joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006b870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100eaa48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001830
mov dword [esi], vtable.boost::log::v2s_mt_nt5::system_error.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1006b8ba
add edi, 0x28
jmp 0x1006b8bc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1006b8d4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::system_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::system_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1006b930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100eaa78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.boost::log::v2s_mt_nt5::unexpected_call.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1006b97a
add edi, 0x28
jmp 0x1006b97c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1006b994
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::unexpected_call_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::unexpected_call_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1006b9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100eaaa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.boost::log::v2s_mt_nt5::setup_error.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1006ba1a
add edi, 0x28
jmp 0x1006ba1c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1006ba34
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::setup_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::setup_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1006ba70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100eaad8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.boost::log::v2s_mt_nt5::limitation_error.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1006baba
add edi, 0x28
jmp 0x1006babc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1006bad4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::limitation_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::limitation_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1006cc90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100eaf38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001830
mov dword [esi], vtable.boost::log::v2s_mt_nt5::missing_value.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1006ccda
add edi, 0x28
jmp 0x1006ccdc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1006ccf4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::missing_value_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::missing_value_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1006d0a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100eb0a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.boost::log::v2s_mt_nt5::odr_violation.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1006d0ea
add edi, 0x28
jmp 0x1006d0ec
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1006d104
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::odr_violation_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::log::v2s_mt_nt5::odr_violation_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1006fa20
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100eb8c0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
push eax
lea ecx, [esp + 8]
call fcn.10001530
mov dword [esp + 4], vtable.boost::log::v2s_mt_nt5::conversion_error.0
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x78], 0
call fcn.1006b440
add esp, 8
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
push eax
mov byte [esp + 0x74], 1
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], edx
call fcn.1006e160
int3
Function at 0x1006faf0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100eb920
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
push eax
lea ecx, [esp + 8]
call fcn.10001530
mov dword [esp + 4], vtable.boost::log::v2s_mt_nt5::system_error.0
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x78], 0
call fcn.1006b490
add esp, 8
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
push eax
mov byte [esp + 0x74], 1
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], edx
call fcn.1006e1d0
int3

Function at 0x1006fc90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100eb9e0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
push eax
lea ecx, [esp + 8]
call fcn.10001370
mov dword [esp + 4], vtable.boost::log::v2s_mt_nt5::setup_error.0
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x78], 0
call fcn.1006b530
add esp, 8
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
push eax
mov byte [esp + 0x74], 1
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], edx
call fcn.1006e2b0
int3

Function at 0x100756e0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x100ec8f6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push 0x101018b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x100757cb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push esi
call edi
mov dword [esp + 0x1c], eax
test eax, eax
je 0x100757cb
push str.AcquireSRWLockExclusive
push esi
call edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x100757cb
push str.ReleaseSRWLockExclusive
push esi
call edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100757cb
push str.InitializeConditionVariable
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x100757cb
push str.SleepConditionVariableSRW
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x100757cb
push str.WakeAllConditionVariable
push esi
call edi
mov esi, eax
test esi, esi
je 0x100757cb
push 0x1c
call fcn.100b31e6
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0
test eax, eax
je 0x10075800
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push esi
push ebx
push ebp
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push ecx
mov ecx, eax
call fcn.10073e50
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0x38
call fcn.100b31e6
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 1
test eax, eax
je 0x10075800
mov ecx, eax
call fcn.100744e0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x1007d810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ed024
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
mov ebp, dword [eax + 0x10]
add eax, 0xc
mov dword [esp + 0x30], eax
cmp ebp, eax
je 0x1007d8e8
lea esi, [edi + 0xc]
xor ebx, ebx
mov eax, dword [edi + 0x18]
lea ecx, [eax + 0x14]
mov dword [edi + 0x18], ecx
mov edx, dword [ebp + 0xc]
cmp edx, ebx
je 0x1007d872
lea ecx, [edx + 4]
mov ebx, 1
lock xadd dword [ecx], ebx
xor ebx, ebx
cmp eax, ebx
je 0x1007d88f
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ebx
mov byte [eax + 0x10], bl
mov ecx, dword [eax + 0xc]
mov dword [eax + 0xc], edx
mov edx, ecx
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [esi], eax
mov dword [ecx + 4], eax
mov ecx, dword [eax + 8]
and ecx, 0xf
lea ecx, [edi + ecx*8 + 0x20]
mov dword [ecx + 4], eax
cmp dword [ecx], ebx
jne 0x1007d8ae
mov dword [ecx], eax
mov dword [esp + 0x28], 0xffffffff
cmp edx, ebx
je 0x1007d8db
lea eax, [edx + 4]
mov edx, eax
or ecx, 0xffffffff
lock xadd dword [edx], ecx
jne 0x1007d8db
cmp eax, ebx
je 0x1007d8db
lea ecx, [eax - 4]
cmp ecx, ebx
je 0x1007d8db
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ebp, dword [ebp + 4]
cmp ebp, dword [esp + 0x30]
jne 0x1007d854
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x100879d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ed793
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov edx, 7
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ecx
mov word [eax + 4], si
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x30], ecx
mov word [eax + 0x20], dx
mov dword [eax + 0x50], 0xf
mov dword [eax + 0x4c], ecx
mov byte [eax + 0x3c], cl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1008ae90
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100edcb1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x3c]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [esp + 0x10], 0
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.1002a740
mov edx, dword [esp + 0x40]
mov eax, edx
mov dword [esp + 0x30], 1
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1008aef5
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.10060820
mov esi, dword [esp + 0x38]
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.1002a740
cmp dword [esp + 0x24], 8
jb 0x1008af46
mov eax, dword [esp + 0x10]
push eax
call fcn.100b3111
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x1008bc30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100eddf8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.std::out_of_range.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1008bc7a
add edi, 0x28
jmp 0x1008bc7c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1008bc94
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::out_of_range_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::out_of_range_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1008c000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100edec8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1008c04a
add edi, 0x28
jmp 0x1008c04c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1008c064
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1008d440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ee258
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.boost::gregorian::bad_weekday.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1008d48a
add edi, 0x28
jmp 0x1008d48c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1008d4a4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_weekday_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_weekday_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1008d4e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ee288
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10001d40
mov dword [esi], vtable.boost::gregorian::bad_day_of_year.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x1008d52a
add edi, 0x28
jmp 0x1008d52c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x1008d544
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1008fee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ee949
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x14], ebx
push 0xffffffffffffffff
xor ecx, ecx
mov ebp, 7
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push ebx
mov word [esi + 4], cx
push eax
mov ecx, esi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], esi
call fcn.1002a740
mov eax, 1
xor edx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
lea ebp, [edi + 0xc]
mov ecx, ebp
mov dword [esp + 0x40], eax
call fcn.10081510
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x1008ff70
lea eax, [esp + 0x1c]
mov ecx, dword [ebp + 0x40]
mov edx, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.10085960
cmp dword [esp + 0x30], 8
mov byte [esp + 0x40], bl
jb 0x1008ff99
mov eax, dword [esp + 0x1c]
push eax
call fcn.100b3111
add esp, 4
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 4]
mov eax, dword [edi + 4]
lea ebp, [edi + 8]
lea ecx, [edx + edi + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0x50]
push eax
mov ecx, ebp
call fcn.10065ea0
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.1008ba10
mov edi, dword [edi]
push 0xffffffffffffffff
push ebx
push eax
push edi
mov ecx, esi
mov dword [esp + 0x50], 2
call fcn.10087da0
cmp dword [esp + 0x30], 8
jb 0x1008ffee
mov edx, dword [esp + 0x1c]
push edx
call fcn.100b3111
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc
Function at 0x10090010
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100ee9ba
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x1012fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebp, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov eax, dword [esp + 0x40]
mov dword [esi], vtable.file_collector.0
mov ecx, dword [eax]
mov dword [esi + 0x14], ecx
mov eax, dword [eax + 4]
mov dword [esp + 0x38], ebp
mov dword [esi + 0x18], eax
cmp eax, ebp
je 0x10090073
add eax, 4
mov edx, 1
lock xadd dword [eax], edx
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x50]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x54]
lea ecx, [esi + 0x38]
push ecx
mov byte [esp + 0x3c], 2
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], eax
call fcn.10087a40
add esp, 4
lea edi, [esi + 0x54]
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebp
mov word [edi + 4], dx
lea ecx, [esi + 0x70]
mov byte [esp + 0x38], 4
call fcn.10089630
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov byte [esp + 0x40], 5
mov dword [esi + 0x90], ebp
mov dword [esi + 0x94], ebp
call fcn.10087b70
push 0xffffffffffffffff
push ebp
push eax
mov ecx, edi
mov byte [esp + 0x44], 6
call fcn.1002a740
cmp dword [esp + 0x2c], 8
mov byte [esp + 0x38], 5
jb 0x10090111
mov edx, dword [esp + 0x18]
push edx
call fcn.100b3111
add esp, 4
push ebp
push edi
call fcn.100a5f10
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret 0x18