joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ab50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.0042e210
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x46acb8
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x46abcc
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x46ac31
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x46abf0
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x46ac5d
mov eax, dword [esi + 4]
push 1
push 0x47ce55
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x47ce56
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x46ac36
push dword [esp + 0x28]
call fcn.0042e210
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x46ac88
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x483004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x46ad90
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x46adb6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x46ade6
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.0042e210
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x46ae3d
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x46ae4c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x46ae5d
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x1020752c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x10207587
mov edi, dword [ebp + 0xc]
test edi, 0xffff0000
jne 0x10207551
sub edi, dword [ebx + esi + 0x10]
jmp 0x102075a2
mov ecx, dword [ebx + esi + 0x20]
xor eax, eax
add ecx, esi
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ecx
cmp dword [ebx + esi + 0x18], eax
jbe 0x10207587
mov eax, dword [ecx + eax*4]
add eax, esi
push edi
push eax
call fcn.1020d414
pop ecx
pop ecx
test eax, eax
je 0x10207590
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + esi + 0x18]
jb 0x10207565
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
test ecx, ecx
js 0x10207587
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ecx*2]
movzx edi, word [eax + esi]
cmp edi, 0xffffffff
je 0x10207587
cmp edi, dword [ebx + esi + 0x14]
jae 0x10207587
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + edi*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x10207589

Function at 0x1020a674
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0x1020a6d7
mov ecx, dword [ebp + 0x10]
sub dword [ebp + 0xc], ecx
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [ebp + 8], eax
mov edi, dword [ebp + 8]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, dword [ebp + 0x10]
xor cl, byte [esi + eax]
mov byte [eax], cl
inc eax
sub dword [ebp - 4], 1
mov dword [ebp + 0x10], eax
mov eax, edi
jne 0x1020a696
mov esi, dword [ebp + 0x14]
pop edi
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
leave
ret
Function at 0x102237fc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push edi
mov ebx, 0x10221598
mov eax, dword [eax + 0xc]
push ebx
mov edi, dword [eax + 0x18]
push dword [edi + 0x28]
call fcn.1021c2c4
pop ecx
pop ecx
test eax, eax
jne 0x10223823
mov eax, dword [edi + 0x10]
jmp 0x10223842
push esi
mov esi, dword [edi + 4]
jmp 0x1022383b
push ebx
push dword [esi + 0x28]
call fcn.1021c2c4
pop ecx
pop ecx
test eax, eax
je 0x10223845
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x10223829
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x10]
jmp 0x10223841
Function at 0x40b4f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4283d4]
jne 0x40b4fa
repz ret
jmp fcn.0041184c

Function at 0x4174fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4283d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ee72
and dword [ebp - 0x14], 0
cmp dword [0x52874c], 0
mov dword [ebp - 0x18], eax
jne 0x4175af
push 0x4037ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417657
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037e0
push ebx
call edi
test eax, eax
je 0x417657
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037d0
push ebx
mov dword [0x52874c], eax
call edi
push eax
call esi
push 0x4037bc
push ebx
mov dword [0x528750], eax
call edi
push eax
call esi
push 0x4037a0
push ebx
mov dword [0x528754], eax
call edi
push eax
call esi
mov dword [0x52875c], eax
test eax, eax
je 0x4175af
push 0x403788
push ebx
call edi
push eax
call esi
mov dword [0x528758], eax
mov eax, dword [0x528758]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417608
cmp dword [0x52875c], ecx
je 0x417608
push eax
call esi
push dword [0x52875c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417608
test ebx, ebx
je 0x417608
call edi
test eax, eax
je 0x4175ff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4175ff
test byte [ebp - 8], 1
jne 0x417608
or dword [ebp + 0x10], 0x200000
jmp 0x41763b
mov eax, dword [0x528750]
cmp eax, dword [ebp - 0x18]
je 0x41763b
push eax
call esi
test eax, eax
je 0x41763b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41763b
mov eax, dword [0x528754]
cmp eax, dword [ebp - 0x18]
je 0x41763b
push eax
call esi
test eax, eax
je 0x41763b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x52874c]
call esi
test eax, eax
je 0x417657
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417659
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b4f0
leave
ret
Function at 0x41f800
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.0041e9c0
cmp dword [0x8c94d0], 0x37
jne 0x41f891
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x404428
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x404448
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x8c94d4]
mov edx, dword [0x8c5940]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x401045
Capabilities:
Encode data using xor
Encrypt data using xtea
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCR80.dll_srand]
mov edi, dword [sym.imp.MSVCR80.dll_rand]
pop ecx
call edi
cdq
mov ecx, 0x3e8
idiv ecx
mov esi, edx
add esi, 0xc8
call edi
cdq
mov ecx, 0x4b0
idiv ecx
add edx, 0x64
push edx
push esi
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0xfffffffffffffff0
push eax
mov dword [0x403378], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x40106f
push 0xf6950
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x11400
push 0x404380
push eax
mov dword [ebp - 0x198], eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push str.xdkrujk3hndy
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
cmp esi, 0x7530
jge 0x40112f
lea eax, [ebp - 0x194]
push str.xdfJKDNcmMDa
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy]
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_PulseEvent]
mov eax, esi
cdq
push 0xf
pop ecx
idiv ecx
push 0xf
pop ebx
lea ecx, [ebp + edx*2 - 0x194]
movzx eax, word [ecx]
xor edx, edx
div ebx
inc esi
mov ax, word [ebp + edx*2 - 0x194]
mov word [ecx], ax
jmp 0x4010e5
mov esi, dword [ebp - 0x198]
mov dword [ebp - 0x19c], 0x1e849
mov ecx, esi
call fcn.00401026
lea ecx, [esi + 4]
mov edi, eax
call fcn.00401026
mov ecx, edi
mov edx, 0xc6ef3720
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
mov ebx, edx
shr ebx, 0xb
and ebx, 3
mov ebx, dword [ebx*4 + 0x402100]
add ebx, edx
add edi, ecx
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
xor edi, ebx
add edx, 0x61c88647
mov ebx, edx
and ebx, 3
mov ebx, dword [ebx*4 + 0x402100]
add edi, eax
add ebx, edx
xor edi, ebx
sub ecx, edi
test edx, edx
jne 0x401157
mov dword [ebp - 0x1a4], ecx
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x1a0], eax
call fcn.00401026
lea ecx, [ebp - 0x1a0]
mov dword [esi], eax
call fcn.00401026
mov dword [esi + 4], eax
add esi, 8
dec dword [ebp - 0x19c]
jne 0x40113f
call dword [ebp - 0x198]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x5eebca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5eebe5
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b3e0a]
pop edx
test eax, eax
je 0x5eecb7
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5eeca6
test dword [ebp - 0x2a8], 1
jne 0x5eeca6
and dword [ebp - 0x2a8], 0x100
jne 0x5eeca6
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3a20]
pop edx
pop esi
test eax, eax
je 0x5eec49
jmp 0x5eeca6
cmp word [esi], 0x5a4d
jne 0x5eeca6
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5eeca6
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d394c]
pop edx
test eax, eax
je 0x5eeca6
lea eax, [ebp - 0x28c]
push eax
call fcn.005eeb26
test eax, eax
jne 0x5eec9f
jmp 0x5eeca6
mov eax, esi
jmp 0x5eecb7
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5eebe5
pop esi
leave
ret 4

Function at 0x10070e7a
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [esp], ah
inc dl
jmp 0x10046440
seta dl
mov dl, byte [esi]
jmp 0x1006caa4

Function at 0x1007658b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1007016e
pushal
jmp 0x10070d59
pushf
pushal
call fcn.10070e7a
pushal
pushal
push dword [esp + 0x40]
ret 0x44
clc
add dl, dl
pushfd
lea esp, [esp + 4]
jne 0x10070864
jae 0x10046241
mov dl, dl
push eax
pushf
pop word [esp + 2]
setno dl
pushal
pushfd
mov dl, byte [esi]
call fcn.10070d83
jle 0x10069d83
je 0x100466e6
cmc
setle dl
mov esi, dword [eax + 0x3c]
rcl dl, cl
and dx, bp
movsx edx, cl
test ch, 0xb
add esi, eax
shl dx, 7
movzx dx, cl
mov edx, dword [esi + 0x78]
cmc
test edx, edx
push eax
call fcn.1006e25a
Function at 0x10007870
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10344f81
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x34], 3
call fcn.10007be0
push eax
push edi
lea ecx, [esp + 0x5c]
call fcn.10007b30
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x60]
mov byte [esp + 0x14], bl
mov ecx, dword [esp + 0x14]
push ecx
push edx
push eax
sub esp, 0xc
mov ecx, esp
lea edx, [esp + 0x6c]
mov dword [esp + 0x78], esp
push edx
push ecx
mov dword [esp + 0x30], 1
call fcn.10007840
push ecx
mov esi, esp
mov byte [esp + 0x54], 4
lea eax, [esp + 0x6c]
mov dword [esp + 0x38], esp
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.100011b0
mov ecx, dword [esp + 0x74]
mov dword [esi + 8], ecx
sub esp, 0xc
mov esi, esp
lea edx, [esp + 0x6c]
mov byte [esp + 0x60], 5
mov dword [esp + 0x48], esp
push edx
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.100011b0
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x4c]
mov dword [esi + 8], eax
push ecx
mov byte [esp + 0x64], 3
call fcn.10008300
add esp, 0x34
lea ecx, [esp + 0x1c]
call fcn.10001230
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 2
call fcn.10001230
lea ecx, [esp + 0x48]
mov byte [esp + 0x30], 1
call fcn.10001230
lea ecx, [esp + 0x54]
mov byte [esp + 0x30], bl
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x10007b30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10341eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.100011b0
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 1
call fcn.10007e30
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.100011b0
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], bl
call fcn.10001230
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x100091e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10343568
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, esi
call fcn.10009740
sub esp, 8
mov ecx, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.100096b0
add esp, 4
mov ecx, edi
mov dword [esp + 0x2c], 0xffffffff
call fcn.100097d0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4

Function at 0x100097d0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10342f78
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
sub esp, 0xc
mov esi, esp
mov dword [esp + 0x28], 1
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], esp
push eax
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov ecx, dword [esp + 0x44]
mov dword [esi + 8], ecx
sub esp, 0xc
mov esi, esp
lea edx, [esp + 0x3c]
mov byte [esp + 0x34], 2
mov dword [esp + 0x28], esp
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov eax, dword [esp + 0x44]
mov dword [esi + 8], eax
mov byte [esp + 0x34], 1
call fcn.100098e0
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call fcn.10001230
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x18

Function at 0x100098e0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10347af8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
sub esp, 0xc
mov esi, esp
mov dword [esp + 0x24], 1
lea eax, [esp + 0x38]
mov dword [esp + 0x14], esp
push eax
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov ecx, dword [esp + 0x40]
mov dword [esi + 8], ecx
sub esp, 0xc
mov esi, esp
lea edx, [esp + 0x38]
mov byte [esp + 0x30], 2
mov dword [esp + 0x24], esp
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100011b0
mov eax, dword [esp + 0x40]
mov dword [esi + 8], eax
push edi
mov byte [esp + 0x34], 1
call fcn.100099f0
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.10001230
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0xffffffff
call fcn.10001230
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0x18
Function at 0x1000ab10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10346ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push str.Day_of_month_value_is_out_of_range_1..31
lea ecx, [esp + 0x14]
call fcn.10003680
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.10009b70
mov dword [esi], vtable.std::out_of_range.0
mov byte [esp + 0x38], 2
cmp dword [esp + 0x2c], 0x10
jb 0x1000ab77
mov eax, dword [esp + 0x18]
push eax
call fcn.1025a370
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.10001370
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x1000abf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10346ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push str.Year_is_out_of_valid_range:_1400..10000
lea ecx, [esp + 0x14]
call fcn.10003680
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.10009b70
mov dword [esi], vtable.std::out_of_range.0
mov byte [esp + 0x38], 2
cmp dword [esp + 0x2c], 0x10
jb 0x1000ac57
mov eax, dword [esp + 0x18]
push eax
call fcn.1025a370
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.10001370
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x1000ad20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10346ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push str.Month_number_is_out_of_range_1..12
lea ecx, [esp + 0x14]
call fcn.10003680
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.10009b70
mov dword [esi], vtable.std::out_of_range.0
mov byte [esp + 0x38], 2
cmp dword [esp + 0x2c], 0x10
jb 0x1000ad87
mov eax, dword [esp + 0x18]
push eax
call fcn.1025a370
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.10001370
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x1000b3d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10343478
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.100016a0
mov dword [esp + 0x18], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
add edi, 0x34
mov dword [esi + 0x30], ecx
push edi
lea ecx, [esi + 0x34]
call fcn.10003720
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x1000b9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10349aac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10525930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
xor edi, edi
mov dword [esi], vtable.boost::detail::thread_data_base.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea eax, [esp + 0x1b]
push eax
lea edx, [esp + 0x1f]
mov dword [esp + 0x2c], edi
lea ecx, [esi + 0x14]
push edx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.10013820
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
push edi
push 1
mov byte [esp + 0x30], 5
call fcn.1000a8f0
mov dword [esi + 0x58], eax
add esp, 8
mov byte [esi + 0x5c], 1
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret