joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102e665e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
cmp dword [0x1077e3e0], 0x40
jae 0x102e6743
push esi
mov esi, dword [ebp + 8]
mov edx, 0xfff80000
add esi, ecx
add ecx, dword [ebp + 0x10]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x40]
push 8
lea eax, [ecx + 0x7ff80000]
cmovb edx, eax
and dword [ebp - 0x44], ebx
pop ecx
xor eax, eax
mov dword [ebp - 4], edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 4]
cmovb edi, eax
cmp edi, esi
jae 0x102e6741
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x102e671c
cmp dword [ebp - 0x10], 0x10000
jne 0x102e6710
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x102e6713
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x102e6713
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x102e6720
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x102e66c5
test ebx, ebx
je 0x102e6741
xor eax, eax
cmp dword [eax*4 + 0x10788e60], 0
je 0x102e6734
inc eax
cmp eax, 0x40
jb 0x102e6722
jmp 0x102e6741
inc dword [0x1077e3e0]
mov dword [eax*4 + 0x10788e60], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x102e677d
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
push 0
push 0x1f03ff
mov dword [ebp - 0x2d4], edx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x102e681d
test esi, esi
je 0x102e681d
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x102e6814
mov dword [ebp - 0x2d0], 0x10001
xor edi, edi
jmp 0x102e6800
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x218], eax
jb 0x102e681d
add eax, dword [ebp + 8]
cmp dword [ebp - 0x218], eax
jae 0x102e681d
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp edi, 3
jge 0x102e6814
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc edi
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x102e67cb
jmp 0x102e681d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10436e26
mov esp, ebp
pop ebp
ret
Function at 0x102e682f
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x1077e3ec], esi
jbe 0x102e6881
mov eax, dword [0x1077e3e8]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x1077e3e8]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x1077e3ec]
jb 0x102e685c
push dword [0x1077e3e8]
call fcn.104376b4
and dword [0x1077e3e8], 0
and dword [0x1077e3ec], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x102e6acd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
mov eax, ecx
xor ebx, ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
call fcn.102e65b1
mov ecx, esi
call fcn.102e65ee
mov esi, eax
mov ecx, edi
mov dword [ebp - 0x10], esi
call fcn.102e65ee
push 0x50
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x70]
movlpd qword [ebp - 0x78], xmm0
push ebx
push eax
call fcn.1043c810
add esp, 0xc
lea eax, [ebp - 0x78]
mov ecx, esi
push eax
call fcn.102e6a19
mov edi, eax
pop ecx
cmp edi, 5
jb 0x102e6c68
mov edx, edi
mov ecx, esi
call fcn.102e68ad
push dword [ebp - 0x6c]
mov ecx, esi
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.102e665e
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x102e6c63
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push ecx
push 0x40
push edi
push esi
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x102e6c48
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x102e6c2b
xor ecx, ecx
lea eax, [ebx + 0x2c]
test edi, edi
je 0x102e6bb7
mov edx, eax
sub esi, eax
mov al, byte [esi + edx]
mov byte [edx], al
mov byte [ebx + ecx + 0x4c], al
inc ecx
inc edx
cmp ecx, edi
jb 0x102e6ba2
mov esi, dword [ebp - 0x10]
lea eax, [ebx + 0x2c]
lea edx, [edi + esi]
lea ecx, [eax + edi]
call fcn.102e661f
mov edx, dword [ebp - 0x14]
mov ecx, esi
sub ecx, edx
mov eax, edx
sub eax, esi
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x102e6bf8
lea esi, [ebx + 0xc]
mov ecx, esi
call fcn.102e661f
sub eax, ebx
sub eax, 0xc
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, esi
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.102e661f
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
lea eax, [ebx + 0x2c]
push edi
push eax
push dword [ebp - 4]
mov dword [ebx + 4], edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [ebx], 0
je 0x102e6c57
mov ecx, dword [ebp - 0x1c]
lea eax, [ebx + 0x2c]
mov dword [ecx], eax
jmp 0x102e6c63
xor edx, edx
mov ecx, ebx
inc edx
call fcn.102e674a
xor ebx, ebx
call fcn.102e682f
push 0x10788f60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test ebx, ebx
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102e6c81
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
xor edi, edi
call fcn.102e65b1
mov esi, edi
mov eax, dword [esi*4 + 0x10788e60]
test eax, eax
je 0x102e6cad
add eax, 0x2c
cmp eax, dword [ebx]
je 0x102e6d43
inc esi
cmp esi, 0x40
jb 0x102e6c97
mov esi, edi
test esi, esi
je 0x102e6d2f
mov edx, dword [esi + 4]
mov ecx, dword [esi]
call fcn.102e68ad
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov dword [ebp - 4], edi
lea eax, [ebp - 4]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x102e6d2a
mov ecx, dword [esi]
cmp dword [esi + 4], edi
jbe 0x102e6cf8
mov al, byte [esi + edi + 0x4c]
mov byte [edi + ecx], al
inc edi
cmp edi, dword [esi + 4]
jb 0x102e6ceb
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 8]
xor edi, edi
mov eax, dword [esi]
xor edx, edx
inc edi
mov dword [ecx], eax
mov ecx, esi
call fcn.102e674a
call fcn.102e682f
push 0x10788f60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi*4 + 0x10788e60]
jmp 0x102e6cb5
Function at 0x102f85be
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x138]
xor ebx, ebx
mov dword [ebp - 0x150], 0xc
mov esi, ecx
mov dword [ebp - 0x14c], ebx
push 0x110
push ebx
push eax
mov dword [esi], vtable.._AV2960_________________________________.0
mov dword [esi + 4], ebx
mov dword [ebp - 0x148], ebx
call fcn.1043c810
add esp, 0xc
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x102f8693
cmp dword [ebp - 0x138], 6
mov ecx, str.D:_A__GA___WD__A__GA___AN_
mov eax, str.D:_A__GA___WD__A__GA___AN_S:_ML__NW___S_1_16_0_
cmovb eax, ecx
lea ecx, [ebp - 0x14c]
push ebx
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
dec eax
neg eax
sbb al, al
inc al
je 0x102f8693
cmp dword [edi + 0x10], ebx
jne 0x102f8660
push ebx
jmp 0x102f8669
cmp dword [edi + 0x14], 8
jb 0x102f8668
mov edi, dword [edi]
push edi
push ebx
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x102f869f
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x140], str._835
jmp 0x102f86a9
mov dword [ebp - 0x140], str._836
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x28]
call fcn.100783c3
push 0x10725f48
lea eax, [ebp - 0x28]
push eax
call fcn.1043aaeb
int3
Function at 0x10306d2d
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104ce6c6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x1c]
call fcn.1007fc4b
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp + 0xc]
sub esp, 0xc
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, dword [eax]
mov edx, esp
mov dword [esp + 0x30], esp
mov dword [esp + 0x34], edx
mov dword [edx], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x48], 1
or dword [esp + 0x48], 0xffffffff
mov edx, edi
mov ecx, esi
call fcn.1009597d
pop ecx
mov dword [esp + 0x44], 2
or dword [esp + 0x44], 0xffffffff
mov ecx, ebx
call fcn.10306dcf
add esp, 0x14
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1030c239
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104cf245
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea eax, [esp + 0x28]
push eax
call fcn.1030c39d
xor ebx, ebx
mov dword [esp + 0x50], ebx
cmp dword [eax + 0x14], 8
jb 0x1030c288
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push eax
push ebx
push 6
call edi
mov esi, eax
or dword [esp + 0x50], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.1007a42c
test esi, esi
jne 0x1030c2e6
lea eax, [esp + 0x10]
push eax
call fcn.1030c449
mov dword [esp + 0x50], 1
cmp dword [eax + 0x14], 8
jb 0x1030c2c5
mov eax, dword [eax]
push eax
push ebx
push 6
call edi
mov esi, eax
or dword [esp + 0x50], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x18]
call fcn.1007a42c
test esi, esi
je 0x1030c37f
push 4
push ebx
push ebx
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x1030c300
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1030c37f
inc dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
call fcn.1030c4f7
mov dword [esp + 0x50], 2
cmp dword [eax + 0x14], 8
jb 0x1030c32a
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendNotifyMessageW]
mov edi, 0xffff
push eax
push ebx
push 0x1a
push edi
call esi
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.1007a42c
lea eax, [esp + 0x10]
push eax
call fcn.1030c5e2
mov dword [esp + 0x50], 3
cmp dword [eax + 0x14], 8
jb 0x1030c367
mov eax, dword [eax]
push eax
push ebx
push 0x1a
push edi
call esi
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.1007a42c
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret
Function at 0x1030e1a6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104c9d3d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea edx, [esp + 0xc]
push edx
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
mov dword [esp + 0x38], ebx
lea eax, [esp + 0x10]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.1008364f
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x10]
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x20]
cmovae ecx, dword [esp + 0x10]
add eax, eax
push eax
push ecx
mov ecx, dword [esi + 0x30]
call fcn.10419f90
mov byte [esp + 0x38], bl
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.1007a42c
or dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1030e253
