joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19fa246
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword fs:[0x30]
and dword [esp + 0xc], 0
and dword [esp + 4], 0
push ebx
mov eax, dword [eax + 0x50]
push esi
push edi
test eax, eax
jne 0x1a48ee4
mov eax, 0x7ffe0385
test byte [eax], 1
mov ebx, 0x7ffe0384
jne 0x1a48f00
mov esi, dword [ebp + 8]
test esi, esi
je 0x1a48fa2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1a48fa2
mov eax, dword fs:[0x18]
cmp dword [eax + 0xfe0], 0
je 0x19fa312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xfe0]
cmp dword [eax], esi
jne 0x19fa312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xfe0]
cmp dword [eax + 4], edi
jne 0x19fa312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xfe0]
mov esi, dword [eax + 8]
push dword [ebp + 0x14]
mov edx, edi
mov ecx, esi
push dword [ebp + 0x10]
call fcn.019fab80
mov esi, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x1a48f5c
mov eax, 0x7ffe0385
test byte [eax], 1
jne 0x1a48f78
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, esi
and eax, 0xfffffffc
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 2
push 1
push esi
call fcn.019e9a20
test eax, eax
je 0x1a48f2d
cmp edi, eax
jb 0x1a48f37
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.019d7b65
mov ecx, eax
mov dword [esp + 0x1c], ecx
cmp ecx, 0xc000007b
je 0x19fa37a
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x19fa2d7
mov eax, dword [esp + 0x14]
cmp edi, eax
jb 0x1a48f37
add eax, ecx
cmp edi, eax
jb 0x19fa2d7
jmp 0x1a48f37
mov esi, dword [esp + 0x1c]
jmp 0x19fa2e8
cmp dword [eax], 0
je 0x19fa26f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22b
jmp 0x19fa274
call fcn.019f1a00
test eax, eax
je 0x1a48f19
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22a
jmp 0x1a48f1b
mov eax, ebx
movzx edx, byte [eax]
mov ecx, 0x19b1b08
call fcn.01a6b2a0
jmp 0x19fa282
mov esi, 0xc0000089
jmp 0x19fa2e8
lea eax, [esp + 0x18]
mov ecx, esi
push eax
push edi
call fcn.01a6ad23
test eax, eax
je 0x19fa2d7
cmp eax, 0xffffffff
je 0x19fa2d7
mov esi, eax
jmp 0x19fa2d7
cmp dword [eax], 0
je 0x19fa2f9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22b
jmp 0x19fa2fe
call fcn.019f1a00
test eax, eax
je 0x1a48f90
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0x50]
add ebx, 0x22a
movzx edx, byte [ebx]
mov ecx, 0x19b1b18
call fcn.01a6b2a0
jmp 0x19fa307
mov eax, 0xc000000d
jmp 0x19fa309
Function at 0x19fba70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1aafa00
push 0x1a2a000
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1acd344]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x1a49775
mov dword [esi], ecx
mov edx, dword [ebp + 8]
test edx, 0xfffffffc
jne 0x1a49775
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1a49775
cmp eax, 0xffffffff
je 0x1a49775
not dl
and dl, 1
mov ebx, dword [ebp + 0x14]
jne 0x19fbb4d
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov esi, 0x5a4d
cmp word [eax], si
jne 0x19fbb93
mov ecx, dword [eax + 0x3c]
test dl, dl
jne 0x19fbb62
cmp ecx, 0x10000000
jae 0x1a49721
add ecx, eax
mov dword [ebp - 0x20], ecx
cmp ecx, eax
jb 0x1a49731
cmp dword [ecx], 0x4550
jne 0x1a4973b
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0x18]
mov dword [ebp - 4], 0xfffffffe
test eax, eax
js 0x19fbb39
mov dword [esi], ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test ebx, ebx
ja 0x19fbae4
jb 0x19fbb5b
mov edi, dword [ebp + 0x10]
cmp edi, 0x40
jae 0x19fbae7
mov eax, 0xc000007b
jmp 0x19fbb39
xor edx, edx
cmp edx, ebx
jb 0x19fbb6e
