joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005aa2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
sub edi, 0x8fce
pop edi
push eax
push edx
add esp, 4
and eax, 0x12e0b
add eax, 0x1e0
add eax, 0x8fc8
and eax, 0x12923
pop eax
push edx
add edx, 0x8485
pop edx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push ecx
push edi
add esp, 4
add ecx, 0x8f59
add ecx, 0xa3b2
or ecx, 0x178ef
add ecx, 0xd678
pop ecx
push esi
xor esi, 0x14445
pop esi
push eax
push ecx
add esp, 4
add eax, 0x72f8
pop eax
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push edx
and edx, 0x11bb5
call fcn.10005940
add byte [edi], dh
inc edi
cmp bh, byte [esi]
cmp bh, byte [edi]
dec ebx
cmp eax, 0x4c48339
add esp, 4
add esp, 4
xor edx, 0xfe53
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0xa145
and ecx, 0xd07
pop ecx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x1000597f
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x100059e2
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x1000589e
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x1000589e
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x100059cc
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x100059d6
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10005a2b
push eax
push edx
add esp, 4
call 0x100059fc
add byte [esi], bh
cmp dword [ecx + 0x35], ecx
cmp dword [eax - 0x7d], edx
les eax, [ecx + eax*4]
call int.1000b00b
jmp 0x10005a0c
call 0x10005a19
add byte [ebx + 0x3d], al
cmp byte [edi + 0x4d], cl
inc edi
xor al, byte [ebx - 0x74a7fb3c]
lea edi, [eax]
cli
invalid
push ebx
xor ebx, 0xc8ac
xor ebx, 0x11640
pop ebx
push esi
push edx
add esp, 4
and esi, 0x1010e
jmp 0x10005a49
pop esi
push eax
jmp 0x10005a50
sub eax, 0x147ce
or eax, 0x1319
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10005a89
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x1000583f
mov dword [ebp - 0x870], 0
push edi
call 0x10005aa2
add byte [eax + 0x3c], al
inc eax
cmp dword [edi + 0x50], ecx
dec esp
xor al, byte [ebx - 0x187efb3c]
popfd
jmp 0x625f5aad
Function at 0x10006a18
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x8c36
add ebx, 0x1012
jmp 0x10006993
pop ebx
push eax
add eax, 0x8c06
jmp 0x100069a4
and eax, 0xab21
or eax, 0x1afd
pop eax
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push eax
call fcn.10006a18
add byte [ebx + 0x4e], cl
inc eax
dec esp
dec ebx
dec esi
dec ecx
aaa
aas
add esp, 4
add eax, 0x366c
add byte [ecx + 0xb2bce0], al
add byte [eax + 0x52], bl
push ebx
add esp, 4
xor edx, 0xc705
and edx, 0x16e49
pop edx
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x10006a57
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x10006ab1
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x1000697f
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x1000697f
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x10006a9b
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x10006aa5
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x10006afa
push ebx
push ecx
add esp, 4
xor ebx, 0x7b49
pop ebx
push edx
and edx, 0xe690
call 0x10006adc
add byte [esi], dh
xor ecx, dword [edi + 0x3f]
xor edi, dword [ebx]
inc edx
xor edi, dword [edi]
add esp, 4
xor edx, 0x1285b
or edx, 0xf2c1
pop edx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x10006b62
push eax
push ecx
add esp, 4
call 0x10006b0b
add byte [ebx + 0x3a], cl
inc eax
cmp eax, 0xc483413e
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [ebx], bh
cmp ecx, dword [esi + 0x4e]
cmp eax, 0x83323d45
les eax, [ecx + eax*4]
invalid
Function at 0x10006adc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x8c36
add ebx, 0x1012
jmp 0x10006993
pop ebx
push eax
add eax, 0x8c06
jmp 0x100069a4
and eax, 0xab21
or eax, 0x1afd
pop eax
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push eax
call fcn.10006a18
add byte [ebx + 0x4e], cl
inc eax
dec esp
dec ebx
dec esi
dec ecx
aaa
aas
add esp, 4
add eax, 0x366c
add byte [ecx + 0xb2bce0], al
add byte [eax + 0x52], bl
push ebx
add esp, 4
xor edx, 0xc705
and edx, 0x16e49
pop edx
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x10006a57
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x10006ab1
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x1000697f
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x1000697f
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x10006a9b
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x10006aa5
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x10006afa
push ebx
push ecx
add esp, 4
xor ebx, 0x7b49
pop ebx
push edx
and edx, 0xe690
call 0x10006adc
add byte [esi], dh
xor ecx, dword [edi + 0x3f]
xor edi, dword [ebx]
inc edx
xor edi, dword [edi]
add esp, 4
xor edx, 0x1285b
or edx, 0xf2c1
pop edx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x10006b62
push eax
push ecx
add esp, 4
call 0x10006b0b
add byte [ebx + 0x3a], cl
inc eax
cmp eax, 0xc483413e
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [ebx], bh
cmp ecx, dword [esi + 0x4e]
cmp eax, 0x83323d45
les eax, [ecx + eax*4]
invalid
Function at 0x10006b0b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x8c36
add ebx, 0x1012
jmp 0x10006993
pop ebx
push eax
add eax, 0x8c06
jmp 0x100069a4
and eax, 0xab21
or eax, 0x1afd
pop eax
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push eax
call fcn.10006a18
add byte [ebx + 0x4e], cl
inc eax
dec esp
dec ebx
dec esi
dec ecx
aaa
aas
add esp, 4
add eax, 0x366c
add byte [ecx + 0xb2bce0], al
add byte [eax + 0x52], bl
push ebx
add esp, 4
xor edx, 0xc705
and edx, 0x16e49
pop edx
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x10006a57
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x10006ab1
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x1000697f
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x1000697f
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x10006a9b
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x10006aa5
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x10006afa
push ebx
push ecx
add esp, 4
xor ebx, 0x7b49
pop ebx
push edx
and edx, 0xe690
call 0x10006adc
add byte [esi], dh
xor ecx, dword [edi + 0x3f]
xor edi, dword [ebx]
inc edx
xor edi, dword [edi]
add esp, 4
xor edx, 0x1285b
or edx, 0xf2c1
pop edx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x10006b62
push eax
push ecx
add esp, 4
call 0x10006b0b
add byte [ebx + 0x3a], cl
inc eax
cmp eax, 0xc483413e
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [ebx], bh
cmp ecx, dword [esi + 0x4e]
cmp eax, 0x83323d45
les eax, [ecx + eax*4]
invalid
Function at 0x10006b1c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x8c36
add ebx, 0x1012
jmp 0x10006993
pop ebx
push eax
add eax, 0x8c06
jmp 0x100069a4
and eax, 0xab21
or eax, 0x1afd
pop eax
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push eax
call fcn.10006a18
add byte [ebx + 0x4e], cl
inc eax
dec esp
dec ebx
dec esi
dec ecx
aaa
aas
add esp, 4
add eax, 0x366c
add byte [ecx + 0xb2bce0], al
add byte [eax + 0x52], bl
push ebx
add esp, 4
xor edx, 0xc705
and edx, 0x16e49
pop edx
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x10006a57
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x10006ab1
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x1000697f
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x1000697f
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x10006a9b
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x10006aa5
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x10006afa
push ebx
push ecx
add esp, 4
xor ebx, 0x7b49
pop ebx
push edx
and edx, 0xe690
call 0x10006adc
add byte [esi], dh
xor ecx, dword [edi + 0x3f]
xor edi, dword [ebx]
inc edx
xor edi, dword [edi]
add esp, 4
xor edx, 0x1285b
or edx, 0xf2c1
pop edx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x10006b62
push eax
push ecx
add esp, 4
call 0x10006b0b
add byte [ebx + 0x3a], cl
inc eax
cmp eax, 0xc483413e
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [ebx], bh
cmp ecx, dword [esi + 0x4e]
cmp eax, 0x83323d45
les eax, [ecx + eax*4]
invalid
Function at 0x100074c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
cmp al, 0x83
les eax, [ecx + eax*4]
jecxz 0x100074b5
pop edi
add dword [eax], eax

Function at 0x100074c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
cmp al, 0x83
les eax, [ecx + eax*4]
jecxz 0x100074b5
pop edi
add dword [eax], eax
Function at 0x100077f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x66edc3], al
add byte [ebx + 0x56], bl

Function at 0x10007812
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
inc edx
xor ebx, dword [edx - 0x7d]
mov ebp, 0xffffe670
add byte [ebp + 0xf], dh
mov dword [ebp - 0x394], 0
jmp 0x100077e4
push ebx
or ebx, 0xaa24
and ebx, 0x6e18
add byte [ecx + 0x66edc3], al
add byte [ebx + 0x56], bl
push edx
add esp, 4
sub esi, 0xc063
call 0x10007812
add byte [ebx], dh
inc eax
xor esi, dword [0x4635434e]
xor al, 0x83
les eax, [esi + ebx*2]
mov ecx, dword [ebp - 0x394]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push ecx
push ebx
add esp, 4
or ecx, 0x9df3
add ecx, 0x3c08
sub ecx, 0x8700
pop ecx
push edi
push edx
add esp, 4
sub edi, 0x479b
add edi, 0x268
pop edi
push edi
Function at 0x1002a150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10050ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x10068548]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x28
xor ebx, ebx
push str.Day_of_month_value_is_out_of_range_1..31
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10007a80
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.10007a20
mov byte [esp + 0x34], 2
cmp dword [esp + 0x28], 0x10
jb 0x1002a1c6
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1002f28b
add esp, 4
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x34], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x1002a210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10050ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x10068548]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x27
xor ebx, ebx
push str.Year_is_out_of_valid_range:_1400..10000
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10007a80
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.10007a20
mov byte [esp + 0x34], 2
cmp dword [esp + 0x28], 0x10
jb 0x1002a286
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1002f28b
add esp, 4
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x34], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x1002a2e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10050ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x10068548]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x22
xor ebx, ebx
push str.Month_number_is_out_of_range_1..12
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10007a80
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.10007a20
mov byte [esp + 0x34], 2
cmp dword [esp + 0x28], 0x10
jb 0x1002a356
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1002f28b
add esp, 4
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x34], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x1002b160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1004f708
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
push edi
mov eax, dword [0x10068548]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
lea esi, [esp + 0xc]
call fcn.1002c570
mov edi, eax
lea esi, [esp + 0x30]
mov dword [esp + 0x64], 0
call fcn.1002c5b0
push 0x100600dc
mov eax, esi
push eax
call fcn.1003134b
int3

Function at 0x1002d7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100535d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10068548]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x30]
mov ecx, dword [ecx + 4]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.1002e1b0
mov byte [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x1c], 0xffffffff
cmp byte [esp + 0xc], 0
je 0x1002d859
mov eax, dword [esp + 8]
mov ecx, 0x80000000
mov edx, eax
lock xadd dword [edx], ecx
test ecx, 0x40000000
jne 0x1002d859
cmp ecx, 0x80000000
jle 0x1002d859
mov ecx, eax
lock bts dword [ecx], 0x1e
jb 0x1002d859
call fcn.10004db0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret 4

Function at 0x1002f296
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10068548]
jne 0x1002f2a0
repz ret
jmp fcn.10033057
Function at 0x1003dbf2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10034414
and dword [ebp - 4], 0
cmp dword [0x1006d5ac], 0
mov ebx, eax
jne 0x1003dca3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1003dd54
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1003dd54
push eax
call fcn.100343a2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1006d5ac], eax
call esi
push eax
call fcn.100343a2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1006d5b0], eax
call esi
push eax
call fcn.100343a2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1006d5b4], eax
call esi
push eax
call fcn.100343a2
pop ecx
mov dword [0x1006d5bc], eax
test eax, eax
je 0x1003dca3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100343a2
pop ecx
mov dword [0x1006d5b8], eax
mov eax, dword [0x1006d5b8]
cmp eax, ebx
je 0x1003dcfb
cmp dword [0x1006d5bc], ebx
je 0x1003dcfb
push eax
call fcn.1003441d
push dword [0x1006d5bc]
mov esi, eax
call fcn.1003441d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003dcfb
test edi, edi
je 0x1003dcfb
call esi
test eax, eax
je 0x1003dcf2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003dcf2
test byte [ebp - 0xc], 1
jne 0x1003dcfb
or dword [ebp + 0x10], 0x200000
jmp 0x1003dd34
mov eax, dword [0x1006d5b0]
cmp eax, ebx
je 0x1003dd34
push eax
call fcn.1003441d
pop ecx
test eax, eax
je 0x1003dd34
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1003dd34
mov eax, dword [0x1006d5b4]
cmp eax, ebx
je 0x1003dd34
push eax
call fcn.1003441d
pop ecx
test eax, eax
je 0x1003dd34
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1006d5ac]
call fcn.1003441d
pop ecx
test eax, eax
je 0x1003dd54
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003dd56
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10046890
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x1004d908
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10068548]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x10046170
push 0x1006d6f0
call fcn.100463b0
mov eax, dword [0x1006d6f8]
add esp, 8
test eax, eax
je 0x100468ea
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.1002f9ba
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.10006420
int3
Function at 0x10046920
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x1004d938
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10068548]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006d6f8]
test eax, eax
jne 0x10046952
xor esi, esi
jmp 0x1004695b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x10046987
cmp dword [esi + 0x14], 0
jne 0x100469c9
cmp dword [esi + 0x10], 0
jne 0x100469d0
push 0
call fcn.10046890
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x100469b5
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100469b5
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x10046a10
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x100469fe
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x100469d0
cmp dword [esi + 0x14], 0
je 0x10046977
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10046a35
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x10046a66
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10046a66
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10046a66
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x10046a1a
jmp 0x10046971