joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], edx
cmova eax, ecx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x58], edx
cmp eax, dword [esi + 0x20]
je 0x40648b
lea edi, [esi + 0xc8]
mov ebx, ecx
cmp dword [edi + 8], edx
je 0x40646c
push edi
call fcn.004063b6
xor edx, edx
add edi, 0x28
sub ebx, 1
jne 0x40645f
cmp dword [esi + 0x5c], ebx
je 0x406486
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.004071e7
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
push ebx
call fcn.00406390
mov edi, eax
test edi, edi
jne 0x406507
lea eax, [ebx + 0x20]
push eax
call fcn.00407905
mov edi, eax
test edi, edi
jne 0x406507
lea eax, [ebx + 0x1c]
push eax
call fcn.00407905
mov edi, eax
test edi, edi
jne 0x406507
push ebx
call fcn.00407157
mov edi, eax
test edi, edi
je 0x406507
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
push 0x20
pop esi
push ebx
call fcn.0040630e
add ebx, 0x28
sub esi, 1
jne 0x4064f6
mov esi, dword [ebp + 8]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x40651b
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x40652f
cmp dword [esi + 0x40], edx
jne 0x40652f
cmp dword [esi + 0x3c], edx
jne 0x40652f
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x40774a
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
and dword [eax + 0xc], 0
mov dword [eax + 0x20], 0x6a09e667
mov dword [eax + 0x24], 0xbb67ae85
mov dword [eax + 0x28], 0x3c6ef372
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0x510e527f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
pop ebp
ret 4
Function at 0x407a12
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.0043b89e
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x407a3e
call fcn.00407924
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409b31
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x44386c
call fcn.004356bf
cmp byte [0x458910], 0
mov edi, dword [ebp + 8]
jne 0x409b71
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00408b08
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.00435675
pop ecx
test esi, esi
je 0x409b7f
mov al, 1
jmp 0x409bc5
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x409b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x409b90
xor al, al
jmp 0x409bc5
lea ecx, [ebp - 0x50]
call fcn.0040a3ed
lea ecx, [ebp - 0x28]
call fcn.00407e94
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040a609
test al, al
je 0x409bba
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00435675
pop ecx
mov al, bl
call fcn.00435688
ret 4

Function at 0x409bcd
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x458910], 0
jne 0x409c07
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00435675
pop ecx
test esi, esi
pop esi
je 0x409c16
mov al, 1
jmp 0x409c18
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x409c01
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x409da8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040ac28
cmp eax, 0xffffffff
je 0x409dd5
mov ecx, eax
and cl, 0x11
cmp cl, 1
jne 0x409dd5
and eax, 0xfffffffe
push eax
push esi
call fcn.0040a349
test al, al
je 0x409e0d
cmp byte [0x458910], 0
push esi
jne 0x409e03
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00435675
pop ecx
test esi, esi
je 0x409e0d
mov al, 1
jmp 0x409e0f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x409dfd
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40a08a
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x458910], 0
jne 0x40a0c2
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00435675
pop ecx
test esi, esi
pop esi
je 0x40a0cf
mov al, 1
jmp 0x40a0d1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x40a0bc
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x40a29d
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x458910], 0
jne 0x40a2d4
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00435675
test esi, esi
pop ecx
setne al
pop esi
jmp 0x40a2e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40a349
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x458910], 0
jne 0x40a384
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00435675
pop ecx
test esi, esi
pop esi
je 0x40a394
mov al, 1
jmp 0x40a396
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x40a37e
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x40ac28
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x458910], 0
jne 0x40ac5c
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408b08
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00435675
pop ecx
mov eax, esi
pop esi
jmp 0x40ac6f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ae3a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ae64
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40ae64
xor al, al
jmp 0x40ae78
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418609
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4446df
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x452094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.004186b8
lea ecx, [esi + 0x78]
call fcn.004186b8
push dword [esi + 0x30]
call fcn.00435675
push dword [esi + 0x24]
call fcn.00435675
push dword [esi + 0x18]
call fcn.00435675
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41866d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x418681
