joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ce980
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CCLCMsg_FileCRCCheck.0
call fcn.1013ed00
mov dword [esi + 0x34], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0x10221af0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x10221af0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0x10221af0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100d2f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CSVCMsg_SendTable_sendprop_t.0
call fcn.1013ed00
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0x10221af0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0x10221af0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100d6db0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CSVCMsg_VoiceData.0
call fcn.1013ed00
mov dword [esi + 0x30], 0
mov eax, esi
mov dword [esi + 8], 0
mov word [esi + 0x1c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], 0x10221af0
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100dab70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CSVCMsg_GameEvent_key_t.0
call fcn.1013ed00
mov dword [esi + 0x34], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0x10221af0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0x10221af0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100e5040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017e9e7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
or dword [edi + 0x30], 2
cmp dword [edi + 0xc], 0
jne 0x100e50c7
push 0x18
call fcn.1017b3b4
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgSteamDatagramConnectionQuality.0
call fcn.1013ed00
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [edi + 0xc], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100e5430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017ea67
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
or dword [edi + 0x3c], 0x800
cmp dword [edi + 0x30], 0
jne 0x100e54c8
push 0x20
call fcn.1017b3b4
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgSteamDatagramClientSwitchedPrimary_RouterQuality.0
call fcn.1013ed00
mov dword [esi + 0x18], 0
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [edi + 0x30], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e6db0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgSteamDatagramRouterPingReply.0
call fcn.1013ed00
mov dword [esi + 8], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x6c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100e9680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgSteamDatagramGameServerAuthTicket.0
call fcn.1013ed00
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0x10221af0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100f2c00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgSteamDatagramConnectionStatsRouterToServer.0
call fcn.1013ed00
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100f51a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgSteamDatagramClientPingSampleReply.0
call fcn.1013ed00
mov dword [esi + 8], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100f78f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgSteamDatagramRouterHealth.0
call fcn.1013ed00
mov dword [esi + 0x20], 0
mov eax, esi
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10100a50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgHttpRequest.0
call fcn.1013ed00
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 8], 0x10221af0
mov dword [esi + 0xc], 0x10221af0
mov dword [esi + 0x48], 0x10221af0
mov dword [esi + 0x24], 0
mov dword [esi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10106ba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgAMGetUserGameStatsResponse.0
call fcn.1013ed00
mov dword [esi + 0x18], 0
mov eax, esi
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 2
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1010bd10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CGCMsgSQLStatsResponse.0
call fcn.1013ed00
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101106a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CMsgAMSendEmail.0
call fcn.1013ed00
mov dword [esi + 0x18], 0
mov eax, esi
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10127d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10185278
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101ce084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10127e44
cmp byte [ebx + 0x3d], 0
je 0x10127e44
push 0xffffffffffffffff
call fcn.10127650
cmp eax, 0xffffffff
sete al
test al, al
je 0x10127d59
xor al, al
jmp 0x10127e46
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
lea edi, [ebx + 0x40]
nop
cmp esi, 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [ebx + 0x38]
push edi
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10127dcc
sub eax, 1
je 0x10127dd0
mov esi, dword [ebp - 0x14]
sub eax, 2
je 0x10127e28
xor bl, bl
jmp 0x10127e2a
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp esi, 0x10
mov edi, dword [ebp - 0x2c]
cmovae eax, ecx
sub edi, eax
je 0x10127e06
push dword [ebx + 0x4c]
cmp esi, 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp edi, eax
jne 0x10127dc8
cmp byte [ebx + 0x3d], 0
je 0x10127e28
test edi, edi
lea edi, [ebx + 0x40]
jne 0x10127d90
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10127be0
jmp 0x10127d89
mov bl, 1
cmp esi, 0x10
jb 0x10127e40
push 1
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x28]
call fcn.10001da0
add esp, 0xc
mov al, bl
jmp 0x10127e46
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017b14e
mov esp, ebp
pop ebp
ret
Function at 0x1012cde0
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
sub dword [ebp + 0xc], 1
jne 0x1012ce9d
push 0xff
push 0x10223ed8
push 0x10223cbc
push 0x10223cb4
push 0x10223cb8
push 0xff
push 0x10223dd8
push 0x101b61e8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [0x10223cb8]
cmp eax, 0x7ee805d4
je 0x1012ce88
cmp eax, 0xc49054ce
je 0x1012ce88
cmp eax, 0x1eafa62c
je 0x1012ce88
cmp eax, 0xbeaf7a66
je 0x1012ce88
cmp eax, 0xfae19114
je 0x1012ce88
cmp eax, 0x60462393
je 0x1012ce88
cmp eax, 0x94ee7937
je 0x1012ce88
cmp eax, 0x58336c2d
je 0x1012ce88
lea eax, [ebp + 0xf]
push eax
push 0
push 1
push 0x13
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea eax, [ebp - 4]
push eax
push 6
push 0
push 0
push 0
push 0xc0000420
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x1012ccf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1012d9d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018551c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x102223ec]
mov ecx, dword [0x10222420]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [0x102223ec]
push eax
call dword [esi + 0xc]
mov ebx, eax
test ebx, ebx
je 0x1012dafc
mov ecx, dword fs:[0x2c]
mov esi, 0x102c79d8
mov edx, dword [0x10222064]
mov edi, dword [ecx + edx*4]
mov ecx, dword [0x102c7a04]
cmp ecx, dword [edi + 4]
jle 0x1012da8a
push 0x102c7a04
call fcn.1017b2b0
mov eax, dword [0x102c7a04]
add esp, 4
cmp eax, 0xffffffff
jne 0x1012da8a
push str.VENDETTA
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.100056e0
push 0x1018b1a0
call fcn.1017b72a
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x102c7a04
call fcn.1017b271
add esp, 4
mov eax, dword [0x102224a4]
mov byte [0x101d0ea1], 1
movd xmm0, dword [eax + ebx]
mov eax, dword [0x102223f4]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [eax + 0x20]
subss xmm0, dword [0x102c79f4]
comiss xmm0, dword [0x101b63bc]
jb 0x1012dafc
call fcn.1012d920
cmp dword [0x102c79ec], 0x10
mov eax, dword [0x102c79fc]
cmovae esi, dword [0x102c79d8]
mov ecx, esi
cmp eax, dword [edi + 4]
jle 0x1012dae2
call fcn.1012d6f0
jmp 0x1012daea
mov edx, esi
call dword [0x102c7a00]
mov eax, dword [0x102223f4]
movss xmm0, dword [eax + 0x10]
movss dword [0x102c79f4], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101314e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [eax]
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101314f0
sub ecx, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x10131516
movzx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10131505
push 0x1f31d
and esi, 0x7fffffff
push esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_ldiv]
imul ecx, eax, 0xb14
add esp, 8
imul edx, edx, 0x41a7
pop edi
pop esi
sub edx, ecx
lea eax, [edx + 0x7fffffff]
js 0x10131545
mov eax, edx
pop ebp
ret 4
Function at 0x10144030
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101869d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x1014407f
mov eax, dword [esi]
jmp 0x10144081
mov eax, esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov byte [eax], 0
call fcn.10005940
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.10005940
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x34], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10153df0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov edx, dword [ebx + 8]
cmp esi, dword [edx]
jne 0x10153e23
cmp eax, edx
jne 0x10153e23
call fcn.10153850
mov eax, dword [ebx + 8]
pop esi
pop ebx
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, eax
je 0x10153efa
push edi
nop dword [eax]
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 8]
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10153e40
sub eax, edx
mov edi, 0x811c9dc5
mov edx, 0
je 0x10153e6c
mov ebx, dword [esi + 8]
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10153e58
mov ebx, dword [ebp - 4]
push 0x1f31d
and edi, 0x7fffffff
push edi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_ldiv]
imul ecx, edx, 0x41a7
add esp, 8
imul eax, eax, 0xb14
sub ecx, eax
jns 0x10153e97
add ecx, 0x7fffffff
mov eax, dword [ebx + 0x1c]
and eax, ecx
mov ecx, dword [ebx + 0x10]
lea edx, [eax*8]
add ecx, edx
cmp dword [ecx + 4], esi
jne 0x10153eca
cmp dword [ecx], esi
jne 0x10153ec2
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 8]
mov dword [edx + ecx + 4], eax
jmp 0x10153ed2
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x10153ed2
cmp dword [ecx], esi
jne 0x10153ed2
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push esi
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 0xc]
call fcn.1017b3e7
mov esi, dword [ebp + 0xc]
add esp, 4
cmp esi, dword [ebp + 0x10]
jne 0x10153e30
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10156fa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10188458
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ce084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.1013ed00
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x60], 0
mov dword [esi + 8], 0x10221af0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret