joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415090
sar esi, 1
lea edi, [esp + 0x80]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x441d68]
mov ebx, dword [esp + 0x80]
test ebx, ebx
jns 0x4150c5
mov eax, 0xffffffff
jmp 0x4150c8
lea eax, [ebx + ebx]
push eax
call fcn.00408f60
add esp, 4
push edi
push ebx
mov dword [esp + 0x1c], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x441d68]
mov dword [esp + 0x20], 0x338e319c
mov dword [esp + 0x24], 0x37a53595
mov dword [esp + 0x28], 0x2b4a29bc
mov dword [esp + 0x2c], 0x2f8b2d9a
mov dword [esp + 0x30], 0x23b121b2
mov dword [esp + 0x34], 0x27b925bd
mov dword [esp + 0x38], 0x1b1a1986
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x98], 0
mov ecx, dword [esp + 0x98]
cmp ecx, 0x1f
ja 0x41519c
nop
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x98]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx - 0x26924278]
mov edi, edx
not edi
or edi, esi
and esi, edx
add esi, edi
neg esi
add ecx, esi
add ecx, 0xd96dbd87
mov dword [esp + 0xb4], ecx
mov ecx, dword [esp + 0xb4]
add cl, 0x48
mov edx, dword [esp + 0x98]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0x98]
mov ecx, dword [esp + 0x98]
cmp ecx, 0x20
jb 0x415140
lea edi, [esp + 0x98]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x80]
mov ecx, eax
add ecx, 0xd
jns 0x4151d5
mov eax, 0xffffffff
jmp 0x4151da
add eax, eax
add eax, 0x1a
mov esi, dword [esp + 0x14]
push eax
call fcn.00408f60
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x415211
lea edx, [esi + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415200
mov word [eax], 0
movzx ecx, word [esp + 0x98]
test cx, cx
je 0x415241
lea edx, [esp + 0x9a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415230
mov word [eax], 0
lea eax, [esp + 0x54]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00436890
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43cce0]

