joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b820
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x10112722
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1014d0cc]
xor eax, esp
mov dword [esp + 0x38], eax
push ebp
push edi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x58]
mov edi, ecx
mov dword [esi], 0
call fcn.1010d600
mov edx, edi
lea ecx, [esp + 0x28]
mov dword [esi + 4], eax
call fcn.1003b180
mov edx, ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0
call fcn.1003b180
mov byte [esp + 0x50], 1
mov ecx, dword [esp + 0x10]
mov eax, 8
cmp dword [esp + 0x24], eax
jae 0x1003b89a
lea ecx, [esp + 0x10]
cmp dword [esp + 0x40], eax
mov eax, dword [esp + 0x2c]
jae 0x1003b8a8
lea eax, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
test eax, eax
jge 0x1003b8cb
call fcn.1010d670
mov edi, eax
call dword [sym.imp.MSVCR80.dll__errno]
mov eax, dword [eax]
mov dword [esi], eax
mov dword [esi + 4], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x50], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x28]
mov dword [esp + 0x50], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1010defb
add esp, 0x48
ret

Function at 0x1003ba20
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x10112759
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1014d0cc]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push edi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esi], 0
call fcn.1010d600
mov edx, edi
lea ecx, [esp + 0xc]
mov dword [esi + 4], eax
call fcn.1003b180
mov dword [esp + 0x34], 0
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x1003ba82
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1003baac
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x1003baac
call fcn.1010d600
mov edi, eax
call ebx
mov dword [esi], eax
mov dword [esi + 4], edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1010defb
add esp, 0x2c
ret
Function at 0x1003bb60
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x10112722
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1014d0cc]
xor eax, esp
mov dword [esp + 0x38], eax
push ebp
push edi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x58]
mov edi, ecx
mov dword [esi], 0
call fcn.1010d600
mov edx, edi
lea ecx, [esp + 0x28]
mov dword [esi + 4], eax
call fcn.1003b180
mov edx, ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0
call fcn.1003b180
mov byte [esp + 0x50], 1
mov ecx, dword [esp + 0x10]
mov eax, 8
cmp dword [esp + 0x24], eax
jae 0x1003bbda
lea ecx, [esp + 0x10]
cmp dword [esp + 0x40], eax
mov eax, dword [esp + 0x2c]
jae 0x1003bbe8
lea eax, [esp + 0x2c]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1003bc08
call fcn.1010d600
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov dword [esi + 4], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x50], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x28]
mov dword [esp + 0x50], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1010defb
add esp, 0x48
ret
Function at 0x1003c6c0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x101126db
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x1014d0cc]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov dword [edi], 0
call fcn.1010d600
lea ecx, [esp + 0x48]
mov dword [edi + 4], eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [esp + 0x70], 0
mov eax, dword [esi + 0x14]
lea ebp, [eax - 1]
cmp ebp, eax
jbe 0x1003c723
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp dword [esi + 0x18], 0x10
lea ebx, [esi + 4]
jb 0x1003c730
mov eax, dword [ebx]
jmp 0x1003c732
mov eax, ebx
cmp byte [eax + ebp], 0x2f
je 0x1003c763
mov eax, dword [esi + 0x14]
lea ebp, [eax - 1]
cmp ebp, eax
jbe 0x1003c748
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp dword [esi + 0x18], 0x10
jb 0x1003c750
mov ebx, dword [ebx]
cmp byte [ebx + ebp], 0x5c
je 0x1003c763
push esi
lea ecx, [esp + 0x4c]
call dword [0x1012717c]
jmp 0x1003c798
mov eax, dword [esi + 0x14]
add eax, 0xffffffff
push eax
push 0
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 1
call dword [0x1012717c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x70], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea edx, [esp + 0x48]
lea ecx, [esp + 0x2c]
call fcn.1003b180
mov byte [esp + 0x70], 2
mov eax, dword [esp + 0x30]
mov esi, 8
cmp dword [esp + 0x44], esi
jae 0x1003c7bd
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003c7fc
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 5
jne 0x1003c7ee
cmp dword [esp + 0x44], esi
mov eax, dword [esp + 0x30]
jae 0x1003c7e3
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1003c7fc
call fcn.1010d600
mov esi, eax
call ebx
mov dword [edi], eax
mov dword [edi + 4], esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x48]
mov dword [esp + 0x70], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1010defb
add esp, 0x64
ret
Function at 0x1003cd80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10110a73
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
add eax, 0x30
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 1
call fcn.1003b2b0
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x2c
ret 8

