joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1004596f
pop dword [ebp - 0x44]
mov eax, 0xda80f0c8
add eax, 0x358368a7
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x8b1c5
push 0
mov eax, 0x20d1b331
sub eax, 0x10bc60dd
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x5564
mov edx, eax
mov ebx, 0x101eb000
add ebx, dword [ebp - 0x44]
mov edi, 0x73490699
add edi, 0x92b58ab6
sub dword [ebp - 0x20], 0xcb36796b
mov esi, dword [ebx]
sub dword [ebp - 0x38], ecx
add esi, edi
xor dword [ebp - 0x28], 0x70c32651
mov dword [edx], esi
sub dword [ebp - 0x38], 0x7f264e99
add edx, 0xc81fca9
sub edx, 0xc81fca5
add ebx, 0x2eb2ad8
sub ebx, 0x2eb2ad4
loop 0x100459c2
add eax, 0xd7bc11da
sub eax, 0xd7bac977
mov ebx, eax
add eax, 0x1b917911
add eax, 0xe46e86f4
mov ecx, 0xb2317e42
sub ecx, 0xa2317e42
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1004ee10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013a0b3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
test byte [0x101cb200], 1
je 0x1004ee5f
push dword [0x101cb20c]
mov ecx, 0x1016d2b0
push dword [0x101cb208]
call fcn.10045960
add esp, 8
push 0xc
call fcn.10045960
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
test eax, eax
je 0x1004ee98
mov dword [eax], vtable.appv::utility::scope_guard_func.0
mov byte [esp + 0x20], 1
mov dword [eax], vtable.._AV__scope_guard_func_impl_V___Bind__00XQ6AXXZ___V_std___utility_appv__.0
mov dword [eax + 4], 0x1004dcb0
mov byte [esp + 0x20], 0
jmp 0x1004ee9a
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 3
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0x1004eeba
call fcn.10045960
mov esi, dword [edi + 8]
lea eax, [edi + 8]
test esi, esi
je 0x1004eeeb
xorps xmm0, xmm0
lea ecx, [esi + 0x20]
movdqu xmmword [esi], xmm0
movdqu xmmword [esi + 0x10], xmm0
call fcn.10045960
lea ecx, [esi + 0x28]
call fcn.10045960
lea ecx, [esi + 0x30]
call fcn.10045960
lea eax, [edi + 8]
mov ecx, eax
call fcn.10045960
xorps xmm0, xmm0
lea ecx, [edi + 0x30]
movdqu xmmword [edi + 0x10], xmm0
movdqu xmmword [edi + 0x20], xmm0
call fcn.10045960
lea ecx, [edi + 0x38]
call fcn.10045960
lea ecx, [edi + 0x40]
call fcn.10045960
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.10045960
xor eax, eax
mov edx, 0x80
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10058dd0
Capabilities:
Listen for remote procedure calls

Disassembly:
push esi
push 1
push dword [ecx + 8]
push dword [ecx + 4]
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
cmp esi, 0x6b1
je 0x10058dfc
test esi, esi
je 0x10058dfc
call fcn.10045960
or eax, esi
or edx, 0x2125
pop esi
ret
mov edx, 0x80
xor eax, eax
pop esi
ret
Function at 0x10074160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013ead8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
lea ecx, [esp + 0x28]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x28]
mov esi, dword [ebp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x24], eax
lea eax, [ebx + 4]
push 0
push eax
push 1
call fcn.10045960
mov dword [esp + 0x68], 0
mov dword [esp + 0x28], vtable.jitv::enable_jitv.0
mov dword [esp + 0x68], 1
push dword [ebp + 0x30]
mov eax, dword [ebx + 0x28]
push esi
push edi
push dword [esp + 0x30]
mov ecx, dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x3c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x68], 0xffffffff
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x2c

Function at 0x10075eb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov edi, dword [ebp + 0xc]
push 0
lea ebx, [esi + 4]
push ebx
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
mov eax, dword [esi + 0x28]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
js 0x10075f36
push edi
mov edx, 0x10176114
mov ecx, ebx
call fcn.10045960
add esp, 4
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 8
Function at 0x10076bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
mov eax, dword [esi + 0x28]
push edi
push dword [ebp + 0x10]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1007a770
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013e9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x18]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [edi + 4]
push 0
push eax
push 1
call fcn.10045960
mov dword [esp + 0x58], 0
mov dword [esp + 0x18], vtable.jitv::enable_jitv.0
mov dword [esp + 0x58], 1
mov eax, dword [edi + 0x28]
push esi
push dword [ebp + 0x18]
mov ecx, dword [eax]
push ebx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
call dword [ecx + 0x30]
mov esi, eax
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1007e5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
mov eax, dword [esi + 0x28]
push edi
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100848a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
mov eax, dword [esi + 0x28]
push edi
push ebx
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10085270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
mov eax, dword [esi + 0x28]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push dword [ebp + 0x10]
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x18

