joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a9e40
Capabilities:
Access peb ldr_data
Create thread
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101733bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
mov eax, dword [ebx + 8]
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0xc]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x4c]
push eax
call fcn.1004bb60
lea eax, [ebx + 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x38
mov byte [ebp - 4], 3
call fcn.101387b7
mov ecx, dword [ebp - 0x54]
add esp, 4
movups xmm0, xmmword [ebp - 0x4c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
movups xmmword [eax + 8], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x18], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
movups xmmword [eax + 0x20], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x30], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b4cc0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100a9fe5
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100a9ff3
lea ecx, [ebp - 0x54]
call fcn.1004fdd0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x100a9f90
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9f86
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a9ff8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov byte [ebx + 0xc], 0
cmp edx, 0x10
jb 0x100a9fd2
mov ecx, dword [ebx + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100a9fc8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a9ff8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x34
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100aa000
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017340b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
mov eax, dword [ebx + 0x18]
movups xmm0, xmmword [ebx + 8]
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x64], 0x1078ec18
movups xmmword [ebp - 0x60], xmm0
call fcn.1004bb60
lea eax, [ebx + 0x34]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x48
mov byte [ebp - 4], 3
call fcn.101387b7
movups xmm0, xmmword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
add esp, 4
movups xmmword [eax + 4], xmm0
mov dword [eax], ecx
movups xmm0, xmmword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
movups xmmword [eax + 0x18], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x28], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
movups xmmword [eax + 0x30], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x40], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b4db0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100aa1b9
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100aa1c7
lea ecx, [ebp - 0x64]
call fcn.1004fd40
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100aa164
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aa15a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aa1cc
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x48]
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0xf
mov byte [ebx + 0x1c], 0
cmp edx, 0x10
jb 0x100aa1a6
mov ecx, dword [ebx + 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aa19c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aa1cc
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x44
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100aa1e0
Capabilities:
Access peb ldr_data
Create thread
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101733bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
mov eax, dword [ebx + 8]
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x24]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x4c]
push eax
call fcn.1004bb60
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x38
mov byte [ebp - 4], 3
call fcn.101387b7
mov ecx, dword [ebp - 0x54]
add esp, 4
movups xmm0, xmmword [ebp - 0x4c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
movups xmmword [eax + 8], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x18], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
movups xmmword [eax + 0x20], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x30], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b4ef0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100aa385
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100aa393
lea ecx, [ebp - 0x54]
call fcn.1004fdd0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x100aa330
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aa326
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aa398
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov byte [ebx + 0xc], 0
cmp edx, 0x10
jb 0x100aa372
mov ecx, dword [ebx + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aa368
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aa398
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x34
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100aa5a0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017340b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
mov eax, dword [ebx + 0x18]
movups xmm0, xmmword [ebx + 8]
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x34]
push eax
mov dword [ebp - 0x64], 0x1078ec18
movups xmmword [ebp - 0x60], xmm0
call fcn.1004bb60
lea eax, [ebx + 0x1c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x48
mov byte [ebp - 4], 3
call fcn.101387b7
movups xmm0, xmmword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
add esp, 4
movups xmmword [eax + 4], xmm0
mov dword [eax], ecx
movups xmm0, xmmword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
movups xmmword [eax + 0x18], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x28], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
movups xmmword [eax + 0x30], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x40], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b4f50
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100aa759
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100aa767
lea ecx, [ebp - 0x64]
call fcn.1004fd40
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100aa704
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aa6fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aa76c
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x48]
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0xf
mov byte [ebx + 0x1c], 0
cmp edx, 0x10
jb 0x100aa746
mov ecx, dword [ebx + 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aa73c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aa76c
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x44
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100aa9f0
Capabilities:
Access peb ldr_data
Create thread
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101733bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
mov eax, dword [ebx + 8]
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x24]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x4c]
push eax
call fcn.1004bb60
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x38
mov byte [ebp - 4], 3
call fcn.101387b7
mov ecx, dword [ebp - 0x54]
add esp, 4
movups xmm0, xmmword [ebp - 0x4c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
movups xmmword [eax + 8], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x18], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
movups xmmword [eax + 0x20], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x30], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b4fb0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100aab95
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100aaba3
lea ecx, [ebp - 0x54]
call fcn.1004fdd0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x100aab40
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aab36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aaba8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov byte [ebx + 0xc], 0
cmp edx, 0x10
jb 0x100aab82
mov ecx, dword [ebx + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aab78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aaba8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x34
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100aadb0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017340b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
mov eax, dword [ebx + 0x18]
movups xmm0, xmmword [ebx + 8]
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x34]
push eax
mov dword [ebp - 0x64], 0x1078ec18
movups xmmword [ebp - 0x60], xmm0
call fcn.1004bb60
lea eax, [ebx + 0x1c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x48
mov byte [ebp - 4], 3
call fcn.101387b7
movups xmm0, xmmword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
add esp, 4
movups xmmword [eax + 4], xmm0
mov dword [eax], ecx
movups xmm0, xmmword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
movups xmmword [eax + 0x18], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x28], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
movups xmmword [eax + 0x30], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x40], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b5010
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100aaf69
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100aaf77
lea ecx, [ebp - 0x64]
call fcn.1004fd40
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100aaf14
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aaf0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aaf7c
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x48]
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0xf
mov byte [ebx + 0x1c], 0
cmp edx, 0x10
jb 0x100aaf56
mov ecx, dword [ebx + 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100aaf4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100aaf7c
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x44
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100ab200
Capabilities:
Access peb ldr_data
Create thread
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101733bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
mov eax, dword [ebx + 8]
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x24]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x4c]
push eax
call fcn.1004bb60
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x38
mov byte [ebp - 4], 3
call fcn.101387b7
mov ecx, dword [ebp - 0x54]
add esp, 4
movups xmm0, xmmword [ebp - 0x4c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
movups xmmword [eax + 8], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x18], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
movups xmmword [eax + 0x20], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x30], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b5070
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100ab3a5
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100ab3b3
lea ecx, [ebp - 0x54]
call fcn.1004fdd0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x100ab350
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100ab346
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ab3b8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov byte [ebx + 0xc], 0
cmp edx, 0x10
jb 0x100ab392
mov ecx, dword [ebx + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100ab388
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ab3b8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x34
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100ab5e0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017340b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
mov eax, dword [ebx + 0x18]
movups xmm0, xmmword [ebx + 8]
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x34]
push eax
mov dword [ebp - 0x64], 0x1078ec18
movups xmmword [ebp - 0x60], xmm0
call fcn.1004bb60
lea eax, [ebx + 0x1c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x48
mov byte [ebp - 4], 3
call fcn.101387b7
movups xmm0, xmmword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
add esp, 4
movups xmmword [eax + 4], xmm0
mov dword [eax], ecx
movups xmm0, xmmword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
movups xmmword [eax + 0x18], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x28], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
movups xmmword [eax + 0x30], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x40], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b50d0
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100ab799
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100ab7a7
lea ecx, [ebp - 0x64]
call fcn.1004fd40
mov edx, dword [ebx + 0x30]
cmp edx, 0x10
jb 0x100ab744
mov ecx, dword [ebx + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100ab73a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ab7ac
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x48]
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0xf
mov byte [ebx + 0x1c], 0
cmp edx, 0x10
jb 0x100ab786
mov ecx, dword [ebx + 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100ab77c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ab7ac
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x44
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3
Function at 0x100aba40
Capabilities:
Access peb ldr_data
Create thread
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101733bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
mov eax, dword [ebx + 8]
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], eax
lea eax, [ebx + 0x24]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x4c]
push eax
call fcn.1004bb60
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.1004bb60
push 0x38
mov byte [ebp - 4], 3
call fcn.101387b7
mov ecx, dword [ebp - 0x54]
add esp, 4
movups xmm0, xmmword [ebp - 0x4c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
movups xmmword [eax + 8], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [eax + 0x18], xmm0
movups xmm0, xmmword [ebp - 0x34]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
movups xmmword [eax + 0x20], xmm0
mov dword [ebp - 0x3c], 0
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
movq qword [eax + 0x30], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x100b5130
push 0
push 0
call fcn.1013fe7e
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100abbe5
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.1009c440
cmp dword [ebp - 0x18], 0
jne 0x100abbf3
lea ecx, [ebp - 0x54]
call fcn.1004fdd0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x100abb90
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100abb86
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100abbf8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov byte [ebx + 0xc], 0
cmp edx, 0x10
jb 0x100abbd2
mov ecx, dword [ebx + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100abbc8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100abbf8
push edx
push ecx
call fcn.10138c1b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x34
push 6
mov dword [ebp - 0x18], 0
call fcn.1013646a
call fcn.1013ff0f
call fcn.1013d33f
int3