joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b7f35
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov word [esp], bp
lea esp, [esp + 3]
mov dword [esp + 0x14], ebp
jmp 0x7b7f67
pushal
mov dword [esp + 0x50], edi
lea esp, [esp + 0x50]
jmp 0x7b7f98
push dx
mov byte [esp], dl
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
pushal
push dword [esp + 9]
jmp 0x7b7ff1
lea esp, [esp + 0x50]
jmp 0x7b7f98
je 0x7b7f51
pushal
mov dword [esp + 0x50], edi
jmp 0x7b7fae

Function at 0x7d505f
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
lea esp, [esp + 2]
xor esi, esi
mov ecx, esi
mov cx, 0xb7e1
jmp 0x7d4fce
pop word [esp]
lea esp, [esp]
jmp 0x7d4fe4

Function at 0x85254f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 6]
std
jmp 0x85258a
mov eax, 0x13569320
mov bp, 0xe766
mov dh, 0x34
neg dx
add esp, 0
mov dword [esp + 0xa], ecx
jmp 0x852574

Function at 0x85274b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, 0x840d
jmp 0x8527e8
or edx, ebx
sub esp, 0x1e
lea esp, [esp + 0x26]
mov dword [esp], ecx
std
sub esp, 0x12
jmp 0x852777
mov dh, ch
mov eax, ecx
mov dx, 0x8b1b
lea edx, [eax + edi]
xchg word [esp + 2], ax
xchg ebp, edx
jmp 0x852797

Function at 0x85298c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 2], ebp
pop word [esp + 1]
xchg word [esp + 4], bp
jmp 0x8529a7
Function at 0x85330a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ebp, esi
push ebx
mov dh, byte [esp + 0x1a]
jmp 0x853346
xchg word [esp + 3], ax
mov word [esp + 1], cx
xchg byte [esp + 0x1c], dh
push word [esp + 0xb]
rdtsc
lea eax, [esp + esi]
jmp 0x853330
Function at 0x857567
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0085703a
mov dword [esp], ecx
mov word [esp], dx
jmp 0x8575cd
lea esp, [esp + 0x14]
jmp 0x8575af
mov eax, dword [eax + 0x1c]
jmp 0x857618
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x857599
mov byte [esp + 2], ah
mov dword [esp + 0x18], esi
push di
mov byte [esp], bh
lea esp, [esp + 2]
mov dword [esp + 0x14], edi
jmp 0x857570
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x857035
Function at 0x1000a430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100a4a23
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov byte [esp + 0x14], 1
call fcn.1000dd40
mov dword [esi + 0x3c], eax
mov byte [eax + 0x61], 1
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov dword [esi + 0x40], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x100158f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a1498
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x90], ebx
mov eax, dword [0x100ad8f4]
push eax
mov esi, 0x100cce40
call fcn.100663e0
add esp, 4
test al, al
je 0x1001596c
push 0xf
push str.Action::clear:
lea ecx, [esp + 0x20]
call fcn.10002b10
mov ecx, dword [0x100ad8f4]
push 1
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x44]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100023e0
push 0x100cce40
mov byte [esp + 0xb8], 1
call fcn.10002800
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xbc], bl
call fcn.1008d030
lea esi, [edi + 0x64]
mov byte [esp + 0x90], 2
call fcn.10009bf0
lea esi, [edi + 0x2c]
call fcn.10009bf0
lea esi, [edi + 0x48]
call fcn.10009bf0
lea esi, [edi + 0x10]
call fcn.10009bf0
mov ecx, dword [edi + 0xf0]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], bl
call fcn.1008bb30
cmp dword [esp + 0x30], 0x10
jb 0x10015a13
mov eax, dword [esp + 0x1c]
push eax
call fcn.10080518
add esp, 4
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10079ea5
mov esp, ebp
pop ebp
ret
Function at 0x10027ba0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x238], eax
cmp dword [0x100ceb9c], 0
push ebx
push esi
push edi
mov dword [esp + 0x10], str.getaddrinfo
mov dword [esp + 0x14], 0x10027d50
mov dword [esp + 0x18], str.getnameinfo
mov dword [esp + 0x1c], 0x10028440
mov dword [esp + 0x20], str.freeaddrinfo
mov dword [esp + 0x24], fcn.10028700
je 0x10027c18
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x100cd288]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.10079ea5
mov esp, ebp
pop ebp
ret 4
push 0x104
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10027d15
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.100799e1
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.1007a1c4
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10027c8d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x10027cdd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.100799e1
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.1007a1c4
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x10027d15
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x10027cdd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10027d15
xor edi, edi
nop
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x10027cd4
add edi, 1
cmp edi, 3
jl 0x10027ce0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x100cd288], edx
mov dword [0x100cd290], eax
mov dword [fcn.10028700], ecx
movzx edx, word [ebp + 8]
mov ecx, dword [esp + 0x244]
mov eax, dword [edx*8 + 0x100cd288]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x100ceb9c], 1
call fcn.10079ea5
mov esp, ebp
pop ebp
ret 4
Function at 0x100282d0
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x10028364
cmp word [ebx + 8], 2
push edi
jne 0x10028335
cmp word [ebx + 0xa], 4
jne 0x10028335
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x10028335
jmp 0x10028310
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ebp
push eax
push ecx
call fcn.10028080
test eax, eax
mov dword [esi], eax
je 0x10028358
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x10028310
mov edx, dword [ebx]
mov eax, dword [esp + 0x20]
push 0x400
push edx
push 0x401
push eax
call fcn.1007a235
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x10028374.11001
jmp dword [eax*4 + 0x1002839c]
pop esi
pop ebp
mov eax, 0x2af9
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afa
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
ret 0x10
Function at 0x10032210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3beb
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov dword [esp + 0x14], edi
mov dword [edi], vtable.Reqmt.0
call fcn.100181a0
mov dword [edi + 8], eax
mov byte [eax + 0x45], 1
mov eax, dword [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [edi + 0xc], ebx
mov dword [esp + 0xc0], ebx
mov dword [edi + 0x28], 0xf
mov dword [edi + 0x24], ebx
mov byte [edi + 0x14], bl
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0xc0], 3
mov eax, dword [0x100ad8f4]
push eax
mov esi, 0x100cce40
call fcn.100663e0
add esp, 4
test al, al
je 0x100322d1
push 0xe
push 0x100b321c
lea ecx, [esp + 0x58]
call fcn.10002b10
mov ecx, dword [0x100ad8f4]
push 1
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x7c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100023e0
push 0x100cce40
mov byte [esp + 0xe8], 4
call fcn.10002800
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0xec], 3
call fcn.1008d030
mov bl, 5
push 0x20
mov esi, 0x100cce40
mov byte [esp + 0xc4], bl
call fcn.100663e0
add esp, 4
test al, al
je 0x100323a5
push str.___
lea ecx, [esp + 0x38]
call fcn.1008d3d0
lea ecx, [esp + 0x18]
push ecx
push 0x100b322c
mov ecx, eax
mov byte [esp + 0xc8], 0xa
call fcn.1008d680
mov ecx, eax
call fcn.1008d7b0
mov byte [esp + 0xc0], 0xb
call fcn.10002800
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x18]
push ecx
push 0x20
push esi
mov ecx, eax
call edx
lea ecx, [esp + 0x18]
call fcn.10002a70
lea ecx, [esp + 0x34]
mov byte [esp + 0xc0], bl
call fcn.10002a70
mov ecx, edi
call fcn.10032630
lea ecx, [esp + 0x6c]
mov byte [esp + 0xc0], 3
call fcn.1008bb30
cmp dword [esp + 0x68], 0x10
jb 0x100323d1
mov eax, dword [esp + 0x54]
push eax
call fcn.10080518
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.10079ea5
add esp, 0xb8
ret
Function at 0x100339f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3268
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push ebp
push esi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov dword [esp + 0x14], edi
mov dword [edi], vtable.Property.0
call fcn.100181a0
mov dword [edi + 8], eax
mov byte [eax + 0x45], 1
mov eax, dword [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [edi + 0xc], ebx
mov dword [esp + 0xc0], ebx
mov ebp, 0xf
mov dword [edi + 0x28], ebp
mov dword [edi + 0x24], ebx
mov byte [edi + 0x14], bl
mov dword [edi + 0x44], ebp
mov dword [edi + 0x40], ebx
mov byte [edi + 0x30], bl
mov dword [edi + 0x60], ebp
mov dword [edi + 0x5c], ebx
mov byte [edi + 0x4c], bl
mov dword [edi + 0x7c], ebp
mov dword [edi + 0x78], ebx
mov byte [edi + 0x68], bl
mov dword [edi + 0x98], ebp
mov dword [edi + 0x94], ebx
mov byte [edi + 0x84], bl
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0xc0], 6
mov eax, dword [0x100ad8f4]
push eax
mov esi, 0x100cce40
call fcn.100663e0
add esp, 4
test al, al
je 0x10033ad3
push 0x14
push 0x100b3310
lea ecx, [esp + 0x58]
call fcn.10002b10
mov ecx, dword [0x100ad8f4]
push 1
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x7c]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100023e0
push 0x100cce40
mov byte [esp + 0xe8], 7
call fcn.10002800
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0xec], 6
call fcn.1008d030
push 0x20
mov esi, 0x100cce40
mov byte [esp + 0xc4], 8
call fcn.100663e0
add esp, 4
test al, al
je 0x10033b9b
push str.___
lea ecx, [esp + 0x38]
call fcn.1008d3d0
lea ecx, [esp + 0x18]
push ecx
push 0x100b3328
mov ecx, eax
mov byte [esp + 0xc8], 0xd
call fcn.1008d680
mov ecx, eax
call fcn.1008d7b0
mov byte [esp + 0xc0], 0xe
call fcn.10002800
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x18]
push ecx
push 0x20
push esi
mov ecx, eax
call edx
lea ecx, [esp + 0x18]
call fcn.10002a70
lea ecx, [esp + 0x34]
call fcn.10002a70
lea ecx, [esp + 0x6c]
mov byte [esp + 0xc0], 6
call fcn.1008bb30
cmp dword [esp + 0x68], 0x10
jb 0x10033bc0
mov eax, dword [esp + 0x54]
push eax
call fcn.10080518
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.10079ea5
add esp, 0xb4
ret
Function at 0x10033e70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a1498
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x90], ebx
mov eax, dword [0x100ad8f4]
push eax
mov esi, 0x100cce40
call fcn.100663e0
add esp, 4
test al, al
je 0x10033eec
push 0x11
push str.Property::clear:
lea ecx, [esp + 0x20]
call fcn.10002b10
mov ecx, dword [0x100ad8f4]
push 1
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x44]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100023e0
push 0x100cce40
mov byte [esp + 0xb8], 1
call fcn.10002800
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xbc], bl
call fcn.1008d030
mov byte [esp + 0x90], 2
mov eax, dword [edi + 8]
mov ecx, dword [eax + 4]
lea esi, [edi + 4]
push ecx
mov ecx, esi
call fcn.10018080
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], ebx
mov dword [eax], eax
mov esi, dword [esi + 4]
mov dword [esi + 8], esi
lea esi, [edi + 0x48]
call fcn.10009bf0
lea esi, [edi + 0x80]
call fcn.10009bf0
lea esi, [edi + 0x64]
call fcn.10009bf0
lea esi, [edi + 0x2c]
call fcn.10009bf0
lea esi, [edi + 0x10]
call fcn.10009bf0
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], bl
call fcn.1008bb30
cmp dword [esp + 0x30], 0x10
jb 0x10033fb7
mov edx, dword [esp + 0x1c]
push edx
call fcn.10080518
add esp, 4
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10079ea5
mov esp, ebp
pop ebp
ret
Function at 0x1003d7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a391b
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov dword [esp + 0x14], edi
mov dword [edi], vtable.Tags.0
call fcn.100181a0
mov dword [edi + 8], eax
mov byte [eax + 0x45], 1
mov eax, dword [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [edi + 0xc], ebx
mov dword [esp + 0xc0], ebx
mov dword [edi + 0x28], 0xf
mov dword [edi + 0x24], ebx
mov byte [edi + 0x14], bl
mov byte [esp + 0xc0], 1
call fcn.100181a0
mov dword [edi + 0x30], eax
mov byte [eax + 0x45], 1
mov eax, dword [edi + 0x30]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x30]
mov dword [eax], eax
mov eax, dword [edi + 0x30]
mov dword [eax + 8], eax
mov dword [edi + 0x34], ebx
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0xc0], 3
mov eax, dword [0x100ad8f4]
push eax
mov esi, 0x100cce40
call fcn.100663e0
add esp, 4
test al, al
je 0x1003d8c0
push 0xc
push 0x100b3c08
lea ecx, [esp + 0x58]
call fcn.10002b10
mov ecx, dword [0x100ad8f4]
push 1
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x7c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100023e0
push 0x100cce40
mov byte [esp + 0xe8], 4
call fcn.10002800
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0xec], 3
call fcn.1008d030
mov bl, 5
push 0x20
mov esi, 0x100cce40
mov byte [esp + 0xc4], bl
call fcn.100663e0
add esp, 4
test al, al
je 0x1003d994
push str.___
lea ecx, [esp + 0x38]
call fcn.1008d3d0
lea ecx, [esp + 0x18]
push ecx
push 0x100b3c18
mov ecx, eax
mov byte [esp + 0xc8], 0xa
call fcn.1008d680
mov ecx, eax
call fcn.1008d7b0
mov byte [esp + 0xc0], 0xb
call fcn.10002800
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x18]
push ecx
push 0x20
push esi
mov ecx, eax
call edx
lea ecx, [esp + 0x18]
call fcn.10002a70
lea ecx, [esp + 0x34]
mov byte [esp + 0xc0], bl
call fcn.10002a70
mov ecx, edi
call fcn.1003dc20
lea ecx, [esp + 0x6c]
mov byte [esp + 0xc0], 3
call fcn.1008bb30
cmp dword [esp + 0x68], 0x10
jb 0x1003d9c0
mov eax, dword [esp + 0x54]
push eax
call fcn.10080518
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.10079ea5
add esp, 0xb8
ret
Function at 0x10046f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3268
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push ebp
push esi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov dword [esp + 0x14], edi
mov dword [edi], vtable.Device.0
call fcn.100181a0
mov dword [edi + 8], eax
mov byte [eax + 0x45], 1
mov eax, dword [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [edi + 0xc], ebx
mov dword [esp + 0xc0], ebx
mov ebp, 0xf
mov dword [edi + 0x28], ebp
mov dword [edi + 0x24], ebx
mov byte [edi + 0x14], bl
mov dword [edi + 0x44], ebp
mov dword [edi + 0x40], ebx
mov byte [edi + 0x30], bl
mov dword [edi + 0x60], ebp
mov dword [edi + 0x5c], ebx
mov byte [edi + 0x4c], bl
mov dword [edi + 0x7c], ebp
mov dword [edi + 0x78], ebx
mov byte [edi + 0x68], bl
mov dword [edi + 0x98], ebp
mov dword [edi + 0x94], ebx
mov byte [edi + 0x84], bl
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0xc0], 6
mov eax, dword [0x100ad8f4]
push eax
mov esi, 0x100cce40
call fcn.100663e0
add esp, 4
test al, al
je 0x10047063
push 0x10
push 0x100b4090
lea ecx, [esp + 0x58]
call fcn.10002b10
mov ecx, dword [0x100ad8f4]
push 1
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x7c]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100023e0
push 0x100cce40
mov byte [esp + 0xe8], 7
call fcn.10002800
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0xec], 6
call fcn.1008d030
push 0x20
mov esi, 0x100cce40
mov byte [esp + 0xc4], 8
call fcn.100663e0
add esp, 4
test al, al
je 0x1004712b
push str.___
lea ecx, [esp + 0x38]
call fcn.1008d3d0
lea ecx, [esp + 0x18]
push ecx
push 0x100b40a4
mov ecx, eax
mov byte [esp + 0xc8], 0xd
call fcn.1008d680
mov ecx, eax
call fcn.1008d7b0
mov byte [esp + 0xc0], 0xe
call fcn.10002800
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x18]
push ecx
push 0x20
push esi
mov ecx, eax
call edx
lea ecx, [esp + 0x18]
call fcn.10002a70
lea ecx, [esp + 0x34]
call fcn.10002a70
lea ecx, [esp + 0x6c]
mov byte [esp + 0xc0], 6
call fcn.1008bb30
cmp dword [esp + 0x68], 0x10
jb 0x10047150
mov eax, dword [esp + 0x54]
push eax
call fcn.10080518
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.10079ea5
add esp, 0xb4
ret
Function at 0x100493d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009e7cb
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov dword [esp + 0x98], ebx
mov eax, dword [0x100ad8f4]
push eax
mov esi, 0x100cce40
call fcn.100663e0
add esp, 4
test al, al
je 0x1004944f
push 0xf
push str.Reqmts::clear:
lea ecx, [esp + 0x28]
call fcn.10002b10
mov ecx, dword [0x100ad8f4]
push 1
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x4c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100023e0
push 0x100cce40
mov byte [esp + 0xc0], 1
call fcn.10002800
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0xc4], bl
call fcn.1008d030
mov byte [esp + 0x98], 2
mov eax, dword [edi + 0x14]
mov eax, dword [eax]
add edi, 0x10
mov esi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x100494c0
cmp esi, ebx
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
je 0x100494cf
cmp esi, edi
je 0x100494d4
call fcn.10076ae4
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x14], ecx
je 0x10049518
cmp esi, ebx
jne 0x100494e7
call fcn.10076ae4
mov edx, dword [esp + 0x14]
cmp edx, dword [esi + 4]
jne 0x100494f5
call fcn.10076ae4
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x28]
cmp ecx, ebx
je 0x10049509
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 1
call eax
lea esi, [esp + 0x10]
call fcn.10046aa0
mov esi, dword [esp + 0x10]
jmp 0x100494c0
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
push edx
mov ecx, edi
call fcn.10012430
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], ebx
mov dword [eax], eax
mov edi, dword [edi + 4]
lea ecx, [esp + 0x3c]
mov dword [edi + 8], edi
mov byte [esp + 0x98], bl
call fcn.1008bb30
cmp dword [esp + 0x38], 0x10
jb 0x1004955e
mov eax, dword [esp + 0x24]
push eax
call fcn.10080518
add esp, 4
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.10079ea5
mov esp, ebp
pop ebp
ret