joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100941c0
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
xor esi, esi
cmp dword [0x10327204], esi
push edi
jne 0x100941fc
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x100941f2
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x10327200], eax
mov dword [0x10327204], 1
mov eax, dword [0x10327200]
test eax, eax
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x10094219
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x10094255
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
jne 0x1009424a
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [esp + 0x14]
jns 0x1009423a
mov ecx, dword [eax + 8]
mov edx, dword [eax]
jmp 0x10094240
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 4]
push ecx
call edx
test eax, eax
je 0x1009425d
mov dword [ebp], eax
push edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x10094370
Capabilities:
Get graphical window text

Disassembly:
movsx eax, word [esp + 4]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + 4]
sub esp, 0x80
push esi
push eax
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x100943d2
push 0x80
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0x10
push 0x10
lea ecx, [esp + 0x10]
push 1
push ecx
mov byte [esp + eax + 0x18], 0
call fcn.10094270
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
je 0x100943d2
push eax
push 1
push 0xf7
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
add esp, 0x80
ret 4

Function at 0x100945d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push edi
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x1009462e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [esi + 4]
push 5
mov dword [edx + 0xc], eax
movsx eax, word [esi + 0x12]
movsx ecx, word [esi + 0x10]
mov edx, dword [esi + 4]
push 0
push 0
push eax
mov eax, dword [edx + 4]
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
push 5
push edx
call edi
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
push 9
push eax
call edi
mov ecx, dword [esi + 4]
pop edi
mov byte [ecx + 0x1a], 1
pop esi
ret
Function at 0x100946b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov byte [esi + 0x54], 0
mov byte [eax + 0x1a], 0
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10094725
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
lea edx, [esp + 4]
push edx
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dx, word [esp + 4]
mov ax, word [esp + 8]
mov ecx, dword [esi + 4]
mov word [esi + 0x10], dx
mov word [esi + 0x12], ax
mov edx, dword [ecx + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10094725
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
add esp, 0x10
ret

Function at 0x10094d50
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
push esi
push 1
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
xor ebx, ebx
push ebx
push ebx
push ecx
lea edx, [esp + 0x1c]
push edx
call ebp
cmp eax, 1
jne 0x10094e9e
push edi
lea esp, [esp]
mov eax, dword [esi + 4]
cmp byte [eax + 0x1a], bl
je 0x10094e4e
mov eax, dword [esp + 0x14]
cmp eax, 0x102
jne 0x10094dc0
mov al, byte [esp + 0x18]
cmp al, 0x20
jge case.0x10094dfc.16
movsx cx, al
push ecx
mov ecx, esi
call fcn.10094410
test al, al
je 0x10094e4e
mov dword [esp + 0x14], ebx
jmp 0x10094e82
cmp eax, 0x104
jne 0x10094ddc
test dword [esp + 0x1c], 0x20000000
jne case.0x10094dfc.16
mov edx, dword [esp + 0x18]
push edx
jmp 0x10094da8
cmp eax, 0x100
jne 0x10094e52
mov eax, dword [esp + 0x18]
movzx edi, ax
movsx eax, ax
add eax, 0xfffffff3
cmp eax, 0xe
ja case.0x10094dfc.14
movzx eax, byte [eax + 0x10094eb8]
jmp dword [eax*4 + 0x10094ea8]
movzx eax, word [esi + 0x14]
cmp ax, bx
je case.0x10094dfc.16
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
mov dword [esp + 0x14], ebx
jmp 0x10094e82
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
test al, al
je 0x10094db7
mov ecx, esi
call fcn.100946b0
mov dword [esp + 0x14], ebx
jmp 0x10094e82
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x10094e48
neg edi
movzx edi, di
push edi
jmp 0x10094da8
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10094e82
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x10094e82
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push 1
push ebx
push ebx
push ecx
lea edx, [esp + 0x20]
push edx
call ebp
cmp eax, 1
je 0x10094d80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10094e03
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
push esi
push 1
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
xor ebx, ebx
push ebx
push ebx
push ecx
lea edx, [esp + 0x1c]
push edx
call ebp
cmp eax, 1
jne 0x10094e9e
push edi
lea esp, [esp]
mov eax, dword [esi + 4]
cmp byte [eax + 0x1a], bl
je 0x10094e4e
mov eax, dword [esp + 0x14]
cmp eax, 0x102
jne 0x10094dc0
mov al, byte [esp + 0x18]
cmp al, 0x20
jge case.0x10094dfc.16
movsx cx, al
push ecx
mov ecx, esi
call fcn.10094410
test al, al
je 0x10094e4e
mov dword [esp + 0x14], ebx
jmp 0x10094e82
cmp eax, 0x104
jne 0x10094ddc
test dword [esp + 0x1c], 0x20000000
jne case.0x10094dfc.16
mov edx, dword [esp + 0x18]
push edx
jmp 0x10094da8
cmp eax, 0x100
jne 0x10094e52
mov eax, dword [esp + 0x18]
movzx edi, ax
movsx eax, ax
add eax, 0xfffffff3
cmp eax, 0xe
ja case.0x10094dfc.14
movzx eax, byte [eax + 0x10094eb8]
jmp dword [eax*4 + 0x10094ea8]
movzx eax, word [esi + 0x14]
cmp ax, bx
je case.0x10094dfc.16
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
mov dword [esp + 0x14], ebx
jmp 0x10094e82
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
test al, al
je 0x10094db7
mov ecx, esi
call fcn.100946b0
mov dword [esp + 0x14], ebx
jmp 0x10094e82
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x10094e48
neg edi
movzx edi, di
push edi
jmp 0x10094da8
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10094e82
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x10094e82
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push 1
push ebx
push ebx
push ecx
lea edx, [esp + 0x20]
push edx
call ebp
cmp eax, 1
je 0x10094d80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x10095180
Capabilities:
Print debug messages

Disassembly:
push edi
xor edi, edi
cmp dword [0x103271fc], edi
je 0x10095196
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x103271f4], edi
je 0x100951a7
mov eax, 1
pop edi
ret 4
cmp dword [0x103271fc], edi
push esi
jne 0x100951b9
call fcn.10094f90
test eax, eax
je 0x100951fb
mov eax, dword [0x10327218]
test eax, eax
mov esi, dword [0x101947ec]
jne 0x100951e5
push str.ActivateActCtx
push 0x10327208
push 0x1015ae1c
call fcn.100941c0
test eax, eax
mov dword [0x10327218], eax
je 0x100951fb
mov ecx, dword [esp + 0xc]
push ecx
push esi
call eax
test eax, eax
je 0x100951fb
pop esi
mov eax, 1
pop edi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x10095210
cmp eax, 0x7e
je 0x10095210
cmp eax, 0x78
jne 0x1009521f
mov eax, 1
pop esi
mov dword [0x103271f4], eax
pop edi
ret 4
pop esi
mov eax, edi
pop edi
ret 4
Function at 0x10096ef0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10149a06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
xor edi, edi
lea ecx, [esi + 8]
mov dword [esp + 0x14], edi
mov dword [esi], vtable.ScScript::ScopeInfo.0
call fcn.1009dbc0
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 1
call fcn.1009dbc0
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 2
call fcn.100aec40
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 4], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 0x10000
mov dword [esi + 0x14], 0xffffffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100a7210
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014a9aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
je 0x100a7268
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push str.__ul_
push ecx
call fcn.100a13b0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0x206f626a
call eax
mov esi, eax
test esi, esi
je 0x100a7364
mov edi, dword [ebp + 8]
mov edx, dword [esi]
mov ebx, dword [ebp + 0xc]
mov eax, dword [edx + 0x54]
push 0xe0010000
push edi
push ebx
mov ecx, esi
call eax
test eax, eax
je 0x100a7364
lea ecx, [ebx + 0x270f]
cmp ecx, 0x4e1e
mov ecx, esi
ja 0x100a72dd
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [eax]
push ebx
add ecx, 0xc
push ecx
push str.LiveObject___ls__.property__ld_
push edi
call fcn.100a13b0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, ebx
and edx, 0xf0f0f0f0
cmp edx, 0x20202020
jb 0x100a7348
mov eax, ebx
sar eax, 0x18
mov byte [ebp - 0x11], al
mov eax, ebx
sar eax, 0x10
mov byte [ebp + 0xf], al
mov eax, ebx
sar eax, 8
mov byte [ebp + 0x13], al
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
call edx
movzx edx, byte [ebp + 0x13]
mov eax, dword [eax]
movzx ecx, bl
push ecx
movzx ecx, byte [ebp + 0xf]
push edx
movzx edx, byte [ebp - 0x11]
push ecx
push edx
add eax, 0xc
push eax
push str._LiveObject___ls__.property__c_c_c_c_
push edi
call fcn.100a13b0
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [eax]
push ebx
add ecx, 0xc
push ecx
push str.LiveObject___ls__.property_0x_08lx_
push edi
call fcn.100a13b0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a87d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014aadb
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax], 1
push edi
jle 0x100a87f9
call fcn.100a7e90
xor edi, edi
xor eax, eax
xor bl, bl
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov word [esp + 0x2c], di
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], edi
call fcn.1009dbc0
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
call fcn.1009dbc0
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 2
call fcn.1009edd0
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 3
call fcn.1009f800
mov edx, dword [esp + 0xc]
cmp dword [edx], edi
je 0x100a88a0
push ebp
mov ebp, dword [esp + 0x48]
push ebp
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
call fcn.100a5010
add esp, 0x10
test eax, eax
sete bl
test bl, bl
je 0x100a889f
mov edx, dword [esi]
mov eax, dword [edx + 8]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov ecx, esi
call fcn.100a8550
mov ecx, eax
call fcn.1009c0a0
mov edx, dword [esp + 0x10]
cmp dword [edx], edi
jne 0x100a8861
pop ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 2
call fcn.1009dbf0
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
call fcn.1009dbf0
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.1009dbf0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.1009b200
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 8

Function at 0x100ab3f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10327294]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x100ab422
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x100ab412
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, esi
call fcn.100b94f0
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [0x10327294]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret

Function at 0x100ab440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1032729c]
test eax, eax
jne 0x100ab49c
mov eax, dword [0x10327294]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100ab49c
push esi
push 0x156
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x100ab476
mov ecx, eax
call fcn.100b9450
mov esi, eax
jmp 0x100ab478
xor esi, esi
cmp byte [0x10327298], 0
jne 0x100ab48b
mov dword [0x1032729c], esi
mov eax, esi
pop esi
ret
mov ecx, dword [0x10327294]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
Function at 0x100ab4a0
Capabilities:
Allocate thread local storage

Disassembly:
cmp byte [esp + 4], 0
je 0x100ab4b3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10327294], eax
ret
call fcn.100ab3f0
mov eax, dword [0x10327294]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, dword [0x1032729c]
test eax, eax
je 0x100ab4f9
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x100ab4e1
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [0x1032729c]
test eax, eax
push esi
mov esi, eax
je 0x100ab4f8
mov ecx, eax
call fcn.100b94f0
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
ret

Function at 0x100abbc0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push 0xc
mov esi, ecx
call fcn.1009d7e0
add esp, 4
mov dword [esi], eax
call fcn.100ab440
mov ecx, dword [esi]
mov edx, dword [eax + 8]
mov dword [ecx + 4], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.100ab680
push eax
push 0x100ab860
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [0x103272b4]
test eax, eax
jne 0x100abc0e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x103272b4], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esi]
mov ecx, dword [0x103272b4]
mov dword [edx + 8], eax
mov eax, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.100b74d0
push 1
call fcn.100abb80
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x100abc40
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0
mov esi, ecx
call fcn.100abb80
mov eax, dword [esi]
add esp, 4
cmp dword [eax], 0
je 0x100abc5d
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
mov eax, dword [0x103272b4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi]
push ecx
call fcn.1009d9f0
add esp, 4
pop esi
ret

Function at 0x100abc80
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x28
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [esp + 8], 0x28
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], edi
call fcn.100b7450
mov edx, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov eax, dword [edx]
add ecx, 0xc
add eax, 0xc
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
mov dword [esp + 0x2c], ecx
or esi, 0x12000
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
call fcn.100abbc0
lea edx, [esp + 8]
push edx
call fcn.100ac140
lea ecx, [esp + 0x34]
mov esi, eax
call fcn.100abc40
pop edi
mov eax, esi
pop esi
add esp, 0x28
ret
Function at 0x100b2f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1014b901
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x30]
call fcn.1009dbc0
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], esi
call fcn.1009dbc0
mov eax, dword [ebp]
cmp dword [eax + 4], esi
mov ebx, 1
mov byte [esp + 0x28], bl
mov dword [esp + 0x14], esi
jle 0x100b3086
push edi
mov dword [esp + 0x14], 0x10
jmp 0x100b2fc5
mov ebx, 1
cmp dword [eax], ebx
jle 0x100b2fd0
mov ecx, ebp
call fcn.100a8d20
mov eax, dword [ebp]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx]
push edx
lea ecx, [esp + 0x14]
call fcn.1009e420
push 9
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.100a0c20
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 2
call fcn.1009e420
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.1009dbf0
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0x34]
push ecx
call fcn.100b2f10
add esp, 4
test al, al
jne 0x100b3058
push 4
call fcn.1009d7e0
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x2c], 3
je 0x100b304a
lea edx, [esp + 0x34]
push edx
mov ecx, eax
call fcn.1009edd0
jmp 0x100b304c
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x30], bl
call fcn.100a9240
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x10]
lea edi, [esp + 0x34]
call fcn.100b2e70
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp]
add dword [esp + 0x14], 4
add ecx, 1
cmp ecx, dword [eax + 4]
mov dword [esp + 0x18], ecx
jl 0x100b2fc0
pop edi
cmp byte [esp + 0x3c], 0
je 0x100b3094
mov ecx, ebp
call fcn.100b3a70
push 0
mov ecx, ebp
call fcn.100a8ef0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.1009dbf0
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.1009dbf0
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x100b5ec0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014bd4c
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x16], 0
mov eax, 0x32
je 0x100b5fca
mov edx, dword [esp + 0x1c]
push edi
push edx
lea ecx, [esp + 0x24]
call fcn.1009edd0
mov edi, dword [esi + 4]
mov dword [esp + 0x18], 0
call fcn.100b3b40
cmp dword [edi + 0x12], eax
setne al
cmp byte [esp + 0x24], 0
je 0x100b5f2a
test al, al
je 0x100b5f2a
mov eax, dword [edi + 0x1e]
push eax
lea ecx, [esp + 0x24]
call fcn.1009ea40
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x12]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x2c]
call fcn.1009ef00
mov edi, eax
test edi, edi
jne 0x100b5f73
mov eax, dword [esp + 8]
test eax, eax
je 0x100b5f73
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x16]
mov edx, dword [esp + 0xc]
push ecx
push 1
push eax
push edx
call sub.MSVCR80.dll_fwrite
add esp, 0x10
cmp eax, 1
je 0x100b5f73
mov edi, 0x34
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x16]
push ecx
call sub.MSVCR80.dll_ferror
add esp, 4
test eax, eax
je 0x100b5f9c
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x16]
push eax
call sub.MSVCR80.dll_clearerr
add esp, 4
mov edi, 0x34
jmp 0x100b5fb6
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
call sub.MSVCR80.dll_ftell
mov esi, dword [esi + 4]
add esp, 4
cmp eax, dword [esi + 0x1a]
jle 0x100b5fb6
mov dword [esi + 0x1a], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.1009dbf0
mov eax, edi
pop edi
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x100b62b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1014bdad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x30]
call fcn.1009dbc0
mov ebx, dword [ebp + 4]
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x28], edi
jle 0x100b6340
call fcn.100b5c20
test eax, eax
jl 0x100b6369
mov byte [esp + edi + 0x10], al
add edi, 1
cmp edi, ebx
jl 0x100b62e8
push ebp
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
call fcn.1009f9d0
test eax, eax
mov dword [esp + 0x28], 0xffffffff
jne 0x100b6371
mov ecx, dword [esp + 0x30]
movzx esi, word [ecx + 0xc]
lea ecx, [esp + 0x30]
call fcn.1009dbf0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
call fcn.100b5c20
test eax, eax
lea ecx, [esp + 0x30]
jl 0x100b6390
mov byte [esp + edi + 0x10], al
push ebp
add edi, 1
push edi
lea edx, [esp + 0x18]
push edx
call fcn.1009f9d0
test eax, eax
je 0x100b639a
cmp edi, 0x10
jl 0x100b6340
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.1009dbf0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov dword [esp + 0x28], 0xffffffff
jmp 0x100b6375
mov eax, dword [esp + 0x30]
movzx esi, word [eax + 0xc]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.1009dbf0
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret