joyce8/EMBER2024-capa huggingface dataset:
Function at 0x109d6bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e12db9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x84], 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 8
call fcn.109d3b40
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x88], 2
call fcn.109d5cd0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x88], 4
call fcn.109d3750
test eax, eax
je 0x109d6d21
push 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x21
call fcn.109b8e40
mov esi, dword [esp + 0x90]
mov edx, dword [esp + 0xc]
mov dword [edx], esi
push edi
jmp 0x109d6c80
cmp esi, ebx
je 0x109d6c89
mov eax, dword [esi + 4]
jmp 0x109d6c8b
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
dec ecx
and ecx, eax
mov eax, dword [edx + ecx*4]
cmp eax, 0xffffffff
je 0x109d6cb8
mov edx, dword [esp + 0x1c]
mov ecx, eax
shl ecx, 4
mov edi, dword [ecx + edx + 4]
add ecx, edx
cmp edi, esi
je 0x109d6d17
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x109d6ca2
xor eax, eax
cmp dword [eax], ebx
je 0x109d6d20
mov ecx, dword [esp + 0x14]
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x18]
mov edi, ecx
inc ecx
cmp ecx, eax
mov dword [esp + 0x14], ecx
jle 0x109d6cf3
lea eax, [ecx + ecx*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
lea edx, [eax + ecx + 0x20]
push 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], edx
call fcn.109b8e40
lea eax, [edi*4]
push eax
mov eax, dword [esp + 0x14]
push eax
add eax, 4
push eax
call fcn.109b8a80
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [ecx], esi
jmp 0x109d6c80
shl eax, 4
lea eax, [eax + edx + 8]
jmp 0x109d6cba
pop edi
mov esi, dword [esp + 0x8c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.109d4070
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x84], 3
call fcn.10914c70
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0x10e48600
mov byte [esp + 0x84], bl
call fcn.109d54f0
mov ecx, dword [esp + 0x7c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x80
ret
Function at 0x109fdff0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
rdtsc
mov dword [0x10fab810], edx
mov dword [0x10fab80c], eax
mov eax, dword [0x10fab80c]
mov esi, dword [ecx + 0x10038]
mov edx, dword [ecx + 0x1c]
sub esi, eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x10050], eax
mov dword [ecx + 0x1004c], eax
mov dword [ecx + 0x10048], eax
mov dword [ecx + 0x10040], eax
mov dword [ecx + 0x1003c], eax
mov eax, dword [ecx + 0x18]
cmp eax, edx
mov dword [ecx + 0x10038], esi
je 0x109fe069
mov edx, dword [eax]
or edx, dword [eax + 4]
je 0x109fe061
movzx edx, word [eax + 0xc]
cmp dword [ecx + 4], edx
jle 0x109fe061
mov edx, dword [eax + 0x10]
mov esi, edx
sar esi, 5
sub edx, esi
mov dword [eax + 0x10], edx
mov eax, dword [eax + 0x14]
cmp eax, dword [ecx + 0x1c]
jne 0x109fe044
inc dword [ecx + 4]
rdtsc
mov dword [0x10fab810], edx
mov dword [0x10fab80c], eax
mov eax, dword [0x10fab80c]
mov edx, dword [ecx + 0x10038]
add eax, 0xfffffff4
add edx, eax
mov dword [ecx + 0x10038], edx
pop esi
ret
Function at 0x10a00530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e14382
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.109c2d60
mov eax, dword [esp + 0x20]
mov dword [esi + 0x2c], eax
xor ebx, ebx
lea eax, [esi + 0x30]
mov dword [esi], 0x10e65a38
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], eax
mov dword [eax + 0x34], ebx
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], ebx
mov ecx, 0x40
mov edi, dword [esp + 0x20]
xor eax, eax
mov edx, ecx
shr ecx, 2
and edx, 3
rep stosd dword es:[edi], eax
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov edi, dword [esp + 0x24]
push edi
lea ecx, [esi + 0x98]
mov byte [esp + 0x1c], 4
mov dword [esi + 0x94], 0x1e240
call fcn.10902ec0
cmp dword [esi + 0x2c], ebx
mov byte [esp + 0x18], 5
mov dword [esi + 0xa4], ebx
jne 0x10a00600
push 0xac
push str..UnLinker.cpp
push str.LinkerRoot
call fcn.109bb190
add esp, 0xc
cmp edi, ebx
jne 0x10a0061b
push 0xad
push str..UnLinker.cpp
push str.InFilename
call fcn.109bb190
add esp, 0xc
cmp dword [0x10fceeec], ebx
je 0x10a0062d
or dword [esi + 0xa4], 0x40000
cmp dword [0x10fceef8], ebx
je 0x10a0063f
or dword [esi + 0xa4], 0x10000
cmp dword [0x10fceefc], ebx
je 0x10a00651
or dword [esi + 0xa4], 0x20000
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x10a04670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e146ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.109c2d60
xor edi, edi
mov dword [esi], 0x10e70a78
mov dword [esp + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea ecx, [esi + 0x38]
mov dword [esp + 0xc], ecx
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov byte [esp + 0x18], 2
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], 8
call fcn.10a02e00
lea ecx, [esi + 0x4c]
mov dword [esp + 0xc], ecx
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov byte [esp + 0x18], 4
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], 8
call fcn.10a02e90
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10a04688
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e146ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.109c2d60
xor edi, edi
mov dword [esi], 0x10e70a78
mov dword [esp + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea ecx, [esi + 0x38]
mov dword [esp + 0xc], ecx
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov byte [esp + 0x18], 2
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], 8
call fcn.10a02e00
lea ecx, [esi + 0x4c]
mov dword [esp + 0xc], ecx
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov byte [esp + 0x18], 4
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], 8
call fcn.10a02e90
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10a04cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e14839
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], 1
xor esi, esi
movzx eax, byte [esi + edi]
push eax
lea ecx, [esp + 0x1c]
push 0x10e6e524
push ecx
call fcn.109bc8a0
add esp, 0xc
cmp dword [eax + 4], ebx
mov byte [esp + 0x2c], 2
je 0x10a04d4b
mov eax, dword [eax]
jmp 0x10a04d50
mov eax, 0x10e43c3c
push eax
lea ecx, [esp + 0x10]
call fcn.109059d0
push 2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.109b8e40
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call fcn.109148d0
inc esi
cmp esi, 0x10
jl 0x10a04d26
mov esi, dword [esp + 0x34]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.10905950
mov dword [esp + 8], 1
push 2
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.109b8e40
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], bl
call fcn.109148d0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x10a067b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e14d99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
lea eax, [esp + 0x18]
push edi
xor esi, esi
push eax
mov dword [esp + 0x10], esi
call fcn.10a05a00
add esp, 4
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, eax
mov dword [esp + 0x38], 1
call fcn.109058d0
push 2
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 4
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call fcn.109b8e40
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.109148d0
cmp dword [esp + 0x14], esi
mov esi, dword [esp + 0x10]
jne 0x10a0682c
mov esi, 0x10e43c3c
mov edi, dword [esp + 0x38]
mov ebx, edi
call fcn.10a04de0
mov dword [esp + 0xc], 1
xor ebx, ebx
push 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 5
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.109b8e40
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.109148d0
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x10a09f00
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10e150aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0xcc]
mov dword [esp + 0x10], 0x10
call fcn.109217b0
lea ecx, [esi + 0xc0]
mov byte [esp + 0x10], 0xf
call fcn.10914dd0
lea ecx, [esi + 0xb4]
mov byte [esp + 0x10], 0xe
call fcn.1093dd10
lea ecx, [esi + 0xa8]
mov byte [esp + 0x10], 0xd
call fcn.10921a10
lea ecx, [esi + 0x9c]
mov byte [esp + 0x10], 0xc
call fcn.109217b0
lea ecx, [esi + 0x90]
mov byte [esp + 0x10], 0xb
call fcn.10914dd0
lea ecx, [esi + 0x84]
mov byte [esp + 0x10], 0xa
call fcn.1093dd10
lea ecx, [esi + 0x78]
mov byte [esp + 0x10], 9
call fcn.10921a10
lea ecx, [esi + 0x6c]
mov byte [esp + 0x10], 8
call fcn.10921a10
lea ecx, [esi + 0x60]
mov byte [esp + 0x10], 7
call fcn.10921a10
lea ecx, [esi + 0x54]
mov byte [esp + 0x10], 6
call fcn.1093dd10
lea ecx, [esi + 0x48]
mov byte [esp + 0x10], 5
call fcn.10995cf0
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 4
call fcn.1093dd10
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 3
call fcn.10921a10
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.10921a10
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.1093dd10
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 0
call fcn.10921a10
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.10921a10
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10a143c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x58], eax
mov dword [esp + 0x4c], eax
push ebp
mov dword [esp + 0x28], 0
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x30]
push esi
mov dword [esp + 0x30], 0
mov esi, dword [esp + 0x30]
mov dword [esp + 0x64], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x24], eax
lea edx, [ecx + 8]
lea eax, [ecx + 4]
push edi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x60], esi
mov byte [esp + 0x70], 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], 2
lea ebx, [ebx]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 2
mov ebx, dword [esp + 0x24]
mov ebp, 2
lea esp, [esp]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
fld dword [edx]
fld dword [eax]
mov ecx, dword [ebx]
fxch st(1)
mov dword [esp + 0x40], ecx
fstp dword [esp + 0x38]
mov dword [esp + 0x44], 0x3f800000
fstp dword [esp + 0x3c]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x7c]
lea edi, [esp + 0x48]
fld dword [esi]
fmul dword [edx]
fld dword [esi]
fmul dword [edx + 4]
fld dword [esi]
fmul dword [edx + 8]
fld dword [esi]
fmul dword [edx + 0xc]
fld dword [esi + 4]
fmul dword [edx + 0x10]
fld dword [esi + 4]
fmul dword [edx + 0x14]
fld dword [esi + 4]
fmul dword [edx + 0x18]
fld dword [esi + 4]
fmul dword [edx + 0x1c]
fxch st(3)
faddp st(7)
faddp st(4)
faddp st(4)
faddp st(1)
fld dword [esi + 8]
fmul dword [edx + 0x20]
fld dword [esi + 8]
fmul dword [edx + 0x24]
fld dword [esi + 8]
fmul dword [edx + 0x28]
fld dword [esi + 8]
fmul dword [edx + 0x2c]
fxch st(3)
faddp st(7)
faddp st(4)
faddp st(4)
faddp st(1)
fld dword [esi + 0xc]
fmul dword [edx + 0x30]
fld dword [esi + 0xc]
fmul dword [edx + 0x34]
fld dword [esi + 0xc]
fmul dword [edx + 0x38]
fld dword [esi + 0xc]
fmul dword [edx + 0x3c]
fxch st(3)
faddp st(7)
faddp st(4)
faddp st(4)
faddp st(1)
fxch st(3)
fstp dword [edi]
fxch st(1)
fstp dword [edi + 4]
fstp dword [edi + 8]
fstp dword [edi + 0xc]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x34], ecx
push edx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x34], eax
call fcn.10971530
add ebx, 0xc
dec ebp
jne 0x10a14450
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, 0xc
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x10a14440
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
add ecx, 0xc
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x10a14430
mov eax, dword [esp + 0x78]
mov ecx, 7
lea esi, [esp + 0x58]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 8
Function at 0x10a286f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e16726
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.109c2d60
xor eax, eax
mov dword [esi], 0x10e7cbe8
