joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b4840
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6790
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b48b9
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b48ed
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b48ed
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b48ed
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100c8d90
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f67b0
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b4934
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b495d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b495d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b4986
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b4986
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b4986
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b4a30
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f67d0
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b4ad6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b4ad6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b4ad6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b4b80
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xe
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6824
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b4c26
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b4c26
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b4c26
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b4d20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xe
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6844
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b4d99
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b4dcd
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b4dcd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b4dcd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100ca570
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xe
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6864
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b4e14
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b4e3d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b4e3d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b4e66
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b4e66
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b4e66
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b4f10
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xe
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6884
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b4fb6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b4fb6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b4fb6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b50b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xe
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f68a4
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b5129
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b515d
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b515d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b515d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100c99a0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xe
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f68c4
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b51a4
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b51cd
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b51cd
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b51f6
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b51f6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b51f6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b52a0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f68e4
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b5346
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b5346
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b5346
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b5440
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6900
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b54b9
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b54ed
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b54ed
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b54ed
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100cab50
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xd
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f691c
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b5534
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b555d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b555d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b5586
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b5586
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b5586
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b5630
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6938
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b56d6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b56d6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b56d6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b57d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6958
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b5849
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b587d
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b587d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b587d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100cb130
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6978
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b58c4
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b58ed
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b58ed
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b5916
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b5916
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b5916
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b59c0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f69d8
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b5a66
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b5a66
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b5a66
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b5b60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f69f8
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b5bd9
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b5c0d
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b5c0d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b5c0d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100cb710
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6a18
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b5c54
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b5c7d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b5c7d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b5ca6
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b5ca6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b5ca6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b5d50
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e21a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ecx + 4]
push eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6a38
mov word [ecx], ax
call fcn.10001df0
lea ecx, [esp + 0x30]
call fcn.100b04a0
add esp, 0x18
mov dword [esp + 0x2c], 0
mov ecx, dword [eax]
call fcn.100b02c0
mov dword [esp + 0x28], 0xffffffff
mov bl, al
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b5df6
or edi, 0xffffffff
lea edx, [esi + 4]
mov ecx, edi
lock xadd dword [edx], ecx
jne 0x100b5df6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b5df6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b5ef0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10115034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6a50
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x18]
call fcn.100b04a0
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [esi + 0x1c]
call fcn.100c6700
test al, al
je 0x100b5f69
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100b5f9d
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b5f9d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x100b5f9d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebx + 4]
call fcn.100cbcf0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f6a68
mov word [ecx], ax
call fcn.10001df0
lea ecx, [ebp - 0x20]
call fcn.100b04a0
add esp, 0x18
mov esi, dword [eax]
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x100b5fe4
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x100b600d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100b600d
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100b6036
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x100b6036
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x100b6036
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4