joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
cmp byte [0x42cff4], al
je 0x42405d
inc eax
cmp byte [eax + 0x42cff4], 0
jne 0x424053
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
inc eax
call fcn.00402930
mov dword [esi], eax
test eax, eax
je 0x42407b
push 0x42cff4
push eax
call dword [fcn.00639134]
mov esi, dword [0x638aa4]
xor eax, eax
cmp byte [esi], al
je 0x42408e
inc eax
cmp byte [esi + eax], 0
jne 0x424087
inc eax
call fcn.00402930
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x4240a5
push esi
push ebx
call dword [fcn.00639134]
lea eax, [ebp - 0x24]
push eax
call dword [0x639044]
mov eax, dword [ebp - 0x16]
xor edi, edi
lea esi, [eax + eax*4]
mov word [0x638ec0], si
cmp dword [ebp + 0xc], edi
jle 0x424119
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
mov edi, edi
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x638ec4], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x4240d0
mov word [0x638ec0], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x424191
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x424161
cmp dword [ecx], 0
je 0x424161
cmp dword [0x6391c4], ecx
jne 0x42414b
mov dword [0x6391c4], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x424161
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x424191
cmp dword [ecx], 0
je 0x424191
cmp dword [0x6391c4], eax
jne 0x42417b
mov dword [0x6391c4], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x424191
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100015f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x10001600
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x1000161c
cmp al, 0x40
jne 0x1000161c
mov al, 1
ret
xor al, al
ret
Function at 0x100055b0
Capabilities:
Enumerate devices by category

Disassembly:
push 0xffffffffffffffff
push 0x1001898b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x828
lea eax, [esp + 0x14]
push ebp
push eax
xor ebp, ebp
push 0x1001d25c
push 1
push ebp
push 0x1001d2ec
mov byte [esp + 0x1b], 0
call dword [0x100220cc]
cmp eax, ebp
je 0x10005607
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ebp
push edx
mov ecx, dword [eax]
push 0x1001d2dc
push eax
mov dword [esp + 0x844], ebp
call dword [ecx + 0xc]
cmp eax, ebp
je 0x1000565c
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebp
je 0x10005644
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebp
jne 0x1000576d
push ebx
mov ebx, dword [0x100191bc]
push esi
mov esi, dword [esp + 0x844]
push edi
mov edi, dword [0x100192f4]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0x10019d00
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x10005742
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push 0
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push 0x10020938
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x10005738
mov eax, dword [esp + 0x30]
push eax
call fcn.1001874c
add esp, 4
test eax, eax
jbe 0x10005738
test esi, esi
je 0x10005734
mov edx, dword [esp + 0x30]
push 0
push 0
lea ecx, [esp + 0x40]
push 0x800
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call ebx
lea eax, [esp + 0x38]
push 0x64
push eax
push esi
call fcn.10018746
add esp, 0xc
push esi
call edi
push esi
lea ebp, [eax + ebp + 1]
call edi
mov ecx, dword [esp + 0x30]
lea esi, [esi + eax + 1]
push ecx
call dword [0x10022060]
inc byte [esp + 0x13]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
je 0x1000569a
pop edi
pop esi
pop ebx
mov eax, dword [esp + 0x840]
test eax, eax
je 0x1000577a
mov dword [eax], ebp
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
test eax, eax
je 0x10005793
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x82c]
mov al, byte [esp + 7]
pop ebp
mov dword fs:[0], ecx
add esp, 0x834
ret
Function at 0x10005860
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [str.BVVVV_f_r]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [0x10019128]
lea edx, [esp + 0x10]
push 0x10020068
push edx
call sym.atl.dll_AtlIPersistStreamInit_Save
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [0x100192e8]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000591b
push edi
push esi
push ebx
call dword [0x100192ec]
mov edi, eax
push edi
call fcn.100186c8
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x10019138]
xor eax, eax
test edi, edi
jbe 0x100058f3
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x100058e5
push edi
push esi
mov ecx, ebp
call fcn.10013610
push esi
mov edi, eax
call fcn.100186c2
add esp, 4
push ebx
call dword [0x100192fc]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x10006e40
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.1000d810
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x10006e75
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x100226b4]
xor eax, edx
inc ecx
dec esi
jne 0x10006e56
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10006e91
push esi
push 0x10021aa8
push eax
call dword [0x1001940c]
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x10007900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.1000b9b0
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x10007954
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x13
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0xa
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x10007923
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100084a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x100220e8]
push ebx
push 0
push 0x80
push 4
push 0
push 3
add eax, 0xd
push 0x40000000
push eax
call dword [0x100192e8]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10008543
push 0
push ebx
mov dword [esp + 0xc], 0
call dword [0x100192ec]
cmp eax, 0x3200000
jae 0x100084ef
push 2
push 0
push 0
push ebx
call dword [0x100192f0]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
call dword [0x100192f4]
mov edi, eax
push edi
call fcn.100186b6
add esp, 4
mov esi, eax
test edi, edi
jle 0x10008520
mov ecx, ebp
mov ebp, edi
sub ecx, esi
mov dl, byte [ecx + eax]
xor dl, 0x44
mov byte [eax], dl
inc eax
dec ebp
jne 0x10008514
lea eax, [esp + 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [0x100192f8]
push ebx
call dword [0x100192fc]
push esi
call fcn.100186b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10008df0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10018b53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.10006c60
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x10019c5c
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.100186b6
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x10008e57
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.100120d0
jmp 0x10008e59
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x10012b30
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.100108e0
push 1
push ebx
push ebx
push esi
push 0x10005f60
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.100108e0
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1000bc50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x1000bc84
