joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10077010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103481a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10525930]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
push str.charger
lea ecx, [esp + 0x10]
call fcn.10003680
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0
call fcn.10076ea0
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 0x10
mov esi, eax
jb 0x1007707f
mov eax, dword [esp + 0x14]
push eax
call fcn.1025a370
add esp, 4
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], eax
mov byte [esp + 0x14], al
call fcn.10001370
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.102595a0
add esp, 0x30
ret

Function at 0x100778c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103423f8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x10], 0
call fcn.10003720
mov dword [esp + 0xc], 0xffffffff
cmp dword [esp + 0x30], 0x10
jb 0x10077910
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1025a370
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.10001370
mov eax, esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0x20
Function at 0x100af830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103458e1
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10525930]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x68], 1
call fcn.10015fb0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x64], 2
call fcn.102e4fb0
push esi
mov ecx, eax
mov byte [esp + 0x64], 3
call fcn.1000b290
mov byte [esp + 0x60], 2
cmp dword [esp + 0x30], 8
mov dword [esp + 0xc], 1
jb 0x100af8c1
mov eax, dword [esp + 0x1c]
push eax
call fcn.1025a370
add esp, 4
xor ecx, ecx
mov word [esp + 0x1c], cx
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
call fcn.10001370
mov byte [esp + 0x60], 1
cmp dword [esp + 0x50], 8
jb 0x100af8f6
mov edx, dword [esp + 0x3c]
push edx
call fcn.1025a370
add esp, 4
xor eax, eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], ax
call fcn.10001370
mov byte [esp + 0x60], bl
cmp dword [esp + 0x84], 0x10
jb 0x100af92d
mov ecx, dword [esp + 0x70]
push ecx
call fcn.1025a370
add esp, 4
lea ecx, [esp + 0x68]
mov dword [esp + 0x84], 0xf
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
call fcn.10001370
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.102595a0
add esp, 0x5c
ret

Function at 0x100b0840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035a4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, esi
call fcn.102e4550
push str.system.img
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.10003680
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call fcn.10019eb0
add esp, 4
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x100b08ac
mov eax, dword [esp + 0x10]
push eax
call fcn.1025a370
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.10001370
test edi, edi
je 0x100b08d6
push edi
mov ecx, esi
call fcn.102e4710
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x100b3410
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x103483c3
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4

Function at 0x100b35f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103421f9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x4c]
push eax
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov dword [esp + 0x5c], esp
call fcn.100b3ac0
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov byte [esp + 0x44], 3
mov dword [esp + 0x2c], esp
call fcn.100b3ac0
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x48], 2
call fcn.100b3ae0
add esp, 0x20
mov edi, eax
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 4
call fcn.100011b0
mov edx, dword [edi + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], edx
mov byte [esp + 0x28], 2
call fcn.10001230
lea eax, [esp + 0x34]
push eax
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov ecx, dword [esp + 0x3c]
mov dword [esi + 8], ecx
mov eax, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], al
call fcn.10001230
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], 0
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x100be9b0
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x1053a8ed], 0
jne 0x100bea6a
push ebx
push esi
push edi
xor bl, bl
xor eax, eax
mov cl, 0x80
test bl, cl
je 0x100be9cf
xor eax, 0x80000000
test eax, eax
jns 0x100be9dc
add eax, eax
xor eax, 0x4c11db7
jmp 0x100be9de
add eax, eax
shr cl, 1
jne 0x100be9c6
mov edx, eax
xor esi, esi
xor eax, eax
test dl, 1
je 0x100be9fd
mov ecx, 0x1f
sub ecx, eax
mov edi, 1
shl edi, cl
or esi, edi
inc eax
shr edx, 1
cmp eax, 0x20
jb 0x100be9e8
xor cl, cl
test bl, 1
je 0x100bea0e
mov cl, 0x80
mov al, bl
shr al, 1
test al, 1
je 0x100bea19
or cl, 0x40
shr al, 1
test al, 1
je 0x100bea22
or cl, 0x20
shr al, 1
test al, 1
je 0x100bea2b
or cl, 0x10
shr al, 1
test al, 1
je 0x100bea34
or cl, 8
shr al, 1
test al, 1
je 0x100bea3d
or cl, 4
shr al, 1
test al, 1
je 0x100bea46
or cl, 2
test al, 2
je 0x100bea4d
or cl, 1
add bl, 1
movzx eax, cl
mov dword [eax*4 + 0x1053a8f0], esi
jne 0x100be9c2
pop edi
pop esi
mov byte [0x1053a8ed], 1
pop ebx
ret
Function at 0x100c2410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
lea esi, [esp + 0x10]
call fcn.1015a9f0
mov esi, eax
mov dword [esp + 0x24], 1
push esi
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.100011b0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x100c4b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103421f9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x4c]
push eax
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov dword [esp + 0x5c], esp
call fcn.100b3ac0
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov byte [esp + 0x44], 3
mov dword [esp + 0x2c], esp
call fcn.100b3ac0
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x48], 2
call fcn.100714c0
add esp, 0x20
mov edi, eax
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 4
call fcn.100011b0
mov edx, dword [edi + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], edx
mov byte [esp + 0x28], 2
call fcn.10001230
lea eax, [esp + 0x34]
push eax
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov ecx, dword [esp + 0x3c]
mov dword [esi + 8], ecx
mov eax, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], al
call fcn.10001230
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], 0
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x100d14a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10349238
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10525930]
xor eax, esp
mov dword [esp + 0xc], eax
push ebp
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov edi, ecx
push eax
lea esi, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.100d1540
mov dword [esp + 0x28], 0
movzx eax, byte [esp + 0x14]
neg eax
sbb eax, eax
test eax, fcn.10012a40
mov eax, ebp
je 0x100d1515
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100d15f0
mov eax, ebp
jmp 0x100d1519
mov byte [ebp], 0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.102595a0
add esp, 0x1c
ret 8

Function at 0x100d16d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035a668
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
push 0
mov dword [esp + 0x10], eax
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x38]
push 7
xor ecx, ecx
call fcn.100361d0
mov edi, eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100d176f
mov esi, eax
add eax, 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100d176f
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100d176f
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x100d5e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
lea eax, [esp + 0x10]
call fcn.100d60c0
mov edi, eax
mov dword [esp + 0x24], 1
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x100d5e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
lea eax, [esp + 0x10]
call fcn.100d60e0
mov edi, eax
mov dword [esp + 0x24], 1
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x100d9bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10349238
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10525930]
xor eax, esp
mov dword [esp + 0xc], eax
push ebp
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov edi, ecx
push eax
lea esi, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.100d1540
mov dword [esp + 0x28], 0
movzx eax, byte [esp + 0x14]
neg eax
sbb eax, eax
test eax, fcn.10012a40
je 0x100d9c33
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.100d9d80
jmp 0x100d9c37
mov byte [ebp], 0
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.102595a0
add esp, 0x1c
ret 8

Function at 0x100d9c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10349238
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10525930]
xor eax, esp
mov dword [esp + 0xc], eax
push ebp
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov edi, ecx
push eax
lea esi, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.100d1540
mov dword [esp + 0x28], 0
movzx eax, byte [esp + 0x14]
neg eax
sbb eax, eax
test eax, fcn.10012a40
je 0x100d9cd3
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.100d9e70
jmp 0x100d9cd7
mov byte [ebp], 0
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.102595a0
add esp, 0x1c
ret 8
Function at 0x100e4090
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10345e12
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 1
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x100e40e8
xor edi, edi
jmp 0x100e4128
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100e4820
mov esi, eax
mov byte [esp + 0x28], 2
mov ebx, 1
mov ecx, esi
lea eax, [esp + 0x38]
mov dword [esp + 0x30], ebx
call fcn.100e54a0
mov ecx, dword [esp + 0x40]
sub ecx, dword [esi + 8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [esp + 0x28], 1
test bl, 1
je 0x100e4145
and ebx, 0xfffffffe
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.10001230
mov ecx, dword [esp + 0x44]
push ecx
push 1
sub esp, 0xc
mov esi, esp
lea edx, [esp + 0x4c]
mov dword [esp + 0x58], esp
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov eax, dword [esp + 0x54]
push ebp
mov dword [esi + 8], eax
call fcn.100e4840
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100e4820
mov byte [esp + 0x28], 3
mov esi, dword [esp + 0x34]
push edi
push esi
mov ecx, eax
call fcn.100e4bf0
or ebx, 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
mov byte [esp + 0x28], 1
call fcn.10001230
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 0
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x18
Function at 0x100e9310
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10345e12
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 1
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
test eax, 0xfffffffc
jne 0x100e935a
xor edi, edi
jmp 0x100e938a
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100e95a0
mov esi, eax
mov byte [esp + 0x28], 2
mov ebx, 1
mov ecx, esi
lea eax, [esp + 0x38]
mov dword [esp + 0x30], ebx
call fcn.100ea0a0
mov edi, dword [esp + 0x40]
sub edi, dword [esi + 8]
sar edi, 2
mov dword [esp + 0x28], 1
test bl, 1
je 0x100e93a7
and ebx, 0xfffffffe
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.10001230
mov ecx, dword [esp + 0x44]
push ecx
sub esp, 0xc
mov esi, esp
lea edx, [esp + 0x48]
mov dword [esp + 0x54], esp
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov eax, dword [esp + 0x50]
mov ecx, 1
mov edx, ebp
mov dword [esi + 8], eax
call fcn.100e95c0
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100e95a0
mov byte [esp + 0x28], 3
mov esi, dword [esp + 0x34]
push edi
push esi
mov ecx, eax
call fcn.100e9b10
or ebx, 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
mov byte [esp + 0x28], 1
call fcn.10001230
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 0
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x18

Function at 0x100ea2d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
lea esi, [esp + 0x10]
call fcn.100ea8e0
mov esi, eax
mov dword [esp + 0x24], 1
push esi
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.100011b0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x100ea360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
lea esi, [esp + 0x10]
call fcn.100ea900
mov esi, eax
mov dword [esp + 0x24], 1
push esi
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.100011b0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x100ea500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
lea esi, [esp + 0x10]
call fcn.100ea920
mov esi, eax
mov dword [esp + 0x24], 1
push esi
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.100011b0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x100ea590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
lea esi, [esp + 0x10]
call fcn.100ea940
mov esi, eax
mov dword [esp + 0x24], 1
push esi
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.100011b0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x100eafd0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
or edx, 0xffffffff
call fcn.100eaf20
test esi, esi
je 0x100eafff
movzx eax, byte [edi]
xor edx, eax
mov ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x1053acf8]
dec esi
inc edi
test esi, esi
jne 0x100eafe2
pop edi
mov eax, edx
pop esi
ret
Function at 0x100ef720
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10345e12
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 1
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
mov eax, 0x67b23a55
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x100ef776
xor edi, edi
jmp 0x100ef7b4
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100f5ba0
mov esi, eax
mov byte [esp + 0x28], 2
mov ebx, 1
mov ecx, esi
lea eax, [esp + 0x38]
mov dword [esp + 0x30], ebx
call fcn.100eff80
mov ecx, dword [esp + 0x40]
sub ecx, dword [esi + 8]
mov eax, 0x67b23a55
imul ecx
sar edx, 8
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [esp + 0x28], 1
test bl, 1
je 0x100ef7d1
and ebx, 0xfffffffe
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.10001230
mov ecx, dword [esp + 0x44]
push ecx
push 1
sub esp, 0xc
mov esi, esp
lea edx, [esp + 0x4c]
mov dword [esp + 0x58], esp
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov eax, dword [esp + 0x54]
mov ecx, ebp
mov dword [esi + 8], eax
call fcn.100efa80
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100f5ba0
mov byte [esp + 0x28], 3
mov esi, dword [esp + 0x34]
push edi
push esi
mov ecx, eax
call fcn.100efe20
or ebx, 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
mov byte [esp + 0x28], 1
call fcn.10001230
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 0
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x18