joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b9d00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1027329a
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push esi
call fcn.100b7260
mov dword [esp + 0x10], 0
mov ecx, dword [0x103b8d8c]
mov dword [esi], vtable.ATL::CComObject_class_CNVFileAction_.0
mov dword [esi + 4], vtable.ATL::CComObject_class_CNVFileAction_.1.0
mov dword [esi + 8], vtable.ATL::CComObject_class_CNVFileAction_.2.0
mov dword [esi + 0xc], vtable.ATL::CComObject_class_CNVFileAction_.3.0
mov dword [esi + 0x30], vtable.ATL::CComObject_class_CNVFileAction_.4.0
mov dword [esi + 0x34], vtable.ATL::CComObject_class_CNVFileAction_.5.0
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x100b9d90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025d1da
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ATL::CComObject_class_CNVFileAction_.0
mov dword [esi + 4], vtable.ATL::CComObject_class_CNVFileAction_.1.0
mov dword [esi + 8], vtable.ATL::CComObject_class_CNVFileAction_.2.0
mov dword [esi + 0xc], vtable.ATL::CComObject_class_CNVFileAction_.3.0
mov dword [esi + 0x30], vtable.ATL::CComObject_class_CNVFileAction_.4.0
mov dword [esi + 0x34], vtable.ATL::CComObject_class_CNVFileAction_.5.0
mov dword [esp + 0x14], 0
mov ecx, dword [0x103b8d8c]
mov dword [esi + 0x38], 0xc0000001
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov dword [esp + 0x14], 0xffffffff
push esi
call fcn.100ba080
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x100ba180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1027329a
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push esi
call fcn.100b7260
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
mov dword [esi], vtable.ATL::CComContainedObject_class_CNVFileAction_.0
mov dword [esi + 4], vtable.ATL::CComContainedObject_class_CNVFileAction_.1.0
mov dword [esi + 8], vtable.ATL::CComContainedObject_class_CNVFileAction_.2.0
mov dword [esi + 0xc], vtable.ATL::CComContainedObject_class_CNVFileAction_.3.0
mov dword [esi + 0x30], vtable.ATL::CComContainedObject_class_CNVFileAction_.4.0
mov dword [esi + 0x34], vtable.ATL::CComContainedObject_class_CNVFileAction_.5.0
mov dword [esi + 0x38], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x100ba2e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1027c65a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.100521d0
mov byte [esp + 0x38], 1
lea ecx, [esp + 4]
call fcn.1001c2b0
mov byte [esp + 0x38], 0
lea ecx, [esp + 0xc]
call fcn.10002d20
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.10002d20
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
add esp, 0x38
ret
Function at 0x100c1110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1026ca08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
test edi, edi
jne 0x100c114a
push edi
push 0x51
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincTypedNVList.h
push 0x80004003
call fcn.100048f0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0xc]
push eax
call esi
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x48]
push ecx
push eax
call edx
test eax, eax
jge 0x100c118a
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
lea eax, [esp + 0x1c]
push eax
call esi
push 0xd
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
jge 0x100c11b8
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
mov eax, dword [esp + 0x24]
mov dword [edi], eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 8
Function at 0x100d59a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1026ca08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0xc]
push eax
call esi
mov dword [esp + 0x38], 0
lea ecx, [esp + 0x1c]
push ecx
call esi
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], edx
push ecx
lea edx, [esp + 0x10]
mov eax, 0xd
push edx
mov word [esp + 0x24], ax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
jge 0x100d5a1a
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x20]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x24]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x40]
push ecx
call eax
test eax, eax
jge 0x100d5a5a
push 0
push 0
push 0x102b274a
push eax
call fcn.100048f0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100d60a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10265fea
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100d60d7
lea esi, [edi + 4]
jmp 0x100d60d9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.100d7220
mov dword [esp + 0x30], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.100d72e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100d61b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10265fea
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100d61e7
lea esi, [edi + 4]
jmp 0x100d61e9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.100d7280
mov dword [esp + 0x30], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.100d72e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100d8200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025d07a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ATL::CComObject_class_CNVRegistryAction_.0
mov dword [esi + 4], vtable.ATL::CComObject_class_CNVRegistryAction_.1.0
mov dword [esi + 8], vtable.ATL::CComObject_class_CNVRegistryAction_.2.0
mov dword [esi + 0x2c], vtable.ATL::CComObject_class_CNVRegistryAction_.3.0
mov dword [esi + 0x30], vtable.ATL::CComObject_class_CNVRegistryAction_.4.0
mov dword [esp + 0x14], 0
mov ecx, dword [0x103b8d8c]
mov dword [esi + 0x34], 0xc0000001
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov dword [esp + 0x14], 0xffffffff
push esi
call fcn.100d8b70
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x100d902c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x100d9067
Function at 0x100d9270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.100d8fec
inc edx
mov byte [0x458d3705], al
test al, 0x50
call fcn.100d8ffc
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.100d8fb1
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x100d92da
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100d8fec
push ds
push ss
jle 0x100d92bf
invalid
inc ebp

Function at 0x100d9390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 9], 0xbf
call fcn.100d8ffc
push eax
push esi
push dword [ebp + 8]
call fcn.100d8fb1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100d8ffc
push eax
push esi
push dword [ebp + 8]
call fcn.100d8fb1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
invalid
inc ebp
invalid

Function at 0x100db4b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102735f8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x10]
call fcn.100023b0
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x44]
push 0
push ecx
mov ecx, eax
call fcn.101e89b0
test eax, eax
sete bl
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.10002d20
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret
Function at 0x100dbcb0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x10276630
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ecx, esi
call fcn.101dc6d0
xor ebx, ebx
cmp al, bl
jne 0x100dbcf3
push ebx
push 0x1b
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincNVDiskSpaceUtil.h
push 0x80070057
call fcn.100048f0
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.10055810
mov dword [esp + 0x68], ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
call fcn.10055870
mov byte [esp + 0x68], 1
push 0x25
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincNVDiskSpaceUtil.h
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call fcn.10002aa0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push eax
call fcn.100556a0
add esp, 0xc
mov byte [esp + 0x68], bl
lea ecx, [esp + 0x3c]
call fcn.10002d20
mov dword [esp + 0x68], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10002d20
mov eax, dword [esp + 0xc]
mul dword [esp + 0x10]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x64
ret

Function at 0x100ddfe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10259c69
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 6
mov eax, dword [esi + 0x34]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push eax
call edi
mov byte [esp + 0x14], 5
mov ecx, dword [esi + 0x30]
push ecx
call edi
mov byte [esp + 0x14], 4
mov edx, dword [esi + 0x2c]
push edx
call edi
mov byte [esp + 0x14], 3
mov eax, dword [esi + 0x24]
push eax
call edi
mov byte [esp + 0x14], 2
mov ecx, dword [esi + 0x20]
push ecx
call edi
mov byte [esp + 0x14], 1
mov edx, dword [esi + 0x1c]
push edx
call edi
mov byte [esp + 0x14], 0
mov eax, dword [esi + 0x18]
push eax
call edi
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.101d3a10
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x100e6110
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1027c2c8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x30]
push ecx
xor ebx, ebx
mov ecx, esi
mov dword [eax], ebx
call fcn.101da900
mov dword [esp + 0x98], ebx
lea edx, [esp + 0x4c]
push edx
mov ecx, eax
call fcn.10055810
mov byte [esp + 0x98], 1
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x70]
call fcn.10055870
mov byte [esp + 0x98], 2
mov ecx, eax
call fcn.100585c0
test eax, eax
setne al
cmp al, bl
jne 0x100e61aa
push ebx
push 0x4e
push 0x102c8bc4
push 0x80070057
call fcn.100048f0
mov byte [esp + 0x98], 1
lea ecx, [esp + 0x6c]
call fcn.10002d20
mov byte [esp + 0x98], bl
lea ecx, [esp + 0x4c]
call fcn.10002d20
mov dword [esp + 0x98], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.10056b10
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.101da900
mov dword [esp + 0x98], 3
lea edx, [esp + 0x4c]
push edx
mov ecx, eax
call fcn.10055810
mov byte [esp + 0x98], 4
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x70]
call fcn.10055870
mov byte [esp + 0x98], 5
mov ecx, eax
call fcn.10003840
push eax
lea ecx, [esp + 0x20]
call fcn.100047f0
mov byte [esp + 0x98], 7
lea ecx, [esp + 0x6c]
call fcn.10002d20
mov byte [esp + 0x98], 8
lea ecx, [esp + 0x4c]
call fcn.10002d20
mov byte [esp + 0x98], 9
lea ecx, [esp + 0x30]
call fcn.10056b10
push 0x59
push 0x102c8bc4
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push eax
call fcn.100556a0
mov esi, dword [esp + 0x1c]
mov eax, dword [ebp + 8]
imul esi, dword [esp + 0x20]
mov ecx, 0x400
mul ecx
add esp, 0xc
xor edi, edi
push edi
push esi
push edx
push eax
call fcn.10234f30
mov dword [esp + 0x28], edx
test ebx, ebx
ja 0x100e62cd
test ecx, ecx
jbe 0x100e62ce
inc eax
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jbe 0x100e631c
push edi
push esi
sub eax, ecx
push 0
push eax
call fcn.10233430
mov ecx, eax
shrd ecx, edx, 0xa
shr edx, 0xa
test edx, edx
ja 0x100e62f4
cmp ecx, 0xffffffff
jbe 0x100e6307
push 0
push 0x61
push 0x102c8bc4
push 0xe0e00000
call fcn.100048f0
mov esi, dword [ebp + 0xc]
and eax, 0x3ff
xor edx, edx
mov dword [esi], ecx
ja 0x100e6319
test eax, eax
jbe 0x100e631c
inc ecx
mov dword [esi], ecx
mov dword [esp + 0x98], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10004720
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100f0f80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10268dd4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100f0fb7
lea esi, [edi + 4]
jmp 0x100f0fb9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.100f4da0
mov dword [esp + 0x38], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.100e1850
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100f1090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10268dd4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100f10c7
lea esi, [edi + 4]
jmp 0x100f10c9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.100f4e00
mov dword [esp + 0x38], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.100e1850
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100f11a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10268dd4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100f11d7
lea esi, [edi + 4]
jmp 0x100f11d9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.100f4e60
mov dword [esp + 0x38], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.100e1850
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100f12b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10268dd4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100f12e7
lea esi, [edi + 4]
jmp 0x100f12e9
xor esi, esi
lea eax, [esp + 0xc]
push eax
call fcn.100f4ec0
mov dword [esp + 0x38], 0
mov edx, edi
mov ecx, edi
lea eax, [esp + 0xc]
call fcn.1007b360
mov edx, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x1c]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x14]
push esi
lea ecx, [esp + 0x10]
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x20]
push esi
lea ecx, [esp + 0x10]
call eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.100e1850
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8