Function at 0x100854b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov edi, dword [ebp + 0xc]
push 0
lea ebx, [esi + 4]
push ebx
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
mov eax, dword [esi + 0x28]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
js 0x10085536
push edi
mov edx, 0x101786d8
mov ecx, ebx
call fcn.10045960
add esp, 4
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 8
Function at 0x10086210
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013e9e8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 8]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x48], 0
mov dword [esp + 8], vtable.jitv::enable_jitv.0
mov dword [esp + 0x48], 1
mov eax, dword [esi + 0x28]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 8]
mov dword [esp + 8], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 8

Function at 0x10088430
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
push dword [ebp + 0x18]
mov eax, dword [esi + 0x28]
push edi
push dword [ebp + 0x10]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1008a510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013e9e8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 8]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x48], 0
mov dword [esp + 8], vtable.jitv::enable_jitv.0
mov dword [esp + 0x48], 1
mov eax, dword [esi + 0x28]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 8]
mov dword [esp + 8], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1008b420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x50], 0
mov dword [esp + 0x10], vtable.jitv::enable_jitv.0
mov dword [esp + 0x50], 1
mov eax, dword [esi + 0x28]
push edi
push ebx
push dword [ebp + 0x10]
mov ecx, dword [eax]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1008b8d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013e9e8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esp + 8]
push 0
lea eax, [esi + 4]
push eax
push 1
call fcn.10045960
mov dword [esp + 0x48], 0
mov dword [esp + 8], vtable.jitv::enable_jitv.0
mov dword [esp + 0x48], 1
mov eax, dword [esi + 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 8]
mov dword [esp + 8], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 4
Function at 0x1008c410
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013e9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101bb518]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x18]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
lea eax, [edi + 4]
push 0
push eax
push 1
call fcn.10045960
mov dword [esp + 0x58], 0
mov dword [esp + 0x18], vtable.jitv::enable_jitv.0
mov dword [esp + 0x58], 1
mov eax, dword [edi + 0x28]
push esi
push ebx
push dword [esp + 0x1c]
mov ecx, dword [eax]
push dword [esp + 0x1c]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x30]
mov esi, eax
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.jitv::jitv_tls_data.0
call fcn.10045960
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10115876
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100bdd10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1013a0b3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
test byte [0x101cb200], 1
je 0x100bdd5e
push dword [0x101cb20c]
mov ecx, 0x10172518
push dword [0x101cb208]
call fcn.10045960
add esp, 8
push 0xc
call fcn.10045960
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
test eax, eax
je 0x100bdd97
mov dword [eax], vtable.appv::utility::scope_guard_func.0
mov byte [esp + 0x20], 1
mov dword [eax], vtable.._AV__scope_guard_func_impl_V___Bind__00XQ6AXXZ___V_std___utility_appv__.0
mov dword [eax + 4], 0x100bbe00
mov byte [esp + 0x20], 0
jmp 0x100bdd99
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 3
lea ecx, [esi + 0x60]
call fcn.10045960
lea ecx, [esi + 0x50]
call fcn.10045960
lea ecx, [esi + 0x58]
call fcn.10045960
lea ecx, [esi + 0x28]
call fcn.10045960
lea ecx, [esi + 0x30]
call fcn.10045960
lea ecx, [esi + 0x38]
call fcn.10045960
lea ecx, [esi + 0x40]
call fcn.10045960
mov dword [esi + 0x48], 0
xorps xmm0, xmm0
mov dword [esi + 0x4c], 0
movdqu xmmword [esi + 8], xmm0
movdqu xmmword [esi + 0x18], xmm0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.10045960
xor eax, eax
mov edx, 0x80
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c6560
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10148618
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x101bb518]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add eax, 0xc
mov ecx, dword [0x101caba8]
mov dword [esp + 0x24], eax
mov eax, ebx
and eax, 0x300
mov dword [esp + 0x1c], 0x18
or eax, dword [esi + 4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x100c65ee
lea edx, [esp + 0x1c]
push edx
push eax
lea eax, [esp + 0x18]
push eax
call ecx
jmp 0x100c65ff
lea ecx, [esp + 0x1c]
push ecx
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x100c66b4
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x40], 1
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
push eax
movzx eax, byte [esi + 0x10]
push eax
call fcn.10045960
mov edi, eax
add esp, 0xc
test edi, edi
js 0x100c667c
cmp byte [esi + 8], 0
je 0x100c665d
mov edx, ebx
lea ecx, [esp + 0x14]
call fcn.10045960
mov edi, eax
test edi, edi
js 0x100c667c
mov edx, dword [ebp + 0x14]
xor edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [edx], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [edx + 4], ecx
mov dword [esp + 0x40], 0xffffffff
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100c66b2
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x100c66b2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x100c66b2
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100fa8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 4]
mov edx, dword [eax + 0x14]
mov esi, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [0x101cabac]
test edx, edx
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
push edx
push esi
push edi
push ebx
push eax
push ecx
je 0x100fa924
call dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
pop edi
pop esi
pop ebx
pop ebp
ret 8