ja 0x19fbb86
cmp ecx, edi
jae 0x19fbb86
cmp ecx, 0xffffffe7
jae 0x19fbb86
lea edx, [ecx + 0x18]
xor esi, esi
cmp esi, ebx
jb 0x19fbaff
ja 0x19fbb86
cmp edx, edi
jb 0x19fbaff
mov eax, 0xc000007b
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
jmp 0x19fbb29
mov eax, 0xc000007b
jmp 0x19fbb26
mov eax, 0xc000007b
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
jmp 0x19fbb29
mov eax, 0xc000007b
jmp 0x19fbb26
mov eax, 0xc000007b
jmp 0x19fbb26
mov eax, 0xc000000d
jmp 0x19fbb39
Function at 0x19fbea0
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
test dword [edi + 0x14], 0x4000000
jne 0x19fc011
xor edx, edx
cmp word [0x7ffe036a], 1
mov dword [ebp - 8], edx
mov byte [ebp - 3], dl
jbe 0x19fbee3
mov edx, dword [edi + 0x14]
mov eax, edx
and edx, 0xffffff
and eax, 0x2000000
mov dword [ebp - 8], edx
setne byte [ebp - 3]
xor bl, bl
mov byte [ebp - 1], bl
mov al, 1
lea ebx, [ebx]
test al, al
je 0x19fbf21
xor eax, eax
mov ecx, edx
test bl, bl
setne al
lea eax, [eax*2 + 1]
mov dword [ebp - 0xc], eax
test edx, edx
je 0x19fbf21
lea esi, [edi + 4]
mov edi, edi
mov ebx, dword [esi]
test bl, 1
jne 0x19fbf90
pause
sub ecx, 1
jne 0x19fbf10
mov bl, byte [ebp - 1]
mov edx, dword [edi + 4]
lea esi, [edi + 4]
xor al, al
mov byte [ebp - 2], al
test bl, bl
je 0x19fbff8
test dl, 2
jne 0x19fbf6a
test dl, 1
jne 0x1a49801
lea ebx, [edx - 2]
cmp ebx, edx
je 0x19fbf67
test al, al
mov ecx, ebx
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x19fc03f
cmp byte [ebp - 2], 0
jne 0x19fbf9e
mov byte [ebp - 1], 1
mov edx, ebx
mov bl, byte [ebp - 1]
mov ecx, edi
call fcn.019dc97e
cmp byte [ebp - 3], 0
mov edx, dword [ebp - 8]
je 0x19fbee8
cmp edx, 0x64
jbe 0x19fbee8
dec edx
mov dword [ebp - 8], edx
jmp 0x19fbee8
mov edx, eax
mov eax, ebx
xor edx, ebx
lock cmpxchg dword [esi], edx
cmp eax, ebx
jne 0x19fbfeb
cmp byte [ebp - 3], 0
je 0x19fbfcf
mov eax, dword [ebp - 8]
cmp eax, 0x7d0
jb 0x19fbff5
mov ecx, dword [edi + 0x14]
xor ecx, eax
mov eax, dword fs:[0x30]
and ecx, 0xffffff
xor ecx, dword [edi + 0x14]
cmp dword [eax + 0x64], 1
je 0x1a49810
mov dword [edi + 0x14], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, eax
mov eax, dword [ebp - 0xc]
jmp 0x19fbf12
inc eax
jmp 0x19fbfae
test dl, 1
jne 0x19fc030
lea ebx, [edx - 4]
test bl, 2
jne 0x19fbf45
sub ebx, 2
jmp 0x19fbf45
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x19fbeba
cmp dword [eax + 8], 0
jne 0x19fbeba
call fcn.01a1b39d
jmp 0x19fbeba
mov ebx, edx
mov al, 1
xor ebx, 1
mov byte [ebp - 2], al
jmp 0x19fbf45
mov edx, dword [ebp - 8]
xor al, al
mov bl, byte [ebp - 1]
jmp 0x19fbef0
mov ebx, edx
mov al, 1
xor ebx, 3
mov byte [ebp - 2], al
jmp 0x19fbf45
and ecx, 0xff000000
jmp 0x19fbfcc
Function at 0x19fc2c0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x19fc39f
cmp byte [esi + 0xdd], 0
jne 0x19fc39f
xor edi, edi
mov ecx, esi
inc edi
mov edx, edi
call fcn.019fd879
test eax, eax
je 0x19fc39f
cmp dword [esi + 4], 0x19b1100
jne 0x19fc39f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19fc39f
push ebx
mov ebx, 0x10000
lea edx, [esi + 0x68]
mov eax, dword [edx]
mov ecx, eax
or ecx, ebx
lock cmpxchg dword [edx], ecx
jne 0x19fc329
test ebx, eax
pop ebx
jne 0x19fc3ae
test eax, 0x30000
jne 0x19fc38d
mov eax, dword [ebp + 4]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x90]
push eax
call fcn.019f6460
inc byte [esi + 0xdf]
mov ecx, esi
mov edx, dword [esi + 0x5c]
push 0
add edx, 0x40
call fcn.019fc73a
test al, al
jne 0x19fc3b5
mov eax, edi
neg eax
lock xadd dword [esi], eax
cmp eax, edi
jne 0x19fc38d
