joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b99e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10152178
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101f2fb0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x50]
mov eax, dword [edi]
mov edx, dword [eax + 0x78]
mov esi, ecx
mov ecx, edi
call edx
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], ecx
mov edx, dword [eax + 0xc]
movzx eax, word [esi + 0x34]
push eax
push 0x10
lea ecx, [esp + 0x34]
push ecx
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], edx
call fcn.100dc6c0
push edi
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x50], 0
call fcn.100dc1b0
mov eax, dword [esp + 0x54]
push eax
sub esp, 0x1c
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.100dc740
mov eax, dword [esi + 0x24]
mov edx, dword [eax + 0x2c]
lea ecx, [esi + 0x24]
call edx
mov ecx, esi
call fcn.100dcd10
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.100dc690
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1012944a
add esp, 0x40
ret 8

Function at 0x100c8510
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10152178
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101f2fb0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x50]
mov eax, dword [edi]
mov edx, dword [eax + 0xbc]
mov esi, ecx
mov ecx, edi
call edx
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], ecx
mov edx, dword [eax + 0xc]
movzx eax, word [esi + 0x34]
push eax
push 0x10
lea ecx, [esp + 0x34]
push ecx
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], edx
call fcn.100dc6c0
push edi
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x50], 0
call fcn.100dc1b0
mov eax, dword [esp + 0x54]
push eax
sub esp, 0x1c
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.100dc740
mov eax, dword [esi + 0x24]
mov edx, dword [eax + 0x2c]
lea ecx, [esi + 0x24]
call edx
mov ecx, esi
call fcn.100dcd10
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.100dc690
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1012944a
add esp, 0x40
ret 8
Function at 0x100d3750
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x370
mov eax, dword [0x101f2fb0]
xor eax, esp
mov dword [esp + 0x36c], eax
mov eax, dword [esp + 0x374]
push ebx
mov ebx, dword [esp + 0x380]
push ebp
push edi
mov edi, dword [esp + 0x384]
xor ebp, ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov byte [esp + 0xf], 0
test eax, eax
je 0x100d397b
test edi, edi
je 0x100d397b
mov ecx, eax
push esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100d37a1
sub ecx, esi
mov esi, ecx
mov dword [esp + 0x1c], esi
jne 0x100d37ef
mov dword [esp + 0x24], str.AAFPGAPI.DLL
mov dword [esp + 0x28], str.AAFINTP.DLL
mov dword [esp + 0x2c], ebp
lea esi, [esp + 0x24]
lea ebx, [ebx]
mov eax, dword [esi]
test eax, eax
je 0x100d3974
push ebx
push 0
push eax
push eax
call edi
mov ebp, eax
add esp, 0x10
add esi, 4
test ebp, ebp
je 0x100d37d0
jmp 0x100d3840
lea edx, [esp + 0x170]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100d37f8
cmp byte [esp + esi + 0x16f], 0x5c
jne 0x100d3833
cmp esi, 0x102
jae 0x100d383b
lea edi, [esp + 0x170]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100d3820
mov ax, word [0x101825dc]
mov word [edi], ax
jmp 0x100d387c
cmp esi, 0x101
jb 0x100d3859
mov eax, 0x8012016c
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x36c]
xor ecx, esp
call fcn.1012944a
add esp, 0x370
ret
lea eax, [esp + 0x170]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100d3861
mov cx, word [0x101825d8]
mov dl, byte [0x101825da]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x174]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
test ebx, ebx
je 0x100d389a
cmp ebx, 0xffffffff
jne 0x100d38a4
mov ebp, 0x80120021
jmp 0x100d3964
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100d38b4
mov esi, dword [esp + 0x1c]
cmp byte [esp + 0x13], 0
jne 0x100d395d
mov edx, dword [esp + 0x30]
shr edx, 4
lea eax, [esp + 0x5c]
and dl, 1
mov ecx, eax
sub esi, ecx
mov byte [esp + 0x20], dl
lea esi, [esp + esi + 0x171]
lea esp, [esp]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x100d38e0
test dl, dl
je 0x100d3907
lea esi, [esp + 0x5c]
call fcn.100d3640
test al, al
je 0x100d3934
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push edx
push eax
jmp 0x100d391e
lea eax, [esp + 0x170]
call fcn.100d36b0
test al, al
je 0x100d3934
mov eax, dword [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x17c]
push edx
call dword [esp + 0x28]
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x100d395d
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100d38b0
mov byte [esp + 0x13], 1
call edi
mov ebp, eax
test ebp, ebp
je 0x100d38b0
cmp ebp, 0x12
jne 0x100d3964
xor ebp, ebp
test ebx, ebx
je 0x100d3974
cmp ebx, 0xffffffff
je 0x100d3974
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebp
jmp 0x100d3840
mov ecx, dword [esp + 0x378]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x80120164
call fcn.1012944a
add esp, 0x370
ret
Function at 0x100d6d60
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10152a08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
push eax
push edi
call fcn.100d6c40
mov ecx, dword [esp + 0x30]
add esp, 4
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
mov ecx, esi
call fcn.100e99e0
lea ebx, [esi + 0x64]
mov dword [esi], vtable.ImplAAFOMCachedRawStorage.1.0
mov dword [esi + 4], vtable.ImplAAFOMCachedRawStorage.0
mov dword [esi + 0x60], edi
mov dword [ebx], 0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push edi
mov dword [esp + 0x20], 0
call ecx
mov eax, dword [esi + 0x60]
mov edx, dword [eax]
push ebx
push 0x1015bf80
push eax
mov eax, dword [edx]
call eax
test eax, eax
mov eax, esi
jge 0x100d6df4
mov dword [ebx], 0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10

