joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ca120
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x100ca140
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x100cedb0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x100cf05c
test edx, edx
je 0x100cf05c
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x100cef70
cmp ecx, 0xc0
je 0x100cee90
cmp ecx, 0x80
jne 0x100cf064
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.100cee76
aeskeygenassist xmm1, xmm0, 2
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 4
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 8
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 0x10
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 0x20
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 0x40
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 0x80
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.100cee70
aeskeygenassist xmm1, xmm0, 0x36
call fcn.100cee70
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.100cef10
aeskeygenassist xmm1, xmm2, 2
call fcn.100cef50
aeskeygenassist xmm1, xmm2, 4
call fcn.100cef00
aeskeygenassist xmm1, xmm2, 8
call fcn.100cef50
aeskeygenassist xmm1, xmm2, 0x10
call fcn.100cef00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.100cef50
aeskeygenassist xmm1, xmm2, 0x40
call fcn.100cef00
aeskeygenassist xmm1, xmm2, 0x80
call fcn.100cef50
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.100cf026
aeskeygenassist xmm1, xmm0, 1
call fcn.100cf040
aeskeygenassist xmm1, xmm2, 2
call fcn.100cf020
aeskeygenassist xmm1, xmm0, 2
call fcn.100cf040
aeskeygenassist xmm1, xmm2, 4
call fcn.100cf020
aeskeygenassist xmm1, xmm0, 4
call fcn.100cf040
aeskeygenassist xmm1, xmm2, 8
call fcn.100cf020
aeskeygenassist xmm1, xmm0, 8
call fcn.100cf040
aeskeygenassist xmm1, xmm2, 0x10
call fcn.100cf020
aeskeygenassist xmm1, xmm0, 0x10
call fcn.100cf040
aeskeygenassist xmm1, xmm2, 0x20
call fcn.100cf020
aeskeygenassist xmm1, xmm0, 0x20
call fcn.100cf040
aeskeygenassist xmm1, xmm2, 0x40
call fcn.100cf020
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x100cf090
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.100cedb0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x100cf0f1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x100cf0c2
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x100d7a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x100d7b30
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x100d7ace
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.100d76c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100d7aa0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x100d7bd7
call 0x100d7ae0
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x100d7b80
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.100d76c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100d7b3d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x100d7bd7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.100d76c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100d7bd5
jmp 0x100d7bd7
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100d7c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x100d7d19
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x100d7cb7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100d7800
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100d7c89
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x100d7dc0
call 0x100d7cc9
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x100d7d69
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100d7930
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100d7d26
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x100d7dc0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100d7930
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100d7dbe
jmp 0x100d7dc0
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100dbad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x100dbbaf
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x100dbb45
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.100db180
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100dbb0f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x100dbc66
call 0x100dbb57
pop edx
lea ecx, [edx + 0x129]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x100dbc07
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.100db630
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100dbbbc
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x100dbc66
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.100db630
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100dbc64
jmp 0x100dbc66
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100dc500
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x100dc5df
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x100dc575
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.100dbcc0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100dc53f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x100dc696
call 0x100dc587
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x100dc637
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.100dc0e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100dc5ec
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x100dc696
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.100dc0e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100dc694
jmp 0x100dc696
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100e05f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10199b5a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10211a50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1015e2ee
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x100e0696
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.10162c00
push 0x10205adc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.1016178c
push edi
push esi
call fcn.1015ebb2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016177d
mov esp, ebp
pop ebp
ret 4

Function at 0x100e0db0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10199be8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x10211a50]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.100eb480
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.100e0ce0
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x100e0e21
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.10162c00
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x100e0e4a
push dword [esp + 0xc]
call fcn.1015f106
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100e3200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10199e7b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x10211a50]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
mov eax, dword [0x10211a50]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [0x10219214]
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0
test al, 1
jne 0x100e3283
or eax, 1
mov dword [0x1021927c], 7
mov dword [0x10219214], eax
xor eax, eax
push 0x101a3c50
mov dword [0x10219278], 0
mov word [0x10219268], ax
call fcn.1015f2a9
add esp, 4
push 0
push 0x101f377c
push dword [0x10219278]
mov ecx, 0x10219268
push 0
call fcn.100ec1f0
test eax, eax
jne 0x100e333a
lea eax, [esp + 0x24]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
cmp word [esp + 0x24], ax
jne 0x100e32d6
xor ecx, ecx
jmp 0x100e32ef
lea ecx, [esp + 0x24]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100e32e0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.100e9e50
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x248], 0
push eax
mov ecx, 0x10219268
call fcn.100ebf30
mov dword [esp + 0x240], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x100e333a
push dword [esp + 0xc]
call fcn.1015f106
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x10219268
mov word [esi], ax
call fcn.100ebf30
mov eax, esi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.1016177d
mov esp, ebp
pop ebp
ret
Function at 0x100e3380
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10199ebb
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x10211a50]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
push edi
mov eax, dword [0x10211a50]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [0x1021920c]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0
test al, 1
jne 0x100e3404
or eax, 1
mov dword [0x10219298], 7
mov dword [0x1021920c], eax
xor eax, eax
push 0x101a3cb0
mov dword [0x10219294], 0
mov word [0x10219284], ax
call fcn.1015f2a9
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
push eax
mov dword [esp + 0x264], eax
lea eax, [esp + 0x48]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100e346e
cmp word [esp + 0x44], 0
jne 0x100e3442
xor ecx, ecx
jmp 0x100e345f
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100e3450
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.100e9e50
push 0x101f3798
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.100eea50
mov edi, eax
add esp, 0xc
cmp edi, 0x10219284
je 0x100e34cd
cmp dword [0x10219298], 8
jb 0x100e34a6
push dword [0x10219284]
call fcn.1015f106
add esp, 4
xor eax, eax
mov dword [0x10219298], 7
push edi
mov ecx, 0x10219284
mov dword [0x10219294], 0
mov word [0x10219284], ax
call fcn.100ebe00
cmp dword [esp + 0x28], 8
jb 0x100e34e0
push dword [esp + 0x14]
call fcn.1015f106
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x10219284
mov word [esi], ax
call fcn.100ebf30
cmp dword [esp + 0x40], 8
jb 0x100e3515
push dword [esp + 0x2c]
call fcn.1015f106
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.1016177d
mov esp, ebp
pop ebp
ret
Function at 0x100e3540
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10199efb
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x10211a50]
xor eax, esp
mov dword [esp + 0x44c], eax
push esi
push edi
mov eax, dword [0x10211a50]
xor eax, esp
push eax
lea eax, [esp + 0x460]
mov dword fs:[0], eax
mov eax, dword [0x102191c4]
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], 0
test al, 1
jne 0x100e35c4
or eax, 1
mov dword [0x10219260], 7
mov dword [0x102191c4], eax
xor eax, eax
push 0x101a3d10
mov dword [0x1021925c], 0
mov word [0x1021924c], ax
call fcn.1015f2a9
add esp, 4
push 0x104
lea eax, [esp + 0x250]
push 0
push eax
call fcn.10161e50
push 0x104
lea eax, [esp + 0x54]
push 0
push eax
call fcn.10161e50
xor eax, eax
mov dword [esp + 0x58], 7
add esp, 0x18
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
mov dword [esp + 0x468], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100e3650
lea ecx, [esp + 0x24c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100e3650
push 0x104
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp word [esp + 0x44], 0
jne 0x100e365c
xor ecx, ecx
jmp 0x100e3672
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100e3663
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.100e9e50
push 0x101f3798
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100eea50
mov edi, eax
add esp, 0xc
cmp edi, 0x1021924c
je 0x100e36e0
cmp dword [0x10219260], 8
jb 0x100e36b9
push dword [0x1021924c]
call fcn.1015f106
add esp, 4
xor eax, eax
mov dword [0x10219260], 7
push edi
mov ecx, 0x1021924c
mov dword [0x1021925c], 0
mov word [0x1021924c], ax
call fcn.100ebe00
cmp dword [esp + 0x24], 8
jb 0x100e36f3
push dword [esp + 0x10]
call fcn.1015f106
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x1021924c
mov word [esi], ax
call fcn.100ebf30
cmp dword [esp + 0x40], 8
jb 0x100e3728
push dword [esp + 0x2c]
call fcn.1015f106
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x460]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.1016177d
mov esp, ebp
pop ebp
ret