mov eax, dword [esi + 4]
push esi
mov edi, dword [eax]
cmp edi, fcn.019ecd80
jne 0x1a4982b
call fcn.019ed980
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19fc38d
call fcn.01aa5c15
jmp 0x19fc38d
push 2
pop edi
jmp 0x19fc36a
mov ecx, edi
call dword [0x1ac91d0]
call edi
jmp 0x19fc38d

Function at 0x19fc3c0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x19fc47f
cmp byte [edi + 0xdd], 0
jne 0x19fc47f
xor edx, edx
mov ecx, edi
call fcn.019fd879
test eax, eax
je 0x19fc47f
cmp dword [edi + 4], 0x19b1100
jne 0x19fc47f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], dl
jne 0x19fc47f
push ebx
xor ebx, ebx
mov byte [ebp - 5], bl
cmp dword [ebp + 0xc], edx
je 0x19fc454
lea esi, [edi + 0x90]
push esi
call fcn.019f6460
inc byte [edi + 0xdf]
mov ecx, edi
mov edx, dword [edi + 0x5c]
push 1
add edx, 0x40
call fcn.019fc73a
mov ecx, dword [edi + 0x20]
mov bl, al
test ecx, ecx
jne 0x19fc4a3
dec byte [edi + 0xdf]
push esi
call fcn.019f8f20
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.019fd89c
cmp byte [ebp - 5], 0
jne 0x1a4983a
test bl, bl
pop ebx
jne 0x19fc495
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19fc46d
call fcn.01aa5c15
jmp 0x19fc46d
or eax, 0xffffffff
lock xadd dword [edi], eax
jne 0x19fc46d
jmp 0x1a49857
mov byte [ebp - 5], 1
jmp 0x19fc44e
lea esi, [edi + 0x90]
push esi
call fcn.019f6460
dec byte [edi + 0xdf]
push esi
call fcn.019f8f20
jmp 0x19fc468
mov eax, dword [edi + 4]
push edi
mov esi, dword [eax]
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x19fc46d
Function at 0x19fc4b0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
test ebx, ebx
je 0x1a4987f
cmp dword [ebp + 0xc], 0
je 0x1a4987f
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x19fc58b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a4987f
mov eax, dword [0x1ac84bc]
push esi
add eax, 0x100000
push 0xe0
or eax, 8
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
je 0x1a4986c
mov eax, dword [ebp + 4]
mov dword [esi + 0x6c], eax
test edi, edi
jne 0x19fc59d
xor eax, eax
mov edx, dword [ebp + 0x10]
mov ecx, esi
push 0x19b1110
push 0x19b1100
push eax
push edi
call fcn.019fce35
test eax, eax
js 0x19fc582
mov edx, dword [esi + 0x5c]
xor ecx, ecx
inc ecx
lea eax, [edx + 0x108]
lock xadd dword [eax], ecx
lea eax, [ecx + 1]
test ecx, ecx
jle 0x19fc5aa
test eax, eax
jle 0x1a49876
and dword [esi + 0x90], 0
mov byte [esi + 0xdd], 0
test edi, edi
jne 0x19fc5a2
cmp dword [esi + 8], 0
jne 0x19fc5c7
xor eax, eax
test eax, eax
js 0x19fc582
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x30], ecx
mov dword [ebx], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test dword [edi + 0x1c], 0xfffffffc
je 0x19fc4d8
jmp 0x1a4987f
mov eax, dword [edi + 0x1c]
jmp 0x19fc523
mov eax, dword [edi + 0x18]
mov dword [esi + 0x10], eax
jmp 0x19fc56e
test eax, eax
jle 0x19fc55c
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 3
push dword [edx + 0x24]
call fcn.01a24280
jmp 0x19fc55c
mov ecx, esi
call fcn.019fc1fb
jmp 0x19fc574
mov eax, 0xc0000017
jmp 0x19fc582
or dword [ebp - 4], 0xffffffff
jmp 0x19fc5b5
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x19fc583
Function at 0x19fc5e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x19fc71a
cmp byte [esi + 0xdd], 0
jne 0x19fc71a
mov eax, dword [esi + 0x68]
test eax, 0x30000
jne 0x19fc71a
cmp dword [esi + 4], 0x19b1100
jne 0x19fc71a
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19fc71a
cmp dword [ebp + 0xc], 0
mov eax, dword [esi + 0x5c]
push ebx
push edi
setne bl
lea edi, [esi + 0x90]
add eax, 0x40
push edi
mov dword [ebp - 0xc], eax
call fcn.019f6460
mov edx, dword [ebp - 0xc]
mov ecx, esi
push ebx
call fcn.019fc73a
cmp dword [ebp + 0xc], 0
mov cl, al
mov byte [ebp - 5], cl
je 0x19fc67a
cmp byte [esi + 0xdf], 0
jne 0x1a4988e
test cl, cl
jne 0x19fc6d2
test bl, bl
je 0x19fc6f2
cmp byte [esi + 0xdd], cl
jne 0x1a4989e
xor edx, edx
mov ecx, esi
call fcn.019fd879
test eax, eax
je 0x1a4989e
cmp dword [esi + 4], 0x19b1100
jne 0x1a4989e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], dl
jne 0x1a4989e
mov eax, dword [esi + 0xc8]
or eax, dword [esi + 0xcc]
jne 0x19fc6e9
lock inc dword [esi]
mov cl, byte [ebp - 5]
test bl, bl
je 0x19fc708
push dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.019fec16
push edi
call fcn.019f8f20
mov cl, byte [ebp - 5]
pop edi
movzx eax, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 0x10
test cl, cl
je 0x19fc6f2
or eax, 0xffffffff
lock xadd dword [esi], eax
jne 0x19fc6f2
jmp 0x1a498a8
cmp dword [ebp + 0xc], 0
jne 0x19fc733
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
je 0x19fc733
xor eax, eax
jmp 0x19fc6f7
call fcn.01aa5c15
jmp 0x19fc72f
push edi
call fcn.019f8f20
mov cl, byte [ebp - 5]
xor bl, bl
jmp 0x19fc67a
call fcn.01aa5c15
jmp 0x19fc6cc
mov eax, dword [esi + 4]
push esi
mov esi, dword [eax]
mov ecx, esi
call dword [0x1ac91d0]
call esi
jmp 0x19fc6ef
Function at 0x19fc990
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
xor edi, edi
inc edi
mov edx, edi
call fcn.019fd879
test eax, eax
je 0x1a499c6
cmp dword [esi + 4], 0x19b1120
jne 0x1a499c6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a499c6
mov ebx, 0x10000
lea edx, [esi + 0x68]
mov eax, dword [edx]
mov ecx, eax
or ecx, ebx
lock cmpxchg dword [edx], ecx
jne 0x19fc9e5
test ebx, eax
jne 0x1a499d9
test eax, 0x30000
jne 0x19fca65
mov eax, dword [ebp + 4]
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x5c]
add eax, 0x40
mov dword [ebp - 8], eax
lea eax, [esi + 0x90]
push eax
call fcn.019f6460
xor ebx, ebx
cmp dword [esi + 0xe0], ebx
jne 0x1a4992d
and byte [esi + 0x124], 0xfc
lea eax, [esi + 0x90]
inc byte [esi + 0xdf]
push eax
call fcn.019f8f20
sub edi, ebx
mov eax, edi
neg eax
lock xadd dword [esi], eax
cmp eax, edi
jne 0x19fca65
mov eax, dword [esi + 4]
push esi
mov edi, dword [eax]
cmp edi, 0x19ece70
jne 0x1a499b7
call fcn.019eda70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
push edi
push dword [esi + 0xe4]
call fcn.01a23270
test eax, eax
je 0x1a49976
cmp eax, 0x103
je 0x1a49950
cmp eax, 0xc0000120
je 0x1a49950
call fcn.01aa5c15
mov al, byte [esi + 0x124]
test al, 4
jne 0x19fca27
or al, 4
lea ecx, [esi + 0x20]
push ebx
mov edx, edi
mov byte [esi + 0x124], al
call fcn.01a0bac0
jmp 0x19fca27
mov edx, dword [ebp - 8]
mov ecx, esi
mov dword [esi + 0xe0], ebx
or ebx, 0xffffffff
push edi
call fcn.019fc73a
test al, al
je 0x1a49991
push 0xfffffffffffffffe
pop ebx
test byte [esi + 0x124], 4
je 0x19fca27
push 0
lea ecx, [esi + 0x20]
or edx, 0xffffffff
call fcn.01a0bac0
and byte [esi + 0x124], 0xfb
jmp 0x19fca27
mov ecx, edi
call dword [0x1ac91d0]
call edi
jmp 0x19fca65
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19fca65
call fcn.01aa5c15
jmp 0x19fca65
Function at 0x19fca80
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push edi
je 0x1a49a36
cmp dword [ebp + 0xc], 0
je 0x1a49a36
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x19fcaaf
test dword [edi + 0x1c], 0xfffffffc
jne 0x1a49a36
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a49a36
mov eax, dword [0x1ac84bc]
push ebx
push esi
add eax, 0x1c0000
push 0x128
or eax, 8
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
je 0x1a499e3
mov eax, dword [ebp + 4]
push 0
mov dword [esi + 0x6c], eax
lea eax, [esi + 0xe4]
push 1
push eax
call fcn.01a23570
mov ebx, eax
test ebx, ebx
js 0x1a49a05
test edi, edi
je 0x19fcbfa
mov eax, dword [edi + 0x1c]
mov edx, dword [ebp + 0x10]
mov ecx, esi
push 0x19b1130
push 0x19b1120
push eax
push edi
call fcn.019fce35
mov ebx, eax
test ebx, ebx
js 0x1a49a05
mov edx, dword [esi + 0x5c]
xor ebx, ebx
inc ebx
mov ecx, ebx
lea eax, [edx + 0x108]
lock xadd dword [eax], ecx
lea eax, [ecx + 1]
test ecx, ecx
jle 0x19fcc01
test eax, eax
jle 0x1a499ed
and dword [esi + 0x90], 0
mov byte [esi + 0xdd], bl
test edi, edi
je 0x19fcb76
mov eax, dword [edi + 0x18]
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
je 0x19fcb83
mov ecx, esi
call fcn.019fc1fb
xor ebx, ebx
test ebx, ebx
js 0x1a49a05
mov ecx, dword [esi + 0x5c]
lea edi, [esi + 0x120]
mov dword [esi + 0x118], 0x19e9a80
test ecx, ecx
je 0x1a499f6
lea edx, [esi + 0x11c]
push edi
call fcn.019fd76a
and dword [esi + 0x10c], 0
lea eax, [esi + 0x110]
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [esi + 0x11c]
mov dword [esi + 0xfc], eax
mov al, byte [edi]
mov byte [esi + 0x100], al
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xf8], 0x19b1118
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0x19fcb1a
test eax, eax
jle 0x19fcb5f
mov dword [ebp - 4], ebx
push 4
lea eax, [ebp - 4]
push eax
push 3
push dword [edx + 0x24]
call fcn.01a24280
jmp 0x19fcb5f
mov ebx, 0xc0000017
jmp 0x19fcbef
or dword [ebp - 4], 0xffffffff
jmp 0x19fcc0c
and dword [esi + 0x11c], 0
mov byte [edi], 0
jmp 0x19fcbb4
lea eax, [esi + 0xe4]
cmp dword [eax], 0
je 0x1a49a17
push dword [eax]
call fcn.01a22a30
mov eax, dword [0x1ac84bc]
push esi
add eax, 0x1c0000
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f1440
jmp 0x19fcbef
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x19fcbf3
Function at 0x19fcd06
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
test eax, 0x10000
jne 0x1a49a84
test eax, 0x20000
jne 0x1a49a5b
cmp dword [esi + 4], 0x19b1120
jne 0x1a49a84
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a49a84
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
test edx, edx
je 0x1a49a84
mov eax, dword fs:[0x18]
xor ecx, ecx
mov eax, dword [eax + 0xf90]
test eax, eax
je 0x1a49a7c
mov eax, dword [eax]
cmp dword [eax + 0x88], esi
sete cl
test ecx, ecx
jne 0x19fcd27
cmp dword [ebp + 8], 0
jne 0x1a49a99
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a49a9e
call fcn.01aa5c15
xor eax, eax
jmp 0x19fcd4a

Function at 0x19fd5d8
Capabilities:
Access peb ldr_data

Disassembly:
push 0x1c
push 0x1aafb00
call fcn.01a3611c
mov ebx, edx
mov dword [ebp - 0x2c], ebx
mov edi, ecx
mov dword [ebp - 0x24], edi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1a4a06e
test edi, edi
je 0x1a4a06e
test ebx, ebx
je 0x1a4a06e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a4a06e
cmp dword [edi], 0
je 0x19fd65c
mov byte [ebp - 0x19], 0
push ebx
call fcn.01a0a690
and dword [ebp - 4], 0
mov eax, dword [edi]
test eax, eax
je 0x19fd640
lock inc dword [eax]
mov eax, dword [edi]
mov dword [esi], eax
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.019fd741
cmp byte [ebp - 0x19], 0
je 0x19fd65c
xor eax, eax
call fcn.01a36161
ret 4
and dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.019e16e0
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
js 0x19fd714
push ebx
call fcn.019f6460
mov dword [ebp - 4], 1
mov eax, dword [edi]
test eax, eax
jne 0x19fd75d
cmp edi, 0x1ac86e4
jne 0x19fd71b
mov eax, dword [0x1ac877c]
test eax, eax
jne 0x1a4a044
mov eax, dword [0x7ffe03c0]
shl eax, 3
mov ecx, 0x300
cmp eax, ecx
jae 0x19fd6bb
mov eax, ecx
push eax
push dword [ebp - 0x20]
call fcn.019e1620
mov eax, dword [0x7ffe03c0]
shl eax, 2
mov ecx, 0x180
cmp eax, ecx
jae 0x19fd6d7
mov eax, ecx
push eax
push dword [ebp - 0x20]
call fcn.01a1a800
mov eax, dword [0x1ac8778]
test eax, eax
jne 0x1a4a052
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
and dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xfffffffe
call fcn.019fd756
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x19fd762
test esi, esi
js 0x19fd714
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, esi
jmp 0x19fd654
cmp edi, 0x1ac86dc
jne 0x19fd6ed
push 1
mov esi, dword [ebp - 0x20]
push esi
call fcn.019e1620
push 1
push esi
call fcn.01a1b440
mov esi, eax
test esi, esi
mov dword [ebp - 0x28], esi
jns 0x19fd6ed
jmp 0x19fd6f6
lock inc dword [eax]
jmp 0x19fd6f6
push eax
call fcn.019d6250
jmp 0x19fd709
push eax
push dword [ebp - 0x20]
call fcn.019e1620
jmp 0x19fd6e0
push eax
push dword [ebp - 0x20]
call fcn.01a1c400
jmp 0x19fd736
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x19fd654
Function at 0x19ff309
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x1a4a794
call fcn.019fd879
test eax, eax
je 0x1a4a794
cmp dword [esi + 4], 0x19b1138
jne 0x1a4a794
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a4a794
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], 0
jne 0x1a4a7a9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a4a7ae
call fcn.01aa5c15
xor eax, eax
jmp 0x19ff349

Function at 0x19ff550
Capabilities:
Access peb ldr_data

Disassembly:
push 0x18
push 0x1aafba8
call fcn.01a3611c
mov dword [ebp - 0x1c], 0xc0000001
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x19ff642
xor edi, edi
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1a4a80e
cmp dword [ebp + 0xc], 0
je 0x1a4a80e
test edi, 0xfffffffc
jne 0x1a4a80e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1a4a80e
and dword [ecx], 0
mov eax, dword [0x1ac84bc]
add eax, 0x200000
push 0x90
or eax, 8
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
mov dword [ebp - 0x24], 1
test esi, esi
je 0x1a4a7ca
mov eax, dword [ebp + 4]
mov esi, dword [ebp - 0x20]
mov dword [esi + 0x6c], eax
push 0x19b1158
push 0x19b1148
push edi
push ebx
mov edx, dword [ebp + 0x10]
mov ecx, esi
call fcn.019fce35
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
js 0x19ff61c
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
xor edi, edi
mov dword [ebp - 0x1c], edi
test ebx, ebx
jne 0x19ff64a
cmp dword [esi + 8], edi
jne 0x19ff652
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x24], 0
call fcn.019ff65b
test edi, edi
js 0x19ff638
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, edi
call fcn.01a36161
ret 0x10
mov edi, dword [ebx + 0x1c]
jmp 0x19ff570
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x10], eax
jmp 0x19ff617
mov ecx, esi
call fcn.019fc1fb
jmp 0x19ff61c
mov edi, 0xc0000017
mov dword [ebp - 0x1c], edi
jmp 0x19ff61c
call fcn.01aa5c15
mov eax, 0xc000000d
jmp 0x19ff63a

Function at 0x19ff680
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x19ff6b9
mov eax, dword [ecx + 0x68]
test eax, 0x30000
jne 0x19ff6b9
cmp dword [ecx + 4], 0x19b1148
jne 0x19ff6b9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x19ff6b9
call fcn.019ff6c0
pop ecx
pop ebp
ret 4
call fcn.01aa5c15
jmp 0x19ff6b4