Function at 0x100dc2e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10152cd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.100de4d0
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.100dc1c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 2
call fcn.100de630
mov edx, dword [esp + 0x38]
mov dword [esi + 0x14], edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 0xc

Function at 0x100dc6c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10152d60
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.100de8e0
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.100dc240
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.100dea10
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 0x10

Function at 0x100e2ce0
Capabilities:
Delete file

Disassembly:
sub esp, 0x108
mov eax, dword [0x101f2fb0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
call fcn.100e2c20
cmp eax, 3
jne 0x100e2d26
push esi
call dword [sym.imp.MSVCR90.dll__wremove]
add esp, 4
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1012944a
add esp, 0x108
ret
push 0x104
lea eax, [esp + 8]
push esi
push eax
call fcn.100dc990
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR90.dll_remove]
mov ecx, dword [esp + 0x118]
add esp, 0x10
pop esi
xor ecx, esp
call fcn.1012944a
add esp, 0x108
ret
Function at 0x100eaa60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10153558
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.OMRawStorage.0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
lea edi, [esi + 4]
push edx
mov ecx, edi
mov dword [esp + 0x24], 0
call fcn.100eb8f0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi], vtable.OMCachedRawStorage.0
mov dword [edi], vtable.OMCachedRawStorage.1.0
mov dword [esi + 0x44], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x100ec2a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101538eb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
call fcn.100e32d0
lea edi, [esi + 0x1c]
mov ecx, edi
mov dword [esp + 0x2c], 0
mov dword [esi], vtable.OMStrongReferenceProperty_class_OMStorable_.0
call fcn.100de4b0
mov ecx, esi
mov byte [esp + 0x2c], 1
call fcn.100dcd40
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.100de4d0
push eax
mov ecx, edi
mov byte [esp + 0x30], 2
call fcn.100de6c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.100de630
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 8

Function at 0x100ec4e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101538eb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
call fcn.100e32d0
lea edi, [esi + 0x1c]
mov ecx, edi
mov dword [esp + 0x2c], 0
mov dword [esi], vtable.OMStrongReferenceProperty_class_OMDictionary_.0
call fcn.100de4b0
mov ecx, esi
mov byte [esp + 0x2c], 1
call fcn.100dcd40
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.100de4d0
push eax
mov ecx, edi
mov byte [esp + 0x30], 2
call fcn.100de6c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.100de630
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 8
Function at 0x100ee4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [0x101f2fb0]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push edi
call edx
mov ecx, dword [esi + 0xb8]
add ecx, dword [esp + 0x64]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xbc]
adc edx, dword [esp + 0x68]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x34]
push edx
push ecx
mov ecx, esi
call eax
mov edx, dword [esi]
mov edx, dword [edx + 0x100]
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0xfc]
mov ecx, esi
call edx
movzx ecx, byte [esi + 0x7c]
mov eax, dword [esi]
mov eax, dword [eax + 0xec]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call eax
mov edx, dword [esi]
mov edx, dword [edx + 0xf8]
lea eax, [esp + 0x13]
push eax
mov ecx, esi
call edx
xor ebx, ebx
xor edi, edi
cmp dword [esp + 0x18], ebx
jb 0x100ee60f
ja 0x100ee550
cmp dword [esp + 0x14], ebx
jbe 0x100ee60f
movzx ecx, byte [esi + 0x7c]
mov eax, dword [esi]
mov eax, dword [eax + 0xe8]
push ecx
lea edx, [esp + 0x50]
push edx
mov ecx, esi
call eax
movzx eax, byte [esi + 0x7c]
mov edx, dword [esi]
mov edx, dword [edx + 0xec]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
mov dword [esp + 0x2c], 0
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0xf8]
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call edx
mov ebp, dword [esp + 0x24]
mov ecx, dword [esi + 0xc0]
mov edx, dword [ecx]
sub esp, 0x18
mov eax, esp
mov dword [eax], ebp
mov ebp, dword [esp + 0x40]
mov dword [eax + 4], ebp
mov ebp, dword [esp + 0x44]
mov dword [eax + 8], ebp
mov ebp, dword [esp + 0x48]
mov dword [eax + 0xc], ebp
mov ebp, dword [esp + 0x4c]
mov dword [eax + 0x10], ebp
mov ebp, dword [esp + 0x50]
mov dword [eax + 0x14], ebp
mov ebp, dword [esp + 0x64]
sub esp, 0x10
mov eax, esp
mov dword [eax], ebp
mov ebp, dword [esp + 0x78]
mov dword [eax + 4], ebp
mov ebp, dword [esp + 0x7c]
mov dword [eax + 8], ebp
mov ebp, dword [esp + 0x80]
mov dword [eax + 0xc], ebp
mov eax, dword [edx + 0xc]
call eax
add ebx, 1
adc edi, 0
cmp edi, dword [esp + 0x18]
jb 0x100ee550
ja 0x100ee60f
cmp ebx, dword [esp + 0x14]
jb 0x100ee550
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push eax
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1012944a
add esp, 0x50
ret 8
Function at 0x100f4900
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x101f2fb0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 4], edx
mov edx, dword [eax + 0xc]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.100e2330
cmp al, 0x4c
je 0x100f494f
call fcn.10059800
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
push 0x10
lea ecx, [esp + 8]
push ecx
mov ecx, eax
call edx
push 0x1018ab6c
push esi
call fcn.100e2c40
push 0
mov esi, eax
push 8
push esi
call dword [sym.imp.MSVCR90.dll_fseek]
push esi
push 1
lea eax, [esp + 0x20]
push 0x10
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
mov ecx, dword [esp + 0x3c]
add esp, 0x28
pop esi
xor ecx, esp
call fcn.1012944a
add esp, 0x14
ret

Function at 0x100fc810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10154228
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push ebp
push ecx
mov ecx, esi
call edx
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.10127bb0
mov eax, dword [esi]
mov edx, dword [esp + 0x38]
mov eax, dword [eax + 0x50]
lea ecx, [esp + 0x40]
push ecx
push ebp
push edx
mov ecx, esi
mov dword [esp + 0x3c], 0
call eax
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x18]
call fcn.10127c70
mov edx, dword [esp + 0x40]
push edx
lea ecx, [esp + 0x18]
call fcn.101219e0
mov edx, dword [esp + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [eax + 0x54]
push ebp
push ecx
mov ecx, esi
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
mov edx, dword [eax]
push 0
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, edi
call fcn.100fa7d0
mov ecx, edi
mov ebp, eax
call fcn.100f9630
mov ecx, dword [str.actualType]
mov esi, dword [eax]
push ebp
push ecx
mov ecx, edi
mov dword [esp + 0x40], eax
add esi, 0x14
call fcn.100f9640
mov ecx, dword [esp + 0x40]
mov edx, dword [esi]
push eax
call edx
push ebp
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
add esp, 4
push eax
push ebx
mov edx, dword [esp + 0x1c]
push ecx
push edx
mov ecx, edi
call fcn.100ff730
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.10127bd0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
Function at 0x10103a50
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x101548ed
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esi], vtable.OMXMLReaderExpat.0
mov eax, dword [esi + 0x278]
push eax
mov dword [esp + 0x3c], 0xf
call fcn.10132cc0
mov eax, dword [esi + 0x284]
add esp, 4
test eax, eax
je 0x10103aad
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [esi + 0x34]
push 0
push eax
lea ecx, [esp + 0x28]
call fcn.101038e0
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0x10
call eax
test al, al
je 0x10103b02
lea ecx, [esp + 0x20]
call fcn.100fb060
mov edi, dword [eax]
test edi, edi
je 0x10103af1
mov ecx, edi
call fcn.101024e0
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0x20]
call eax
test al, al
jne 0x10103ad2
mov edx, dword [esi + 0x34]
mov eax, dword [edx + 4]
lea ecx, [esi + 0x34]
call eax
mov edx, dword [esi + 0x50]
mov eax, dword [edx]
lea edi, [esi + 0x50]
mov ecx, edi
call eax
xor ebx, ebx
mov dword [esp + 0x14], eax
test eax, eax
jbe 0x10103b5e
push ebx
mov ecx, edi
call fcn.100894a0
mov ebp, dword [eax]
mov dword [esp + 0x1c], ebp
test ebp, ebp
je 0x10103b57
lea ecx, [ebp + 4]
mov byte [esp + 0x38], 0x11
call fcn.10120c20
mov ecx, ebp
mov byte [esp + 0x38], 0x10
call fcn.10120c20
push ebp
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
inc ebx
cmp ebx, dword [esp + 0x14]
jb 0x10103b23
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [esp + 0x20]
call fcn.10102ad0
lea ecx, [esi + 0x70]
mov byte [esp + 0x38], 0xe
call fcn.10120c20
lea ecx, [esi + 0x60]
mov byte [esp + 0x38], 0xd
call fcn.10103620
mov ecx, edi
mov byte [esp + 0x38], 0xc
call fcn.10102a10
lea ecx, [esi + 0x48]
mov byte [esp + 0x38], 0xb
call fcn.10120c20
lea ecx, [esi + 0x44]
mov byte [esp + 0x38], 0xa
call fcn.10120c20
lea ecx, [esi + 0x40]
mov byte [esp + 0x38], 9
call fcn.10120c20
lea ecx, [esi + 0x34]
mov byte [esp + 0x38], 8
call fcn.101033d0
lea ecx, [esi + 0x30]
mov byte [esp + 0x38], 7
call fcn.10120c20
lea ecx, [esi + 0x2c]
mov byte [esp + 0x38], 6
call fcn.10120c20
lea ecx, [esi + 0x28]
mov byte [esp + 0x38], 5
call fcn.10120c20
lea ecx, [esi + 0x24]
mov byte [esp + 0x38], 4
call fcn.10120c20
lea ecx, [esi + 0x20]
mov byte [esp + 0x38], 3
call fcn.10120c20
lea ecx, [esi + 0x1c]
mov byte [esp + 0x38], 2
call fcn.10120c20
lea ecx, [esi + 0x18]
mov byte [esp + 0x38], 1
call fcn.10120c20
lea ecx, [esi + 4]
mov byte [esp + 0x38], 0
call fcn.101029e0
mov ecx, esi
call fcn.10102230
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10104140
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10154a3d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x101f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.OMXMLReaderExpat.0
call fcn.10103310
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 1
call fcn.10120b90
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 2
call fcn.10120b90
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 3
call fcn.10120b90
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 4
call fcn.10120b90
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 5
call fcn.10120b90
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 6
call fcn.10120b90
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 7
call fcn.10120b90
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 8
call fcn.10103350
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 9
call fcn.10120b90
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 0xa
call fcn.10120b90
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 0xb
call fcn.10120b90
lea ecx, [esi + 0x50]
mov byte [esi + 0x4c], bl
call fcn.10103400
lea ecx, [esi + 0x60]
call fcn.10103420
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 0xe
call fcn.10120b90
mov eax, dword [esp + 0x20]
mov ecx, esi
mov byte [esp + 0x18], 0xf
mov dword [esi + 0x274], eax
mov dword [esi + 0x278], ebx
call fcn.101026f0
push 0x20
push ebx
call fcn.10137320
push 0x10103250
push eax
mov dword [esi + 0x278], eax
call fcn.10130d40
mov ecx, dword [esi + 0x278]
push 0x10103270
push ecx
call fcn.10130d70
mov edx, dword [esi + 0x278]
push 0x101032b0
push edx
call fcn.10130d50
mov eax, dword [esi + 0x278]
push 0x101032d0
push eax
call fcn.10130d60
mov ecx, dword [esi + 0x278]
push 0x10104070
push ecx
call fcn.10130d10
mov edx, dword [esi + 0x278]
push 0x101032e0
push edx
call fcn.10130d20
mov eax, dword [esi + 0x278]
push 0x101032f0
push eax
call fcn.10130d30
mov ecx, dword [esi + 0x278]
add esp, 0x40
push esi
push ecx
call fcn.10130cf0
push 0x800
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 0x284], eax
add esp, 0xc
mov dword [esi + 0x288], 0x400
mov byte [esi + 0x27c], 1
mov byte [esi + 0x27d], 1
mov dword [esi + 0x280], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4