joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd718d8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
mov eax, 0xf9e764
push ebx
push esi
push edi
call fcn.00f4f878
call fcn.00d71308
mov ebx, eax
mov edx, dword [ebx + 0x3c]
push edx
call sub.USER32.DLL_OpenClipboard
test eax, eax
jne 0xd71910
mov ecx, dword [ebp - 0x4c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0xd71a39
call fcn.00d713b0
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx]
mov dword [ebp - 0x28], esi
test esi, esi
je 0xd71941
mov eax, dword [esi]
mov dword [ebp - 0x24], eax
mov word [ebp - 0x3c], 0x14
push 3
mov edx, dword [ebp - 0x28]
push edx
mov ecx, dword [edx]
call dword [ecx]
mov word [ebp - 0x3c], 8
add esp, 8
mov dword [ebx], edi
call sub.USER32.DLL_EmptyClipboard
mov word [ebp - 0x3c], 0x2c
lea eax, [ebp - 0x20]
push eax
call fcn.00d7ab34
pop ecx
add dword [ebp - 0x30], 3
mov word [ebp - 0x3c], 0x20
xor edx, edx
mov dword [ebp - 0x54], edx
jmp 0xd719e5
lea ecx, [ebp - 0x20]
push ecx
call fcn.00d9a388
pop ecx
mov ebx, eax
mov word [ebp - 0x3c], 0x20
test ebx, ebx
je 0xd719e2
mov eax, dword [ebp - 0x50]
push eax
push ebx
mov edx, dword [ebx]
call dword [edx + 0x18]
add esp, 8
test eax, eax
je 0xd719d2
mov word [ebp - 0x3c], 0x20
xor esi, esi
jmp 0xd719c7
push esi
push ebx
mov eax, dword [ebx]
call dword [eax + 0xc]
add esp, 8
mov edi, eax
mov word [ebp - 0x3c], 0x20
push edi
mov eax, dword [ebp - 0x50]
push eax
push ebx
mov edx, dword [ebx]
call dword [edx + 0x10]
add esp, 0xc
test al, al
je 0xd719c6
push 0
push edi
call sub.USER32.DLL_SetClipboardData
inc esi
push ebx
mov ecx, dword [ebx]
call dword [ecx + 8]
pop ecx
cmp esi, eax
jl 0xd7199a
lea eax, [ebp - 0x20]
push eax
call fcn.00d9a3cc
pop ecx
mov ebx, eax
test ebx, ebx
jne 0xd7197f
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 4]
add esp, 8
mov dword [ebp - 0x50], eax
test eax, eax
jne 0xd71969
call sub.USER32.DLL_CloseClipboard
dec dword [ebp - 0x30]
mov eax, 0xf9e7b4
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x20]
push edx
call dword [eax + 4]
pop ecx
mov word [ebp - 0x3c], 0x20
sub dword [ebp - 0x30], 2
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.00d99b28
add esp, 8
mov eax, dword [ebp - 0x4c]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd8b95c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00e52194
pop ecx
push 0
mov eax, dword [ebx + 0x3c]
push eax
call sub.USER32.DLL_ShowWindow
pop ebx
pop ebp
ret

Function at 0xdb1924
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x102fc74
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x10]
push edx
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00e0ecec
inc dword [ebp - 8]
mov edx, 0x102ff94
mov eax, dword [ebp + 8]
xor ecx, ecx
add eax, 0x30
add esp, 0xc
mov dword [eax], edx
mov dword [eax + 4], ecx
inc dword [ebp - 8]
mov eax, 0x102fed0
mov edx, dword [ebp + 8]
mov ecx, 0x102ff48
mov dword [edx + 8], eax
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], ecx
mov eax, dword [ebp + 8]
add eax, 0x44
or ecx, 0xffffffff
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00db1828
pop ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x38], eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00e0fdec
add esp, 8
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0xdbeea0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x103766c
push ebx
push esi
lea esi, [ebp - 0x24]
call fcn.00f4f878
mov dword [esi + 0x1c], 1
mov word [esi + 0x10], 8
mov word [esi + 0x10], 0x14
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00dbded4
add dword [esi + 0x1c], 3
mov ecx, dword [ebp + 8]
mov edx, 0x10389b0
mov eax, 0x1038a08
add esp, 0xc
mov dword [ecx + 8], edx
mov edx, dword [ebp + 8]
mov dword [edx + 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x38
push ecx
call fcn.00de08c4
pop ecx
inc dword [esi + 0x1c]
mov ebx, dword [ebp + 8]
add ebx, 0x3c
push ebx
call fcn.00d99a0c
pop ecx
mov eax, 0xf9926c
add dword [esi + 0x1c], 2
mov dword [ebx], eax
mov edx, 0xf99298
inc dword [esi + 0x1c]
mov dword [ebx], edx
mov byte [ebx + 0x20], 1
mov byte [ebx + 4], 1
inc dword [esi + 0x1c]
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0xfffffffc
lea edx, [ebp + 0xc]
mov dword [ecx + 0x60], eax
mov word [esi + 0x10], 0x2c
push edx
lea ecx, [esp + 4]
push ecx
call fcn.00de0a9c
add esp, 8
inc dword [esi + 0x1c]
mov eax, dword [ebp + 8]
push eax
mov word [esi + 0x10], 0x20
dec dword [esi + 0x1c]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 8]
call dword [ecx + 0x44]
add esp, 8
dec dword [esi + 0x1c]
push 2
lea eax, [ebp + 0xc]
push eax
call fcn.00de0bf8
add esp, 8
mov edx, dword [esi]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xdbef94
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x10376b4
push ebx
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00dbded4
add dword [ebp - 8], 3
mov ecx, dword [ebp + 8]
mov edx, 0x10389b0
mov eax, 0x1038a08
add esp, 0xc
mov dword [ecx + 8], edx
mov edx, dword [ebp + 8]
mov dword [edx + 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x38
push ecx
call fcn.00de08c4
pop ecx
inc dword [ebp - 8]
mov ebx, dword [ebp + 8]
add ebx, 0x3c
push ebx
call fcn.00d99a0c
pop ecx
mov eax, 0xf9926c
add dword [ebp - 8], 2
mov dword [ebx], eax
mov edx, 0xf99298
inc dword [ebp - 8]
mov dword [ebx], edx
mov byte [ebx + 0x20], 1
mov byte [ebx + 4], 1
inc dword [ebp - 8]
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x60], eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xdbffe8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x1037d10
push ebx
push esi
lea esi, [ebp - 0x24]
call fcn.00f4f878
mov dword [esi + 0x1c], 4
mov word [esi + 0x10], 8
mov word [esi + 0x10], 0x14
mov edx, dword [ebp + 0x34]
push edx
mov ecx, dword [ebp + 0x30]
push ecx
push 0x1036f9d
mov eax, dword [ebp + 8]
push eax
call fcn.00dbfc98
add dword [esi + 0x1c], 4
mov ecx, dword [ebp + 8]
mov edx, 0x10388c4
mov eax, 0x1038920
add esp, 0x10
mov dword [ecx + 8], edx
add esp, 0xffffffdc
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
mov dword [edx + 0x30], eax
mov word [esi + 0x10], 0x2c
push ecx
lea eax, [esp + 4]
push eax
call fcn.00d99a98
add dword [esi + 0x1c], 2
add esp, 8
mov edx, 0xf9926c
mov ecx, 0xf99298
mov dword [esp], edx
inc dword [esi + 0x1c]
mov dword [esp], ecx
mov byte [esp + 0x20], 0
push esp
mov eax, dword [esp + 4]
call dword [eax + 4]
pop ecx
mov bl, byte [ebp + 0x2c]
mov byte [esp + 0x20], bl
mov byte [esp + 4], bl
lea eax, [ebp + 0xc]
push eax
lea edx, [esp + 4]
push edx
call fcn.00d99c10
add esp, 8
inc dword [esi + 0x1c]
mov ecx, dword [ebp + 8]
push ecx
mov word [esi + 0x10], 0x20
add dword [esi + 0x1c], 0xfffffffc
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
call dword [edx + 0x50]
add esp, 0x28
dec dword [esi + 0x1c]
mov eax, 0xf99298
mov dword [ebp + 0xc], eax
lea edx, [ebp + 0xc]
push edx
call dword [eax + 4]
pop ecx
mov word [esi + 0x10], 0x14
dec dword [esi + 0x1c]
mov eax, 0xf9926c
mov dword [ebp + 0xc], eax
lea edx, [ebp + 0xc]
push edx
call dword [eax + 4]
pop ecx
sub dword [esi + 0x1c], 2
push 0
lea ecx, [ebp + 0xc]
push ecx
call fcn.00d99b28
add esp, 8
mov eax, dword [esi]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xde16b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
test cl, 3
je 0xde16ed
cmp dword [eax + 0x20], 0
je 0xde16d7
mov edx, dword [edx]
mov eax, dword [edx + 0x20]
mov edx, dword [eax]
jmp 0xde16d9
xor edx, edx