mov dword [esp + 0x14], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x44]
mov dword [esp + 8], ecx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov byte [esp + 0x14], 3
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], 8
call fcn.10943170
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10a2b31f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e16811
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x40], 1
call fcn.10a28e10
cmp dword [esi + 0x60], ebx
je 0x10a2b38f
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x20]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x48]
mov dword [edx + 4], ecx
push ebx
push esi
mov dword [edx + 8], eax
call fcn.10a2b000
add esp, 0x24
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.10a2a020
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x38], bl
call fcn.109217b0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 0x20
Function at 0x10a5f082
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 0x420]
push edi
xor ebx, ebx
push 0xc
mov ecx, ebp
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
call fcn.109b8e40
mov eax, dword [esi + 0x3d8]
xor edi, edi
cmp eax, ebx
jle 0x10a5f156
lea ecx, [ecx]
mov eax, dword [esi + 0x3d4]
mov eax, dword [eax + edi*4]
cmp eax, ebx
je 0x10a5f147
lea ecx, [eax + 0x74]
push 0xc
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.109b8e40
mov ecx, dword [esi + 0x3d4]
mov edx, dword [ecx + edi*4]
push ebp
push edx
push esi
mov ecx, 0x110b8410
call fcn.10b98ea0
push eax
push esi
mov ecx, 0x110b8410
call fcn.10b99ae0
mov eax, dword [esi + 0x3d4]
mov eax, dword [eax + edi*4]
lea ecx, [eax + 0x74]
push ecx
push eax
push esi
mov ecx, 0x110b8410
call fcn.10b98ea0
push eax
push esi
mov ecx, 0x110b8410
call fcn.10b99ae0
mov edx, dword [esi + 0x3d4]
mov eax, dword [edx + edi*4]
test byte [eax + 0x68], 1
je 0x10a5f147
fld dword [0x10e4500c]
fld dword [eax + 0x6c]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x10a5f147
mov eax, edx
mov eax, dword [eax + edi*4]
fld dword [eax + 0x70]
fdiv dword [eax + 0x6c]
fstp dword [eax + 0x3c]
mov eax, dword [esi + 0x3d8]
inc edi
cmp edi, eax
jl 0x10a5f0b0
cmp dword [0x10fceeec], ebx
pop edi
je 0x10a5f169
mov ecx, esi
pop esi
pop ebp
pop ebx
jmp fcn.10a5e770
pop esi
pop ebp
pop ebx
ret
Function at 0x10a68d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e1bb38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov edi, dword [esp + 0x44]
lea eax, [esp + 0xc]
cmp eax, edi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x30], esi
je 0x10a68e15
mov eax, dword [edi + 4]
push 2
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
call fcn.109b8e40
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x10a68e15
cmp dword [edi + 4], esi
je 0x10a68dfe
mov edi, dword [edi]
jmp 0x10a68e03
mov edi, 0x10e43c3c
mov edx, dword [esp + 0xc]
lea ecx, [eax + eax]
push ecx
push edi
push edx
call fcn.10902f60
add esp, 0xc
mov edi, dword [esp + 0x48]
lea eax, [esp + 0x18]
cmp eax, edi
je 0x10a68e5f
mov eax, dword [edi + 4]
push 2
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
call fcn.109b8e40
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x10a68e5f
cmp dword [edi + 4], esi
je 0x10a68e48
mov edi, dword [edi]
jmp 0x10a68e4d
mov edi, 0x10e43c3c
mov edx, dword [esp + 0x18]
lea ecx, [eax + eax]
push ecx
push edi
push edx
call fcn.10902f60
add esp, 0xc
mov edi, dword [esp + 0x4c]
lea eax, [esp + 0x24]
cmp eax, edi
je 0x10a68ea9
mov eax, dword [edi + 4]
push 2
lea ecx, [esp + 0x28]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
call fcn.109b8e40
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x10a68ea9
cmp dword [edi + 4], esi
je 0x10a68e92
mov edi, dword [edi]
jmp 0x10a68e97
mov edi, 0x10e43c3c
mov edx, dword [esp + 0x24]
lea ecx, [eax + eax]
push ecx
push edi
push edx
call fcn.10902f60
add esp, 0xc
mov ecx, dword [0x110b86f8]
mov edi, dword [ebx]
push esi
lea eax, [esp + 0x10]
push eax
push esi
push ecx
mov ecx, ebx
call fcn.109c4030
push eax
mov ecx, ebx
call dword [edi + 0x10]
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.10a65f00
mov ecx, dword [esp + 0x34]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc
Function at 0x10a68f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e1bb60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov esi, dword [esp + 0x30]
lea eax, [esp + 0xc]
cmp eax, esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], edi
je 0x10a68f7d
mov eax, dword [esi + 4]
push 2
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
call fcn.109b8e40
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x10a68f7d
cmp dword [esi + 4], edi
je 0x10a68f66
mov esi, dword [esi]
jmp 0x10a68f6b
mov esi, 0x10e43c3c
mov edx, dword [esp + 0xc]
lea ecx, [eax + eax]
push ecx
push esi
push edx
call fcn.10902f60
add esp, 0xc
mov edx, dword [0x110b84cc]
mov eax, dword [esp + 0x34]
mov esi, dword [ebx]
push edi
lea ecx, [esp + 0x10]
push ecx
push edi
push edx
mov ecx, ebx
mov dword [esp + 0x28], eax
call fcn.109c4030
push eax
mov ecx, ebx
call dword [esi + 0x10]
mov esi, dword [esp + 0x1c]
push 2
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call fcn.109b8e40
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.109148d0
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x10a90300
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x10e1cba8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x3d4]
xor ebp, ebp
cmp eax, ebp
push edi
jne 0x10a90347
mov eax, dword [esi]
call dword [eax + 0x1d0]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0x10
mov eax, dword [esi + 0x6c]
test ah, 0x10
jne 0x10a904b8
rdtsc
mov dword [0x10fab810], edx
mov dword [0x10fab80c], eax
test byte [esi + 0x400], 1
mov ecx, dword [0x10fab80c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebp
je 0x10a90381
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1d4]
cmp dword [esi + 0x384], ebp
mov edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x4c]
jle 0x10a903f7
mov eax, dword [esi + 0x380]
mov eax, dword [eax + ebp*4]
test eax, eax
je 0x10a903ec
mov dword [eax + 0x3c8], esi
mov edx, dword [edi]
mov ecx, edi
call dword [edx]
mov eax, dword [esi + 0x380]
mov ecx, dword [eax + ebp*4]
mov eax, dword [ecx + 0x2c]
test ah, 0x10
jne 0x10a903e5
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x34]
test dword [eax + 0x5ac], 0x1000000
je 0x10a903e5
mov eax, dword [esp + 0x50]
mov edx, dword [ecx]
push edi
push eax
mov eax, dword [esp + 0x50]
push ebx
push eax
call dword [edx + 0x94]
add dword [esp + 0x10], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
mov eax, dword [esi + 0x384]
inc ebp
cmp ebp, eax
jl 0x10a90391
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x110]
test ecx, ecx
je 0x10a90474
mov al, byte [esi + 0x3f0]
test al, al
je 0x10a90474
push 1
push edi
lea ecx, [esp + 0x20]
call fcn.10b87f70
mov edx, dword [edi]
push 0x10f46d88
push 0
mov ecx, edi
mov dword [esp + 0x48], 0
call dword [edx + 0x38]
mov al, 0xff
mov byte [esp + 0x55], al
mov byte [esp + 0x56], al
mov byte [esp + 0x57], al
mov byte [esp + 0x54], 0
mov eax, dword [esp + 0x54]
push eax
sub esp, 0x1c
mov edi, esp
add esi, 0x3d8
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
call fcn.10b83d20
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0xffffffff
call fcn.10b892c0
mov eax, dword [0x110bb4b0]
mov ecx, dword [0x110bb678]
mov edi, dword [eax + ecx*4]
mov edx, dword [esp + 0x10]
add edi, edx
mov dword [eax + ecx*4], edi
mov eax, dword [0x110bb4b0]
mov ecx, dword [0x110bb680]
lea ecx, [eax + ecx*4]
rdtsc
mov dword [0x10fab810], edx
mov dword [0x10fab80c], eax
mov edx, dword [0x10fab80c]
mov esi, dword [esp + 0x14]
mov eax, dword [ecx]
sub edx, esi
add eax, edx
mov dword [ecx], eax
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 0x10