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x418695
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4186a8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41aebf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44406d
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x452094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041a034
lea ecx, [esi + 0x30]
call fcn.004186b8
push dword [esi + 0x24]
call fcn.00435675
pop ecx
lea ecx, [esi + 0xc]
call fcn.00407a69
mov ecx, esi
call fcn.0041ae85
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b549
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x444cb1
call fcn.004356bf
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.0041b0b9
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.0041a140
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040be97
push dword [ebp - 0x18]
call fcn.00435675
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.00435688
ret 8
Function at 0x43443a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x452094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x208
push esi
push eax
call fcn.00436fb0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4344d6
push edi
push esi
call fcn.0043478d
push dword [edi]
and dword [ebp - 0x210], 0
call fcn.0043566c
pop ecx
push 0
lea ecx, [ebp - 0x210]
mov dword [ebx], eax
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043540e
mov esp, ebp
pop ebp
ret 8

Function at 0x43478d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4347b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4347b8
xor al, al
jmp 0x4347cc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x435402
Capabilities:
Terminate process

Disassembly:
jmp 0x435fe2
push 0x14
push 0x450250
call fcn.00435480
push 1
call fcn.00435bc8
pop ecx
test al, al
jne 0x435e99
push 7
call fcn.00436611
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00435b93
mov byte [ebp - 0x24], al
mov eax, dword [0x458c54]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x435e92
test eax, eax
jne 0x435f03
mov dword [0x458c54], ecx
push 0x445308
push 0x4452f0
call fcn.0043cc4a
pop ecx
pop ecx
test eax, eax
je 0x435ee6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x435fdc
push 0x4452ec
push 0x445284
call fcn.0043cbee
pop ecx
pop ecx
mov dword [0x458c54], 2
jmp 0x435f08
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00435d22
pop ecx
call fcn.004368ff
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x435f38
push esi
call fcn.00435c98
pop ecx
test al, al
je 0x435f38
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00436367
call esi
call fcn.00436905
mov esi, eax
cmp dword [esi], edi
je 0x435f56
push esi
call fcn.00435c98
pop ecx
test al, al
je 0x435f56
push dword [esi]
call fcn.0043c08b
pop ecx
call fcn.0043672c
movzx eax, ax
push eax
call fcn.0043cb9b
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0043675f
test al, al
jne 0x435f81
push esi
call fcn.0043c0c3
test bl, bl
jne 0x435f8a
call fcn.0043c066
push edi
push 1
call fcn.00435d3f
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x435fdc
call fcn.004354c6
ret
call fcn.004367f8
jmp 0x435e7a
Function at 0x10003250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101178b8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10157de0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
lea eax, [esp + 0x2c]
push eax
lea edi, [esp + 0x60]
mov dword [esp + 0x58], ebx
call fcn.10009820
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 1
call fcn.100c3450
push esi
mov ecx, eax
mov byte [esp + 0x58], 2
call fcn.100030b0
mov edi, 8
cmp dword [esp + 0x28], edi
jb 0x100032d0
mov edx, dword [esp + 0x14]
push edx
call fcn.100d41ba
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
cmp dword [esp + 0x44], edi
jb 0x100032f6
mov ecx, dword [esp + 0x30]
push ecx
call fcn.100d41ba
add esp, 4
xor edx, edx
cmp dword [esp + 0x74], 0x10
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], dx
jb 0x1000331d
mov eax, dword [esp + 0x60]
push eax
call fcn.100d41ba
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.100d32e1
add esp, 0x4c
ret
Function at 0x10008ef0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x101167eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1007011b
push 4
mov dword [esp + 0x24], 0
call fcn.100d4296
mov edi, eax
add esp, 4
test edi, edi
je 0x10008f72
call fcn.1006fcf5
mov dword [edi], eax
call fcn.1006faf9
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1006ff48
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10008f67
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.1006ff70
jmp 0x10008f74
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x1000f350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10117654
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 0x28], 0x1012bed8
mov dword [esi + 0x30], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x14], 0
push edi
mov ecx, esi
mov dword [esp + 0xc], 1
call fcn.1000aac0
mov dword [esp + 0x14], 1
mov eax, dword [esi + 0x28]
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::bad_format_string__.0
mov dword [esi + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::bad_format_string__.1.0
mov edx, dword [eax + 4]
lea ecx, [esi + 0x14]
mov dword [edx + esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::bad_format_string__.2.0
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 4]
lea edx, [eax - 8]
mov dword [eax + esi + 0x24], edx
test edi, edi
je 0x1000f3e0
lea eax, [edi + 0x14]
jmp 0x1000f3e2
xor eax, eax
push eax
push ecx
call fcn.10002cf0
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10010ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1011a320
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x90]
lea eax, [esp + 0x14]
push eax
mov eax, ebp
call fcn.10010bc0
xor ebx, ebx
push eax
mov dword [esp + 0x8c], ebx
call fcn.100096b0
mov edx, dword [eax]
add esp, 4
mov ecx, eax
mov eax, dword [edx + 0x18]
push 0x20
call eax
mov dword [esp + 0x88], 0xffffffff
mov edi, dword [esp + 0x14]
mov byte [esp + 0x90], al
cmp edi, ebx
je 0x10010d50
push ebx
lea ecx, [esp + 0x1c]
call fcn.1006ff48
mov eax, dword [edi + 4]
cmp eax, ebx
jbe 0x10010d2e
cmp eax, 0xffffffff
jae 0x10010d2e
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.1006ff70
cmp esi, ebx
je 0x10010d50
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10010dfc
mov cl, byte [esp + 0x90]
mov eax, 0xf
or esi, 0xffffffff
mov dword [esp + 0x1c], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
mov byte [esp + 0x70], bl
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], 6
mov byte [esp + 0x60], cl
mov dword [esp + 0x64], 0x201
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x78], 0x7fffffff
mov dword [esp + 0x7c], ebx
mov eax, dword [esp + 0x94]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, ebp
mov dword [esp + 0x90], 1
call fcn.10013850
mov dword [esp + 0x88], esi
lea esi, [esp + 0x1c]
call fcn.1000ec40
jmp 0x10010eb9
mov esi, dword [esp + 0x94]
cmp esi, eax
jbe 0x10010e26
mov ecx, dword [esp + 0x90]
sub esp, 0x64
mov eax, esp
mov dword [esp + 0x7c], esp
push ecx
call fcn.1000f2b0
mov ecx, esi
mov edx, ebp
call fcn.1000f060
lea edi, [ebp + 0x18]
call fcn.10012c50
xor edi, edi
cmp esi, ebx
jbe 0x10010eb9
mov dword [esp + 0x14], ebx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10010e5c
call fcn.100d3cdd
mov esi, dword [ebp + 0xc]
add esi, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 4]
mov dword [esi], 0xffffffff
mov dword [esi + 0x5c], 0x7fffffff
mov dword [esi + 0x60], ebx
call fcn.10007290
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x20]
call fcn.10007290
mov cl, byte [esp + 0x90]
add dword [esp + 0x14], 0x64
inc edi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 6
mov byte [esi + 0x44], cl
mov dword [esi + 0x48], 0x201
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
cmp edi, dword [esp + 0x94]
jb 0x10010e3c
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x4c]
call fcn.10007290
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78
ret 8
Function at 0x10012e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10117434
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 0x28], 0x1012bf18
mov dword [esi + 0x30], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x14], 0
push edi
mov ecx, esi
mov dword [esp + 0xc], 1
call fcn.1000ed70
mov dword [esp + 0x14], 1
mov eax, dword [esi + 0x28]
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.0
mov dword [esi + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.1.0
mov edx, dword [eax + 4]
lea ecx, [esi + 0x14]
mov dword [edx + esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_few_args__.2.0
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 4]
lea edx, [eax - 8]
mov dword [eax + esi + 0x24], edx
test edi, edi
je 0x10012eb0
lea eax, [edi + 0x14]
jmp 0x10012eb2
xor eax, eax
push eax
push ecx
call fcn.10002cf0
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10014aa0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1011a2a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esi + 0x40]
mov ebx, dword [esi + 0x44]
cmp edi, ebx
jl 0x10014b09
test byte [esi + 0x68], 4
je 0x10014bef
lea ecx, [esp + 0x18]
call fcn.100d34ff
mov dword [esp + 0x18], vtable.boost::io::too_many_args.0
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0
call fcn.10016130
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x10014bef
mov dword [esp + 0x10], edi
cmp edi, eax
jb 0x10014b35
call fcn.100d3cdd
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + eax]
cmp edx, dword [esi + 0x40]
jne 0x10014bca
cmp byte [esi + 0xb8], 0
je 0x10014b5d
lea ecx, [esi + 0xbc]
mov dword [esp + 0x14], ecx
jmp 0x10014b65
mov dword [esp + 0x14], 0
mov ecx, dword [esi + 0x10]
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10014b84
call fcn.100d3cdd
mov ebx, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
sub ecx, ebx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x10014ba6
call fcn.100d3cdd
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esi + 0xc]
lea eax, [esi + 0x6c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [eax + ebx + 4]
push ecx
add edx, eax
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.100161a0
add esp, 0x14
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
add dword [esp + 0x10], 0x64
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
cmp edi, eax
jb 0x10014b35
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret