joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016a30
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 0x48], 0xffffffff
setne al
push eax
push 0x1003cdc
push edi
push edi
push edi
push 0x1003bf0
push dword [0x102256c]
push 4
call fcn.01020f34
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x48]
call dword [fcn.01001080]
test eax, eax
jne 0x1016a95
call dword [fcn.0100103c]
cmp eax, edi
jle 0x1016a93
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 0x14

Function at 0x1016aa2
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016ac6
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016ac6
mov al, 1
jmp 0x1016ac8
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003d00
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [edi + 0x14]
push dword [ebp + 8]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1016b01
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016b25
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016b25
mov al, 1
jmp 0x1016b27
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003dd8
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1016b63
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016b87
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016b87
mov al, 1
jmp 0x1016b89
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003eb8
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x24]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1016bc5
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016be9
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016be9
mov al, 1
jmp 0x1016beb
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1003f90
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1016c27
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016c4b
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016c4b
mov al, 1
jmp 0x1016c4d
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1004070
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1016c89
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x1016cad
mov edx, esi
shl edx, 5
cmp dword [edx + eax + 8], ecx
je 0x1016cad
mov al, 1
jmp 0x1016caf
xor al, al
push eax
push 0x10022b4
push ecx
push ecx
push ecx
push 0x1004148
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
mov eax, dword [edi + 0x14]
push dword [ebp + 0xc]
shl esi, 5
mov esi, dword [esi + eax + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1016f46
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x10]
push edi
call dword [fcn.01001044]
xor ebx, ebx
cmp dword [esi], esi
sete bl
xor eax, eax
cmp ebx, eax
je 0x1016f85
cmp dword [esi + 8], eax
sete cl
push ecx
push 0x10045c4
push eax
push eax
push eax
push 0x10044f0
push dword [0x102256c]
push 4
call fcn.01020f34
push edi
call dword [fcn.01001048]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x101703a
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
sete al
push eax
push 0x10046d8
push 0
push 0
push 0
push 0x10045f0
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
and dword [esi + 8], 0
mov dword [esi + 4], eax
mov dword [esi], 1
pop esi
pop ebp
ret 4
Function at 0x101797d
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
setne al
push eax
push 0x10022b4
xor eax, eax
push eax
push eax
push eax
push 0x1005508
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edx, dword [esi + 0x14]
mov ecx, dword [ebp + 0xc]
shl ecx, 5
lea ecx, [ecx + edx + 0xc]
mov edx, dword [ecx + 4]
lea eax, [edi + 0x7c]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edx], eax
mov dword [ecx + 4], eax
mov esi, dword [esi + 0x44]
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
ret 8

Function at 0x10179ee
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
setne al
push eax
push 0x10022b4
xor eax, eax
push eax
push eax
push eax
push 0x10055f0
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [esi + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
lea eax, [edi + 0x7c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov esi, dword [esi + 0x44]
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1017a5e
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1022568], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x1017ab7
cmp dword [esi + 0xc], 1
mov ebx, 0x10022b4
sete al
push eax
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x10057c0
push dword [0x102256c]
push 4
call fcn.01020f34
xor eax, eax
cmp edi, eax
setne cl
push ecx
push ebx
push eax
push eax
push eax
push 0x10056e8
push dword [0x102256c]
push 4
call fcn.01020f34
lea ebx, [esi + 0x10]
push ebx
call dword [fcn.01001044]
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 4]
lea eax, [edi + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
inc dword [esi + 8]
push ebx
mov dword [esi + 4], eax
call dword [fcn.01001048]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1017aed
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10]
push ebx
call dword [fcn.01001044]
mov edi, dword [ebp + 8]
lea eax, [edi + 8]
cmp dword [eax], eax
jne 0x1017b59
cmp dword [eax + 4], eax
jne 0x1017b59
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x1017b47
test byte [eax + 0x9c], 4
je 0x1017b47
cmp byte [eax + 0x99], 2
jb 0x1017b47
push edi
push 0x10038dc
push 0x22
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor eax, eax
push eax
push 0x10022b4
push eax
push eax
push eax
push 0x1005970
jmp 0x1017bc1
cmp dword [esi], esi
je 0x1017b7a
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov dword [ecx + 4], edx
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
dec dword [esi + 8]
xor esi, esi
inc esi
jmp 0x1017bd0
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x1017bb1
test byte [eax + 0x9c], 4
je 0x1017bb1
cmp byte [eax + 0x99], 2
jb 0x1017bb1
push edi
push 0x10038dc
push 0x23
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor eax, eax
push eax
push 0x10022b4
push eax
push eax
push eax
push 0x1005898
push dword [0x102256c]
xor esi, esi
push 4
call fcn.01020f34
push ebx
call dword [fcn.01001048]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1017cf7
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push edi
mov esi, ecx
call dword [eax + 8]
lea ecx, [esi + 0x50]
mov eax, dword [ecx + 0xc]
dec eax
push eax
call fcn.01013db7
xor ebx, ebx
mov esi, eax
cmp esi, ebx
setne al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1005ba0
push dword [0x102256c]
push 4
call fcn.01020f34
cmp byte [esi + 0x1c], 1
sete al
push eax
push 0x1005b6c
push ebx
push ebx
push ebx
push 0x1005aa0
push dword [0x102256c]
push 4
call fcn.01020f34
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1017d6c
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push edi
mov edi, ecx
lea ecx, [edi + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [edi + 0x5c], eax
jne 0x1017dca
push esi
call fcn.01014a80
mov esi, dword [eax + 0xc]
test esi, esi
je 0x1017dc3
lea eax, [esi + 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x1017dc3
push edi
mov ecx, esi
call fcn.0101bf28
test eax, eax
jne 0x1017dc3
push eax
push 0x1005d40
push 0x5d4
push 2
push 1
push 0x1005c70
push dword [0x102256c]
push 4
call fcn.01020f34
mov dword [edi + 0xd0], esi
pop esi
pop edi
ret
Function at 0x1017e8b
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
xor ebx, ebx
cmp eax, ebx
mov dword [esi], 0x1005a58
mov dword [esi + 4], 0x1005a44
je 0x1017ed3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
sete al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1005f08
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [esi + 0x1c]
call fcn.0101fb42
push dword [esi + 0x20]
mov dword [esi + 0x1c], ebx
call fcn.0101fb42
push dword [esi + 0x24]
mov dword [esi + 0x20], ebx
call fcn.0101fb42
push dword [esi + 0x2c]
mov dword [esi + 0x24], ebx
call fcn.0101fb42
push dword [esi + 0x28]
mov dword [esi + 0x2c], ebx
call fcn.0101fb42
mov ecx, dword [esi + 0x38]
add esp, 0x14
cmp ecx, ebx
mov dword [esi + 0x28], ebx
je 0x1017f1b
push 3
call fcn.01014545
cmp dword [esi + 0x14], ebx
mov dword [esi + 0x38], ebx
je 0x1017fa7
cmp dword [esi + 0x3c], ebx
mov dword [ebp - 4], ebx
jbe 0x1017f96
push edi
xor edi, edi
mov eax, dword [esi + 0x14]
add eax, edi
cmp dword [eax + 8], ebx
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
je 0x1017f52
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14]
mov dword [eax + edi + 8], ebx
mov eax, dword [esi + 0x14]
add eax, edi
cmp dword [eax + 0x14], ebx
je 0x1017f87
cmp dword [eax + 0x1c], ebx
je 0x1017f6d
mov eax, dword [eax + 0x14]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [esi + 0x14]
lea eax, [eax + edi + 0x14]
cmp dword [eax], ebx
je 0x1017f87
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14]
mov dword [eax + edi + 0x14], ebx
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 0x20
cmp eax, dword [esi + 0x3c]
jb 0x1017f32
pop edi
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x1017fa4
push 3
call fcn.0101735a
mov dword [esi + 0x14], ebx
push dword [esi + 0x30]
call fcn.0101fb42
mov eax, dword [esi + 0x34]
cmp eax, ebx
pop ecx
mov dword [esi + 0x30], ebx
je 0x1017fc3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x1017fd3
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [esi + 0x40], ebx
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x1017fe3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x44], ebx
mov esi, dword [esi + 0x48]
cmp esi, 0xffffffff
je 0x1017ff2
push esi
call dword [fcn.01001030]
pop esi
pop ebx
leave
ret
Function at 0x1019317
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov al, byte [esi + 0x1c]
test al, al
jne 0x101932c
mov byte [esi + 0x1c], 8
jmp 0x101934f
cmp al, 9
sete al
push eax
push 0x10022b4
push 0
push 0
push 0
push 0x1007698
push dword [0x102256c]
push 4
call fcn.01020f34
mov eax, dword [ebp + 8]
test eax, eax
je 0x101935b
mov eax, dword [eax]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1019367
mov eax, dword [eax]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1019373
mov eax, dword [eax]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101937f
mov eax, dword [eax]
mov dword [esi + 0x2c], eax
pop esi
pop ebp
ret 0x10

Function at 0x10194ba
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0x54], 0
mov dword [esi], 0x1006da8
mov dword [esi + 0xc0], 0x1006ce8
je 0x10194f5
lea ecx, [esi + 0x50]
mov eax, dword [ecx + 0xc]
dec eax
push eax
call fcn.01013db7
cmp byte [eax + 0x1c], 1
jne 0x10194f5
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10194f5
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ecx, esi
pop esi
jmp fcn.010170b2
Function at 0x101980d
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], edi
mov dword [eax], edi
je 0x10198c7
mov ecx, dword [0x1022570]
mov eax, dword [ecx]
push 1
push dword [ebp + 0x14]
lea edx, [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push edx
call dword [eax + 0x28]
test eax, eax
jge 0x10198ad
mov ecx, 0x8007000e
mov ebx, ecx
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x1019887
test byte [eax + 0x9c], 4
je 0x1019887
cmp byte [eax + 0x99], 2
jb 0x1019887
push ecx
push 0x10038ec
push 0xa
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
cmp dword [ebp - 4], edi
sete al
push eax
push 0x1003540
push edi
push edi
push edi
push 0x1007b28
push dword [0x102256c]
push 4
call fcn.01020f34
jmp 0x101995a
mov ecx, dword [ebp - 4]
push dword [ebp + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp + 0x18]
mov esi, eax
push edi
push esi
call fcn.010203a4
add esp, 0xc
push 0xf8
call fcn.0101fb27
cmp eax, edi
pop ecx
je 0x10198ee
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x1c]
push dword [ebp - 4]
call fcn.01018f69
mov esi, eax
jmp 0x10198f0
xor esi, esi
cmp esi, edi
jne 0x1019934
mov ecx, 0x8007000e
mov ebx, ecx
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101995a
test byte [eax + 0x9c], 4
je 0x101995a
cmp byte [eax + 0x99], 2
jb 0x101995a
push ecx
push 0x10038ec
push 0xb
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
jmp 0x101995a
push dword [ebp + 0x24]
mov dword [ebp - 4], edi
push dword [ebp + 0x20]
mov eax, dword [esi]
push dword [ebp + 0x10]
mov ecx, esi
call dword [eax + 0x58]
mov ebx, eax
cmp ebx, edi
jl 0x1019954
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x1019966
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x1019966
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x20
Function at 0x1019983
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x1c]
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push edi
je 0x10199c5
cmp esi, ebx
je 0x10199c5
cmp dword [esi], 4
je 0x10199a7
cmp dword [ebp + 0x38], ebx
jne 0x10199a7
xor al, al
jmp 0x10199aa
xor eax, eax
inc eax
push eax
push 0x1002740
push ebx
push ebx
push ebx
push 0x1007cc0
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 0x3c]
lea eax, [ebp + 0x1c]
push dword [ebp + 0x34]
mov dword [ebp + 0x1c], ebx
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0101980d
mov edi, eax
cmp edi, ebx
jl 0x1019a15
push ebx
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x1c]
mov ecx, esi
call fcn.0101d110
mov eax, dword [ebp + 0x38]
mov dword [esi + 0xd0], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x1019a22
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x1019a22
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x38

Function at 0x101a003
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 0x18], edi
sete al
push eax
push 0x1008a0c
push edi
push edi
push edi
push 0x1008938
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [esi + 8]
call fcn.0101fb42
mov eax, dword [esi + 0xc]
cmp eax, edi
pop ecx
je 0x101a046
push eax
call dword [fcn.01001090]
mov dword [esi + 0xc], edi
pop edi
pop esi
ret

Function at 0x101a215
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp byte [0x1022568], bl
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x101a250
cmp dword [edi + 0xc], 1
sete al
push eax
push 0x10022b4
push ebx
push ebx
push ebx
push 0x1008a28
push dword [0x102256c]
push 4
call fcn.01020f34
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 8], eax
call dword [fcn.01001044]
mov esi, dword [edi]
jmp 0x101a298
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101a28d
cmp dx, bx
je 0x101a289
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101a28d
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x101a267
xor eax, eax
jmp 0x101a292
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x101a29e
mov esi, dword [esi]
cmp edi, esi
jne 0x101a261
jmp 0x101a2ab
lea eax, [esi + 0x10]
push eax
call dword [fcn.01001064]
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [fcn.01001048]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101a3d9
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1022568], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x101a432
cmp dword [esi + 0xc], 1
mov ebx, 0x10022b4
sete al
push eax
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x1008c40
push dword [0x102256c]
push 4
call fcn.01020f34
xor eax, eax
cmp edi, eax
setne cl
push ecx
push ebx
push eax
push eax
push eax
push 0x1008b78
push dword [0x102256c]
push 4
call fcn.01020f34
lea ebx, [esi + 0x10]
push ebx
call dword [fcn.01001044]
mov eax, dword [esi + 4]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [eax], edi
inc dword [esi + 8]
push ebx
mov dword [esi + 4], edi
call dword [fcn.01001048]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x101a45f
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1022568], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ebx, 0x10022b4
je 0x101a4b8
cmp dword [edi + 0xc], 1
sete al
push eax
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x1008f88
push dword [0x102256c]
push 4
call fcn.01020f34
xor eax, eax
cmp esi, eax
setne cl
push ecx
push ebx
push eax
push eax
push eax
push 0x1008ec0
push dword [0x102256c]
push 4
call fcn.01020f34
lea eax, [edi + 0x10]
push eax
mov dword [ebp + 8], eax
call dword [fcn.01001044]
mov ecx, dword [esi]
cmp ecx, esi
jne 0x101a519
cmp dword [esi + 4], esi
jne 0x101a519
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101a507
test byte [eax + 0x9c], 4
je 0x101a507
cmp byte [eax + 0x99], 2
jb 0x101a507
push esi
push 0x1008924
push 0xa
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor esi, esi
push esi
push 0x1008e98
push esi
push esi
push esi
push 0x1008dd0
jmp 0x101a575
cmp dword [edi], edi
je 0x101a532
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov dword [esi + 4], esi
mov dword [esi], esi
dec dword [edi + 8]
xor esi, esi
inc esi
jmp 0x101a582
mov eax, dword [0x102200c]
cmp eax, 0x102200c
je 0x101a569
test byte [eax + 0x9c], 4
je 0x101a569
cmp byte [eax + 0x99], 2
jb 0x101a569
push esi
push 0x1008924
push 0xb
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.01013553
xor esi, esi
push esi
push ebx
push esi
push esi
push esi
push 0x1008d08
push dword [0x102256c]
push 4
call fcn.01020f34
push dword [ebp + 8]
call dword [fcn.01001048]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x101add1
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, 1
push edi
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
je 0x101adfd
cmp eax, 2
jne 0x101ae05
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
jmp 0x101ae20
push ebx
push 0x100927c
push ebx
push ebx
push ebx
push 0x10091b0
push dword [0x102256c]
push 4
call fcn.01020f34
lea eax, [ebp - 4]
push eax
push 0x1000
push dword [ebp + 8]
call fcn.01014a44
mov edi, eax
cmp edi, ebx
jl 0x101ae7e
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0101fb27
cmp eax, ebx
pop ecx
mov dword [esi + 8], eax
jne 0x101ae60
mov edi, 0x8007000e
jmp 0x101ae7e
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call fcn.010149d6
mov edi, eax
cmp edi, ebx
jge 0x101ae7e
push dword [esi + 8]
call fcn.0101fb42
pop ecx
mov dword [esi + 8], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x101ae8c
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x10]
push eax
call dword [fcn.01001068]
mov ebx, eax
xor edi, edi
cmp ebx, edi
jge 0x101aec2
push edi
push 0x1009440
push edi
push edi
push edi
push 0x1009378
push dword [0x102256c]
push 4
call fcn.01020f34
jmp 0x101af0e
jne 0x101af0e
push esi
mov ecx, 0x102204c
call fcn.0101a45f
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x101aedc
cmp eax, 2
jne 0x101aeea
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x18], edi
jmp 0x101af05
push edi
push 0x1009360
push edi
push edi
push edi
push 0x1009298
push dword [0x102256c]
push 4
call fcn.01020f34
push 1
mov ecx, esi
call fcn.0101a1cf
pop edi
pop esi
mov eax, ebx
pop ebx
ret