joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a89bf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100a8a5c
push ebx
push esi
call fcn.100a8988
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100a312e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100a8a09
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a8a5b
push edi
push eax
call fcn.100a1017
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100a8a29
call fcn.100a0fdd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a8a5a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100a312e
add esp, 0x20
test eax, eax
jne 0x100a8a48
push edi
call fcn.100a0fdd
jmp 0x100a8a50
push ebx
call fcn.100a0fdd
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100a8a5f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100a8a70
pop esi
ret
push ebx
push edi
push esi
call fcn.100a8988
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100a1017
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100a8a98
push ebx
push esi
push edi
call fcn.10086560
add esp, 0xc
push 0
call fcn.100a0fdd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100a91f2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a8d0d

Function at 0x100ab477
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1009eab9
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ab4e6
cmp esi, dword [ebp - 4]
je 0x100ab4e1
cmp dword [ebp + 0xc], 0
je 0x100ab4e1
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100ab4be
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100aafc9
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100ab4e8
xor eax, eax
inc eax
jmp 0x100ab4e8
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100ab54d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102a0600]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1009eab9
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1009eab9
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100ab5c4
cmp word [ecx], dx
je 0x100ab5c4
mov eax, dword [0x10201264]
push edi
dec eax
push eax
push 0x10201150
call fcn.100ab4ec
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100ab637
cmp word [eax], dx
je 0x100ab637
mov eax, dword [edi]
test eax, eax
je 0x100ab5e8
cmp word [eax], dx
je 0x100ab5e8
lea eax, [ebp - 0x10]
push eax
call fcn.100aaecf
jmp 0x100ab5f1
lea eax, [ebp - 0x10]
push eax
call fcn.100aaf6a
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100ab661
mov eax, dword [0x1020114c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10200e40
call fcn.100ab4ec
add esp, 0xc
test al, al
je 0x100ab661
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100ab62c
cmp word [eax], di
je 0x100ab62c
lea eax, [ebp - 0x10]
push eax
call fcn.100aaecf
pop ecx
jmp 0x100ab663
lea eax, [ebp - 0x10]
push eax
call fcn.100aaf6a
jmp 0x100ab629
mov eax, dword [edi]
test eax, eax
je 0x100ab64e
cmp word [eax], dx
je 0x100ab64e
lea eax, [ebp - 0x10]
push eax
call fcn.100aae84
pop ecx
jmp 0x100ab661
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100ab72c
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100ab371
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100ab72c
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100ab72c
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100ab72c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100ab6b9
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100a2000
test ebx, ebx
je 0x100ab727
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100a2000
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ab72c
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ab72c
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100b1629
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100ab72e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10084465
leave
ret
Function at 0x100b1745
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100b16c1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100b18b4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100b18b4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100b1869
jg 0x100b17a1
test eax, eax
je 0x100b185f
push 1
push 0x1000
call fcn.100a1890
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100b17c4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100b1856
push 0x8000
push ebx
call fcn.1008e55d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100b17ed
jg 0x100b17e8
cmp ecx, 0x1000
jb 0x100b17ed
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100a562d
add esp, 0x10
cmp eax, 0xffffffff
je 0x100b1832
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100b17e8
jl 0x100b1819
test ecx, ecx
jne 0x100b17da
push dword [ebp - 0xc]
push ebx
call fcn.1008e55d
push esi
call fcn.100a0fdd
add esp, 0xc
xor ebx, ebx
jmp 0x100b18c2
cmp byte [edi + 0x24], 0
je 0x100b1849
cmp dword [edi + 0x20], 5
jne 0x100b1849
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100b1854
mov ebx, dword [edi + 0x18]
jmp 0x100b1856
xor ebx, ebx
push esi
call fcn.100a0fdd
pop ecx
jmp 0x100b18c2
test ecx, ecx
jg 0x100b182b
jl 0x100b1869
test eax, eax
jae 0x100b182b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1009e6f1
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100b1889
cmp byte [edi + 0x1c], 0
je 0x100b182b
jmp 0x100b18ba
push ebx
call fcn.10095f57
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100b182b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100b18c2
cmp byte [edi + 0x1c], 0
je 0x100b18bf
mov ebx, dword [edi + 0x18]
jmp 0x100b18c2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1009e6f1
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100bdc00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.100bee50
mov edi, dword [esi + 0x14]
add esp, 4
test edi, edi
je 0x100bdc81
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov ecx, dword [edx + eax*8]
mov eax, dword [edx + eax*8 + 4]
mov edx, dword [esi + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp edx, edi
jae 0x100bdc81
push ebx
mov ebx, dword [esi + 0x18]
nop dword [eax + eax]
movq xmm1, qword [esp + 0xc]
mov eax, 0x38
sub eax, edx
add edx, 8
movd xmm0, eax
psrlq xmm1, xmm0
movd eax, xmm1
movzx ecx, al
mov eax, ebx
shr eax, 8
xor ecx, eax
movzx ebx, bl
shl ebx, 8
movzx ecx, word [ecx*2 + 0x102061a8]
xor ebx, ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x18], ebx
cmp edx, edi
jb 0x100bdc40
pop ebx
mov ax, word [esi + 0x18]
pop edi
pop esi
add esp, 8
ret

Function at 0x100bef30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
cmp edi, 8
jb 0x100befd0
push ebx
mov ebx, edi
shr ebx, 3
nop dword [eax + eax]
movzx edx, byte [esi]
sub edi, 8
movzx ecx, byte [esi + 1]
movzx eax, ax
shl edx, 8
or edx, ecx
xor edx, eax
movzx eax, byte [esi + 6]
mov ecx, edx
shr ecx, 8
mov cx, word [ecx*2 + 0x10206fa8]
xor cx, word [eax*2 + 0x102063a8]
movzx eax, byte [esi + 5]
xor cx, word [eax*2 + 0x102065a8]
movzx eax, byte [esi + 4]
xor cx, word [eax*2 + 0x102067a8]
movzx eax, byte [esi + 3]
xor cx, word [eax*2 + 0x102069a8]
movzx eax, byte [esi + 7]
xor cx, word [eax*2 + 0x102061a8]
movzx eax, byte [esi + 2]
add esi, 8
xor cx, word [eax*2 + 0x10206ba8]
movzx eax, dl
xor cx, word [eax*2 + 0x10206da8]
movzx eax, cx
sub ebx, 1
jne 0x100bef50
pop ebx
test edi, edi
je 0x100beff5
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, ax
shr edx, 8
xor edx, ecx
shl eax, 8
xor ax, word [edx*2 + 0x102061a8]
movzx eax, ax
sub edi, 1
jne 0x100befd4
pop edi
pop esi
ret

Function at 0x100bf000
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x100bf0a4
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
add ecx, 2
push ebx
push esi
nop word [eax + eax]
mov edx, dword [ecx + 2]
lea ecx, [ecx + 8]
movzx eax, ax
mov ebx, dword [ecx - 0xa]
shr edx, 0x10
xor edx, eax
movzx eax, byte [ecx - 9]
mov dword [esp + 0x18], edx
movzx edx, byte [ecx - 7]
mov si, word [eax*2 + 0x102063a8]
movzx eax, byte [ecx - 6]
xor si, word [edx*2 + 0x102067a8]
mov edx, dword [esp + 0x18]
xor si, word [eax*2 + 0x102069a8]
movzx eax, byte [ecx - 5]
xor si, word [eax*2 + 0x10206ba8]
mov eax, edx
shr eax, 8
xor si, word [eax*2 + 0x10206fa8]
movzx eax, bl
xor si, word [eax*2 + 0x102061a8]
movzx eax, dl
xor si, word [eax*2 + 0x10206da8]
movzx eax, byte [ecx - 8]
xor si, word [eax*2 + 0x102065a8]
movzx eax, si
sub edi, 1
jne 0x100bf020
pop esi
pop ebx
pop edi
ret
mov ax, word [esp + 0x10]
pop edi
ret
Function at 0x100bf0b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
test edx, edx
je 0x100bf0d7
push esi
mov esi, dword [esp + 8]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x102071a8]
sub edx, 1
jne 0x100bf0c0
pop esi
ret
Function at 0x100c5f20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
xor ecx, ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x10], esi
test edi, edi
je 0x100c5fa6
cmp edi, 8
jb 0x100c5fa6
cmp dword [0x102a73f8], 2
jl 0x100c5fa6
mov eax, edi
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [ebx + ecx*4]
pabsd xmm0, xmm0
paddd xmm2, xmm0
movups xmm0, xmmword [ebx + ecx*4 + 0x10]
add ecx, 8
pabsd xmm0, xmm0
paddd xmm1, xmm0
cmp ecx, eax
jb 0x100c5f60
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd esi, xmm1
mov dword [esp + 0x10], esi
xor ebp, ebp
mov dword [esp + 0x14], ebp
cmp ecx, edi
jae 0x100c5ffe
mov eax, edi
sub eax, ecx
cmp eax, 2
jb 0x100c5fec
lea eax, [edi - 1]
xor edi, edi
mov esi, eax
mov eax, dword [ebx + ecx*4]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [ebx + ecx*4 + 4]
cdq
add ecx, 2
xor eax, edx
sub eax, edx
add edi, eax
mov eax, ecx
cmp ecx, esi
jb 0x100c5fc0
mov esi, dword [esp + 0x10]
mov dword [esp + 0x14], edi
cmp eax, dword [esp + 0x24]
jae 0x100c5ff6
mov eax, dword [ebx + ecx*4]
cdq
xor eax, edx
sub eax, edx
add esi, eax
mov ecx, dword [esp + 0x14]
add ecx, ebp
add esi, ecx
mov eax, 1
test esi, esi
cmove esi, eax
mov eax, esi
cdq
push edx
push eax
call fcn.100cea70
add esp, 8
add eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100c6030
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x10], esi
test edi, edi
je 0x100c60b8
cmp edi, 8
jb 0x100c60b8
cmp dword [0x102a73f8], 2
mov edx, dword [esp + 0x20]
jl 0x100c60bc
mov eax, edi
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [edx + ecx*4]
pabsd xmm0, xmm0
paddd xmm2, xmm0
movups xmm0, xmmword [edx + ecx*4 + 0x10]
add ecx, 8
pabsd xmm0, xmm0
paddd xmm1, xmm0
cmp ecx, eax
jb 0x100c6070
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd esi, xmm1
mov dword [esp + 0x10], esi
jmp 0x100c60bc
mov edx, dword [esp + 0x20]
xor ebx, ebx
xor ebp, ebp
cmp ecx, edi
jae 0x100c6113
mov eax, edi
sub eax, ecx
cmp eax, 2
jb 0x100c6100
lea eax, [edi - 1]
mov edi, eax
lea esi, [edx + 4]
mov eax, dword [edx + ecx*4]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esi + ecx*4]
cdq
add ecx, 2
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x20]
add ebp, eax
mov eax, ecx
cmp ecx, edi
jb 0x100c60d5
mov esi, dword [esp + 0x10]
cmp eax, dword [esp + 0x24]
jae 0x100c610e
mov eax, dword [esp + 0x20]
mov eax, dword [eax + ecx*4]
cdq
xor eax, edx
sub eax, edx
add esi, eax
lea ecx, [ebx + ebp]
add esi, ecx
mov eax, 1
test esi, esi
cmove esi, eax
mov eax, esi
cdq
push edx
push eax
call fcn.100cea70
mov ebx, dword [esp + 0x24]
add esp, 8
mov edx, ebx
sub edx, dword [esp + 0x28]
add edx, eax
pop edi
pop esi
cmp ebx, edx
lea ecx, [ebx + 1]
lea eax, [edx + 1]
pop ebp
cmovg eax, ecx
pop ebx
add esp, 8
ret
Function at 0x100cec80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
jl 0x100ced35
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [esp + 0x10]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x102099b0]
xor edx, dword [ecx*4 + 0x102095b0]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x10209db0]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x102085b0]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x102089b0]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x102081b0]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x10208db0]
xor edx, dword [eax*4 + 0x102091b0]
mov eax, edx
sub ebx, 1
jne 0x100ceca4
pop ebx
jmp 0x100ced39
mov eax, dword [esp + 0xc]
test edi, edi
je 0x100ced5c
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x102081b0]
sub edi, 1
jne 0x100ced40
pop edi
pop esi
ret
Function at 0x100f4a80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164633
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102a0600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esi], eax
mov dword [esi + 4], 0
mov word [esi + 8], 0x100
mov dword [esi + 0xc], 0x3f800000
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
movups xmmword [esi + 0x40], xmm0
mov dword [esi + 0x50], 0x3f800000
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0x3f800000
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0x3f800000
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0x3f800000
movups xmmword [esi + 0x90], xmm0
mov dword [esi + 0xa0], 0x3f800000
mov dword [esi + 0xa4], 0x3f800000
mov dword [esi + 0xa8], 0x3f7e87d3
mov dword [esi + 0xac], 0x3f800000
mov dword [esi + 0xb0], 0x43aba666
mov word [esi + 0xb4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
movq qword [esi + 0xcc], xmm0
push 0
lea ecx, [esi + 0xd4]
mov dword [ebp - 4], 0
call fcn.1012ded0
mov dword [esi + 0xd8], 0
mov eax, esi
mov dword [esi + 0xdc], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100fcc40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164d1d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x102a0600]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
nop
push 8
mov byte [esi + 8], 0
call fcn.10084566
add esp, 4
test eax, eax
je 0x100fcc95
mov dword [eax], esi
mov dword [eax + 4], 0x100fc490
jmp 0x100fcc97
xor eax, eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x100fc2e0
push 0
push 0
call fcn.10099b80
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x48], ecx
test ecx, ecx
je 0x100fcd19
cmp dword [esi + 0x10], 0
jne 0x100fcd14
mov eax, dword [ebp - 0x44]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10084465
mov esp, ebp
pop ebp
ret
call fcn.1008e754
push 6
mov dword [ebp - 0x44], 0
call fcn.1008052d
int3

Function at 0x100fd790
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164e48
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102a0600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0xc], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
movups xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 4], 0
movups xmmword [ecx + 0x18], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x28], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov eax, dword [ebp + 0x18]
lea edx, [ecx + 0x30]
xorps xmm0, xmm0
mov byte [ebp - 4], 1
mov esi, dword [eax]
mov eax, esi
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100fd860
sub eax, edi
mov ecx, edx
sar eax, 1
push eax
push esi
call fcn.10025d91
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ff570
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164ff5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x102a0600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x102a8088
mov dword [ebp - 0x10], 0x102a8088
call fcn.10080a84
add esp, 4
test eax, eax
jne 0x100ff738
mov eax, dword [0x102a80b4]
cmp eax, 0x7fffffff
je 0x100ff73f
xor esi, esi
mov dword [ebp - 4], 0
cmp dword [0x102a80bc], esi
jne 0x100ff705
push 0x7c
call fcn.10084566
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100ff5f2
push esi
mov ecx, eax
call fcn.100fda30
jmp 0x100ff5f4
xor eax, eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
test eax, eax
je 0x100ff74c
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
lock inc dword [eax + 4]
push 8
mov byte [ebp - 4], 2
call fcn.10084566
add esp, 4
test eax, eax
je 0x100ff63a
lea ecx, [ebp - 0x30]
mov dword [eax + 4], 0x10102810
mov dword [eax], ecx
jmp 0x100ff63c
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
push ecx
push 0
push eax
push 0x100fd4f0
push 0
push 0
call fcn.10099b80
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x100ff72a
cmp dword [0x102a80bc], 0
mov byte [ebp - 4], 2
jne 0x100ff753
mov eax, dword [ebp - 0x20]
mov dword [0x102a80b8], ecx
lea ecx, [ebp - 0x1c]
mov dword [0x102a80bc], eax
call fcn.10101d60
mov esi, eax
test esi, esi
jns 0x100ff6d8
mov ecx, 0x102a80b8
call fcn.1000299b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100ff6ce
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x100ff6ce
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x100ff6c8
mov eax, dword [edx]
push ecx
mov ecx, edx
call dword [eax]
lea ecx, [ebp - 0x30]
call fcn.100fe0e0
jmp 0x100ff70b
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x30]
call fcn.100fe0e0
jmp 0x100ff70b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100ff6fd
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x100ff6fd
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x100ff6f7
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x100ff6fb
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x30]
call fcn.100fe0e0
inc dword [0x102a812c]
push 0x102a8088
call fcn.10080aa9
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x20], 0
call fcn.1008052d
push 5
call fcn.1008052d
dec eax
push 6
mov dword [0x102a80b4], eax
call fcn.1008052d
push 4
call fcn.10101550
call fcn.1008e754
int3