joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010dd40
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x8000
jg 0x1010de5a
je 0x1010de51
cmp eax, 0x80
jg 0x1010ddd7
je 0x1010ddce
cmp eax, 8
jg 0x1010dda0
je 0x1010dd97
cmp eax, 0x80000000
je 0x1010dd8e
cmp eax, 2
je 0x1010dd85
cmp eax, 4
jne 0x1010df3d
mov eax, 2
pop ebp
ret 4
mov eax, 1
pop ebp
ret 4
mov eax, 0x1f
pop ebp
ret 4
mov eax, 3
pop ebp
ret 4
cmp eax, 0x10
je 0x1010ddc5
cmp eax, 0x20
je 0x1010ddbc
cmp eax, 0x40
jne 0x1010df3d
mov eax, 6
pop ebp
ret 4
mov eax, 5
pop ebp
ret 4
mov eax, 4
pop ebp
ret 4
mov eax, 7
pop ebp
ret 4
cmp eax, 0x800
jg 0x1010de1d
je 0x1010de14
cmp eax, 0x100
je 0x1010de0b
cmp eax, 0x200
je 0x1010de02
cmp eax, 0x400
jne 0x1010df3d
mov eax, 0xa
pop ebp
ret 4
mov eax, 9
pop ebp
ret 4
mov eax, 8
pop ebp
ret 4
mov eax, 0xb
pop ebp
ret 4
cmp eax, 0x1000
je 0x1010de48
cmp eax, 0x2000
je 0x1010de3f
cmp eax, 0x4000
jne 0x1010df3d
mov eax, 0xe
pop ebp
ret 4
mov eax, 0xd
pop ebp
ret 4
mov eax, 0xc
pop ebp
ret 4
mov eax, 0xf
pop ebp
ret 4
cmp eax, 0x800000
jg 0x1010dee6
je 0x1010dedd
cmp eax, 0x80000
jg 0x1010dead
je 0x1010dea4
cmp eax, 0x10000
je 0x1010de9b
cmp eax, 0x20000
je 0x1010de92
cmp eax, 0x40000
jne 0x1010df3d
mov eax, 0x12
pop ebp
ret 4
mov eax, 0x11
pop ebp
ret 4
mov eax, 0x10
pop ebp
ret 4
mov eax, 0x13
pop ebp
ret 4
cmp eax, 0x100000
je 0x1010ded4
cmp eax, 0x200000
je 0x1010decb
cmp eax, 0x400000
jne 0x1010df3d
mov eax, 0x16
pop ebp
ret 4
mov eax, 0x15
pop ebp
ret 4
mov eax, 0x14
pop ebp
ret 4
mov eax, 0x17
pop ebp
ret 4
cmp eax, 0x8000000
jg 0x1010df28
je 0x1010df1f
cmp eax, 0x1000000
je 0x1010df16
cmp eax, 0x2000000
je 0x1010df0d
cmp eax, 0x4000000
jne 0x1010df3d
mov eax, 0x1a
pop ebp
ret 4
mov eax, 0x19
pop ebp
ret 4
mov eax, 0x18
pop ebp
ret 4
mov eax, 0x1b
pop ebp
ret 4
cmp eax, 0x10000000
je 0x1010df55
cmp eax, 0x20000000
je 0x1010df4c
cmp eax, 0x40000000
je 0x1010df43
xor eax, eax
pop ebp
ret 4
mov eax, 0x1e
pop ebp
ret 4
mov eax, 0x1d
pop ebp
ret 4
mov eax, 0x1c
pop ebp
ret 4
Function at 0x10115de4
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0xf0000000
push 0x18
push 0x101a6ad8
push 0x101a6ad8
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10115e3c
push 0x24
push 0x4367c4a
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10115ea1
mov dword [ebp - 0xc], esp
push 0
push 0x18
push 0x101a6ad8
push 0x101a6ad8
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10115e8a
push 0x7d
push 0x4367c4a
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10115ea1
mov eax, 0x101a6c00
jmp 0x10115f1a
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.10115f34
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10115ec6
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10115efb
push 0x120
push 0x4367c4a
push 6
call fcn.101571f7
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x10115f15
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.10157203
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10115f1a
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10115f2b
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10117a84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x184
call fcn.10158d80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10117ac9
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x104
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10117afe
push 0x5a
push 0x436a8a9
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x10117bc9
push 0x80000301
push 0
push 1
push OleUIBusyA
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10117b2a
mov eax, 0x101a6ad8
push eax
push 2
mov ebx, 0x138
call fcn.101590b0
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x101e310c
push dword [ebp - 8]
call fcn.10002738
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10117b6e
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x10117ba8
push 0x101e310c
push dword [ebp - 4]
mov ecx, 2
call fcn.100012af
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10117ba4
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x10117bc4
push eax
mov ebx, eax
call fcn.10001244
inc eax
push eax
call fcn.10157203
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10117bd3
mov eax, 0x101a6ad8
jmp 0x10117bd3
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10117be4
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x10119ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov eax, dword [esp + 4]
xor edx, edx
mov eax, dword [eax]
test eax, eax
je 0x10119edb
cmp word [eax + 8], 0x5a4d
lea ecx, [eax + 8]
je 0x10119ee4
mov eax, edx
ret 8
add ecx, dword [ecx + 0x3c]
cmp word [ecx + 4], 0x14c
jne 0x10119edb
cmp dword [ecx], 0x4550
jne 0x10119edb
mov edx, dword [ecx + 0x34]
mov eax, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [ecx + 0x50]
jmp 0x10119edb

Function at 0x10119f18
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
test eax, eax
je 0x10119f38
cmp word [eax + 8], 0x5a4d
lea ebx, [eax + 8]
je 0x10119f4a
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov esi, dword [ebx + 0x3c]
xor eax, eax
lea edx, [esi + ebx]
cmp word [edx + 4], 0x14c
jne 0x10119f38
cmp dword [edx], 0x4550
jne 0x10119f38
movzx edx, word [edx + 6]
add esi, 0xf8
mov dword [esp + 4], ebx
xor edi, edi
lea eax, [edx + edx*4]
mov dword [esp + 0x18], edx
lea eax, [esi + eax*8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [esp + 0x4c]
sub esp, 0xc
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call dword [esp + 0x48]
sub esp, 0x10
mov edx, dword [esp + 0x18]
test edx, edx
je 0x1011a029
lea esi, [esi]
lea ebp, [ebx + esi]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1011a01f
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1011a01f
mov dword [esp + 0x1c], edx
mov edx, dword [ebp + 0x10]
add eax, ebx
add ecx, dword [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ecx
mov dword [esp + 0x18], ecx
call dword [esp + 0x4c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], 0x40
mov eax, dword [ebp + 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [esp + 0x48]
sub esp, 0x10
mov edx, dword [esp + 0x1c]
add edi, 1
add esi, 0x28
cmp edx, edi
jne 0x10119fc2
mov eax, 1
jmp 0x10119f38
Function at 0x1011a044
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x1011a105
test ecx, ecx
je 0x1011a105
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x1011a105
test ebx, ebx
je 0x1011a105
mov ebx, eax
add ebx, edx
je 0x1011a105
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x1011a105
cmp dword [edx + eax + 0x14], 0
je 0x1011a105
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x1011a105
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x1011a0f5
test dl, dl
je 0x1011a0f1
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x1011a0f5
add edi, 2
add esi, 2
test dl, dl
jne 0x1011a0d5
xor eax, eax
jmp 0x1011a0fa
sbb eax, eax
or eax, 1
test eax, eax
je 0x1011a111
inc ebp
cmp ebp, dword [esp + 4]
jb 0x1011a0c2
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x1011a1e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 0
je 0x1011a264
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 0x14], ebx
mov eax, 0x101a6c00
xor ecx, ecx
test eax, eax
je 0x1011a228
mov ecx, dword [eax + 4]
push ecx
add eax, 8
push eax
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
xor ebx, ebx
test eax, eax
je 0x1011a23b
mov ebx, dword [eax + 4]
add eax, 8
push eax
cmp ebx, ecx
mov eax, 1
jne 0x1011a252
dec eax
test ecx, ecx
je 0x1011a252
call fcn.10007aa4
add esp, 0xc
test eax, eax
je 0x1011a264
mov eax, 1
jmp 0x1011a269
mov eax, 0
test eax, eax
je 0x1011a3da
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 0xc], ebx
push OleUIBusyA
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x1011a291
mov eax, 0x101a6c00
push eax
push 1
mov ebx, 0x194
call fcn.10158c30
add esp, 0x10
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
lea eax, [ebp - 8]
push eax
push 0x40
push dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1011a2e9
push 0xb4
push 0x436a910
push 6
call fcn.101571f7
add esp, 0xc
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x10]
call fcn.1011a1c0
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
push dword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call fcn.1011a138
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov eax, 0x101a6c00
test eax, eax
je 0x1011a36c
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.10157203
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x1011a37f
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
cmp dword [ebp - 8], 0x40
je 0x1011a3da
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1011a3da
push 0x22c
push 0x436a910
push 6
call fcn.101571f7
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x1011bef4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.10158d80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1011bf39
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1011bf6e
push 0x36
push 0x436a95b
push 6
call fcn.101571f7
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x1011bf8a
push eax
mov ebx, eax
call fcn.10001244
inc eax
push eax
call fcn.10157203
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1011bf8f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1011bfa0
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x1011c6a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10215788], 0
jne 0x1011c74b
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.1011c7d0
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1011c6e1
push ebx
call fcn.1015720f
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x10215788], eax
cmp dword [0x10215788], 0
jne 0x1011c74b
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
nop
nop
cmp dword [ebp - 8], esp
je 0x1011c71f
push 0xc6
push 0x436a900
push 6
call fcn.101571f7
add esp, 0xc
mov dword [0x10215788], eax
push dword [0x10215788]
mov eax, str.__threadStrMap
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.1011cc1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1011c74b
push ebx
call fcn.1015720f
add esp, 4
mov dword [ebp - 8], esp
push dword [0x10215788]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x1011c77a
push 0x138
push 0x436a900
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1011c7c1
call fcn.1011ca58
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [0x10215788]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x1011c7c1
push 0x1b6
push 0x436a900
push 6
call fcn.101571f7
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1011c7c9
mov esp, ebp
pop ebp
ret
Function at 0x1011c800
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x1021578c], 0
jne 0x1011ca37
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.10158d80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1011c852
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x1011c87f
push 0xb8
push 0x436a904
push 6
call fcn.101571f7
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.101583d0
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.100012af
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1011c8c4
push ebx
call fcn.1015720f
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x1011c8f8
push 0xb8
push 0x436a904
push 6
call fcn.101571f7
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1011c908
push ebx
call fcn.1015720f
add esp, 4
push OleUIBusyA
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1011c91b
mov eax, 0x101a6ad8
push eax
push 1
mov ebx, 0x164
call fcn.1015cb40
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.1000121c
mov dword [0x1021578c], eax
cmp dword [0x1021578c], 0
jne 0x1011ca37
call fcn.1011ca58
mov dword [0x1021578c], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x1011c981
push 0x1c1
push 0x436a904
push 6
call fcn.101571f7
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.101583d0
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.100012af
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1011c9c6
push ebx
call fcn.1015720f
add esp, 4
push 0x80000301
push 0
push dword [0x1021578c]
push 1
mov ebx, 0x168
call fcn.101583d0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1011ca17
push 0x1d6
push 0x436a904
push 6
call fcn.101571f7
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1011ca27
push ebx
call fcn.1015720f
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1011ca37
push ebx
call fcn.1015720f
add esp, 4
mov eax, dword [0x1021578c]
jmp 0x1011ca41
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1011ca52
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1011ebd0
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x1011ebf1
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x1011ebe8
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x1011ebe0
mov eax, ebx
leave
ret

Function at 0x1011ec17
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x1011ec76
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x1011eca3
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x1011ec92
xor ecx, eax
xor edx, ebx
dec edi
jne 0x1011ec83
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x1011ecc9
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x1011ec6a
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x1011f509
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.1011eb96
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x1011f6e8
push dword [ebp - 4]
call fcn.1011eb7a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1011f5d9
jmp 0x1011f6e8
push dword [ebp - 4]
call fcn.1011eb7a
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x1011f62d
lea eax, [ebp - 4]
push eax
call fcn.1011f4ef
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.1011eda1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1011f62d
mov eax, 1
jmp 0x1011f62f
xor eax, eax
test eax, eax
je 0x1011f6dd
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x1011f6d5
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.1011f30c
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1011f6c4
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.1011f4c8
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x1011f677
add esp, 0xc
jmp 0x1011f6e8
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x1011f5b2
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x1011f709
mov esp, ebp
pop ebp
ret 8