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, bh
jne 0x1000bc64
inc esi
inc esi
inc edi
test bx, bx
jne 0x1000bc73
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bf40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push esi
push edi
push 0x104
push eax
call dword [0x10019240]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10020be0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [0x100192e4]
lea edx, [esp + 0x14]
push edx
call dword [0x100192f4]
lea ebx, [esp + eax + 0x14]
mov eax, dword [str.BVVVV_f_r]
or ecx, 0xffffffff
push ebx
lea edi, [eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10010720
mov edi, 0x10021c90
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x28]
push 2
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x100192e8]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000c0dc
mov esi, dword [str.BVVVV_f_r]
mov ecx, 0x17e
lea edi, [esp + 0x21c]
push 0
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call fcn.10018858
push eax
call fcn.10018852
add esp, 8
call fcn.1001884c
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fmul qword [0x10019c90]
call fcn.10018740
test al, al
je 0x1000c049
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x1000c06a
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x224]
push 0x5f8
push edx
push ebx
call dword [0x100192f8]
push ebx
call dword [0x100192fc]
mov edi, 0x10021c80
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.100110c0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x808
ret

Function at 0x1000d810
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x100226b4
mov eax, edx
mov esi, 8
test al, 1
je 0x1000d82c
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000d82e
shr eax, 1
dec esi
jne 0x1000d81f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x10022ab4
jl 0x1000d818
pop esi
ret
Function at 0x1000e810
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10018b68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x10019c5c
mov edi, dword [0x100191b0]
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call edi
lea ecx, [esi + 0x10]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov edi, dword [0x10019140]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edi, dword [0x100192fc]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x1000e887
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call sym.atl.dll_AtlGetObjectSourceInterface
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10011be0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [0x100191f4]
test eax, eax
je 0x10011c56
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [0x100191e4]
test eax, eax
je 0x10011c56
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x10011c56
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x10011c44
mov edx, esi
cmp edi, ebx
jb 0x10011c4e
add edx, ebx
cmp edi, edx
jbe 0x10011c60
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x10011c36
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x100124d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x100125dd
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x1001257b
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x10012599
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.1000bec0
add esp, 4
push eax
push edi
call fcn.10006e40
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x10012566
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x10012523
jmp 0x10012599
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x10012599
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x100125dd
cmp eax, ecx
jb 0x100125dd
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x100125df
cmp eax, esi
jb 0x100125df
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x100125df
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x100125dd
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x100125ea
cmp byte [esi], 0
jne 0x100125cd
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x100125dd
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call fcn.10014fe0
add esp, 4
lea eax, [esp + 0x20]
push eax
call fcn.1000bc50
push 0
push esi
mov edi, eax
call fcn.1000bec0
add esp, 4
push eax
push esi
call fcn.10006e40
and eax, 0x7fffffff
push eax
push edi
call fcn.100124d0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x100142f0
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100189d0
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x10014329
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x1001d25c
push 1
push ebx
push 0x1001d2ec
call dword [0x100220cc]
cmp eax, ebx
je 0x10014378
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x100143c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x1001d2dc
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x100143d7
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x100143ac
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x100143c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x10014496
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x10019d00
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x1001446c
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push 0x10020938
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x10014462
cmp esi, edi
jne 0x10014457
mov eax, dword [esp + 0x14]
push ebp
push 0x1001d24c
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [0x10022060]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x10014407
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x100144a9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x100144bf
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x10014af0
Capabilities:
Get file attributes
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019bc0
push 0x100186bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 1
mov dword [ebp - 4], ebx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [0x10019018]
test eax, eax
je 0x10014bce
lea ecx, [ebp - 0x38]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea edx, [ebp - 0x34]
push edx
call dword [0x10019014]
test eax, eax
je 0x10014bce
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
add edi, 0x10
mov dword [ebp - 0x2c], edi
push edi
push 8
call dword [0x10019110]
push eax
call dword [0x10019120]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x10014bce
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x10014bce
mov ecx, dword [ebp - 0x38]
push ecx
push 0x10000000
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test eax, eax
je 0x10014bce
push ebx
push esi
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
je 0x10014bce
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
call fcn.10014c0c
cmp dword [ebp - 0x24], ebx
jne 0x10014c1b
cmp esi, ebx
je 0x10014bf2
push esi
push ebx
call dword [0x10019110]
push eax
call dword [0x1001910c]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4