joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4735f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0xc], 0
mov esi, dword [esp + 0x30]
je 0x449f51
mov eax, dword [edi + 8]
cmp byte [eax + 0x21], 0
je 0x449f51
lea ebp, [eax + 8]
push ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
lea eax, [esp + 0x30]
push eax
xor ebx, ebx
push esi
push ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
call fcn.00403730
mov esi, eax
cmp esi, ebx
jne 0x449ea0
push str.._vsocket.cpp_:_WriteExact:_DSMPlugin_RestoreBuffer_Alloc_Error_n
push 4
push 0x490660
call fcn.00401810
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x449f0b
mov ecx, dword [esp + 0x30]
test ecx, ecx
mov ebx, ecx
jle 0x449ee2
lea ebx, [ebx]
push ecx
push esi
mov ecx, edi
call fcn.00449df0
test eax, eax
jle 0x449ecb
mov ecx, dword [esp + 0x30]
add esi, eax
sub ecx, eax
mov dword [esp + 0x30], ecx
jmp 0x449ede
je 0x449f21
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x449f2b
mov ecx, dword [esp + 0x30]
test ecx, ecx
jg 0x449eb0
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edi + 8]
push ebx
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x3c], ebx
call fcn.00403760
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
push str.._vsocket.cpp_:_zero_bytes_read1_n
jmp 0x449e86
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.._vsocket.cpp_:_socket_error_1:__d_n
push 4
push 0x490660
call fcn.00401810
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x449f0b
test esi, esi
jbe 0x449f08
mov ebx, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ebp, dword [esp + 0x2c]
nop
push esi
push ebp
mov ecx, edi
call fcn.00449df0
test eax, eax
jle 0x449f73
add ebp, eax
sub esi, eax
jmp 0x449f82
je 0x449f88
call ebx
cmp eax, 0x2733
jne 0x449e9c
test esi, esi
ja 0x449f60
jmp 0x449f08
push str.._vsocket.cpp_:_zero_bytes_read2_n
push 4
push 0x490660
call fcn.00401810
add esp, 0xc
xor eax, eax
jmp 0x449f0b

Function at 0x44a180
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov dword [esp + 4], 1
jl 0x44a197
call fcn.00449700
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 4], eax
jge 0x44a1af
xor eax, eax
pop esi
pop ecx
ret
push edi
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0xffff
push eax
call edi
test eax, eax
je 0x44a1d1
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 1
push 6
push eax
call edi
neg eax
sbb eax, eax
neg eax
pop edi
sub eax, 1
pop esi
pop ecx
ret
Function at 0x44ab50
Capabilities:
Check if file exists
Check mutex on windows
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x473719
mov eax, dword fs:[0]
push eax
sub esp, 0x554
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x550], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 0x568]
mov dword fs:[0], eax
push str.GlobalWinVNC
xor ebx, ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
cmp esi, ebx
jne 0x44ad51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44ad51
push str.GlobalWinVNC
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.004099f0
call fcn.0043c630
push str..winvnc.cpp_:__DBG___WinVNCAPPMain_n
push 9
push 0x490660
call fcn.00401810
push 4
call fcn.0045c2ef
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x570], ebx
je 0x44ac05
mov ecx, eax
call fcn.0040e4f0
mov esi, eax
mov dword [esp + 0x14], esi
jmp 0x44ac0b
mov dword [esp + 0x14], ebx
mov esi, ebx
or edi, 0xffffffff
mov ecx, esi
mov dword [esp + 0x570], edi
call fcn.00434af0
test eax, eax
je 0x44ad6b
lea ecx, [esp + 0x1c]
call fcn.00446dd0
mov eax, dword [str.RealLive]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x574], 1
call fcn.00442fb0
push str..winvnc.cpp_:_server_created_ok_n
push ebx
push 0x490660
call fcn.00401810
mov ecx, dword [0x4aaaa4]
add esp, 0xc
push str.GlobalSessionEventUltra
push ebx
push 0x1f0003
mov dword [esp + 0x550], ecx
call dword [sym.imp.KERNEL32.dll_OpenEventA]
cmp eax, ebx
mov dword [0x4aaaa8], eax
je 0x44ac88
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str..winvnc.cpp_:__SDEvent_created__n
push ebx
push 0x490660
call fcn.00401810
add esp, 0xc
mov dword [0x4aa6a4], edi
call fcn.0044a7b0
cmp byte [0x4aaaa2], 0
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x44ad06
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x24]
push eax
push 0x44a7f0
push 0
push 0
call edi
mov esi, eax
push 0xffffffffffffffff
push esi
call ebx
push esi
call ebp
push str..winvnc.cpp_:__Closing_Imp_Thread_n
push 0
push 0x490660
call fcn.00401810
add esp, 0xc
cmp byte [0x4aaaa2], 0
je 0x44acc1
mov esi, dword [esp + 0x14]
or edi, 0xffffffff
test esi, esi
je 0x44ad1a
mov ecx, esi
call fcn.00434ae0
push esi
call fcn.0045c39e
add esp, 4
mov eax, dword [0x4aaaa8]
test eax, eax
je 0x44ad26
push eax
call ebp
push str..winvnc.cpp_:__SHUTING_DOWN_SERVER__n
push 0
push 0x490660
call fcn.00401810
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x570], edi
call fcn.004462e0
mov eax, 1
jmp 0x44ad6d
push str..winvnc.cpp_:__Err___Mutex_already_exists__eixt____n
push ebx
push 0x490660
call fcn.00401810
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x568]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x550]
xor ecx, esp
call fcn.0045c20d
add esp, 0x560
ret
Function at 0x45bcc0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
xor eax, eax
cmp dword [ecx + 0x28], eax
jne 0x45bcd8
cmp dword [ecx + 0x2c], eax
jne 0x45bcd8
mov dword [ecx + 0x34], eax
add esp, 4
jmp fcn.0045bbd0
mov byte [esp + 3], al
push 0x489998
lea eax, [esp + 7]
push eax
call fcn.0045c3d2
int3

Function at 0x45c20d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48ea40]
jne 0x45c217
repz ret
jmp fcn.004612b8
Function at 0x4607bb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4607f8
cmp dword [ebp + 0x14], edi
je 0x4607f8
cmp ecx, edi
jne 0x4607ff
call fcn.00462881
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0045cf50
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x460813
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x460834
cmp ebx, 0xffffffff
je 0x460823
push ebx
push edi
push ecx
call fcn.0045c220
add esp, 0xc
cmp esi, edi
je 0x4607e0
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4607e0
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x460850
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x460857
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x460948
test word [esi + 0xc], 0x10c
je 0x4608ab
mov eax, dword [esi + 4]
test eax, eax
je 0x4608ab
jl 0x4609a9
cmp ebx, eax
mov edi, ebx
jb 0x46087c
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x460950
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0045cc10
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x460940
cmp ebx, dword [ebp - 0xc]
jb 0x460918
cmp dword [ebp - 0xc], 0
je 0x4608d5
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x4608ca
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4608d1
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4608e0
mov eax, closesocket
cmp ebx, eax
ja 0x4608e0
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x46097c
push eax
push dword [ebp - 8]
push esi
call fcn.00467a7d
pop ecx
push eax
call fcn.0046a4d3
add esp, 0xc
test eax, eax
je 0x4609bb
cmp eax, 0xffffffff
je 0x4609a9
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x460940
push esi
call fcn.00469df2
cmp eax, 0xffffffff
pop ecx
je 0x4609ad
cmp dword [ebp - 4], 0
je 0x46097c
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x46085f
mov eax, dword [ebp + 0x14]
jmp 0x4607fa
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x460967
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0045c220
add esp, 0xc
call fcn.00462881
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4607f0
cmp dword [ebp + 0xc], 0xffffffff
je 0x460992
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0045c220
add esp, 0xc
call fcn.00462881
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4607f0
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4607fa
or dword [esi + 0xc], 0x10
jmp 0x4609ad
Function at 0x464c10
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x48f500]
je 0x464c2b
inc edi
cmp edi, 0x17
jb 0x464c1c
cmp edi, 0x17
jae 0x464dab
push ebp
push 3
call fcn.0046ba66
cmp eax, 1
pop ecx
je 0x464d77
push 3
call fcn.0046ba66
test eax, eax
pop ecx
jne 0x464c5f
cmp dword [0x48ed18], 1
je 0x464d77
cmp ebx, 0xfc
je 0x464daa
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4aaef8
push ebp
call fcn.004639f6
add esp, 0xc
test eax, eax
je 0x464c95
push esi
push esi
push esi
push esi
push esi
call fcn.0045ce54
add esp, 0x14
push 0x104
mov esi, 0x4aaf11
push esi
push 0
mov byte [0x4ab015], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x464cd9
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004639f6
add esp, 0xc
test eax, eax
je 0x464cd9
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045ce54
add esp, 0x14
push esi
call fcn.00463a60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x464d1e
push esi
call fcn.00463a60
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4ab20c
push 0x484874
sub ecx, eax
push ecx
push eax
call fcn.0046b5b6
add esp, 0x14
test eax, eax
je 0x464d1e
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0045ce54
add esp, 0x14
jmp 0x464d20
xor esi, esi
push 0x484870
push ebx
push ebp
call fcn.0046b4fa
add esp, 0xc
test eax, eax
je 0x464d40
push esi
push esi
push esi
push esi
push esi
call fcn.0045ce54
add esp, 0x14
push dword [edi*8 + 0x48f504]
push ebx
push ebp
call fcn.0046b4fa
add esp, 0xc
test eax, eax
je 0x464d62
push esi
push esi
push esi
push esi
push esi
call fcn.0045ce54
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0046b8a9
add esp, 0xc
jmp 0x464daa
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x464daa
cmp ebp, 0xffffffff
je 0x464daa
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x48f504]
push dword [esi]
call fcn.00463a60
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x46b8a9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00461732
xor ebx, ebx
cmp dword [0x4ab508], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x46b97f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x46ba5f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x46ba5f
push eax
call fcn.004616c4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ab508], eax
call esi
push eax
call fcn.004616c4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ab50c], eax
call esi
push eax
call fcn.004616c4
mov dword [0x4ab510], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0045ef24
test eax, eax
pop ecx
pop ecx
je 0x46b94d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045ce54
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x46b97f
push 0x485a14
push edi
call esi
push eax
call fcn.004616c4
cmp eax, ebx
pop ecx
mov dword [0x4ab518], eax
je 0x46b97f
push 0x4859fc
push edi
call esi
push eax
call fcn.004616c4
pop ecx
mov dword [0x4ab514], eax
mov eax, dword [0x4ab514]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x46ba04
cmp dword [0x4ab518], ecx
je 0x46ba04
push eax
call fcn.0046173b
push dword [0x4ab518]
mov esi, eax
call fcn.0046173b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x46ba04
cmp edi, ebx
je 0x46ba04
call esi
cmp eax, ebx
je 0x46b9d1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46b9d1
test byte [ebp - 0x18], 1
jne 0x46ba04
lea eax, [ebp - 0x10]
push eax
call fcn.0045ef5b
test eax, eax
pop ecx
je 0x46b9ec
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045ce54
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x46b9fb
or dword [ebp + 0x10], 0x200000
jmp 0x46ba3f
or dword [ebp + 0x10], 0x40000
jmp 0x46ba3f
mov eax, dword [0x4ab50c]
cmp eax, dword [ebp - 8]
je 0x46ba3f
push eax
call fcn.0046173b
cmp eax, ebx
pop ecx
je 0x46ba3f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x46ba3f
mov eax, dword [0x4ab510]
cmp eax, dword [ebp - 8]
je 0x46ba3f
push eax
call fcn.0046173b
cmp eax, ebx
pop ecx
je 0x46ba3f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ab508]
call fcn.0046173b
cmp eax, ebx
pop ecx
je 0x46ba5f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46ba61
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xb8d2988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.100064c0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.10001a00
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x100065e2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10035dbb
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xb8d435b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10030ca0
mov edx, dword [esp + 0xb4]
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x18
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x64
lea eax, [esp + 0x44]
push eax
push edx
mov dword [esp + 0xb8], 0
mov dword [esi], 0xb8dbce8
mov dword [esi + 0x2740], edx
call fcn.10014ec0
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x2710]
push 0xb8d7810
push edx
call fcn.10001830
xor eax, eax
mov byte [esp + 0x24], 0
mov ecx, 0xc
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x2740]
stosb byte es:[edi], al
push 0x32
lea eax, [esp + 0x28]
push eax
push ecx
call fcn.10014f50
lea edx, [esp + 0x30]
push edx
lea eax, [esi + 0x2714]
push 0xb8d7810
push eax
call fcn.10001830
mov ecx, dword [esp + 0xd4]
add esp, 0x30
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xa8
ret 4

Function at 0x10035e9b
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xb8d435b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10030ca0
mov edx, dword [esp + 0xb4]
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x18
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x64
lea eax, [esp + 0x44]
push eax
push edx
mov dword [esp + 0xb8], 0
mov dword [esi], 0xb8dbcf0
mov dword [esi + 0x2740], edx
call fcn.10014ec0
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x2710]
push 0xb8d7810
push edx
call fcn.10001830
xor eax, eax
mov byte [esp + 0x24], 0
mov ecx, 0xc
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x2740]
stosb byte es:[edi], al
push 0x32
lea eax, [esp + 0x28]
push eax
push ecx
call fcn.10014f50
lea edx, [esp + 0x30]
push edx
lea eax, [esi + 0x2714]
push 0xb8d7810
push eax
call fcn.10001830
mov ecx, dword [esp + 0xd4]
add esp, 0x30
mov dword [esi + 0x273c], 9
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xa8
ret 4
Function at 0x10035f8b
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xb8d435b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10030ca0
mov edx, dword [esp + 0xb4]
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x18
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x64
lea eax, [esp + 0x44]
push eax
push edx
mov dword [esp + 0xb8], 0
mov dword [esi], 0xb8dbcf8
mov dword [esi + 0x2740], edx
call fcn.10014ec0
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x2710]
push 0xb8d7810
push edx
call fcn.10001830
xor eax, eax
mov byte [esp + 0x24], 0
mov ecx, 0xc
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x2740]
stosb byte es:[edi], al
push 0x32
lea eax, [esp + 0x28]
push eax
push ecx
call fcn.10014f50
lea edx, [esp + 0x30]
push edx
lea eax, [esi + 0x2714]
push 0xb8d7810
push eax
call fcn.10001830
mov ecx, dword [esp + 0xd4]
add esp, 0x30
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xa8
ret 4

Function at 0x1003606b
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xb8d435b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10030ca0
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x18
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x64
lea eax, [esp + 0x44]
push eax
push 0x47c
mov dword [esp + 0xb8], 0
mov dword [esi], 0xb8dbd68
call fcn.10014ec0
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x2710]
push 0xb8d7810
push edx
call fcn.10001830
xor eax, eax
mov byte [esp + 0x24], 0
mov ecx, 0xc
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x32
lea eax, [esp + 0x28]
push eax
push 0x47c
call fcn.10014f50
lea ecx, [esp + 0x30]
push ecx
lea edx, [esi + 0x2714]
push 0xb8d7810
push edx
call fcn.10001830
mov ecx, dword [esp + 0xd4]
add esp, 0x30
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xa8
ret
Function at 0x1003613b
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xb8d435b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10030ca0
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x18
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x64
lea eax, [esp + 0x44]
push eax
push 0x47d
mov dword [esp + 0xb8], 0
mov dword [esi], 0xb8dbd70
call fcn.10014ec0
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x2710]
push 0xb8d7810
push edx
call fcn.10001830
xor eax, eax
mov byte [esp + 0x24], 0
mov ecx, 0xc
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x32
lea eax, [esp + 0x28]
push eax
push 0x47d
call fcn.10014f50
lea ecx, [esp + 0x30]
push ecx
lea edx, [esi + 0x2714]
push 0xb8d7810
push edx
call fcn.10001830
mov ecx, dword [esp + 0xd4]
add esp, 0x30
mov dword [esi + 0x1b4], 0x47d
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xa8
ret

Function at 0x100363fb
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xb8d435b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10030ca0
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x18
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x64
lea eax, [esp + 0x44]
push eax
push 0x47e
mov dword [esp + 0xb8], 0
mov dword [esi], 0xb8dbdf0
call fcn.10014ec0
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x2710]
push 0xb8d7810
push edx
call fcn.10001830
xor eax, eax
mov byte [esp + 0x24], 0
mov ecx, 0xc
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x32
lea eax, [esp + 0x28]
push eax
push 0x47e
call fcn.10014f50
lea ecx, [esp + 0x30]
push ecx
lea edx, [esi + 0x2714]
push 0xb8d7810
push edx
call fcn.10001830
mov ecx, dword [esp + 0xd4]
add esp, 0x30
mov dword [esi + 0x1b4], 0x47e
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xa8
ret