dec dword [eax + 0x48]
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x48], ebx
jne 0x1030e253
call fcn.102e2160
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4
Function at 0x10314a89
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104d0c71
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
and dword [esp + 0xc], 0
lea eax, [esp + 0x10]
push eax
call fcn.10314b15
and dword [esp + 0x38], 0
lea ecx, [esp + 0xc]
push ecx
mov edx, eax
mov ecx, esi
call fcn.102dee76
pop ecx
mov esi, eax
or dword [esp + 0x38], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1007a42c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret
Function at 0x1031859f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104d1736
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push esi
call fcn.10325caa
push dword [esi]
lea ecx, [esp + 0x14]
call fcn.1008097d
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push dword [esi]
mov ecx, esi
push eax
call fcn.1007e9a2
push 0x58
call fcn.10437946
pop ecx
mov dword [esp + 0xc], eax
mov byte [esp + 0x38], 1
test eax, eax
je 0x10318621
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.10302ab7
jmp 0x10318623
xor eax, eax
mov byte [esp + 0x38], 0
lea ecx, [edi + 0x14]
push eax
call fcn.1031259d
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push 1
call fcn.1007a42c
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4

Function at 0x1031c720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104d0c71
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x10]
and dword [esp + 0xc], 0
call fcn.1031f14c
and dword [esp + 0x38], 0
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.10301cbe
mov dword [esi + 8], eax
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push 1
call fcn.1007a42c
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4
Function at 0x1031d146
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104d224a
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x50], ebx
push edi
call fcn.1031bfc1
lea edx, [esi + 0xc]
mov ecx, edi
call fcn.1031f0fc
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.1031cc08
mov byte [esp + 0x50], 1
lea ecx, [esp + 0x10]
cmp ecx, eax
je 0x1031d1d5
push 0xffffffffffffffff
push ebx
push eax
call fcn.1007a2b8
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.1007a42c
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.1031f0fc
mov eax, dword [esi + 8]
dec eax
je 0x1031d211
dec eax
jne 0x1031d23e
add esi, 0x28
lea eax, [esp + 0x10]
cmp eax, esi
je 0x1031d23e
push 0xffffffffffffffff
push ebx
push esi
mov ecx, eax
call fcn.1007a2b8
jmp 0x1031d23e
push ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x24]
call fcn.1008364f
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x10]
push eax
call fcn.100807b4
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.1007a42c
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.1031f0fc
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.1007a42c
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4

Function at 0x1031d4ad
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104d2305
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x50], ebx
push esi
call fcn.1031bfc1
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.1031d626
mov byte [esp + 0x50], 1
mov edx, eax
mov ecx, esi
call fcn.1031f0fc
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.1007a42c
lea edx, [edi + 0xc]
mov ecx, esi
call fcn.1031f0fc
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.1007a42c
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4
Function at 0x1031d575
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104d0638
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.1031f14c
and dword [esp + 0x38], 0
mov ecx, edi
push eax
call fcn.1031d9ce
or dword [esp + 0x38], 0xffffffff
xor ebx, ebx
push 0
inc ebx
lea ecx, [esp + 0x14]
push ebx
call fcn.1007a42c
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.1031f14c
mov dword [esp + 0x38], ebx
lea ecx, [edi + 0xc]
push eax
call fcn.100807b4
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.1007a42c
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4

Function at 0x1031ded8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x104d2305
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x50], ebx
push esi
call fcn.1031bfc1
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.1031e0bf
mov byte [esp + 0x50], 1
mov edx, eax
mov ecx, esi
call fcn.1031f0fc
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.1007a42c
lea edx, [edi + 0xc]
mov ecx, esi
call fcn.1031f0fc
lea edx, [edi + 0x24]
mov ecx, esi
call fcn.1031f0fc
lea edx, [edi + 0x3c]
mov ecx, esi
call fcn.1031f0fc
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.1007a42c
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4