Function at 0x1003d180
Capabilities:
Get disk size

Disassembly:
sub esp, 0x2c
cmp dword [esi + 0x28], 0
jne 0x1003d208
push edi
push 0
lea edi, [esi + 8]
push 0x5c
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_first_of_wchar_t__unsigned_int_const]
add eax, 1
push eax
push 0
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
cmp dword [eax + 0x18], 8
jb 0x1003d1b7
mov eax, dword [eax + 4]
jmp 0x1003d1ba
add eax, 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea ecx, [esp + 0x14]
mov edi, eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
test edi, edi
pop edi
je 0x1003d1fa
mov eax, dword [esp]
mov ecx, dword [esp + 4]
imul ecx, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
add esp, 0x2c
ret
mov dword [esi + 0x28], 0x200
mov dword [esi + 0x2c], 0x1000
mov eax, dword [esi + 0x28]
add esp, 0x2c
ret

Function at 0x1003d210
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x10155000]
sub esp, 0x24
test eax, eax
jne 0x1003d24b
mov eax, dword [0x10154fc0]
test eax, eax
jne 0x1003d246
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 4]
test eax, eax
mov dword [0x10154fc0], eax
jg 0x1003d246
mov eax, 0x1000
mov dword [0x10154fc0], eax
mov dword [0x10155000], eax
add esp, 0x24
ret
Function at 0x1003d9a0
Capabilities:
Get file size

Disassembly:
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x40]
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], esi
call fcn.1010d600
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1003d9df
call fcn.1010d600
call dword [sym.imp.KERNEL32.dll_GetLastError]
or ebp, 0xffffffff
mov esi, eax
mov dword [esp + 0x1c], ebp
jmp 0x1003d9eb
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x1c], edx
neg esi
sbb esi, esi
test esi, fcn.1009bff0
mov dword [esp + 0x18], ebp
je 0x1003da0d
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0xc
test byte [ebx + 0x24], 4
je 0x1003da5c
call fcn.1003d210
sub eax, 1
cdq
mov ecx, eax
mov esi, edx
not esi
not ecx
mov ebx, esi
and ebx, dword [esp + 0x54]
mov edi, ecx
and edi, dword [esp + 0x50]
add eax, ebp
adc edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
and eax, ecx
and edx, esi
mov esi, dword [esp + 0x54]
sub eax, edi
sbb edx, ebx
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x34], edx
jmp 0x1003da7a
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov ecx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edi
sbb ecx, esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], ecx
push 0
lea edx, [esp + 0x18]
push edx
mov edx, dword [ebx + 4]
push 0x10
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x44]
push eax
push 0x10
lea ecx, [esp + 0x3c]
push ecx
push 0x940cf
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1003dab1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1003dada
cmp dword [esp + 0x14], 0
jne 0x1003dac8
mov eax, ebp
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0xc
mov edx, dword [esp + 0x3c]
cmp edx, esi
mov eax, dword [esp + 0x38]
jg 0x1003dade
jl 0x1003dada
cmp eax, edi
jae 0x1003dade
mov edx, esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0xc
Function at 0x10045d70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10116ff1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], 1
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
sub esp, 8
test esi, esi
mov eax, esp
mov dword [esp + 0x18], esp
mov dword [eax], ecx
mov dword [eax + 4], esi
je 0x10045dcf
lea edx, [esi + 8]
mov eax, 1
lock xadd dword [edx], eax
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call fcn.10046b70
mov dword [edi], 0x100437c0
mov edx, dword [eax]
mov dword [edi + 4], edx
mov eax, dword [eax + 4]
test eax, eax
mov dword [edi + 8], eax
je 0x10045dfe
add eax, 8
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0xc], 1
je 0x10045e23
mov ecx, eax
add eax, 8
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x10045e23
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
test esi, esi
mov byte [esp + 0x20], 0
je 0x10045e41
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10045e41
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x10046670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1011b748
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x20], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x38]
sub esp, 0x30
test ebx, ebx
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp + 0x44], esp
mov dword [eax + 0xc], ebx
je 0x100466d5
lea edx, [ebx + 4]
mov ecx, 1
lock xadd dword [edx], ecx
lea edi, [eax + 0x10]
mov ecx, 7
lea esi, [esp + 0x6c]
push ebp
rep movsd dword es:[edi], dword [esi]
call fcn.10048400
test ebx, ebx
mov dword [esp + 0x20], 0xffffffff
je 0x1004671f
lea edx, [ebx + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x1004671f
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1004671f
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x34
Function at 0x10048400
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1011b748
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x20], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x38]
sub esp, 0x30
test ebx, ebx
mov eax, esp
mov dword [ebp], 0
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp + 0x44], esp
mov dword [eax + 0xc], ebx
je 0x1004846c
lea edx, [ebx + 4]
mov ecx, 1
lock xadd dword [edx], ecx
lea edi, [eax + 0x10]
mov ecx, 7
lea esi, [esp + 0x6c]
push ebp
rep movsd dword es:[edi], dword [esi]
call fcn.100495d0
test ebx, ebx
mov dword [esp + 0x20], 0xffffffff
je 0x100484b6
lea edx, [ebx + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x100484b6
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100484b6
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x34

