joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10155080
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x104b346c], eax
jne 0x101550ad
call fcn.1013d9fd
mov eax, dword [eax]
push eax
push str.Cant_initialize_threads:_error__d_n
push 0x1039f0b0
call fcn.1013d011
add esp, 0xc
mov al, 1
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104b35a0
call esi
push 0x104b3520
call esi
push 0x104b3540
call esi
push 0x104b34e0
call esi
push 0x104b3500
call esi
push 0x104b34a0
call esi
push 0x104b3480
call esi
push 0x104b3560
call esi
call fcn.10158c90
push 0x104b3580
call esi
push 0x104b34c0
call esi
call fcn.10155180
test al, al
pop esi
je 0x10155111
call fcn.10155120
mov al, 1
ret
xor al, al
ret

Function at 0x10155180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x104b3540
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x104b346c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x101551fb
push 0x4c
push 1
call fcn.1013de25
mov esi, eax
add esp, 8
test esi, esi
jne 0x101551c3
push 0x104b3540
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x104b346c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x104a5e3c]
inc eax
lea edx, [esi + 0xc]
mov dword [0x104a5e3c], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.10158ca0
add esp, 8
mov byte [esi + 0x3c], 1
push 0x104b3540
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
Function at 0x10155680
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.1013d9fd
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.10147eeb
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x1015577a
call fcn.1013d9fd
cmp dword [eax], 0
je 0x101556c7
call fcn.1013d9fd
mov ebp, dword [eax]
jmp 0x101556ca
or ebp, 0xffffffff
call fcn.10155210
test esi, esi
mov dword [eax], ebp
jne 0x101556df
call fcn.1013d9fd
cmp dword [eax], 4
je 0x1015572f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x10155712
cmp esi, 0xffffffff
je 0x10155754
test al, 6
je 0x10155712
call fcn.10155210
mov ecx, dword [eax]
push ecx
push ebx
call fcn.10158cd0
add esp, 4
push eax
push 0x24
push 9
call fcn.10155a60
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x10155772
test al, 6
je 0x10155720
test ah, 2
je 0x10155772
test esi, esi
jbe 0x1015577e
test ah, 2
je 0x1015577e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.1013d9fd
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.10147eeb
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x1015577a
jmp 0x101556b4
call fcn.10155210
mov eax, dword [eax]
push eax
push ebx
call fcn.10158cd0
add esp, 4
push eax
push 0x24
push 2
call fcn.10155a60
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x1015578b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x10155794
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x101713a1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x101713c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1013d98a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x101713e4
test byte [esp + 8], 2
je 0x101713e4
call fcn.1013d9fd
mov dword [eax], 0xd
call fcn.1013da06
mov dword [eax], 5
jmp 0x101713bd
xor eax, eax
ret

Function at 0x10176526
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1017655e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.101745b3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1017458b
jmp 0x1017656a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10177c18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10177c5a
call fcn.1017dc79
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10177c5a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10177c51
xor eax, eax
jmp 0x10177c62
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10177c68
pop edi
pop esi
pop ebx
ret 4

Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad76a41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x3ad76a50
pop dword [ebp - 0x48]
mov eax, 0x3ad76a50
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x37228
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x462e
xor edx, edx
add edx, eax
mov edi, 0x3ad88e00
add edi, dword [ebp - 0x48]
mov esi, 0x89187357
add esi, 0xa743d462
xor dword [ebp - 0xc], 0xbfd8f20
mov ebx, dword [edi]
xor dword [ebp - 0x34], edi
xor ebx, esi
add dword [ebp - 0xc], 0xa71c289b
mov dword [edx], ebx
xor dword [ebp - 0x28], ecx
add edx, 0xaff8c548
add edx, 0x50073abc
add edi, 0x6581721
sub edi, 0x658171d
loop 0x3ad76a9b
add eax, 0x10b8b
mov ebx, eax
add eax, 0x739ff8e8
sub eax, 0x739ff8e3
mov ecx, 0x3ad70000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1090d450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10e0a55b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1090d5b0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x10e46be0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x10e46bd0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.109151d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.10915250
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1093df20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0c8e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [0x10fcccac]
mov eax, dword [ecx]
push ebx
push esi
push 1
push str.Creating_static_mesh...
call dword [eax + 0xc]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x38], 1
call fcn.1093d240
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.1093d080
mov ecx, dword [0x10fcccac]
mov esi, eax
mov eax, dword [ecx]
add esp, 0x20
call dword [eax + 0x10]
lea ecx, [esp + 8]
mov byte [esp + 0x28], bl
call fcn.1093ddc0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.1093de70
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10954147
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0dcc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, 1
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x81
mov dword [esi + 8], 0xc6c
mov dword [esi + 0xc], 0x1e
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0x48]
mov dword [esp + 0x18], edi
mov dword [esi], 0x10e520d8
mov dword [esi + 0x44], eax
call fcn.109fecd0
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [0x10fceeec]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1095465d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0de1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
mov edx, 1
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi + 4], 0x81
mov dword [esi + 8], 0xc6c
mov dword [esi + 0xc], 0x1e
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0xffffffff
mov dword [esi], 0x10e52140
mov dword [esp + 0x10], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xd4], ecx
lea ecx, [esi + 0xd8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [esi + 0x14], edx
mov dword [esi + 0x1c], edx
mov eax, dword [0x10fceeec]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edx
mov edx, dword [0x110a36e0]
push edx
push 4
mov byte [esp + 0x18], 0xa
call fcn.10923200
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x109563c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0e1d1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x10e52298
mov dword [esp + 0x18], 3
call fcn.109c3760
lea edi, [esi + 0x48]
mov dword [esp + 0xc], edi
mov eax, dword [edi + 4]
push eax
push 0
mov ecx, edi
mov byte [esp + 0x20], 4
call fcn.10956470
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.10914930
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 1
call fcn.10914b10
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 0
call fcn.10914b10
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.109c5340
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1097d760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0f408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov ecx, 1
mov dword [esp + 4], esi
mov dword [esi + 4], 0x81
mov dword [esi + 8], 0xc6c
mov dword [esi + 0xc], 0x1e
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esi], 0x10e5a518
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov eax, dword [ecx]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1097d778
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0f408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov ecx, 1
mov dword [esp + 4], esi
mov dword [esi + 4], 0x81
mov dword [esi + 8], 0xc6c
mov dword [esi + 0xc], 0x1e
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esi], 0x10e5a518
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov eax, dword [ecx]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10982920
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0f682
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi], 0x10e5af9c
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov byte [esp + 0x10], 5
call fcn.109aec90
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10982936
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e0f682
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi], 0x10e5af9c
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov byte [esp + 0x10], 5
call fcn.109aec90
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10984670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e0f759
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0xc], ebx
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 4]
cmp eax, ebx
mov dword [esp + 0x30], 1
je 0x109846b5
lea esi, [eax - 1]
jmp 0x109846b7
xor esi, esi
dec esi
cmp esi, 0xffffffff
jle 0x1098471c
lea ecx, [ecx]
push 1
push esi
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.109298d0
cmp dword [eax + 4], ebx
mov byte [esp + 0x30], 2
je 0x109846dd
mov eax, dword [eax]
jmp 0x109846e2
mov eax, 0x10e43c3c
push eax
lea ecx, [esp + 0x14]
call fcn.109059d0
push 2
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 3
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.109b8e40
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.109148d0
dec esi
cmp esi, 0xffffffff
jg 0x109846c0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
cmp edi, edx
je 0x10984758
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
push 2
mov ecx, edi
call fcn.109b8e40
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x10984758
cmp dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x10]
jne 0x10984749
mov ecx, 0x10e43c3c
add eax, eax
push eax
push ecx
mov ecx, dword [edi]
push ecx
call fcn.10902f60
add esp, 0xc
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.10905950
mov dword [esp + 0xc], 1
push 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.109b8e40
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.109148d0
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x10996ff6
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10e10264
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x3c]
mov dword [esp + 0x10], 4
call fcn.10995a90
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 3
call fcn.109959e0
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.10996df0
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.10995930
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 0
call fcn.10921a10
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.10995880
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1099a6b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e1067b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ecx, [esi + 0x34]
push 0x28
mov dword [esp + 0x18], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.109b8e40
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x24], 0x10e5ee88
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1099a6c6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e1067b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ecx, [esi + 0x34]
push 0x28
mov dword [esp + 0x18], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.109b8e40
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x24], 0x10e5ee88
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1099df40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10e10c31
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 8], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov eax, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x2c]
mov dword [esi + 0xc], edx
mov dword [esi + 0x34], eax
mov ecx, dword [0x10faca88]
mov eax, dword [0x10faca8c]
mov edi, ecx
inc ecx
cmp ecx, eax
mov byte [esp + 0x14], 2
mov dword [0x10faca88], ecx
jle 0x1099e000
lea eax, [ecx + ecx*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
lea ecx, [eax + ecx + 0x20]
mov dword [0x10faca8c], ecx
push 4
mov ecx, 0x10faca84
call fcn.109b8e40
mov edx, dword [0x10faca84]
mov dword [edx + edi*4], esi
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
mov eax, dword [0x10faca84]
mov ecx, dword [esp + 0xc]
mov dword [eax + edi*4], esi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x109a3d56
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e10fc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.109c2d60
xor edi, edi
mov dword [esi], 0x10e600f8
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 1
call fcn.10b88fc0
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
lea ecx, [esi + 0x78]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
call fcn.109a3580
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret