joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c8640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101734aa
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
or edi, 0xffffffff
xor ebx, ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.K16_FIDVID_Control.0
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], eax
lea ebp, [esi + 0x44]
mov edi, edi
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c86d5
lea ecx, [ebx - 0x3ffeff9c]
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c86d7
xor eax, eax
mov dword [ebp], eax
inc ebx
add ebp, 4
cmp ebx, 8
jl 0x100c86b0
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c8706
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010062
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8708
xor eax, eax
push 0x10
mov dword [esi + 0x68], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c872e
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010063
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8730
xor eax, eax
push 0x10
mov dword [esi + 0x64], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c8756
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010071
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8758
xor eax, eax
push 0x10
mov dword [esi + 0x34], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c877e
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010070
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8780
xor eax, eax
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x100c8bc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101734f0
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
or edi, 0xffffffff
xor ebx, ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.K15_FIDVID_Control.0
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], eax
lea ebp, [esi + 0x44]
mov edi, edi
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c8c55
lea ecx, [ebx - 0x3ffeff9c]
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8c57
xor eax, eax
mov dword [ebp], eax
inc ebx
add ebp, 4
cmp ebx, 8
jl 0x100c8c30
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c8c86
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010062
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8c88
xor eax, eax
push 0x10
mov dword [esi + 0x68], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c8cae
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010063
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8cb0
xor eax, eax
push 0x10
mov dword [esi + 0x64], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c8cd6
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010071
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8cd8
xor eax, eax
push 0x10
mov dword [esi + 0x34], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c8cfe
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010070
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100c8d00
xor eax, eax
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x100c9170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10173536
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
or ebx, 0xffffffff
xor edi, edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.K14_FIDVID_Control.0
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0xfa0
lea ebp, [esi + 0x44]
mov edi, edi
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c9205
lea ecx, [edi - 0x3ffeff9c]
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c9207
xor eax, eax
mov dword [ebp], eax
inc edi
add ebp, 4
cmp edi, 8
jl 0x100c91e0
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c9236
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010062
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c9238
xor eax, eax
push 0x10
mov dword [esi + 0x68], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c925e
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010063
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c9260
xor eax, eax
push 0x10
mov dword [esi + 0x64], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c9286
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010071
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c9288
xor eax, eax
push 0x10
mov dword [esi + 0x34], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c92ae
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010070
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c92b0
xor eax, eax
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x100c9770
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1017357c
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
or ebx, 0xffffffff
xor edi, edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.K12_FIDVID_Control.0
mov dword [esi + 0x3c], ebx
lea ebp, [esi + 0x40]
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c97fc
lea ecx, [edi - 0x3ffeff9c]
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c97fe
xor eax, eax
mov dword [ebp], eax
inc edi
add ebp, 4
cmp edi, 8
jl 0x100c97d7
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c982d
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010062
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c982f
xor eax, eax
push 0x10
mov dword [esi + 0x64], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c9855
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010063
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c9857
xor eax, eax
push 0x10
mov dword [esi + 0x60], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c987d
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010071
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c987f
xor eax, eax
push 0x10
mov dword [esi + 0x34], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100c98a5
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010070
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100c98a7
xor eax, eax
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x100c9fb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101735c2
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
or ebx, 0xffffffff
xor edi, edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.K10_FIDVID_Control.0
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea ebp, [esi + 0x44]
lea ebx, [ebx]
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100ca045
lea ecx, [edi - 0x3ffeff9c]
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100ca047
xor eax, eax
mov dword [ebp], eax
inc edi
add ebp, 4
cmp edi, 5
jl 0x100ca020
push 0x10
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100ca076
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010062
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100ca078
xor eax, eax
push 0x10
mov dword [esi + 0x5c], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100ca09e
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010063
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100ca0a0
xor eax, eax
push 0x10
mov dword [esi + 0x58], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100ca0c6
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010071
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100ca0c8
xor eax, eax
push 0x10
mov dword [esi + 0x34], eax
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x100ca0ee
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010070
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x100ca0f0
xor eax, eax
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x100ca440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101735e5
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
or edi, 0xffffffff
xor ebx, ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x18], ebx
push 0x10
mov dword [esi], vtable.K8_AM2_FIDVID_Control.0
call fcn.1003ddbb
add esp, 4
cmp eax, ebx
je 0x100ca4c3
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010042
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100ca4c5
xor eax, eax
push 0x10
mov dword [esi + 0x34], eax
call fcn.1003ddbb
add esp, 4
cmp eax, ebx
je 0x100ca4ee
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010041
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [esi + 0x38], eax
jmp 0x100ca4f1
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x100ca860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10173608
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
or edi, 0xffffffff
xor ebx, ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x18], ebx
push 0x10
mov dword [esi], vtable.K8_FIDVID_Control.0
call fcn.1003ddbb
add esp, 4
cmp eax, ebx
je 0x100ca8e3
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010042
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x100ca8e5
xor eax, eax
push 0x10
mov dword [esi + 0x34], eax
call fcn.1003ddbb
add esp, 4
cmp eax, ebx
je 0x100ca90e
mov dword [eax], vtable.MSR_Register.0
mov dword [eax + 4], 0xc0010041
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [esi + 0x38], eax
jmp 0x100ca911
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x100cb4d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1017408c
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10206870]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esi + 4], 0x80000010
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [esp + 0x20]
mov dl, byte [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esi + 0x14], eax
mov al, byte [esp + 0x28]
mov dword [esi + 0x18], ecx
mov cl, byte [esp + 0x2c]
push 0x200
mov dword [esi], vtable.CDrive.0
mov dword [esi + 0x10], edi
mov byte [esi + 0x20], dl
mov byte [esi + 0x21], al
mov byte [esi + 0x22], cl
mov dword [esi + 0x24], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call fcn.1003de3e
push 0x1017ea7a
push 0x200
push eax
mov dword [esi + 0x34], eax
call fcn.1003dc98
push 0x200
call fcn.1003de3e
push 0x1017ea7b
push 0x200
push eax
mov dword [esi + 0x38], eax
call fcn.1003dc98
push 0x200
call fcn.1003de3e
push 0x1017ea83
push 0x200
push eax
mov dword [esi + 0x3c], eax
call fcn.1003dc98
push 0x20
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.1003ddbb
fld qword [0x101f69b0]
add esp, 0x34
cmp eax, edi
je 0x100cb5c5
fld dword [0x101f69a8]
mov dword [eax], vtable.CCounter.0
fstp dword [eax + 0x18]
fst qword [eax + 0x10]
fstp qword [eax + 8]
jmp 0x100cb5c9
fstp st(0)
xor eax, eax
push 0x20
mov dword [esi + 0x48], eax
call fcn.1003ddbb
add esp, 4
cmp eax, edi
je 0x100cb5f7
fld dword [0x101f69a8]
mov dword [eax], vtable.CCounter.0
fstp dword [eax + 0x18]
fld qword [0x101f69b0]
fst qword [eax + 0x10]
fstp qword [eax + 8]
jmp 0x100cb5f9
xor eax, eax
push 0x20
mov dword [esi + 0x4c], eax
call fcn.1003ddbb
add esp, 4
cmp eax, edi
je 0x100cb627
fld dword [0x101f69a8]
mov dword [eax], vtable.CCounter.0
fstp dword [eax + 0x18]
fld qword [0x101f69b0]
fst qword [eax + 0x10]
fstp qword [eax + 8]
jmp 0x100cb629
xor eax, eax
push 0x20
mov dword [esi + 0x50], eax
call fcn.1003ddbb
add esp, 4
cmp eax, edi
je 0x100cb657
fld dword [0x101f69a8]
mov dword [eax], vtable.CCounter.0
fstp dword [eax + 0x18]
fld qword [0x101f69b0]
fst qword [eax + 0x10]
fstp qword [eax + 8]
jmp 0x100cb659
xor eax, eax
mov dword [esi + 0x54], eax
or eax, 0xffffffff
mov ecx, 1
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x90], ecx
mov dword [esi + 0x94], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x14
Function at 0x100d60f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov edx, esi
call fcn.100e34a0
xor ebx, ebx
mov edi, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
cmp edi, 0xffffffff
je 0x100d630d
mov eax, dword [esi + 0x174]
cmp eax, ebx
je 0x100d630d
cmp dword [esi + 0x178], ebx
je 0x100d630d
cmp dword [esi + 0x184], ebx
je 0x100d630d
cmp dword [esi + 0x180], ebx
je 0x100d630d
mov edx, dword [esi + 0x114]
push ebx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + edi*4]
push ecx
call eax
add esp, 0xc
test eax, eax
jne 0x100d6300
mov eax, dword [esp + 0x10]
cmp eax, ebx
jbe 0x100d6300
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003de3e
mov ecx, dword [esi + 0x114]
mov edx, dword [ecx + edi*4]
mov ebx, eax
push ebx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x174]
push edx
call eax
add esp, 0x10
test eax, eax
jne 0x100d62f7
xor edi, edi
cmp dword [esp + 0x10], edi
jbe 0x100d62f7
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x178]
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0x20
mov edx, dword [ebx + edi*4]
push ecx
push edx
call eax
add esp, 8
test eax, eax
jne 0x100d62ec
mov eax, dword [esp + 0x38]
sub eax, 0
je 0x100d6260
sub eax, 1
jne 0x100d62ec
cmp dword [ebp + 0xc], eax
je 0x100d62a0
push 0x38
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.1003f7d0
mov ecx, dword [esi + 0x184]
lea edx, [esp + 0x5c]
mov dword [esp + 0x5c], 0x38
mov eax, dword [ebx + edi*4]
push edx
push eax
call ecx
add esp, 0x14
test eax, eax
jne 0x100d62ec
fld qword [esp + 0x78]
mov edx, dword [ebp + 0x10]
fstp dword [edx + 8]
jmp 0x100d62e4
cmp dword [ebp + 0xc], 0
je 0x100d62a0
push 0x38
lea ecx, [esp + 0x54]
push 0
push ecx
call fcn.1003f7d0
mov ecx, dword [esi + 0x184]
lea edx, [esp + 0x5c]
mov dword [esp + 0x5c], 0x38
mov eax, dword [ebx + edi*4]
push edx
push eax
call ecx
add esp, 0x14
test eax, eax
jne 0x100d62ec
fld qword [esp + 0x78]
mov edx, dword [ebp + 0x10]
fstp dword [edx + 4]
jmp 0x100d62e4
mov edx, dword [esi + 0x180]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x18
mov ecx, dword [ebx + edi*4]
push eax
push ecx
call edx
add esp, 8
test eax, eax
jne 0x100d62ec
mov eax, dword [ebp + 0x10]
fld qword [esp + 0x28]
fstp dword [eax + 4]
mov dword [esp + 0x14], 1
inc edi
cmp edi, dword [esp + 0x10]
jb 0x100d61bf
push ebx
call fcn.1003e211
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10125be0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ecx + 0xc]
fld dword [0x101f69a8]
push ebx
fstp dword [esp + 8]
push esi
push edi
test eax, eax
je 0x10125ddc
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10125ddc
mov edi, dword [eax + 4]
test edi, edi
je 0x10125ddc
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x18]
movzx eax, word [eax + 6]
mov ecx, 0x1533
cmp ax, cx
je 0x10125c3d
mov edx, 0x1583
cmp ax, dx
jne 0x10125dbe
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10125dbe
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
lea edx, [esp + 0x14]
push edx
movzx edx, byte [edi + 0x16]
push 0xa4
push edx
movzx edx, byte [edi + 0x15]
push edx
movzx edx, byte [edi + 0x14]
push edx
call eax
test eax, eax
je 0x10125dbe
cmp dword [ebx + 0x498], 0
jne 0x10125ce9
push 0x16c
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x10125c9f
push 1
mov ecx, eax
call fcn.100550e0
mov esi, eax
jmp 0x10125ca1
xor esi, esi
push 0x101e88c8
lea ecx, [esi + 4]
push 0x100
push ecx
call fcn.1013b440
fldz
fstp dword [esi + 0x168]
add esp, 0xc
mov dword [ebx + 0x498], esi
or dword [esi + 0x144], 0x1802000
call fcn.1013c470
mov edx, dword [eax + 0x38]
mov ecx, dword [edx + 8]
mov dword [esi + 0x148], ecx
mov ecx, dword [eax + 0x38]
push esi
call fcn.100021e0
mov esi, dword [ebx + 0x498]
test esi, esi
je 0x10125dbe
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10125d26
mov edx, dword [ecx]
mov edx, dword [edx + 0x18]
lea eax, [esp + 0x14]
push eax
movzx eax, byte [edi + 0x16]
push 0xa4
push eax
movzx eax, byte [edi + 0x15]
push eax
movzx eax, byte [edi + 0x14]
push eax
call edx
mov eax, dword [esp + 0x14]
shr eax, 0x15
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esi + 0x14c], eax
test eax, eax
jge 0x10125d45
fadd dword [0x101f69c0]
fmul qword [0x101f6ec8]
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
fadd dword [esi + 0x168]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fmul dword [esi + 0x164]
fstp dword [esi + 0x158]
call edx
test eax, eax
je 0x10125db4
fld dword [esi + 0x158]
fld dword [esi + 0x160]
fcompp
fnstsw ax
test ah, 5
jp 0x10125d93
fld dword [esi + 0x158]
fstp dword [esi + 0x160]
fld dword [esi + 0x158]
fld dword [esi + 0x15c]
fcompp
fnstsw ax
test ah, 0x41
jne 0x10125db4
fld dword [esi + 0x158]
fstp dword [esi + 0x15c]
fld dword [esi + 0x158]
fstp dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10125ddc
mov eax, dword [eax + 8]
test eax, eax
je 0x10125ddc
mov edi, dword [eax + 4]
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x10125c1e
fld dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4