax, dword [0x102b7738]
jmp 0x100b923e
cmp eax, dword [0x102b7738]
jne 0x100b923e
push 0
push ecx
push esi
mov ecx, ebx
call fcn.10079533
mov eax, dword [eax + 0x4f8]
cmp eax, 0x80000000
je 0x100b924f
test eax, eax
jne 0x100b92c4
push esi
mov ecx, ebx
call fcn.10004b2c
test al, al
je 0x100b92c4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
cmp eax, 1
jne 0x100b9277
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x3e4]
cmp eax, 1
je 0x100b92c4
mov esi, dword [ebx + 0x7c]
lea eax, [esp + 0x1c]
mov edi, dword [ebx + 0x78]
mov ecx, ebx
add esi, dword [esp + 0x3c]
add edi, dword [esp + 0x38]
push eax
call fcn.100303e8
mov ecx, dword [eax + 4]
mov edx, dword [eax]
add ecx, esi
mov esi, dword [esp + 0x10]
add edx, edi
cmp dword [ebx + 0xc8], 0
mov edi, dword [esp + 0x14]
jne 0x100b92f6
push 0
push ecx
push ecx
mov eax, esp
push esi
push edi
mov dword [eax + 4], ecx
mov ecx, ebx
mov dword [eax], edx
mov eax, dword [ebx]
call dword [eax + 0x2ac]
jmp 0x100b92f6
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x3e4]
cmp eax, 1
jne 0x100b92f6
mov eax, dword [esp + 0x38]
mov edx, esi
push ecx
push ecx
mov ecx, esp
push ebx
push dword [esp + 0x3c]
mov dword [ecx], eax
mov eax, dword [esp + 0x4c]
mov dword [ecx + 4], eax
mov ecx, edi
call fcn.100b913a
add esp, 0x10
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x34], eax
cmp eax, dword [esp + 0x24]
jl 0x100b920f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x100bb59b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edi
call fcn.100b4b0d
mov ecx, eax
mov dword [esp + 0x18], ecx
cmp ecx, edi
jne 0x100bb5ce
push dword [ebp + 8]
mov ecx, edi
call fcn.1002e357
mov eax, dword [ebp + 8]
jmp 0x100bb70c
movdqa xmm0, xmmword [0x102711a0]
xor eax, eax
mov edx, dword [ecx + 0xf4]
mov dword [esp + 0x1c], eax
movdqu xmmword [esp + 0x38], xmm0
test edx, edx
je 0x100bb5f1
mov edx, dword [edx - 4]
jmp 0x100bb5f3
mov edx, eax
dec edx
js 0x100bb6ba
inc edx
mov dword [esp + 0x20], edx
mov ebx, dword [ecx + 0xf4]
add ebx, eax
mov dword [esp + 0x34], ebx
mov esi, dword [ebx + 0x14]
mov dword [esp + 0x10], esi
cmp esi, dword [ebx + 0x18]
jg 0x100bb6a8
imul edx, esi, 0x1c
mov dword [esp + 0x14], edx
mov eax, dword [ecx + 0xf0]
add eax, edx
mov dword [esp + 0x28], eax
push 1
push edi
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x1dc]
test al, al
je 0x100bb687
mov eax, dword [esp + 0x28]
sub esp, 0x10
mov edi, dword [ebx + 0xc]
mov ebx, dword [ebx]
dec ebx
movsx esi, word [eax + 0xc]
add ebx, edi
movsx edx, word [eax + 0x12]
movsx ecx, word [eax + 0x14]
add edx, esi
movzx eax, word [eax + 0xe]
add ecx, edx
dec eax
add ecx, eax
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
lea ecx, [esp + 0x48]
mov dword [eax + 0xc], ebx
call fcn.1001d3fb
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
inc esi
mov ecx, dword [esp + 0x18]
add edx, 0x1c
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
cmp esi, dword [ebx + 0x18]
jle 0x100bb622
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add eax, 0x20
dec edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
jne 0x100bb5ff
mov ebx, dword [esp + 0x38]
mov edx, ecx
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
add eax, dword [ecx + 0x78]
mov edi, dword [esp + 0x44]
add ebx, dword [ecx + 0x78]
add esi, dword [ecx + 0x7c]
add edi, dword [ecx + 0x7c]
lea ecx, [esp + 0x28]
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
call fcn.100b4530
mov eax, dword [ebp + 8]
add ebx, dword [esp + 0x2c]
add esi, dword [esp + 0x30]
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, dword [esp + 0x28]
add edi, dword [esp + 0x2c]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100d1796
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
xor eax, eax
mov byte [esp + 0x17], al
mov dword [esp + 0x2c], ecx
mov dword [edi], eax
mov dword [edi + 4], eax
mov eax, dword [esp + 0x58]
or dword [edi + 8], 0xffffffff
or dword [edi + 0xc], 0xffffffff
mov ebp, dword [eax]
jmp 0x100d18d7
mov eax, dword [ecx + 0xcc]
mov esi, dword [eax + ebp*4]
mov ecx, esi
mov dword [esp + 0x28], esi
mov eax, dword [esi]
call dword [eax + 0x34]
cmp eax, 4
jne 0x100d18ce
mov eax, dword [esp + 0x5c]
mov ebx, dword [eax]
jmp 0x100d18c1
test ebx, ebx
js 0x100d17ff
push ebx
mov ecx, esi
call fcn.100cae55
mov esi, eax
mov dword [esp + 0x18], eax
jmp 0x100d1805
xor esi, esi
mov dword [esp + 0x18], esi
push ebx
mov edx, ebp
mov ecx, esi
call fcn.100cb2e1
pop ecx
test al, al
je 0x100d18b8
cmp byte [esp + 0x17], 0
je 0x100d1887
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 8]
mov ebp, dword [edi]
mov esi, dword [edi + 4]
mov edi, dword [edi + 0xc]
mov dword [esp + 0x24], eax
lea eax, [ecx + 0x88]
push eax
lea eax, [ecx + 0x78]
push eax
lea ecx, [esp + 0x38]
call fcn.1000e87b
mov ebx, dword [esp + 0x34]
cmp esi, ebx
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
cmovl ebx, esi
mov eax, dword [esp + 0x38]
cmp edi, edx
cmovg edx, edi
mov edi, dword [esp + 0x54]
cmp ebp, ecx
cmovl ecx, ebp
cmp dword [esp + 0x24], eax
mov ebp, dword [esp + 0x20]
cmovg eax, dword [esp + 0x24]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi], ecx
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
jmp 0x100d18b8
lea eax, [esi + 0x88]
push eax
lea eax, [esi + 0x78]
push eax
lea ecx, [esp + 0x48]
call fcn.1000e87b
mov ecx, eax
mov byte [esp + 0x17], 1
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x5c]
inc ebx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp ebx, dword [eax + 4]
jle 0x100d17eb
mov eax, dword [esp + 0x58]
inc ebp
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x20], ebp
cmp ebp, dword [eax + 4]
jle 0x100d17c3
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
Function at 0x100d7c92
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1021dc10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], vtable.html::event.0
xor ebx, ebx
mov dword [esp + 0xc], 5
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.1000fdf5
push dword [ebp + 8]
mov dword [esp + 0x48], ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], vtable.html::event_behavior.0
mov dword [esp + 0x18], ebx
call fcn.1000fdf5
xor eax, eax
mov dword [esp + 0x20], ebx
cmp byte [ebp + 0xc], al
xorps xmm0, xmm0
mov dword [esp + 0x24], ebx
sete al
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x18], eax
mov byte [esp + 0x30], bl
mov dword [esp + 0x44], 1
lea ecx, [esp + 8]
mov eax, dword [esi]
push ebx
push ecx
mov ecx, esi
call dword [eax + 0x11c]
or dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 8]
call fcn.10004640
mov ecx, dword [esp + 0x3c]
xor al, al
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100dc6c2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1021e11d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x10264748
mov dword [esi + 0x48], vtable.tool::resource.0
mov dword [esi + 0x4c], ebx
mov dword [esp + 0x1c], ebx
push ecx
mov dword [esp + 0xc], 1
call fcn.100048f3
mov eax, dword [esi + 4]
movaps xmm0, xmmword [0x10271130]
mov dword [esi], vtable.html::magnifier_ctl.1.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.html::magnifier_ctl.0
mov dword [esi + 0x10], ebx
movups xmmword [esi + 0x18], xmm0
mov byte [esi + 0x40], bl
movsd xmm0, qword [0x10270f50]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x14], ebx
call fcn.10211170
mov ecx, dword [esp + 0x14]
mov eax, esi
movsd qword [esi + 0x28], xmm0
movaps xmm0, xmmword [0x10271040]
movups xmmword [esi + 0x30], xmm0
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ddde1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1021e282
call fcn.10210210
push ecx
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
mov dword [esi + 4], 0x10264940
mov dword [esi + 0x44], 0x102646d4
mov dword [esi + 0x58], 0x1026488c
mov dword [esi + 0x34], vtable.tool::resource.0
mov dword [esi + 0x38], edi
push ecx
mov dword [ebp - 4], edi
lea ecx, [esi + 0x40]
mov dword [ebp - 0x10], 1
call fcn.100048f3
push ecx
lea ecx, [esi + 0x54]
call fcn.100dc52e
mov eax, dword [esi + 4]
mov dword [esi], vtable.html::marquee_ctl.3.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.html::marquee_ctl.1.0
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
mov dword [eax + esi + 4], vtable.html::marquee_ctl.2.0
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dword [eax + esi + 4], vtable.html::marquee_ctl.0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 8]
lea eax, [ecx - 0x3c]
mov dword [ecx + esi], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xc]
lea eax, [ecx - 0x50]
mov dword [ecx + esi], eax
mov eax, SysReAllocStringLen
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], 0xff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100e10dc
Capabilities:
Check if file exists
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1021e5f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x308
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 8]
push esi
push edi
push str._filename
push ebx
push eax
mov edi, ecx
call fcn.100a3d70
and dword [esp + 0x31c], 0
lea ecx, [esp + 0x10]
push 0x1025d7d0
call fcn.100027b0
test al, al
jne 0x100e12c7
mov eax, dword [esp + 0x10]
cmp dword [eax + 4], 0
jne 0x100e116e
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call dword [eax + 0x33c]
lea ecx, [esp + 0x10]
push dword [eax]
call fcn.10131585
lea ecx, [esp + 0x14]
call fcn.100026e7
mov eax, dword [esp + 0x10]
cmp dword [eax + 4], 0
je 0x100e12c7
and dword [esp + 0x58], 0
lea eax, [esp + 0x5c]
push 0x2b0
push 0
push eax
call fcn.101e2950
add esp, 0xc
lea ecx, [esp + 0x10]
mov esi, 0x4000
push 0x10264b34
call fcn.10132245
test eax, eax
js 0x100e11b3
mov eax, dword [esp + 0x10]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x100e11e7
push 0x10262de0
lea ecx, [esp + 0x14]
mov esi, 0x4010
call fcn.100027b0
test al, al
je 0x100e11cf
push 0x10
pop ecx
jmp 0x100e11e7
push 0x10264a60
lea ecx, [esp + 0x14]
call fcn.100027b0
movzx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x40
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x58]
push esi
push 0x2b4
push edx
add eax, 8
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x100e12c7
lea eax, [esp + 0x20]
push eax
push 0x1024250c
push dword [edi + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetImageList]
test eax, eax
js 0x100e12c7
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call esi
push 0x31
mov edi, eax
call esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
push eax
push dword [esp + 0x28]
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
mov eax, dword [esp + 0x18]
push ecx
push ecx
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0x24]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x2c]
push dword [esp + 0x64]
push dword [esp + 0x2c]
call fcn.100df100
mov byte [esp + 0x31c], 1
mov eax, dword [ebx + 0x2c]
test eax, eax
jne 0x100e1288
mov eax, dword [0x102b7738]
jmp 0x100e129d
cmp eax, dword [0x102b7738]
jne 0x100e129d
push 0
push ecx
push dword [ebp + 8]
mov ecx, ebx
call fcn.10079533
lea ecx, [esp + 0x24]
add eax, 0x174
push ecx
push ecx
push dword [ebp + 0x14]
mov ecx, ebx
push eax
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.10077292
lea ecx, [esp + 0x24]
call fcn.10003136
xor ebx, ebx
inc ebx
jmp 0x100e12c9
xor bl, bl
lea ecx, [esp + 0x10]
call fcn.100026e7
mov ecx, dword [esp + 0x314]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100eed1f
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x1021f77a
call fcn.10210210
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0x10266610
mov dword [esi + 0x30], vtable.tool::resource.0
mov dword [esi + 0x34], ebx
mov dword [ebp - 4], ebx
push ecx
mov dword [ebp - 0x10], 1
call fcn.100048f3
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0xc]
mov dword [esi], vtable.html::masked_edit_ctl.0
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], vtable.html::masked_edit_ctl.1.0
mov eax, 0x2022
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 0x102b807c
or dword [esi + 0x20], 0xffffffff
mov word [esi + 0x1c], ax
mov eax, esi
mov byte [esi + 0x1e], bl
mov dword [esi + 0x28], ebx
mov word [esi + 0x24], 0x101
mov dword [esi + 0x2c], 0x64
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100fb70d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1021fece
call fcn.10210210
push ecx
push ecx
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.1000317c
and dword [esp + 0x20], 0
mov dword [ebx], vtable.gool::plain_dib_t_struct_gool::DIBFMT24_.1.0
mov dword [ebx + 0x1c], vtable.gool::plain_dib_t_struct_gool::DIBFMT24_.0
and dword [ebx + 0xcc], 0
mov esi, dword [esp + 0x30]
push ecx
mov byte [esp + 0x24], 1
push ecx
mov ecx, dword [esi + 0xc]
mov edx, esp
sub ecx, dword [esi + 4]
mov eax, dword [esi + 8]
inc ecx
sub eax, dword [esi]
inc eax
mov dword [edx + 4], ecx
mov ecx, ebx
mov dword [edx], eax
call fcn.100fb68d
mov esi, dword [esp + 0x2c]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebx + 0x24]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, eax
push ebp
call ebx
mov edx, dword [esp + 0x30]
mov edi, eax
push 0xcc0020
push dword [edx + 4]
mov ecx, dword [edx + 0xc]
push dword [edx]
sub ecx, dword [edx + 4]
push dword [esi + 4]
mov eax, dword [edx + 8]
inc ecx
sub eax, dword [edx]
push ecx
inc eax
push eax
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
push ebp
call ebx
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x100fc42e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1021ff74
call fcn.10210210
push ecx
push ecx
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.1000317c
and dword [esp + 0x20], 0
mov dword [ebx], vtable.gool::plain_dib_t_struct_gool::DIBFMT16_.1.0
mov dword [ebx + 0x1c], vtable.gool::plain_dib_t_struct_gool::DIBFMT16_.0
and dword [ebx + 0xcc], 0
mov esi, dword [esp + 0x30]
push ecx
mov byte [esp + 0x24], 1
push ecx
mov ecx, dword [esi + 0xc]
mov edx, esp
sub ecx, dword [esi + 4]
mov eax, dword [esi + 8]
inc ecx
sub eax, dword [esi]
inc eax
mov dword [edx + 4], ecx
mov ecx, ebx
mov dword [edx], eax
call fcn.100fc3a1
mov esi, dword [esp + 0x2c]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebx + 0x24]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, eax
push ebp
call ebx
mov edx, dword [esp + 0x30]
mov edi, eax
push 0xcc0020
push dword [edx + 4]
mov ecx, dword [edx + 0xc]
push dword [edx]
sub ecx, dword [edx + 4]
push dword [esi + 4]
mov eax, dword [edx + 8]
inc ecx
sub eax, dword [edx]
push ecx
inc eax
push eax
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
push ebp
call ebx
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 8