joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009caf8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call edx
mov dword [esp + 0x38], 0
push 0x100aa190
push ecx
push eax
mov eax, dword [esi + 4]
push eax
call fcn.1002c3a0
add esp, 0xc
push eax
call fcn.1002e9f0
add esp, 8
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x1002a49e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1004ad4f
add esp, 4
mov eax, dword [edi]
xor edx, edx
lea ecx, [esi + 8]
mov word [esp + 0x14], dx
mov edx, dword [eax + 0xc]
push ecx
mov ecx, edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call edx
mov eax, dword [esi + 4]
push 0x100aa198
push eax
call fcn.1002e9f0
add esp, 8
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1002a4f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009caf8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x14]
test eax, eax
jbe 0x1002a543
mov eax, dword [esi + 4]
push 0x100aa180
push ecx
push ecx
push eax
call fcn.1002c3a0
add esp, 0xc
push eax
call fcn.1002e9f0
add esp, 8
mov edi, dword [ebp + 0xc]
mov edx, dword [edi]
mov edx, dword [edx + 4]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call edx
mov dword [esp + 0x38], 0
push 0x100aa190
push ecx
push eax
mov eax, dword [esi + 4]
push eax
call fcn.1002c3a0
add esp, 0xc
push eax
call fcn.1002e9f0
add esp, 8
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x1002a594
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1004ad4f
add esp, 4
mov eax, dword [edi]
xor edx, edx
mov word [esp + 0x14], dx
mov edx, dword [eax + 0xc]
push esi
mov ecx, edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call edx
mov eax, dword [esi + 4]
push 0x100aa198
push eax
call fcn.1002e9f0
add esp, 8
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002e540
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1009c261
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x14], ebx
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
call fcn.10048b90
mov dword [esp + 0x34], 1
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1002e5a0
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.1002e420
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.10048b90
mov dword [esp + 0xc], 1
mov byte [esp + 0x34], bl
cmp dword [esp + 0x28], 8
jb 0x1002e5f5
mov eax, dword [esp + 0x14]
push eax
call fcn.1004ad4f
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], cx
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x1002e620
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100a11ee
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
sub esp, 0x18
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.1002d090
mov dword [esp + 0x54], 0
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x40], esp
push ecx
call fcn.1002dda0
mov byte [esp + 0x6c], 1
push 0
sub esp, 0x74
mov edx, esp
mov dword [esp + 0xbc], esp
push edx
call fcn.1002de20
mov byte [esp + 0xe4], 2
mov dword [esp + 0xe4], 0xffffffff
call fcn.1002cd50
mov dword [esp + 0x3c], 3
xor eax, eax
mov word [esp + 0x1c], ax
mov eax, 0x100a8a50
mov dword [esi], vtable.boost::date_time::time_facet_class_boost::posix_time::ptime__wchar_t__class_std::ostreambuf_iterator_wchar_t__struct_std::char_traits_wchar_t___.0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002e6d0
sub eax, edx
sar eax, 1
push eax
push 0x100a8a50
lea ecx, [esp + 0x20]
call fcn.100470d0
mov byte [esp + 0x3c], 4
lea ecx, [esi + 0x160]
push ecx
mov edi, str._H:_M:_S_F
lea ecx, [esp + 0x1c]
call fcn.1002e540
add esp, 4
mov byte [esp + 0x3c], 6
cmp dword [esp + 0x30], 8
jb 0x1002e724
mov edx, dword [esp + 0x1c]
push edx
call fcn.1004ad4f
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x3c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 4
Function at 0x10034410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10097780
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x30]
mov dword [esi], vtable.std::locale::facet.0
mov dword [esi + 4], eax
mov dword [esp + 0x24], 0
mov dword [esi], vtable.std::ctype_base.0
mov dword [esp + 0x24], 1
lea ecx, [esp + 0xc]
push ecx
mov dword [esi], vtable.std::ctype_char_.0
call fcn.1005ec9a
mov edx, dword [eax]
mov dword [esi + 8], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 8]
mov dword [esi + 0x10], edx
mov eax, dword [eax + 0xc]
add esp, 4
mov dword [esi + 0x14], eax
mov dword [esp + 0x24], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x100347f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1009774b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1005ee35
mov dword [esp + 0x14], 0
push 4
call fcn.1004ad24
mov edi, eax
add esp, 4
test edi, edi
je 0x10034851
call fcn.1005e9a2
mov dword [edi], eax
call fcn.1005e82e
mov ecx, eax
call fcn.10041cc0
jmp 0x10034853
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x10036920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100990f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
mov dword [esp + 0x14], 1
push esi
call fcn.1005e85e
add esp, 4
mov byte [esp + 0x14], 0
cmp dword [esi + 0x30], 0x10
jb 0x10036976
mov eax, dword [esi + 0x1c]
push eax
call fcn.1004ad4f
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x10039c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009aa65
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x20]
push edi
mov ecx, esi
call fcn.1003a110
mov dword [esp + 0x18], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::out_of_range__.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::out_of_range__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::out_of_range__.2.0
test edi, edi
je 0x10039cc2
lea ebx, [edi + 0x28]
jmp 0x10039cc4
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x10039cd5
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x10039ce5
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x1003a200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009a995
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x20]
push edi
mov ecx, esi
call fcn.1003a6b0
mov dword [esp + 0x18], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_weekday__.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_weekday__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_weekday__.2.0
test edi, edi
je 0x1003a262
lea ebx, [edi + 0x28]
jmp 0x1003a264
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x1003a275
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x1003a285
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x1003a870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009a860
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0x1c
xor ebx, ebx
push str.Weekday_is_out_of_range_0..6
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.10047880
mov dword [esp + 0x30], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.10047820
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x1003a8e4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1004ad4f
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esi], vtable.boost::gregorian::bad_weekday.0
mov dword [esp + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x1003ab10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009a905
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x20]
push edi
mov ecx, esi
call fcn.1003afc0
mov dword [esp + 0x18], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_year__.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_year__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_year__.2.0
test edi, edi
je 0x1003ab72
lea ebx, [edi + 0x28]
jmp 0x1003ab74
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x1003ab85
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x1003ab95
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x1003b110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009a860
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0x28
xor ebx, ebx
push str.Day_of_year_value_is_out_of_range_1..366
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.10047880
mov dword [esp + 0x30], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.10047820
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x1003b184
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1004ad4f
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esi], vtable.boost::gregorian::bad_day_of_year.0
mov dword [esp + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x1003ca50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100a00a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x18], ax
mov eax, 0x100a88f8
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1003ca92
sub eax, edx
sar eax, 1
push eax
push 0x100a88f8
lea ecx, [esp + 0x1c]
call fcn.100470d0
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], edx
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, esi
mov dword [esp + 0xc], vtable.Nvidia::Logging::GenericSimpleLoggable_class_boost::posix_time::ptime_.0
call eax
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x1003caff
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1004ad4f
add esp, 4
xor edx, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], dx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
add esp, 0x38
ret 8

Function at 0x1003f360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009bdd4
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
sub esp, 8
mov eax, esp
mov dword [esp + 0xc], esp
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.1003f8f0
mov byte [esp + 0x18], 1
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push esi
mov byte [esp + 0x30], 0
call fcn.1003f1f0
add esp, 0x20
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x28]
push ecx
call fcn.1003fab0
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x10040080
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10097deb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1005ee35
mov dword [esp + 0x18], 0
push 4
call fcn.1004ad24
mov edi, eax
add esp, 4
test edi, edi
je 0x100400e4
call fcn.1005e9a2
mov dword [edi], eax
call fcn.1005e82e
mov ecx, eax
call fcn.10041cc0
jmp 0x100400e6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x100439c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009dab1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100c6270]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0xc], ebx
cmp dword [eax + 0x18], 8
mov dword [esp + 8], esi
jb 0x10043a08
mov ecx, dword [eax + 4]
jmp 0x10043a0b
lea ecx, [eax + 4]
mov eax, dword [eax + 0x14]
xor edx, edx
lea eax, [ecx + eax*2]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], dx
mov dword [esp + 0x38], 1
mov edx, dword [esp + 8]
push edx
push eax
push ecx
lea eax, [esp + 0x1c]
call fcn.10043220
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov ecx, esi
mov word [esi + 4], ax
call fcn.10048b90
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], bl
cmp dword [esp + 0x28], 8
jb 0x10043a7b
mov edx, dword [esp + 0x14]
push edx
call fcn.1004ad4f
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10071821
add esp, 0x34
ret
Function at 0x10043d60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1009bd28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x38], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x48], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x64]
mov ebp, 7
xor eax, eax
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov word [ecx + 4], ax
call fcn.10048b90
mov byte [esp + 0x54], 1
xor eax, eax
mov word [esp + 0x30], ax
mov eax, 0x100a88f8
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10043dd1
sub eax, edx
sar eax, 1
push eax
push 0x100a88f8
lea ecx, [esp + 0x34]
call fcn.100470d0
mov byte [esp + 0x54], 2
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x58], 3
call fcn.10043c80
mov byte [esp + 0x38], bl
cmp dword [esp + 0x28], 8
jb 0x10043e1b
mov edx, dword [esp + 0x14]
push edx
call fcn.1004ad4f
add esp, 4
xor eax, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x58], 8
jb 0x10043e46
mov ecx, dword [esp + 0x44]
push ecx
call fcn.1004ad4f
add esp, 4
xor edx, edx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], dx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x2c
ret 0x1c

Function at 0x10044620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009a703
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100c6270]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.10044ad0
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month__.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month__.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month__.2.0
test edi, edi
je 0x10044685
lea ebx, [edi + 0x28]
jmp 0x10044687
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x10044698
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x100446a8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4