joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100478f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1016d8f3
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov ebp, dword [esp + 0xd8]
cmp dword [ebp + 0x14], 0
mov ebx, dword [esp + 0xd4]
je 0x10047a8b
push 1
push 0
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
mov byte [esp + 0x20], 0x3b
call fcn.10006df0
mov edi, eax
xor esi, esi
cmp edi, 0xffffffff
je 0x10047a2c
mov byte [esp + 0x14], 0x3b
mov ecx, edi
sub ecx, esi
push ecx
push esi
lea edx, [esp + 0x5c]
push edx
mov ecx, ebp
call fcn.1003afc0
mov ecx, dword [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0xd4], 0
call fcn.10045530
push eax
mov ecx, ebx
mov byte [esp + 0xd0], 1
call fcn.10047230
mov esi, 0x10
cmp dword [esp + 0x50], esi
jb 0x100479b4
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.10149646
add esp, 4
cmp dword [esp + 0x34], esi
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
jb 0x100479dc
mov edx, dword [esp + 0x20]
push edx
call fcn.10149646
add esp, 4
cmp dword [esp + 0x6c], esi
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
mov dword [esp + 0xcc], 0xffffffff
jb 0x10047a0f
mov eax, dword [esp + 0x58]
push eax
call fcn.10149646
add esp, 4
push 1
lea esi, [edi + 1]
push esi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call fcn.10006df0
mov edi, eax
cmp edi, 0xffffffff
jne 0x10047960
push 0xffffffffffffffff
push esi
lea edx, [esp + 0x78]
push edx
mov ecx, ebp
call fcn.1003afc0
mov ecx, dword [esp + 0x18]
push eax
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0xd4], 2
call fcn.10045530
push eax
mov ecx, ebx
mov byte [esp + 0xd0], 3
call fcn.10047230
lea ecx, [esp + 0x8c]
call fcn.1000a7e0
cmp dword [esp + 0x88], 0x10
jb 0x10047a8b
mov ecx, dword [esp + 0x74]
push ecx
call fcn.10149646
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x10047aaa
mov ecx, dword [ebx + 8]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret 8
Function at 0x1004d890
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1016e0d0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea eax, [esi + 0x48]
mov dword [esp + 0x24], eax
add eax, 4
mov ebx, 0x1018442c
push eax
mov byte [esp + 0x1b], 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
call edi
lea eax, [esi + 0x64]
mov dword [esp + 0x2c], eax
add eax, 4
push eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
call edi
lea ebp, [esi + 0x80]
mov ecx, ebp
mov byte [esp + 0x38], 1
call fcn.10050fa0
mov ebx, eax
xor edi, edi
test ebx, ebx
jbe 0x1004d94d
add esi, 0x20b4
jmp 0x1004d920
push edi
mov ecx, esi
call fcn.100ee536
test al, al
mov ecx, ebp
je 0x1004d932
push 2
jmp 0x1004d939
mov byte [esp + 0x17], 0
push 0
push edi
call fcn.10050f60
mov ecx, eax
call fcn.10033ec0
add edi, 1
cmp edi, ebx
jb 0x1004d920
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push eax
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call esi
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10050a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016e5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov dword [esi + 0x221c], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x2220], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x2224], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x2228], edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x222c], ecx
mov edx, dword [eax + 0x14]
mov dword [esi + 0x2230], edx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0x1f6c], eax
call fcn.100e47eb
mov ecx, eax
call fcn.100e4578
xor ebx, ebx
push ebx
push 0x3e8
push ebx
push ebx
mov ecx, esi
mov dword [esi + 0x220c], eax
call fcn.1004d780
mov eax, dword [esi]
mov edx, dword [eax + 0xa4]
push ebx
push ebx
push 0x40
mov ecx, esi
call edx
mov eax, dword [esi + 0x13c]
mov ecx, dword [esi + 0x140]
cmp eax, ecx
mov edi, eax
jb 0x10050b14
mov edi, ecx
mov edx, dword [esi + 0x144]
cmp edx, edi
jae 0x10050b22
mov ecx, edx
jmp 0x10050b28
cmp eax, ecx
jae 0x10050b28
mov ecx, eax
cmp ecx, ebx
jne 0x10050b31
mov ecx, 1
sub esp, 0x18
mov eax, esp
mov dword [eax], 0x10187138
mov dword [esp + 0x48], esp
mov dword [eax + 4], 0x1018710c
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
push ecx
lea ecx, [esi + 0x2068]
mov dword [eax], 0x10187138
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
call fcn.1000c6e0
cmp byte [esi + 0x2078], bl
mov dword [esi + 0x1f54], 1
jne 0x10050b88
push ebx
lea eax, [esi + 0x1ed4]
push eax
mov ecx, esi
call fcn.1004dfc0
jmp 0x10050c05
xor edi, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x80]