Function at 0x4161d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov edi, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 8], 0
jmp dword [eax*4 + 0x43ce30]
Function at 0x417760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x417780
sar ebx, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x441d68]
mov esi, dword [esp + 4]
test esi, esi
jns 0x4177af
mov eax, 0xffffffff
jmp 0x4177b2
lea eax, [esi + esi]
push eax
call fcn.00408f60
add esp, 4
lea ecx, [esp + 4]
push ecx
push esi
mov esi, eax
push eax
push ebx
push edi
push 0
call dword [0x441d68]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00436a70
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43d01c]
Function at 0x41f0c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x868
lea ebx, [esp + 0xec]
mov eax, 0x20219
mov ecx, 1
xor esi, esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
jmp dword [ecx*4 + 0x43e0b4]
Function at 0x42b300
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42b4b3
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x42b4ad
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.0040c8f0
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 0
je 0x42b499
mov ecx, dword [ebp + 8]
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov bl, byte [esp + 0x14]
mov byte [esp + 0x1c], bl
mov byte [esp + 0x20], 3
mov byte [esp + 0x21], 0x39
mov byte [esp + 0x22], 0x23
mov byte [esp + 0x23], 0x3b
mov byte [esp + 0x24], 0x26
mov byte [esp + 0x25], 0x3a
mov byte [esp + 0x26], 0x37
mov byte [esp + 0x27], 0x29
mov byte [esp + 0x28], 0x38
mov byte [esp + 0x29], 0x67
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2b], 0x2b
mov byte [esp + 0x2c], 0x2c
mov byte [esp + 0x2d], 0x51
mov dword [esp + 0x2e], 0
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x10]
cmp esi, 0x12
jae 0x42b47a
mov dword [esp + 0x40], edi
jmp 0x42b413
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
movzx eax, byte [esp + edi + 0x20]
mov edi, esi
add edi, 0xb1f4f14a
mov ebx, eax
not ebx
or edi, ebx
mov ebx, eax
add ebx, edi
lea edi, [esi + eax - 0x4e0b0eb6]
add esi, 0x4a
and esi, eax
lea eax, [esi + ebx + 1]
mov esi, edi
not esi
mov ebx, eax
and ebx, esi
not eax
and edi, eax
sub edi, ebx
mov dword [esp + 0x44], edi
mov eax, dword [esp + 0x44]
add al, 0xfa
mov esi, dword [esp + 0x10]
mov byte [esp + esi + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x12
jb 0x42b413
mov edi, dword [esp + 0x40]
jmp 0x42b47a
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
call fcn.00409950
sub esp, 0xc
and al, 1
mov byte [esp + 0xf], al
jmp 0x42b499
jmp 0x42b49b
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42b4ad
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x430ea0
mov eax, esi
and eax, 0xfffffffc
mov dword [esp], esi
mov ecx, dword [esp]
and ecx, 3
mov edx, dword [esp]
or edx, 3
imul edx, ecx
xor ecx, 3
imul ecx, eax
add edx, ecx
mov ecx, dword [esp]
shr edx, 2
movzx eax, byte [edi + ecx - 1]
cmp eax, 0x3d
je 0x430ede
cmp eax, 0x2e
jne 0x430edf
dec edx
movzx eax, byte [edi + ecx - 2]
cmp eax, 0x3d
je 0x430eee
cmp eax, 0x2e
jne 0x430eef
dec edx
mov dword [esp + 4], edx
mov edx, 0
test ecx, ecx
je 0x430fe7
xor esi, esi
mov ebp, 2
jmp 0x430f22
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, ecx
mov ebp, eax
jae 0x430fe7
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.00417640
add esp, 4
mov ebx, eax
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.00417640
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
mov ecx, dword [esp]
cmp ebp, ecx
jae 0x430f10
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 0xc], edx
call fcn.00417640
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
add esp, 4
cmp al, 0x40
je 0x430f10
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 1], al
mov ecx, dword [esp]
lea eax, [ebp + 1]
cmp eax, ecx
jae 0x430f10
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
mov dword [esp + 0xc], edx
call fcn.00417640
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
add esp, 4
cmp al, 0x40
je 0x430f10
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
mov ecx, dword [esp]
add esi, 3
mov edx, esi
jmp 0x430f10
mov ecx, dword [esp + 4]
cmp edx, ecx
mov eax, 0
jne 0x431097
mov ebp, dword [esp + 0x44]
lea esi, [ebp + 0x20]
mov eax, ecx
or eax, 0xffffffdf
mov ebx, ecx
and ebx, 0xffffffdf
add ebx, eax
mov dword [esp + 4], ecx
lea edi, [esp + 0xc]
mov eax, ebp
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor edx, edx
xor ecx, ecx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov eax, ebx
inc eax
je 0x431092
mov esi, dword [esp + 4]
mov ecx, esi
and ecx, 1
cmp esi, 0x21
je 0x43107c
mov edi, eax
sub edi, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x1e
movzx ebx, byte [esp + esi + 0xc]
xor bl, byte [ebp + edx + 0x20]
mov byte [ebp + edx], bl
lea esi, [edx + 1]
and esi, 0x1f
movzx ebx, byte [esp + esi + 0xc]
xor bl, byte [ebp + edx + 0x21]
mov byte [ebp + edx + 1], bl
add edx, 2
cmp edi, edx
jne 0x431050
test ecx, ecx
je 0x431092
mov ecx, edx
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [ebp + edx + 0x20]
mov byte [ebp + edx], cl
mov byte [ebp + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43fac4]
Function at 0x435d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
movzx eax, word [esi]
mov dword [esp + 0x10], 0x4342e3f1
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 7
ja 0x435d9e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
add ecx, 0xdba4dcf6
xor ecx, edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
mov edx, ecx
or edx, 0x45
and ecx, 0x45
add ecx, edx
inc cl
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 8
jb 0x435d60
xor ecx, ecx
cmp dword [esp + 0x10], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x440874]
mov edx, dword [esi + 0x3c]
mov esi, dword [esi + edx]
mov dword [esp + 0x10], 0xb3b27440
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xb
ja 0x435e21
nop
mov ecx, dword [esp + 4]
mov edi, dword [esp + 4]
movzx edi, byte [esp + edi + 0x10]
lea ebx, [ecx - 0x3c3b2c98]
and ebx, edi
add ecx, edi
add ecx, 0xc3c4d368
add ebx, ebx
sub ecx, ebx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 0x28
mov edi, dword [esp + 4]
mov byte [esp + edi + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xc
jb 0x435de0
xor ecx, ecx
cmp esi, dword [esp + 0x10]
setne cl
mov edi, dword [ebp + 8]
jmp dword [ecx*4 + 0x44087c]
mov esi, dword [edi + edx + 0x7c]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x440884]
mov edx, dword [edi + edx + 0x78]
mov ecx, dword [case.0x435e2d.6]
jmp ecx
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x44089c]
mov eax, dword [edi + edx + 0x20]
add eax, edi
mov dword [esp + 0x38], eax
mov eax, dword [0x4408ac]
nop
jmp eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x101383a4
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x10002494
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR120.dll_fwrite]
push esi
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 0x14
pop esi
pop ebp
ret

Function at 0x10002940
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ebx
cdq
and edx, 3
add edx, eax
sar edx, 2
push esi
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ecx + edx*4]
neg edx
je 0x10002991
jmp 0x10002970
imul eax, dword [edi + edx*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
inc edx
jne 0x10002970
mov eax, ebx
xor ecx, ecx
and eax, 3
dec eax
je 0x100029b1
dec eax
je 0x100029a8
dec eax
jne 0x100029c7
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, ebx
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
pop ebp
ret

Function at 0x100034d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10127458
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
call fcn.100211f0
mov eax, dword [ebp + 8]
mov dword [esi], vtable.gl::Buffer.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x88e8
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
push 0x24
mov dword [ebp - 4], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x10003579
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xbad_alloc_void_]
lea ecx, [eax + 4]
mov dword [eax], eax
test ecx, ecx
je 0x10003584
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x1000358d
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x40], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000ffb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10127201
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
mov dword [esi], 0
mov dword [esi + 4], eax
call fcn.10003240
push 0xa0
mov dword [ebp - 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x10010019
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xbad_alloc_void_]
lea ecx, [eax + 4]
mov dword [eax], eax
test ecx, ecx
je 0x10010024
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x1001002d
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x14], eax
push 0x14
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x1001005c
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xbad_alloc_void_]
lea ecx, [eax + 4]
mov dword [eax], eax
test ecx, ecx
je 0x10010067
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x10010070
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x1c], eax
lea ecx, [esi + 0x25]
mov byte [ebp - 4], 2
mov byte [esi + 0x24], 0
call fcn.10004020
lea ecx, [esi + 0x26]
call fcn.10004380
mov dword [esi + 0x44], 0xf
mov eax, esi
mov dword [esi + 0x40], 0
mov byte [esi + 0x30], 0
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], 0
mov byte [esi + 0x48], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10027f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10128138
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.100211f0
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [esi], vtable.egl::Surface.0
mov dword [esi + 0x14], eax
mov word [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0x305c
mov dword [esi + 0x28], 0x305c
mov dword [esi + 0x2c], 0x2710
mov dword [esi + 0x30], 0x3084
mov dword [esi + 0x34], 0x3094
mov dword [esi + 0x38], 0
call fcn.10021250
mov edi, dword [ebp + 0x14]
mov ecx, edi
push 0
push 0x30be
mov eax, dword [edi]
call dword [eax + 8]
cmp eax, 1
mov ecx, edi
push 0
sete al
mov byte [esi + 0x18], al
mov eax, dword [edi]
push 0x3201
call dword [eax + 8]
cmp eax, 1
sete al
mov byte [esi + 0x19], al
test al, al
je 0x10027ffc
mov eax, dword [edi]
mov ecx, edi
push 0
push 0x3057
call dword [eax + 8]
mov dword [esi + 0x1c], eax
mov ecx, edi
mov eax, dword [edi]
push 0
push 0x3056
call dword [eax + 8]
mov dword [esi + 0x20], eax
cmp dword [esi + 0x10], 4
je 0x1002802a
mov eax, dword [edi]
mov ecx, edi
push 0x305c
push 0x3080
call dword [eax + 8]
mov dword [esi + 0x24], eax
mov ecx, edi
mov eax, dword [edi]
push 0x305c
push 0x3081
call dword [eax + 8]
mov dword [esi + 0x28], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100526b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012af88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10036a40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
cmp dword [ebp + 0x1c], 1
push dword [ebp + 0x24]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
sete al
mov dword [esi], vtable.rx::SurfaceD3D.0
mov byte [esi + 0xc], al
mov eax, dword [ecx]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 4]
lea ecx, [esi + 0x20]
mov dword [ebp - 4], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
mov word [esi + 0x1c], 1
call fcn.100b3de0
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], eax
call fcn.10052f40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x10052a20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012aff3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x34
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x10052ad6
mov ecx, esi
call fcn.10036a40
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], vtable.rx::SurfaceD3D.0
mov dword [esi + 8], eax
mov byte [esi + 0xc], 1
mov eax, dword [ecx]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 4]
lea ecx, [esi + 0x20]
push 0
mov byte [ebp - 4], 1
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
mov word [esi + 0x1c], 1
call fcn.100b3de0
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x30], ecx
mov ecx, esi
mov dword [esi + 0x2c], 1
call fcn.10052f40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10071ea0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10071eb4
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10071ec6
call fcn.10071e30
mov eax, dword [eax + 4]
ret

Function at 0x10071ed0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10071ee4
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10071ef6
call fcn.10071e30
mov eax, dword [eax + 0x14]
ret

Function at 0x10071f00
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10071f14
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10071f26
call fcn.10071e30
mov eax, dword [eax + 8]
ret

Function at 0x10071f30
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10071f44
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10071f56
call fcn.10071e30
mov eax, dword [eax + 0xc]
ret

Function at 0x10071f60
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10071f74
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10071f86
call fcn.10071e30
mov eax, dword [eax]
ret

Function at 0x10071f90
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10071fa4
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10071fb6
call fcn.10071e30
mov eax, dword [eax + 0x10]
ret