Function at 0x10048c60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10119ee8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
sub esp, 0x10
test esi, esi
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
lea ecx, [edi + 8]
mov dword [esp + 0x18], esp
mov dword [eax + 0xc], esi
je 0x10048cc1
lea eax, [esi + 4]
mov edx, 1
lock xadd dword [eax], edx
call fcn.100dd380
neg al
mov dword [esp + 0x14], 0xffffffff
sbb eax, eax
and eax, 0x1012b2c0
test esi, esi
mov dword [edi], eax
je 0x10048d07
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10048d07
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10048d07
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x100496b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10119ee8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
sub esp, 0x10
test esi, esi
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
lea ecx, [edi + 8]
mov dword [esp + 0x18], esp
mov dword [eax + 0xc], esi
je 0x10049711
lea eax, [esi + 4]
mov edx, 1
lock xadd dword [eax], edx
call fcn.100dd380
neg al
mov dword [esp + 0x14], 0xffffffff
sbb eax, eax
and eax, 0x1012b2d0
test esi, esi
mov dword [edi], eax
je 0x10049757
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10049757
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10049757
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x1004b790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10119ee8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
sub esp, 0x10
test esi, esi
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
lea ecx, [edi + 8]
mov dword [esp + 0x18], esp
mov dword [eax + 0xc], esi
je 0x1004b7f1
lea eax, [esi + 4]
mov edx, 1
lock xadd dword [eax], edx
call fcn.100dd380
neg al
mov dword [esp + 0x14], 0xffffffff
sbb eax, eax
and eax, 0x1012b2d8
test esi, esi
mov dword [edi], eax
je 0x1004b837
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1004b837
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1004b837
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x1004bb40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10119ee8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
sub esp, 0x10
test esi, esi
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
lea ecx, [edi + 8]
mov dword [esp + 0x18], esp
mov dword [eax + 0xc], esi
je 0x1004bba1
lea eax, [esi + 4]
mov edx, 1
lock xadd dword [eax], edx
call fcn.100dd380
neg al
mov dword [esp + 0x14], 0xffffffff
sbb eax, eax
and eax, 0x1012b2e0
test esi, esi
mov dword [edi], eax
je 0x1004bbe7
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1004bbe7
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1004bbe7
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x1004e440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10119e78
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
call fcn.1010d600
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
add ecx, edx
call dword [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x1004e4ca
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1004e4ca
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1004e4ca
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x1004e570
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10119e78
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1014d0cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
call fcn.1010d600
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], ecx
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [eax + edx]
call dword [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x1004e600
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1004e600
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1004e600
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret