joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006fe90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035a678
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.1006ff30
mov dword [esp + 0x18], 0
test edi, edi
je 0x1006fed4
add edi, 0x30
jmp 0x1006fed6
xor edi, edi
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x1006feee
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x40], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data_.1.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10070d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103586b9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x4c]
push eax
sub esp, 0xc
mov ecx, esp
lea edx, [esp + 0x50]
mov dword [esp + 0x5c], esp
push edx
push ecx
call fcn.100075d0
push ecx
mov eax, esp
lea ecx, [esp + 0x50]
mov dword [esp + 0x2c], esp
push ecx
push eax
mov byte [esp + 0x4c], 3
call fcn.100075d0
lea edx, [esp + 0x38]
add esp, 8
push edx
mov byte [esp + 0x48], 2
call fcn.100c9ea0
add esp, 0x20
mov edi, eax
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 4
call fcn.10001120
mov eax, dword [edi + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x28], 2
call fcn.100011a0
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10001120
mov edx, dword [esp + 0x3c]
mov dword [esi + 8], edx
mov eax, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], al
call fcn.100011a0
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], 0
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x10071b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035c494
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 0x44], 0x1042bf18
mov dword [esi + 0x4c], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x14], 0
push edi
mov ecx, esi
mov dword [esp + 0xc], 1
call fcn.1006fcb0
mov dword [esp + 0x14], 1
mov eax, dword [esi + 0x44]
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_path__.0
mov dword [esi + 0x30], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_path__.1.0
mov edx, dword [eax + 4]
lea ecx, [esi + 0x30]
mov dword [edx + esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_path__.2.0
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 4]
lea edx, [eax - 8]
mov dword [eax + esi + 0x40], edx
test edi, edi
je 0x10071bc0
lea eax, [edi + 0x30]
jmp 0x10071bc2
xor eax, eax
push eax
push ecx
call fcn.1000a630
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x10071bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035c454
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 0x44], 0x1042bf18
mov dword [esi + 0x4c], vtable.boost::exception_detail::clone_base.0
mov dword [esp + 0x14], 0
push edi
mov ecx, esi
mov dword [esp + 0xc], 1
call fcn.1006fe90
mov dword [esp + 0x14], 1
mov eax, dword [esi + 0x44]
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data__.0
mov dword [esi + 0x30], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data__.1.0
mov edx, dword [eax + 4]
lea ecx, [esi + 0x30]
mov dword [edx + esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::property_tree::ptree_bad_data__.2.0
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 4]
lea edx, [eax - 8]
mov dword [eax + esi + 0x40], edx
test edi, edi
je 0x10071c80
lea eax, [edi + 0x30]
jmp 0x10071c82
xor eax, eax
push eax
push ecx
call fcn.1000a630
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10076dc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1035eef8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10480b90]
xor eax, esp
mov dword [esp + 0x2c], eax
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
push str.dram
lea ecx, [esp + 0x18]
call fcn.10003660
push ecx
mov ecx, esp
mov dword [esp + 0x44], 0
mov dword [ecx], 0
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push esi
call fcn.101057e0
mov esi, dword [esp + 0xc]
add esi, 0x2c
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 0x10
jb 0x10076e42
mov edx, dword [esp + 0x1c]
push edx
call fcn.1026bc50
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.100012e0
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1026af30
add esp, 0x3c
ret

Function at 0x10076e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1035fbd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x14]
mov dword [esp + 0x40], ebx
call fcn.1006b6a0
add esp, 8
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x10076ef4
mov edx, dword [esp + 0x14]
push edx
call fcn.1026bc50
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
call fcn.100012e0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100771e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10358888
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x30
call fcn.1026c830
mov edi, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], 0
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
lea esi, [edi + 0xc]
call fcn.10105a60
add esp, 8
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 8
Function at 0x100773b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10358858
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x10], 0
call fcn.10003700
mov dword [esp + 0xc], 0xffffffff
cmp dword [esp + 0x30], 0x10
jb 0x10077400
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1026bc50
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.100012e0
mov eax, esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0x20
Function at 0x100b4630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10357570
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.100b4600
push 1
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 0
call fcn.100b50b0
mov ecx, eax
mov byte [esp + 0x28], 1
call fcn.100b5160
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x28], 0
call fcn.100011a0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x100b50b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1035ccf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.10001120
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
neg ecx
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 1
call fcn.100b5c10
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], bl
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 8

Function at 0x100b56c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1035ccf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.10001120
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 1
call fcn.100b5c10
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], bl
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x100b6850
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1035eea3
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4

Function at 0x100b6c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103586b9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x4c]
push eax
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov dword [esp + 0x5c], esp
call fcn.100b7640
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov byte [esp + 0x44], 3
mov dword [esp + 0x2c], esp
call fcn.100b7640
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x48], 2
call fcn.100b7660
add esp, 0x20
mov edi, eax
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 4
call fcn.10001120
mov edx, dword [edi + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], edx
mov byte [esp + 0x28], 2
call fcn.100011a0
lea eax, [esp + 0x34]
push eax
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10001120
mov ecx, dword [esp + 0x3c]
mov dword [esi + 8], ecx
mov eax, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], al
call fcn.100011a0
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], 0
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x100c3b60
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x104964e5], 0
jne 0x100c3c1a
push ebx
push esi
push edi
xor bl, bl
xor eax, eax
mov cl, 0x80
test bl, cl
je 0x100c3b7f
xor eax, 0x80000000
test eax, eax
jns 0x100c3b8c
add eax, eax
xor eax, 0x4c11db7
jmp 0x100c3b8e
add eax, eax
shr cl, 1
jne 0x100c3b76
mov edx, eax
xor esi, esi
xor eax, eax
test dl, 1
je 0x100c3bad
mov ecx, 0x1f
sub ecx, eax
mov edi, 1
shl edi, cl
or esi, edi
inc eax
shr edx, 1
cmp eax, 0x20
jb 0x100c3b98
xor cl, cl
test bl, 1
je 0x100c3bbe
mov cl, 0x80
mov al, bl
shr al, 1
test al, 1
je 0x100c3bc9
or cl, 0x40
shr al, 1
test al, 1
je 0x100c3bd2
or cl, 0x20
shr al, 1
test al, 1
je 0x100c3bdb
or cl, 0x10
shr al, 1
test al, 1
je 0x100c3be4
or cl, 8
shr al, 1
test al, 1
je 0x100c3bed
or cl, 4
shr al, 1
test al, 1
je 0x100c3bf6
or cl, 2
test al, 2
je 0x100c3bfd
or cl, 1
add bl, 1
movzx eax, cl
mov dword [eax*4 + 0x104964e8], esi
jne 0x100c3b72
pop edi
pop esi
mov byte [0x104964e5], 1
pop ebx
ret
Function at 0x100c7870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035ccf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
lea esi, [esp + 0x10]
call fcn.10180030
mov esi, eax
mov dword [esp + 0x24], 1
push esi
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.10001120
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.100011a0
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x100c99e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103586b9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], 2
mov eax, dword [esp + 0x4c]
push eax
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov dword [esp + 0x5c], esp
call fcn.100b7640
sub esp, 0xc
lea edi, [esp + 0x50]
mov eax, esp
mov byte [esp + 0x44], 3
mov dword [esp + 0x2c], esp
call fcn.100b7640
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x48], 2
call fcn.100c9ea0
add esp, 0x20
mov edi, eax
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 4
call fcn.10001120
mov edx, dword [edi + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], edx
mov byte [esp + 0x28], 2
call fcn.100011a0
lea eax, [esp + 0x34]
push eax
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10001120
mov ecx, dword [esp + 0x3c]
mov dword [esi + 8], ecx
mov eax, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0xc], eax
mov byte [esp + 0x28], al
call fcn.100011a0
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], 0
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x100d6140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1037cbf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
push 7
mov dword [esp + 0x1c], edx
push ecx
xor edx, edx
xor ecx, ecx
call fcn.100332f0
mov edi, eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100d61e0
mov esi, eax
add eax, 4
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x100d61e0
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100d61e0
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x100da1d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035ccf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
lea eax, [esp + 0x10]
call fcn.100da370
mov edi, eax
mov dword [esp + 0x24], 1
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10001120
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x100da260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035ccf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
lea eax, [esp + 0x10]
call fcn.100da390
mov edi, eax
mov dword [esp + 0x24], 1
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10001120
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x100e8c80
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1035bb42
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 1
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x100e8cd8
xor edi, edi
jmp 0x100e8d18
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100e93b0
mov esi, eax
mov byte [esp + 0x28], 2
mov ebx, 1
mov ecx, esi
lea eax, [esp + 0x38]
mov dword [esp + 0x30], ebx
call fcn.100ea1b0
mov ecx, dword [esp + 0x40]
sub ecx, dword [esi + 8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [esp + 0x28], 1
test bl, 1
je 0x100e8d35
and ebx, 0xfffffffe
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.100011a0
mov ecx, dword [esp + 0x44]
push ecx
push 1
sub esp, 0xc
mov esi, esp
lea edx, [esp + 0x4c]
mov dword [esp + 0x58], esp
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10001120
mov eax, dword [esp + 0x54]
push ebp
mov dword [esi + 8], eax
call fcn.100e93d0
lea esi, [esp + 0x14]
mov eax, ebp
call fcn.100e93b0
mov byte [esp + 0x28], 3
mov esi, dword [esp + 0x34]
push edi
push esi
mov ecx, eax
call fcn.100e97e0
or ebx, 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
mov byte [esp + 0x28], 1
call fcn.100011a0
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 0
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x18

Function at 0x100e9890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10358439
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.100e9710
lea edx, [esp + 0xc]
mov byte [esp + 0x20], 2
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10001120
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x20], 1
call fcn.100011a0
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0x14