joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005ff40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10117c38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10002300
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1005ff8a
add edi, 0x28
jmp 0x1005ff8c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1005ffa4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10066650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10119293
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
mov ecx, edi
call fcn.100668e0
lea eax, [esi + 0x18]
lea ecx, [edi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.100666d0
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
lea eax, [edi + 0x30]
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.100070a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x10073490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10109928
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
push 1
push edi
sub esp, 8
mov eax, esp
mov dword [esp + 0x20], esp
mov dword [eax], edi
push esi
mov dword [esp + 0x30], edi
mov dword [eax + 4], edi
call fcn.100d3150
mov esi, dword [esi + 4]
add esp, 0x14
mov dword [esp + 0x1c], 0xffffffff
cmp esi, edi
je 0x10073516
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi + 4]
push eax
call edi
test eax, eax
jne 0x10073516
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
push ecx
call edi
test eax, eax
jne 0x10073516
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10075760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10109d88
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call fcn.10081d70
mov eax, dword [esi]
mov ebp, dword [eax + 0x14]
add eax, 4
mov dword [esp + 0x30], 0
cmp dword [eax + 0xc], ebp
jbe 0x100757b6
call fcn.100d3cfd
mov edi, dword [esi]
mov esi, dword [edi + 0x10]
add edi, 4
cmp esi, dword [edi + 0x10]
jbe 0x100757c8
call fcn.100d3cfd
mov edi, dword [edi]
mov dword [esp + 0x24], esi
mov ebx, esi
cmp esi, ebp
je 0x100757eb
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
lea ebx, [ebx]
cmp dword [ebx], eax
je 0x100757eb
add ebx, 8
cmp ebx, ebp
jne 0x100757e0
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx]
mov ebp, dword [esi + 0x14]
add esi, 4
cmp dword [esi + 0xc], ebp
jbe 0x10075801
call fcn.100d3cfd
mov esi, dword [esi]
test edi, edi
je 0x1007580b
cmp edi, esi
je 0x10075810
call fcn.100d3cfd
cmp ebx, ebp
jne 0x10075827
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x38]
mov ecx, dword [eax]
push edx
add ecx, 4
call fcn.100756a0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.10081d80
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x10077810
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1010a118
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x30]
mov dword [esi + 4], eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x28], 0
mov dword [esi], vtable.std::ctype_wchar_t_.0
call fcn.100702f8
mov edx, dword [eax]
mov dword [esi + 8], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 8]
mov dword [esi + 0x10], edx
mov eax, dword [eax + 0xc]
add esp, 4
mov dword [esi + 0x14], eax
call fcn.1006f93f
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x10079fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1010a310
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x68]
mov eax, dword [ecx + 4]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esi + 0x3c]
lea edx, [eax + esi]
mov eax, dword [edx + 0x80]
sub eax, ebp
mov ebx, eax
mov eax, dword [edx + 0x78]
and eax, 0x1c0
cmp eax, 0x40
sete al
mov dword [esp + 0x14], ebx
test al, al
je 0x1007a085
cmp byte [esi + 0x44], 0
jne 0x1007a068
mov eax, dword [ecx + 4]
lea edx, [esp + 0x2c]
push edx
lea ecx, [eax + esi + 0x68]
call fcn.10002a00
mov ecx, dword [esi + 0x40]
push eax
push ecx
mov ecx, dword [esp + 0x30]
push edi
push ebp
push ecx
mov dword [esp + 0x34], 0
call fcn.10095a30
add esp, 0x14
test al, al
lea ecx, [esp + 0x2c]
sete bl
mov dword [esp + 0x20], 0xffffffff
call fcn.10001a90
test bl, bl
je 0x1007a068
mov byte [esi + 0x44], 1
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 4]
movzx ecx, word [eax + esi + 0x98]
mov edx, dword [esp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.10079f30
jmp 0x1007a0e5
mov eax, dword [ecx + 4]
movzx eax, word [eax + esi + 0x98]
push eax
push ebx
mov ecx, esi
call fcn.10079f30
cmp byte [esi + 0x44], 0
jne 0x1007a0e5
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [eax + esi + 0x68]
call fcn.10002a00
mov ecx, dword [esi + 0x40]
push eax
push ecx
mov ecx, dword [esp + 0x30]
push edi
push ebp
push ecx
mov dword [esp + 0x34], 1
call fcn.10095a30
add esp, 0x14
test al, al
lea ecx, [esp + 0x14]
sete bl
call fcn.10001a90
test bl, bl
je 0x1007a0e5
mov byte [esi + 0x44], 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x10088040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010bb88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001890
mov dword [esi], vtable.boost::log::v2s_mt_nt5::conversion_error.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1008808a
add edi, 0x28
jmp 0x1008808c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x100880a4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::conversion_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::conversion_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x100882e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010bc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10002300
mov dword [esi], vtable.boost::log::v2s_mt_nt5::setup_error.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1008832a
add edi, 0x28
jmp 0x1008832c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x10088344
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::setup_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::setup_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10088380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010bc78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10002300
mov dword [esi], vtable.boost::log::v2s_mt_nt5::limitation_error.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x100883ca
add edi, 0x28
jmp 0x100883cc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x100883e4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::limitation_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::limitation_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x100931a0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x1010e2b6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x1009328b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push esi
call edi
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1009328b
push str.AcquireSRWLockExclusive
push esi
call edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x1009328b
push str.ReleaseSRWLockExclusive
push esi
call edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1009328b
push str.InitializeConditionVariable
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x1009328b
push str.SleepConditionVariableSRW
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1009328b
push str.WakeAllConditionVariable
push esi
call edi
mov esi, eax
test esi, esi
je 0x1009328b
push 0x1c
call fcn.100d42b6
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0
test eax, eax
je 0x100932c0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push esi
push ebx
push ebp
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push ecx
mov ecx, eax
call fcn.10091730
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0x38
call fcn.100d42b6
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 1
test eax, eax
je 0x100932c0
mov ecx, eax
call fcn.10091dd0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x10094c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010e5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10157de0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.100946d0
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.10094a10
cmp dword [esp + 0x24], 0x10
jb 0x10094d2a
mov edx, dword [esp + 0x10]
push edx
call fcn.100d41da
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100d3301
add esp, 0x30
ret 0x1c
Function at 0x10094d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010e5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10157de0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.100947a0
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.10094a10
cmp dword [esp + 0x24], 0x10
jb 0x10094dea
mov edx, dword [esp + 0x10]
push edx
call fcn.100d41da
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100d3301
add esp, 0x30
ret 0x1c

Function at 0x10094e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010e618
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10157de0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.10094870
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.10094ae0
cmp dword [esp + 0x24], 8
jb 0x10094eac
mov ecx, dword [esp + 0x10]
push ecx
call fcn.100d41da
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100d3301
add esp, 0x30
ret 0x1c
Function at 0x10094ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010e648
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10157de0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.10094940
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.10094ae0
cmp dword [esp + 0x24], 8
jb 0x10094f6c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.100d41da
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100d3301
add esp, 0x30
ret 0x1c

Function at 0x100a74b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010f323
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov edx, 7
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ecx
mov word [eax + 4], si
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x30], ecx
mov word [eax + 0x20], dx
mov dword [eax + 0x50], 0xf
mov dword [eax + 0x4c], ecx
mov byte [eax + 0x3c], cl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x100aaa50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1010f7c1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x3c]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [esp + 0x10], 0
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.1003cca0
mov edx, dword [esp + 0x40]
mov eax, edx
mov dword [esp + 0x30], 1
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100aaab5
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.10079c20
mov esi, dword [esp + 0x38]
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.1003cca0
cmp dword [esp + 0x24], 8
jb 0x100aab06
mov eax, dword [esp + 0x10]
push eax
call fcn.100d41da
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x100ab850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010f938
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10002300
mov dword [esi], vtable.std::out_of_range.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x100ab89a
add edi, 0x28
jmp 0x100ab89c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x100ab8b4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::out_of_range_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::out_of_range_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x100ad340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010fdc8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10002300
mov dword [esi], vtable.boost::gregorian::bad_weekday.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x100ad38a
add edi, 0x28
jmp 0x100ad38c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x100ad3a4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_weekday_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_weekday_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x100ad3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010fdf8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10002300
mov dword [esi], vtable.boost::gregorian::bad_day_of_year.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x100ad42a
add edi, 0x28
jmp 0x100ad42c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x100ad444
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x100af890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10110449
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10157de0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x14], ebx
push 0xffffffffffffffff
xor ecx, ecx
mov ebp, 7
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push ebx
mov word [esi + 4], cx
push eax
mov ecx, esi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], esi
call fcn.1003cca0
mov eax, 1
xor edx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
lea ebp, [edi + 0xc]
mov ecx, ebp
mov dword [esp + 0x40], eax
call fcn.100a10e0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x100af920
lea eax, [esp + 0x1c]
mov ecx, dword [ebp + 0x40]
mov edx, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.100a55b0
cmp dword [esp + 0x30], 8
mov byte [esp + 0x40], bl
jb 0x100af949
mov eax, dword [esp + 0x1c]
push eax
call fcn.100d41da
add esp, 4
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 4]
mov eax, dword [edi + 4]
lea ebp, [edi + 8]
lea ecx, [edx + edi + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0x50]
push eax
mov ecx, ebp
call fcn.1007d620
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.100ab5e0
mov edi, dword [edi]
push 0xffffffffffffffff
push ebx
push eax
push edi
mov ecx, esi
mov dword [esp + 0x50], 2
call fcn.100a7a00
cmp dword [esp + 0x30], 8
jb 0x100af99e
mov edx, dword [esp + 0x1c]
push edx
call fcn.100d41da
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc