joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016a30
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 0x48], 0xffffffff
setne al
push eax
push 0x1003cdc
push edi
push edi
push edi
push 0x1003bf0
push dword [0x102256c]
push 4
call fcn.01020f34
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1016a95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1016a93
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 0x14

Function at 0x1016aa2
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016ac6
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016ac6
mov al, 1
jmp 0x1016ac8
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003d00
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [edi + 0x14]
push dword [ebp + 8]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1016b01
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016b25
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016b25
mov al, 1
jmp 0x1016b27
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003dd8
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1016b63
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016b87
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016b87
mov al, 1
jmp 0x1016b89
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003eb8
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x24]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1016bc5
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016be9
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016be9
mov al, 1
jmp 0x1016beb
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003f90
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1016c27
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016c4b
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016c4b
mov al, 1
jmp 0x1016c4d
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1004070
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1016c89
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016cad
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016cad
mov al, 1
jmp 0x1016caf
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1004148
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x101703a
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
sete al
push eax
push 0x10046d8
push 0
push 0
push 0
push 0x10045f0
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
and dword [esi + 8], 0
mov dword [esi + 4], eax
mov dword [esi], 1
pop esi
pop ebp
ret 4
Function at 0x10173ab
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
setne al
mov esi, ecx
push eax
push 0x1004b00
push ebx
push ebx
push ebx
push 0x1004a08
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
push 0x10038fc
push esi
mov dword [ebp + 0xc], ebx
call dword [eax]
test eax, eax
jl 0x10173f8
cmp dword [ebp + 0xc], ebx
je 0x10173f8
mov al, 1
jmp 0x10173fa
xor al, al
push eax
push 0x1002cd8
push ebx
push ebx
push ebx
push 0x1004910
push dword [0x102256c]
push 4
call fcn.01020f34
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push dword [ebp + 0xc]
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov eax, dword [edi]
push 0xffffffffffffffff
push edi
call dword [eax + 0x14]
movzx eax, al
cmp eax, 1
sete al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1004818
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 0xc]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x1017464
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop ebp
ret 8
Function at 0x101746d
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, ecx
lea ecx, [ebp - 4]
push ecx
push 0x1002bd4
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [eax + 0x10]
test eax, eax
jl 0x101749e
cmp dword [ebp - 4], ebx
je 0x101749e
mov al, 1
jmp 0x10174a0
xor al, al
push eax
push 0x1002cd8
push ebx
push ebx
push ebx
push 0x10050f8
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [edi + 0x5c]
cmp dword [esi + 0x3c], eax
mov dword [ebp + 8], eax
sbb al, al
inc al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1005018
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
call fcn.0101c6c3
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x1017505
mov ecx, dword [ebp + 8]
shl ecx, 5
cmp dword [ecx + eax + 8], ebx
je 0x1017505
mov al, 1
jmp 0x1017507
xor al, al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1004f38
push dword [0x102256c]
push 4
call fcn.01020f34
lea eax, [edi + 0xc0]
mov ecx, dword [eax]
push eax
mov dword [ebp - 0xc], eax
call dword [ecx + 0x74]
cmp al, 0x16
jne 0x10175c7
mov edi, dword [edi + 0x80]
cmp edi, ebx
setne al
mov dword [ebp - 8], edi
push eax
push 0x10037f4
push ebx
push ebx
push ebx
push 0x1004e58
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x14]
shl eax, 5
mov edi, dword [eax + ecx + 4]
cmp edi, ebx
setne al
push eax
push 0x1004e34
push ebx
push ebx
push ebx
push 0x1004d58
push dword [0x102256c]
push 4
call fcn.01020f34
mov edi, dword [edi + 8]
cmp edi, ebx
setne al
push eax
push 0x1004d34
push ebx
push ebx
push ebx
push 0x1004c58
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [0x1022574]
mov ecx, dword [eax]
push edi
push dword [esi + 0x50]
push dword [ebp - 8]
push eax
call dword [ecx + 0xb0]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
push dword [ebp - 4]
shl edi, 5
mov eax, dword [eax + edi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10175ed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x74]
cmp al, 0x1b
jne 0x1017631
mov eax, dword [ebx]
push ebx
call dword [eax + 0x70]
cmp al, 2
jne 0x1017631
mov eax, dword [esi + 0x14]
lea eax, [eax + edi + 0xc]
cmp dword [eax], eax
sete al
push eax
push 0x1004c08
push 0x3bc
push 2
push 1
push 0x1004b28
push dword [0x102256c]
push 4
call fcn.01020f34
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101797d
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
setne al
push eax
push 0x10022b4
xor eax, eax
push eax
push eax
push eax
push 0x1005508
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edx, dword [esi + 0x14]
mov ecx, dword [ebp + 0xc]
shl ecx, 5
lea ecx, [ecx + edx + 0xc]
mov edx, dword [ecx + 4]
lea eax, [edi + 0x7c]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edx], eax
mov dword [ecx + 4], eax
mov esi, dword [esi + 0x44]
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
ret 8

Function at 0x10179ee
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
setne al
push eax
push 0x10022b4
xor eax, eax
push eax
push eax
push eax
push 0x10055f0
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
lea eax, [edi + 0x7c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov esi, dword [esi + 0x44]
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1017a5e
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1022568], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x1017ab7
cmp dword [esi + 0xc], 1
mov ebx, 0x10022b4
sete al
push eax
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x10057c0
push dword [0x102256c]
push 4
call fcn.01020f34
xor eax, eax
cmp edi, eax
setne cl
push ecx
push ebx
push eax
push eax
push eax
push 0x10056e8
push dword [0x102256c]
push 4
call fcn.01020f34
lea ebx, [esi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 4]
lea eax, [edi + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
inc dword [esi + 8]
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1017aed
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
lea eax, [edi + 8]
cmp dword [eax], eax
jne 0x1017b59
cmp dword [eax + 4], eax
jne 0x1017b59
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x1017b47
test byte [eax + 0x9c], 4
je 0x1017b47
cmp byte [eax + 0x99], 2
jb 0x1017b47
push edi
push 0x10038dc
push 0x22
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor eax, eax
push eax
push 0x10022b4
push eax
push eax
push eax
push 0x1005970
jmp 0x1017bc1
cmp dword [esi], esi
je 0x1017b7a
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
dec dword [esi + 8]
xor esi, esi
inc esi
jmp 0x1017bd0
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x1017bb1
test byte [eax + 0x9c], 4
je 0x1017bb1
cmp byte [eax + 0x99], 2
jb 0x1017bb1
push edi
push 0x10038dc
push 0x23
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor eax, eax
push eax
push 0x10022b4
push eax
push eax
push eax
push 0x1005898
push dword [0x102256c]
xor esi, esi
push 4
call fcn.01020f34
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1017cf7
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push edi
mov esi, ecx
call dword [eax + 8]
lea ecx, [esi + 0x50]
mov eax, dword [ecx + 0xc]
dec eax
push eax
call fcn.01013db7
xor ebx, ebx
mov esi, eax
cmp esi, ebx
setne al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1005ba0
push dword [0x102256c]
push 4
call fcn.01020f34
cmp byte [esi + 0x1c], 1
sete al
push eax
push 0x1005b6c
push ebx
push ebx
push ebx
push 0x1005aa0
push dword [0x102256c]
push 4
call fcn.01020f34
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1017d6c
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push edi
mov edi, ecx
lea ecx, [edi + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [edi + 0x5c], eax
jne 0x1017dca
push esi
call fcn.01014a80
mov esi, dword [eax + 0xc]
test esi, esi
je 0x1017dc3
lea eax, [esi + 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x1017dc3
push edi
mov ecx, esi
call fcn.0101bf28
test eax, eax
jne 0x1017dc3
push eax
push 0x1005d40
push 0x5d4
push 2
push 1
push 0x1005c70
push dword [0x102256c]
push 4
call fcn.01020f34
mov dword [edi + 0xd0], esi
pop esi
pop edi
ret
Function at 0x1017e8b
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
xor ebx, ebx
cmp eax, ebx
mov dword [esi], 0x1005a58
mov dword [esi + 4], 0x1005a44
je 0x1017ed3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
sete al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1005f08
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [esi + 0x1c]
call fcn.0101fb42
push dword [esi + 0x20]
mov dword [esi + 0x1c], ebx
call fcn.0101fb42
push dword [esi + 0x24]
mov dword [esi + 0x20], ebx
call fcn.0101fb42
push dword [esi + 0x2c]
mov dword [esi + 0x24], ebx
call fcn.0101fb42
push dword [esi + 0x28]
mov dword [esi + 0x2c], ebx
call fcn.0101fb42
mov ecx, dword [esi + 0x38]
add esp, 0x14
cmp ecx, ebx
mov dword [esi + 0x28], ebx
je 0x1017f1b
push 3
call fcn.01014545
cmp dword [esi + 0x14], ebx
mov dword [esi + 0x38], ebx
je 0x1017fa7
cmp dword [esi + 0x3c], ebx
mov dword [ebp - 4], ebx
jbe 0x1017f96
push edi
xor edi, edi
mov eax, dword [esi + 0x14]
add eax, edi
cmp dword [eax + 8], ebx
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
je 0x1017f52
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14]
mov dword [eax + edi + 8], ebx
mov eax, dword [esi + 0x14]
add eax, edi
cmp dword [eax + 0x14], ebx
je 0x1017f87
cmp dword [eax + 0x1c], ebx
je 0x1017f6d
mov eax, dword [eax + 0x14]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [esi + 0x14]
lea eax, [eax + edi + 0x14]
cmp dword [eax], ebx
je 0x1017f87
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14]
mov dword [eax + edi + 0x14], ebx
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 0x20
cmp eax, dword [esi + 0x3c]
jb 0x1017f32
pop edi
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x1017fa4
push 3
call fcn.0101735a
mov dword [esi + 0x14], ebx
push dword [esi + 0x30]
call fcn.0101fb42
mov eax, dword [esi + 0x34]
cmp eax, ebx
pop ecx
mov dword [esi + 0x30], ebx
je 0x1017fc3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x1017fd3
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [esi + 0x40], ebx
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x1017fe3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x44], ebx
mov esi, dword [esi + 0x48]
cmp esi, 0xffffffff
je 0x1017ff2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
leave
ret
Function at 0x1018843
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
setne al
mov dword [ebp - 4], ecx
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1006b10
push dword [0x102256c]
push 4
call fcn.01020f34
cmp dword [esi + 0x4c], 1
jne 0x1018919
lea eax, [esi + 0xc0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
cmp al, 0x16
jne 0x1018919
lea edi, [esi + 0xfc]
cmp edi, ebx
setne al
push eax
push 0x1006af0
push ebx
push ebx
push ebx
push 0x1006a20
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi + 0x80]
cmp eax, ebx
mov dword [ebp + 8], eax
setne al
push eax
push 0x10037f4
push ebx
push ebx
push ebx
push 0x1006950
push dword [0x102256c]
push 4
call fcn.01020f34
cmp dword [edi], ebx
mov edx, dword [ebp - 4]
je 0x10188ff
push dword [edx + 0x50]
mov eax, dword [0x1022574]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xb4]
jmp 0x1018919
mov dword [edi], 1
push dword [edx + 0x50]
mov eax, dword [0x1022574]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xb8]
lea edi, [esi + 0x50]
mov ecx, edi
call fcn.01014a9b
mov eax, dword [esi + 0x5c]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x3c], eax
mov dword [ebp - 8], eax
sbb al, al
inc al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1006880
push dword [0x102256c]
push 4
call fcn.01020f34
mov ecx, edi
call fcn.01014a80
cmp dword [esi + 0x4c], 1
movzx eax, byte [eax + 0x1c]
mov dword [ebp + 8], eax
je 0x101898a
mov ecx, edi
call fcn.01014a80
cmp dword [eax + 0xc], ebx
setne al
push eax
push 0x1006860
push ebx
push ebx
push ebx
push 0x1006790
push dword [0x102256c]
push 4
call fcn.01020f34
cmp dword [ebp + 8], 3
je 0x101899c
cmp dword [ebp + 8], 4
je 0x101899c
cmp dword [ebp + 8], 9
jne 0x10189a3
mov ecx, esi
call fcn.01017d6c
cmp dword [ebp - 8], ebx
jne 0x1018a35
cmp dword [esi + 0x4c], 1
jne 0x10189d5
lea edi, [esi + 0xc0]
mov eax, dword [edi]
push edi
call dword [eax + 0x74]
cmp al, 0x1b
jne 0x10189cc
mov eax, dword [edi]
push edi
call dword [eax + 0x70]
cmp al, 2
je 0x1018a3c
mov ecx, esi
call fcn.0101d5b1
jmp 0x1018a3c
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x1002d00
push esi
mov dword [ebp + 8], ebx
call dword [eax + 0x10]
test eax, eax
jl 0x10189f4
cmp dword [ebp + 8], ebx
je 0x10189f4
mov al, 1
jmp 0x10189f6
xor al, al
push eax
push 0x1002cd8
push ebx
push ebx
push ebx
push 0x10066c0
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [esi + 0xb4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x1018a3c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1018a3c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1018fc6
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [edi + 0x44]
xor eax, eax
shl esi, 2
cmp dword [esi + ecx], eax
sete cl
push ecx
push 0x1006ee8
push eax
push eax
push eax
push 0x1006e10
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [edi + 0x44]
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [esi + eax], ecx
pop esi
pop ebp
ret 8

Function at 0x101900f
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 1
sete al
push eax
push 0x10022b4
push 0
push 0
push 0
push 0x1006f28
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
test eax, eax
je 0x1019048
mov ecx, dword [esi + 0x24]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1019056
mov cx, word [esi + 0x28]
mov word [eax], cx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1019064
mov cx, word [esi + 0x2a]
mov word [eax], cx
pop esi
pop ebp
ret 0xc

Function at 0x101906e
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 3
sete al
push eax
push 0x10022b4
push 0
push 0
push 0
push 0x1007010
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
test eax, eax
je 0x10190a7
mov ecx, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10190b9
mov ecx, dword [esi + 0x28]
mov dword [eax], ecx
mov ecx, dword [esi + 0x2c]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10190c5
mov ecx, dword [esi + 0x24]
mov dword [eax], ecx
pop esi
pop ebp
ret 0xc

Function at 0x10190cf
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 4
sete al
push eax
push 0x10022b4
push 0
push 0
push 0
push 0x10070f8
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
test eax, eax
je 0x1019108
mov ecx, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x101911a
mov ecx, dword [esi + 0x28]
mov dword [eax], ecx
mov ecx, dword [esi + 0x2c]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1019126
mov ecx, dword [esi + 0x24]
mov dword [eax], ecx
pop esi
pop ebp
ret 0xc

Function at 0x1019130
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov al, byte [esi + 0x1c]
cmp al, 5
je 0x1019147
cmp al, 9
je 0x1019147
xor al, al
jmp 0x101914a
xor eax, eax
inc eax
push eax
push 0x10022b4
push 0
push 0
push 0
push 0x10071e0
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
test eax, eax
je 0x1019174
mov ecx, dword [esi + 0x28]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1019180
mov ecx, dword [esi + 0x24]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101918c
mov ecx, dword [esi + 0x20]
mov dword [eax], ecx
pop esi
pop ebp
ret 0xc