joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102f6f50
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1034e478
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.102f6de0
mov dword [esp + 0x30], 0
cmp dword [esp + 0x1c], 0
je 0x102f6ffb
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
push 0
cmovae eax, dword [esp + 0x10]
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x102f6ffb
test esi, esi
je 0x102f6ffb
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 8
lea eax, [esp + 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x102f7017
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1033d458
add esp, 0x2c
ret 8

Function at 0x102f7050
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1035ca78
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x10], xmm0
call fcn.102f6de0
mov dword [esp + 0x40], 0
cmp dword [esp + 0x2c], 0
je 0x102f7112
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
push 0
cmovae eax, dword [esp + 0x20]
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x102f7112
test esi, esi
je 0x102f7112
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 8
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x102f710b
xorps xmm0, xmm0
movlpd qword [esp + 0xc], xmm0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x102f7136
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov word [esp + 0x1c], ax
mov edx, edi
mov dword [esp + 0x2c], 0
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1033d458
add esp, 0x38
ret
Function at 0x102fb8e0
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1035d3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x102fb936
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x102fbabb
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x100000
mov eax, dword [esp + 0x54]
push 0
mov ebx, eax
mov dword [esp + 0x34], 0
cmp eax, 0x100000
lea eax, [esp + 0x34]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x102fba80
test eax, eax
je 0x102fba80
mov ecx, dword [esp + 0x30]
jmp 0x102fb9a0
cmp ecx, ebx
jae 0x102fba84
call ebp
mov ecx, dword [edi]
mov dword [esp + 0x18], eax
cmp ecx, 0xffffffff
je 0x102fb9e3
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x102fb9d6
call ebp
test eax, eax
jne 0x102fb9e3
mov eax, dword [esp + 0x38]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x102fb9f4
xorps xmm0, xmm0
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push dword [esp + 0x1c]
push eax
push ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.100cd9d0
mov dword [esp + 0x70], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0x70], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x102fba80
push eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
add ecx, dword [esp + 0x34]
and eax, 0x7fffbffb
mov dword [esp + 0x30], ecx
add eax, 0x80004005
jne 0x102fb9a0
jmp 0x102fba84
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
add dword [edx], ecx
test eax, eax
jne 0x102fbab1
test ecx, ecx
je 0x102fbaad
mov eax, dword [esp + 0x54]
add esi, ecx
sub eax, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x54], eax
mov ecx, 0x100000
jne 0x102fb954
mov al, 1
jmp 0x102fbabd
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x102fbabb
mov dword [ecx], eax
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1033d458
add esp, 0x38
ret 0x10
Function at 0x102fbae0
Capabilities:
Clear file content

Disassembly:
push 0xffffffffffffffff
push 0x1035d3e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x2c], xmm0
xor bl, bl
call fcn.1017b880
mov ebp, dword [esp + 0x44]
test al, al
lea eax, [esp + 0x24]
movzx ecx, bl
mov ebx, dword [esp + 0x48]
mov edx, 1
push eax
push 0
cmovne ecx, edx
xorps xmm0, xmm0
push ebx
mov dword [esp + 0x24], ecx
mov ecx, edi
push ebp
movlpd qword [esp + 0x34], xmm0
call fcn.1017b880
test al, al
je 0x102fbc7c
cmp dword [esp + 0x24], ebp
jne 0x102fbc7c
cmp dword [esp + 0x28], ebx
jne 0x102fbc7c
mov ebp, dword [esp + 0x4c]
mov eax, dword [edi]
test ebp, ebp
jne 0x102fbbb1
cmp eax, 0xffffffff
jne 0x102fbb94
xor al, al
xor ecx, ecx
test al, al
mov esi, 0x80004005
cmovne esi, ecx
jmp 0x102fbc52
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
mov esi, 0x80004005
setne al
xor ecx, ecx
test al, al
cmovne esi, ecx
jmp 0x102fbc52
mov ebx, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 0xffffffff
jne 0x102fbbc0
xor al, al
jmp 0x102fbbc8
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
je 0x102fbc52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
push dword [esp + 0x50]
xor eax, eax
push dword [esp + 0x50]
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x74], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.100cd9d0
mov dword [esp + 0x64], 0
mov eax, dword [ebp]
mov dword [esp + 0x64], 0xffffffff
mov ecx, ebp
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jne 0x102fbc52
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x102fbc3a
xor al, al
jmp 0x102fbc42
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
jne 0x102fbbd8
cmp byte [esp + 0x18], 0
je 0x102fbc78
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.1017b880
mov eax, esi
jmp 0x102fbca7
cmp byte [esp + 0x18], 0
je 0x102fbca2
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.1017b880
mov eax, 0x80004005
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x102fbcc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
lea esp, [esp]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x105e7e00], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x105e7f00], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x105e8000], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x105e7d00], al
inc esi
cmp esi, 0x100
jl 0x102fbdd0
pop esi
add esp, 0x80
ret
Function at 0x102fede0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1035d7b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ebx, [esi + 0xc]
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x102fee35
mov eax, dword [ebx]
test eax, eax
je 0x102fee35
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
push esi
lea ecx, [esp + 0x20]
movq qword [esp + 0x20], xmm0
mov dword [esp + 0x28], 0
call fcn.102ffd90
mov byte [esp + 0x38], 1
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x102fee76
mov eax, dword [ebx]
test eax, eax
je 0x102fee70
push eax
call esi
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x1c]
mov edi, eax
cmp eax, dword [esp + 0x20]
je 0x102fef54
mov ebx, dword [esp + 0x10]
lea ebx, [ebx]
lea esi, [ebx + 0xc]
mov dword [esp + 0x18], esi
test esi, esi
je 0x102feea8
mov eax, dword [esi]
test eax, eax
je 0x102feea8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x102fef1b
mov edx, dword [eax]
mov dword [esp + 0x10], edx
test edx, edx
je 0x102feec4
cmp edx, dword [edi]
je 0x102feecd
add eax, 0x18
cmp eax, ecx
jne 0x102feeb6
jmp 0x102fef1b
push eax
call fcn.102ff3d0
test al, al
je 0x102feefb
test esi, esi
je 0x102feeee
mov eax, dword [esi]
test eax, eax
je 0x102feee8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov dword [esp + 0x18], esi
push dword [esp + 0x10]
mov ecx, ebx
call fcn.102ff810
jmp 0x102fef1b
test esi, esi
je 0x102fef12
mov eax, dword [esi]
test eax, eax
je 0x102fef0c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x10]
call fcn.102f6060
mov byte [esp + 0x38], 1
test esi, esi
je 0x102fef39
mov eax, dword [esi]
test eax, eax
je 0x102fef31
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x18], 0
add edi, 0x18
cmp edi, dword [esp + 0x20]
jne 0x102fee90
mov ebx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x38], 0
test eax, eax
je 0x102fef7f
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], 0xffffffff
test ebx, ebx
je 0x102fef9c
mov eax, dword [ebx]
test eax, eax
je 0x102fef94
push eax
call esi
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1033d458
mov esp, ebp
pop ebp
ret
Function at 0x102ff1e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1035d7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
lea ebx, [edi + 0xc]
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x102ff235
mov eax, dword [ebx]
test eax, eax
je 0x102ff235
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 1
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x102ff29a
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x14]
lea esp, [esp]
cmp edi, dword [esi]
jne 0x102ff292
push esi
lea ecx, [esp + 0x1c]
call fcn.102ffe50
mov eax, dword [esp + 0x14]
add esi, 0x18
cmp esi, dword [eax + 4]
jne 0x102ff280
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x102ff2b3
mov eax, dword [ebx]
test eax, eax
je 0x102ff2ad
push eax
call esi
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x18]
mov edi, eax
cmp eax, dword [esp + 0x1c]
je 0x102ff362
mov ebx, dword [esp + 0x14]
lea esi, [ebx + 0xc]
mov dword [esp + 0x14], esi
test esi, esi
je 0x102ff2df
mov eax, dword [esi]
test eax, eax
je 0x102ff2df
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x102ff329
lea ecx, [ecx]
mov edx, dword [eax]
mov dword [esp + 0x10], edx
test edx, edx
je 0x102ff2fe
cmp edx, dword [edi]
je 0x102ff307
add eax, 0x18
cmp eax, ecx
jne 0x102ff2f0
jmp 0x102ff329
test esi, esi
je 0x102ff322
mov eax, dword [esi]
test eax, eax
je 0x102ff31c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0x14], esi
mov ecx, edx
call fcn.102f6060
mov byte [esp + 0x38], 1
test esi, esi
je 0x102ff347
mov eax, dword [esi]
test eax, eax
je 0x102ff33f
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], 0
add edi, 0x18
cmp edi, dword [esp + 0x1c]
jne 0x102ff2c7
mov ebx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x38], 0
test eax, eax
je 0x102ff38d
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
test ebx, ebx
je 0x102ff3aa
mov eax, dword [ebx]
test eax, eax
je 0x102ff3a2
push eax
call esi
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1033d458
mov esp, ebp
pop ebp
ret 4
Function at 0x102ff550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10351d59
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.100cd9d0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.100cd9d0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.100cd9d0
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.100cd9d0
mov byte [esp + 0x18], 3
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x103015f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035dbbb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
xchg dword [esi], eax
lea ecx, [esi + 4]
call fcn.10154e30
mov dword [esp + 0x18], 0
lea ecx, [esi + 0x20]
call fcn.102f7d60
mov byte [esp + 0x18], 1
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov byte [esp + 0x18], 2
lea eax, [esi + 0xa4]
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov dword [esp + 0xc], eax
mov word [eax], cx
mov byte [esp + 0x18], 3
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov byte [esp + 0x18], 4
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [esp + 0x18], 5
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov byte [esp + 0x18], 7
lea edx, [esi + 0xe0]
mov dword [edx], ecx
xchg dword [edx], ecx
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x10301710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035dc09
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 2
lea ecx, [esi + 0x30]
call fcn.10301eb0
mov byte [esp + 0x18], 1
mov ecx, dword [esi + 0x24]
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
test ecx, ecx
je 0x10301785
push dword [esp + 0xc]
mov edx, dword [esi + 0x28]
push ecx
call fcn.10155a50
push dword [esi + 0x24]
call edi
add esp, 0xc
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esp + 0x18], 0
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x103017bb
push dword [esp + 0xc]
mov edx, dword [esi + 0x1c]
push ecx
call fcn.10155a50
push dword [esi + 0x18]
call edi
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esp + 0x18], 0xffffffff
cmp dword [esi + 0x14], 8
jb 0x103017d0
push dword [esi]
call edi
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x10306ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035e638
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], 0
sub ecx, edi
mov eax, 0xdd67c8a7
imul ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], 0
add edx, ecx
mov dword [esp + 0x14], 0
sar edx, 7
mov esi, edx
mov dword [esp + 0x18], 0
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov ecx, edi
push dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push esi
call fcn.10307290
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10306fd1
cmp esi, dword [esp + 0x18]
je 0x10306fc7
mov edi, edi
mov ecx, esi
call fcn.10307b00
add esi, 0x94
cmp esi, dword [esp + 0x18]
jne 0x10306fb0
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1033d458
add esp, 0x28
ret

Function at 0x10309310
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1035e71f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.100cd9d0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.100cd9d0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.100cd9d0
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.100cd9d0
mov byte [esp + 0x18], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x64]
push eax
call fcn.100cd9d0
mov byte [esp + 0x18], 4
lea ecx, [edi + 0x7c]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x7c]
push eax
call fcn.100cd9d0
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4