mov dword [esp + 0x2c], ebx
call fcn.100525d0
test eax, eax
jbe 0x10050bd9
mov edi, dword [esp + 0x14]
cmp edi, ebx
je 0x10050bce
mov ecx, dword [esp + 0x18]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10050bd7
call fcn.10149775
mov edi, dword [esp + 0x14]
mov edi, dword [edi]
push edi
lea ecx, [esi + 0x1ed4]
push ecx
mov ecx, esi
call fcn.1004dfc0
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10050bf9
push eax
call fcn.10149646
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov al, 1
mov byte [esi + 0x2210], al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x10051b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016e62b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x10185e7c
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], 0
call fcn.10051960
cmp dword [esi + 0x30], 0x10
jb 0x10051be0
mov eax, dword [esi + 0x1c]
push eax
call fcn.10149646
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x100523b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016e68b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
mov dword [eax], 0x10185e7c
xor ecx, ecx
mov word [eax + 7], 3
mov dword [eax + 9], ecx
mov dword [eax + 0xd], ecx
mov dword [eax + 0x11], ecx
mov byte [eax + 5], 0x50
mov byte [eax + 0x15], cl
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x1c], cl
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov byte [eax + 0x14], cl
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x10052ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10178427
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
call fcn.10033b60
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [ebx + 4], 0x10185b24
lea eax, [ebx + 0xc]
mov dword [ebx], 0x10185e98
mov dword [ebx + 4], 0x10185e90
push eax
mov dword [ebx + 8], 0x1018458c
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [ebx + 0x24], ecx
push eax
lea ecx, [ebx + 0x2c]
mov byte [esp + 0x24], 2
mov dword [ebx + 0x28], edx
call fcn.10010a20
mov esi, dword [esp + 0x34]
lea edi, [ebx + 0x150]
mov ecx, 0x2da
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x38]
push 0x114a
push ecx
lea edx, [ebx + 0xcb8]
push edx
call fcn.1014a220
mov esi, dword [esp + 0x48]
lea edi, [ebx + 0x1e02]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
add esp, 0xc
lea eax, [ebx + 0x1e40]
mov dword [ebx + 0x1e38], 0x10186784
mov edi, 0x1018458c
push eax
mov dword [ebx + 0x1e3c], edi
call esi
mov dword [ebx + 0x1e58], 1
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [ebx + 0x1e5c]
mov byte [esp + 0x24], 4
call fcn.10042860
mov dl, byte [esp + 0x44]
mov eax, dword [esp + 0x48]
lea ecx, [ebx + 0x1f00]
mov byte [ebx + 0x1ef0], dl
mov dword [ebx + 0x1ef4], ebp
mov dword [ebx + 0x1ef8], eax
push ecx
mov dword [ebx + 0x1efc], edi
call esi
lea edi, [ebx + 0x1f18]
mov ecx, edi
call fcn.10005a20
lea edx, [ebx + 0x1fac]
mov dword [ebx + 0x1fa0], 0x10185b2c
push edx
mov dword [ebx + 0x1fa8], 0x1018458c
call esi
mov dword [ebx + 0x1fc8], ebp
mov dword [ebx + 0x1fcc], ebp
lea eax, [ebx + 0x1fdc]
mov dword [ebx + 0x1fd0], 0x10185b2c
push eax
mov dword [ebx + 0x1fd8], 0x1018458c
call esi
mov dword [ebx + 0x1ff8], ebp
mov dword [ebx + 0x1ffc], ebp
mov dword [ebx + 0x2004], ebp
mov dword [ebx + 0x2008], ebp
mov dword [ebx + 0x200c], ebp
push ebp
mov dword [ebx + 0x2010], ebp
mov dword [ebx + 0x2014], ebp
mov dword [ebx + 0x2018], ebp
call fcn.10149d08
mov dword [ebx + 0x2000], eax
add esp, 4
mov dword [edi], 6
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24
Function at 0x10054ee0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1016e8e0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101b01e4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x54], 1
call fcn.10001ec0
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x28], ecx
movzx ecx, byte [esp + 0x78]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dl, byte [esp + 0x7c]
lea eax, [esp + 0xc]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x3c], dl
call fcn.10054e40
mov esi, 0x10
cmp dword [esp + 0x24], esi
jb 0x10054f9c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10149646
add esp, 4
cmp dword [esp + 0x68], esi
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
jb 0x10054fbf
mov edx, dword [esp + 0x54]
push edx
call fcn.10149646
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10149c5e
add esp, 0x40
ret 0x30
Function at 0x1005c3f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x34]
ja 0x1005c402
or eax, 0xffffffff
pop esi
ret 4
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call ebp
sub eax, dword [esi + 0x58]
cmp eax, 0x20
jbe 0x1005c419
add dword [esi + 0x54], 1
call ebp
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.1005c250
mov edi, eax
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1005c44a
mov ecx, dword [esi + 0x48]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1005c44f
call fcn.10149775
mov eax, dword [esi + 0x44]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
lea ebx, [edi*8]
sub ebx, edi
add ebx, ebx
add ebx, ebx
add eax, ebx
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
call ebp
mov ebp, eax
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1005c4a2
mov ecx, dword [esi + 0x48]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1005c4a7
call fcn.10149775
mov edx, dword [esi + 0x44]
mov dword [ebx + edx + 0x10], ebp
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1005c4d1
mov ecx, dword [esi + 0x48]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1005c4d6
call fcn.10149775
mov eax, dword [esi + 0x44]
mov ebp, 1
mov dword [eax + ebx + 0x14], ebp
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1005c505
mov ecx, dword [esi + 0x48]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1005c50a
call fcn.10149775
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x54]
mov dword [ecx + ebx + 0x18], edx
add dword [esi + 0x34], ebp
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
ret 4
Function at 0x1005f090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1016f0c8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x101b01e4]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x20], eax
xor eax, eax
mov ebx, ecx
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], eax
mov byte [esp + 0x68], al
mov dword [esp + 0x8c], eax
lea eax, [ebx + 8]
mov dword [esp + 0x2c], eax
add eax, 4
push eax
mov dword [esp + 0x2c], 0x1018442c
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [ebx + 0x28]
mov eax, dword [eax]
mov ecx, dword [ebx + 0x28]
lea esi, [ebx + 0x24]
mov ebp, esi
mov edi, eax
mov byte [esp + 0x8c], 1
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], ecx
jmp 0x1005f130
test ebp, ebp
je 0x1005f138
cmp ebp, esi
je 0x1005f13d
call fcn.10149775
cmp edi, dword [esp + 0x34]
je 0x1005f211
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x1005f1eb
cmp byte [esp + 0x94], 0
je 0x1005f1d5
test ebp, ebp
jne 0x1005f172
call fcn.10149775
cmp edi, dword [ebp + 4]
jne 0x1005f17c
call fcn.10149775
lea ecx, [esp + 0x38]
push ecx
lea ecx, [edi + 0x28]
call fcn.100371f0
mov dword [esp + 0x24], eax
cmp edi, dword [ebp + 4]
mov byte [esp + 0x8c], 2
jne 0x1005f19f
call fcn.10149775
lea edx, [esp + 0x54]
push edx
lea ecx, [edi + 0x28]
call fcn.10063b60
push eax
mov eax, dword [esp + 0x28]
push eax
mov ecx, ebx
call fcn.1005ecb0
cmp dword [esp + 0x50], 0x10
mov byte [esp + 0x8c], 1
jb 0x1005f1d5
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.10149646
add esp, 4
lea ecx, [esp + 0x18]
call fcn.1005dfe0
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
jmp 0x1005f130
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [esp + 0x7c], 0x10
jb 0x1005f20a
mov eax, dword [esp + 0x68]
push eax
call fcn.10149646
add esp, 4
mov eax, 2
jmp 0x1005f25b
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
push edx
mov ecx, esi
call fcn.1005edc0
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [eax], eax
mov eax, dword [esp + 0x14]
mov esi, dword [esi + 4]
push eax
mov dword [esi + 8], esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [esp + 0x7c], 0x10
jb 0x1005f256
mov ecx, dword [esp + 0x68]
push ecx
call fcn.10149646
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.10149c5e
add esp, 0x7c
ret 8
Function at 0x10061f10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016f326
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x101861e0
mov eax, dword [edi + 0x34]
mov ecx, dword [eax]
lea esi, [edi + 0x30]
push eax
push esi
push ecx
push esi
lea eax, [esp + 0x24]
push eax
mov ecx, esi
mov dword [esp + 0x38], 1
call fcn.10061a60
mov eax, dword [esi + 4]
push eax
call fcn.10149646
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x28]
mov ecx, dword [eax]
add esp, 4
lea esi, [edi + 0x24]
push eax
push esi
push ecx
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov byte [esp + 0x38], bl
call fcn.1005f660
mov edx, dword [esi + 4]
push edx
call fcn.10149646
add esp, 4
lea eax, [edi + 0xc]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push eax
mov dword [edi + 8], 0x1018458c
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
mov dword [edi + 8], 0x10186684
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x10063530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1016f517
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x101b01e4]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x1b0]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c0]
mov ebp, dword [esp + 0x1c4]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
mov dword [esp + 0x28], ebp
call fcn.10071bd0
mov ecx, eax
call fcn.10071bd0
cmp dword [esp + 0x1c], 3
je 0x100635e9
push 0x10
xor esi, esi
push str.invalid_cache___
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], esi
mov byte [esp + 0x4c], 0
call fcn.10001fe0
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x110]
mov dword [esp + 0x1bc], esi
call fcn.10002490
push 0x1018f208
lea eax, [esp + 0x110]
push eax
call fcn.10149808
lea ecx, [esp + 0x134]
call fcn.10063b80
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 4]
lea esi, [ebp + 0x24]
mov ebx, 1
push edx
mov ecx, esi
mov dword [esp + 0x1bc], ebx
call fcn.1005edc0
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
xor ecx, ecx
mov dword [esi + 8], ecx
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
cmp dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
jle 0x10063763
add ebp, 0x30
lea esp, [esp]
lea eax, [esp + 0x134]
push eax
push edi
call fcn.10063f20
add esp, 8
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x138]
call fcn.10063b00
mov edx, dword [eax]
mov dword [esp + 0x74], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x78], ecx
mov edx, dword [eax + 8]
mov dword [esp + 0x7c], edx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x80], ecx
mov edx, dword [eax + 0x10]
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x88], edx
call fcn.1005ef10
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x6c]
push edx
mov ecx, esi
mov byte [esp + 0x1c0], 2
call fcn.10061340
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1b8], bl
call fcn.10063be0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x138]
call fcn.10063d10
lea ecx, [esp + 0x134]
push ecx
push eax
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1c0], 3
call fcn.1005f5e0
push eax
lea edx, [esp + 0x60]
push edx
mov ecx, ebp
mov byte [esp + 0x1c0], 4
call fcn.10061440
lea ecx, [esp + 0x74]
mov byte [esp + 0x1b8], 3
call fcn.1005ed50
cmp dword [esp + 0x3c], 0x10
mov byte [esp + 0x1b8], bl
jb 0x10063736
mov eax, dword [esp + 0x28]
push eax
call fcn.10149646
add esp, 4
mov eax, dword [esp + 0x14]
add eax, ebx
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
mov dword [esp + 0x14], eax
jl 0x10063640
mov ebp, dword [esp + 0x20]
mov ecx, ebp
call fcn.10061fd0
lea ecx, [esp + 0x134]
mov dword [esp + 0x1b8], 0xffffffff
call fcn.10063be0
mov eax, edi
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.10149c5e
add esp, 0x1a8
ret
Function at 0x100637b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016f566
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea eax, [esi + 0xc]
mov dword [esi], 0x101861e0
push eax
mov dword [esi + 8], 0x1018458c
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
lea edi, [esi + 0x24]
mov ecx, edi
mov dword [esp + 0x18], 0
call fcn.1005e7d0
mov dword [edi + 4], eax
mov byte [eax + 0xa1], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], 0
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.1005e810
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [edi + 4], eax
mov byte [eax + 0xa9], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], 0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x10063c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016f5eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
mov dword [esi], 0x101861dc
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0xc], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x10], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x14], edx
mov eax, dword [eax + 0x10]
mov edx, dword [esp + 0x2c]
xor ebx, ebx
push ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
call fcn.10149d08
add esp, 4
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
lea ecx, [esi + 0x2c]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.10001ec0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov dword [esi + 0x48], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x58]
mov dword [esi + 0x54], edx
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x24], ebx
mov byte [ecx + 4], bl
call fcn.10001ec0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x18