mov eax, edx
mov edx, ecx
add edx, eax
cmp edx, eax
jbe 0xde172d
xor byte [eax], 0xff
inc eax
cmp edx, eax
ja 0xde16e3
pop ebp
ret
mov eax, dword [edx]
cmp dword [eax + 0x20], 0
je 0xde16fe
mov eax, dword [edx]
mov eax, dword [eax + 0x20]
mov eax, dword [eax]
jmp 0xde1700
xor eax, eax
shr ecx, 2
shl ecx, 2
add ecx, eax
cmp byte [ebp + 0xc], 0
je 0xde171d
mov edx, dword [edx]
cmp dword [edx + 0xc], 0x20
jne 0xde171d
mov edx, str.x_x_xx_x.x0x5x7xCxDxGxHxLxNxRxxx_xaxcxdxhxjxnxzxx
jmp 0xde1720
or edx, 0xffffffff
cmp ecx, eax
jbe 0xde172d
xor dword [eax], edx
add eax, 4
cmp ecx, eax
ja 0xde1724
pop ebp
ret
Function at 0xdf6580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov edx, dword [ebp + 8]
xor eax, eax
test edx, edx
je 0xdf65b8
jmp 0xdf65b2
shl eax, 4
and ecx, 0xff
add eax, ecx
inc edx
mov ecx, eax
and ecx, 0xf0000000
test ecx, ecx
je 0xdf65ae
mov ebx, ecx
shr ebx, 0x18
xor eax, ebx
not ecx
and eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0xdf658f
test eax, eax
jne 0xdf65c1
mov eax, 1
pop ebx
pop ebp
ret

Function at 0xe052e8
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x1047c3c
push ebx
push esi
lea esi, [ebp + 8]
call fcn.00f4f878
mov word [ebp - 0x14], 8
push 0
push 0
mov edx, dword [esi]
push edx
call fcn.00e0ecec
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [esi]
add eax, 0x30
mov dword [eax], 1
mov ebx, dword [esi]
add ebx, 0x34
mov eax, 0x1032a2c
mov dword [ebx], eax
push 0
push 0
lea edx, [ebx + 4]
push edx
call fcn.00e3c470
add dword [ebp - 8], 2
inc dword [ebp - 8]
mov ecx, 0x10482d8
mov dword [ebx], ecx
mov edx, 0x1042bbc
inc dword [ebp - 8]
mov ecx, 0x1048230
mov eax, dword [esi]
add esp, 0xc
add eax, 0x6c
mov dword [eax], edx
mov edx, 0x1048298
mov eax, dword [esi]
mov dword [eax + 8], ecx
mov eax, 0x10482b0
mov ecx, dword [esi]
mov dword [ecx + 0x34], edx
or ecx, 0xffffffff
mov edx, dword [esi]
mov dword [edx + 0x6c], eax
xor edx, edx
mov eax, dword [esi]
add eax, 0xb0
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov eax, dword [esi]
xor edx, edx
add eax, 0xc0
or ecx, 0xffffffff
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov eax, dword [esi]
add eax, 0xd8
push eax
call fcn.00e1bf70
pop ecx
add dword [ebp - 8], 2
mov edx, dword [esi]
add edx, 0xf0
push edx
call fcn.00dba3e0
pop ecx
xor edx, edx
add dword [ebp - 8], 3
mov eax, dword [esi]
add eax, 0x108
mov dword [eax + 4], 0x40000000
mov dword [eax], edx
xor eax, eax
mov ecx, dword [esi]
mov dword [ecx + 0x80], eax
xor ecx, ecx
mov edx, dword [esi]
mov dword [edx + 0xd0], ecx
xor edx, edx
mov eax, dword [esi]
mov dword [eax + 0xd4], edx
xor eax, eax
mov ecx, dword [esi]
mov dword [ecx + 0x78], eax
xor ecx, ecx
mov edx, dword [esi]
mov dword [edx + 0x74], ecx
xor edx, edx
mov eax, dword [esi]
mov dword [eax + 0x7c], edx
push 0
mov ecx, dword [esi]
push ecx
call fcn.00e057fc
add esp, 8
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe339b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
lea ebx, [ebp + 8]
mov eax, 0x1053400
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x50], eax
mov edx, dword [ebx]
mov dword [edx], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x38], eax
mov edx, dword [ebx]
mov dword [edx + 0x34], eax
mov edx, dword [ebx]
mov dword [edx + 0x30], eax
mov edx, dword [ebx]
mov dword [edx + 0x2c], eax
mov edx, dword [ebx]
mov dword [edx + 0x28], eax
mov edx, dword [ebx]
mov dword [edx + 0x54], eax
mov edx, dword [ebx]
mov dword [edx + 8], eax
dec eax
mov ecx, dword [ebx]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebx]
mov dword [eax + 0x20], edx
mov eax, dword [ebx]
mov dword [eax + 0x14], edx
mov eax, dword [ebx]
mov dword [eax + 0x10], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x40], eax
