joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b890
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x10193ba6
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov edi, dword [esp + 0x168]
mov eax, dword [esp + 0x16c]
mov ebp, dword [esp + 0x174]
mov ebx, dword [esp + 0x180]
mov esi, ecx
mov ecx, dword [esp + 0x17c]
push 4
lea edx, [esi + 0x2ad8]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, edi
mov dword [esp + 0x28], eax
call fcn.1000dee0
mov ecx, ebp
call fcn.10017ff0
mov eax, dword [esi + 0xb84]
mov ecx, dword [esi + 0xb80]
mov edx, dword [esp + 0x18]
push 0
push 0
push eax
push ecx
push edx
lea ecx, [esp + 0x30]
call fcn.1007b190
mov ecx, esi
mov dword [esp + 0x160], 0
call fcn.10049740
mov byte [esi + 0x17e4], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x18], eax
xor eax, eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call fcn.1007a4a0
push eax
lea ecx, [esp + 0x30]
call fcn.10095850
push ebx
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x178]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push ebp
lea edx, [esi + 0x1280]
push edx
push 0
push eax
mov byte [esp + 0x17c], 1
mov dword [esp + 0x70], 0
call fcn.1000c320
push eax
push esi
lea ecx, [esi + 0x1688]
push ecx
lea ebp, [esi + 0x2950]
push ebp
mov ecx, edi
call fcn.1000c320
push eax
push esi
call fcn.100a1270
mov edx, dword [esp + 0x88]
mov byte [esp + 0x4b], al
mov al, byte [esp + 0x7e]
add esp, 0x34
mov dword [esi + 0xc30], edx
mov byte [esi + 0x10ab], al
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jb 0x1003b9fc
sub eax, ecx
push eax
push str.totalElapsedMs
mov ecx, ebx
call fcn.100612a0
cmp byte [esp + 0x17], 0
push ebx
je 0x1003ba3e
lea ecx, [esp + 0x20]
call fcn.1007b1e0
mov ecx, dword [esi + 0x155c]
mov edx, dword [esi + 0x1558]
push ecx
push edx
push str.ContentLength
lea ecx, [esi + 0x908]
call fcn.10061380
cmp dword [esi + 0x1554], 0x190
jl 0x1003ba45
mov byte [esp + 0x17], 0
jmp 0x1003ba45
mov ecx, ebp
call fcn.10084480
lea ecx, [esp + 0x2c]
mov byte [esp + 0x160], 0
call fcn.10095930
lea ecx, [esp + 0x1c]
mov dword [esp + 0x160], 0xffffffff
call fcn.1007a4c0
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.1018f87e
add esp, 0x150
ret 0x1c
Function at 0x1003bd10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10193c58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x1003bd42
lea eax, [esi + 0x8dc]
jmp 0x1003bd44
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
call fcn.1005ff60
test esi, esi
mov dword [esp + 0x2c], 0
je 0x1003bd62
lea eax, [esi + 0x8dc]
jmp 0x1003bd64
xor eax, eax
push str.CloseAllConnections
push eax
lea ecx, [esp + 0x14]
call fcn.100615f0
mov eax, dword [esi + 0xb84]
mov ecx, dword [esi + 0xb80]
mov edx, dword [esp + 0x34]
push 0
push 0
push eax
push ecx
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 1
call fcn.1007b190
lea eax, [esi + 0x908]
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.1007a4a0
push eax
mov ecx, esi
call fcn.10049970
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 1
call fcn.1007a4c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.100616a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4

Function at 0x10043270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1019e8d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x100432a2
lea eax, [esi + 0x8dc]
jmp 0x100432a4
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.1005ff60
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
lea eax, [esi + 0x908]
push eax
mov eax, dword [esp + 0x28]
push ecx
push 0
push edx
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.10043010
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.1005ff90
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0xc

Function at 0x10043300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x10043333
lea eax, [esi + 0x8dc]
jmp 0x10043335
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
lea eax, [esi + 0x908]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push 0
push edx
push eax
push ecx
push str.S3_DownloadBytes
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.1003d980
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0x10
Function at 0x10043470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x100434a3
lea eax, [esi + 0x8dc]
jmp 0x100434a5
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
lea eax, [esi + 0x908]
push eax
push ecx
push 0
push edx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.1003de00
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x10043500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x10043533
lea eax, [esi + 0x8dc]
jmp 0x10043535
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
lea eax, [esi + 0x908]
push eax
push ecx
push 0
push edx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.1003e4c0
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x10043590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x100435c3
lea eax, [esi + 0x8dc]
jmp 0x100435c5
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
lea eax, [esi + 0x908]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push 0
push edx
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.1003ec30
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0xc
Function at 0x10047210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x10047243
lea eax, [esi + 0x8dc]
jmp 0x10047245
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
lea eax, [esi + 0x908]
push eax
push ecx
push 0
push edx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.10043620
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x100472a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x100472d3
lea eax, [esi + 0x8dc]
jmp 0x100472d5
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
lea eax, [esi + 0x908]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push 0
push edx
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.10044380
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0xc

Function at 0x10047330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10194cf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x10047363
lea eax, [esi + 0x8dc]
jmp 0x10047365
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
lea eax, [esi + 0x908]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push 0
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.10044b70
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0x10
Function at 0x10049fb0
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x101951b6
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x1026d48c]
xor eax, esp
mov dword [esp + 0x24c], eax
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov al, byte [esp + 0x268]
test al, al
mov esi, ecx
mov byte [esi + 0x2af1], al
je 0x1004a11a
lea ecx, [esp + 0x13c]
mov byte [esi + 0x2af0], 0
call fcn.1000a870
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:91.0__Gecko_20100101_Firefox_91.0
lea ecx, [esp + 0x140]
mov dword [esp + 0x264], 0
call fcn.1000ae10
lea eax, [esp + 0x13c]
push eax
push str.User_Agent
mov ecx, esi
call fcn.10049640
lea ecx, [esp + 8]
call fcn.1002a630
lea ecx, [esp + 8]
push ecx
push str.text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8
add esi, 0x17a8
push str.Accept
mov ecx, esi
mov byte [esp + 0x26c], 1
call fcn.10089a20
lea edx, [esp + 8]
push edx
push str.Accept_Language
mov ecx, esi
call fcn.10088070
test al, al
jne 0x1004a09a
lea eax, [esp + 8]
push eax
push str.en_US_en_q0.5
push str.Accept_Language
mov ecx, esi
call fcn.10089a20
lea ecx, [esp + 8]
push ecx
push str.Connection
mov ecx, esi
call fcn.10088070
test al, al
jne 0x1004a0c5
lea edx, [esp + 8]
push edx
push str.keep_alive
push str.Connection
mov ecx, esi
call fcn.10089a20
lea eax, [esp + 8]
push eax
push str.Upgrade_Insecure_Requests
mov ecx, esi
call fcn.10088070
test al, al
jne 0x1004a0f0
lea ecx, [esp + 8]
push ecx
push 0x101e61b0
push str.Upgrade_Insecure_Requests
mov ecx, esi
call fcn.10089a20
lea ecx, [esp + 8]
mov byte [esp + 0x260], 0
call fcn.1002a650
lea ecx, [esp + 0x13c]
mov dword [esp + 0x260], 0xffffffff
call fcn.1000a910
jmp 0x1004a12c
push 1
push str.User_Agent
lea ecx, [esi + 0x17a8]
call fcn.10088380
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.1018f87e
add esp, 0x25c
ret 4
Function at 0x10050700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195a00
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esi + 0x2c4]
test ecx, ecx
mov dword [esp + 0x2c], 0
je 0x10050774
call fcn.100c2c60
test al, al
jne 0x1005079b
push str.rRoot
mov dword [esi + 0x2c4], 0
call fcn.100c4c30
add esp, 4
test eax, eax
mov dword [esi + 0x2c4], eax
je 0x10050774
mov ecx, eax
call fcn.100c3b00
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4
mov eax, dword [esi + 0x2c4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x100507ad
add eax, 8
jmp 0x100507af
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
call fcn.1005ff60
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esi + 0x2c4]
mov byte [esp + 0x30], 1
call fcn.100c30b0
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x2c], 0
call fcn.1005ff90
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4

Function at 0x10052820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.1005ff60
mov eax, dword [esi + 0x2c]
mov edx, dword [eax + 0x20]
lea edi, [esi + 0x2c]
mov ecx, edi
mov dword [esp + 0x38], 0
call edx
push str.GetChild
push edi
lea ecx, [esp + 0x14]
call fcn.10061630
push edi
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.10007cf0
push edi
mov ecx, esi
call fcn.1004f780
test al, al
jne 0x100528c2
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], al
call fcn.100616a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.1005ff90
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
mov eax, dword [esi + 0x2c4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x100528d4
add eax, 8
jmp 0x100528d6
xor eax, eax
push eax
lea ecx, [esp + 0x28]
call fcn.1005ff60
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, dword [esi + 0x2c4]
mov byte [esp + 0x3c], 2
xor edi, edi
call fcn.100c2ca0
test eax, eax
je 0x1005290b
cmp byte [eax + 0x3c], 0xce
jne 0x1005290b
push eax
mov ecx, esi
call fcn.10052370
mov edi, eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.1005ff90
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.100616a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.1005ff90
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x10052ce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.1005ff60
mov eax, dword [esi + 0x2c]
mov edx, dword [eax + 0x20]
lea edi, [esi + 0x2c]
mov ecx, edi
mov dword [esp + 0x38], 0
call edx
push str.RemoveFromTree
push edi
lea ecx, [esp + 0x14]
call fcn.10061630
push edi
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.10007cf0
push edi
mov ecx, esi
call fcn.1004f780
test al, al
je 0x10052d8c
mov eax, dword [esi + 0x2c4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10052d60
add eax, 8
jmp 0x10052d62
xor eax, eax
push eax
lea ecx, [esp + 0x28]
call fcn.1005ff60
mov ecx, dword [esi + 0x2c4]
push 1
mov byte [esp + 0x3c], 2
call fcn.100c5290
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.1005ff90
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.100616a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.1005ff90
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x100535b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.1005ff60
mov eax, dword [esi + 0x2c]
mov edx, dword [eax + 0x20]
lea edi, [esi + 0x2c]
mov ecx, edi
mov dword [esp + 0x38], 0
call edx
push str.GetSelf
push edi
lea ecx, [esp + 0x14]
call fcn.10061630
push edi
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.10007cf0
push edi
mov ecx, esi
call fcn.1004f780
test al, al
jne 0x10053650
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], al
call fcn.100616a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.1005ff90
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
mov eax, dword [esi + 0x2c4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10053662
add eax, 8
jmp 0x10053664
xor eax, eax
push eax
lea ecx, [esp + 0x28]
call fcn.1005ff60
mov eax, dword [esi + 0x2c4]
xor edi, edi
test eax, eax
mov byte [esp + 0x38], 2
je 0x1005368f
cmp byte [eax + 0x3c], 0xce
jne 0x1005368f
push eax
mov ecx, esi
call fcn.10052370
mov edi, eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.1005ff90
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.100616a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.1005ff90
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x10053f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195a00
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esi + 0x2c4]
test ecx, ecx
mov dword [esp + 0x2c], 0
je 0x10053f94
call fcn.100c2c60
test al, al
jne 0x10053fbb
push str.rRoot
mov dword [esi + 0x2c4], 0
call fcn.100c4c30
add esp, 4
test eax, eax
mov dword [esi + 0x2c4], eax
je 0x10053f94
mov ecx, eax
call fcn.100c3b00
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4
mov eax, dword [esi + 0x2c4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10053fcd
add eax, 8
jmp 0x10053fcf
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
call fcn.1005ff60
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esi + 0x2c4]
mov byte [esp + 0x30], 1
call fcn.100c3390
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x2c], 0
call fcn.1005ff90
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4

Function at 0x10054860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195a00
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0x10]
call fcn.1005ff60
mov ecx, dword [esi + 0x2c4]
test ecx, ecx
mov dword [esp + 0x2c], 0
je 0x100548d4
call fcn.100c2c60
test al, al
jne 0x100548fb
push str.rRoot
mov dword [esi + 0x2c4], 0
call fcn.100c4c30
add esp, 4
test eax, eax
mov dword [esi + 0x2c4], eax
je 0x100548d4
mov ecx, eax
call fcn.100c3b00
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4
mov eax, dword [esi + 0x2c4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1005490d
add eax, 8
jmp 0x1005490f
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
call fcn.1005ff60
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esi + 0x2c4]
mov byte [esp + 0x30], 1
call fcn.100c48c0
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x2c], 0
call fcn.1005ff90
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005ff90
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x24
ret 4
Function at 0x100572e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1019e8d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x1026d48c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
push esi
lea ecx, [esp + 0xc]
call fcn.1005ff60
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
lea ecx, [esi + 0x2c0]
mov dword [esp + 0x2c], 0
call fcn.100aa110
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.1005ff90
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0x10
Function at 0x10058460
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x1026e8a8], 0
push edi
jne 0x100585ff
mov al, byte [0x1026e8a9]
test al, al
push esi
jne 0x100585d7
cmp dword [0x1026e8ac], 0
jne 0x100585fe
push 0x100
mov byte [0x1026e8a9], 1
call fcn.100171c0
mov edi, eax
add esp, 4
test edi, edi
je 0x100585fe
xor esi, esi
push ebx
lea ebx, [ebx]
push 8
push esi
call fcn.10058180
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
add esp, 8
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov dword [edi + esi*4], eax
xor edx, edx
mov ecx, 0x1f
test al, 1
je 0x10058580
mov ebx, 1
shl ebx, cl
or edx, ebx
sub ecx, 1
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10058573
mov dword [edi + esi*4], edx
add esi, 1
cmp esi, 0xff
jbe 0x100584b0
cmp dword [0x1026e8ac], 0
pop ebx
jne 0x100585bd
pop esi
mov dword [0x1026e8ac], edi
mov byte [0x1026e8a8], 1
mov byte [0x1026e8a9], 0
pop edi
ret
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
mov byte [0x1026e8a8], 1
mov byte [0x1026e8a9], 0
pop edi
ret
xor esi, esi
test al, al
je 0x100585fe
lea ecx, [ecx]
push 2
call fcn.1002ace0
add esi, 1
add esp, 4
cmp esi, 0xc8
ja 0x100585fe
cmp byte [0x1026e8a9], 0
jne 0x100585e0
pop esi
pop edi
ret