mov edx, dword [ebx]
mov dword [edx + 0x3c], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x48], eax
mov edx, dword [ebx]
mov dword [edx + 0x44], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x1c], eax
mov edx, dword [ebx]
mov dword [edx + 0x18], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x58], eax
fld qword [0xe33a6c]
mov edx, dword [ebx]
fst qword [edx + 0x68]
mov ecx, dword [ebx]
fstp qword [ecx + 0x60]
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xe3744c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x1053d20
push ebx
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov ebx, dword [ebp + 8]
add ebx, 0x10
push ebx
call fcn.00d99a0c
pop ecx
mov eax, 0x1054b1c
add dword [ebp - 8], 2
mov dword [ebx], eax
inc dword [ebp - 8]
mov ebx, dword [ebp + 8]
add ebx, 0x30
push ebx
call fcn.00d99a0c
pop ecx
mov eax, 0x1054b1c
add dword [ebp - 8], 2
mov dword [ebx], eax
inc dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xe3f320
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x1056098
push ebx
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00e0ecec
inc dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, 0x1057500
mov dword [ecx + 8], edx
mov ebx, dword [ebp + 8]
push 0
push 1
push 0
add ebx, 0x30
push 0x11
push ebx
call fcn.00d97ecc
add dword [ebp - 8], 2
mov eax, 0x10574d8
add esp, 0x14
mov dword [ebx], eax
inc dword [ebp - 8]
mov edx, dword [ebp + 8]
push edx
call fcn.00e3f440
pop ecx
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe505b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x105b8a8
push ebx
push esi
push edi
call fcn.00f4f878
mov word [ebp - 0x18], 8
mov edx, 0x105ba7c
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
push 0x34
call fcn.00f4dd50
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0xe506b1
mov word [ebp - 0x18], 0x20
cmp dword [0x10292b4], 0
je 0xe505fd
mov edx, dword [0x10292b4]
jmp 0xe50604
call fcn.00da3d94
mov edx, eax
mov eax, dword [ebp - 4]
mov dword [eax], edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
inc dword [eax]
inc dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edi, 8
cmp dword [0x10292b4], 0
je 0xe50629
mov eax, dword [0x10292b4]
jmp 0xe5062e
call fcn.00da3d94
mov dword [edi], eax
mov edx, dword [edi]
inc dword [edx]
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, 0xc
cmp dword [0x10292b4], 0
mov dword [ebp - 0x2c], ecx
je 0xe50650
mov eax, dword [0x10292b4]
jmp 0xe50655
call fcn.00da3d94
mov edx, dword [ebp - 0x2c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx]
inc dword [eax]
inc dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov eax, 0xf98f3c
mov dword [ebx], eax
xor edx, edx
mov dword [ebx + 4], edx
lea ecx, [ebx + 8]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [eax], edx
mov esi, dword [ebp - 4]
add esi, 0x20
mov eax, 0xf98f3c
mov dword [esi], eax
xor edx, edx
mov dword [esi + 4], edx
lea ecx, [esi + 8]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [eax], edx
add dword [ebp - 0xc], 0xfffffffd
mov word [ebp - 0x18], 0x14
mov ecx, dword [ebp - 4]
jmp 0xe506b4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov esi, dword [edx + 4]
push esi
push ebx
call fcn.00da4388
add esp, 8
lea eax, [esi + 8]
push eax
lea edx, [ebx + 8]
push edx
call fcn.00da4388
add esp, 8
lea ecx, [esi + 0xc]
push ecx
lea eax, [ebx + 0xc]
push eax
call fcn.00da4388
add esp, 8
lea edx, [esi + 0x14]
mov dword [ebp - 0x38], edx
lea eax, [ebx + 0x14]
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
lea eax, [esi + 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x3c]
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov dl, byte [esi + 0x2c]
mov byte [ebx + 0x2c], dl
mov cl, byte [esi + 0x2d]
mov byte [ebx + 0x2d], cl
mov al, byte [esi + 0x2e]
mov byte [ebx + 0x2e], al
mov dl, byte [esi + 0x2f]
mov byte [ebx + 0x2f], dl
mov cl, byte [esi + 0x30]
mov byte [ebx + 0x30], cl
mov al, byte [esi + 0x31]
mov byte [ebx + 0x31], al
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe5076c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x105b918
push ebx
push esi
push edi
call fcn.00f4f878
mov word [ebp - 0x18], 8
mov edx, 0x105ba7c
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
push 0x34
call fcn.00f4dd50
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0xe5086d
mov word [ebp - 0x18], 0x20
cmp dword [0x10292b4], 0
je 0xe507b9
mov edx, dword [0x10292b4]
jmp 0xe507c0
call fcn.00da3d94
mov edx, eax
mov eax, dword [ebp - 4]
mov dword [eax], edx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
inc dword [eax]
inc dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edi, 8
cmp dword [0x10292b4], 0
je 0xe507e5
mov eax, dword [0x10292b4]
jmp 0xe507ea
call fcn.00da3d94
mov dword [edi], eax
mov edx, dword [edi]
inc dword [edx]
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, 0xc
cmp dword [0x10292b4], 0
mov dword [ebp - 0x2c], ecx
je 0xe5080c
mov eax, dword [0x10292b4]
jmp 0xe50811
call fcn.00da3d94
mov edx, dword [ebp - 0x2c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx]
inc dword [eax]
inc dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov eax, 0xf98f3c
mov dword [ebx], eax
xor edx, edx
mov dword [ebx + 4], edx
lea ecx, [ebx + 8]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [eax], edx
mov esi, dword [ebp - 4]
add esi, 0x20
mov eax, 0xf98f3c
mov dword [esi], eax
xor edx, edx
mov dword [esi + 4], edx
lea ecx, [esi + 8]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [eax], edx
add dword [ebp - 0xc], 0xfffffffd
mov word [ebp - 0x18], 0x14
mov ecx, dword [ebp - 4]
jmp 0xe50870
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push edx
call fcn.00da4388
add esp, 8
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 0x14]
push ecx
add eax, 8
push eax
call fcn.00da4388
add esp, 8
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
add ecx, 0xc
push ecx
call fcn.00da4388
add esp, 8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x10], edx
mov edx, dword [ebp + 0x20]
add eax, 0x14
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x20
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dl, byte [ebp + 0x28]
mov byte [eax + 0x2c], dl
mov cl, byte [ebp + 0x2c]
mov byte [eax + 0x2d], cl
mov dl, byte [ebp + 0x30]
mov byte [eax + 0x2e], dl
mov cl, byte [ebp + 0x34]
mov byte [eax + 0x2f], cl
mov dl, byte [ebp + 0x38]
mov byte [eax + 0x30], dl
mov cl, byte [ebp + 0x3c]
mov byte [eax + 0x31], cl
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe645dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push esi
push edi
mov eax, 0x10618f0
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00e5138c
add dword [ebp - 8], 5
mov eax, dword [ebp + 8]
mov ecx, 0x1061bc0
mov edx, 0x1061d78
add esp, 0x10
mov dword [eax + 8], ecx
lea esi, [ebp - 0x34]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x30], edx
xor edx, edx
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
add eax, 0x80
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp + 8]
mov ecx, 4
lea edi, [eax + 0x80]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x90], edx
mov ecx, dword [ebp + 8]
mov word [ecx + 0x94], 1
mov eax, dword [ebp + 8]
mov word [eax + 0x96], 0
mov edx, dword [ebp + 8]
xor eax, eax
mov word [edx + 0x98], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x9c], eax
mov edx, dword [ebp + 8]
push edx
call fcn.00e64790
pop ecx
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret